@tagma/sdk 0.7.9 → 0.7.11

package/dist/validate-raw.js

@@ -11,12 +11,16 @@ import { extractInputReferences } from '@tagma/core';
 function buildQidIndex(config) {
     const idx = new Map();
     for (const track of config.tracks ?? []) {
-        if (!track.id)
+        if (!track || typeof track !== 'object')
+            continue;
+        if (!isValidTaskId(track.id))
             continue;
         if (!Array.isArray(track.tasks))
             continue;
         for (const task of track.tasks ?? []) {
-            if (!task.id)
+            if (!task || typeof task !== 'object')
+                continue;
+            if (!isValidTaskId(task.id))
                 continue;
             idx.set(qualifyTaskId(track.id, task.id), { track, task });
         }
@@ -24,8 +28,40 @@ function buildQidIndex(config) {
     return idx;
 }
 const DURATION_RE = /^(\d*\.?\d+)\s*(s|m|h|d)$/;
-function isValidDuration(input) {
-    return DURATION_RE.test(input.trim());
+const MAX_TIMER_DURATION_MS = 2_147_483_647;
+function validateDuration(input) {
+    if (typeof input !== 'string')
+        return { ok: false, reason: 'format' };
+    const match = DURATION_RE.exec(input.trim());
+    if (!match)
+        return { ok: false, reason: 'format' };
+    const value = parseFloat(match[1]);
+    const unit = match[2];
+    const ms = (() => {
+        switch (unit) {
+            case 's':
+                return value * 1000;
+            case 'm':
+                return value * 60_000;
+            case 'h':
+                return value * 3_600_000;
+            case 'd':
+                return value * 86_400_000;
+            default:
+                return Number.NaN;
+        }
+    })();
+    if (!Number.isFinite(ms) || ms > MAX_TIMER_DURATION_MS) {
+        return { ok: false, reason: 'range' };
+    }
+    return { ok: true };
+}
+function durationErrorMessage(input, validation) {
+    const label = String(input);
+    if (validation.reason === 'range') {
+        return `Duration "${label}" exceeds maximum supported timeout of ${MAX_TIMER_DURATION_MS}ms.`;
+    }
+    return `Invalid duration format "${label}". Expected e.g. "30s", "5m", "1h".`;
 }
 // D8: IDs may only contain letters, digits, underscores, and hyphens, and must
 // start with a letter or underscore. Dots are explicitly forbidden because the
@@ -35,7 +71,6 @@ function isValidDuration(input) {
 // engine.ts, editor) stays in lockstep with what we accept here.
 const isValidId = isValidTaskId;
 const VALID_ON_FAILURE = new Set(['skip_downstream', 'stop_all', 'ignore']);
-const VALID_REASONING_EFFORT = new Set(['low', 'medium', 'high']);
 const VALID_PIPELINE_MODES = new Set(['trusted', 'safe']);
 const PERMISSION_FIELDS = ['read', 'write', 'execute'];
 // Built-in plugin types always known to the SDK core, regardless of which
@@ -50,6 +85,168 @@ const BUILTIN_COMPLETION_TYPES = new Set([
 ]);
 const BUILTIN_MIDDLEWARE_TYPES = new Set(['static_context']);
 const BUILTIN_DRIVER_TYPES = new Set(['opencode']);
+function commandConfigKind(value) {
+    if (typeof value === 'string')
+        return 'shell';
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        return null;
+    const raw = value;
+    const hasShell = 'shell' in raw;
+    const hasArgv = 'argv' in raw;
+    if (hasShell === hasArgv)
+        return null;
+    if (hasShell)
+        return typeof raw.shell === 'string' ? 'shell' : null;
+    return Array.isArray(raw.argv) && raw.argv.every((arg) => typeof arg === 'string')
+        ? 'argv'
+        : null;
+}
+function validateCommandConfig(value, path, label, errors) {
+    const kind = commandConfigKind(value);
+    if (kind === null) {
+        errors.push({
+            path,
+            message: `${label} must be a non-empty shell string, { shell: string }, or { argv: string[] }`,
+        });
+        return false;
+    }
+    if (typeof value === 'string') {
+        if (value.trim().length === 0) {
+            errors.push({ path, message: `${label} shell string must not be empty` });
+            return false;
+        }
+        return true;
+    }
+    const raw = value;
+    if (kind === 'shell') {
+        if (!raw.shell || raw.shell.trim().length === 0) {
