paperlint 11.1.2 → 12.0.0

package/src/submission-confirm-hook.test.ts

@@ -1,6 +1,7 @@
 /**
- * The `submission-confirm` hook: which commands send a submission (asked), which do not (silent), and
- * what the person is told — including when what it reads is missing, stale or broken.
+ * The `submission-confirm` hook: which commands send a submission, which do not (silent); a send runs
+ * only after the person's AskUserQuestion yes naming its paper folder and its PDF's sha256, once per send; what the agent is told to
+ * ask — including when what it reads is missing, stale or broken.
  */
 import { expect, test } from "vitest";
 import { memoryFiles } from "./adapters/memory/index.ts";
@@ -23,8 +24,8 @@ const kind = (command: string, hosts: () => readonly string[]) => {
       portalHosts: hosts,
     })?.hookSpecificOutput.permissionDecisionReason ?? null;
   if (reason === null) return null;
-  if (reason.startsWith(HEAD)) return "paperlint";
-  return reason.startsWith("This command names") ? "direct" : reason;
+  if (reason.startsWith(NOT_SENT)) return "paperlint";
+  return reason.startsWith("Not run: this command names") ? "direct" : reason;
 };
 
 /** The portal hosts the project declares, in these tests: one venue on its own domain. */
@@ -45,8 +46,15 @@ const submissionConfirm = (
     ...more,
   });
 
-const payload = (command: string, cwd = "/w"): string =>
-  JSON.stringify({ tool_name: "Bash", tool_input: { command }, cwd });
+/** The session's transcript, in every test that does not give its own. */
+const T = "/t/session.jsonl";
+
+const payload = (
+  command: string,
+  cwd = "/w",
+  more: object = { transcript_path: T, tool_use_id: "now" },
+): string =>
+  JSON.stringify({ tool_name: "Bash", tool_input: { command }, cwd, ...more });
 
 test.each([
   "npx paperlint submission update papers/p --save",
@@ -60,7 +68,7 @@ test.each([
   `npx paperlint "submission" 'update' papers/p "--save"`,
   "npx paperlint --save submission update papers/p",
   `npx paperlint submis"sion" up'date' papers/p --sa"ve"`,
-])("asked: %s", (command) => {
+])("a send: %s", (command) => {
   expect(kind(command, () => [])).toBe("paperlint");
 });
 
@@ -75,7 +83,7 @@ test.each([
   "node upload.mjs submit.example-venue.org",
   "curl -X POST CONFERENCE.org/api/paper",
   "echo https://venue.hotcrp.com",
-])("asked, straight at HotCRP: %s", (command) => {
+])("refused, straight at HotCRP: %s", (command) => {
   expect(kind(command, () => HOSTS)).toBe("direct");
 });
 
@@ -108,26 +116,29 @@ test("the hosts are read only for a command that makes a request: anything else
   expect(kind("npx paperlint submission new --save", never)).toBe("paperlint");
 });
 
-test("hosts that cannot be read: a request still asks, rather than passing unseen", () => {
-  expect(
-    submissionConfirm(payload("curl https://example.org/x"), memoryFiles({}), {
-      portalHosts: () => {
-        throw new Error("broken preset");
-      },
-    }),
-  ).toStrictEqual({
-    hookSpecificOutput: {
-      hookEventName: "PreToolUse",
-      permissionDecision: "ask",
-      permissionDecisionReason:
-        "paperlint could not tell what this command sends (broken preset). Allow only if you have read the dry run's venue check.",
+test("presets that cannot be read: only HotCRP-hosted sites and paperlint sends are recognised, and a refusal says why", () => {
+  const broken = {
+    portalHosts: () => {
+      throw new Error("broken preset");
     },
-  });
+  };
+  const reason = (command: string) =>
+    submissionConfirm(payload(command), paper(facts()), broken)
+      ?.hookSpecificOutput.permissionDecisionReason ?? null;
+  const FALLBACK =
+    "The venue presets could not be read (broken preset), so only HotCRP-hosted sites and paperlint sends are recognised until they are fixed.";
+  // A command that names no HotCRP site runs: one bad preset does not stop the shell.
+  expect(reason("curl https://submit.example-venue.org/x")).toBe(null);
+  expect(reason("cat notes.txt")).toBe(null);
+  expect(
+    reason("curl https://venue.hotcrp.com/api/paper")?.split("\n").at(-1),
+  ).toBe(FALLBACK);
+  expect(reason(SEND)?.split("\n").at(-1)).toBe(FALLBACK);
 });
-
-/** The made-up paper: its PDF, and its facts when given. */
+/** The made-up paper: its PDF, its facts when given, and an empty transcript. */
 const paper = (factsText: string | null): Files =>
   memoryFiles({
+    [T]: "",
     "/w/papers/p/paper.pdf": PDF,
     ...(factsText === null
       ? {}
@@ -136,21 +147,29 @@ const paper = (factsText: string | null): Files =>
 
