imbi-api 2.45.0__tar.gz → 2.46.0__tar.gz

{imbi_api-2.45.0 → imbi_api-2.46.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: imbi-api
-Version: 2.45.0
+Version: 2.46.0
 Summary: Imbi is a DevOps Service Management Platform designed to provide an efficient way to manage a large environment that contains many services and applications.
 Author-email: Alex Campbell <alexc@aweber.com>, Dave Shawley <daves@aweber.com>, "Gavin M. Roy" <gavinr@aweber.com>
 License-Expression: BSD-3-Clause
@@ -20,7 +20,7 @@ Requires-Dist: fastapi
 Requires-Dist: filetype
 Requires-Dist: httpx<1,>=0.28.1
 Requires-Dist: idna>=3.18
-Requires-Dist: imbi-common[databases,llm,mcp,sentry,server]==2.45.0
+Requires-Dist: imbi-common[databases,llm,mcp,sentry,server]==2.46.0
 Requires-Dist: jinja2
 Requires-Dist: jsonpatch>=1.33
 Requires-Dist: limits<6,>=5

{imbi_api-2.45.0 → imbi_api-2.46.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "imbi-api"
-version = "2.45.0"
+version = "2.46.0"
 description = "Imbi is a DevOps Service Management Platform designed to provide an efficient way to manage a large environment that contains many services and applications."
 readme = "README.md"
 requires-python = ">=3.14"
@@ -29,7 +29,7 @@ dependencies = [
   "filetype",
   "httpx>=0.28.1,<1",
   "idna>=3.18",
-  "imbi-common[databases,llm,mcp,sentry,server]==2.45.0",
+  "imbi-common[databases,llm,mcp,sentry,server]==2.46.0",
   "jinja2",
   "jsonpatch>=1.33",
   "limits>=5,<6",

{imbi_api-2.45.0 → imbi_api-2.46.0}/src/imbi/api/agent_tasks/__init__.py

@@ -30,7 +30,6 @@ from imbi.api.agent_tasks.store import (
     NewRequest,
     NewTask,
     Pool,
-    PrimaryProject,
     RequestKeyConflict,
     RequestNotFound,
     RequestNotOpen,
@@ -80,6 +79,7 @@ async def store_lifespan() -> abc.AsyncGenerator[TaskStore]:
     try:
         await pool.open()
         store = TaskStore(pool)
+        await store.move_legacy_projects()
         stop = asyncio.Event()
         sweep = asyncio.create_task(sweeper.run_sweeper(store, stop=stop))
         try:
@@ -112,7 +112,6 @@ __all__ = [
     'NewRequest',
     'NewTask',
     'Pool',
-    'PrimaryProject',
     'RequestKeyConflict',
     'RequestNotFound',
     'RequestNotOpen',

{imbi_api-2.45.0 → imbi_api-2.46.0}/src/imbi/api/agent_tasks/log.py

@@ -10,7 +10,7 @@ Both tables are ReplacingMergeTree tables keyed on the identity of the
 row, so a row that is published two times is stored one time.
 
 Request resolutions and terminal outcomes also go to the Operations Log
-(I9, N9), as a projection of their events: see :func:`opslog_row`.
+(I9, N9), as a projection of their events: see :func:`opslog_rows`.
 """
 
 import decimal
@@ -45,6 +45,17 @@ ORDER BY seq
 LIMIT {limit:UInt32}
 """
 
+_LAST_AGENT_TURN_QUERY = """
+SELECT JSONExtractString(payload, 'body') AS body
+FROM imbi.agent_task_events
+WHERE organization_id = {organization_id:String}
+  AND task_id = {task_id:String}
+  AND type = 'turn'
+  AND actor_kind = 'agent'
+ORDER BY seq DESC
+LIMIT 1
+"""
+
 _EVENT_COUNTS_QUERY = """
 SELECT task_id, uniqExact(seq) AS events, max(seq) AS max_seq
 FROM imbi.agent_task_events
@@ -80,6 +91,11 @@ def _optional_str(value: typing.Any) -> str | None:
     return None if value is None else str(value)
 
