@event4u/agent-config 16.1.0 → 16.2.0

package/src/scripts/_lib/read_surface_scan.ts

@@ -0,0 +1,322 @@
+/**
+ * Read-surface scanner — derive the sanitize floor's coverage list from the
+ * imports, not from intent
+ * (road-to-a-sanitize-list-that-is-generated, Phase 1).
+ *
+ * WHY A SCANNER AND NOT A LIST
+ * ----------------------------
+ * `retrieval_sanitize.ts` used to carry a hand-maintained prose list of the
+ * read surfaces it covers, with its own header stating the rule for anything
+ * not on it: uncovered. That list went wrong in both directions — a path that
+ * reaches the outside world and IS sanitized was absent from it, and two paths
+ * carrying fetched bytes toward a model-facing surface were neither listed nor
+ * covered. The header already recorded the same failure happening once before,
+ * for the same reason: a list maintained by hand records what its author meant,
+ * and the tree records what the code does.
+ *
+ * This module derives the list. A row cannot disagree with the tree, because
+ * the tree is the only thing it reads.
+ *
+ * WHAT A ROW MEANS, AND WHAT IT DOES NOT
+ * --------------------------------------
+ * A row says a module matched an INBOUND shape — a recognised way outside bytes
+ * enter this process — and whether that module imports the sanitize floor. It
+ * does not say the floor is applied to the right string, at the right point, or
+ * at all: an import is evidence of intent, and only a read of the module
+ * establishes the rest. `covered` here means "the floor is in scope in this
+ * module", never "this module is safe".
+ *
+ * THE MISSING-ROW FAILURE, AND WHY `unclassified` EXISTS
+ * -----------------------------------------------------
+ * A generated table carries an authority a hand-written one never claimed, so
+ * its worst failure is not a wrong row — it is an ABSENT one. A fetch shape the
+ * scanner does not recognise produces no row, and a missing row reads as "no
+ * surface here".
+ *
+ * Two things push back. Inbound shapes are plural and named (a `fetch`, a
+ * `node:http(s)` request, a subprocess of a remote-fetching tool, a parse of
+ * markup arriving on stdin) rather than a single pattern. And a WEAK shape —
+ * a network call reached through an injected or computed callee, which the
+ * strong detectors cannot see — still emits a row, marked `unclassified`, so an
+ * unrecognised shape appears in the table as a visible gap instead of as
+ * silence. The residual is stated in the table's own header rather than left
+ * for a reader to discover: a module whose network access is reached through a
+ * shape matching neither set is still absent.
+ */
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+
+/** Coverage verdict for one read surface. */
+export type SurfaceCoverage = 'covered' | 'uncovered' | 'unclassified';
+
+/** One module that brings outside bytes in and hands a string onward. */
+export interface ReadSurfaceRow {
+    /** Path relative to `src/scripts/`, POSIX separators. */
+    readonly module: string;
+    /** Inbound shape id that matched. */
+    readonly inbound: string;
+    /** Emit shape id that matched, or `undecided`. */
+    readonly emit: string;
+    readonly coverage: SurfaceCoverage;
+    /** Why the row reads the way it does — one clause, no paraphrase. */
+    readonly evidence: string;
+}
+
+interface ShapeDetector {
+    readonly id: string;
+    /** True when this module's source carries the shape. */
+    readonly match: (src: string) => boolean;
+}
+
+/** True when the module imports node's HTTP client at all. */
+function _importsNodeHttp(src: string): boolean {
+    return /from\s+['"]node:https?['"]/.test(src);
+}
+
+/**
+ * Strong inbound shapes — a recognised way outside bytes enter this process.
+ *
+ * Each is deliberately narrow. `await fetch(` rather than `fetch(` keeps a
+ * fetch call named inside a string literal (a spawned one-liner, a doc example)
+ * out of the table; the node-HTTP shape requires the import as well as the call
+ * so a `.get(` on an unrelated object cannot produce a row.
