Function isSafeTaskId

packages/core/src/task-ledger.ts:216–227

(value: unknown)

 * these constraints without coupling to the UUID format.
 */
export function isSafeTaskId(value: unknown): value is string {
  // Stable token (alphanumeric plus . _ : -, 1-64 chars) AND redaction-stable:
  // the id is rendered verbatim, so a secret-shaped id (ghp_..., sk-..., a
  // 40-char hex, AIza...) must be rejected -- otherwise a renderer that does
  // run redactSecrets would turn it into [redacted] while the store keeps the
  // real id, and a later task_update would miss.
  return (
    typeof value === 'string' &&
    /^[A-Za-z0-9][A-Za-z0-9._:-]{0,63}$/.test(value) &&
    redactSecrets(value) === value
  );
}

export function isTaskKey(value: unknown): value is string {
  return (