docs(release): Add v1.18.0 release notes

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-09-19 06:00:49 +08:00 · 2026-08-08 13:30:52 +09:00
parent a27ecec777
commit 6bc6cd918b
1 changed files with 61 additions and 0 deletions
@@ -0,0 +1,61 @@
+This release introduces sandbox mode for the MCP server, confining it to a single workspace directory, along with a set of security hardening changes across the MCP tool surface and remote repository processing!
+
+## What's New 🚀
+
+### MCP Sandbox Mode (#1753, #1754)
+
+The MCP server can now be confined to a single workspace directory with the `--sandbox` flag:
+
+```bash
+# Confine to the current working directory
+repomix --mcp --sandbox
+
+# Confine to a specific directory
+repomix --mcp --sandbox path/to/project
+```
+
+By default the MCP server can read any path the host user can, which is convenient for a trusted local assistant but too broad when the server is exposed to an untrusted client or agent, such as when embedding Repomix in a hosted application. In sandbox mode:
+
+- Every path is relative to the workspace root. Absolute paths, `~`, `..`, and Windows drive/UNC paths are refused, and paths that resolve outside the root (including through symlinks) are dropped.
+- Results and error messages are virtualized, so host paths are never exposed.
+- Only the read-only, root-confined tools are registered: `pack_codebase`, `read_repomix_output`, `grep_repomix_output`, `file_system_read_file`, and `file_system_read_directory`. Remote packing, skill generation, and attaching external outputs are disabled.
+
+This is an application-level confinement of the tool surface, not an OS-level sandbox: when hosting the server for untrusted clients, still run it under your platform's usual isolation (containers, dedicated users).
+
+See [MCP Server – Sandbox Mode](https://repomix.com/guide/mcp-server#sandbox-mode) for details.
+
+Special thanks to @huy-trn for designing and implementing this feature. Great to have a long-time contributor back! 🎉
+
+## Security Hardening 🔒
+
+### MCP File System Tools Are Now Sandbox-Only
+
+The `file_system_read_file` and `file_system_read_directory` tools are now registered **only in sandbox mode**. Outside `--sandbox` they could read any path the process can, while their built-in Secretlint scan was presented as more protection than it provides: it recognizes known secret formats in file content, and nothing else. In sandbox mode the workspace root gives these tools a real access boundary, with the secret scan kept as an additional heuristic safeguard.
+
+If your MCP setup relied on these two tools, add `--sandbox [dir]` to the server arguments to keep using them, confined to that workspace.
+
+Tool descriptions and documentation have also been reworded across the board to describe the Secretlint scan as what it is: a best-effort content heuristic, not an access boundary.
+
+See the security advisory for details. Thanks to @rafaelfiguereod-stack for the report! 🙏
+https://github.com/yamadashy/repomix/security/advisories/GHSA-rpmv-562j-qxrv
+
+### Credentials in Repository URLs Are Redacted Before Logging
+
+Remote URLs are routinely written with credentials inline (`https://<token>@github.com/owner/repo.git`), especially in CI. Repomix previously echoed such URLs as-is into console output, trace logs, error messages (git repeats the full command line in its failure output), and the MCP `pack_remote_repository` response, persisting the credential in terminal scrollback, CI build logs, and log aggregation systems. All of these paths now redact userinfo credentials and known credential query parameters (`token`, `private_token`, `access_token`, and similar) before the URL is written anywhere.
+
+See the security advisory for details. Thanks to @kakashi-kx for the report! 🙏
+https://github.com/yamadashy/repomix/security/advisories/GHSA-w8cw-mgw9-74h7
+
+### Cloud Metadata Endpoints Are Refused as Clone Targets
+
+Remote packing now refuses to clone from cloud instance metadata endpoints (`169.254.0.0/16`, `fd00:ec2::254`, `100.100.100.200`, `metadata.google.internal`), which serve credentials and host no git repository. Through the MCP server an AI agent chooses the URL, so an injected instruction could otherwise aim a clone at an address the user never asked for. Private networks (RFC1918) remain allowed, since cloning from self-hosted git servers is normal.
+
+## How to Update
+
+```bash
+npm update -g repomix
+```
+
+---
+
+As always, if you have any issues or suggestions, please let us know on GitHub issues or our [Discord community](https://discord.gg/wNYzTwZFku).