diff --git a/codex-rs/core/src/agent/role.rs b/codex-rs/core/src/agent/role.rs
index 6570baa45a..84e7642d97 100644
--- a/codex-rs/core/src/agent/role.rs
+++ b/codex-rs/core/src/agent/role.rs
@@ -25,7 +25,7 @@ use std::sync::LazyLock;
 use toml::Value as TomlValue;
 
 /// The role name used when a caller omits `agent_type`.
-pub const DEFAULT_ROLE_NAME: &str = "default";
+pub(crate) const DEFAULT_ROLE_NAME: &str = "default";
 const AGENT_TYPE_UNAVAILABLE_ERROR: &str = "agent type is currently not available";
 
 /// Applies a named role layer to `config` while preserving caller-owned model selection.
diff --git a/codex-rs/core/src/client.rs b/codex-rs/core/src/client.rs
index d77e36870a..7bfc88f3bd 100644
--- a/codex-rs/core/src/client.rs
+++ b/codex-rs/core/src/client.rs
@@ -117,12 +117,12 @@ use codex_response_debug_context::extract_response_debug_context_from_api_error;
 use codex_response_debug_context::telemetry_api_error_message;
 use codex_response_debug_context::telemetry_transport_error_message;
 
-pub const OPENAI_BETA_HEADER: &str = "OpenAI-Beta";
-pub const X_CODEX_TURN_STATE_HEADER: &str = "x-codex-turn-state";
+pub(crate) const OPENAI_BETA_HEADER: &str = "OpenAI-Beta";
+pub(crate) const X_CODEX_TURN_STATE_HEADER: &str = "x-codex-turn-state";
 pub const X_CODEX_TURN_METADATA_HEADER: &str = "x-codex-turn-metadata";
-pub const X_CODEX_PARENT_THREAD_ID_HEADER: &str = "x-codex-parent-thread-id";
-pub const X_CODEX_WINDOW_ID_HEADER: &str = "x-codex-window-id";
-pub const X_OPENAI_SUBAGENT_HEADER: &str = "x-openai-subagent";
+pub(crate) const X_CODEX_PARENT_THREAD_ID_HEADER: &str = "x-codex-parent-thread-id";
+pub(crate) const X_CODEX_WINDOW_ID_HEADER: &str = "x-codex-window-id";
+pub(crate) const X_OPENAI_SUBAGENT_HEADER: &str = "x-openai-subagent";
 pub const X_RESPONSESAPI_INCLUDE_TIMING_METRICS_HEADER: &str =
     "x-responsesapi-include-timing-metrics";
 const RESPONSES_WEBSOCKETS_V2_BETA_HEADER_VALUE: &str = "responses_websockets=2026-02-06";
diff --git a/codex-rs/core/src/client_common.rs b/codex-rs/core/src/client_common.rs
index cb50ccac39..6ae58aaced 100644
--- a/codex-rs/core/src/client_common.rs
+++ b/codex-rs/core/src/client_common.rs
@@ -18,8 +18,9 @@ use tokio::sync::mpsc;
 pub const REVIEW_PROMPT: &str = include_str!("../review_prompt.md");
 
 // Centralized templates for review-related user messages
-pub const REVIEW_EXIT_SUCCESS_TMPL: &str = include_str!("../templates/review/exit_success.xml");
-pub const REVIEW_EXIT_INTERRUPTED_TMPL: &str =
+pub(crate) const REVIEW_EXIT_SUCCESS_TMPL: &str =
+    include_str!("../templates/review/exit_success.xml");
+pub(crate) const REVIEW_EXIT_INTERRUPTED_TMPL: &str =
     include_str!("../templates/review/exit_interrupted.xml");
 
 /// API request payload for a single model turn
diff --git a/codex-rs/core/src/codex.rs b/codex-rs/core/src/codex.rs
index 4bf309c902..80d683106c 100644
--- a/codex-rs/core/src/codex.rs
+++ b/codex-rs/core/src/codex.rs
@@ -149,7 +149,6 @@ use rmcp::model::PaginatedRequestParams;
 use rmcp::model::ReadResourceRequestParams;
 use rmcp::model::ReadResourceResult;
 use rmcp::model::RequestId;
-use serde_json;
 use serde_json::Value;
 use tokio::sync::Mutex;
 use tokio::sync::RwLock;
@@ -388,7 +387,7 @@ use codex_utils_readiness::ReadinessFlag;
 
