refactor(core): remove guardian compatibility aliases

codex-rs/core/src/guardian/approval_request.rs

@@ -1,7 +0,0 @@
-pub(crate) use codex_guardian::format_guardian_action_pretty;
-#[cfg(test)]
-pub(crate) use codex_guardian::guardian_approval_request_to_json;
-pub(crate) use codex_guardian::guardian_assessment_action;
-pub(crate) use codex_guardian::guardian_request_target_item_id;
-pub(crate) use codex_guardian::guardian_request_turn_id;
-pub(crate) use codex_guardian::guardian_reviewed_action;

codex-rs/core/src/guardian/mod.rs

@@ -11,7 +11,6 @@
 //! 3. Fail closed on timeout, execution failure, or malformed output.
 //! 4. Apply the guardian's explicit allow/deny outcome.
 
-mod approval_request;
 mod metrics;
 mod prompt;
 mod review;
@@ -23,15 +22,14 @@ use codex_protocol::protocol::GuardianAssessmentOutcome;
 use serde::Deserialize;
 use serde::Serialize;
 
-pub(crate) use approval_request::format_guardian_action_pretty;
+pub(crate) use codex_guardian::format_guardian_action_pretty;
 #[cfg(test)]
-pub(crate) use approval_request::guardian_approval_request_to_json;
-pub(crate) use approval_request::guardian_assessment_action;
-pub(crate) use approval_request::guardian_request_target_item_id;
-pub(crate) use approval_request::guardian_request_turn_id;
-// Compatibility aliases while core call sites migrate to extension-api names.
-pub(crate) use codex_extension_api::ApprovalReviewMcpAnnotations as GuardianMcpAnnotations;
-pub(crate) use codex_extension_api::ApprovalReviewNetworkAccessTrigger as GuardianNetworkAccessTrigger;
+pub(crate) use codex_guardian::guardian_approval_request_to_json;
+pub(crate) use codex_guardian::guardian_assessment_action;
+pub(crate) use codex_guardian::guardian_request_target_item_id;
+pub(crate) use codex_guardian::guardian_request_turn_id;
+pub(crate) use codex_guardian::guardian_reviewed_action;
+// Compatibility alias while the remaining core request call sites migrate.
 pub(crate) use codex_extension_api::ApprovalReviewRequest as GuardianApprovalRequest;
 pub(crate) use codex_guardian::AUTO_REVIEW_DENIAL_WINDOW_SIZE;
 pub(crate) use codex_guardian::GuardianRejection;

codex-rs/core/src/guardian/prompt.rs

@@ -21,7 +21,7 @@ use super::GUARDIAN_MAX_TOOL_TRANSCRIPT_TOKENS;
 use super::GUARDIAN_RECENT_ENTRY_LIMIT;
 use super::GuardianApprovalRequest;
 use super::GuardianAssessment;
-use super::approval_request::format_guardian_action_pretty;
+use super::format_guardian_action_pretty;
 pub(crate) use codex_guardian::guardian_truncate_text;
 
 /// Transcript entry retained for guardian review after filtering.

codex-rs/core/src/guardian/review.rs

@@ -38,11 +38,11 @@ use super::GuardianAssessment;
 use super::GuardianAssessmentOutcome;
 use super::GuardianRejection;
 use super::GuardianRejectionCircuitBreakerAction;
-use super::approval_request::guardian_assessment_action;
-use super::approval_request::guardian_request_target_item_id;
-use super::approval_request::guardian_request_turn_id;
-use super::approval_request::guardian_reviewed_action;
+use super::guardian_assessment_action;
+use super::guardian_request_target_item_id;
+use super::guardian_request_turn_id;
 use super::guardian_review_session_manager;
+use super::guardian_reviewed_action;
 use super::metrics::emit_guardian_review_metrics;
 use super::prompt::guardian_output_schema;
 use super::prompt::parse_guardian_assessment;