+ */
+export const STRONG_INBOUND: readonly ShapeDetector[] = [
+    {
+        id: 'network-fetch',
+        match: (s) => /\bawait\s+fetch\s*\(/.test(s),
+    },
+    {
+        id: 'node-http-request',
+        match: (s) => _importsNodeHttp(s) && /\bhttps?\s*\.\s*(?:get|request)\s*\(/.test(s),
+    },
+    {
+        id: 'remote-subprocess',
+        match: (s) =>
+            /\b(?:spawnSync|spawn|execSync|execFileSync|execFile)\s*\(\s*\[?\s*['"`](?:curl|wget|gh)['"`]/.test(s),
+    },
+    {
+        id: 'stdin-markup-parse',
+        match: (s) =>
+            /\bprocess\s*\.\s*stdin\b/.test(s) && /&(?:amp|lt|gt|quot|nbsp|#x?[0-9a-f]+);/i.test(s),
+    },
+    {
+        id: 'declared',
+        match: (s) => _DECLARATION_RE.test(s),
+    },
+];
+
+/**
+ * A module may declare its own inbound shape when no syntactic one captures it.
+ *
+ * The shapes above are all things the scanner can SEE. A host primitive cannot
+ * be seen: a subagent reply, an MCP tool result and a host file-read arrive
+ * through a channel this package does not own, so no call site in this tree
+ * spells them. Risk 1 of the roadmap that produced this scanner names exactly
+ * that class, and the answer it demands is a visible row rather than silence.
+ *
+ * The marker is a comment at the site — `// read-surface: <shape-id>` — not a
+ * line in a central list, which is the arrangement this whole module exists to
+ * retire. A declaration says only "outside bytes arrive here"; the coverage
+ * verdict is still read from the imports, so declaring a surface cannot make it
+ * read `covered`.
+ */
+const _DECLARATION_RE = /\/\/\s*read-surface:\s*([a-z0-9-]+)/;
+
+/** `git` is deliberately NOT a remote command above. */
+export const LOCAL_VCS_EXCLUSION =
+    'a `git` subprocess reads local repository state, not outside bytes, so it is not an ' +
+    'inbound shape. `git fetch` and `git ls-remote` move refs rather than content and are ' +
+    'excluded with the rest — a branch name is attacker-influenceable in principle, and if ' +
+    'that ever reaches a model-facing surface it needs its own row, not a widened matcher ' +
+    'that would re-add every local `git status` wrapper in the tree.';
+
+/**
+ * Weak inbound shapes — a network call the strong detectors cannot resolve.
+ *
+ * `await this._fetch(url, …)` is a real HTTP request behind an injected
+ * dependency, which is exactly the shape a strong matcher on `await fetch(`
+ * misses. It produces a row rather than silence; the verdict is
+ * `unclassified`, because the scanner cannot tell an injected fetch from an
+ * injected stub without executing it.
+ */
+export const WEAK_INBOUND: readonly ShapeDetector[] = [
+    {
+        id: 'indirect-fetch',
+        match: (s) => /\bawait\s+(?:this|self|[a-z_$][\w$]*)\s*\.\s*_?fetch\s*\(/i.test(s),
+    },
+];
+
+/** Recognised ways a module hands a string onward. */
+export const EMIT_SHAPES: readonly ShapeDetector[] = [
+    { id: 'file-write', match: (s) => /\b(?:writeFileSync|appendFileSync|writeFile)\s*\(/.test(s) },
+    { id: 'stdout-write', match: (s) => /\bprocess\s*\.\s*stdout\s*\.\s*write\s*\(/.test(s) },
+    { id: 'exported-api', match: (s) => /^export\s+(?:async\s+)?function\s/m.test(s) },
+];
+
+/** The sanitize floor, as an import. One hop; a transitive import is not counted. */
+const _SANITIZE_IMPORT_RE =
+    /import\s*\{[^}]*\b(?:sanitize_text|sanitize_entry|sanitize_markup)\b[^}]*\}\s*from\s*['"][^'"]*retrieval_sanitize(?:\.js)?['"]/;
+
+/** Test files under `src/scripts/` — fixtures, not surfaces that ship bytes. */
+const _EXCLUDE_RE = /(?:^|\/)(?:__tests__|node_modules)\/|\.test\.ts$/;
+
+/**
+ * Modules that define or read the coverage rather than being a surface.
+ *
+ * The scanner and its gate quote every detector pattern above as a literal, so
+ * they match their own matchers. Excluding them by name is the honest fix: a
+ * row for the scanner would be an artefact of the scanner reading itself, and
+ * carrying it would train a reader to skip rows.
+ */
+const _SELF_MODULES: ReadonlySet<string> = new Set([
+    '_lib/retrieval_sanitize.ts',
+    '_lib/read_surface_scan.ts',
+    'check_read_surface_coverage.ts',
+]);
+
+/**
+ * Raised when a directory under the scan root cannot be read.
