update

lua/plugins/lsp.lua

@@ -7,18 +7,38 @@ return {
   config = function()
     local capabilities = require("cmp_nvim_lsp").default_capabilities()
 
-    -- Load project-local LSP settings from .nvim.lua
+    -- Load trusted project-local LSP settings from .nvim.lua.
     local function load_project_lsp_settings(server_name, root_dir)
       if not root_dir then
         return {}
       end
+
       local config_file = root_dir .. "/.nvim.lua"
-      if vim.fn.filereadable(config_file) == 1 then
-        local ok, project_config = pcall(dofile, config_file)
-        if ok and project_config and project_config.lsp and project_config.lsp[server_name] then
-          return project_config.lsp[server_name]
-        end
+      if vim.fn.filereadable(config_file) ~= 1 then
+        return {}
       end
+
+      local contents = vim.secure.read(config_file)
+      if not contents then
+        return {}
+      end
+
+      local chunk, load_error = load(contents, "@" .. config_file, "t")
+      if not chunk then
+        vim.notify("Invalid project config: " .. load_error, vim.log.levels.WARN)
+        return {}
+      end
+
+      local ok, project_config = pcall(chunk)
+      if not ok then
+        vim.notify("Failed to load project config: " .. project_config, vim.log.levels.WARN)
+        return {}
+      end
+
+      if project_config and project_config.lsp and project_config.lsp[server_name] then
+        return project_config.lsp[server_name]
+      end
+
       return {}
     end