 const reasonOf = (command: string, fs: Files, cwd = "/w"): string =>
   submissionConfirm(payload(command, cwd), fs)?.hookSpecificOutput
-    .permissionDecisionReason ?? "(no ask)";
+    .permissionDecisionReason ?? "(let through)";
 
 const SEND = "npx paperlint submission update papers/p --submit --save";
-const HEAD =
-  "This sends the paper to the venue's portal (paperlint submission with --save or --submit).";
-const LAST = "Allow only if you have read the dry run's venue check.";
+const NOT_SENT = "Not run: this sends the paper to the venue's portal";
+/** The first line when no yes was found. */
+const HEAD = `${NOT_SENT}, and the person has not said yes to it since the last send.`;
+/** What the agent is told to ask: the last lines of that refusal. */
+const LAST = [
+  "Ask the person with AskUserQuestion first, then run this command again. In the question, give:",
+  "- the paper folder (the full path, as written above), the PDF and its sha256 as written above (the folder path and the sha256 must both be in the question text),",
+  "- what the lines above say about the build (the body pages, or that it is stale or missing),",
+  "- the dry run's venue check, quoted word for word (its `venue rules at their default options` line and every error under it).",
+  'Options: "Yes, send it" and "No". One yes lets one send through: ask one question per send, each naming its own folder and sha256.',
+].join("\n");
 
-test("the ask: the paper folder, the PDF and its sha256, the body pages the build counted, and the line to read the venue check", () => {
+test("no yes: refused, telling the agent what to ask — the paper folder, the PDF and its sha256, the body pages, the venue check, yes or no", () => {
   expect(submissionConfirm(payload(SEND), paper(facts()))).toStrictEqual({
     hookSpecificOutput: {
       hookEventName: "PreToolUse",
-      permissionDecision: "ask",
+      permissionDecision: "deny",
       permissionDecisionReason: [
         HEAD,
-        "paper folder: papers/p",
+        "paper folder: /w/papers/p",
         `PDF: papers/p/paper.pdf, sha256 ${HEX.slice(0, 12)}`,
         "body pages: 4 (up to the references on page 5)",
         LAST,
@@ -159,11 +178,11 @@ test("the ask: the paper folder, the PDF and its sha256, the body pages the buil
   });
 });
 
-test("a stale build is said loudly; no facts, broken facts and a missing PDF are said too — and every one still asks", () => {
+test("a stale build is said loudly; no facts and broken facts are said too", () => {
   expect(reasonOf(SEND, paper(facts({ sha: "b".repeat(64) })))).toBe(
     [
       HEAD,
-      "paper folder: papers/p",
+      "paper folder: /w/papers/p",
       `PDF: papers/p/paper.pdf, sha256 ${HEX.slice(0, 12)}`,
       "!! THE LAST BUILD IS NOT OF THIS PDF — the check did not see it. Rebuild (`paperlint build`) and run the dry run again.",
       "body pages: 4 (up to the references on page 5)",
@@ -179,12 +198,30 @@ test("a stale build is said loudly; no facts, broken facts and a missing PDF are
   expect(
     reasonOf(SEND, paper(JSON.stringify({ schema: 1 }))).split("\n")[3],
   ).toBe("could not read the build facts (_build/paper.facts.json): schema 1");
+});
+
+/** The refusal of a send whose PDF is not known or not there: nothing to ask about yet. */
+const NO_PDF = (...lines: readonly string[]): string =>
+  [
+    `${NOT_SENT}, and paperlint cannot find the PDF it uploads, so there is no sha256 to ask the person about.`,
+    ...lines,
+    "Name the paper folder and the PDF plainly (no cd, no $…), build the PDF, run the dry run, and ask then.",
+  ].join("\n");
+
+test("a PDF that is not there: refused, whatever the transcript says — there is no sha256 to ask about", () => {
   expect(
     reasonOf(
       "npx paperlint submission update papers/p --pdf gone.pdf --save",
       paper(facts()),
-    ).split("\n")[2],
-  ).toBe("PDF: gone.pdf — NOT FOUND");
+    ),
+  ).toBe(
+    NO_PDF(
+      "paper folder: /w/papers/p",
+      "PDF: gone.pdf — NOT FOUND",
+      "!! THE LAST BUILD IS NOT OF THIS PDF — the check did not see it. Rebuild (`paperlint build`) and run the dry run again.",
+      "body pages: 4 (up to the references on page 5)",
+    ),
+  );
 });
 