 
+def _project_ids(task: Row) -> str:
+    """The ids of the projects of a task, comma separated."""
+    return ','.join(project['project_id'] for project in task['projects'])
+
+
 def event_row(task: Row, event: Row) -> Row:
     """Return the ``agent_task_events`` row of one Postgres event."""
     return {
@@ -88,7 +104,7 @@ def event_row(task: Row, event: Row) -> Row:
         'short_id': task['short_id'],
         'agent_id': task['agent_id'],
         'agent_version': task['agent_version'],
-        'project_id': task['project_id'] or '',
+        'project_id': _project_ids(task),
         'seq': event['seq'],
         'event_id': str(event['event_id']),
         'type': event['type'],
@@ -109,7 +125,7 @@ def usage_row(task: Row, ledger: Row) -> Row:
         'task_id': str(task['id']),
         'short_id': task['short_id'],
         'agent_id': task['agent_id'],
-        'project_id': task['project_id'] or '',
+        'project_id': _project_ids(task),
         'session_id': _optional_str(ledger['session_id']),
         'report_id': str(ledger['id']),
         'model_id': ledger['model_id'] or '',
@@ -136,17 +152,18 @@ def usage_row(task: Row, ledger: Row) -> Row:
     return row
 
 
-def opslog_row(task: Row, event: Row) -> Row | None:
-    """Return the ``operations_log`` row of an event, or ``None``.
+def opslog_rows(task: Row, event: Row) -> list[Row]:
+    """Return the ``operations_log`` rows of an event: one row for each
+    project of the task.
 
-    Only a resolution or an outcome of a task with a project has a row.
-    The Operations Log is project scoped, and its list is not scoped to
-    an organization, so a task with no project never goes there. The
-    description has no task, request, or reply text. The row id is the
-    event id, so a row that is published again collapses.
+    Only a resolution or an outcome has rows. The Operations Log is
+    project scoped, and its list is not scoped to an organization, so a
+    task with no project never goes there. The description has no task,
+    request, or reply text. The row id comes from the event id and the
+    project id, so a row that is published again collapses.
     """
-    if event['type'] not in OPSLOG_EVENT_TYPES or not task['project_slug']:
-        return None
+    if event['type'] not in OPSLOG_EVENT_TYPES:
+        return []
     payload = event['payload']
     if event['type'] == 'request.resolved':
         description = f'{task["short_id"]}: {payload["kind"]} request '
@@ -154,21 +171,24 @@ def opslog_row(task: Row, event: Row) -> Row | None:
     else:
         description = f'{task["short_id"]} closed: {payload["outcome"]}'
     actor = event['actor_id'] or 'imbi'
-    entry = models.OperationLog(
-        id=str(event['event_id']),
-        occurred_at=event['at'],
-        recorded_by=actor,
-        performed_by=actor,
-        completed_at=event['at'],
-        project_id=task['project_id'],
-        project_slug=task['project_slug'],
-        environment_slug='',
-        entry_type='Agent Task',
-        description=description,
-    )
-    row = entry.model_dump(by_alias=True, mode='python')
-    row['is_deleted'] = 0
-    return row
+    result: list[Row] = []
+    for project in task['projects']:
+        entry = models.OperationLog(
+            id=str(uuid.uuid5(event['event_id'], project['project_id'])),
+            occurred_at=event['at'],
+            recorded_by=actor,
+            performed_by=actor,
+            completed_at=event['at'],
+            project_id=project['project_id'],
+            project_slug=project['project_slug'],
+            environment_slug='',
+            entry_type='Agent Task',
+            description=description,
+        )
+        row = entry.model_dump(by_alias=True, mode='python')
+        row['is_deleted'] = 0
+        result.append(row)
+    return result
 
 
 async def publish(
@@ -182,9 +202,7 @@ async def publish(
     try:
         # Before the events: when this publish fails, the sweep finds
         # the events missing and publishes both again.
-        opslog = [
-            row for e in events if (row := opslog_row(task, e)) is not None
-        ]
+        opslog = [row for e in events for row in opslog_rows(task, e)]
         if opslog:
             await iggy.publish_rows(OPSLOG_STREAM, OPSLOG_TOPIC, opslog)
         if events:
@@ -233,6 +251,21 @@ async def archived_events(task: Row, after_seq: int, limit: int) -> list[Row]:
     ]
 