+            errors.push({ path: `${path}.shell`, message: `${label}.shell must not be empty` });
+            return false;
+        }
+        return true;
+    }
+    if (!raw.argv || raw.argv.length === 0) {
+        errors.push({ path: `${path}.argv`, message: `${label}.argv must contain at least one argument` });
+        return false;
+    }
+    raw.argv.forEach((arg, index) => {
+        if (arg.length === 0) {
+            errors.push({ path: `${path}.argv[${index}]`, message: `${label}.argv entries must not be empty` });
+        }
+    });
+    return true;
+}
+function commandInputReferences(command) {
+    if (typeof command === 'string')
+        return extractInputReferences(command);
+    if ('shell' in command)
+        return extractInputReferences(command.shell);
+    const refs = new Set();
+    for (const arg of command.argv) {
+        for (const ref of extractInputReferences(arg))
+            refs.add(ref);
+    }
+    return [...refs];
+}
+function isRecord(value) {
+    return Boolean(value) && typeof value === 'object' && !Array.isArray(value);
+}
+function isNonEmptyString(value) {
+    return typeof value === 'string' && value.trim().length > 0;
+}
+function validateStringList(value, path, label, errors) {
+    if (value === undefined)
+        return [];
+    if (!Array.isArray(value)) {
+        errors.push({ path, message: `${label} must be an array of strings` });
+        return [];
+    }
+    const refs = [];
+    for (let i = 0; i < value.length; i++) {
+        const item = value[i];
+        if (typeof item !== 'string' || item.trim().length === 0) {
+            errors.push({ path: `${path}[${i}]`, message: `${label} entries must be non-empty strings` });
+            continue;
+        }
+        refs.push(item);
+    }
+    return refs;
+}
+function dependencyRefs(task) {
+    return Array.isArray(task.depends_on)
+        ? task.depends_on.filter((dep) => typeof dep === 'string' && dep.length > 0)
+        : [];
+}
+function validatePluginRef(value, path, label, errors) {
+    if (value === undefined)
+        return null;
+    if (!isRecord(value)) {
+        errors.push({ path, message: `${label} must be an object with a non-empty type` });
+        return null;
+    }
+    if (!isNonEmptyString(value.type)) {
+        errors.push({ path: `${path}.type`, message: `${label}.type must be a non-empty string` });
+        return null;
+    }
+    return value.type;
+}
+function validateMiddlewareList(value, path, errors) {
+    if (value === undefined)
+        return [];
+    if (!Array.isArray(value)) {
+        errors.push({ path, message: 'middlewares must be an array of objects' });
+        return [];
+    }
+    const types = [];
+    for (let i = 0; i < value.length; i++) {
+        const type = validatePluginRef(value[i], `${path}[${i}]`, 'middleware', errors);
+        if (type !== null)
+            types.push({ index: i, type });
+    }
+    return types;
+}
+const HOOK_FIELDS = [
+    'pipeline_start',
+    'task_start',
+    'task_success',
+    'task_failure',
+    'pipeline_complete',
+    'pipeline_error',
+];
+function validateHooks(value, errors) {
+    if (value === undefined)
+        return;
+    if (!isRecord(value)) {
+        errors.push({ path: 'hooks', message: 'hooks must be an object map' });
+        return;
+    }
+    for (const field of HOOK_FIELDS) {
+        if (!(field in value))
+            continue;
+        const command = value[field];
+        if (!Array.isArray(command)) {
+            validateCommandConfig(command, `hooks.${field}`, `hooks.${field}`, errors);
+            continue;
+        }
+        if (command.length === 0) {
+            errors.push({ path: `hooks.${field}`, message: `hooks.${field} must not be empty` });
+            continue;
+        }
+        command.forEach((entry, index) => {
+            validateCommandConfig(entry, `hooks.${field}[${index}]`, `hooks.${field}[${index}]`, errors);
+        });
+    }
+}
+function validateReasoningEffort(value, path, errors) {
+    if (value === undefined)
+        return;
+    if (!isNonEmptyString(value)) {
+        errors.push({
+            path,
+            message: 'reasoning_effort must be a non-empty string',
+        });
+    }
+}
 /**
  * Validate a raw pipeline config.