 /// The high-level interface to the Codex system.
 /// It operates as a queue pair where you send submissions and receive events.
-pub struct Codex {
+pub(crate) struct Codex {
     pub(crate) tx_sub: Sender<Submission>,
     pub(crate) rx_event: Receiver<Event>,
     // Last known status of the agent.
@@ -404,11 +403,9 @@ pub(crate) type SessionLoopTermination = Shared<BoxFuture<'static, ()>>;
 /// Wrapper returned by [`Codex::spawn`] containing the spawned [`Codex`],
 /// the submission id for the initial `ConfigureSession` request and the
 /// unique session id.
-pub struct CodexSpawnOk {
-    pub codex: Codex,
-    pub thread_id: ThreadId,
-    #[deprecated(note = "use thread_id")]
-    pub conversation_id: ThreadId,
+pub(crate) struct CodexSpawnOk {
+    pub(crate) codex: Codex,
+    pub(crate) thread_id: ThreadId,
 }
 
 pub(crate) struct CodexSpawnArgs {
@@ -693,20 +690,15 @@ impl Codex {
             session_loop_termination: session_loop_termination_from_handle(session_loop_handle),
         };
 
-        #[allow(deprecated)]
-        Ok(CodexSpawnOk {
-            codex,
-            thread_id,
-            conversation_id: thread_id,
-        })
+        Ok(CodexSpawnOk { codex, thread_id })
     }
 
     /// Submit the `op` wrapped in a `Submission` with a unique ID.
-    pub async fn submit(&self, op: Op) -> CodexResult<String> {
+    pub(crate) async fn submit(&self, op: Op) -> CodexResult<String> {
         self.submit_with_trace(op, /*trace*/ None).await
     }
 
-    pub async fn submit_with_trace(
+    pub(crate) async fn submit_with_trace(
         &self,
         op: Op,
         trace: Option<W3cTraceContext>,
@@ -723,7 +715,7 @@ impl Codex {
 
     /// Use sparingly: prefer `submit()` so Codex is responsible for generating
     /// unique IDs for each submission.
-    pub async fn submit_with_id(&self, mut sub: Submission) -> CodexResult<()> {
+    pub(crate) async fn submit_with_id(&self, mut sub: Submission) -> CodexResult<()> {
         if sub.trace.is_none() {
             sub.trace = current_span_w3c_trace_context();
         }
@@ -734,7 +726,7 @@ impl Codex {
         Ok(())
     }
 
-    pub async fn shutdown_and_wait(&self) -> CodexResult<()> {
+    pub(crate) async fn shutdown_and_wait(&self) -> CodexResult<()> {
         let session_loop_termination = self.session_loop_termination.clone();
         match self.submit(Op::Shutdown).await {
             Ok(_) => {}
@@ -745,7 +737,7 @@ impl Codex {
         Ok(())
     }
 
-    pub async fn next_event(&self) -> CodexResult<Event> {
+    pub(crate) async fn next_event(&self) -> CodexResult<Event> {
         let event = self
             .rx_event
             .recv()
@@ -754,7 +746,7 @@ impl Codex {
         Ok(event)
     }
 
-    pub async fn steer_input(
+    pub(crate) async fn steer_input(
         &self,
         input: Vec<UserInput>,
         expected_turn_id: Option<&str>,
@@ -867,8 +859,8 @@ pub(crate) struct TurnContext {
     /// by the model as well as sandbox policies are resolved against this path
     /// instead of `std::env::current_dir()`.
     pub(crate) cwd: AbsolutePathBuf,
-    pub(crate) current_date: Option<String>,
     pub(crate) timezone: Option<String>,
+    pub(crate) current_date: Option<String>,
     pub(crate) app_server_client_name: Option<String>,
     pub(crate) developer_instructions: Option<String>,
     pub(crate) compact_prompt: Option<String>,
@@ -3034,7 +3026,7 @@ impl Session {
     /// be used to derive the available decisions via
     /// [ExecApprovalRequestEvent::default_available_decisions].
     #[allow(clippy::too_many_arguments)]
-    pub async fn request_command_approval(
+    pub(crate) async fn request_command_approval(
         &self,
         turn_context: &TurnContext,
         call_id: String,
@@ -3105,7 +3097,7 @@ impl Session {
         rx_approve.await.unwrap_or(ReviewDecision::Abort)
     }
 
-    pub async fn request_patch_approval(
+    pub(crate) async fn request_patch_approval(
         &self,
         turn_context: &TurnContext,
         call_id: String,
@@ -3141,7 +3133,7 @@ impl Session {
         rx_approve
     }
 
