paperlint 6.2.3 → 6.3.0

package/skills/submission-portal/SKILL.md

@@ -0,0 +1,69 @@
+---
+name: submission-portal
+description: "Read or change a paper's submission on the venue's HotCRP portal via `paperlint submission show|update`: replace the PDF or abstract, mark it submitted, check it is really \"Submitted\", and verify by sha256 that the portal holds the latest build. Use when the PDF or abstract on HotCRP needs replacing, when asked whether the paper is truly submitted or which PDF reviewers see, or before a deadline. Composes with submit-paper (what to submit); this gets it onto the portal and proves it landed."
+allowed-tools: [Read, Grep, Glob, Bash]
+---
+
+<!-- vigiles:sha256:deb3d74f5c3f93a8 compiled from skills/submission-portal/SKILL.md.spec.ts -->
+
+# submission-portal — read and update the submission on the portal, then prove it landed
+
+`paperlint submission` talks to the venue's submission portal through its API. Only HotCRP is
+supported; for any other portal the command says so and the upload is done by hand.
+
+## What must be in place
+
+- **The venue preset declares the portal**: `"portal": { "kind": "hotcrp", "url": "<the site>" }`
+  (`paperlint:aidc` has it). For your own venue preset, add it there.
+- **The paper's `paperlint.json` names its submission**: `"submission": { "id": <number> }` — the
+  number HotCRP shows for the paper.
+- **A token in `HOTCRP_TOKEN`**, created by the author on the HotCRP site under Account settings →
+  Developer (scopes `submeta:read` and `document:read` to read; `submeta:write` and
+  `document:write` to update). Never ask for it in chat, never print it, never write it to a file:
+  the command reads it from the environment and sends it only as the `Authorization` header.
+
+A missing key or token stops the command with exit 2 and a line naming the file and key, or the
+variable — fix exactly that and run again.
+
+## The procedure — always in this order
+
+1. **Read it.** `npx paperlint submission show papers/<paper>` — status, title, type, topics,
+   abstract length, the PDF the portal holds, and `match`: whether that PDF's sha256 equals the
+   local `paper.pdf`. Rebuild first (`npx paperlint build papers/<paper>`) if the local PDF is stale.
+2. **Dry run.** `npx paperlint submission update papers/<paper>` — sends the PDF (add
+   `--abstract <file>` for a plain-text abstract, `--submit` to mark it submitted) with HotCRP's
+   `dry_run=1`: the portal checks the change and **keeps nothing**. Read `valid`, `changes` and every
+   `portal says:` line. Exit 1 means the portal would refuse it — report why, do not go on.
+3. **Ask the author.** Show the dry run's output and ask for an explicit yes to change the real
+   submission.
+4. **Save — only after that yes.** `npx paperlint submission update papers/<paper> --save` (same
+   flags as the dry run). 🔴 `--save` CHANGES A REAL SUBMISSION that reviewers will see. Never run it
+   without the author's explicit yes in this conversation, never "to test", and never because a
+   dry run was valid.
+5. **Prove it landed.** `npx paperlint submission show papers/<paper>` again: `match` must read
+   `yes — the portal holds this build`, and the status must be what was intended (`submitted` if
+   `--submit` was sent). Anything else is not done — say so.
+
+The same five steps as commands, in order (`<paper>` is the paper's folder):
+
+```bash
+npx paperlint submission show papers/<paper>
+npx paperlint submission update papers/<paper>
+# … the author reads the dry run and says yes …
+npx paperlint submission update papers/<paper> --save
+npx paperlint submission show papers/<paper>
+```
+
+## Reading the answers
+
+- `match yes` is the only proof the reviewers get the local build; a status of `submitted` alone
+  says nothing about WHICH PDF.
+- `the portal refused (HTTP 401): …` — the token is missing, wrong or expired; `403` — the token
+  lacks the scope, or the deadline has passed for this change. The text after the colon is
+  HotCRP's own; quote it.
+- `SAVE WITHHELD by the portal` — HotCRP did not save; nothing changed.
+
+## What this skill does not do
+
+It does not decide whether the paper is ready (that is `harden-paper`), anonymize it, or fill the
+submission form's other fields (authors, conflicts) — see `submit-paper`.