  * Checks structure, required fields, prompt/command exclusivity,
@@ -77,7 +274,7 @@ export function validateRaw(config, knownTypes) {
         ? new Set([...BUILTIN_MIDDLEWARE_TYPES, ...(knownTypes.middlewares ?? [])])
         : null;
     //  Top level
-    if (!config.name?.trim()) {
+    if (!isNonEmptyString(config.name)) {
         errors.push({ path: 'name', message: 'Pipeline name is required' });
     }
     if (config.mode && !VALID_PIPELINE_MODES.has(config.mode)) {
@@ -86,12 +283,26 @@ export function validateRaw(config, knownTypes) {
             message: `Invalid mode "${config.mode}". Expected "trusted" or "safe".`,
         });
     }
-    if (config.reasoning_effort && !VALID_REASONING_EFFORT.has(config.reasoning_effort)) {
-        errors.push({
-            path: 'reasoning_effort',
-            message: `Invalid reasoning_effort "${config.reasoning_effort}". Expected "low", "medium", or "high".`,
-        });
+    validateReasoningEffort(config.reasoning_effort, 'reasoning_effort', errors);
+    if (config.timeout !== undefined) {
+        const validation = validateDuration(config.timeout);
+        if (!validation.ok) {
+            errors.push({
+                path: 'timeout',
+                message: durationErrorMessage(config.timeout, validation),
+            });
+        }
+    }
+    if (config.max_concurrency !== undefined) {
+        if (!Number.isInteger(config.max_concurrency) || config.max_concurrency < 1) {
+            errors.push({
+                path: 'max_concurrency',
+                message: 'max_concurrency must be a positive integer',
+            });
+        }
     }
+    validateStringList(config.plugins, 'plugins', 'plugins', errors);
+    validateHooks(config.hooks, errors);
     if (knownDrivers && config.driver && !knownDrivers.has(config.driver)) {
         errors.push({
             path: 'driver',
@@ -126,7 +337,7 @@ export function validateRaw(config, knownTypes) {
             continue;
         }
         const track = maybeTrack;
-        if (!track.id?.trim()) {
+        if (!isNonEmptyString(track.id)) {
             errors.push({ path: `${trackPath}.id`, message: 'Track id is required' });
         }
         else if (!isValidId(track.id)) {
@@ -141,7 +352,7 @@ export function validateRaw(config, knownTypes) {
         else {
             seenTrackIds.add(track.id);
         }
-        if (!track.name?.trim()) {
+        if (!isNonEmptyString(track.name)) {
             errors.push({ path: `${trackPath}.name`, message: 'Track name is required' });
         }
         if (track.on_failure && !VALID_ON_FAILURE.has(track.on_failure)) {
@@ -150,12 +361,7 @@ export function validateRaw(config, knownTypes) {
                 message: `Invalid on_failure value "${track.on_failure}". Expected "skip_downstream", "stop_all", or "ignore".`,
             });
         }
-        if (track.reasoning_effort && !VALID_REASONING_EFFORT.has(track.reasoning_effort)) {
-            errors.push({
-                path: `${trackPath}.reasoning_effort`,
-                message: `Invalid reasoning_effort "${track.reasoning_effort}". Expected "low", "medium", or "high".`,
-            });
-        }
+        validateReasoningEffort(track.reasoning_effort, `${trackPath}.reasoning_effort`, errors);
         if (knownDrivers && track.driver && !knownDrivers.has(track.driver)) {
             errors.push({
                 path: `${trackPath}.driver`,
@@ -167,13 +373,13 @@ export function validateRaw(config, knownTypes) {
         // Track-level middlewares can reference a plugin that was uninstalled
         // after the YAML was written  - surface a warning so the user notices
         // before hitting Run.