+ *
+ * The walk used to swallow the error and return, which made an INCOMPLETE scan
+ * indistinguishable from a complete one: a permission error on one subtree
+ * silently removed every module under it from the table, and the gate then
+ * reported the shortened list as matching the tree. An independent review named
+ * it; the direction is the same one `assertScanned` enforces at the corpus
+ * level, applied to the traversal that builds the corpus.
+ */
+export class ScanTraversalError extends Error {
+    constructor(readonly dir: string, cause: unknown) {
+        super(`read_surface_scan: cannot read ${dir} — the scan is incomplete, not clean (${String(cause)})`);
+        this.name = 'ScanTraversalError';
+    }
+}
+
+/**
+ * Directory reader, injectable for one reason: to test the failure.
+ *
+ * The fail-closed branch below can only be exercised by a `readdirSync` that
+ * throws, and on ESM `vi.spyOn(fs, 'readdirSync')` cannot redefine the
+ * namespace property. The alternative — chmod-000 on a real directory — is not
+ * portable, because under root the mode is no barrier and the test then fails
+ * in exactly the environment it was written to survive. A narrow seam is the
+ * honest shape: production passes nothing and gets `fs.readdirSync`.
+ */
+export type ReadDir = (dir: string) => fs.Dirent[];
+
+const _defaultReadDir: ReadDir = (dir) => fs.readdirSync(dir, { withFileTypes: true });
+
+function _walk(dir: string, base: string, out: string[], readDir: ReadDir): void {
+    let entries: fs.Dirent[];
+    try {
+        entries = readDir(dir);
+    } catch (exc) {
+        throw new ScanTraversalError(dir, exc);
+    }
+    for (const e of entries) {
+        const abs = path.join(dir, e.name);
+        const rel = path.relative(base, abs).split(path.sep).join('/');
+        if (e.isDirectory()) {
+            _walk(abs, base, out, readDir);
+        } else if (e.isFile() && rel.endsWith('.ts') && !rel.endsWith('.d.ts') && !_EXCLUDE_RE.test(rel)) {
+            out.push(rel);
+        }
+    }
+}
+
+/** The scan root, repo-relative. Published so the gate can name it in an error. */
+export const SCAN_ROOT = 'src/scripts';
+
+/**
+ * Scan every TypeScript module under `src/scripts/` and return one row per
+ * module that both brings outside bytes in and hands a string onward.
+ *
+ * Rows are sorted by module path so the rendered table is stable across
+ * filesystems.
+ */
+export function scanReadSurfaces(repoRoot: string, readDir: ReadDir = _defaultReadDir): ReadSurfaceRow[] {
+    const base = path.join(repoRoot, SCAN_ROOT);
+    const files: string[] = [];
+    _walk(base, base, files, readDir);
+    files.sort();
+
+    const rows: ReadSurfaceRow[] = [];
+    for (const rel of files) {
+        if (_SELF_MODULES.has(rel)) continue;
+        let src: string;
+        try {
+            src = fs.readFileSync(path.join(base, rel), 'utf-8');
+        } catch {
+            continue;
+        }
+        const strong = STRONG_INBOUND.find((d) => d.match(src));
+        const weak = strong === undefined ? WEAK_INBOUND.find((d) => d.match(src)) : undefined;
+        if (strong === undefined && weak === undefined) continue;
+        // A declared surface reports the shape its own marker names, so the
+        // table says `ingested-corpus` rather than the detector's own id.