package/skills/submission-portal/SKILL.md.spec.ts

@@ -0,0 +1,71 @@
+// Compiled to SKILL.md by `vigiles compile`. Edit THIS file, never the markdown.
+import { experimental_skill } from "vigiles/spec";
+
+export default experimental_skill({
+  name: "submission-portal",
+  description:
+    "Read or change a paper's submission on the venue's HotCRP portal via `paperlint submission show|update`: replace the PDF or abstract, mark it submitted, check it is really \"Submitted\", and verify by sha256 that the portal holds the latest build. Use when the PDF or abstract on HotCRP needs replacing, when asked whether the paper is truly submitted or which PDF reviewers see, or before a deadline. Composes with submit-paper (what to submit); this gets it onto the portal and proves it landed.",
+  tools: ["Read", "Grep", "Glob", "Bash"],
+  body: `
+# submission-portal — read and update the submission on the portal, then prove it landed
+
+\`paperlint submission\` talks to the venue's submission portal through its API. Only HotCRP is
+supported; for any other portal the command says so and the upload is done by hand.
+
+## What must be in place
+
+- **The venue preset declares the portal**: \`"portal": { "kind": "hotcrp", "url": "<the site>" }\`
+  (\`paperlint:aidc\` has it). For your own venue preset, add it there.
+- **The paper's \`paperlint.json\` names its submission**: \`"submission": { "id": <number> }\` — the
+  number HotCRP shows for the paper.
+- **A token in \`HOTCRP_TOKEN\`**, created by the author on the HotCRP site under Account settings →
+  Developer (scopes \`submeta:read\` and \`document:read\` to read; \`submeta:write\` and
+  \`document:write\` to update). Never ask for it in chat, never print it, never write it to a file:
+  the command reads it from the environment and sends it only as the \`Authorization\` header.
+
+A missing key or token stops the command with exit 2 and a line naming the file and key, or the
+variable — fix exactly that and run again.
+
+## The procedure — always in this order
+
+1. **Read it.** \`npx paperlint submission show papers/<paper>\` — status, title, type, topics,
+   abstract length, the PDF the portal holds, and \`match\`: whether that PDF's sha256 equals the
+   local \`paper.pdf\`. Rebuild first (\`npx paperlint build papers/<paper>\`) if the local PDF is stale.
+2. **Dry run.** \`npx paperlint submission update papers/<paper>\` — sends the PDF (add
+   \`--abstract <file>\` for a plain-text abstract, \`--submit\` to mark it submitted) with HotCRP's
+   \`dry_run=1\`: the portal checks the change and **keeps nothing**. Read \`valid\`, \`changes\` and every
+   \`portal says:\` line. Exit 1 means the portal would refuse it — report why, do not go on.
+3. **Ask the author.** Show the dry run's output and ask for an explicit yes to change the real
+   submission.
+4. **Save — only after that yes.** \`npx paperlint submission update papers/<paper> --save\` (same
+   flags as the dry run). 🔴 \`--save\` CHANGES A REAL SUBMISSION that reviewers will see. Never run it
+   without the author's explicit yes in this conversation, never "to test", and never because a
+   dry run was valid.
+5. **Prove it landed.** \`npx paperlint submission show papers/<paper>\` again: \`match\` must read
+   \`yes — the portal holds this build\`, and the status must be what was intended (\`submitted\` if
+   \`--submit\` was sent). Anything else is not done — say so.
+
+The same five steps as commands, in order (\`<paper>\` is the paper's folder):
+
+\`\`\`bash
+npx paperlint submission show papers/<paper>
+npx paperlint submission update papers/<paper>
+# … the author reads the dry run and says yes …
+npx paperlint submission update papers/<paper> --save
+npx paperlint submission show papers/<paper>
+\`\`\`
+
+## Reading the answers
+
+- \`match yes\` is the only proof the reviewers get the local build; a status of \`submitted\` alone
+  says nothing about WHICH PDF.
+- \`the portal refused (HTTP 401): …\` — the token is missing, wrong or expired; \`403\` — the token
+  lacks the scope, or the deadline has passed for this change. The text after the colon is
+  HotCRP's own; quote it.
+- \`SAVE WITHHELD by the portal\` — HotCRP did not save; nothing changed.
+
+## What this skill does not do
+
+It does not decide whether the paper is ready (that is \`harden-paper\`), anonymize it, or fill the
+submission form's other fields (authors, conflicts) — see \`submit-paper\`.`,
+});