-        if (knownMiddlewares && track.middlewares) {
-            for (let mi = 0; mi < track.middlewares.length; mi++) {
-                const mw = track.middlewares[mi];
-                if (mw?.type && !knownMiddlewares.has(mw.type)) {
+        const trackMiddlewareTypes = validateMiddlewareList(track.middlewares, `${trackPath}.middlewares`, errors);
+        if (knownMiddlewares) {
+            for (const { index: mi, type } of trackMiddlewareTypes) {
+                if (!knownMiddlewares.has(type)) {
                     errors.push({
                         path: `${trackPath}.middlewares[${mi}].type`,
-                        message: `Middleware type "${mw.type}" is not registered. Install the plugin (e.g. @tagma/middleware-${mw.type}) or remove the reference  - the pipeline will fail at run time.`,
+                        message: `Middleware type "${type}" is not registered. Install the plugin (e.g. @tagma/middleware-${type}) or remove the reference  - the pipeline will fail at run time.`,
                         severity: 'warning',
                     });
                 }
@@ -196,9 +402,14 @@ export function validateRaw(config, knownTypes) {
         //  Per-task validation
         const seenTaskIds = new Set();
         for (let ki = 0; ki < track.tasks.length; ki++) {
-            const task = track.tasks[ki];
             const taskPath = `${trackPath}.tasks[${ki}]`;
-            if (!task.id?.trim()) {
+            const maybeTask = track.tasks[ki];
+            if (!isRecord(maybeTask)) {
+                errors.push({ path: taskPath, message: `Task ${ki} must be an object` });
+                continue;
+            }
+            const task = maybeTask;
+            if (!isNonEmptyString(task.id)) {
                 errors.push({ path: `${taskPath}.id`, message: 'Task id is required' });
                 continue; // Can't check further without an id
             }
@@ -216,46 +427,44 @@ export function validateRaw(config, knownTypes) {
             }
             seenTaskIds.add(task.id);
             const hasPromptKey = typeof task.prompt === 'string';
-            const hasCommandKey = typeof task.command === 'string';
+            const hasCommandField = task.command !== undefined;
+            const hasCommandKey = commandConfigKind(task.command) !== null;
             const promptEmpty = hasPromptKey && task.prompt.trim().length === 0;
-            const commandEmpty = hasCommandKey && task.command.trim().length === 0;
             if (hasPromptKey && hasCommandKey) {
                 errors.push({
                     path: taskPath,
                     message: `Task "${task.id}": cannot have both "prompt" and "command"`,
                 });
             }
-            else if (!hasPromptKey && !hasCommandKey) {
+            else if (!hasPromptKey && !hasCommandField) {
                 errors.push({
                     path: taskPath,
                     message: `Task "${task.id}": must have "prompt" or "command"`,
                 });
             }
+            else if (hasCommandField && !hasCommandKey) {
+                validateCommandConfig(task.command, `${taskPath}.command`, `Task "${task.id}" command`, errors);
+            }
             else if (promptEmpty) {
                 errors.push({
                     path: taskPath,
                     message: `Task "${task.id}": prompt content cannot be empty`,
                 });
             }
-            else if (commandEmpty) {
-                errors.push({
-                    path: taskPath,
-                    message: `Task "${task.id}": command content cannot be empty`,
-                });
+            else if (task.command !== undefined) {
+                validateCommandConfig(task.command, `${taskPath}.command`, `Task "${task.id}" command`, errors);
             }
             //  Field-level validations
-            if (task.timeout && !isValidDuration(task.timeout)) {
-                errors.push({
-                    path: `${taskPath}.timeout`,
-                    message: `Invalid duration format "${task.timeout}". Expected e.g. "30s", "5m", "1h".`,
-                });
-            }
-            if (task.reasoning_effort && !VALID_REASONING_EFFORT.has(task.reasoning_effort)) {
-                errors.push({
-                    path: `${taskPath}.reasoning_effort`,
-                    message: `Invalid reasoning_effort "${task.reasoning_effort}". Expected "low", "medium", or "high".`,
-                });
+            if (task.timeout !== undefined) {
+                const validation = validateDuration(task.timeout);
+                if (!validation.ok) {
+                    errors.push({
+                        path: `${taskPath}.timeout`,
+                        message: durationErrorMessage(task.timeout, validation),
+                    });
+                }
             }
+            validateReasoningEffort(task.reasoning_effort, `${taskPath}.reasoning_effort`, errors);
             if (knownDrivers && task.driver && !knownDrivers.has(task.driver)) {
                 errors.push({
                     path: `${taskPath}.driver`,
@@ -268,39 +477,46 @@ export function validateRaw(config, knownTypes) {
             // Only fire when the host supplied a `knownTypes` snapshot, so offline
             // validation stays quiet. The messages deliberately name the npm
             // scope so users can copy-paste the install command.