 
+async def last_archived_agent_turn(task: Row) -> str | None:
+    """Return the body of the newest agent ``turn`` of an archived task.
+
+    ``None`` when the agent wrote no turn.
+    """
+    rows = await clickhouse.query(
+        _LAST_AGENT_TURN_QUERY,
+        {
+            'organization_id': task['organization_id'],
+            'task_id': str(task['id']),
+        },
+    )
+    return str(rows[0]['body']) if rows else None
+
+
 async def event_counts(
     organization_id: str, task_ids: list[str]
 ) -> dict[str, tuple[int, int]]:

{imbi_api-2.45.0 → imbi_api-2.46.0}/src/imbi/api/agent_tasks/schemata.toml

@@ -24,10 +24,10 @@ agent_id = "TEXT NOT NULL"
 agent_version = "INTEGER NOT NULL"
 prompt_version = "INTEGER"
 service_account_id = "TEXT NOT NULL"
+# Not used. A task had one primary project here before it had a list
+# of projects (`task_projects`). Each start of imbi-api moves a value
+# that it finds to `task_projects` and clears it.
 project_id = "TEXT"
-# The slug of the project at creation, for the Operations Log rows of
-# the task. NULL for a task with no project, and for project tasks made
-# before this column existed.
 project_slug = "TEXT"
 title = "TEXT NOT NULL"
 description = "TEXT NOT NULL"
@@ -64,6 +64,10 @@ chain_id = "UUID"
 # (`harness.platform_configs`) when the task was made. NULL when the
 # organization had no configuration: the defaults apply.
 platform_config_version = "INTEGER"
+# When a person marked a closed task as needing no more attention, and
+# the email of that person. The dashboard does not show it then.
+acknowledged_at = "TIMESTAMP WITH TIME ZONE"
+acknowledged_by = "TEXT"
 
 [tables.primary_key]
 columns = ["id"]
@@ -269,8 +273,7 @@ columns = ["organization_id", "dependent_task_id", "prerequisite_task_id"]
 name = "task_dependencies_prerequisite_idx"
 columns = ["organization_id", "prerequisite_task_id"]
 
-# One row per project that a task touches, other than its primary
-# project (F13). The project is a graph node; `project_slug` is its slug
+# One row per project of a task (F13). The project is a graph node; `project_slug` is its slug
 # when the row was added, so the UI can name a project that was deleted.
 [[tables]]
 name = "task_projects"

{imbi_api-2.45.0 → imbi_api-2.46.0}/src/imbi/api/agent_tasks/store.py

@@ -110,6 +110,22 @@ _OPEN_REQUESTS = sql.SQL(
     ' AND (r.expires_at IS NULL OR r.expires_at > NOW())'
 )
 
+#: The projects of task ``t`` (F13), oldest first, as a JSON list of
+#: ``project_id`` and ``project_slug``. Every task row has it.
+PROJECTS: typing.LiteralString = (
+    '(SELECT coalesce(jsonb_agg(jsonb_build_object('
+    "'project_id', p.project_id, 'project_slug', p.project_slug)"
+    " ORDER BY p.added_at, p.project_id), '[]'::jsonb)"
+    ' FROM agent_runtime.task_projects AS p'
+    ' WHERE p.organization_id = t.organization_id AND p.task_id = t.id)'
+    ' AS projects'
+)
+
+#: A task row with its projects. Continue it with a WHERE clause.
+_SELECT_TASKS: typing.LiteralString = (
+    'SELECT t.*, ' + PROJECTS + ' FROM agent_runtime.tasks AS t'  # noqa: S608
+)
+
 #: The tasks at the other end of the dependencies of a task, with the
 #: link. ``this`` is the column of the task, ``other`` the other column.
 _LINKED_TASKS = sql.SQL(
@@ -198,10 +214,6 @@ class SelfDependency(ValueError):
     """A task cannot depend on itself."""
 
