diff --git a/codex-rs/Cargo.lock b/codex-rs/Cargo.lock
index babf854a5..fd9f41f12 100644
--- a/codex-rs/Cargo.lock
+++ b/codex-rs/Cargo.lock
@@ -2999,6 +2999,7 @@ dependencies = [
  "codex-utils-elapsed",
  "codex-utils-fuzzy-match",
  "codex-utils-oss",
+ "codex-utils-path",
  "codex-utils-plugins",
  "codex-utils-pty",
  "codex-utils-sandbox-summary",
diff --git a/codex-rs/app-server-client/src/lib.rs b/codex-rs/app-server-client/src/lib.rs
index 77ef0a577..be6bf52ad 100644
--- a/codex-rs/app-server-client/src/lib.rs
+++ b/codex-rs/app-server-client/src/lib.rs
@@ -73,7 +73,6 @@ pub mod legacy_core {
     pub use codex_core::grant_read_root_non_elevated;
     pub use codex_core::lookup_message_history_entry;
     pub use codex_core::message_history_metadata;
-    pub use codex_core::path_utils;
     pub use codex_core::web_search_detail;
 
     pub mod config {
@@ -84,10 +83,6 @@ pub mod legacy_core {
         }
     }
 
-    pub mod config_loader {
-        pub use codex_core::config_loader::*;
-    }
-
     pub mod connectors {
         pub use codex_core::connectors::*;
     }
diff --git a/codex-rs/tui/Cargo.toml b/codex-rs/tui/Cargo.toml
index 0ea1544d0..29d6d0c39 100644
--- a/codex-rs/tui/Cargo.toml
+++ b/codex-rs/tui/Cargo.toml
@@ -57,6 +57,7 @@ codex-utils-cli = { workspace = true }
 codex-utils-elapsed = { workspace = true }
 codex-utils-fuzzy-match = { workspace = true }
 codex-utils-oss = { workspace = true }
+codex-utils-path = { workspace = true }
 codex-utils-plugins = { workspace = true }
 codex-utils-sandbox-summary = { workspace = true }
 codex-utils-sleep-inhibitor = { workspace = true }
diff --git a/codex-rs/tui/src/app.rs b/codex-rs/tui/src/app.rs
index 48d1dcd9f..fe14c3663 100644
--- a/codex-rs/tui/src/app.rs
+++ b/codex-rs/tui/src/app.rs
@@ -42,7 +42,6 @@ use crate::legacy_core::config::ConfigBuilder;
 use crate::legacy_core::config::ConfigOverrides;
 use crate::legacy_core::config::edit::ConfigEdit;
 use crate::legacy_core::config::edit::ConfigEditsBuilder;
-use crate::legacy_core::config_loader::ConfigLayerStackOrdering;
 use crate::legacy_core::lookup_message_history_entry;
 use crate::legacy_core::plugins::PluginsManager;
 #[cfg(target_os = "windows")]
@@ -110,6 +109,7 @@ use codex_app_server_protocol::ThreadStartSource;
 use codex_app_server_protocol::Turn;
 use codex_app_server_protocol::TurnError as AppServerTurnError;
 use codex_app_server_protocol::TurnStatus;
+use codex_config::ConfigLayerStackOrdering;
 use codex_config::types::ApprovalsReviewer;
 use codex_config::types::ModelAvailabilityNuxConfig;
 use codex_exec_server::EnvironmentManager;
diff --git a/codex-rs/tui/src/chatwidget.rs b/codex-rs/tui/src/chatwidget.rs
index 01b345aa7..dbceecb6c 100644
--- a/codex-rs/tui/src/chatwidget.rs
+++ b/codex-rs/tui/src/chatwidget.rs
@@ -60,7 +60,6 @@ use crate::legacy_core::DEFAULT_AGENTS_MD_FILENAME;
 use crate::legacy_core::config::Config;
 use crate::legacy_core::config::Constrained;
 use crate::legacy_core::config::ConstraintResult;
-use crate::legacy_core::config_loader::ConfigLayerStackOrdering;
 #[cfg(target_os = "windows")]
 use crate::legacy_core::windows_sandbox::WindowsSandboxLevelExt;
 use crate::mention_codec::LinkedMention;