 test("the body pages: up to the references when the build found them, else banal's count, else not counted", () => {
@@ -203,6 +240,7 @@ test("the body pages: up to the references when the build found them, else banal
 
 test("the paper and the PDF as the command names them: the current folder by default, --pdf=<file> too", () => {
   const fs = memoryFiles({
+    [T]: "",
     "/w/papers/p/paper.pdf": PDF,
     "/w/papers/p/out.pdf": PDF,
   });
@@ -211,7 +249,7 @@ test("the paper and the PDF as the command names them: the current folder by def
       .split("\n")
       .slice(1, 3),
   ).toStrictEqual([
-    "paper folder: p (the current folder)",
+    "paper folder: /w/papers/p",
     `PDF: paper.pdf, sha256 ${HEX.slice(0, 12)}`,
   ]);
   expect(
@@ -222,13 +260,14 @@ test("the paper and the PDF as the command names them: the current folder by def
       .split("\n")
       .slice(1, 3),
   ).toStrictEqual([
-    "paper folder: papers/p",
+    "paper folder: /w/papers/p",
     `PDF: papers/p/out.pdf, sha256 ${HEX.slice(0, 12)}`,
   ]);
 });
 
 test("the paper's own `pdf` setting is the PDF hashed when the command names no --pdf, as the command sends it", () => {
   const fs = memoryFiles({
+    [T]: "",
     "/w/papers/p/paperlint.json": JSON.stringify({ pdf: "out/main.pdf" }),
     "/w/papers/p/out/main.pdf": PDF,
   });
@@ -237,8 +276,9 @@ test("the paper's own `pdf` setting is the PDF hashed when the command names no
   );
 });
 
-test("a paperlint.json that does not parse: the PDF is the default paper.pdf, and the ask still goes out", () => {
+test("a paperlint.json that does not parse: the PDF is the default paper.pdf, and the send is still described", () => {
   const fs = memoryFiles({
+    [T]: "",
     "/w/papers/p/paperlint.json": "{ nope",
     "/w/papers/p/paper.pdf": PDF,
   });
@@ -253,7 +293,7 @@ test("a --pdf at the end with no value, which the command refuses: unresolved",
       "npx paperlint submission update papers/p --save --pdf",
       paper(facts()),
     ),
-  ).toBe([HEAD, UNRESOLVED, LAST].join("\n"));
+  ).toBe(NO_PDF(UNRESOLVED));
 });
 
 test("a command that only mentions `submission` beside a send is no second send", () => {
@@ -262,7 +302,7 @@ test("a command that only mentions `submission` beside a send is no second send"
       "npx paperlint submission update papers/p --save; echo submission",
       paper(facts()),
     ).split("\n")[1],
-  ).toBe("paper folder: papers/p");
+  ).toBe("paper folder: /w/papers/p");
 });
 
 /** What the reason says for a send the parse cannot resolve. */
@@ -275,13 +315,13 @@ test("the send's words are read by the command's own parser: a value flag before
       "npx paperlint submission update --max-warnings 0 --config paperlint.json papers/p --save",
       paper(facts()),
     ).split("\n")[1],
-  ).toBe("paper folder: papers/p");
+  ).toBe("paper folder: /w/papers/p");
   expect(
     reasonOf(
       "npx paperlint submission update papers/p --nope --save",
       paper(null),
     ),
-  ).toBe([HEAD, UNRESOLVED, LAST].join("\n"));
+  ).toBe(NO_PDF(UNRESOLVED));
 });
 
 test("anything that may change the directory before the send makes its PDF unresolved, not guessed", () => {
@@ -290,13 +330,11 @@ test("anything that may change the directory before the send makes its PDF unres
     "pushd papers/p; npx paperlint submission update --save",
     "env -C papers/p npx paperlint submission update --save",
   ])
-    expect(reasonOf(command, paper(facts())), command).toBe(
-      [HEAD, UNRESOLVED, LAST].join("\n"),
-    );
+    expect(reasonOf(command, paper(facts())), command).toBe(NO_PDF(UNRESOLVED));
 });
 