 
-class PrimaryProject(ValueError):
-    """The project is the primary project of the task."""
-
-
 @dataclasses.dataclass(frozen=True)
 class Actor:
     """Who caused an event, and through which channel."""
@@ -220,7 +232,6 @@ class NewTask:
     agent_version: int
     prompt_version: int | None
     service_account_id: str
-    project_id: str | None
     title: str
     description: str
     origin_kind: str
@@ -229,7 +240,10 @@ class NewTask:
     idempotency_key: str | None
     owner: str
     budget: decimal.Decimal | None
-    project_slug: str | None = None
+    #: The ``(project_id, project_slug)`` of each project of the task.
+    #: A child task (origin ``task``) gets the projects of its parent
+    #: instead.
+    projects: abc.Sequence[tuple[str, str]] = ()
     #: The root task of the chain of a child task. ``None`` makes the
     #: task the root of its own chain.
     chain_id: uuid.UUID | None = None
@@ -437,6 +451,30 @@ class TaskStore:
         if write.task['status'] == 'closed':
             await _run_close_hooks(write.task)
 
+    async def move_legacy_projects(self) -> int:
+        """Move the old single project of each task (``tasks.project_id``)
+        to ``task_projects``, and clear it. Return the number of tasks.
+
+        A task had one primary project before it had a project list. A
+        second run moves nothing, so each start runs it.
+        """
+        async with self._pool.connection() as conn, conn.transaction():
+            cursor = await conn.execute(
+                'WITH moved AS (UPDATE agent_runtime.tasks AS t'
+                ' SET project_id = NULL, project_slug = NULL'
+                ' FROM agent_runtime.tasks AS o'
+                ' WHERE o.id = t.id AND o.project_id IS NOT NULL'
+                ' RETURNING t.organization_id, t.id, t.created_at,'
+                ' o.project_id, o.project_slug)'
+                ' INSERT INTO agent_runtime.task_projects (organization_id,'
+                ' task_id, project_id, project_slug, added_by_kind,'
+                ' added_by, added_at)'
+                ' SELECT organization_id, id, project_id,'
+                " coalesce(project_slug, project_id), 'system', 'migration',"
+                ' created_at FROM moved ON CONFLICT DO NOTHING'
+            )
+            return cursor.rowcount
+
     async def find_by_idempotency_key(
         self, organization_id: str, origin_kind: str, origin_id: str, key: str
     ) -> Row | None:
@@ -444,8 +482,8 @@ class TaskStore:
         async with self._pool.connection() as conn:
             return await _fetch_one(
                 conn,
-                'SELECT * FROM agent_runtime.tasks'
-                ' WHERE organization_id = %s AND origin_kind = %s'
+                _SELECT_TASKS
+                + ' WHERE organization_id = %s AND origin_kind = %s'
                 ' AND origin_id = %s AND idempotency_key = %s',
                 (organization_id, origin_kind, origin_id, key),
             )
@@ -480,11 +518,11 @@ class TaskStore:
                 await conn.execute(
                     'INSERT INTO agent_runtime.tasks (id, organization_id,'
                     ' short_id, agent_id, agent_version, prompt_version,'
-                    ' service_account_id, project_id, project_slug, title,'
+                    ' service_account_id, title,'
                     ' description, origin_kind, origin_id, origin,'
                     ' idempotency_key, owner, budget, chain_id,'
                     ' platform_config_version) VALUES (%s,'
-                    ' %s, %s, %s, %s, %s, %s, %s, %s, %s, %s, %s, %s, %s, %s,'
+                    ' %s, %s, %s, %s, %s, %s, %s, %s, %s, %s, %s, %s,'
                     ' %s, %s, %s, (SELECT max(version)'
                     ' FROM harness.platform_configs'
                     ' WHERE organization_id = %s))',
@@ -496,8 +534,6 @@ class TaskStore:
                         task.agent_version,
                         task.prompt_version,
                         task.service_account_id,
-                        task.project_id,
-                        task.project_slug,
                         task.title,
                         task.description,
                         task.origin_kind,
@@ -510,6 +546,45 @@ class TaskStore:
                         task.organization_id,
                     ),
                 )
+                if task.origin_kind == 'task':
+                    # The parent row is locked, so its projects cannot
+                    # change until this commits.
+                    await conn.execute(
+                        'INSERT INTO agent_runtime.task_projects'
+                        ' (organization_id, task_id, project_id,'
+                        ' project_slug, added_by_kind, added_by)'
+                        ' SELECT organization_id, %s, project_id,'
+                        ' project_slug, %s, %s'
+                        ' FROM agent_runtime.task_projects'
+                        ' WHERE organization_id = %s AND task_id = %s::uuid',
+                        (
+                            task_id,
+                            actor.kind,
+                            actor.id,
+                            task.organization_id,
+                            task.origin_id,
+                        ),
+                    )
+                elif task.projects:
+                    async with conn.cursor() as cursor:
+                        await cursor.executemany(
+                            'INSERT INTO agent_runtime.task_projects'
+                            ' (organization_id, task_id, project_id,'
+                            ' project_slug, added_by_kind, added_by)'
+                            ' VALUES (%s, %s, %s, %s, %s, %s)'
+                            ' ON CONFLICT DO NOTHING',
+                            [
+                                (
+                                    task.organization_id,
+                                    task_id,
+                                    project_id,
+                                    project_slug,
+                                    actor.kind,
+                                    actor.id,
+                                )
+                                for project_id, project_slug in task.projects
+                            ],
+                        )
                 event = await _append_event(
                     conn, task_id, 'task.created', event_payload, actor
                 )
@@ -537,8 +612,8 @@ class TaskStore:
         async with self._pool.connection() as conn:
             return await _fetch_one(
                 conn,
-                'SELECT * FROM agent_runtime.tasks'
-                ' WHERE organization_id = %s AND short_id = %s',
+                _SELECT_TASKS
+                + ' WHERE organization_id = %s AND short_id = %s',
                 (organization_id, short_id),
             )
 
