provide-module local-kakrc %—
    declare-option -docstring %{
        Path to the list of trusted directories.
        List must be a text file with one path per line.
        Defaults to %exp{%val{config}/local_kakrc_trusted.txt}
    } str local_kakrc_trusted %exp{%val{config}/local_kakrc_trusted.txt}
    declare-option -docstring %{
        Whether to automatically load .kakrc if it's trusted.
        Otherwise, you must load manually with local-kakrc-load-if-trusted.
    } bool local_kakrc_autoload false
    declare-option -docstring %{
        Whether to use 'notify-send' for notifications.
    } bool local_kakrc_notify_send false

    # ensures that the file exists
    define-command -hidden local-kakrc-ensure-file %{
        nop %sh{
            file="$kak_opt_local_kakrc_trusted"
            dir="$(dirname "$file")"
            if [ ! -f "$file" ]; then
                [ ! -d "$dir" ] || mkdir -p "$dir"
                base="$(basename "$file")"
                # add to gitignore by default
                printf '%s\n' "$base" >>"$dir/.gitignore"
                touch "$file"
            fi
        }
    }

    define-command -docstring %{
        Local the .kakrc if it exists and is trusted.
        If it exists but isn't trusted, notify the user.
    } local-kakrc-load-if-trusted %{
        evaluate-commands %sh{
            # first we check if the .kakrc exists
            if [ -f .kakrc ]; then
                # check if it's trusted
                if grep -qFx "$PWD" "$kak_opt_local_kakrc_trusted"; then
                    echo "source .kakrc"
                else
                    # notify otherwise
                    msg="Local .kakrc found, but directory is untrusted."
                    if [ "$kak_opt_local_kakrc_notify_send" = "false" ]; then
                        printf "info -title 'local-kakrc' '%s'\n" "$msg"
                    else
                        notify-send -h string:title:local-kakrc "$msg"
                    fi
                fi
            fi
        }
    }

    define-command -docstring %{
        local-kakrc-add-trusted [<dir>]: Trust a directory. If none is
        provided, the current directory is used.
    } -params 0..1 local-kakrc-add-trusted %{
        evaluate-commands %sh{
            # process arg (if any)
            if [ "$#" -eq 0 ]; then
                arg="$PWD"
            else
                arg="$(realpath "$1")"
            fi
            # ensure the file exists
            echo "local-kakrc-ensure-file">"$kak_command_fifo"
            # notify user
            msg="Adding $arg to trust list"
            if [ "$kak_opt_local_kakrc_notify_send" = "false" ]; then
                printf "info -title 'local-kakrc' '%s'\n" "$msg"
            else
                notify-send -h string:title:local-kakrc "$msg"
            fi
            # append to trust list
            printf '%s\n' "$arg">>"$kak_opt_local_kakrc_trusted"
        }
    }

    define-command -docstring %{
        local-kakrc-add-trusted [<dir>]: Untrust a directory. If none is
        provided, the current directory is used.
    } -params 0..1 local-kakrc-rm-trusted %{
        evaluate-commands %sh{
            # process arg (if any)
            if [ "$#" -eq 0 ]; then
            	arg="$PWD"
            else
            	arg="$(realpath "$1")"
            fi
            # fail if no trust list
            # (no point creating an empty one if it doesn't exist)
            if [ ! -f "$kak_opt_local_kakrc_trusted" ]; then
            	echo "fail local_kakrc_trusted not found!"
            	exit 1
            fi
            # create temp file
            temp="$(mktemp)"
            touch "$temp"
            # check if given path is in file
            if grep -qFx "$arg" "$kak_opt_local_kakrc_trusted"; then
                # perform removal
                grep -vxF "$arg" "$kak_opt_local_kakrc_trusted" >"$temp"
                mv -f "$temp" "$kak_opt_local_kakrc_trusted"
            else
                # notify user of failure
                msg="No such trusted directory!"
                if [ "$kak_opt_local_kakrc_notify_send" = "false" ]; then
                    printf "info -title 'local-kakrc' '%s'\n" "$msg"
                else
                    notify-send -h string:title:local-kakrc "$msg"
                fi
                # clean up unused temp file
                rm "$temp" 2>/dev/null
            fi
        }
    }
    # define completions for command
    complete-command local-kakrc-rm-trusted shell-script-candidates %{
        cat "$kak_opt_local_kakrc_trusted"
    }

    # define completions
    complete-command local-kakrc-add-trusted shell-script-candidates %{
        # any non-".git" directory is valid
        find . -type d -name .git -prune -o -type d -print |
        	awk -F/ '$0 != "." { sub("^./", "", $0); print }'
    }
    
    # set up syntax highlighting for .kakrc files
    hook global BufCreate (.*/)?(\.kakrc) %{
        set-option buffer filetype kak
    }

    # register autoloading hook
    hook global -once KakBegin .* %{
        # only attempt loading if option is set
        evaluate-commands %sh{
            if [ "$kak_opt_local_kakrc_autoload" = 'true' ]; then
                local-kakrc-load-if-trusted
            fi
        }
    }
—