 test("a quoted --pdf=<file> with a space is one word: the PDF is that file", () => {
-  const fs = memoryFiles({ "/w/final copies/paper.pdf": PDF });
+  const fs = memoryFiles({ [T]: "", "/w/final copies/paper.pdf": PDF });
   expect(
     reasonOf(
       `npx paperlint submission update papers/p --pdf="final copies/paper.pdf" --save`,
@@ -310,6 +348,7 @@ const B = new TextEncoder().encode("%PDF b");
 
 test("every send in a chain is described, one block each", () => {
   const fs = memoryFiles({
+    [T]: "",
     "/w/papers/a/paper.pdf": PDF,
     "/w/papers/b/paper.pdf": B,
   });
@@ -321,24 +360,24 @@ test("every send in a chain is described, one block each", () => {
     reason.filter((l) => /^(?:send|paper folder|PDF)/u.test(l)),
   ).toStrictEqual([
     "send 1 of 2:",
-    "paper folder: papers/a",
+    "paper folder: /w/papers/a",
     `PDF: papers/a/paper.pdf, sha256 ${HEX.slice(0, 12)}`,
     "send 2 of 2:",
-    "paper folder: papers/b",
+    "paper folder: /w/papers/b",
     `PDF: papers/b/paper.pdf, sha256 ${sha256Hex(B).slice(0, 12)}`,
   ]);
 });
 
-test("a send whose words the shell would expand, or one inside a string, is asked about as unresolved", () => {
+test("a send whose words the shell would expand, or one inside a string, is refused as unresolved", () => {
   expect(
     reasonOf('npx paperlint submission update "$P" --save', paper(null)),
-  ).toBe([HEAD, UNRESOLVED, LAST].join("\n"));
+  ).toBe(NO_PDF(UNRESOLVED));
   expect(
     reasonOf(
       `bash -c "npx paperlint submission update papers/p --save"`,
       paper(null),
     ),
-  ).toBe([HEAD, UNRESOLVED, LAST].join("\n"));
+  ).toBe(NO_PDF(UNRESOLVED));
 });
 
 test("a client run by its path or quoted is a request: the program is read by its basename", () => {
@@ -353,17 +392,27 @@ test("a client run by its path or quoted is a request: the program is read by it
   ).toBe("direct");
 });
 
-test("straight at HotCRP: asked, naming that paperlint's check is skipped", () => {
+/** What the agent is told to ask before a command that names a portal. */
+const ASK_PORTAL = [
+  "It may send to the portal around paperlint's venue check. Ask the person with AskUserQuestion first, then run this command again: the question must contain the portal host and the command start above, exactly as written, and say what the command does.",
+  'Options: "Yes, run it" and "No". One yes lets one command through. To send a paper, use `paperlint submission new|update --save` instead.',
+].join("\n");
+
+test("straight at a portal, with no yes: refused, naming the host and the command's first 60 characters to ask about", () => {
   expect(
     reasonOf(
-      "curl -F file=@paper.pdf https://venue.hotcrp.com/api/upload",
+      "  curl -F file=@paper.pdf https://Venue.HotCRP.com/api/upload?p=1&token=secret",
       paper(null),
     ),
   ).toBe(
-    "This command names a venue's submission portal, so it may send to it outside paperlint and its venue check. Allow only if you have read the dry run's venue check.",
+    [
+      "Not run: this command names a venue's submission portal, and the person has not said yes to it since the last send.",
+      "portal host: hotcrp.com",
+      "command start: curl -F file=@paper.pdf https://Venue.HotCRP.com/api/upload?",
+      ASK_PORTAL,
+    ].join("\n"),
   );
 });
-
 test("a command that sends nothing: no output at all — neither allow nor deny", () => {
   expect(
     submissionConfirm(
@@ -376,7 +425,7 @@ test("a command that sends nothing: no output at all — neither allow nor deny"
   ).toBe(null);
 });
 