+        const strongId =
+            strong?.id === 'declared' ? (_DECLARATION_RE.exec(src)?.[1] ?? 'declared') : strong?.id;
+
+        const emit = EMIT_SHAPES.find((d) => d.match(src));
+        const sanitized = _SANITIZE_IMPORT_RE.test(src);
+
+        if (weak !== undefined) {
+            rows.push({
+                module: rel,
+                inbound: weak.id,
+                emit: emit?.id ?? 'undecided',
+                coverage: 'unclassified',
+                evidence: 'network access through a callee the scanner cannot resolve — read the module',
+            });
+            continue;
+        }
+        if (emit === undefined) {
+            rows.push({
+                module: rel,
+                inbound: strongId ?? 'unknown',
+                emit: 'undecided',
+                coverage: 'unclassified',
+                evidence: 'inbound bytes with no recognised emit — the onward path is undecided',
+            });
+            continue;
+        }
+        rows.push({
+            module: rel,
+            inbound: strongId ?? 'unknown',
+            emit: emit.id,
+            coverage: sanitized ? 'covered' : 'uncovered',
+            evidence: sanitized
+                ? 'imports the sanitize floor'
+                : 'no sanitize import — fetched bytes reach the emit unfiltered',
+        });
+    }
+    return rows;
+}
+
+/** Counts by verdict, for the gate's scanned line and for the table header. */
+export function tally(rows: readonly ReadSurfaceRow[]): Record<SurfaceCoverage, number> {
+    const out: Record<SurfaceCoverage, number> = { covered: 0, uncovered: 0, unclassified: 0 };
+    for (const r of rows) out[r.coverage] += 1;
+    return out;
+}
+
+/** Render the rows as the markdown table body committed to the contract doc. */
+export function renderTable(rows: readonly ReadSurfaceRow[]): string {
+    const lines = [
+        '| module (under `src/scripts/`) | inbound shape | emit shape | coverage | evidence |',
+        '|---|---|---|---|---|',
+    ];
+    for (const r of rows) {
+        lines.push(
+            `| \`${r.module}\` | \`${r.inbound}\` | \`${r.emit}\` | **${r.coverage}** | ${r.evidence} |`,
+        );
+    }
+    const t = tally(rows);
+    lines.push('');
+    lines.push(
+        `${String(rows.length)} read surface(s): ` +
+            `${String(t.covered)} covered, ${String(t.uncovered)} uncovered, ` +
+            `${String(t.unclassified)} unclassified.`,
+    );
+    return lines.join('\n');
+}

package/src/scripts/_lib/release_highlights.ts

@@ -574,7 +574,8 @@ export function section_publication_blockers(
                 'fails, so a missing line means the collection failed during `task release`. ' +
                 'Fix the collection, then render the number and put it on the section — ' +
                 `the release commit already exists on ${where}, so amend it there. Do not ` +
-                'invent the count: `npx vitest list | wc -l` is the same probe the writer runs.',
+                'invent the count: `npx vitest list --staticParse=false | grep -c .` is the same ' +
+                'probe the writer runs.',
         );
     }
     return out;

package/src/scripts/_lib/retrieval_sanitize.ts

@@ -16,26 +16,58 @@
  * Codepoint classes are shared with `lint_hidden_unicode` (one source of truth
  * for what counts as a hidden-instruction vector).
  *
- * WHERE IT ACTUALLY RUNS — measured end-to-end, not asserted. Keep this list
- * honest: an earlier version of this header named surfaces by intent, and the
- * legacy-envelope gap below went unnoticed for exactly that reason. Every
- * claim here is backed by a probe row in
- * `agents/evidence/reports/sanitize-floor-wiring.md`:
+ * WHERE IT ACTUALLY RUNS — read the table, which is GENERATED:
  *
- *   - `retrieve_v1()`     — yes (`memory_lookup.ts` calls `sanitize_entry`)
- *   - `memory_get_v1()`   — yes (same)
- *   - MCP `memory_lookup` / `memory_get` tools — inherited from the two above
- *   - `retrieve()` / `retrieve_with_meta()` — yes, since the S0.0 wiring fix;
- *     before it they emitted every vector intact, and so did the CLI default
- *     (`--envelope legacy`), which is the path the rules document
- *   - inter-agent channels (`ai_team` / `ai_council` model replies) — the
- *     inbound parse choke point only; the subagent boundary itself is a HOST
- *     primitive this package cannot reach (see the report, § S0.0b)
+ *     docs/contracts/retrieval-read-surfaces.md
  *
- * Anything not on that list is uncovered. Do not widen the list without a
- * probe row to back it.
+ * This header used to carry that list inline, and the list was wrong in BOTH
+ * directions: a path that reaches the outside world and IS sanitized was
+ * absent from it, and two paths carrying fetched bytes toward a model-facing
+ * surface were neither listed nor covered. An earlier version had already
+ * failed the same way — it named surfaces by intent, and the legacy-envelope
+ * gap went unnoticed for exactly that reason. Twice is a property of the
+ * mechanism, not of the entries, which is why the list is now derived from the
+ * import graph by `check_read_surface_coverage` and this header points at it
+ * instead of copying it. A divergence between the two FAILS that gate; two
+ * copies is how it went stale.