-            if (knownTriggers && task.trigger?.type && !knownTriggers.has(task.trigger.type)) {
+            const triggerType = validatePluginRef(task.trigger, `${taskPath}.trigger`, 'trigger', errors);
+            const completionType = validatePluginRef(task.completion, `${taskPath}.completion`, 'completion', errors);
+            const taskMiddlewareTypes = validateMiddlewareList(task.middlewares, `${taskPath}.middlewares`, errors);
+            if (knownTriggers && triggerType !== null && !knownTriggers.has(triggerType)) {
                 errors.push({
                     path: `${taskPath}.trigger.type`,
-                    message: `Trigger type "${task.trigger.type}" is not registered. Install the plugin (e.g. @tagma/trigger-${task.trigger.type}) or the task will fail at run time.`,
+                    message: `Trigger type "${triggerType}" is not registered. Install the plugin (e.g. @tagma/trigger-${triggerType}) or the task will fail at run time.`,
                     severity: 'warning',
                 });
             }
-            if (knownCompletions &&
-                task.completion?.type &&
-                !knownCompletions.has(task.completion.type)) {
+            if (knownCompletions && completionType !== null && !knownCompletions.has(completionType)) {
                 errors.push({
                     path: `${taskPath}.completion.type`,
-                    message: `Completion type "${task.completion.type}" is not registered. Install the plugin (e.g. @tagma/completion-${task.completion.type}) or the task will fail at run time.`,
+                    message: `Completion type "${completionType}" is not registered. Install the plugin (e.g. @tagma/completion-${completionType}) or the task will fail at run time.`,
                     severity: 'warning',
                 });
             }
-            if (knownMiddlewares && task.middlewares) {
-                for (let mi = 0; mi < task.middlewares.length; mi++) {
-                    const mw = task.middlewares[mi];
-                    if (mw?.type && !knownMiddlewares.has(mw.type)) {
+            if (knownMiddlewares) {
+                for (const { index: mi, type } of taskMiddlewareTypes) {
+                    if (!knownMiddlewares.has(type)) {
                         errors.push({
                             path: `${taskPath}.middlewares[${mi}].type`,
-                            message: `Middleware type "${mw.type}" is not registered. Install the plugin (e.g. @tagma/middleware-${mw.type}) or remove the reference  - the pipeline will fail at run time.`,
+                            message: `Middleware type "${type}" is not registered. Install the plugin (e.g. @tagma/middleware-${type}) or remove the reference  - the pipeline will fail at run time.`,
                             severity: 'warning',
                         });
                     }
                 }
             }
             //  Port declaration checks
+            const deps = validateStringList(task.depends_on, `${taskPath}.depends_on`, 'task.depends_on', errors);
+            if (task.continue_from !== undefined && !isNonEmptyString(task.continue_from)) {
+                errors.push({
+                    path: `${taskPath}.continue_from`,
+                    message: 'task.continue_from must be a non-empty string',
+                });
+            }
             validateTaskPorts(task, track.id, taskPath, qidIndex, index, errors);
             //  depends_on reference checks
-            if (task.depends_on && task.depends_on.length > 0) {
-                for (const dep of task.depends_on) {
