@hienlh/ppm 0.13.14 → 0.13.15

package/CHANGELOG.md

@@ -1,5 +1,10 @@
 # Changelog
 
+## [0.13.15] - 2026-04-24
+
+### Fixed
+- **File compare with absolute paths**: Comparing files outside the project (e.g. `/tmp/`) no longer fails with "Path traversal not allowed" — absolute paths now use `readSystemFile` instead of project-scoped read
+
 ## [0.13.14] - 2026-04-24
 
 ### Fixed

package/assets/skills/ppm/SKILL.md

@@ -71,4 +71,4 @@ This skill covers the `ppm` CLI, its HTTP API, and its config DB. It does **not*
 - Third-party extensions (inspect via `ppm ext list`).
 - The Claude Agent SDK internals (separate skill).
 
-<!-- Generated for PPM v0.13.14 at build time. Re-run `ppm export skill --install` to refresh. -->
+<!-- Generated for PPM v0.13.15 at build time. Re-run `ppm export skill --install` to refresh. -->

package/assets/skills/ppm/references/http-api.md

@@ -201,4 +201,4 @@ _Base URL: `http://localhost:8080` (default; override via `ppm config set port <
 - `ws://<host>/ws/terminal` — PTY terminal multiplexer
 - `ws://<host>/ws/extensions` — extension host channel
 
-<!-- Generated from src/server/routes/ for PPM v0.13.14 -->
+<!-- Generated from src/server/routes/ for PPM v0.13.15 -->

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hienlh/ppm",
-  "version": "0.13.14",
+  "version": "0.13.15",
   "description": "Personal Project Manager — mobile-first web IDE with AI assistance",
   "author": "hienlh",
   "license": "MIT",

package/src/server/routes/files.ts

@@ -1,7 +1,8 @@
 import { Hono } from "hono";
-import { resolve } from "node:path";
+import { resolve, isAbsolute } from "node:path";
 import { existsSync, mkdirSync } from "node:fs";
 import { fileService, SecurityError, NotFoundError, ValidationError } from "../../services/file.service.ts";
+import { readSystemFile } from "../../services/fs-browse.service.ts";
 import { ok, err } from "../../types/api.ts";
 import { errorStatus } from "../helpers/error-status.ts";
 
@@ -196,9 +197,12 @@ fileRoutes.get("/compare", (c) => {
     if (!file1 || !file2) {
       return c.json(err("Missing query parameters: file1, file2"), 400);
     }
-    const original = fileService.readFile(projectPath, file1);
-    const modified = fileService.readFile(projectPath, file2);
-    return c.json(ok({ original: original.content, modified: modified.content }));
+    // Support absolute paths (files outside project, e.g. /tmp/)
+    const readSide = (p: string) =>
+      isAbsolute(p) ? readSystemFile(p).content : fileService.readFile(projectPath, p).content;
+    const original = readSide(file1);
+    const modified = readSide(file2);
+    return c.json(ok({ original, modified }));
   } catch (e) {
     return c.json(err((e as Error).message), errorStatus(e));
   }