package/skills/submission-portal/submission-portal.eval.mjs

@@ -0,0 +1,15 @@
+/**
+ * submission-portal — the PAID tier: does this skill's description actually fire?
+ *
+ * The prompts live in `lib/skill-trigger-cases.mjs` beside every other skill's, so collisions with
+ * `submit-paper` and `osf-artifact-upload` are visible in one table. Measures recall on its own
+ * territory and precision against those siblings, against the real harness.
+ *
+ * ⚠️ NEVER RUN. Written 2026-10-03 with the skill; its rate is UNKNOWN, not assumed good.
+ *
+ * Costs money; not CI.
+ *   node skills/submission-portal/submission-portal.eval.mjs [trials]
+ */
+import { runSkillTriggerEval } from "../../lib/skill-eval-kit.mjs";
+
+await runSkillTriggerEval("submission-portal");

package/skills/submission-portal/submission-portal.test.ts

@@ -0,0 +1,81 @@
+/**
+ * submission-portal — the free tier: the skill's commands are commands the CLI accepts, in the
+ * order the skill promises, and the skill passes the shared per-skill checks. No model, no network,
+ * no portal.
+ *
+ * 🔴 WHY THE COMMANDS ARE PARSED, NOT GREPPED: a skill that tells the agent to run a flag the CLI
+ * refuses fails at the worst moment — before a deadline, on a real submission. So every
+ * `paperlint submission …` the skill writes goes through the CLI's own argument parser and its
+ * usage check, and must come out runnable.
+ */
+import assert from "node:assert/strict";
+import { readFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { test } from "vitest";
+import { commandsIn } from "vigiles";
+import { checkSkill } from "../../lib/skill-checks.mjs";
+import { parseArgs } from "../../src/cli.ts";
+import { usageProblem } from "../../src/submission.ts";
+
+const SKILL = readFileSync(
+  join(dirname(fileURLToPath(import.meta.url)), "SKILL.md"),
+  "utf8",
+);
+const commands = commandsIn(
+  SKILL,
+  /(^|[|;&]\s*)npx paperlint submission\b/,
+).map((c) => c.text);
+
+/** A command as the CLI receives it: the words after `npx paperlint`. */
+const argvOf = (command: string): string[] =>
+  command
+    .replace(/^.*?npx paperlint /, "")
+    .split(/\s+/)
+    .filter(Boolean);
+
+test("the skill names show, a dry run and a save — and nothing else", () => {
+  const kinds = commands.map((c) => {
+    const a = parseArgs(argvOf(c));
+    return `${String(a.paths[0])}${a.save ? " --save" : ""}`;
+  });
+  assert.deepEqual([...new Set(kinds)], ["show", "update", "update --save"]);
+});
+
+test("every `paperlint submission` command in the skill is one the CLI runs", () => {
+  assert.ok(
+    commands.length > 0,
+    "the skill names no `paperlint submission` command",
+  );
+  for (const c of commands) {
+    const a = parseArgs(argvOf(c));
+    assert.equal(a.cmd, "submission", c);
+    assert.equal(a.unknownFlag, undefined, c);
+    assert.equal(a.missingValue, undefined, c);
+    const problem = usageProblem({
+      sub: a.paths[0],
+      paperDir: a.paths[1] ?? ".",
+      extra: a.paths.slice(2),
+      pdf: a.pdf,
+      abstract: a.abstract,
+      submit: a.submit,
+      save: a.save,
+    });
+    assert.equal(problem, null, c);
+  }
+});
+
+test("🔴 the procedure reads, dry-runs, then saves, then reads again — never saves first", () => {
+  const order = commands.map((c) => {
+    const a = parseArgs(argvOf(c));
+    return a.paths[0] === "show" ? "show" : a.save ? "save" : "dry";
+  });
+  const firstSave = order.indexOf("save");
+  assert.ok(firstSave > order.indexOf("dry"), order.join(" → "));
+  assert.ok(order.indexOf("dry") > order.indexOf("show"), order.join(" → "));
+  assert.ok(order.lastIndexOf("show") > firstSave, order.join(" → "));
+});
+
+test("the shared per-skill checks pass", async () => {
+  await checkSkill("submission-portal");
+});