@@ -558,8 +633,8 @@ class TaskStore:
         """Return tasks in the organization, newest first.
 
         ``text`` matches the title or the short id. A task also matches
-        when its agent is in ``text_agent_ids`` or its project is in
-        ``text_project_ids``; the caller finds those in the graph.
+        when its agent is in ``text_agent_ids`` or one of its projects is
+        in ``text_project_ids``; the caller finds those in the graph.
         ``before`` is the ``(created_at, id)`` keyset of the last row of
         the previous page. Each row also has ``blocked_since``: for a
         task that waits on a person (see :data:`_OPEN_REQUESTS`), the
@@ -582,7 +657,10 @@ class TaskStore:
             conditions.append(
                 sql.SQL(
                     '(title ILIKE %s OR short_id ILIKE %s'
-                    ' OR agent_id = ANY(%s) OR project_id = ANY(%s))'
+                    ' OR agent_id = ANY(%s) OR EXISTS (SELECT 1'
+                    ' FROM agent_runtime.task_projects AS tp'
+                    ' WHERE tp.organization_id = t.organization_id'
+                    ' AND tp.task_id = t.id AND tp.project_id = ANY(%s)))'
                 )
             )
             params += [
@@ -595,7 +673,8 @@ class TaskStore:
             conditions.append(sql.SQL('(created_at, id) < (%s, %s)'))
             params += list(before)
         statement = sql.SQL(
-            "SELECT t.*, CASE WHEN t.status <> 'closed' THEN"
+            'SELECT t.*, ' + PROJECTS + ','  # noqa: S608
+            " CASE WHEN t.status <> 'closed' THEN"
             ' (SELECT min(r.opened_at) {open}) END AS blocked_since'
             ' FROM agent_runtime.tasks AS t WHERE {where}'
             ' ORDER BY created_at DESC, id DESC LIMIT %s'
@@ -639,20 +718,33 @@ class TaskStore:
             )
             return await cursor.fetchall()
 
-    async def last_agent_turn(self, task_id: uuid.UUID) -> str | None:
+    async def last_agent_turn(self, task: Row) -> str | None:
         """Return the body of the newest ``turn`` of the agent.
 
-        ``None`` when the agent wrote no turn, or the log is archived.
+        It reads ClickHouse when the log of the task is archived.
+        ``None`` when the agent wrote no turn.
         """
+        if task['log_archived_at'] is not None:
+            return await log.last_archived_agent_turn(task)
+        # One statement reads the archive state and the turn from the same
+        # snapshot, so an archive that commits after the caller read
+        # ``task`` cannot hide the turn.
         async with self._pool.connection() as conn:
             cursor = await conn.execute(
-                "SELECT payload->>'body' FROM agent_runtime.events"
-                " WHERE task_id = %s AND type = 'turn'"
-                " AND actor_kind = 'agent' ORDER BY seq DESC LIMIT 1",
-                (task_id,),
+                'SELECT t.log_archived_at IS NOT NULL,'
+                " (SELECT e.payload->>'body' FROM agent_runtime.events AS e"
+                "   WHERE e.task_id = t.id AND e.type = 'turn'"
+                "   AND e.actor_kind = 'agent' ORDER BY e.seq DESC LIMIT 1)"
+                ' FROM agent_runtime.tasks AS t WHERE t.id = %s',
+                (task['id'],),
             )
             row = await cursor.fetchone()
-        return row[0] if row else None
+        if row is None:
+            return None
+        archived, body = row
+        if archived:
+            return await log.last_archived_agent_turn(task)
+        return None if body is None else str(body)
 
