[codex] reduce module visibility (#16978)

## Summary
- reduce public module visibility across Rust crates, preferring private
or crate-private modules with explicit crate-root public exports
- update external call sites and tests to use the intended public crate
APIs instead of reaching through module trees
- add the module visibility guideline to AGENTS.md

## Validation
- `cargo check --workspace --all-targets --message-format=short` passed
before the final fix/format pass
- `just fix` completed successfully
- `just fmt` completed successfully
- `git diff --check` passed

codex-rs/codex-mcp/src/lib.rs

@@ -1,2 +1,40 @@
-pub mod mcp;
-pub mod mcp_connection_manager;
+pub(crate) mod mcp;
+pub(crate) mod mcp_connection_manager;
+
+pub use mcp::CODEX_APPS_MCP_SERVER_NAME;
+pub use mcp::McpAuthStatusEntry;
+pub use mcp::McpConfig;
+pub use mcp::McpManager;
+pub use mcp::McpOAuthLoginConfig;
+pub use mcp::McpOAuthLoginSupport;
+pub use mcp::McpOAuthScopesSource;
+pub use mcp::McpSnapshotDetail;
+pub use mcp::ResolvedMcpOAuthScopes;
+pub use mcp::ToolPluginProvenance;
+pub use mcp::canonical_mcp_server_key;
+pub use mcp::collect_mcp_snapshot;
+pub use mcp::collect_mcp_snapshot_from_manager;
+pub use mcp::collect_mcp_snapshot_from_manager_with_detail;
+pub use mcp::collect_mcp_snapshot_with_detail;
+pub use mcp::collect_missing_mcp_dependencies;
+pub use mcp::compute_auth_statuses;
+pub use mcp::configured_mcp_servers;
+pub use mcp::discover_supported_scopes;
+pub use mcp::effective_mcp_servers;
+pub use mcp::group_tools_by_server;
+pub use mcp::oauth_login_support;
+pub use mcp::qualified_mcp_tool_name_prefix;
+pub use mcp::resolve_oauth_scopes;
+pub use mcp::should_retry_without_scopes;
+pub use mcp::split_qualified_tool_name;
+pub use mcp::tool_plugin_provenance;
+pub use mcp::with_codex_apps_mcp;
+pub use mcp_connection_manager::CodexAppsToolsCacheKey;
+pub use mcp_connection_manager::DEFAULT_STARTUP_TIMEOUT;
+pub use mcp_connection_manager::MCP_SANDBOX_STATE_CAPABILITY;
+pub use mcp_connection_manager::MCP_SANDBOX_STATE_METHOD;
+pub use mcp_connection_manager::McpConnectionManager;
+pub use mcp_connection_manager::SandboxState;
+pub use mcp_connection_manager::ToolInfo;
+pub use mcp_connection_manager::codex_apps_tools_cache_key;
+pub use mcp_connection_manager::filter_non_codex_apps_mcp_tools_only;

codex-rs/codex-mcp/src/mcp/mod.rs

@@ -1,5 +1,15 @@
-pub mod auth;
+pub(crate) mod auth;
 mod skill_dependencies;
+pub use auth::McpAuthStatusEntry;
+pub use auth::McpOAuthLoginConfig;
+pub use auth::McpOAuthLoginSupport;
+pub use auth::McpOAuthScopesSource;
+pub use auth::ResolvedMcpOAuthScopes;
+pub use auth::compute_auth_statuses;
+pub use auth::discover_supported_scopes;
+pub use auth::oauth_login_support;
+pub use auth::resolve_oauth_scopes;
+pub use auth::should_retry_without_scopes;
 pub use skill_dependencies::canonical_mcp_server_key;
 pub use skill_dependencies::collect_missing_mcp_dependencies;
 
@@ -23,7 +33,6 @@ use codex_protocol::protocol::McpListToolsResponseEvent;
 use codex_protocol::protocol::SandboxPolicy;
 use serde_json::Value;
 
-use crate::mcp::auth::compute_auth_statuses;
 use crate::mcp_connection_manager::McpConnectionManager;
 use crate::mcp_connection_manager::SandboxState;
 use crate::mcp_connection_manager::codex_apps_tools_cache_key;
@@ -388,7 +397,7 @@ pub fn group_tools_by_server(
 
 pub async fn collect_mcp_snapshot_from_manager(
     mcp_connection_manager: &McpConnectionManager,
-    auth_status_entries: HashMap<String, crate::mcp::auth::McpAuthStatusEntry>,
+    auth_status_entries: HashMap<String, McpAuthStatusEntry>,
 ) -> McpListToolsResponseEvent {
     collect_mcp_snapshot_from_manager_with_detail(
         mcp_connection_manager,
@@ -400,7 +409,7 @@ pub async fn collect_mcp_snapshot_from_manager(
 
 pub async fn collect_mcp_snapshot_from_manager_with_detail(
     mcp_connection_manager: &McpConnectionManager,
-    auth_status_entries: HashMap<String, crate::mcp::auth::McpAuthStatusEntry>,
+    auth_status_entries: HashMap<String, McpAuthStatusEntry>,
     detail: McpSnapshotDetail,
 ) -> McpListToolsResponseEvent {
     let (tools, resources, resource_templates) = tokio::join!(

codex-rs/codex-mcp/src/mcp_connection_manager.rs

@@ -19,10 +19,10 @@ use std::sync::atomic::Ordering;
 use std::time::Duration;
 use std::time::Instant;
 
+use crate::McpAuthStatusEntry;
 use crate::mcp::CODEX_APPS_MCP_SERVER_NAME;
 use crate::mcp::McpConfig;
 use crate::mcp::ToolPluginProvenance;
-use crate::mcp::auth::McpAuthStatusEntry;
 use crate::mcp::configured_mcp_servers;
 use crate::mcp::effective_mcp_servers;
 use crate::mcp::sanitize_responses_api_tool_name;
@@ -1568,7 +1568,7 @@ fn filter_disallowed_codex_apps_tools(tools: Vec<ToolInfo>) -> Vec<ToolInfo> {
 }
 
 fn emit_duration(metric: &str, duration: Duration, tags: &[(&str, &str)]) {
-    if let Some(metrics) = codex_otel::metrics::global() {
+    if let Some(metrics) = codex_otel::global() {
         let _ = metrics.record_duration(metric, duration, tags);
     }
 }