-test("a crash while describing the send still asks; a payload that is not JSON is asked about", () => {
+test("a crash while describing the send is refused; a payload that is not JSON is refused", () => {
   const broken: Files = {
     isFile: () => false,
     readBytes: (p: AbsolutePath) => {
@@ -385,15 +434,399 @@ test("a crash while describing the send still asks; a payload that is not JSON i
     writeAtomic: () => undefined,
   };
   expect(reasonOf(SEND, broken)).toBe(
-    `${HEAD} paperlint could not say what will be sent: disk on fire at /w/papers/p/paperlint.json. ${LAST}`,
+    "Not run: paperlint could not check whether this command sends a paper: disk on fire at /w/papers/p/paperlint.json.",
   );
   expect(
     submissionConfirm(`{"tool_input": {"command": "${SEND}"`, paper(null))
-      ?.hookSpecificOutput.permissionDecision,
-  ).toBe("ask");
+      ?.hookSpecificOutput,
+  ).toStrictEqual({
+    hookEventName: "PreToolUse",
+    permissionDecision: "deny",
+    permissionDecisionReason:
+      "Not run: paperlint could not read this command, so it cannot tell whether it sends a paper to a venue's portal.",
+  });
   // A relative or missing cwd: the hook's own working directory.
   expect(
     submissionConfirm(payload(SEND, "relative"), paper(null))
       ?.hookSpecificOutput.permissionDecision,
-  ).toBe("ask");
+  ).toBe("deny");
+});
+
+// ── the person's yes, read from the transcript ───────────────────────────────────────────
+// Hand-built entries in the shape Claude Code writes: the assistant's `tool_use`, and the user
+// entry with the matching `tool_result` and `toolUseResult.answers` (question text → option).
+
+const SHA = HEX.slice(0, 12);
+
+/** The assistant asks one AskUserQuestion; with an answer, the person's reply follows. */
+const question = (id: string, text: string, answer?: unknown): string[] => {
+  const questions = [
+    {
+      question: text,
+      header: "Send",
+      multiSelect: false,
+      options: [
+        { label: "Yes, send it", description: "Send this PDF." },
+        { label: "No", description: "Do not send." },
+      ],
+    },
+  ];
+  return [
+    JSON.stringify({
+      type: "assistant",
+      message: {
+        role: "assistant",
+        content: [
+          { type: "text", text: "Asking first." },
+          {
+            type: "tool_use",
+            id,
+            name: "AskUserQuestion",
+            input: { questions },
+          },
+        ],
+      },
+    }),
+    ...(answer === undefined
+      ? []
+      : [
+          JSON.stringify({
+            type: "user",
+            message: {
+              role: "user",
+              content: [
+                { type: "tool_result", tool_use_id: id, content: "answered" },
+              ],
+            },
+            toolUseResult: { questions, answers: { [text]: answer } },
+          }),
+        ]),
+  ];
+};
+
+/** The assistant runs a Bash command. */
+const bash = (id: string, command: unknown): string[] => [
+  JSON.stringify({
+    type: "assistant",
+    message: {
+      role: "assistant",
+      content: [{ type: "tool_use", id, name: "Bash", input: { command } }],
+    },
+  }),
+];
+
+/** A question about the send of `sha` from `folder`, as the hook asks the agent to write it. */
+const asksAbout = (folder: string, sha: string) =>
+  `Send ${folder}/paper.pdf (paper folder ${folder}, sha256 ${sha}) to the portal? Venue check: venue rules at their default options: no errors`;
+
+const asks = (sha: string) => asksAbout("/w/papers/p", sha);
+
+/** The hook's answer to SEND, over the paper with this transcript. */
+const withTranscript = (lines: readonly string[], command = SEND) =>
+  submissionConfirm(
+    payload(command),
+    memoryFiles({
+      [T]: `${lines.join("\n")}\n`,
+      "/w/papers/p/paper.pdf": PDF,
+      "/w/papers/p/_build/paper.facts.json": facts(),
+    }),
+  );
+
