@tagma/sdk 0.6.10 → 0.6.12

package/src/ports.ts

@@ -34,7 +34,13 @@
 // Everything here is pure / deterministic so it can be reused by the CLI,
 // the editor (for preview/simulation), and the engine without side effects.
 
-import type { PortDef, PortType, TaskConfig, TaskPorts } from './types';
+import type {
+  PortDef,
+  PortType,
+  TaskConfig,
+  TaskOutputBindings,
+  TaskPorts,
+} from './types';
 
 // ─── Template substitution ────────────────────────────────────────────
 
@@ -244,6 +250,157 @@ export function resolveTaskInputs(
   return { kind: 'ready', inputs, missingOptional };
 }
 
+// ─── Lightweight binding resolution ──────────────────────────────────
+
+export interface UpstreamBindingData {
+  readonly outputs?: Readonly<Record<string, unknown>> | null;
+  readonly stdout?: string;
+  readonly stderr?: string;
+  readonly normalizedOutput?: string | null;
+  readonly exitCode?: number | null;
+}
+
+export type BindingInputResolution =
+  | {
+      readonly kind: 'ready';
+      readonly inputs: Readonly<Record<string, unknown>>;
+      readonly missingOptional: readonly string[];
+    }
+  | {
+      readonly kind: 'blocked';
+      readonly missingRequired: readonly string[];
+      readonly ambiguous: readonly { input: string; producers: readonly string[] }[];
+      readonly reason: string;
+    };
+
+export function resolveTaskBindingInputs(
+  task: Pick<TaskConfig, 'inputs'>,
+  upstreamData: ReadonlyMap<string, UpstreamBindingData>,
+  dependsOn: readonly string[],
+): BindingInputResolution {
+  const bindings = task.inputs;
+  if (!bindings || Object.keys(bindings).length === 0) {
+    return { kind: 'ready', inputs: {}, missingOptional: [] };
+  }
+
+  const inputs: Record<string, unknown> = {};
+  const missingRequired: string[] = [];
+  const missingOptional: string[] = [];
+  const ambiguous: { input: string; producers: string[] }[] = [];
+
+  for (const [name, binding] of Object.entries(bindings)) {
+    let value: unknown;
+    let present = false;
+
+    if ('value' in binding) {
+      value = binding.value;
+      present = true;
+    } else if (binding.from) {
+      const found = resolveBindingSource(binding.from, upstreamData, dependsOn);
+      if (found.kind === 'ambiguous') {
+        ambiguous.push({ input: name, producers: found.producers });
+        continue;
+      }
+      if (found.kind === 'hit') {
+        value = found.value;
+        present = true;
+      }
+    }
+
+    if (!present && 'default' in binding) {
+      value = binding.default;
+      present = true;
+    }
+
+    if (!present || value === undefined || value === null) {
+      if (binding.required === true) {
+        missingRequired.push(name);
+      } else {
+        missingOptional.push(name);
+      }
+      continue;
+    }
+
+    inputs[name] = value;
+  }
+
+  if (missingRequired.length > 0 || ambiguous.length > 0) {
+    const lines: string[] = [];
+    if (missingRequired.length > 0) {
+      lines.push(`missing required binding input(s): ${missingRequired.join(', ')}`);
+    }
+    for (const amb of ambiguous) {
+      lines.push(
+        `binding input "${amb.input}" is produced by multiple upstreams ` +
+          `(${amb.producers.join(', ')}) — use "taskId.outputs.${amb.input}"`,
+      );
+    }
+    return { kind: 'blocked', missingRequired, ambiguous, reason: lines.join('\n') };
+  }
+
+  return { kind: 'ready', inputs, missingOptional };
+}
+
+type BindingLookup =
+  | { kind: 'hit'; producer: string; value: unknown }
+  | { kind: 'miss' }
+  | { kind: 'ambiguous'; producers: string[] };
+
+function resolveBindingSource(
+  source: string,
+  upstreamData: ReadonlyMap<string, UpstreamBindingData>,
+  dependsOn: readonly string[],
+): BindingLookup {
+  if (source.startsWith('outputs.')) {
+    return findOutputByName(source.slice('outputs.'.length), upstreamData, dependsOn);
+  }
+
+  const outputMarker = '.outputs.';
+  const outputIdx = source.lastIndexOf(outputMarker);
+  if (outputIdx > 0) {
+    const upstreamId = source.slice(0, outputIdx);
+    const outputName = source.slice(outputIdx + outputMarker.length);
+    if (!dependsOn.includes(upstreamId)) return { kind: 'miss' };
+    const upstream = upstreamData.get(upstreamId);
+    if (upstream?.outputs && outputName in upstream.outputs) {
+      return { kind: 'hit', producer: upstreamId, value: upstream.outputs[outputName] };
+    }
+    return { kind: 'miss' };
+  }
+
+  for (const field of ['stdout', 'stderr', 'normalizedOutput', 'exitCode'] as const) {
+    const suffix = `.${field}`;
+    if (!source.endsWith(suffix)) continue;
+    const upstreamId = source.slice(0, -suffix.length);
+    if (!dependsOn.includes(upstreamId)) return { kind: 'miss' };
+    const upstream = upstreamData.get(upstreamId);
+    if (!upstream) return { kind: 'miss' };
+    const value = upstream[field];
+    return value === undefined || value === null
+      ? { kind: 'miss' }
+      : { kind: 'hit', producer: upstreamId, value };
+  }
+
+  return { kind: 'miss' };
+}
+
+function findOutputByName(
+  name: string,
+  upstreamData: ReadonlyMap<string, UpstreamBindingData>,
+  dependsOn: readonly string[],
+): BindingLookup {
+  const hits: { producer: string; value: unknown }[] = [];
+  for (const upstreamId of dependsOn) {
+    const upstream = upstreamData.get(upstreamId);
+    if (upstream?.outputs && name in upstream.outputs) {
+      hits.push({ producer: upstreamId, value: upstream.outputs[name] });
+    }
+  }
+  if (hits.length === 0) return { kind: 'miss' };
+  if (hits.length === 1) return { kind: 'hit', producer: hits[0]!.producer, value: hits[0]!.value };
+  return { kind: 'ambiguous', producers: hits.map((h) => h.producer) };
+}
+
 type UpstreamLookup =
   | { kind: 'hit'; producer: string; value: unknown }
   | { kind: 'miss' }
@@ -416,6 +573,72 @@ export function extractTaskOutputs(
   return { outputs, diagnostic };
 }
 
