v1.17.0

This release introduces custom file processors, an interactive confirmation before a remote repository's config is trusted, and per-file inclusion levels for the MCP pack tools!

## What's New 🚀

### Custom File Processors (#1720, #933)

You can now run an external command on matching files **before** they are packed, so the packed output contains the transformed content. This opens the door to token-saving conversions like JSON→TOON, SVG minification, or notebook→script conversion.

```json5
{
  "input": {
    "processors": [
      { "pattern": "**/*.json", "command": "npx @toon-format/cli {file}" }
    ]
  }
}
```

Each entry is `{ pattern, command, timeout?, onError? }`, matched the same way as `include` / `ignore` and evaluated in array order (first match wins, one processor per file). The required `{file}` placeholder is replaced with a temporary copy of the file, and the command's stdout becomes the new content, which then flows through the security check, token counting, and output like any other file.

- `timeout`: per-command timeout in ms (default `60000`)
- `onError`: `"fail"` (default, aborts the pack) or `"skip"` (warn and keep the original content)

Because processors run **arbitrary commands**, execution is default-deny: they run only when you invoke the repomix CLI directly. The library API, the MCP server, and the hosted website never run them, and a cloned remote repository's processors are honored only with `--remote-trust-config`. Active processors are printed at startup.

See [File Processors](https://repomix.com/guide/configuration#file-processors) for details.

### Confirm Before Trusting a Remote Repository's Config (#1747)

A `repomix.config.*` is code, not just data: a `.ts` / `.js` config is executed when loaded, `input.processors` runs external commands, and path options can read files outside the repository. A cloned repository's config is still never loaded by default, but when you opt in with `--remote-trust-config`, Repomix now shows you the config that is about to run and asks before loading it:

```
⚠ user/repo ships a config file that will be trusted: repomix.config.json
  A trusted config can run arbitrary commands (input.processors) and read local files.
────────────────────────────────────────────────────────────────────────
| { "output": { "style": "xml" } }
────────────────────────────────────────────────────────────────────────

? Trust and run this config from user/repo? It can run arbitrary commands on your machine.
❯ Yes, once
  Yes, and don't ask again for this repository
  No, do not run
```

"Don't ask again" is pinned to the config's contents, so you are asked again if that repository later ships a different one, the same model as `direnv allow`. The safe answer is the default, and the displayed config is escaped and capped so a repository cannot repaint your terminal or hide part of what you are approving.

> [!NOTE]
> **`REPOMIX_REMOTE_TRUST_CONFIG=true` now prompts on an interactive terminal.** Non-interactive shells such as CI are unchanged and keep trusting the config as before, so existing automation keeps working. Passing `--force` also skips the prompt.

Thanks to @nuc13us and @sumo166, whose reports on how much `--remote-trust-config` hands over prompted this work and the accompanying documentation. 🙏

### MCP: Per-File Inclusion Levels for Pack Tools (#1719, #608)

The `pack_codebase` and `pack_remote_repository` MCP tools now accept an `outputPatterns` parameter, so an AI agent can decide per file whether to include full content, compressed content, or the directory structure only, on a per-call basis.

This is especially useful for remote repositories: a remote repository's own config (including its `output.patterns`) is never loaded, so `outputPatterns` is the way to control inclusion levels there.

See [MCP Server](https://repomix.com/guide/mcp-server) for details.

## Improvements ⚡

### Split Output for Repositories with One Oversized Directory (#1724, #1134)

`repomix --split-output 1mb` failed with `Cannot split output: root entry 'src' exceeds max size` on any repository where a single top-level directory was larger than the part limit — a common layout. Oversized directories are now subdivided instead of aborting.

Special thanks to @serhiizghama for this contribution! 🎉

### Markdown Output Fixes

- Language hints are now resolved for extensionless filenames in subdirectories (for example `docs/Makefile`), instead of falling back to no hint. (#1727)
- Code fences are widened so a git diff containing a triple-backtick block can no longer break out of its fence. (#1725)

Special thanks to @serhiizghama for these contributions! 🎉

### Correct Output-File Ignoring on Windows (#1748)

Repomix excludes its own output file from packing, but the ignore pattern used the OS separator while the matcher expects forward slashes. On Windows, a nested output path such as `--output docs/out.xml` therefore never matched and the output file was packed into itself on the next run. The pattern is now normalized to POSIX separators.

Special thanks to @serhiizghama for this contribution! 🎉

### Skip Legacy Config Migration for Remote Repositories (#1726)

Packing a remote repository that still ships legacy Repopack config files triggered an interactive migration prompt and rewrote files inside the temporary clone. Remote runs now skip migration entirely.

Special thanks to @ShiroKSH for their first contribution! 🎉

## Documentation 📚

The trust model for `--remote-trust-config` is now documented explicitly (#1746, #1747): what a trusted config can do, what the confirmation prompt protects against, and where the "don't ask again" decision is stored, including the limits of that pin. See [Remote Repository Config Trust](https://repomix.com/guide/security#remote-repository-config-trust).

## How to Update

```bash
npm update -g repomix
```

---

As always, if you have any issues or suggestions, please let us know on GitHub issues or our [Discord community](https://discord.gg/wNYzTwZFku).