@hienlh/ppm 0.13.13 → 0.13.15

package/CHANGELOG.md

@@ -1,9 +1,19 @@
 # Changelog
 
+## [0.13.15] - 2026-04-24
+
+### Fixed
+- **File compare with absolute paths**: Comparing files outside the project (e.g. `/tmp/`) no longer fails with "Path traversal not allowed" — absolute paths now use `readSystemFile` instead of project-scoped read
+
+## [0.13.14] - 2026-04-24
+
+### Fixed
+- **DB CLI run multi-statement**: PostgreSQL `ppm db run` now splits SQL into individual statements and executes within `sql.begin()` transaction. Handles strings, comments, dollar-quoting. Strips user-supplied `BEGIN`/`COMMIT`/`ROLLBACK` to avoid conflicts with managed transaction
+
 ## [0.13.13] - 2026-04-24
 
 ### Added
-- **DB CLI run command**: `ppm db run <name> <file.sql>` executes SQL files against saved connections. Supports multi-statement files and transactions (`BEGIN...COMMIT`). Respects readonly flag. Works with both SQLite (`db.exec()`) and PostgreSQL (`sql.unsafe()`)
+- **DB CLI run command**: `ppm db run <name> <file.sql>` executes SQL files against saved connections. Supports multi-statement files and transactions (`BEGIN...COMMIT`). Respects readonly flag. Works with both SQLite (`db.exec()`) and PostgreSQL
 
 ## [0.13.12] - 2026-04-24
 

package/assets/skills/ppm/SKILL.md

@@ -71,4 +71,4 @@ This skill covers the `ppm` CLI, its HTTP API, and its config DB. It does **not*
 - Third-party extensions (inspect via `ppm ext list`).
 - The Claude Agent SDK internals (separate skill).
 
-<!-- Generated for PPM v0.13.13 at build time. Re-run `ppm export skill --install` to refresh. -->
+<!-- Generated for PPM v0.13.15 at build time. Re-run `ppm export skill --install` to refresh. -->

package/assets/skills/ppm/references/http-api.md

@@ -201,4 +201,4 @@ _Base URL: `http://localhost:8080` (default; override via `ppm config set port <
 - `ws://<host>/ws/terminal` — PTY terminal multiplexer
 - `ws://<host>/ws/extensions` — extension host channel
 
-<!-- Generated from src/server/routes/ for PPM v0.13.13 -->
+<!-- Generated from src/server/routes/ for PPM v0.13.15 -->

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hienlh/ppm",
-  "version": "0.13.13",
+  "version": "0.13.15",
   "description": "Personal Project Manager — mobile-first web IDE with AI assistance",
   "author": "hienlh",
   "license": "MIT",

package/src/cli/commands/db-cmd.ts

@@ -401,13 +401,9 @@ export function registerDbCommands(program: Command): void {
 
         if (conn.type === "postgres") {
           const { postgresService } = await import("../../services/postgres.service.ts");
-          const result = await postgresService.executeQuery(cfg.connectionString!, sql);
+          const result = await postgresService.executeScript(cfg.connectionString!, sql);
           await postgresService.closeAll();
-          if (result.changeType === "select") {
-            formatRows(result.columns, result.rows);
-          } else {
-            console.log(`${C.green}OK${C.reset} — ${result.rowsAffected} row(s) affected (${result.executionTimeMs}ms)`);
-          }
+          console.log(`${C.green}OK${C.reset} — ${result.statementsRun} statement(s) executed (${result.executionTimeMs}ms)`);
         } else {
           const { sqliteService } = await import("../../services/sqlite.service.ts");
           const result = sqliteService.executeScript(cfg.path!, cfg.path!, sql);

package/src/server/routes/files.ts

@@ -1,7 +1,8 @@
 import { Hono } from "hono";
-import { resolve } from "node:path";
+import { resolve, isAbsolute } from "node:path";
 import { existsSync, mkdirSync } from "node:fs";
 import { fileService, SecurityError, NotFoundError, ValidationError } from "../../services/file.service.ts";
+import { readSystemFile } from "../../services/fs-browse.service.ts";
 import { ok, err } from "../../types/api.ts";
 import { errorStatus } from "../helpers/error-status.ts";
 
