@ai-sdk/harness-codex

Repo package mentioncaution

The repository name does not match the package and its README does not mention the package, so the exact package-to-source relationship is less transparent. The organization-owned monorepo context partly explains the name mismatch but does not remove the missing mention.

Workflow auditcaution

All 12 workflows were analyzed with no unpinned actions, and 11 use read-only permissions. High-confidence findings that app tokens inherit blanket installation permissions, plus one top-level write-permission workflow, create a real workflow-hygiene caution; the template-injection finding is not paired with an untrusted checkout or script-injection trigger.