v1.18.0

This release introduces sandbox mode for the MCP server, confining it to a single workspace directory, along with a set of security hardening changes across the MCP tool surface and remote repository processing!

What's New 🚀

MCP Sandbox Mode (#1753, #1754)

The MCP server can now be confined to a single workspace directory with the --sandbox flag:

# Confine to the current working directory
repomix --mcp --sandbox

# Confine to a specific directory
repomix --mcp --sandbox path/to/project

By default the MCP server can read any path the host user can, which is convenient for a trusted local assistant but too broad when the server is exposed to an untrusted client or agent, such as when embedding Repomix in a hosted application. In sandbox mode:

• Every path is relative to the workspace root. Absolute paths, ~, .., and Windows drive/UNC paths are refused, and paths that resolve outside the root (including through symlinks) are dropped.
• Results and error messages are virtualized, so host paths are never exposed.
• Only the read-only, root-confined tools are registered: pack_codebase, read_repomix_output, grep_repomix_output, file_system_read_file, and file_system_read_directory. Remote packing, skill generation, and attaching external outputs are disabled.

This is an application-level confinement of the tool surface, not an OS-level sandbox: when hosting the server for untrusted clients, still run it under your platform's usual isolation (containers, dedicated users).

See MCP Server – Sandbox Mode for details.

Special thanks to @huy-trn for designing and implementing this feature. Great to have a long-time contributor back! 🎉

Security Hardening 🔒

MCP File System Tools Are Now Sandbox-Only

The file_system_read_file and file_system_read_directory tools are now registered only in sandbox mode. Outside --sandbox they could read any path the process can, while their built-in Secretlint scan was presented as more protection than it provides: it recognizes known secret formats in file content, and nothing else. In sandbox mode the workspace root gives these tools a real access boundary, with the secret scan kept as an additional heuristic safeguard.

If your MCP setup relied on these two tools, add --sandbox [dir] to the server arguments to keep using them, confined to that workspace.

Tool descriptions and documentation have also been reworded across the board to describe the Secretlint scan as what it is: a best-effort content heuristic, not an access boundary.

See the security advisory for details. Thanks to @rafaelfiguereod-stack for the report! 🙏
GHSA-rpmv-562j-qxrv

Credentials in Repository URLs Are Redacted Before Logging

Remote URLs are routinely written with credentials inline (https://<token>@github.com/owner/repo.git), especially in CI. Repomix previously echoed such URLs as-is into console output, trace logs, error messages (git repeats the full command line in its failure output), and the MCP pack_remote_repository response, persisting the credential in terminal scrollback, CI build logs, and log aggregation systems. All of these paths now redact userinfo credentials and known credential query parameters (token, private_token, access_token, and similar) before the URL is written anywhere.

See the security advisory for details. Thanks to @kakashi-kx for the report! 🙏
GHSA-w8cw-mgw9-74h7

Cloud Metadata Endpoints Are Refused as Clone Targets

Remote packing now refuses to clone from cloud instance metadata endpoints (169.254.0.0/16, fd00:ec2::254, 100.100.100.200, metadata.google.internal), which serve credentials and host no git repository. Through the MCP server an AI agent chooses the URL, so an injected instruction could otherwise aim a clone at an address the user never asked for. Private networks (RFC1918) remain allowed, since cloning from self-hosted git servers is normal.

How to Update

npm update -g repomix

---

As always, if you have any issues or suggestions, please let us know on GitHub issues or our Discord community.

v1.17.0

This release introduces custom file processors, an interactive confirmation before a remote repository's config is trusted, and per-file inclusion levels for the MCP pack tools!

What's New 🚀

Custom File Processors (#1720, #933)

You can now run an external command on matching files before they are packed, so the packed output contains the transformed content. This opens the door to token-saving conversions like JSON→TOON, SVG minification, or notebook→script conversion.

{
  "input": {
    "processors": [
      { "pattern": "**/*.json", "command": "npx @toon-format/cli {file}" }
    ]
  }
}

Each entry is { pattern, command, timeout?, onError? }, matched the same way as include / ignore and evaluated in array order (first match wins, one processor per file). The required {file} placeholder is replaced with a temporary copy of the file, and the command's stdout becomes the new content, which then flows through the security check, token counting, and output like any other file.