-    pub async fn request_permissions(
+    pub(crate) async fn request_permissions(
         &self,
         turn_context: &TurnContext,
         call_id: String,
@@ -3196,7 +3188,7 @@ impl Session {
         rx_response.await.ok()
     }
 
-    pub async fn request_user_input(
+    pub(crate) async fn request_user_input(
         &self,
         turn_context: &TurnContext,
         call_id: String,
@@ -3228,7 +3220,7 @@ impl Session {
         rx_response.await.ok()
     }
 
-    pub async fn request_mcp_server_elicitation(
+    pub(crate) async fn request_mcp_server_elicitation(
         &self,
         turn_context: &TurnContext,
         request_id: RequestId,
@@ -3307,7 +3299,7 @@ impl Session {
         rx_response.await.ok()
     }
 
-    pub async fn notify_user_input_response(
+    pub(crate) async fn notify_user_input_response(
         &self,
         sub_id: &str,
         response: RequestUserInputResponse,
@@ -3332,7 +3324,7 @@ impl Session {
         }
     }
 
-    pub async fn notify_request_permissions_response(
+    pub(crate) async fn notify_request_permissions_response(
         &self,
         call_id: &str,
         response: RequestPermissionsResponse,
@@ -3385,7 +3377,11 @@ impl Session {
         state.granted_permissions()
     }
 
-    pub async fn notify_dynamic_tool_response(&self, call_id: &str, response: DynamicToolResponse) {
+    pub(crate) async fn notify_dynamic_tool_response(
+        &self,
+        call_id: &str,
+        response: DynamicToolResponse,
+    ) {
         let entry = {
             let mut active = self.active_turn.lock().await;
             match active.as_mut() {
@@ -3406,7 +3402,7 @@ impl Session {
         }
     }
 
-    pub async fn notify_approval(&self, approval_id: &str, decision: ReviewDecision) {
+    pub(crate) async fn notify_approval(&self, approval_id: &str, decision: ReviewDecision) {
         let entry = {
             let mut active = self.active_turn.lock().await;
             match active.as_mut() {
@@ -3427,7 +3423,7 @@ impl Session {
         }
     }
 
-    pub async fn resolve_elicitation(
+    pub(crate) async fn resolve_elicitation(
         &self,
         server_name: String,
         id: RequestId,
@@ -3574,7 +3570,7 @@ impl Session {
         self.persist_rollout_items(&rollout_items).await;
     }
 
-    pub fn enabled(&self, feature: Feature) -> bool {
+    pub(crate) fn enabled(&self, feature: Feature) -> bool {
         self.features.enabled(feature)
     }
 
@@ -3913,12 +3909,12 @@ impl Session {
         state.record_mcp_dependency_prompted(names);
     }
 
-    pub async fn dependency_env(&self) -> HashMap<String, String> {
+    pub(crate) async fn dependency_env(&self) -> HashMap<String, String> {
         let state = self.state.lock().await;
         state.dependency_env()
     }
 
-    pub async fn set_dependency_env(&self, values: HashMap<String, String>) {
+    pub(crate) async fn set_dependency_env(&self, values: HashMap<String, String>) {
         let mut state = self.state.lock().await;
         state.set_dependency_env(values);
     }
@@ -4038,7 +4034,7 @@ impl Session {
     /// Inject additional user input into the currently active turn.
     ///
     /// Returns the active turn id when accepted.
-    pub async fn steer_input(
+    pub(crate) async fn steer_input(
         &self,
         input: Vec<UserInput>,
         expected_turn_id: Option<&str>,
@@ -4087,7 +4083,7 @@ impl Session {
     }
 
     /// Returns the input if there was no task running to inject into.
-    pub async fn inject_response_items(
+    pub(crate) async fn inject_response_items(
         &self,
         input: Vec<ResponseInputItem>,
     ) -> Result<(), Vec<ResponseInputItem>> {
@@ -4152,7 +4148,10 @@ impl Session {
         self.mailbox_rx.lock().await.has_pending_trigger_turn()
     }
 
-    pub async fn prepend_pending_input(&self, input: Vec<ResponseInputItem>) -> Result<(), ()> {
+    pub(crate) async fn prepend_pending_input(
+        &self,
+        input: Vec<ResponseInputItem>,
+    ) -> Result<(), ()> {
         let mut active = self.active_turn.lock().await;
         match active.as_mut() {
             Some(at) => {
@@ -4164,7 +4163,7 @@ impl Session {
         }
     }
 