+ *
+ * Anything absent from the table is uncovered, and a module the generator
+ * cannot classify appears there as an `unclassified` ROW rather than being
+ * omitted — a missing row would read as no surface at all.
+ *
+ * One boundary the table cannot move: the subagent boundary itself is a HOST
+ * primitive this package cannot reach, so the inter-agent channels are covered
+ * at the inbound parse choke point and nowhere else.
+ *
+ * loss_class: ephemeral-lossy
+ *
+ * `sanitize_text` drops hidden-instruction codepoints, control-char noise and
+ * invisible fillers, and caps the result at MAX_FIELD_CHARS. None of that is
+ * reconstructible from the output, and for the dropped vectors the
+ * unrecoverability IS the guarantee — a retrieval path that could hand back
+ * the vector it stripped would not be a floor. So the class is
+ * `ephemeral-lossy` for the module, even though `sanitize_markup` below
+ * returns structured removals for the layer it composes: a class names what a
+ * caller can recover from the output, and `sanitize_text` returns a string.
+ *
+ * THE STRUCTURAL LAYER IS A SEPARATE MODULE. Everything below is a CODEPOINT
+ * floor. Fetched markup also hides content STRUCTURALLY — an HTML comment, a
+ * `<template>` block, a `style="display:none"` span — which no codepoint
+ * predicate can see. That class is covered by `_lib/structural_hiding.ts`,
+ * composed with this floor by `sanitize_markup` below, and it is covered for
+ * fetched MARKUP only: a caller holding plain text needs nothing from it.
+ *
+ * WHAT THAT LAYER STILL DOES NOT SEE is a register in its own file —
+ * `STRUCTURAL_HIDING_GAPS` — and every surface claiming the coverage cites the
+ * register alongside the claim, because a detector cited without its gaps is
+ * how the claim becomes a false green. No recall or coverage percentage is
+ * published for it anywhere; a rate needs a frozen corpus and none exists.
+ * `aria-hidden` is deliberately NOT one of its channels
+ * (`STRUCTURAL_HIDING_NON_CHANNELS` says why).
  */
 import { _classify } from '../lint_hidden_unicode.js';
+import { strip_structural_hiding } from './structural_hiding.js';
+import type { StructuralRemoval } from './structural_hiding.js';
 import { TOKEN_RE, classifyToken } from './confusables.js';
 
 /** Hard per-field length cap — bounds a runaway/adversarial body. */
@@ -85,6 +117,35 @@ export function sanitize_text(s: string): string {
     return out.length > MAX_FIELD_CHARS ? out.slice(0, MAX_FIELD_CHARS) : out;
 }
 
+/**
+ * The fetched-markup floor: structural pre-pass, then the codepoint floor.
+ *
+ * ORDER IS LOAD-BEARING. The structural pass runs FIRST, because a codepoint
+ * floor applied first would sanitize text that is about to be discarded and,
+ * worse, would leave a hidden subtree looking clean. Running it second means
+ * every byte that survives the structural pass still clears the codepoint
+ * floor — including the text that was only reachable once markup was removed.
+ *
+ * Use this for fetched MARKUP. For plain text `sanitize_text` is the whole
+ * floor and this adds nothing but a parse.
+ *
+ * The removals are RETURNED, not logged and not swallowed: a caller debugging
+ * a corrupted result needs to know what went and where it was. See the removal
+ * policy in `structural_hiding.ts`.
+ */
+export function sanitize_markup(markup: string): {
+    text: string;
+    removals: readonly StructuralRemoval[];
+    truncated: boolean;
+} {
+    const stripped = strip_structural_hiding(markup);
+    return {
+        text: sanitize_text(stripped.text),
+        removals: stripped.removals,
+        truncated: stripped.truncated,
+    };
+}
+
 /**
  * Report the INVISIBLE layer without removing it.
  *

package/src/scripts/_lib/shell_write_shapes.ts

@@ -0,0 +1,108 @@
+/**
+ * The shell shapes that mean "this path is being WRITTEN", shared by the
+ * PreToolUse guards that refuse a write to a governed file.