@@ -107,6 +106,7 @@ use codex_app_server_protocol::TurnCompletedNotification;
 use codex_app_server_protocol::TurnPlanStepStatus;
 use codex_app_server_protocol::TurnStatus;
 use codex_chatgpt::connectors;
+use codex_config::ConfigLayerStackOrdering;
 use codex_config::types::ApprovalsReviewer;
 use codex_config::types::Notifications;
 use codex_config::types::WindowsSandboxModeToml;
diff --git a/codex-rs/tui/src/chatwidget/tests.rs b/codex-rs/tui/src/chatwidget/tests.rs
index 44d39476a..4c4d74090 100644
--- a/codex-rs/tui/src/chatwidget/tests.rs
+++ b/codex-rs/tui/src/chatwidget/tests.rs
@@ -19,12 +19,6 @@ pub(super) use crate::legacy_core::config::Config;
 pub(super) use crate::legacy_core::config::ConfigBuilder;
 pub(super) use crate::legacy_core::config::Constrained;
 pub(super) use crate::legacy_core::config::ConstraintError;
-pub(super) use crate::legacy_core::config_loader::AppRequirementToml;
-pub(super) use crate::legacy_core::config_loader::AppsRequirementsToml;
-pub(super) use crate::legacy_core::config_loader::ConfigLayerStack;
-pub(super) use crate::legacy_core::config_loader::ConfigRequirements;
-pub(super) use crate::legacy_core::config_loader::ConfigRequirementsToml;
-pub(super) use crate::legacy_core::config_loader::RequirementSource;
 pub(super) use crate::legacy_core::plugins::OPENAI_CURATED_MARKETPLACE_NAME;
 pub(super) use crate::model_catalog::ModelCatalog;
 pub(super) use crate::test_backend::VT100Backend;
@@ -99,6 +93,12 @@ pub(super) use codex_app_server_protocol::TurnStartedNotification;
 pub(super) use codex_app_server_protocol::TurnStatus as AppServerTurnStatus;
 pub(super) use codex_app_server_protocol::UserInput as AppServerUserInput;
 pub(super) use codex_app_server_protocol::WarningNotification;
+pub(super) use codex_config::AppRequirementToml;
+pub(super) use codex_config::AppsRequirementsToml;
+pub(super) use codex_config::ConfigLayerStack;
+pub(super) use codex_config::ConfigRequirements;
+pub(super) use codex_config::ConfigRequirementsToml;
+pub(super) use codex_config::RequirementSource;
 pub(super) use codex_config::types::ApprovalsReviewer;
 pub(super) use codex_config::types::Notifications;
 #[cfg(target_os = "windows")]
diff --git a/codex-rs/tui/src/debug_config.rs b/codex-rs/tui/src/debug_config.rs
index 008ff1a5f..fbaf9f2a1 100644
--- a/codex-rs/tui/src/debug_config.rs
+++ b/codex-rs/tui/src/debug_config.rs
@@ -1,16 +1,16 @@
 use crate::history_cell::PlainHistoryCell;
 use crate::legacy_core::config::Config;
-use crate::legacy_core::config_loader::ConfigLayerEntry;
-use crate::legacy_core::config_loader::ConfigLayerStack;
-use crate::legacy_core::config_loader::ConfigLayerStackOrdering;
-use crate::legacy_core::config_loader::NetworkConstraints;
-use crate::legacy_core::config_loader::NetworkDomainPermissionToml;
-use crate::legacy_core::config_loader::NetworkUnixSocketPermissionToml;
-use crate::legacy_core::config_loader::RequirementSource;
-use crate::legacy_core::config_loader::ResidencyRequirement;
-use crate::legacy_core::config_loader::SandboxModeRequirement;
-use crate::legacy_core::config_loader::WebSearchModeRequirement;
 use codex_app_server_protocol::ConfigLayerSource;
+use codex_config::ConfigLayerEntry;
