[codex] reduce module visibility (#16978)

## Summary
- reduce public module visibility across Rust crates, preferring private
or crate-private modules with explicit crate-root public exports
- update external call sites and tests to use the intended public crate
APIs instead of reaching through module trees
- add the module visibility guideline to AGENTS.md

## Validation
- `cargo check --workspace --all-targets --message-format=short` passed
before the final fix/format pass
- `just fix` completed successfully
- `just fmt` completed successfully
- `git diff --check` passed

codex-rs/core/src/tools/handlers/mod.rs

@@ -1,5 +1,5 @@
 pub(crate) mod agent_jobs;
-pub mod apply_patch;
+pub(crate) mod apply_patch;
 mod dynamic;
 mod js_repl;
 mod list_dir;

codex-rs/core/src/tools/handlers/multi_agents.rs

@@ -63,7 +63,7 @@ pub(crate) use send_input::Handler as SendInputHandler;
 pub(crate) use spawn::Handler as SpawnAgentHandler;
 pub(crate) use wait::Handler as WaitAgentHandler;
 
-pub mod close_agent;
+pub(crate) mod close_agent;
 mod resume_agent;
 mod send_input;
 mod spawn;

codex-rs/core/src/tools/handlers/tool_search.rs

@@ -7,7 +7,7 @@ use crate::tools::registry::ToolKind;
 use bm25::Document;
 use bm25::Language;
 use bm25::SearchEngineBuilder;
-use codex_mcp::mcp_connection_manager::ToolInfo;
+use codex_mcp::ToolInfo;
 use codex_tools::TOOL_SEARCH_DEFAULT_LIMIT;
 use codex_tools::TOOL_SEARCH_TOOL_NAME;
 use codex_tools::ToolSearchResultSource;

codex-rs/core/src/tools/handlers/tool_suggest.rs

@@ -1,7 +1,7 @@
 use std::collections::HashSet;
 
 use codex_app_server_protocol::AppInfo;
-use codex_mcp::mcp::CODEX_APPS_MCP_SERVER_NAME;
+use codex_mcp::CODEX_APPS_MCP_SERVER_NAME;
 use codex_rmcp_client::ElicitationAction;
 use codex_tools::DiscoverableTool;
 use codex_tools::DiscoverableToolAction;

codex-rs/core/src/tools/handlers/unified_exec.rs

@@ -24,7 +24,7 @@ use crate::unified_exec::UnifiedExecProcessManager;
 use crate::unified_exec::WriteStdinRequest;
 use codex_features::Feature;
 use codex_otel::SessionTelemetry;
-use codex_otel::metrics::names::TOOL_CALL_UNIFIED_EXEC_METRIC;
+use codex_otel::TOOL_CALL_UNIFIED_EXEC_METRIC;
 use codex_protocol::models::PermissionProfile;
 use codex_protocol::protocol::EventMsg;
 use codex_protocol::protocol::TerminalInteractionEvent;

codex-rs/core/src/tools/mod.rs

@@ -1,16 +1,16 @@
-pub mod code_mode;
-pub mod context;
-pub mod events;
+pub(crate) mod code_mode;
+pub(crate) mod context;
+pub(crate) mod events;
 pub(crate) mod handlers;
-pub mod js_repl;
+pub(crate) mod js_repl;
 pub(crate) mod network_approval;
-pub mod orchestrator;
-pub mod parallel;
-pub mod registry;
-pub mod router;
-pub mod runtimes;
-pub mod sandboxing;
-pub mod spec;
+pub(crate) mod orchestrator;
+pub(crate) mod parallel;
+pub(crate) mod registry;
+pub(crate) mod router;
+pub(crate) mod runtimes;
+pub(crate) mod sandboxing;
+pub(crate) mod spec;
 
 use codex_protocol::exec_output::ExecToolCallOutput;
 use codex_utils_output_truncation::TruncationPolicy;

codex-rs/core/src/tools/router.rs

@@ -8,7 +8,7 @@ use crate::tools::context::ToolPayload;
 use crate::tools::registry::AnyToolResult;
 use crate::tools::registry::ToolRegistry;
 use crate::tools::spec::build_specs_with_discoverable_tools;
-use codex_mcp::mcp_connection_manager::ToolInfo;
+use codex_mcp::ToolInfo;
 use codex_protocol::dynamic_tools::DynamicToolSpec;
 use codex_protocol::models::LocalShellAction;
 use codex_protocol::models::ResponseItem;

codex-rs/core/src/tools/runtimes/mod.rs

@@ -12,9 +12,9 @@ use codex_sandboxing::SandboxCommand;
 use std::collections::HashMap;
 use std::path::Path;
 
-pub mod apply_patch;
-pub mod shell;
-pub mod unified_exec;
+pub(crate) mod apply_patch;
+pub(crate) mod shell;
+pub(crate) mod unified_exec;
 
 /// Shared helper to construct sandbox transform inputs from a tokenized command line.
 /// Validates that at least a program is present.

codex-rs/core/src/tools/spec.rs

@@ -5,8 +5,8 @@ use crate::tools::handlers::multi_agents_common::DEFAULT_WAIT_TIMEOUT_MS;
 use crate::tools::handlers::multi_agents_common::MAX_WAIT_TIMEOUT_MS;
 use crate::tools::handlers::multi_agents_common::MIN_WAIT_TIMEOUT_MS;
 use crate::tools::registry::ToolRegistryBuilder;
-use codex_mcp::mcp::CODEX_APPS_MCP_SERVER_NAME;
-use codex_mcp::mcp_connection_manager::ToolInfo;
+use codex_mcp::CODEX_APPS_MCP_SERVER_NAME;
+use codex_mcp::ToolInfo;
 use codex_protocol::dynamic_tools::DynamicToolSpec;
 use codex_tools::DiscoverableTool;
 use codex_tools::ToolHandlerKind;

codex-rs/core/src/tools/spec_tests.rs

@@ -8,7 +8,7 @@ use crate::tools::router::ToolRouterParams;
 use codex_app_server_protocol::AppInfo;
 use codex_features::Feature;
 use codex_features::Features;
-use codex_mcp::mcp::CODEX_APPS_MCP_SERVER_NAME;
+use codex_mcp::CODEX_APPS_MCP_SERVER_NAME;
 use codex_models_manager::bundled_models_response;
 use codex_models_manager::model_info::with_config_overrides;
 use codex_protocol::config_types::WebSearchMode;