+export function extractTaskBindingOutputs(
+  bindings: TaskOutputBindings | undefined,
+  stdout: string,
+  stderr: string,
+  normalizedOutput: string | null,
+): ExtractResult {
+  if (!bindings || Object.keys(bindings).length === 0) {
+    return { outputs: {}, diagnostic: null };
+  }
+
+  const outputs: Record<string, unknown> = {};
+  const missing: string[] = [];
+  let record: Record<string, unknown> | null | undefined;
+
+  for (const [name, binding] of Object.entries(bindings)) {
+    let value: unknown;
+    let present = false;
+
+    if ('value' in binding) {
+      value = binding.value;
+      present = true;
+    } else {
+      const source = binding.from ?? `json.${name}`;
+      if (source === 'stdout') {
+        value = stdout;
+        present = true;
+      } else if (source === 'stderr') {
+        value = stderr;
+        present = true;
+      } else if (source === 'normalizedOutput') {
+        if (normalizedOutput !== null) {
+          value = normalizedOutput;
+          present = true;
+        }
+      } else if (source.startsWith('json.')) {
+        if (record === undefined) {
+          const jsonSource = (normalizedOutput ?? '').length > 0 ? normalizedOutput! : stdout;
+          record = parseJsonTail(jsonSource);
+        }
+        const key = source.slice('json.'.length);
+        if (record && key in record) {
+          value = record[key];
+          present = true;
+        }
+      }
+    }
+
+    if (!present && 'default' in binding) {
+      value = binding.default;
+      present = true;
+    }
+
+    if (!present || value === undefined || value === null) {
+      missing.push(name);
+      continue;
+    }
+
+    outputs[name] = value;
+  }
+
+  return {
+    outputs,
+    diagnostic: missing.length > 0 ? `outputs: unresolved binding output(s): ${missing.join(', ')}` : null,
+  };
+}
+
 /**
  * Find the last non-empty line that parses as a JSON object. Returns
  * null when no such line exists. Also tries the whole source as a