@@ -196,9 +197,12 @@ fileRoutes.get("/compare", (c) => {
     if (!file1 || !file2) {
       return c.json(err("Missing query parameters: file1, file2"), 400);
     }
-    const original = fileService.readFile(projectPath, file1);
-    const modified = fileService.readFile(projectPath, file2);
-    return c.json(ok({ original: original.content, modified: modified.content }));
+    // Support absolute paths (files outside project, e.g. /tmp/)
+    const readSide = (p: string) =>
+      isAbsolute(p) ? readSystemFile(p).content : fileService.readFile(projectPath, p).content;
+    const original = readSide(file1);
+    const modified = readSide(file2);
+    return c.json(ok({ original, modified }));
   } catch (e) {
     return c.json(err((e as Error).message), errorStatus(e));
   }

package/src/services/database/split-sql-statements.ts

@@ -0,0 +1,95 @@
+/**
+ * Split a SQL script into individual statements, respecting:
+ * - Single-quoted strings ('hello; world')
+ * - Double-quoted identifiers ("my;table")
+ * - Dollar-quoted strings ($$...$$, $tag$...$tag$)
+ * - Single-line comments (-- ...)
+ * - Multi-line comments (/* ... *​/)
+ *
+ * Returns non-empty trimmed statements without trailing semicolons.
+ */
+export function splitSqlStatements(script: string): string[] {
+  const statements: string[] = [];
+  let current = "";
+  let i = 0;
+  const len = script.length;
+
+  while (i < len) {
+    const ch = script[i]!;
+
+    // Single-line comment
+    if (ch === "-" && script[i + 1] === "-") {
+      const end = script.indexOf("\n", i);
+      const lineEnd = end === -1 ? len : end + 1;
+      current += script.slice(i, lineEnd);
+      i = lineEnd;
+      continue;
+    }
+
+    // Multi-line comment
+    if (ch === "/" && script[i + 1] === "*") {
+      const end = script.indexOf("*/", i + 2);
+      const blockEnd = end === -1 ? len : end + 2;
+      current += script.slice(i, blockEnd);
+      i = blockEnd;
+      continue;
+    }
+
+    // Single-quoted string
+    if (ch === "'") {
+      let j = i + 1;
+      while (j < len) {
+        if (script[j] === "'" && script[j + 1] === "'") { j += 2; continue; }
+        if (script[j] === "'") { j++; break; }
+        j++;
+      }
+      current += script.slice(i, j);
+      i = j;
+      continue;
+    }
+
+    // Double-quoted identifier
+    if (ch === '"') {
+      let j = i + 1;
+      while (j < len) {
+        if (script[j] === '"' && script[j + 1] === '"') { j += 2; continue; }
+        if (script[j] === '"') { j++; break; }
+        j++;
+      }
+      current += script.slice(i, j);
+      i = j;
+      continue;
+    }
+
+    // Dollar-quoted string (PostgreSQL): $$...$$ or $tag$...$tag$
+    if (ch === "$") {
+      const tagMatch = script.slice(i).match(/^(\$[A-Za-z0-9_]*\$)/);
+      if (tagMatch) {
+        const tag = tagMatch[1]!;
+        const endIdx = script.indexOf(tag, i + tag.length);
+        const blockEnd = endIdx === -1 ? len : endIdx + tag.length;
+        current += script.slice(i, blockEnd);
+        i = blockEnd;
+        continue;
+      }
+    }
+
+    // Statement separator
+    if (ch === ";") {
+      const trimmed = current.trim();
+      if (trimmed) statements.push(trimmed);
+      current = "";
+      i++;
+      continue;
+    }
+
+    current += ch;
+    i++;
+  }
+
+  // Last statement (no trailing semicolon)
+  const trimmed = current.trim();
+  if (trimmed) statements.push(trimmed);
+
+  return statements;
+}

package/src/services/postgres.service.ts

@@ -1,4 +1,5 @@
 import postgres from "postgres";
+import { splitSqlStatements } from "./database/split-sql-statements.ts";
 
 export interface PgTableInfo {
   name: string;
@@ -180,6 +181,23 @@ class PostgresService {
     return { columns: [], rows: [], rowsAffected: result.count ?? 0, changeType: "modify", executionTimeMs };
   }
 
+  /** Execute multi-statement SQL script inside a transaction via sql.begin().
+   *  Strips user-supplied BEGIN/COMMIT/ROLLBACK since sql.begin() manages the transaction. */
+  async executeScript(connectionString: string, scriptText: string): Promise<{ statementsRun: number; executionTimeMs: number }> {
+    const sql = this.connect(connectionString);
+    const txControl = /^(BEGIN|COMMIT|ROLLBACK|END)(;|\s|$)/i;
+    const statements = splitSqlStatements(scriptText).filter((s) => !txControl.test(s));
+    if (statements.length === 0) return { statementsRun: 0, executionTimeMs: 0 };
+
+    const start = performance.now();
+    await sql.begin(async (tx) => {
+      for (const stmt of statements) {
+        await tx.unsafe(stmt);
+      }
+    });
+    return { statementsRun: statements.length, executionTimeMs: Math.round(performance.now() - start) };
+  }
+
   /** Update a single cell value */
   async updateCell(
     connectionString: string, table: string, schema = "public",