• timeout: per-command timeout in ms (default 60000)
• onError: "fail" (default, aborts the pack) or "skip" (warn and keep the original content)

Because processors run arbitrary commands, execution is default-deny: they run only when you invoke the repomix CLI directly. The library API, the MCP server, and the hosted website never run them, and a cloned remote repository's processors are honored only with --remote-trust-config. Active processors are printed at startup.

See File Processors for details.

Confirm Before Trusting a Remote Repository's Config (#1747)

A repomix.config.* is code, not just data: a .ts / .js config is executed when loaded, input.processors runs external commands, and path options can read files outside the repository. A cloned repository's config is still never loaded by default, but when you opt in with --remote-trust-config, Repomix now shows you the config that is about to run and asks before loading it:

⚠ user/repo ships a config file that will be trusted: repomix.config.json
  A trusted config can run arbitrary commands (input.processors) and read local files.
────────────────────────────────────────────────────────────────────────
| { "output": { "style": "xml" } }
────────────────────────────────────────────────────────────────────────

? Trust and run this config from user/repo? It can run arbitrary commands on your machine.
❯ Yes, once
  Yes, and don't ask again for this repository
  No, do not run

"Don't ask again" is pinned to the config's contents, so you are asked again if that repository later ships a different one, the same model as direnv allow. The safe answer is the default, and the displayed config is escaped and capped so a repository cannot repaint your terminal or hide part of what you are approving.

Note

REPOMIX_REMOTE_TRUST_CONFIG=true now prompts on an interactive terminal. Non-interactive shells such as CI are unchanged and keep trusting the config as before, so existing automation keeps working. Passing --force also skips the prompt.

Thanks to @nuc13us and @sumo166, whose reports on how much --remote-trust-config hands over prompted this work and the accompanying documentation. 🙏

MCP: Per-File Inclusion Levels for Pack Tools (#1719, #608)

The pack_codebase and pack_remote_repository MCP tools now accept an outputPatterns parameter, so an AI agent can decide per file whether to include full content, compressed content, or the directory structure only, on a per-call basis.

This is especially useful for remote repositories: a remote repository's own config (including its output.patterns) is never loaded, so outputPatterns is the way to control inclusion levels there.

See MCP Server for details.

Improvements ⚡

Split Output for Repositories with One Oversized Directory (#1724, #1134)

repomix --split-output 1mb failed with Cannot split output: root entry 'src' exceeds max size on any repository where a single top-level directory was larger than the part limit — a common layout. Oversized directories are now subdivided instead of aborting.

Special thanks to @serhiizghama for this contribution! 🎉

Markdown Output Fixes

• Language hints are now resolved for extensionless filenames in subdirectories (for example docs/Makefile), instead of falling back to no hint. (#1727)
• Code fences are widened so a git diff containing a triple-backtick block can no longer break out of its fence. (#1725)

Special thanks to @serhiizghama for these contributions! 🎉

Correct Output-File Ignoring on Windows (#1748)

Repomix excludes its own output file from packing, but the ignore pattern used the OS separator while the matcher expects forward slashes. On Windows, a nested output path such as --output docs/out.xml therefore never matched and the output file was packed into itself on the next run. The pattern is now normalized to POSIX separators.

Special thanks to @serhiizghama for this contribution! 🎉

Skip Legacy Config Migration for Remote Repositories (#1726)

Packing a remote repository that still ships legacy Repopack config files triggered an interactive migration prompt and rewrote files inside the temporary clone. Remote runs now skip migration entirely.

Special thanks to @ShiroKSH for their first contribution! 🎉

Documentation 📚

The trust model for --remote-trust-config is now documented explicitly (#1746, #1747): what a trusted config can do, what the confirmation prompt protects against, and where the "don't ask again" decision is stored, including the limits of that pin. See Remote Repository Config Trust.

How to Update

npm update -g repomix

---

As always, if you have any issues or suggestions, please let us know on GitHub issues or our Discord community.

v1.16.1

This release is a bug-fix patch: it plugs a WebAssembly memory leak, extends comment removal to more JavaScript/TypeScript module files, and fixes the token count tree for underscore-prefixed directories and the directory tree on Windows. Updating to 1.16.1 is recommended for all users.