package/src/schema-ports.test.ts

@@ -13,6 +13,34 @@ const WORK_DIR = process.platform === 'win32' ? 'D:\\fake-work' : '/fake-work';
 // ─── resolveConfig preserves ports ───────────────────────────────────
 
 describe('resolveConfig — ports passthrough', () => {
+  test('raw lightweight bindings survive onto the resolved task', () => {
+    const raw: RawPipelineConfig = {
+      name: 'p',
+      tracks: [
+        {
+          id: 't',
+          name: 'T',
+          tasks: [
+            {
+              id: 'a',
+              command: 'echo "{{inputs.city}}"',
+              inputs: {
+                city: { from: 't.plan.outputs.city', required: true },
+              },
+              outputs: {
+                report: { from: 'json.reportPath' },
+              },
+            },
+          ],
+        },
+      ],
+    };
+    const resolved = resolveConfig(raw, WORK_DIR);
+    const task = resolved.tracks[0]!.tasks[0]!;
+    expect(task.inputs).toEqual(raw.tracks[0]!.tasks[0]!.inputs!);
+    expect(task.outputs).toEqual(raw.tracks[0]!.tasks[0]!.outputs!);
+  });
+
   test('raw ports survive onto the resolved task', () => {
     const raw: RawPipelineConfig = {
       name: 'p',
@@ -83,6 +111,35 @@ describe('resolveConfig — ports passthrough', () => {
 // ─── deresolvePipeline preserves ports ───────────────────────────────
 
 describe('deresolvePipeline — ports round-trip', () => {
+  test('lightweight bindings round-trip', () => {
+    const raw: RawPipelineConfig = {
+      name: 'p',
+      tracks: [
+        {
+          id: 't',
+          name: 'T',
+          tasks: [
+            {
+              id: 'a',
+              command: 'echo "{{inputs.city}}"',
+              inputs: {
+                city: { from: 't.plan.outputs.city', required: true },
+                mode: { default: 'quick' },
+              },
+              outputs: {
+                raw: { from: 'stdout' },
+              },
+            },
+          ],
+        },
+      ],
+    };
+    const resolved = resolveConfig(raw, WORK_DIR);
+    const back = deresolvePipeline(resolved, WORK_DIR);
+    expect(back.tracks[0]!.tasks[0]!.inputs).toEqual(raw.tracks[0]!.tasks[0]!.inputs!);
+    expect(back.tracks[0]!.tasks[0]!.outputs).toEqual(raw.tracks[0]!.tasks[0]!.outputs!);
+  });
+
   test('ports with both inputs and outputs round-trip', () => {
     const raw: RawPipelineConfig = {
       name: 'p',
@@ -200,6 +257,35 @@ describe('deresolvePipeline — ports round-trip', () => {
 // ─── parseYaml accepts ports ─────────────────────────────────────────
 