-    pub async fn get_pending_input(&self) -> Vec<ResponseInputItem> {
+    pub(crate) async fn get_pending_input(&self) -> Vec<ResponseInputItem> {
         let (pending_input, accepts_mailbox_delivery) = {
             let mut active = self.active_turn.lock().await;
             match active.as_mut() {
@@ -4219,7 +4218,7 @@ impl Session {
         !self.idle_pending_input.lock().await.is_empty()
     }
 
-    pub async fn has_pending_input(&self) -> bool {
+    pub(crate) async fn has_pending_input(&self) -> bool {
         let (has_turn_pending_input, accepts_mailbox_delivery) = {
             let active = self.active_turn.lock().await;
             match active.as_ref() {
@@ -4242,7 +4241,7 @@ impl Session {
         self.mailbox_rx.lock().await.has_pending()
     }
 
-    pub async fn list_resources(
+    pub(crate) async fn list_resources(
         &self,
         server: &str,
         params: Option<PaginatedRequestParams>,
@@ -4255,7 +4254,7 @@ impl Session {
             .await
     }
 
-    pub async fn list_resource_templates(
+    pub(crate) async fn list_resource_templates(
         &self,
         server: &str,
         params: Option<PaginatedRequestParams>,
@@ -4268,7 +4267,7 @@ impl Session {
             .await
     }
 
-    pub async fn read_resource(
+    pub(crate) async fn read_resource(
         &self,
         server: &str,
         params: ReadResourceRequestParams,
@@ -4281,7 +4280,7 @@ impl Session {
             .await
     }
 
-    pub async fn call_tool(
+    pub(crate) async fn call_tool(
         &self,
         server: &str,
         tool: &str,
@@ -4318,7 +4317,7 @@ impl Session {
             .await
     }
 
-    pub async fn interrupt_task(self: &Arc<Self>) {
+    pub(crate) async fn interrupt_task(self: &Arc<Self>) {
         info!("interrupt received: abort current task, if any");
         let has_active_turn = { self.active_turn.lock().await.is_some() };
         if has_active_turn {
@@ -4805,15 +4804,15 @@ mod handlers {
     use tracing::info;
     use tracing::warn;
 
-    pub async fn interrupt(sess: &Arc<Session>) {
+    pub(super) async fn interrupt(sess: &Arc<Session>) {
         sess.interrupt_task().await;
     }
 
-    pub async fn clean_background_terminals(sess: &Arc<Session>) {
+    pub(super) async fn clean_background_terminals(sess: &Arc<Session>) {
         sess.close_unified_exec_processes().await;
     }
 
-    pub async fn override_turn_context(
+    pub(super) async fn override_turn_context(
         sess: &Session,
         sub_id: String,
         updates: SessionSettingsUpdate,
@@ -4830,7 +4829,7 @@ mod handlers {
         }
     }
 
-    pub async fn user_input_or_turn(sess: &Arc<Session>, sub_id: String, op: Op) {
+    pub(super) async fn user_input_or_turn(sess: &Arc<Session>, sub_id: String, op: Op) {
         let (items, updates) = match op {
             Op::UserTurn {
                 cwd,
@@ -4921,7 +4920,7 @@ mod handlers {
 
     /// Records an inter-agent assistant envelope, then lets the shared pending-work scheduler
     /// decide whether an idle session should start a regular turn.
-    pub async fn inter_agent_communication(
+    pub(super) async fn inter_agent_communication(
         sess: &Arc<Session>,
         sub_id: String,
         communication: InterAgentCommunication,
@@ -4934,7 +4933,11 @@ mod handlers {
         }
     }
 
-    pub async fn run_user_shell_command(sess: &Arc<Session>, sub_id: String, command: String) {
+    pub(super) async fn run_user_shell_command(
+        sess: &Arc<Session>,
+        sub_id: String,
+        command: String,
+    ) {
         if let Some((turn_context, cancellation_token)) =
             sess.active_turn_context_and_cancellation_token().await
         {
@@ -4961,7 +4964,7 @@ mod handlers {
         .await;
     }
 
-    pub async fn resolve_elicitation(
+    pub(super) async fn resolve_elicitation(
         sess: &Arc<Session>,
         server_name: String,
         request_id: ProtocolRequestId,
@@ -5003,7 +5006,7 @@ mod handlers {
 
