[codex] reduce module visibility (#16978)

## Summary
- reduce public module visibility across Rust crates, preferring private
or crate-private modules with explicit crate-root public exports
- update external call sites and tests to use the intended public crate
APIs instead of reaching through module trees
- add the module visibility guideline to AGENTS.md

## Validation
- `cargo check --workspace --all-targets --message-format=short` passed
before the final fix/format pass
- `just fix` completed successfully
- `just fmt` completed successfully
- `git diff --check` passed

codex-rs/codex-api/src/endpoint/mod.rs

@@ -1,7 +1,22 @@
-pub mod compact;
-pub mod memories;
-pub mod models;
-pub mod realtime_websocket;
-pub mod responses;
-pub mod responses_websocket;
+pub(crate) mod compact;
+pub(crate) mod memories;
+pub(crate) mod models;
+pub(crate) mod realtime_websocket;
+pub(crate) mod responses;
+pub(crate) mod responses_websocket;
 mod session;
+
+pub use compact::CompactClient;
+pub use memories::MemoriesClient;
+pub use models::ModelsClient;
+pub use realtime_websocket::RealtimeEventParser;
+pub use realtime_websocket::RealtimeSessionConfig;
+pub use realtime_websocket::RealtimeSessionMode;
+pub use realtime_websocket::RealtimeWebsocketClient;
+pub use realtime_websocket::RealtimeWebsocketConnection;
+pub use realtime_websocket::RealtimeWebsocketEvents;
+pub use realtime_websocket::RealtimeWebsocketWriter;
+pub use responses::ResponsesClient;
+pub use responses::ResponsesOptions;
+pub use responses_websocket::ResponsesWebsocketClient;
+pub use responses_websocket::ResponsesWebsocketConnection;

codex-rs/codex-api/src/endpoint/realtime_websocket/methods.rs

@@ -625,9 +625,9 @@ fn normalize_realtime_path(url: &mut Url) {
 #[cfg(test)]
 mod tests {
     use super::*;
-    use crate::endpoint::realtime_websocket::protocol::RealtimeHandoffRequested;
     use crate::endpoint::realtime_websocket::protocol::RealtimeTranscriptDelta;
     use crate::endpoint::realtime_websocket::protocol::RealtimeTranscriptEntry;
+    use codex_protocol::protocol::RealtimeHandoffRequested;
     use codex_protocol::protocol::RealtimeInputAudioSpeechStarted;
     use codex_protocol::protocol::RealtimeResponseCancelled;
     use http::HeaderValue;

codex-rs/codex-api/src/endpoint/realtime_websocket/mod.rs

@@ -1,14 +1,12 @@
-pub mod methods;
+pub(crate) mod methods;
 mod methods_common;
 mod methods_v1;
 mod methods_v2;
-pub mod protocol;
+pub(crate) mod protocol;
 mod protocol_common;
 mod protocol_v1;
 mod protocol_v2;
 
-pub use codex_protocol::protocol::RealtimeAudioFrame;
-pub use codex_protocol::protocol::RealtimeEvent;
 pub use methods::RealtimeWebsocketClient;
 pub use methods::RealtimeWebsocketConnection;
 pub use methods::RealtimeWebsocketEvents;

codex-rs/codex-api/src/endpoint/realtime_websocket/protocol.rs

@@ -2,7 +2,6 @@ use crate::endpoint::realtime_websocket::protocol_v1::parse_realtime_event_v1;
 use crate::endpoint::realtime_websocket::protocol_v2::parse_realtime_event_v2;
 pub use codex_protocol::protocol::RealtimeAudioFrame;
 pub use codex_protocol::protocol::RealtimeEvent;
-pub use codex_protocol::protocol::RealtimeHandoffRequested;
 pub use codex_protocol::protocol::RealtimeTranscriptDelta;
 pub use codex_protocol::protocol::RealtimeTranscriptEntry;
 use serde::Serialize;

codex-rs/codex-api/src/endpoint/responses.rs

@@ -4,11 +4,11 @@ use crate::common::ResponsesApiRequest;
 use crate::endpoint::session::EndpointSession;
 use crate::error::ApiError;
 use crate::provider::Provider;
+use crate::requests::Compression;
+use crate::requests::attach_item_ids;
 use crate::requests::headers::build_conversation_headers;
 use crate::requests::headers::insert_header;
 use crate::requests::headers::subagent_header;
-use crate::requests::responses::Compression;
-use crate::requests::responses::attach_item_ids;
 use crate::sse::spawn_response_stream;
 use crate::telemetry::SseTelemetry;
 use codex_client::HttpTransport;

codex-rs/codex-api/src/endpoint/responses_websocket.rs

@@ -6,8 +6,8 @@ use crate::common::ResponsesWsRequest;
 use crate::error::ApiError;
 use crate::provider::Provider;
 use crate::rate_limits::parse_rate_limit_event;
-use crate::sse::responses::ResponsesStreamEvent;
-use crate::sse::responses::process_responses_event;
+use crate::sse::ResponsesStreamEvent;
+use crate::sse::process_responses_event;
 use crate::telemetry::WebsocketTelemetry;
 use codex_client::TransportError;
 use codex_client::maybe_build_rustls_client_config_with_custom_ca;