 describe('parseYaml — accepts ports declarations', () => {
+  test('real-world YAML with lightweight bindings parses cleanly', () => {
+    const text = `pipeline:
+  name: demo
+  tracks:
+    - id: t
+      name: Main
+      tasks:
+        - id: build
+          command: bun run build
+          outputs:
+            bundlePath: { from: json.bundlePath }
+        - id: test
+          depends_on: [build]
+          command: 'bun test "{{inputs.bundlePath}}"'
+          inputs:
+            bundlePath:
+              from: t.build.outputs.bundlePath
+              required: true
+`;
+    const config = parseYaml(text);
+    const build = config.tracks[0]!.tasks[0]!;
+    const testTask = config.tracks[0]!.tasks[1]!;
+    expect(build.outputs!.bundlePath).toEqual({ from: 'json.bundlePath' });
+    expect(testTask.inputs!.bundlePath).toEqual({
+      from: 't.build.outputs.bundlePath',
+      required: true,
+    });
+  });
+
   test('real-world YAML with ports parses cleanly', () => {
     const text = `pipeline:
   name: demo

package/src/schema.test.ts

@@ -1,7 +1,7 @@
 import { describe, expect, test } from 'bun:test';
 import yaml from 'js-yaml';
 import type { PipelineConfig, RawPipelineConfig } from './types';
-import { deresolvePipeline, serializePipeline } from './schema';
+import { deresolvePipeline, parseYaml, resolveConfig, serializePipeline } from './schema';
 
 function parsePipelineYaml(content: string): RawPipelineConfig {
   const doc = yaml.load(content) as { pipeline: RawPipelineConfig };
@@ -56,6 +56,37 @@ describe('completion default serialization', () => {
     });
   });
 
+  test('serializePipeline drops continue_from from command tasks (prompt-only field)', () => {
+    const raw: RawPipelineConfig = {
+      name: 'Strip Continue From',
+      tracks: [
+        {
+          id: 'track_a',
+          name: 'Track A',
+          tasks: [
+            { id: 'upstream', prompt: 'generate something' },
+            // Simulates a task the user authored as `prompt` with a
+            // continue_from, then toggled to `command` in the editor panel.
+            // The field should not survive serialization.
+            {
+              id: 'downstream',
+              command: 'bun run build',
+              continue_from: 'upstream',
+              depends_on: ['upstream'],
+            },
+            // A prompt task keeps its continue_from as-is.
+            { id: 'threaded', prompt: 'refine', continue_from: 'upstream' },
+          ],
+        },
+      ],
+    };
+
+    const parsed = parsePipelineYaml(serializePipeline(raw));
+    expect(parsed.tracks[0].tasks[1].continue_from).toBeUndefined();
+    expect(parsed.tracks[0].tasks[1].depends_on).toEqual(['upstream']);
+    expect(parsed.tracks[0].tasks[2].continue_from).toBe('upstream');
+  });
+
   test('deresolvePipeline also omits the default exit_code completion', () => {
     const resolved: PipelineConfig = {
       name: 'Deresolve Defaults',
@@ -99,3 +130,84 @@ describe('completion default serialization', () => {
     });
   });
 });
+
+describe('parseYaml structural validation', () => {
+  test('rejects non-array pipeline.tracks with a clear error', () => {
+    expect(() =>
+      parseYaml(`
+pipeline:
+  name: Bad
+  tracks:
+    id: not-an-array
+`),
+    ).toThrow(/pipeline\.tracks must be an array/);
+  });
+
+  test('rejects non-array track.tasks with a clear error', () => {
+    expect(() =>
+      parseYaml(`
+pipeline:
+  name: Bad
+  tracks:
+    - id: t
+      name: T
+      tasks:
+        id: not-an-array
+`),
+    ).toThrow(/track "t": tasks must be an array/);
+  });
+});
+
+describe('permissions inheritance', () => {
+  test('resolveConfig applies pipeline-level permissions to tracks and tasks', () => {
+    const raw: RawPipelineConfig = {
+      name: 'Pipeline Permissions',
+      permissions: { read: true, write: true, execute: false },
+      tracks: [
+        {
+          id: 'track_a',
+          name: 'Track A',
+          tasks: [{ id: 'task_1', prompt: 'hello' }],
+        },
+      ],
+    };
+
+    const resolved = resolveConfig(raw, 'D:/workspace');
+    expect(resolved.tracks[0].permissions).toEqual({ read: true, write: true, execute: false });
+    expect(resolved.tracks[0].tasks[0].permissions).toEqual({
+      read: true,
+      write: true,
+      execute: false,
+    });
+  });
+
+  test('deresolvePipeline preserves pipeline-level permissions without repeating inherited values', () => {
+    const resolved: PipelineConfig = {
+      name: 'Deresolve Permissions',
+      permissions: { read: true, write: true, execute: false },
+      tracks: [
+        {
+          id: 'track_a',
+          name: 'Track A',
+          permissions: { read: true, write: true, execute: false },
+          cwd: 'D:/workspace',
+          tasks: [
+            {
+              id: 'task_1',
+              name: 'Task 1',
+              prompt: 'hello',
+              permissions: { read: true, write: true, execute: false },
+              cwd: 'D:/workspace',
+            },
+          ],
+        },
+      ],
+    };
+
+    const raw = deresolvePipeline(resolved, 'D:/workspace');
+
+    expect(raw.permissions).toEqual({ read: true, write: true, execute: false });
+    expect(raw.tracks[0].permissions).toBeUndefined();
+    expect(raw.tracks[0].tasks[0].permissions).toBeUndefined();
+  });
+});