Improvements ⚡

Fixed a WebAssembly Memory Leak (#1681)

Parsed web-tree-sitter Tree objects were not released after use, leaking WebAssembly heap memory when parsing or compressing many files — noticeable on large repositories. Each tree is now freed right after parsing, keeping memory usage stable.

Special thanks to @isaka1022 for their first contribution! 🎉

Comment Removal for More Module Files (#1683)

--remove-comments now strips comments from JavaScript/TypeScript module files that were previously skipped — .mjs, .cjs, .mts, .cts, and their JSX variants .mjsx / .mtsx.

repomix --remove-comments

Special thanks to @serhiizghama for this contribution! 🎉

Token Count Tree: Count Underscore-Prefixed Directories (#1710)

Directories whose names start with an underscore (for example __tests__ or __mocks__) were dropped from the --token-count-tree output and excluded from the token totals. They are now rendered and counted like any other directory.

repomix --token-count-tree

Special thanks to @serhiizghama for this contribution! 🎉

Correct Directory Tree and File Ordering on Windows (#1712)

On Windows, the <directory_structure> section collapsed into a flat list of full paths and file sorting fell back to a plain string comparison, because already-normalized (/-separated) paths were being split on the OS separator (\). Paths are now normalized before splitting, so the tree nests correctly and files sort in directory-aware order on every platform.

Special thanks to @serhiizghama for this contribution! 🎉

How to Update

npm update -g repomix

---

As always, if you have any issues or suggestions, please let us know on GitHub issues or our Discord community.

v1.16.0

This release adds per-file inclusion levels via output.patterns for fine-grained control over how each file is packed, a new cwd-relative output path style, and a --skill-project-name option, along with compression-robustness and file-matching fixes.

What's New 🚀

Per-file Inclusion Levels (output.patterns) (#1653, #608)

You can now control the detail level per glob from your configuration file. output.patterns is an ordered array of { pattern, compress?, directoryStructureOnly? } entries; the first matching glob wins and overrides the global output.compress for that file. Each file resolves to one of three levels:

• Full content (default)
• Compressed (compress: true) — passed through the same Tree-sitter pipeline as output.compress
• Directory-structure-only (directoryStructureOnly: true) — listed in the directory structure, but its content is omitted

For example, compress docs/** while reducing website/** to structure only:

{
  "output": {
    "compress": false,
    "patterns": [
      { "pattern": "docs/**/*", "compress": true },
      { "pattern": "website/**/*", "directoryStructureOnly": true }
    ]
  }
}

This option is config-file only. See Per-file Inclusion Levels.

Special thanks to @PAMulligan for designing and implementing this feature! 🎉

cwd-relative Output Path Style (#1646)

A new output path style renders file paths relative to the current working directory instead of the target directory — handy for multi-root runs and clearer paths. Set output.filePathStyle: "cwd-relative" in your config, or pass --output-file-path-style cwd-relative (default remains target-relative).

Special thanks to @Samsen879 for this contribution! 🎉

--skill-project-name Option (#1649)

Skill generation now exposes a --skill-project-name option so you can set the project name explicitly.

Special thanks to @WilliamK112 for this contribution! 🎉

Improvements ⚡

• --compress is now resilient: a single file that Tree-sitter cannot parse — including pathological files that trigger a WASM runtime abort — no longer aborts the whole pack. It falls back to uncompressed output with a warning, and the rest of the run completes normally (#1679, #1668).
• File extensions are now matched case-insensitively when selecting the comment manipulator, so files like .PY or .TS are handled correctly (#1632).
• Split-output files are now copied correctly after remote packing (#1631).

Special thanks to @serhiizghama and @Samsen879 for these fixes! 🎉

How to Update

npm update -g repomix

---

As always, if you have any issues or suggestions, please let us know on GitHub issues or our Discord community.

v1.15.0

This release adds Watch Mode for continuous re-packing, GitHub shorthand auto-detection so you can run repomix owner/repo without --remote, and a --token-budget guard for CI and agent workflows, along with several ignore-handling fixes.

What's New 🚀

Watch Mode (-w, --watch) (#1643, #1647, #1429)

Repomix can now watch your codebase and automatically re-pack on every change. New, changed, and deleted files are detected, rapid bursts are debounced (300 ms), and a timestamp is printed after each rebuild. Press Ctrl+C to stop. Watch mode honors your usual ignore rules (.gitignore, .repomixignore, default patterns, --ignore) and skips ignored directories to stay efficient on large projects. It is local-only, so it cannot be combined with --remote, --stdout, --stdin, --split-output, --skill-generate, or --copy. See the new Watch Mode guide.