codex-rs/core/src/guardian/tests.rs

@@ -5,7 +5,7 @@ use crate::config::Constrained;
 use crate::config::ManagedFeatures;
 use crate::config::NetworkProxySpec;
 use crate::config::test_config;
-use crate::guardian::approval_request::guardian_request_target_item_id;
+use crate::guardian::guardian_request_target_item_id;
 use crate::session::session::Session;
 use crate::session::turn_context::TurnContext;
 use crate::test_support;
@@ -20,6 +20,8 @@ use codex_config::Sourced;
 use codex_config::config_toml::ConfigToml;
 use codex_config::types::McpServerConfig;
 use codex_exec_server::LOCAL_FS;
+use codex_extension_api::ApprovalReviewMcpAnnotations;
+use codex_extension_api::ApprovalReviewNetworkAccessTrigger;
 use codex_features::Feature;
 use codex_model_provider::create_model_provider;
 use codex_model_provider_info::AMAZON_BEDROCK_GPT_5_4_MODEL_ID;
@@ -774,7 +776,7 @@ fn guardian_approval_request_to_json_renders_mcp_tool_call_shape() -> serde_json
         connector_description: None,
         tool_title: Some("Navigate".to_string()),
         tool_description: None,
-        annotations: Some(GuardianMcpAnnotations {
+        annotations: Some(ApprovalReviewMcpAnnotations {
             destructive_hint: Some(true),
             open_world_hint: None,
             read_only_hint: Some(false),
@@ -811,7 +813,7 @@ fn guardian_approval_request_to_json_renders_network_access_trigger() -> serde_j
         host: "example.com".to_string(),
         protocol: NetworkApprovalProtocol::Https,
         port: 443,
-        trigger: Some(GuardianNetworkAccessTrigger {
+        trigger: Some(ApprovalReviewNetworkAccessTrigger {
             call_id: "call-1".to_string(),
             tool_name: "shell".to_string(),
             command: vec!["curl".to_string(), "https://example.com".to_string()],
@@ -861,7 +863,7 @@ async fn build_guardian_prompt_items_explains_network_access_review_scope() -> a
             host: "example.com".to_string(),
             protocol: NetworkApprovalProtocol::Https,
             port: 443,
-            trigger: Some(GuardianNetworkAccessTrigger {
+            trigger: Some(ApprovalReviewNetworkAccessTrigger {
                 call_id: "call-1".to_string(),
                 tool_name: "shell".to_string(),
                 command: vec!["curl".to_string(), "https://example.com".to_string()],
@@ -974,7 +976,7 @@ fn guardian_request_target_item_id_omits_network_access_trigger_call_id() {
         host: "example.com".to_string(),
         protocol: NetworkApprovalProtocol::Https,
         port: 443,
-        trigger: Some(GuardianNetworkAccessTrigger {
+        trigger: Some(ApprovalReviewNetworkAccessTrigger {
             call_id: "call-1".to_string(),
             tool_name: "shell".to_string(),
             command: vec!["curl".to_string(), "https://example.com".to_string()],

codex-rs/core/src/mcp_tool_call.rs

@@ -8,7 +8,6 @@ use crate::config::edit::ConfigEdit;
 use crate::config::edit::ConfigEditsBuilder;
 use crate::connectors;
 use crate::guardian::GuardianApprovalRequest;
-use crate::guardian::GuardianMcpAnnotations;
 use crate::guardian::new_guardian_review_id;
 use crate::guardian::routes_approval_to_guardian_with_reviewer;
 use crate::hook_runtime::run_permission_request_hooks;
@@ -31,6 +30,7 @@ use codex_app_server_protocol::McpServerElicitationRequest;
 use codex_app_server_protocol::McpServerElicitationRequestParams;
 use codex_config::types::AppToolApproval;
 use codex_config::types::ApprovalsReviewer;
+use codex_extension_api::ApprovalReviewMcpAnnotations;
 use codex_extension_api::ApprovalReviewSource;
 use codex_features::Feature;
 use codex_hooks::PermissionRequestDecision;
@@ -1379,7 +1379,7 @@ pub(crate) fn build_guardian_mcp_tool_review_request(
         tool_description: metadata.and_then(|metadata| metadata.tool_description.clone()),
         annotations: metadata
             .and_then(|metadata| metadata.annotations.as_ref())
-            .map(|annotations| GuardianMcpAnnotations {
+            .map(|annotations| ApprovalReviewMcpAnnotations {
                 destructive_hint: annotations.destructive_hint,
                 open_world_hint: annotations.open_world_hint,
                 read_only_hint: annotations.read_only_hint,

codex-rs/core/src/mcp_tool_call_tests.rs

@@ -1668,7 +1668,7 @@ fn guardian_mcp_review_request_includes_annotations_when_present() {
             connector_description: None,
             tool_title: None,
             tool_description: None,
-            annotations: Some(GuardianMcpAnnotations {
+            annotations: Some(ApprovalReviewMcpAnnotations {
                 destructive_hint: Some(true),
                 open_world_hint: Some(true),
                 read_only_hint: Some(false),

codex-rs/core/src/tools/network_approval.rs

@@ -1,5 +1,4 @@
 use crate::guardian::GuardianApprovalRequest;
-use crate::guardian::GuardianNetworkAccessTrigger;
 use crate::guardian::new_guardian_review_id;
 use crate::guardian::routes_approval_to_guardian;
 use crate::hook_runtime::run_permission_request_hooks;
@@ -9,6 +8,7 @@ use crate::tools::approval_dispatch::AutomatedApprovalDecision;
 use crate::tools::approval_dispatch::request_automated_approval;
 use crate::tools::sandboxing::PermissionRequestPayload;
 use crate::tools::sandboxing::ToolError;
+use codex_extension_api::ApprovalReviewNetworkAccessTrigger;
 use codex_extension_api::ApprovalReviewSource;
 use codex_hooks::PermissionRequestDecision;
 use codex_network_proxy::BlockedRequest;
@@ -49,7 +49,7 @@ pub(crate) enum NetworkApprovalMode {
 pub(crate) struct NetworkApprovalSpec {
     pub network: Option<NetworkProxy>,
     pub mode: NetworkApprovalMode,
-    pub trigger: GuardianNetworkAccessTrigger,
+    pub trigger: ApprovalReviewNetworkAccessTrigger,
     pub command: String,
 }
 
