[codex] reduce module visibility (#16978)

## Summary
- reduce public module visibility across Rust crates, preferring private
or crate-private modules with explicit crate-root public exports
- update external call sites and tests to use the intended public crate
APIs instead of reaching through module trees
- add the module visibility guideline to AGENTS.md

## Validation
- `cargo check --workspace --all-targets --message-format=short` passed
before the final fix/format pass
- `just fix` completed successfully
- `just fmt` completed successfully
- `git diff --check` passed

codex-rs/core/src/lib.rs

@@ -10,7 +10,7 @@ mod apps;
 mod arc_monitor;
 mod client;
 mod client_common;
-pub mod codex;
+pub(crate) mod codex;
 mod realtime_context;
 mod realtime_conversation;
 pub use codex::SteerInputError;
@@ -38,28 +38,40 @@ mod flags;
 mod git_info_tests;
 mod guardian;
 mod hook_runtime;
-pub mod instructions;
-pub mod landlock;
-pub mod mcp;
+pub(crate) mod instructions;
+pub(crate) mod landlock;
+pub use landlock::spawn_command_under_linux_sandbox;
+pub(crate) mod mcp;
 mod mcp_skill_dependencies;
 mod mcp_tool_approval_templates;
 mod network_policy_decision;
-pub mod network_proxy_loader;
+pub(crate) mod network_proxy_loader;
+pub use mcp::McpManager;
+pub use network_proxy_loader::MtimeConfigReloader;
+pub use network_proxy_loader::build_network_proxy_state;
+pub use network_proxy_loader::build_network_proxy_state_and_reloader;
 mod original_image_detail;
-pub use codex_mcp::mcp_connection_manager;
-pub use codex_mcp::mcp_connection_manager::MCP_SANDBOX_STATE_CAPABILITY;
-pub use codex_mcp::mcp_connection_manager::MCP_SANDBOX_STATE_METHOD;
-pub use codex_mcp::mcp_connection_manager::SandboxState;
+pub use codex_mcp::MCP_SANDBOX_STATE_CAPABILITY;
+pub use codex_mcp::MCP_SANDBOX_STATE_METHOD;
+pub use codex_mcp::SandboxState;
 mod mcp_tool_call;
 mod memories;
-pub mod mention_syntax;
-pub mod message_history;
-pub mod utils;
+pub(crate) mod mention_syntax;
+pub(crate) mod message_history;
+pub(crate) mod utils;
+pub use mention_syntax::PLUGIN_TEXT_MENTION_SIGIL;
+pub use mention_syntax::TOOL_MENTION_SIGIL;
+pub use message_history::HistoryEntry as MessageHistoryEntry;
+pub use message_history::append_entry as append_message_history_entry;
+pub use message_history::history_metadata as message_history_metadata;
+pub use message_history::lookup as lookup_message_history_entry;
 pub use utils::path_utils;
 pub mod personality_migration;
 pub mod plugins;
 #[doc(hidden)]
-pub mod prompt_debug;
+pub(crate) mod prompt_debug;
+#[doc(hidden)]
+pub use prompt_debug::build_prompt_input;
 pub(crate) mod mentions {
     pub(crate) use crate::plugins::build_connector_slug_counts;
     pub(crate) use crate::plugins::build_skill_name_counts;
@@ -102,54 +114,63 @@ mod event_mapping;
 pub mod review_format;
 pub mod review_prompts;
 mod thread_manager;
-pub mod web_search;
-pub mod windows_sandbox_read_grants;
+pub(crate) mod web_search;
+pub(crate) mod windows_sandbox_read_grants;
 pub use thread_manager::ForkSnapshot;
 pub use thread_manager::NewThread;
 pub use thread_manager::ThreadManager;
+pub use web_search::web_search_action_detail;
+pub use web_search::web_search_detail;
+pub use windows_sandbox_read_grants::grant_read_root_non_elevated;
 #[deprecated(note = "use ThreadManager")]
 pub type ConversationManager = ThreadManager;
 #[deprecated(note = "use NewThread")]
 pub type NewConversation = NewThread;
 #[deprecated(note = "use CodexThread")]
 pub type CodexConversation = CodexThread;
-pub mod project_doc;
+pub(crate) mod project_doc;
+pub use project_doc::DEFAULT_PROJECT_DOC_FILENAME;
+pub use project_doc::LOCAL_PROJECT_DOC_FILENAME;
+pub use project_doc::discover_project_doc_paths;
+pub use project_doc::read_project_docs;
 mod rollout;
 pub(crate) mod safety;
 pub mod seatbelt;
 mod session_rollout_init_error;
 pub mod shell;
-pub mod shell_snapshot;
+pub(crate) mod shell_snapshot;
 pub mod spawn;
-pub mod state_db_bridge;
+pub(crate) mod state_db_bridge;
+pub use state_db_bridge::StateDbHandle;
+pub use state_db_bridge::get_state_db;
 mod thread_rollout_truncation;
 mod tools;
-pub mod turn_diff_tracker;
+pub(crate) mod turn_diff_tracker;
 mod turn_metadata;
 mod turn_timing;
 pub use rollout::ARCHIVED_SESSIONS_SUBDIR;
+pub use rollout::Cursor;
+pub use rollout::EventPersistenceMode;
 pub use rollout::INTERACTIVE_SESSION_SOURCES;
 pub use rollout::RolloutRecorder;
 pub use rollout::RolloutRecorderParams;
 pub use rollout::SESSIONS_SUBDIR;
 pub use rollout::SessionMeta;
+pub use rollout::ThreadItem;
+pub use rollout::ThreadSortKey;
+pub use rollout::ThreadsPage;
 pub use rollout::append_thread_name;
 pub use rollout::find_archived_thread_path_by_id_str;
 #[deprecated(note = "use find_thread_path_by_id_str")]
 pub use rollout::find_conversation_path_by_id_str;
 pub use rollout::find_thread_name_by_id;
+pub use rollout::find_thread_names_by_ids;
 pub use rollout::find_thread_path_by_id_str;
 pub use rollout::find_thread_path_by_name_str;
-pub use rollout::list::Cursor;
-pub use rollout::list::ThreadItem;
-pub use rollout::list::ThreadSortKey;
-pub use rollout::list::ThreadsPage;
-pub use rollout::list::parse_cursor;
-pub use rollout::list::read_head_for_summary;
-pub use rollout::list::read_session_meta_line;
-pub use rollout::policy::EventPersistenceMode;
+pub use rollout::parse_cursor;
+pub use rollout::read_head_for_summary;
+pub use rollout::read_session_meta_line;
 pub use rollout::rollout_date_parts;
-pub use rollout::session_index::find_thread_names_by_ids;
 mod function_tool;
 mod state;
 mod tasks;
@@ -172,5 +193,7 @@ pub use exec_policy::load_exec_policy;
 pub use file_watcher::FileWatcherEvent;
 pub use turn_metadata::build_turn_metadata_header;
 pub mod compact;
-pub mod memory_trace;
+pub(crate) mod memory_trace;
+pub use memory_trace::BuiltMemory;
+pub use memory_trace::build_memories_from_trace_files;
 pub mod otel_init;