+            if (deps.length > 0) {
+                for (const dep of deps) {
                     const resolved = resolveTaskRef(dep, track.id, index);
                     if (resolved.kind === 'not_found') {
                         errors.push({
@@ -317,7 +533,7 @@ export function validateRaw(config, knownTypes) {
                 }
             }
             //  continue_from reference check
-            if (task.continue_from) {
+            if (isNonEmptyString(task.continue_from)) {
                 const resolved = resolveTaskRef(task.continue_from, track.id, index);
                 if (resolved.kind === 'not_found') {
                     errors.push({
@@ -331,8 +547,8 @@ export function validateRaw(config, knownTypes) {
                         message: `Task "${task.id}": continue_from "${task.continue_from}" is ambiguous  - multiple tracks have a task with this id. Use the fully-qualified form "trackId.${task.continue_from}".`,
                     });
                 }
-                else if (!task.depends_on ||
-                    !task.depends_on.some((dep) => {
+                else if (deps.length === 0 ||
+                    !deps.some((dep) => {
                         const depResolved = resolveTaskRef(dep, track.id, index);
                         return depResolved.kind === 'resolved' && depResolved.qid === resolved.qid;
                     })) {
@@ -472,7 +688,7 @@ function validateInputBindingSources(task, trackId, taskPath, index, errors) {
         const upstreamId = bindingSourceTaskId(source);
         if (!upstreamId)
             continue;
-        const deps = task.depends_on ?? [];
+        const deps = dependencyRefs(task);
         const isDirectDep = deps.some((dep) => {
             const resolved = resolveTaskRef(dep, trackId, index);
             return resolved.kind === 'resolved' && resolved.qid === upstreamId;
@@ -499,7 +715,7 @@ function bindingSourceTaskId(source) {
     return null;
 }
 function validateTaskPorts(task, trackId, taskPath, qidIndex, index, errors) {
-    const isPromptTask = typeof task.prompt === 'string' && typeof task.command !== 'string';
+    const isPromptTask = typeof task.prompt === 'string' && commandConfigKind(task.command) === null;
     validateBindingMap(task.inputs, `${taskPath}.inputs`, 'inputs', errors);
     validateBindingMap(task.outputs, `${taskPath}.outputs`, 'outputs', errors);
     validateInputBindingSources(task, trackId, taskPath, index, errors);
@@ -513,8 +729,8 @@ function validateTaskPorts(task, trackId, taskPath, qidIndex, index, errors) {
         for (const n of extractInputReferences(task.prompt))
             referenced.add(n);
     }
-    if (typeof task.command === 'string') {
-        for (const n of extractInputReferences(task.command))
+    if (commandConfigKind(task.command) !== null) {
+        for (const n of commandInputReferences(task.command))
             referenced.add(n);
     }
     let availableInputs;
@@ -559,7 +775,7 @@ function validateTaskPorts(task, trackId, taskPath, qidIndex, index, errors) {
  */
 function collectUpstreamCommandOutputNames(task, trackId, qidIndex, index) {
     const names = new Set();
-    for (const dep of task.depends_on ?? []) {
+    for (const dep of dependencyRefs(task)) {
         const r = resolveTaskRef(dep, trackId, index);
         if (r.kind !== 'resolved')
             continue;
@@ -567,7 +783,7 @@ function collectUpstreamCommandOutputNames(task, trackId, qidIndex, index) {
         if (!entry)
             continue;
         // Only Command tasks contribute  - Prompt upstreams pass free text.
