Repository navigation
[idea] Auto-source per-project .nvim.lua on DirChanged #284
Description
What
An autocmd that sources a .nvim.lua file from the project root whenever Neovim changes directory, enabling project-specific overrides without touching the global config.
Why it fits this setup
The config already uses lcd for per-window project roots and has vim.keymap.set("n", "<leader>e", ":edit **/*") for project-relative navigation. A .nvim.lua loader makes the project-root concept actionable: each repo can carry its own LSP tweaks, formatter choices, makeprg values, or iskeyword adjustments.
Sketch
-- add to options.lua or a new lua/config/project.lua
local function load_project_config()
local root = vim.fn.getcwd()
local nvim_lua = root .. "/.nvim.lua"
if vim.fn.filereadable(nvim_lua) == 1 then
-- sandbox: only source if the file is owned by the current user
local stat = vim.uv.fs_stat(nvim_lua)
if stat then
pcall(dofile, nvim_lua)
end
end
end
vim.api.nvim_create_autocmd({ "DirChanged", "VimEnter" }, {
callback = load_project_config,
})Example .nvim.lua in a project
-- project root .nvim.lua
vim.opt_local.makeprg = "cargo build 2>&1"
vim.lsp.enable("rust_analyzer")
-- disable pyright for this non-Python repo
vim.lsp.enable("pyright", false)Security note
Only source files owned by the current user (check via vim.uv.fs_stat uid or vim.fn.getfperm), and consider a vim.fn.confirm() prompt on first load (like vim's exrc with secure). Neovim's own exrc / 'secure' options do this for .nvim.lua natively since 0.9 — worth checking if simply enabling vim.o.exrc = true is sufficient before implementing a custom loader.
Activity
stanfish06 commentedon Oct 19, 2026
Heads-up for whoever implements this: Neovim shipped a security fix relevant to this exact feature.
CVE-2026-11487 — a local command-injection bug in
vim.secure.read()'s trust-prompt handling (runtime/lua/vim/secure.lua): hitting "View" on the trust prompt for an untrustedexrc/.nvim.luacould lead to arbitrary Ex-command execution via unescaped path expansion. Affects Neovim 0.12.0–0.12.2, fixed in 0.12.3 (commitf83e0dcaf8cf18de94828341b0a1a61a86c75baf, PR neovim/neovim#39918).Auto-sourcing per-project
.nvim.luaonDirChanged(this issue's ask) would exercise exactly this trust-prompt code path on every untrusted directory change, so whatever implementation lands here should either depend on Neovim ≥0.12.3 or document the minimum version in the PR description. Not blocking, just worth folding into the design before someone writes the autocmd.(This repo's
init.luadoesn't declare a repo-wide minimum Neovim version — only a per-modulemin = "0.13"gate forconfig.image— so there's no existing guard to lean on here.)Generated by Claude Code