@@ -226,7 +226,7 @@ impl PendingHostApproval {
 struct ActiveNetworkApprovalCall {
     registration_id: String,
     turn_id: String,
-    trigger: GuardianNetworkAccessTrigger,
+    trigger: ApprovalReviewNetworkAccessTrigger,
     command: String,
     cancellation_token: CancellationToken,
 }
@@ -269,7 +269,7 @@ impl NetworkApprovalService {
         &self,
         registration_id: String,
         turn_id: String,
-        trigger: GuardianNetworkAccessTrigger,
+        trigger: ApprovalReviewNetworkAccessTrigger,
         command: String,
         cancellation_token: CancellationToken,
     ) {

codex-rs/core/src/tools/network_approval_tests.rs

@@ -241,7 +241,7 @@ async fn register_call_with_default_shell_trigger(
         .register_call(
             registration_id.to_string(),
             "turn-1".to_string(),
-            GuardianNetworkAccessTrigger {
+            ApprovalReviewNetworkAccessTrigger {
                 call_id: "call-1".to_string(),
                 tool_name: "shell_command".to_string(),
                 command: vec!["curl".to_string(), "https://example.com".to_string()],
@@ -261,7 +261,7 @@ async fn register_call_with_default_shell_trigger(
 #[tokio::test]
 async fn active_call_preserves_triggering_command_context() {
     let service = NetworkApprovalService::default();
-    let expected = GuardianNetworkAccessTrigger {
+    let expected = ApprovalReviewNetworkAccessTrigger {
         call_id: "call-1".to_string(),
         tool_name: "shell_command".to_string(),
         command: vec!["curl".to_string(), "https://example.com".to_string()],

codex-rs/core/src/tools/runtimes/shell.rs

@@ -11,7 +11,6 @@ pub(crate) mod zsh_fork_backend;
 use crate::command_canonicalization::canonicalize_command_for_approval;
 use crate::exec::ExecCapturePolicy;
 use crate::guardian::GuardianApprovalRequest;
-use crate::guardian::GuardianNetworkAccessTrigger;
 use crate::sandboxing::ExecOptions;
 use crate::sandboxing::SandboxPermissions;
 use crate::sandboxing::execute_env;
@@ -38,6 +37,7 @@ use crate::tools::sandboxing::ToolRuntime;
 use crate::tools::sandboxing::managed_network_for_sandbox_permissions;
 use crate::tools::sandboxing::sandbox_permissions_preserving_denied_reads;
 use crate::tools::sandboxing::with_cached_approval;
+use codex_extension_api::ApprovalReviewNetworkAccessTrigger;
 use codex_network_proxy::NetworkProxy;
 use codex_protocol::exec_output::ExecToolCallOutput;
 use codex_protocol::models::AdditionalPermissionProfile;
@@ -217,7 +217,7 @@ impl ToolRuntime<ShellRequest, ExecToolCallOutput> for ShellRuntime {
         Some(NetworkApprovalSpec {
             network: Some(network.clone()),
             mode: NetworkApprovalMode::Immediate,
-            trigger: GuardianNetworkAccessTrigger {
+            trigger: ApprovalReviewNetworkAccessTrigger {
                 call_id: ctx.call_id.clone(),
                 tool_name: flat_tool_name(&ctx.tool_name).into_owned(),
                 command: req.command.clone(),

codex-rs/core/src/tools/runtimes/unified_exec.rs

@@ -8,7 +8,6 @@ use crate::command_canonicalization::canonicalize_command_for_approval;
 use crate::exec::ExecCapturePolicy;
 use crate::exec::ExecExpiration;
 use crate::guardian::GuardianApprovalRequest;
-use crate::guardian::GuardianNetworkAccessTrigger;
 use crate::sandboxing::ExecOptions;
 use crate::sandboxing::ExecServerEnvConfig;
 use crate::sandboxing::SandboxPermissions;
@@ -41,6 +40,7 @@ use crate::unified_exec::UnifiedExecError;
 use crate::unified_exec::UnifiedExecProcess;
 use crate::unified_exec::UnifiedExecProcessManager;
 use codex_exec_server::Environment;
+use codex_extension_api::ApprovalReviewNetworkAccessTrigger;
 use codex_network_proxy::NetworkProxy;
 use codex_protocol::error::CodexErr;
 use codex_protocol::error::SandboxErr;
@@ -240,7 +240,7 @@ impl<'a> ToolRuntime<UnifiedExecRequest, UnifiedExecProcess> for UnifiedExecRunt
         Some(NetworkApprovalSpec {
             network: Some(network.clone()),
             mode: NetworkApprovalMode::Deferred,
-            trigger: GuardianNetworkAccessTrigger {
+            trigger: ApprovalReviewNetworkAccessTrigger {
                 call_id: ctx.call_id.clone(),
                 tool_name: flat_tool_name(&ctx.tool_name).into_owned(),
                 command: req.command.clone(),