+test("a yes to a question naming the PDF's sha256: the send runs — the hook says nothing, so Claude Code's own permissions apply", () => {
+  expect(withTranscript(question("q1", asks(SHA), "Yes, send it"))).toBe(null);
+  // The answer is a yes by its first word, in any case, typed or chosen.
+  expect(withTranscript(question("q1", asks(SHA), " yes"))).toBe(null);
+  // The call being decided may already be in the transcript: it is no earlier send.
+  expect(
+    withTranscript([
+      ...question("q1", asks(SHA), "Yes, send it"),
+      ...bash("now", SEND),
+    ]),
+  ).toBe(null);
+});
+
+test("one yes, one send: the same send again is refused until the person is asked again", () => {
+  const once = [
+    ...question("q1", asks(SHA), "Yes, send it"),
+    ...bash("b1", SEND),
+  ];
+  expect(
+    withTranscript(once)?.hookSpecificOutput.permissionDecisionReason,
+  ).toMatch(new RegExp(`^${HEAD}`, "u"));
+  expect(
+    withTranscript([...once, ...question("q2", asks(SHA), "Yes, send it")]),
+  ).toBe(null);
+  // A send the hook refused uses the yes up too: a question asked BEFORE it does not count.
+  expect(
+    withTranscript([
+      ...question("q1", asks(SHA), "Yes"),
+      ...bash("b1", `${SEND} && echo`),
+    ])?.hookSpecificOutput.permissionDecision,
+  ).toBe("deny");
+  // Other commands in between use up nothing.
+  expect(
+    withTranscript([
+      ...question("q1", asks(SHA), "Yes"),
+      ...bash("b1", "npx paperlint submission show papers/p"),
+      ...bash("b2", 42),
+    ]),
+  ).toBe(null);
+});
+
+test("no yes: a 'No', no answer yet, an answer that is not a yes, a yes withdrawn later — refused", () => {
+  const refused = (lines: readonly string[]) =>
+    withTranscript(lines)?.hookSpecificOutput.permissionDecisionReason.split(
+      "\n",
+    )[0];
+  expect(refused(question("q1", asks(SHA), "No"))).toBe(HEAD);
+  // Asked in the same turn as the send: not answered yet.
+  expect(refused(question("q1", asks(SHA)))).toBe(HEAD);
+  expect(
+    refused(question("q1", asks(SHA), "Yesterday's build, not this one")),
+  ).toBe(HEAD);
+  expect(refused(question("q1", asks(SHA), ["Yes"]))).toBe(HEAD);
+  // A reply with no answers in it, and a tool other than a question or Bash, count for nothing.
+  const reply = question("q1", asks(SHA), "Yes");
+  expect(
+    refused([
+      reply[0] ?? "",
+      (reply[1] ?? "")
+        .replace('"toolUseResult"', '"otherResult"')
+        .replace('"type":"user"', '"type":"user","toolUseResult":"Yes"'),
+      JSON.stringify({
+        type: "assistant",
+        message: {
+          content: [{ type: "tool_use", id: "r1", name: "Read", input: {} }],
+        },
+      }),
+    ]),
+  ).toBe(HEAD);
+  // The latest question naming the sha decides.
+  expect(
+    refused([
+      ...question("q1", asks(SHA), "Yes"),
+      ...question("q2", asks(SHA), "No"),
+    ]),
+  ).toBe(HEAD);
+  // An answer that arrives after a send, to a question asked before it, is no fresh yes.
+  const late = question("q1", asks(SHA), "Yes");
+  expect(refused([late[0] ?? "", ...bash("b1", SEND), late[1] ?? ""])).toBe(
+    HEAD,
+  );
+});
+
+test("a stale sha: a yes to another PDF's bytes does not let this one through", () => {
+  expect(
+    withTranscript(
+      question("q1", asks("b".repeat(12)), "Yes, send it"),
+    )?.hookSpecificOutput.permissionDecisionReason.split("\n")[0],
+  ).toBe(HEAD);
+});
+
+/** Two sends in one command, and the hook's answer over a transcript. */
+const chained = (command: string, lines: readonly string[]) =>
+  submissionConfirm(
+    payload(command),
+    memoryFiles({
+      [T]: lines.join("\n"),
+      "/w/papers/a/paper.pdf": PDF,
+      "/w/papers/b/paper.pdf": B,
+      "/w/papers/c/paper.pdf": PDF,
+    }),
+  )?.hookSpecificOutput.permissionDecision ?? "runs";
+
+const AB =
+  "npx paperlint submission update papers/a --save && npx paperlint submission new papers/b --save";
+
+test("two sends in one command: each needs a yes of its own, naming its own folder and sha256", () => {