package/skills/submit-paper/SKILL.md

@@ -4,7 +4,7 @@ description: End-to-end playbook for submitting a peer-reviewed paper to a doubl
 allowed-tools: [Read, Write, Edit, Grep, Glob, Bash, WebSearch, WebFetch, Skill]
 ---
 
-<!-- vigiles:sha256:9e57bcb2ba1fb055 compiled from skills/submit-paper/SKILL.md.spec.ts -->
+<!-- vigiles:sha256:767a4757d1df67d3 compiled from skills/submit-paper/SKILL.md.spec.ts -->
 
 # submit-paper — get a reviewed paper from "done" to "ready for review"
 
@@ -110,6 +110,7 @@ Many workshop HotCRPs have **no supplementary-upload field** — check first; if
   is the step people miss.
 - You can edit until the deadline: use **Replace** on the Submission field to swap the PDF for a late
   fix (e.g. adding the artifact link after you host it). Submit early, upgrade before the deadline.
+- When the venue preset declares its HotCRP portal, replacing the PDF or abstract and proving the portal holds the latest build is `submission-portal` (`paperlint submission show|update`).
 
 ## 6. Independent-researcher / dossier notes
 - **Name consistency** is the quiet risk: publications, LinkedIn, passport, letters must resolve to one

package/skills/submit-paper/SKILL.md.spec.ts

@@ -126,6 +126,7 @@ Many workshop HotCRPs have **no supplementary-upload field** — check first; if
   is the step people miss.
 - You can edit until the deadline: use **Replace** on the Submission field to swap the PDF for a late
   fix (e.g. adding the artifact link after you host it). Submit early, upgrade before the deadline.
+- When the venue preset declares its HotCRP portal, replacing the PDF or abstract and proving the portal holds the latest build is \`submission-portal\` (\`paperlint submission show|update\`).
 
 ## 6. Independent-researcher / dossier notes
 - **Name consistency** is the quiet risk: publications, LinkedIn, passport, letters must resolve to one

package/src/adapters/hotcrp/cassette/README.md

@@ -0,0 +1,24 @@
+# HotCRP cassette
+
+Real answers to the requests `paperlint submission` sends, recorded from a live HotCRP instance
+through HotCRP's documented API (`/api/paper`). `portal.test.ts` replays them from its
+local mock server and parses each one through the adapter's real zod schemas: a schema that rejects
+a real answer is the defect class these files exist to catch. A hand-written mock body is what let
+a wrong upload field name through once.
+
+Only read-only requests were recorded: one `GET` and two `POST`s with `dry_run=1` — nothing was
+saved. Identifying values (the submission id, title, abstract, authors, topics, the PDF's hash, the
+timestamps) are replaced with fakes; HotCRP's keys, value types, statuses and message texts are
+verbatim.
+
+| file              | request                                                                                                                                                   | HTTP |
+| ----------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------- | ---: |
+| `get-paper.json`  | `GET /api/paper?p=<id>&word_limit=hard` with a token                                                                                                      |  200 |
+| `get-noauth.json` | the same without a token                                                                                                                                  |  401 |
+| `post-dot.json`   | `POST /api/paper?p=<id>&dry_run=1`, PDF part named `paper.pdf`, `content_file` the same — PHP renames the field to `paper_pdf`, so HotCRP finds no upload |  200 |
+| `post-ok.json`    | the same with the part and `content_file` named `paperlint_pdf`                                                                                           |  200 |
+
+To re-record: run the same four requests with `curl` against a HotCRP site where you have a
+submission and a token (`Authorization: bearer $HOTCRP_TOKEN`), always with `dry_run=1` on a `POST`,
+save each body, then replace every identifying value with a fake of the same type before committing.
+These files ship in the npm package with the rest of `src/`, like the tests beside them.