+use codex_config::ConfigLayerStack;
+use codex_config::ConfigLayerStackOrdering;
+use codex_config::NetworkConstraints;
+use codex_config::NetworkDomainPermissionToml;
+use codex_config::NetworkUnixSocketPermissionToml;
+use codex_config::RequirementSource;
+use codex_config::ResidencyRequirement;
+use codex_config::SandboxModeRequirement;
+use codex_config::WebSearchModeRequirement;
 use codex_protocol::protocol::SessionNetworkProxyRuntime;
 use ratatui::style::Stylize;
 use ratatui::text::Line;
@@ -468,26 +468,26 @@ mod tests {
     use super::render_debug_config_lines;
     use super::session_all_proxy_url;
     use crate::legacy_core::config::Constrained;
-    use crate::legacy_core::config_loader::ConfigLayerEntry;
-    use crate::legacy_core::config_loader::ConfigLayerStack;
-    use crate::legacy_core::config_loader::ConfigRequirements;
-    use crate::legacy_core::config_loader::ConfigRequirementsToml;
-    use crate::legacy_core::config_loader::ConstrainedWithSource;
-    use crate::legacy_core::config_loader::FeatureRequirementsToml;
-    use crate::legacy_core::config_loader::FilesystemConstraints;
-    use crate::legacy_core::config_loader::McpServerIdentity;
-    use crate::legacy_core::config_loader::McpServerRequirement;
-    use crate::legacy_core::config_loader::NetworkConstraints;
-    use crate::legacy_core::config_loader::NetworkDomainPermissionToml;
-    use crate::legacy_core::config_loader::NetworkDomainPermissionsToml;
-    use crate::legacy_core::config_loader::NetworkUnixSocketPermissionToml;
-    use crate::legacy_core::config_loader::NetworkUnixSocketPermissionsToml;
-    use crate::legacy_core::config_loader::RequirementSource;
-    use crate::legacy_core::config_loader::ResidencyRequirement;
-    use crate::legacy_core::config_loader::SandboxModeRequirement;
-    use crate::legacy_core::config_loader::Sourced;
-    use crate::legacy_core::config_loader::WebSearchModeRequirement;
     use codex_app_server_protocol::ConfigLayerSource;
+    use codex_config::ConfigLayerEntry;
+    use codex_config::ConfigLayerStack;
+    use codex_config::ConfigRequirements;
+    use codex_config::ConfigRequirementsToml;
+    use codex_config::ConstrainedWithSource;
+    use codex_config::FeatureRequirementsToml;
+    use codex_config::FilesystemConstraints;
+    use codex_config::McpServerIdentity;
+    use codex_config::McpServerRequirement;
+    use codex_config::NetworkConstraints;
+    use codex_config::NetworkDomainPermissionToml;
+    use codex_config::NetworkDomainPermissionsToml;
+    use codex_config::NetworkUnixSocketPermissionToml;
+    use codex_config::NetworkUnixSocketPermissionsToml;
+    use codex_config::RequirementSource;
+    use codex_config::ResidencyRequirement;
+    use codex_config::SandboxModeRequirement;
+    use codex_config::Sourced;
+    use codex_config::WebSearchModeRequirement;
     use codex_protocol::config_types::ApprovalsReviewer;
     use codex_protocol::config_types::WebSearchMode;
     use codex_protocol::protocol::AskForApproval;
diff --git a/codex-rs/tui/src/lib.rs b/codex-rs/tui/src/lib.rs
index 7e5d03ecd..84160e25f 100644
--- a/codex-rs/tui/src/lib.rs
+++ b/codex-rs/tui/src/lib.rs