Special thanks to @PAMulligan for designing and implementing the entire watch mode feature! 🎉

GitHub Shorthand Auto-Detection (#1628, #1120)

You can now run repomix owner/repo directly, without the --remote flag. When the argument matches the owner/repo shorthand and no local path of that name exists, Repomix probes GitHub (a lightweight HEAD-only check) and packs the remote repository if it is reachable. A matching local path always wins; prefix with ./ to force local handling.

Special thanks to @serhiizghama for this contribution! 🎉

--token-budget <number> Guard (#1621, #1616)

A new --token-budget option exits with a non-zero code when the packed output exceeds N tokens. The output is still generated; only the exit code signals the overflow, making it a useful guard in CI pipelines and agent workflows to keep output within a target model's context window.

Improvements ⚡

• Fixed .gitignore handling edge cases: ignored .gitignore rules stay active, trailing-slash ignore-control patterns no longer leak the file, and descendants of a directory literally named .gitignore are excluded (#1622, #624).
• Fixed duplicate relative paths when packing multiple roots (#1618).
• Updated root dependencies, including major bumps to v15 (#1641).

Special thanks to @Samsen879 for the ignore-handling and multi-root fixes! 🎉

How to Update

npm update -g repomix

---

As always, if you have any issues or suggestions, please let us know on GitHub issues or our Discord community.

v1.14.1

This release patches two security advisories and continues the performance work from v1.14.0 with a persistent token-count cache, plus expanded Dart parsing and Nix support. Updating to 1.14.1 is recommended for all users.

Security 🔒

Argument Injection via --remote-branch (GHSA-9mm9-rqhj-j5mx)

A crafted --remote-branch value could be passed to git as an option rather than a ref, enabling argument injection (CWE-88, High). Repomix now validates refs and inserts --end-of-options before the ref in git fetch and git checkout, so a branch value can never be interpreted as a git option.

Special thanks to @kakashi-kx (Abhijith S) for the responsible disclosure! 🎉

MCP attach_packed_output Secret-Scan Bypass (GHSA-hwpp-h97w-2h3j)

The MCP attach_packed_output flow could register an arbitrary local file and read it back through read_repomix_output / grep_repomix_output without the secret scan that file_system_read_file applies (CWE-200, Moderate). Those tools now run the same secret scan on attach-sourced files before returning content, closing the bypass.

Special thanks to @dodge1218 for the responsible disclosure! 🎉

Improvements ⚡

Expanded Dart Code Parsing (#1515)

The Dart Tree-sitter query now captures mixins, typedefs, getters, setters, and factory constructors. Compressed output (--compress) for Dart files now preserves more of the file's structure.

Content-Addressed Token-Count Disk Cache (#1562, #1580)

Token counts are now cached on disk, keyed by content hash. Re-packing a repository reuses counts for unchanged files instead of re-tokenizing them, and the eager metrics warm-up is skipped when the cache is already populated — speeding up repeated runs on the same repository.

Faster Binary Detection (#1542)

Repomix now attempts a UTF-8 decode before the binary-file check, avoiding a pathological slow path in the protobuf detector on certain inputs.

Node.js Support Update (#1556)

Node.js 20 is no longer supported and Node.js 26 is now supported. Repomix requires Node.js 22 or later.

Available on nixpkgs

Repomix is available in nixpkgs, so Nix users can install it directly:

nix-shell -p repomix

Development 🛠️

Nix Flake with Development Shell (#1525)

Added a flake.nix providing a development shell (Node.js 24 + Git) for contributors using Nix:

nix develop

How to Update

npm update -g repomix

---

As always, if you have any issues or suggestions, please let us know on GitHub issues or our Discord community.

v1.14.0

This release is a major performance overhaul — packing the Repomix repository now takes about 1.4 seconds (down from 3.3 seconds in v1.13.1) — roughly 2.4× faster, a 58% reduction. Faster startup, lighter dependencies, and a smarter pipeline that overlaps work across stages.