     async def unarchived(self) -> list[Row]:
         """Return the tasks whose log is not archived, by organization.
@@ -664,7 +756,8 @@ class TaskStore:
             conn.cursor(row_factory=rows.dict_row) as cursor,
         ):
             await cursor.execute(
-                'SELECT t.*, (SELECT count(*) FROM agent_runtime.budget_ledger'
+                'SELECT t.*, ' + PROJECTS + ','  # noqa: S608
+                ' (SELECT count(*) FROM agent_runtime.budget_ledger'
                 ' AS l WHERE l.task_id = t.id) AS ledger_count'
                 ' FROM agent_runtime.tasks AS t'
                 ' WHERE t.log_archived_at IS NULL'
@@ -745,8 +838,8 @@ class TaskStore:
         async with self._pool.connection() as conn, conn.transaction():
             task = await _fetch_one(
                 conn,
-                'SELECT * FROM agent_runtime.tasks'
-                ' WHERE organization_id = %s AND short_id = %s FOR UPDATE',
+                _SELECT_TASKS
+                + ' WHERE organization_id = %s AND short_id = %s FOR UPDATE',
                 (organization_id, short_id),
             )
             if task is None:
@@ -875,6 +968,40 @@ class TaskStore:
                 await write.update({'owner': owner})
         return write.task
 
+    async def acknowledge(
+        self, organization_id: str, short_id: str, actor_id: str | None
+    ) -> Row:
+        """Mark a closed task as seen by ``actor_id``, and return it.
+
+        The first acknowledgement stays. A closed task does not take
+        events, so this changes only the row.
+
+        Raises:
+            TaskNotFound: No such task.
+            TaskOpen: The task is not closed.
+
+        """
+        async with self._pool.connection() as conn:
+            task = await _fetch_one(
+                conn,
+                'UPDATE agent_runtime.tasks AS t'  # noqa: S608
+                ' SET acknowledged_at = COALESCE(acknowledged_at, NOW()),'
+                ' acknowledged_by = COALESCE(acknowledged_by, %s)'
+                ' WHERE organization_id = %s AND short_id = %s'
+                " AND status = 'closed' RETURNING t.*, " + PROJECTS,
+                (actor_id, organization_id, short_id),
+            )
+            if task is not None:
+                return task
+            cursor = await conn.execute(
+                'SELECT 1 FROM agent_runtime.tasks'
+                ' WHERE organization_id = %s AND short_id = %s',
+                (organization_id, short_id),
+            )
+            if await cursor.fetchone() is None:
+                raise TaskNotFound(short_id)
+            raise TaskOpen(short_id)
+
     # --- Relations ----------------------------------------------------
 
     @contextlib.asynccontextmanager
@@ -997,7 +1124,7 @@ class TaskStore:
         project_slug: str,
         actor: Actor,
     ) -> bool:
-        """Associate a project, other than the primary, with a task.
+        """Associate a project with a task.
 
         The caller checks that the project is in the organization. Write
         ``project.associated``. Return ``False`` and write no event when
@@ -1006,12 +1133,9 @@ class TaskStore:
         Raises:
             TaskNotFound: No such task.
             TaskArchived: The task is archived.
-            PrimaryProject: The project is the primary project.
 