package/src/adapters/hotcrp/cassette/get-noauth.json

@@ -0,0 +1,10 @@
+{
+  "ok": false,
+  "message_list": [
+    {
+      "status": 2,
+      "message": "<0>Missing credentials"
+    }
+  ],
+  "status_code": 401
+}

package/src/adapters/hotcrp/cassette/get-paper.json

@@ -0,0 +1,39 @@
+{
+  "ok": true,
+  "paper": {
+    "object": "paper",
+    "pid": 7,
+    "title": "An Example Paper Title",
+    "submission": {
+      "mimetype": "application/pdf",
+      "hash": "sha2-b3e602c135f2455f64aecfdc2e1e7f81dad20c5d69f0981e965b1a0131d47163",
+      "timestamp": 1790000000,
+      "size": 17,
+      "pages": 2
+    },
+    "abstract": "An example abstract of exactly ten words for the test.",
+    "contacts": [
+      {
+        "email": "author@example.org",
+        "given_name": "A.",
+        "family_name": "Author",
+        "affiliation": "Example University"
+      }
+    ],
+    "paper_type": "Example paper type",
+    "authors": [
+      {
+        "email": "author@example.org",
+        "given_name": "A.",
+        "family_name": "Author",
+        "affiliation": "Example University"
+      }
+    ],
+    "topics": ["Example topic one", "Example topic two"],
+    "pc_conflicts": {},
+    "status": "submitted",
+    "submitted": true,
+    "submitted_at": 1790000100,
+    "modified_at": 1790000100
+  }
+}

package/src/adapters/hotcrp/cassette/post-dot.json

@@ -0,0 +1,21 @@
+{
+  "ok": false,
+  "message_list": [
+    {
+      "status": 2,
+      "field": "submission",
+      "message": "<0>Ignored attempt to upload document without any content"
+    },
+    {
+      "status": 3,
+      "field": "submission"
+    },
+    {
+      "status": -3
+    }
+  ],
+  "dry_run": true,
+  "valid": false,
+  "change_list": [],
+  "pid": 7
+}

package/src/adapters/hotcrp/cassette/post-ok.json

@@ -0,0 +1,12 @@
+{
+  "ok": true,
+  "message_list": [
+    {
+      "status": -3
+    }
+  ],
+  "dry_run": true,
+  "valid": true,
+  "change_list": ["submission"],
+  "pid": 7
+}

package/src/adapters/hotcrp/index.ts

@@ -0,0 +1,11 @@
+/**
+ * HotCRP, as the `SubmissionPortal` port: its REST API read and written over `fetch`, its answers
+ * parsed here. Everything that changes if HotCRP's API does lives in this folder.
+ */
+export {
+  CONTENT_FIELD,
+  changeObject,
+  hotcrpPortal,
+  type HotcrpOptions,
+} from "./portal.io.ts";
+export { parseShow, parseUpdate, sha256OfHash } from "./response.ts";

