Repropack

Turn a failing command into a redacted, ready-to-review reproduction report.

repropack -- npm run build

Repropack streams the command normally, captures its result, adds system/project/Git context, redacts common sensitive values, and writes Markdown and JSON reports. It runs locally and does not upload anything.

Repropack is currently a beta. Automatic redaction is best-effort; review every report before sharing it.

Requirements

• Node.js 20 or newer
• Linux, macOS, or Windows

Quick start

Run without installing:

npx repropack-cli -- npm test

Or install it in a project:

npm install --save-dev repropack-cli
npx repropack -- npm test

Build and run it locally:

cd /home/faisal/Documents/Codex/2026-08-14/i-w
npm install
npm run build
node dist/cli.js -- npm test

Usage

Write both report formats to ./reports:

node dist/cli.js --output ./reports --format both -- npm test

Generated files:

reports/repropack-report.md
reports/repropack-report.json

Preview a redacted Markdown report without writing files or echoing the raw child output:

node dist/cli.js --preview --format markdown -- npm test

Stop a command after 30 seconds and still create a report:

node dist/cli.js --timeout 30 -- npm test

Usage: repropack [options] <command...>

Options:
  -o, --output <directory>  report output directory
  -f, --format <format>     markdown, json, or both
  --preview                 print a redacted report without writing files
  --timeout <seconds>       stop the command after this many seconds
  -V, --version             show the version
  -h, --help                show help

Use -- before the wrapped command so its flags are not interpreted as Repropack flags.

What is collected

• Command and arguments
• Captured stdout and stderr
• Exit code, signal, duration, and timeout status
• OS, architecture, and Node.js version
• Available package-manager versions
• Package name/version and lockfile names
• Git commit, branch, and modified filenames

Repropack does not read .env files, source contents, Git diffs, credential directories, or shell history. Combined captured output is limited to 2 MiB; live terminal output is not limited.

Redaction

The redactor covers:

• Values of environment variables whose names indicate secrets
• Authorization and cookie headers
• JWTs
• Common API-key formats
• Passwords embedded in URLs
• Email addresses
• Linux, macOS, and Windows home-directory usernames

Repeated values receive stable aliases such as <email-1>. Sensitive environment values are used only in memory to find matching output and are not copied directly into reports.

Redaction cannot recognize every application-specific secret. See SECURITY.md for the threat model and limitations.

Exit codes

| Code | Meaning | | ---: | --- | | 0 | Wrapped command succeeded and the report was produced | | Wrapped code | Wrapped command failed; its exit code is preserved | | 124 | Repropack stopped the command after --timeout | | 127 | Wrapped executable was not found | | 1 | Repropack usage, collection, or report-writing error |

Demo

npm run build
cd examples/failing-project
node ../../dist/cli.js --output ./reports --format both -- npm run build

The demo intentionally exits with code 1 and produces a report under examples/failing-project/reports.

Development

npm install
npm run check

npm run check performs strict type checking, runs the test suite, and creates the production build. npm pack runs the same checks through the prepack safeguard.

Current limitations

• Redaction is heuristic and not a security guarantee.
• Normal mode shows the child process's original output in the terminal. Use --preview when the terminal output itself should be suppressed.
• Commands requiring a full TTY UI may not behave like ordinary non-interactive commands.
• Timeouts terminate the direct child process; complex programs may leave independently detached descendants.
• Package-manager and Git collection are intentionally shallow.

License

MIT