     /// Propagate a user's exec approval decision to the session.
     /// Also optionally applies an execpolicy amendment.
-    pub async fn exec_approval(
+    pub(super) async fn exec_approval(
         sess: &Arc<Session>,
         approval_id: String,
         turn_id: Option<String>,
@@ -5045,7 +5048,7 @@ mod handlers {
         }
     }
 
-    pub async fn patch_approval(sess: &Arc<Session>, id: String, decision: ReviewDecision) {
+    pub(super) async fn patch_approval(sess: &Arc<Session>, id: String, decision: ReviewDecision) {
         match decision {
             ReviewDecision::Abort => {
                 sess.interrupt_task().await;
@@ -5054,7 +5057,7 @@ mod handlers {
         }
     }
 
-    pub async fn request_user_input_response(
+    pub(super) async fn request_user_input_response(
         sess: &Arc<Session>,
         id: String,
         response: RequestUserInputResponse,
@@ -5062,7 +5065,7 @@ mod handlers {
         sess.notify_user_input_response(&id, response).await;
     }
 
-    pub async fn request_permissions_response(
+    pub(super) async fn request_permissions_response(
         sess: &Arc<Session>,
         id: String,
         response: RequestPermissionsResponse,
@@ -5071,7 +5074,7 @@ mod handlers {
             .await;
     }
 
-    pub async fn dynamic_tool_response(
+    pub(super) async fn dynamic_tool_response(
         sess: &Arc<Session>,
         id: String,
         response: DynamicToolResponse,
@@ -5079,7 +5082,7 @@ mod handlers {
         sess.notify_dynamic_tool_response(&id, response).await;
     }
 
-    pub async fn add_to_history(sess: &Arc<Session>, config: &Arc<Config>, text: String) {
+    pub(super) async fn add_to_history(sess: &Arc<Session>, config: &Arc<Config>, text: String) {
         let id = sess.conversation_id;
         let config = Arc::clone(config);
         tokio::spawn(async move {
@@ -5089,7 +5092,7 @@ mod handlers {
         });
     }
 
-    pub async fn get_history_entry_request(
+    pub(super) async fn get_history_entry_request(
         sess: &Arc<Session>,
         config: &Arc<Config>,
         sub_id: String,
@@ -5126,16 +5129,19 @@ mod handlers {
         });
     }
 
-    pub async fn refresh_mcp_servers(sess: &Arc<Session>, refresh_config: McpServerRefreshConfig) {
+    pub(super) async fn refresh_mcp_servers(
+        sess: &Arc<Session>,
+        refresh_config: McpServerRefreshConfig,
+    ) {
         let mut guard = sess.pending_mcp_server_refresh_config.lock().await;
         *guard = Some(refresh_config);
     }
 
-    pub async fn reload_user_config(sess: &Arc<Session>) {
+    pub(super) async fn reload_user_config(sess: &Arc<Session>) {
         sess.reload_user_config_layer().await;
     }
 
-    pub async fn list_mcp_tools(sess: &Session, config: &Arc<Config>, sub_id: String) {
+    pub(super) async fn list_mcp_tools(sess: &Session, config: &Arc<Config>, sub_id: String) {
         let mcp_connection_manager = sess.services.mcp_connection_manager.read().await;
         let auth = sess.services.auth_manager.auth().await;
         let mcp_servers = sess
@@ -5155,7 +5161,7 @@ mod handlers {
         sess.send_event_raw(event).await;
     }
 
-    pub async fn list_skills(
+    pub(super) async fn list_skills(
         sess: &Session,
         sub_id: String,
         cwds: Vec<PathBuf>,
@@ -5244,13 +5250,13 @@ mod handlers {
         sess.send_event_raw(event).await;
     }
 
-    pub async fn undo(sess: &Arc<Session>, sub_id: String) {
+    pub(super) async fn undo(sess: &Arc<Session>, sub_id: String) {
         let turn_context = sess.new_default_turn_with_sub_id(sub_id).await;
         sess.spawn_task(turn_context, Vec::new(), UndoTask::new())
             .await;
     }
 