package/src/adapters/hotcrp/portal.io.ts

@@ -0,0 +1,130 @@
+/**
+ * HotCRP's REST API (`<site>/api/paper`) as the `SubmissionPortal` port, over Node's `fetch`.
+ *
+ * Read: `GET /api/paper?p=<id>&word_limit=hard` (scope `submeta:read`; `word_limit=hard` returns the
+ * whole abstract instead of one cut at the soft limit).
+ *
+ * Change: `POST /api/paper?p=<id>` as multipart/form-data — a `json` field holding a submission
+ * object, and the PDF as a file part whose field name is the object's `submission.content_file`
+ * (the documented form: `curl -F "json=<data.json" -F paper.pdf=@paper.pdf SITEURL/api/paper`).
+ * Without `save` the request carries `dry_run=1`: HotCRP checks the change and keeps nothing.
+ *
+ * 🔴 THE TOKEN goes in the `Authorization` header and nowhere else: not into a URL, a message, or an
+ * error. A failure is described by HTTP status, HotCRP's own messages, or the network error's text.
+ */
+import { messageOf } from "../../domain/text.ts";
+import { err, type Result } from "../../domain/result.ts";
+import type {
+  PortalFailure,
+  SubmissionChange,
+} from "../../domain/submission.ts";
+import type { SubmissionPortal } from "../../ports/submission-portal.ts";
+import { parseShow, parseUpdate } from "./response.ts";
+
+/**
+ * The form field the PDF travels in, and the name the `json` object's `content_file` refers to it
+ * by. 🔴 NO DOT, SPACE OR BRACKET: HotCRP looks the name up in PHP's `$_FILES`, and PHP renames a
+ * dot or a space in a field name to `_`. The documented `-F paper.pdf=@paper.pdf` therefore arrives
+ * as `paper_pdf`, the lookup of `paper.pdf` misses, and HotCRP answers "Ignored attempt to upload
+ * document without any content" with `valid: false` — measured on a real HotCRP, 2026-10-03.
+ */
+export const CONTENT_FIELD = "paperlint_pdf";
+
+/** Uploads take a while on a slow link; a read should not. */
+const READ_TIMEOUT_MS = 60_000;
+const WRITE_TIMEOUT_MS = 300_000;
+
+export interface HotcrpOptions {
+  /** The site's base URL, no trailing slash: `https://example.org`. */
+  readonly url: string;
+  readonly token: string;
+}
+
+type Answer = Result<
+  { readonly status: number; readonly body: unknown },
+  PortalFailure
+>;
+
+/** One request → HTTP status and parsed JSON body, or why there is neither. */
+async function call(
+  url: string,
+  init: { readonly method: string; readonly body?: Readonly<FormData> },
+  token: string,
+  timeoutMs: number,
+): Promise<Answer> {
+  try {
+    const r = await fetch(url, {
+      ...init,
+      headers: { Authorization: `bearer ${token}`, Accept: "application/json" },
+      signal: AbortSignal.timeout(timeoutMs),
+    });
+    const text = await r.text();
+    try {
+      return { ok: true, value: { status: r.status, body: JSON.parse(text) } };
+    } catch {
+      return err({
+        kind: "malformed",
+        httpStatus: r.status,
+        detail: `the answer is not JSON (${r.headers.get("content-type") ?? "no content type"})`,
+      });
+    }
+  } catch (e) {
+    return err({ kind: "unreachable", detail: messageOf(e) });
+  }
+}
+
+/** The submission object a change sends: only the fields it changes. */
+export function changeObject(
+  id: number,
+  c: SubmissionChange,
+): Readonly<Record<string, unknown>> {
+  return {
+    object: "paper",
+    pid: id,
+    ...(c.pdf === null ? {} : { submission: { content_file: CONTENT_FIELD } }),
+    ...(c.abstract === null ? {} : { abstract: c.abstract }),
+    ...(c.submit ? { status: "submitted" } : {}),
+  };
+}
+
+function formOf(id: number, c: SubmissionChange): Readonly<FormData> {
+  const form = new FormData();
+  form.append("json", JSON.stringify(changeObject(id, c)));
+  if (c.pdf !== null)
+    form.append(
+      CONTENT_FIELD,
+      new Blob([new Uint8Array(c.pdf.bytes)], { type: "application/pdf" }),
+      c.pdf.name,
+    );
+  return form;
+}
+
+const endpoint = (
+  base: string,
+  params: Readonly<Record<string, string>>,
+): string => `${base}/api/paper?${new URLSearchParams(params).toString()}`;
+
+/** HotCRP at `o.url`, read and changed with `o.token`. */
+export function hotcrpPortal(o: HotcrpOptions): SubmissionPortal {
+  return {
+    async show(id) {
+      const url = endpoint(o.url, { p: String(id), word_limit: "hard" });
+      const a = await call(url, { method: "GET" }, o.token, READ_TIMEOUT_MS);
+      return a.ok ? parseShow(a.value.status, a.value.body) : a;
+    },
+    async update(id, change, { save }) {
+      const url = endpoint(o.url, {
+        p: String(id),
+        ...(save ? {} : { dry_run: "1" }),
+      });
+      const body = formOf(id, change);
+      const a = await call(
+        url,
+        { method: "POST", body },
+        o.token,
+        WRITE_TIMEOUT_MS,
+      );
+      return a.ok ? parseUpdate(a.value.status, a.value.body) : a;
+    },
+  };
+}