+  const shaB = sha256Hex(B).slice(0, 12);
+  const yesA = question("q1", asksAbout("/w/papers/a", SHA), "Yes");
+  const yesB = question("q2", asksAbout("/w/papers/b", shaB), "Yes");
+  expect(chained(AB, yesA)).toBe("deny");
+  expect(chained(AB, [...yesA, ...yesB])).toBe("runs");
+  // The order of the answers does not matter.
+  expect(chained(AB, [...yesB, ...yesA])).toBe("runs");
+  // A No to the second send refuses the command.
+  expect(
+    chained(AB, [
+      ...yesA,
+      ...question("q2", asksAbout("/w/papers/b", shaB), "No"),
+    ]),
+  ).toBe("deny");
+});
+
+test("one yes whose question names two shas covers one send, not two", () => {
+  const shaB = sha256Hex(B).slice(0, 12);
+  const both = question(
+    "q1",
+    `${asksAbout("/w/papers/a", SHA)} and ${asksAbout("/w/papers/b", shaB)}`,
+    "Yes",
+  );
+  expect(chained(AB, both)).toBe("deny");
+  // Asked again for the second send, the command runs.
+  expect(
+    chained(AB, [
+      ...both,
+      ...question("q2", asksAbout("/w/papers/b", shaB), "Yes"),
+    ]),
+  ).toBe("runs");
+});
+
+test("two sends of the same PDF: one yes denies, two yeses run", () => {
+  const twice =
+    "npx paperlint submission update papers/a --save && npx paperlint submission update papers/a --submit --save";
+  const yes = question("q1", asksAbout("/w/papers/a", SHA), "Yes");
+  expect(chained(twice, yes)).toBe("deny");
+  expect(
+    chained(twice, [
+      ...yes,
+      ...question("q2", asksAbout("/w/papers/a", SHA), "Yes"),
+    ]),
+  ).toBe("runs");
+});
+
+test("a yes naming the right sha but another folder does not count: identical bytes in two folders share no yes", () => {
+  const sendC = "npx paperlint submission update papers/c --save";
+  // papers/a and papers/c hold the same bytes.
+  expect(
+    chained(sendC, question("q1", asksAbout("/w/papers/a", SHA), "Yes")),
+  ).toBe("deny");
+  expect(
+    chained(sendC, question("q1", asksAbout("/w/papers/c", SHA), "Yes")),
+  ).toBe("runs");
+  // Neither a longer folder that starts with this one, nor one this one ends.
+  for (const other of ["/w/papers/c2", "/w/papers/c.old", "/x/w/papers/c"])
+    expect(chained(sendC, question("q1", asksAbout(other, SHA), "Yes"))).toBe(
+      "deny",
+    );
+  // The folder path is case-sensitive; the sha is not.
+  expect(
+    chained(sendC, question("q1", asksAbout("/W/papers/c", SHA), "Yes")),
+  ).toBe("deny");
+  expect(
+    chained(
+      sendC,
+      question("q1", asksAbout("/w/papers/c", SHA.toUpperCase()), "Yes"),
+    ),
+  ).toBe("runs");
+  // The folder as part of a longer path to the PDF is named.
+  expect(
+    chained(
+      sendC,
+      question("q1", `Send /w/papers/c/paper.pdf, sha256 ${SHA}?`, "Yes"),
+    ),
+  ).toBe("runs");
+});
+
+test("a transcript that cannot be read, or no transcript: refused", () => {
+  const reason = (fs: Files, more?: object) =>
+    submissionConfirm(payload(SEND, "/w", more), fs)?.hookSpecificOutput
+      .permissionDecisionReason;
+  const files = (transcript?: string) =>
+    memoryFiles({
+      "/w/papers/p/paper.pdf": PDF,
+      ...(transcript === undefined ? {} : { [T]: transcript }),
+    });
+  expect(reason(files())).toBe(
+    `${NOT_SENT}, and the transcript ${T} could not be read, so paperlint cannot see the person's yes.`,
+  );
+  expect(reason(files(""), {})).toBe(
+    `${NOT_SENT}, and the hook was given no transcript_path, so paperlint cannot see the person's yes.`,
+  );
+  expect(reason(files(""), { transcript_path: "session.jsonl" })).toBe(
+    `${NOT_SENT}, and the hook was given no transcript_path, so paperlint cannot see the person's yes.`,
+  );
+});
+
+test("a broken transcript line: one that may hold a send uses the yes before it up; any other is skipped", () => {
+  const yes = question("q1", asks(SHA), "Yes");
+  const decide = (lines: readonly string[]) =>
+    withTranscript(lines)?.hookSpecificOutput.permissionDecision ?? "runs";