+ *
+ * WHY IT IS SHARED. `block_kernel_rule_writes.ts` grew this parser after the
+ * S0.2 spike measured a real gap: a guard keyed on the TOOL NAME let
+ * `Bash sed -i … src/rules/commit-policy.md` reach the outcome the Write
+ * branch refuses, and a two-step `Write` → `Bash mv` sequence did the same with
+ * every individual step allowed. `block_plumbing_writes.ts`
+ * (road-to-a-kernel-that-guards-its-plumbing 1.2) refuses a different file set
+ * against the same shapes. Two copies of a shell-shape parser is two places a
+ * verb can be added to one and forgotten in the other, and the guard that
+ * silently stopped recognising `tee` would look exactly like the guard that
+ * never had to.
+ *
+ * DELIBERATELY NARROW (council 2026-08-02 cut, option ii, recorded on the
+ * kernel guard and inherited here unchanged): only redirection into the path,
+ * an in-place `sed`, a `tee`/`truncate`/`rm`/`shred` naming it, or a
+ * `mv`/`cp`/`install`/`rsync` whose DESTINATION it is. Reads stay allowed —
+ * `cat`, `grep`, `head`, `diff`, `git show` carry none of these shapes — and no
+ * attempt is made to understand arbitrary shell. Recognising every conceivable
+ * write verb would make this a shell sandbox, which is the failure mode the
+ * council named.
+ *
+ * KNOWN-OPEN, stated rather than implied: a write routed through an
+ * interpreter (`python -c`, a heredoc fed to `sh`) carries none of these
+ * shapes and is not detected. This is a guard, not write mediation.
+ */
+import * as path from 'node:path';
+
+/** In-place mutators that name their target as a plain argument. */
+const MUTATOR_VERBS: ReadonlySet<string> = new Set(['sed', 'tee', 'truncate', 'rm', 'shred']);
+
+/** Verbs whose LAST positional argument is the destination. */
+const DEST_LAST_VERBS: ReadonlySet<string> = new Set(['mv', 'cp', 'install', 'rsync']);
+
+/**
+ * The first governed target a command WRITES, or `null`.
+ *
+ * @param command the raw shell string off the tool envelope
+ * @param match   classifies one token: a non-null return names the governed
+ *                target that token resolves to, and is what this returns
+ */
+export function shellWriteTarget<T>(command: string, match: (token: string) => T | null): T | null {
+    const tokens = command.split(/\s+/).filter((t) => t.length > 0);
+    const stripped = tokens.map((t) => t.replace(/^['"]|['"]$/g, ''));
+
+    // Cheap reject first: no governed path in the string at all.
+    if (!stripped.some((t) => match(t) !== null)) {
+        return null;
+    }
+
+    // 1. Redirection into the path: `> p`, `>> p`, `>p`, `>>p`.
+    for (let i = 0; i < stripped.length; i += 1) {
+        const tok = stripped[i] as string;
+        const inline = /^>{1,2}(.+)$/.exec(tok);
+        if (inline) {
+            const r = match(inline[1] as string);
+            if (r !== null) {
+                return r;
+            }
+        }
+        if (tok === '>' || tok === '>>') {
+            const next = stripped[i + 1];
+            if (typeof next === 'string') {
+                const r = match(next);
+                if (r !== null) {
+                    return r;
+                }
+            }
+        }
+    }
+
+    // 2. A mutator verb anywhere in the pipeline, with the path as an argument.
+    //    `sed` only counts in its in-place form — `sed 's/x/y/' file` prints.
+    const verbs = new Set<string>();
+    let prevWasSeparator = true;
+    for (const tok of stripped) {
+        if (['&&', '||', ';', '|'].includes(tok)) {
+            prevWasSeparator = true;
+            continue;
+        }
+        if (prevWasSeparator && !tok.startsWith('-')) {
+            verbs.add(path.basename(tok));
+            prevWasSeparator = false;
+        }
+    }
+    const sedInPlace = verbs.has('sed') && stripped.some((t) => /^-i/.test(t));
+    for (const verb of verbs) {
+        if (verb === 'sed' && !sedInPlace) {
+            continue;
+        }
+        if (MUTATOR_VERBS.has(verb)) {
+            const hit = stripped.map(match).find((r) => r !== null);
+            if (hit !== undefined && hit !== null) {
+                return hit;
+            }
+        }
+        if (DEST_LAST_VERBS.has(verb)) {
+            const last = stripped[stripped.length - 1] as string;
+            const r = match(last);
+            if (r !== null) {
+                return r;
+            }
+        }
+    }
+    return null;
+}