repomix

This release introduces custom file processors, an interactive confirmation before a remote repository's config is trusted, and per-file inclusion levels for the MCP pack tools!

What's New 🚀

Custom File Processors (#1720, #933)

You can now run an external command on matching files before they are packed, so the packed output contains the transformed content. This opens the door to token-saving conversions like JSON→TOON, SVG minification, or notebook→script conversion.

{
  "input": {
    "processors": [
      { "pattern": "**/*.json", "command": "npx @toon-format/cli {file}" }
    ]
  }
}

Each entry is { pattern, command, timeout?, onError? }, matched the same way as include / ignore and evaluated in array order (first match wins, one processor per file). The required {file} placeholder is replaced with a temporary copy of the file, and the command's stdout becomes the new content, which then flows through the security check, token counting, and output like any other file.

• timeout: per-command timeout in ms (default 60000)
• onError: "fail" (default, aborts the pack) or "skip" (warn and keep the original content)

Because processors run arbitrary commands, execution is default-deny: they run only for real local CLI invocations. The library API, the MCP server, and the hosted website never run them, and a cloned remote repository's processors are honored only with --remote-trust-config. Active processors are printed at startup.

See File Processors for details.

Confirm Before Trusting a Remote Repository's Config (#1747)

A repomix.config.* is code, not just data: a .ts / .js config is executed when loaded, input.processors runs external commands, and path options can read files outside the repository. A cloned repository's config is still never loaded by default, but when you opt in with --remote-trust-config, Repomix now shows you the config that is about to run and asks before loading it:

⚠ user/repo ships a config file that will be trusted: repomix.config.json
  A trusted config can run arbitrary commands (input.processors) and read local files.
────────────────────────────────────────────────────────────────────────
| { "output": { "style": "xml" } }
────────────────────────────────────────────────────────────────────────

? Trust and run this config from user/repo? It can run arbitrary commands on your machine.
❯ Yes, once
  Yes, and don't ask again for this repository
  No, do not run

"Don't ask again" is pinned to the config's contents, so you are asked again if that repository later ships a different one, the same model as direnv allow. The safe answer is the default, and the displayed config is escaped and capped so a repository cannot repaint your terminal or hide part of what you are approving.

[!NOTE]
REPOMIX_REMOTE_TRUST_CONFIG=true now prompts on an interactive terminal. Non-interactive shells such as CI are unchanged and keep trusting the config as before, so existing automation keeps working. Passing --force also skips the prompt.

Thanks to @nuc13us and @sumo166, whose reports on how much --remote-trust-config hands over prompted this work and the accompanying documentation. 🙏

MCP: Per-File Inclusion Levels for Pack Tools (#1719, #608)

The pack_codebase and pack_remote_repository MCP tools now accept an outputPatterns parameter, so an AI agent can decide per file whether to include full content, compressed content, or the directory structure only, on a per-call basis.

This works for remote repositories too, where config-file discovery does not apply because untrusted remote configs are skipped.

Improvements ⚡

Split Output for Repositories with One Oversized Directory (#1724, #1134)

repomix --split-output 1mb failed with Cannot split output: root entry 'src' exceeds max size on any repository where a single top-level directory was larger than the part limit, which is most real projects. Oversized directories are now subdivided instead of aborting.

Special thanks to @serhiizghama for this contribution! 🎉

Markdown Output Fixes (#1727, #1725)

• Language hints are now resolved for extensionless filenames in subdirectories (for example docs/Makefile), instead of falling back to no hint.
• Code fences are widened so a git diff containing a triple-backtick block can no longer break out of its fence.

Special thanks to @serhiizghama for these contributions! 🎉

Correct Output-File Ignoring on Windows (#1748)

Repomix excludes its own output file from packing, but the ignore pattern used the OS separator while the matcher expects forward slashes. On Windows, a nested output path such as --output docs/out.xml therefore never matched and the output file was packed into itself on the next run. The pattern is now normalized to POSIX separators.

Special thanks to @serhiizghama for this contribution! 🎉

Skip Legacy Config Migration for Remote Repositories (#1726)

Packing a remote repository that still ships legacy Repopack config files triggered an interactive migration prompt and rewrote files inside the temporary clone. Remote runs now skip migration entirely.

Special thanks to @ShiroKSH for their first contribution! 🎉

Documentation 📚

The trust model for --remote-trust-config is now documented explicitly (#1746, #1747): what a trusted config can do, what the confirmation prompt protects against, and where the "don't ask again" decision is stored, including the limits of that pin. See Remote Repository Config Trust.

How to Update

npm update -g repomix

As always, if you have any issues or suggestions, please let us know on GitHub issues or our Discord community.