package/src/schema.ts

@@ -17,13 +17,17 @@ import { buildDag } from './dag';
 // ═══ YAML Parsing ═══
 
 export function parseYaml(content: string): RawPipelineConfig {
-  const doc = yaml.load(content) as { pipeline?: RawPipelineConfig };
+  const doc = yaml.load(content) as { pipeline?: unknown };
   if (!doc?.pipeline) {
     throw new Error('YAML must contain a top-level "pipeline" key');
   }
-  const p = doc.pipeline;
+  if (typeof doc.pipeline !== 'object' || Array.isArray(doc.pipeline)) {
+    throw new Error('pipeline must be an object');
+  }
+  const p = doc.pipeline as RawPipelineConfig;
   if (!p.name) throw new Error('pipeline.name is required');
-  if (!p.tracks || p.tracks.length === 0) throw new Error('pipeline.tracks must be non-empty');
+  if (!Array.isArray(p.tracks)) throw new Error('pipeline.tracks must be an array');
+  if (p.tracks.length === 0) throw new Error('pipeline.tracks must be non-empty');
 
   // D14: Detect duplicate track IDs before per-track validation so the error
   // message is clear ("Duplicate track id") rather than a confusing DAG error
@@ -60,10 +64,16 @@ function assertValidId(id: string, label: string): void {
 }
 
 function validateRawTrack(track: RawTrackConfig): void {
+  if (!track || typeof track !== 'object' || Array.isArray(track)) {
+    throw new Error('track must be an object');
+  }
   if (!track.id) throw new Error('track.id is required');
   assertValidId(track.id, `track "${track.id}"`);
   if (!track.name) throw new Error(`track "${track.id}": name is required`);
-  if (!track.tasks || track.tasks.length === 0) {
+  if (!Array.isArray(track.tasks)) {
+    throw new Error(`track "${track.id}": tasks must be an array`);
+  }
+  if (track.tasks.length === 0) {
     throw new Error(`track "${track.id}": tasks must be non-empty`);
   }
   for (const task of track.tasks) {
@@ -72,6 +82,9 @@ function validateRawTrack(track: RawTrackConfig): void {
 }
 
 function validateRawTask(task: RawTaskConfig, trackId: string): void {
+  if (!task || typeof task !== 'object' || Array.isArray(task)) {
+    throw new Error(`track "${trackId}": task must be an object`);
+  }
   if (!task.id) throw new Error(`track "${trackId}": task.id is required`);
   assertValidId(task.id, `task "${task.id}" in track "${trackId}"`);
 