+  // An entry cut short and run into the next, as real transcripts have them.
+  const cut = (entry: string) => `${entry.slice(0, 80)}${entry}`;
+  const send = bash("b1", SEND)[0] ?? "";
+  const other = bash("b1", "ls -la")[0] ?? "";
+  expect(decide([...yes, cut(send)])).toBe("deny");
+  expect(decide([...yes, cut(other)])).toBe("runs");
+  // A yes asked after it counts again; a line with no content list is skipped.
+  expect(
+    decide([
+      cut(send),
+      JSON.stringify({ type: "user", message: { content: "toolUseResult" } }),
+      ...yes,
+    ]),
+  ).toBe("runs");
+});
+
+test("a command naming a portal runs after a yes to a question with its host and its start, once", () => {
+  const command = "curl -X POST https://venue.hotcrp.com/api/paper/1/comment";
+  const start = command.slice(0, 60);
+  const decide = (lines: readonly string[]) =>
+    withTranscript(lines, command)?.hookSpecificOutput.permissionDecision ??
+    "runs";
+  const yes = question("q1", `Run ${start} against HOTCRP.COM?`, "Yes, run it");
+  expect(decide(yes)).toBe("runs");
+  // Used up by the run, or by any earlier command that names a portal.
+  expect(decide([...yes, ...bash("b1", command)])).toBe("deny");
+  expect(decide([...yes, ...bash("b1", "grep -rn hotcrp.com src/")])).toBe(
+    "deny",
+  );
+  // The host alone, or the start alone, is not enough; nor is a No.
+  expect(decide(question("q1", "Run it against hotcrp.com?", "Yes"))).toBe(
+    "deny",
+  );
+  expect(
+    decide(question("q1", `Run ${start.slice(0, 30)} on hotcrp.com?`, "Yes")),
+  ).toBe("deny");
+  expect(decide(question("q1", `Run ${start} on hotcrp.com?`, "No"))).toBe(
+    "deny",
+  );
+  // A broken transcript line that names a portal counts as a run of one.
+  expect(
+    decide([...yes, `{"type":"tool_use"${bash("b1", command)[0] ?? ""}`]),
+  ).toBe("deny");
+});
+
+test("a paperlint send that also names a portal needs both yeses: the PDF's sha256, and the host with the start", () => {
+  const command = `${SEND} && curl https://venue.hotcrp.com/api/paper/1`;
+  const start = command.slice(0, 60);
+  const decide = (lines: readonly string[]) =>
+    withTranscript(lines, command)?.hookSpecificOutput
+      .permissionDecisionReason ?? "runs";
+  const sha = question("q1", asks(SHA), "Yes");
+  const host = question("q2", `${start} on hotcrp.com`, "Yes");
+  expect(decide([...sha, ...host])).toBe("runs");
+  const reason = decide(sha).split("\n");
+  expect(reason[0]).toBe(HEAD);
+  expect(reason.slice(-4)).toStrictEqual([
+    "portal host: hotcrp.com",
+    `command start: ${start}`,
+    ...ASK_PORTAL.split("\n"),
+  ]);
+  expect(decide(host).split("\n")[0]).toBe(HEAD);
+});
+
+test("a paperlint send that also names a portal: one yes naming everything covers one of them, not both", () => {
+  const command = `${SEND} && curl https://venue.hotcrp.com/api/paper/1`;
+  const start = command.slice(0, 60);
+  const decide = (lines: readonly string[]) =>
+    withTranscript(lines, command)?.hookSpecificOutput.permissionDecision ??
+    "runs";
+  const all = question("q1", `${asks(SHA)} Also ${start} on hotcrp.com`, "Yes");
+  expect(decide(all)).toBe("deny");
+  // A second yes naming only the host and the start, before or after it, covers the other.
+  const host = question("q2", `${start} on hotcrp.com`, "Yes");
+  expect(decide([...all, ...host])).toBe("runs");
+  expect(decide([...host, ...all])).toBe("runs");
+});
+
+test("the approved command start is compared as written; the host in any case", () => {
+  const command = "curl -F f=@paper.pdf https://venue.hotcrp.com/api/paper/1";
+  const decide = (text: string) =>
+    withTranscript(question("q1", text, "Yes"), command)?.hookSpecificOutput
+      .permissionDecision ?? "runs";
+  expect(decide(`Run ${command} on VENUE.HOTCRP.COM?`)).toBe("runs");
+  expect(
+    decide(`Run ${command.replace("paper.pdf", "PAPER.PDF")} on hotcrp.com?`),
+  ).toBe("deny");
 });