-        if (typeof entry.task.command !== 'string')
+        if (commandConfigKind(entry.task.command) === null)
             continue;
         const outputs = entry.task.outputs;
         if (!outputs || typeof outputs !== 'object' || Array.isArray(outputs))
@@ -594,12 +810,12 @@ function collectUpstreamCommandOutputNames(task, trackId, qidIndex, index) {
 function validateInferredPromptPortConflicts(task, trackId, taskPath, qidIndex, index, errors) {
     //  Input collision
     const producersByName = new Map();
-    for (const dep of task.depends_on ?? []) {
+    for (const dep of dependencyRefs(task)) {
         const r = resolveTaskRef(dep, trackId, index);
         if (r.kind !== 'resolved')
             continue;
         const entry = qidIndex.get(r.qid);
-        if (!entry || typeof entry.task.command !== 'string')
+        if (!entry || commandConfigKind(entry.task.command) === null)
             continue;
         const outputs = entry.task.outputs;
         if (!outputs || typeof outputs !== 'object' || Array.isArray(outputs))
@@ -632,9 +848,9 @@ function validateInferredPromptPortConflicts(task, trackId, taskPath, qidIndex,
     for (const [downstreamQid, entry] of qidIndex) {
         if (downstreamQid === taskQid)
             continue;
-        if (typeof entry.task.command !== 'string')
+        if (commandConfigKind(entry.task.command) === null)
             continue; // only downstream Commands contribute
-        const deps = entry.task.depends_on ?? [];
+        const deps = dependencyRefs(entry.task);
         let dependsOnUs = false;
         for (const d of deps) {
             const r = resolveTaskRef(d, entry.track.id, index);
@@ -651,24 +867,50 @@ function validateInferredPromptPortConflicts(task, trackId, taskPath, qidIndex,
         for (const [inputName, binding] of Object.entries(inputs)) {
             if (!binding || typeof binding !== 'object' || Array.isArray(binding))
                 continue;
+            const outputName = inferredPromptOutputName(inputName, binding, taskQid);
+            if (outputName === null)
+                continue;
             const shape = bindingShapeKey(binding);
-            const prior = consumerShapeByName.get(inputName);
+            const prior = consumerShapeByName.get(outputName);
             if (!prior) {
-                consumerShapeByName.set(inputName, { shape, firstConsumer: downstreamQid });
+                consumerShapeByName.set(outputName, { shape, firstConsumer: downstreamQid });
                 continue;
             }
-            if (prior.shape !== shape && !reported.has(inputName)) {
-                reported.add(inputName);
+            if (prior.shape !== shape && !reported.has(outputName)) {
+                reported.add(outputName);
                 errors.push({
                     path: taskPath,
                     message: `Task "${task.id}": downstream Commands ${prior.firstConsumer} and ` +
-                        `${downstreamQid} disagree on the shape of inferred output "${inputName}"  - ` +
+                        `${downstreamQid} disagree on the shape of inferred output "${outputName}"  - ` +
                         `a single LLM emission cannot satisfy both. Rename on one side.`,
                 });
             }
         }
     }
 }
+function inferredPromptOutputName(inputName, binding, promptTaskId) {
+    if (typeof binding.from !== 'string' || binding.from.length === 0)
+        return inputName;
+    const source = binding.from;
+    if (source.startsWith('outputs.'))
+        return source.slice('outputs.'.length);
+    const outputMarker = '.outputs.';
+    const outputIdx = source.lastIndexOf(outputMarker);
+    if (outputIdx > 0) {
+        const sourceTaskId = source.slice(0, outputIdx);
+        if (sourceTaskId !== promptTaskId)
+            return null;
+        return source.slice(outputIdx + outputMarker.length);
+    }
+    const dot = source.lastIndexOf('.');
+    if (dot > 0) {
+        const sourceTaskId = source.slice(0, dot);
+        if (sourceTaskId !== promptTaskId)
+            return null;
+        return source.slice(dot + 1);
+    }
+    return source;
+}
 function bindingShapeKey(port) {
     if ((port.type ?? 'json') !== 'enum')
         return String(port.type ?? 'json');
@@ -679,21 +921,21 @@ function detectCycles(config, index) {
     // Build adjacency: qualifiedId ->[resolved dep qualifiedIds]
     const adj = new Map();
     for (const track of config.tracks) {
-        if (!track.id)
+        if (!track || typeof track !== 'object' || !isValidTaskId(track.id))
             continue;
         if (!Array.isArray(track.tasks))
             continue;
         for (const task of track.tasks ?? []) {
-            if (!task.id)
+            if (!task || typeof task !== 'object' || !isValidTaskId(task.id))
                 continue;
             const qid = qualifyTaskId(track.id, task.id);
             const deps = [];
-            for (const dep of task.depends_on ?? []) {
+            for (const dep of dependencyRefs(task)) {
                 const resolved = resolveTaskRef(dep, track.id, index);
                 if (resolved.kind === 'resolved')
                     deps.push(resolved.qid);
             }
-            if (task.continue_from) {
+            if (isNonEmptyString(task.continue_from)) {
                 const resolved = resolveTaskRef(task.continue_from, track.id, index);
                 if (resolved.kind === 'resolved' && !deps.includes(resolved.qid))
                     deps.push(resolved.qid);