@@ -84,7 +97,7 @@ function validateRawTask(task: RawTaskConfig, trackId: string): void {
     throw new Error(`task "${task.id}": cannot have both "prompt" and "command"`);
   }
   // Empty-content tasks (e.g. `prompt: ''`) are allowed at parse time and
-  // flagged as non-fatal validation errors by validate-raw.ts.
+  // flagged as hard validation errors by validate-raw.ts.
 }
 
 // ═══ Config Inheritance Resolution ═══
@@ -140,7 +153,7 @@ export function resolveConfig(raw: RawPipelineConfig, workDir: string): Pipeline
         model: rawTask.model ?? rawTrack.model ?? raw.model,
         reasoning_effort:
           rawTask.reasoning_effort ?? rawTrack.reasoning_effort ?? raw.reasoning_effort,
-        permissions: rawTask.permissions ?? rawTrack.permissions ?? DEFAULT_PERMISSIONS,
+        permissions: rawTask.permissions ?? rawTrack.permissions ?? raw.permissions ?? DEFAULT_PERMISSIONS,
         driver: rawTask.driver ?? trackDriver ?? 'opencode',
         timeout: rawTask.timeout,
         // Middleware: Task-level overrides Track (including [] to disable)
@@ -148,8 +161,10 @@ export function resolveConfig(raw: RawPipelineConfig, workDir: string): Pipeline
         completion: rawTask.completion,
         agent_profile: rawTask.agent_profile ?? rawTrack.agent_profile,
         cwd: rawTask.cwd ? validatePath(rawTask.cwd, workDir) : trackCwd,
-        // Ports: no inheritance — they describe per-task I/O contract, not
-        // cross-task defaults. Passed through as-is (including `undefined`).
+        // Lightweight bindings and ports: no inheritance — they describe
+        // per-task data flow, not cross-task defaults.
+        inputs: rawTask.inputs,
+        outputs: rawTask.outputs,
         ports: rawTask.ports,
       };
     });
@@ -161,7 +176,7 @@ export function resolveConfig(raw: RawPipelineConfig, workDir: string): Pipeline
       agent_profile: rawTrack.agent_profile,
       model: rawTrack.model ?? raw.model,
       reasoning_effort: rawTrack.reasoning_effort ?? raw.reasoning_effort,
-      permissions: rawTrack.permissions ?? DEFAULT_PERMISSIONS,
+      permissions: rawTrack.permissions ?? raw.permissions ?? DEFAULT_PERMISSIONS,
       driver: trackDriver ?? 'opencode',
       cwd: trackCwd,
       middlewares: rawTrack.middlewares,
@@ -175,6 +190,7 @@ export function resolveConfig(raw: RawPipelineConfig, workDir: string): Pipeline
     driver: raw.driver,
     model: raw.model,
     reasoning_effort: raw.reasoning_effort,
+    permissions: raw.permissions,
     timeout: raw.timeout,
     plugins: raw.plugins,
     hooks: raw.hooks,
@@ -208,14 +224,32 @@ function stripDefaultTaskCompletion<T extends { completion?: CompletionConfig }>
   return rest as T;
 }
 