@@ -10,12 +10,7 @@ use crate::legacy_core::config::ConfigOverrides;
 use crate::legacy_core::config::find_codex_home;
 use crate::legacy_core::config::load_config_as_toml_with_cli_overrides;
 use crate::legacy_core::config::resolve_oss_provider;
-use crate::legacy_core::config_loader::CloudRequirementsLoader;
-use crate::legacy_core::config_loader::ConfigLoadError;
-use crate::legacy_core::config_loader::LoaderOverrides;
-use crate::legacy_core::config_loader::format_config_error_with_source;
 use crate::legacy_core::format_exec_policy_error_with_source;
-use crate::legacy_core::path_utils;
 use crate::legacy_core::windows_sandbox::WindowsSandboxLevelExt;
 use additional_dirs::add_dir_warning_message;
 use app::App;
@@ -36,6 +31,10 @@ use codex_app_server_protocol::ThreadListParams;
 use codex_app_server_protocol::ThreadSortKey as AppServerThreadSortKey;
 use codex_app_server_protocol::ThreadSourceKind;
 use codex_cloud_requirements::cloud_requirements_loader_for_storage;
+use codex_config::CloudRequirementsLoader;
+use codex_config::ConfigLoadError;
+use codex_config::LoaderOverrides;
+use codex_config::format_config_error_with_source;
 use codex_exec_server::EnvironmentManager;
 use codex_exec_server::ExecServerRuntimePaths;
 use codex_login::AuthConfig;
@@ -57,6 +56,7 @@ use codex_utils_absolute_path::AbsolutePathBuf;
 use codex_utils_absolute_path::canonicalize_existing_preserving_symlinks;
 use codex_utils_oss::ensure_oss_provider_ready;
 use codex_utils_oss::get_default_model_for_oss_provider;
+use codex_utils_path as path_utils;
 use color_eyre::eyre::WrapErr;
 use cwd_prompt::CwdPromptAction;
 use cwd_prompt::CwdPromptOutcome;
diff --git a/codex-rs/tui/src/main.rs b/codex-rs/tui/src/main.rs
index 386aa2180..35230b61d 100644
--- a/codex-rs/tui/src/main.rs
+++ b/codex-rs/tui/src/main.rs
@@ -2,6 +2,7 @@ use clap::Parser;
 use codex_app_server_client::legacy_core;
 use codex_arg0::Arg0DispatchPaths;
 use codex_arg0::arg0_dispatch_or_else;
+use codex_config::LoaderOverrides;
 use codex_tui::AppExitInfo;
 use codex_tui::Cli;
 use codex_tui::ExitReason;
@@ -55,7 +56,7 @@ fn main() -> anyhow::Result<()> {
         let exit_info = run_main(
             inner,
             arg0_paths,
-            legacy_core::config_loader::LoaderOverrides::default(),
+            LoaderOverrides::default(),
             /*remote*/ None,
             /*remote_auth_token*/ None,
         )
diff --git a/codex-rs/tui/src/resume_picker.rs b/codex-rs/tui/src/resume_picker.rs
index 9243f3376..94d5401d2 100644
--- a/codex-rs/tui/src/resume_picker.rs
+++ b/codex-rs/tui/src/resume_picker.rs
@@ -7,7 +7,6 @@ use crate::app_server_session::AppServerSession;
 use crate::diff_render::display_path_for;
 use crate::key_hint;
 use crate::legacy_core::config::Config;
-use crate::legacy_core::path_utils;
 use crate::text_formatting::truncate_text;
 use crate::tui::FrameRequester;
 use crate::tui::Tui;
@@ -19,6 +18,7 @@ use codex_app_server_protocol::ThreadListParams;
 use codex_app_server_protocol::ThreadSortKey;
 use codex_app_server_protocol::ThreadSourceKind;
 use codex_protocol::ThreadId;
+use codex_utils_path as path_utils;
 use color_eyre::eyre::Result;
 use crossterm::event::KeyCode;
 use crossterm::event::KeyEvent;