What's New 🚀

Monorepo-Aware Tech Stack Detection (#1310, #1317)

The skill generator (--skill-generate) now detects dependency files in subdirectories and groups results by package directory. Monorepos with packages under packages/*/package.json, apps/*/package.json, etc. now produce a tech-stacks.md with a separate section per workspace, each listing its own languages, frameworks, dependencies, and runtime versions. Previously only the root-level dependency file was inspected.

Improvements ⚡

The 58% pack-time reduction is the cumulative result of dozens of optimizations across startup, the pipeline, worker IPC, and remote downloads — no single change accounts for the full speedup. The most impactful changes are highlighted below.

Replaced tiktoken WASM with gpt-tokenizer (#1350)

Token counting now uses gpt-tokenizer, a pure-JavaScript tokenizer, in place of the previous WASM-based tiktoken. This eliminates ~200 ms of WASM initialization overhead from startup and works in environments where WASM is restricted. Token counts are preserved — gpt-tokenizer is configured to match tiktoken's default behavior.

Eliminated Child Process in Default Action (#1372)

The default repomix action no longer spawns a child process for the main pack flow. This removes process startup overhead — most noticeable on smaller repositories where startup was a meaningful fraction of total time.

Wrapper-Extraction Fast Path for Token Counting (-13.2%) (#1457)

For non-parsable XML/Markdown/Plain output, Repomix now reuses per-file token counts and tokenizes only the output "wrapper" (header, separators, footer) instead of re-tokenizing the entire ~MB-scale output. This delivers a ~13% reduction in total pack time on typical repositories.

Pipeline Parallelization

The pack pipeline now overlaps stages that don't depend on each other:

• Security check and file processing run concurrently (#1359)
• Output generation overlaps with metrics calculation (#1359)
• Git sort data is prefetched alongside file search and collection (#1467)
• Wrapper tokenization runs in parallel with file metrics (#1469)
• CLI actions are lazy-loaded so each command imports only what it needs (#1346)

Faster Startup

• Removed Zod from the startup path (#1306)
• Lazy-loaded handlebars, fast-xml-builder, and @clack/prompts (#1436)
• Lazy-loaded jschardet and iconv-lite for encoding detection (#1401)
• Removed gpt-tokenizer from the config schema's import chain (#1500)
• Skipped the worker pool when only lightweight transforms are needed (#1338)
• Eliminated a redundant stat() syscall in file reading (#1400)

Worker & IPC Optimizations

• Batched token counting IPC (#1411)
• Batched security check tasks (#1380)
• Warmed up metrics worker threads in parallel (#1374)
• Capped security worker threads at 2 to reduce contention (#1409)
• Cached empty-directory paths across pipeline stages (#1356)
• Combined file and directory globby walks into a single traversal (#1506)

Faster Remote Repository Downloads

• Used codeload.github.com URLs directly to skip the 302 redirect (#1375)
• Skipped binary files during tar extraction (#1392)

@secretlint/profiler Overhead Removed (-6.5%)

Disabling the profiler in the security worker reduced pack time by ~6.5% (#1453). A follow-up patch to perf_hooks.performance.mark handles duplicate @secretlint/profiler singletons that survive across hoisted/nested copies (#1456).

How to Update

npm update -g repomix

---

As always, if you have any issues or suggestions, please let us know on GitHub issues or our Discord community.

v1.13.1

This release fixes a false positive in base64 detection and brings a lighter clipboard dependency!

Bug Fixes 🐛

Fixed Base64 Detection False Positives (#1307, #1298)

The truncateBase64 feature was incorrectly truncating XPath and path-like strings (e.g., postTransactionAmounts/sharesOwnedFollowingTransaction/value) that contained only letters and / characters.

Two improvements were made:

• Raised the minimum standalone base64 detection threshold from 60 to 256 characters
• Added a digits requirement to the heuristic — real base64-encoded binary data virtually always contains digits, while path-like strings typically don't

Special thanks to @NaustudentX14 for the detailed bug report! 🎉

Improvements ⚡

Migrated to tinyclip for Clipboard Operations (#1296)

Replaced clipboardy with tinyclip, a zero-dependency clipboard library. This removes 41 transitive dependencies and reduces clipboard-related install size from ~4 MB to ~24 KB.

Special thanks to @florian-lefebvre for their first contribution! 🎉

How to Update

npm update -g repomix

---

As always, if you have any issues or suggestions, please let us know on GitHub issues or our Discord community.

v1.13.0

This release strengthens security with remote config sandboxing and a cleaner dependency footprint, while delivering significant performance improvements across the core pipeline!