-function stripDefaultCompletionsForSerialization<T extends PipelineConfig | RawPipelineConfig>(
+// `continue_from` is a prompt-only field — it tells AI drivers with
+// session-resume capability to thread off an upstream prompt task's context.
+// A command task runs as a plain shell subprocess and has no session to
+// resume, so any `continue_from` on a command task is dead weight. Drop it
+// at serialization time so YAML on disk never carries the stale field after
+// a user toggles task mode from prompt → command. The tagma-yaml agent's
+// system prompt (apps/editor/server/opencode-seed.ts) documents this
+// stripping — keep them in sync.
+function stripPromptOnlyFieldsFromCommandTask<
+  T extends { command?: string; continue_from?: string },
+>(task: T): T {
+  if (task.command === undefined || task.continue_from === undefined) return task;
+  const { continue_from: _cf, ...rest } = task;
+  return rest as T;
+}
+
+function stripForSerialization<T extends PipelineConfig | RawPipelineConfig>(
   config: T,
 ): T {
   return {
     ...config,
     tracks: config.tracks.map((track) => ({
       ...track,
-      tasks: track.tasks.map((task) => stripDefaultTaskCompletion(task)),
+      tasks: track.tasks.map((task) =>
+        stripPromptOnlyFieldsFromCommandTask(stripDefaultTaskCompletion(task)),
+      ),
     })),
   } as T;
 }
@@ -228,7 +262,7 @@ function stripDefaultCompletionsForSerialization<T extends PipelineConfig | RawP
  */
 export function serializePipeline(config: PipelineConfig | RawPipelineConfig): string {
   return yaml.dump(
-    { pipeline: stripDefaultCompletionsForSerialization(config) },
+    { pipeline: stripForSerialization(config) },
     { lineWidth: 120, indent: 2 },
   );
 }
@@ -277,6 +311,8 @@ export function deresolvePipeline(config: PipelineConfig, workDir: string): RawP
         ...(task.permissions && !permissionsEqual(task.permissions, track.permissions)
           ? { permissions: task.permissions }
           : {}),
+        ...(task.inputs && Object.keys(task.inputs).length > 0 ? { inputs: task.inputs } : {}),
+        ...(task.outputs && Object.keys(task.outputs).length > 0 ? { outputs: task.outputs } : {}),
         ...(task.ports &&
         ((task.ports.inputs && task.ports.inputs.length > 0) ||
           (task.ports.outputs && task.ports.outputs.length > 0))
@@ -302,7 +338,7 @@ export function deresolvePipeline(config: PipelineConfig, workDir: string): RawP
       ...(track.on_failure && track.on_failure !== 'skip_downstream'
         ? { on_failure: track.on_failure }
         : {}),
-      ...(track.permissions && !permissionsEqual(track.permissions, DEFAULT_PERMISSIONS)
+      ...(track.permissions && !permissionsEqual(track.permissions, config.permissions ?? DEFAULT_PERMISSIONS)
         ? { permissions: track.permissions }
         : {}),
       tasks,
@@ -314,6 +350,9 @@ export function deresolvePipeline(config: PipelineConfig, workDir: string): RawP
     ...(config.driver ? { driver: config.driver } : {}),
     ...(config.model ? { model: config.model } : {}),
     ...(config.reasoning_effort ? { reasoning_effort: config.reasoning_effort } : {}),
+    ...(config.permissions && !permissionsEqual(config.permissions, DEFAULT_PERMISSIONS)
+      ? { permissions: config.permissions }
+      : {}),
     ...(config.timeout ? { timeout: config.timeout } : {}),
     ...(config.plugins?.length ? { plugins: config.plugins } : {}),
     ...(config.hooks ? { hooks: config.hooks } : {}),

package/src/sdk.ts

@@ -129,12 +129,16 @@ export {
 export {
   substituteInputs,
   extractInputReferences,
+  resolveTaskBindingInputs,
   resolveTaskInputs,
+  extractTaskBindingOutputs,
   extractTaskOutputs,
   inferPromptPorts,
 } from './ports';
 export type {
   SubstituteResult,
+  BindingInputResolution,
+  UpstreamBindingData,
   InputResolution,
   ExtractResult,
   PromptPortInference,

package/src/task-ref.ts

@@ -68,6 +68,7 @@ export function buildTaskIndex(config: RawPipelineConfig | PipelineConfig): Task
   const bareToQualified = new Map<string, string>();
   for (const track of config.tracks ?? []) {
     if (!track?.id) continue;
+    if (!Array.isArray(track.tasks)) continue;
     for (const task of track.tasks ?? []) {
       if (!task?.id) continue;
       const qid = qualifyTaskId(track.id, task.id);