         """
         async with self._relate(organization_id, [short_id]) as relate:
-            if relate.tasks[0]['project_id'] == project_id:
-                raise PrimaryProject(project_id)
             row = await _fetch_one(
                 relate.conn,
                 'INSERT INTO agent_runtime.task_projects (organization_id,'
@@ -1097,14 +1221,14 @@ class TaskStore:
             parent: Row | None = None
             if task['origin_kind'] == 'task':
                 await cursor.execute(
-                    'SELECT * FROM agent_runtime.tasks'
-                    ' WHERE organization_id = %s AND id::text = %s',
+                    _SELECT_TASKS
+                    + ' WHERE organization_id = %s AND id::text = %s',
                     (task['organization_id'], task['origin_id']),
                 )
                 parent = await cursor.fetchone()
             await cursor.execute(
-                'SELECT * FROM agent_runtime.tasks'
-                " WHERE organization_id = %s AND origin_kind = 'task'"
+                _SELECT_TASKS
+                + " WHERE organization_id = %s AND origin_kind = 'task'"
                 ' AND origin_id = %s ORDER BY created_at, id',
                 (task['organization_id'], str(task['id'])),
             )
@@ -1715,8 +1839,8 @@ class TaskStore:
         async with self._pool.connection() as conn:
             task = await _fetch_one(
                 conn,
-                'SELECT * FROM agent_runtime.tasks'
-                ' WHERE organization_id = %s AND short_id = %s',
+                _SELECT_TASKS
+                + ' WHERE organization_id = %s AND short_id = %s',
                 (organization_id, short_id),
             )
             if task is None:
@@ -1761,8 +1885,8 @@ async def requeue_chain(
     """
     async with conn.cursor(row_factory=rows.dict_row) as cursor:
         await cursor.execute(
-            'SELECT * FROM agent_runtime.tasks'
-            ' WHERE (chain_id = %s OR (chain_id IS NULL AND id = %s))'
+            _SELECT_TASKS
+            + ' WHERE (chain_id = %s OR (chain_id IS NULL AND id = %s))'
             " AND status <> 'closed' ORDER BY id FOR UPDATE",
             (chain_id, chain_id),
         )
@@ -1822,7 +1946,7 @@ async def append_event(
     """
     task = await _fetch_one(
         conn,
-        'SELECT * FROM agent_runtime.tasks WHERE id = %s'
+        _SELECT_TASKS + ' WHERE id = %s'
         ' AND organization_id = %s AND log_archived_at IS NULL FOR UPDATE',
         (task_id, organization_id),
     )
@@ -2039,7 +2163,7 @@ async def _fetch_task(
 ) -> Row:
     row = await _fetch_one(
         conn,
-        'SELECT * FROM agent_runtime.tasks WHERE id = %s',
+        _SELECT_TASKS + ' WHERE id = %s',
         (task_id,),
     )
     if row is None:  # pragma: no cover - read inside the write transaction
@@ -2055,8 +2179,8 @@ async def _lock_task(
     """Lock and return an open task, for a change in this transaction."""
     task = await _fetch_one(
         conn,
-        'SELECT * FROM agent_runtime.tasks'
-        ' WHERE organization_id = %s AND short_id = %s FOR UPDATE',
+        _SELECT_TASKS
+        + ' WHERE organization_id = %s AND short_id = %s FOR UPDATE',
         (organization_id, short_id),
     )
     if task is None:
@@ -2072,8 +2196,8 @@ async def _lock_tasks(
     """Lock and return tasks in task id order, closed or not."""
     async with conn.cursor(row_factory=rows.dict_row) as cursor:
         await cursor.execute(
-            'SELECT * FROM agent_runtime.tasks'
-            ' WHERE organization_id = %s AND short_id = ANY(%s)'
+            _SELECT_TASKS
+            + ' WHERE organization_id = %s AND short_id = ANY(%s)'
             ' ORDER BY id FOR UPDATE',
             (organization_id, short_ids),
         )
@@ -2122,8 +2246,8 @@ async def _update_task(
     changes: Row,
 ) -> Row:
     statement = sql.SQL(
-        'UPDATE agent_runtime.tasks SET {sets}, updated_at = NOW()'
-        ' WHERE id = %s RETURNING *'
+        'UPDATE agent_runtime.tasks AS t SET {sets}, updated_at = NOW()'  # noqa: S608
+        ' WHERE id = %s RETURNING t.*, ' + PROJECTS
     ).format(
         sets=sql.SQL(', ').join(
             sql.SQL('{col} = %s').format(col=sql.Identifier(col))