What's New 🚀

Prevent Remote Config File Execution (#1292)

Previously, when packing a remote repository, Repomix would automatically load and execute any repomix.config.ts or repomix.config.js found in the repository. Since TypeScript/JavaScript configs are executed via jiti, a malicious repository could embed arbitrary code in its config file, leading to remote code execution (RCE) on the user's machine.

Remote config files are now skipped by default. If you trust a remote repository and want to use its config, you can opt in with the new --remote-trust-config flag:

# Remote config is now safely ignored by default
repomix --remote https://github.com/user/repo

# Explicitly trust the remote config
repomix --remote https://github.com/user/repo --remote-trust-config

Improvements ⚡

Replace fast-xml-parser with fast-xml-builder (#1253, #1219)

Repomix only uses XMLBuilder for output generation, not the XML parser. Switched to fast-xml-builder directly to eliminate recurring CVEs from the parser side, bringing npm audit to 0 vulnerabilities and reducing dependency size from 831KB to 176KB.

Performance Optimizations (#1234, #1235, #1255)

Several performance improvements across the core pipeline:

• File tree generation: Map-based O(1) child lookups and single-pass sorting — generateFileTree ~82% faster, treeToString ~70% faster on 10,000 files
• Path sorting: Decorate-sort-undecorate pattern with pre-computed path.split() — 6-7x faster. Set.has() for filterOutUntrustedFiles — up to 30x faster at 10K files
• Compile cache propagation: V8 compile cache (introduced in v1.12.0) now extends to Tinypool worker processes via environment variables, not just the main process

Fix Closure Memory Leaks (#1233)

Replaced arrow functions with .bind() in setTimeout/setInterval callbacks to prevent closures from capturing scope and retaining references to large objects. Added proper dispose() methods and .unref() calls for cleanup.

Website Enhancements 🌐

Turkish Language Support (#1194)

Added Turkish (Türkçe) translation to repomix.com, based on Google Analytics data showing strong engagement from Turkish-speaking users.

LLMO Optimization with JSON-LD and llms.txt (#1236)

Added JSON-LD structured data (schema.org WebSite and SoftwareApplication markup) and generated llms.txt/llms-full.txt for LLM-friendly documentation discovery.

How to Update

npm update -g repomix

---

As always, if you have any issues or suggestions, please let us know on GitHub issues or our Discord community.

v1.12.0

This release brings significant performance improvements across the board—faster startup, optimized file collection, and reduced package size—along with a smoother CLI experience for remote repositories!

What's New 🚀

Auto-detect Remote URLs Without --remote Flag (#1145)

You can now pass GitHub URLs directly as positional arguments without the --remote flag:

# Before
repomix --remote https://github.com/user/repo

# Now also works!
repomix https://github.com/user/repo

The CLI automatically detects explicit remote URLs (GitHub, GitLab, Bitbucket, etc.) in positional arguments and treats them as remote repository targets.

Improvements ⚡

Node.js Module Compile Cache for Faster Startup (#1181)

Enabled Node.js V8 compile cache (available in Node.js 22.8.0+) for approximately 10% faster startup time. The compiled module cache is stored automatically and speeds up subsequent launches.

Optimized File Collection with UTF-8 Fast Path (#1155)

Improved file collection performance with two key optimizations:

• UTF-8 fast path: Skips expensive encoding detection for files that are valid UTF-8, which covers the vast majority of source code files
• Promise pool: Replaced worker threads with a lightweight promise pool for better concurrency control

Streaming tar.gz Extraction for Remote Repositories (#1153)

Replaced ZIP archive download with streaming tar.gz extraction for remote repository operations:

• Better handling of large repositories

Smaller npm Package (#1092)

Removed unused source maps from the npm package, reducing lib/ size from 2.4MB to 1.2MB (~50% reduction).

Bug Fixes 🐛

Skip Retry on Archive Extraction Error (#1149)

Fixed an issue where archive extraction errors would trigger unnecessary retries. Extraction errors are now treated as non-retryable, providing faster error feedback.

How to Update

npm update -g repomix

---

As always, if you have any issues or suggestions, please let us know on GitHub issues or our Discord community.