-    pub async fn compact(sess: &Arc<Session>, sub_id: String) {
+    pub(super) async fn compact(sess: &Arc<Session>, sub_id: String) {
         let turn_context = sess.new_default_turn_with_sub_id(sub_id).await;
 
         sess.spawn_task(
@@ -5265,7 +5271,7 @@ mod handlers {
         .await;
     }
 
-    pub async fn drop_memories(sess: &Arc<Session>, config: &Arc<Config>, sub_id: String) {
+    pub(super) async fn drop_memories(sess: &Arc<Session>, config: &Arc<Config>, sub_id: String) {
         let mut errors = Vec::new();
 
         if let Some(state_db) = sess.services.state_db.as_deref() {
@@ -5308,7 +5314,7 @@ mod handlers {
         .await;
     }
 
-    pub async fn update_memories(sess: &Arc<Session>, config: &Arc<Config>, sub_id: String) {
+    pub(super) async fn update_memories(sess: &Arc<Session>, config: &Arc<Config>, sub_id: String) {
         let session_source = {
             let state = sess.state.lock().await;
             state.session_configuration.session_source.clone()
@@ -5325,7 +5331,7 @@ mod handlers {
         .await;
     }
 
-    pub async fn thread_rollback(sess: &Arc<Session>, sub_id: String, num_turns: u32) {
+    pub(super) async fn thread_rollback(sess: &Arc<Session>, sub_id: String, num_turns: u32) {
         if num_turns == 0 {
             sess.send_event_raw(Event {
                 id: sub_id,
@@ -5436,7 +5442,7 @@ mod handlers {
     /// current `thread_id`, then updates `SessionConfiguration::thread_name`.
     ///
     /// Returns an error event if the name is empty or session persistence is disabled.
-    pub async fn set_thread_name(sess: &Arc<Session>, sub_id: String, name: String) {
+    pub(super) async fn set_thread_name(sess: &Arc<Session>, sub_id: String, name: String) {
         let Some(name) = crate::util::normalize_thread_name(&name) else {
             let event = Event {
                 id: sub_id,
@@ -5495,7 +5501,7 @@ mod handlers {
         .await;
     }
 
-    pub async fn shutdown(sess: &Arc<Session>, sub_id: String) -> bool {
+    pub(super) async fn shutdown(sess: &Arc<Session>, sub_id: String) -> bool {
         sess.abort_all_tasks(TurnAbortReason::Interrupted).await;
         let _ = sess.conversation.shutdown().await;
         sess.services
@@ -5544,7 +5550,7 @@ mod handlers {
         true
     }
 
-    pub async fn review(
+    pub(super) async fn review(
         sess: &Arc<Session>,
         config: &Arc<Config>,
         sub_id: String,
diff --git a/codex-rs/core/src/codex_tests_guardian.rs b/codex-rs/core/src/codex_tests_guardian.rs
index 4f60c2f28e..98388f29a5 100644
--- a/codex-rs/core/src/codex_tests_guardian.rs
+++ b/codex-rs/core/src/codex_tests_guardian.rs
@@ -282,7 +282,7 @@ async fn process_compacted_history_preserves_separate_guardian_developer_message
         .iter()
         .filter_map(|item| match item {
             ResponseItem::Message { role, content, .. } if role == "developer" => {
-                crate::content_items_to_text(content)
+                crate::compact::content_items_to_text(content)
             }
             _ => None,
         })
diff --git a/codex-rs/core/src/compact.rs b/codex-rs/core/src/compact.rs
index 8300dc650c..4e0cacfe06 100644
--- a/codex-rs/core/src/compact.rs
+++ b/codex-rs/core/src/compact.rs
@@ -233,7 +233,7 @@ async fn run_compact_task_inner(
     Ok(())
 }
 
-pub fn content_items_to_text(content: &[ContentItem]) -> Option<String> {
+pub(crate) fn content_items_to_text(content: &[ContentItem]) -> Option<String> {
     let mut pieces = Vec::new();
     for item in content {
         match item {
diff --git a/codex-rs/core/src/connectors.rs b/codex-rs/core/src/connectors.rs
index 334e160f12..96eaff9424 100644
--- a/codex-rs/core/src/connectors.rs
+++ b/codex-rs/core/src/connectors.rs
@@ -613,7 +613,7 @@ pub fn merge_plugin_apps(
     merged
 }
 
-pub fn merge_plugin_apps_with_accessible(
+pub(crate) fn merge_plugin_apps_with_accessible(
     plugin_apps: Vec<AppConnectorId>,
     accessible_connectors: Vec<AppInfo>,
 ) -> Vec<AppInfo> {
@@ -655,7 +655,7 @@ pub fn with_app_enabled_state(mut connectors: Vec<AppInfo>, config: &Config) ->
     connectors
 }
 
-pub fn with_app_plugin_sources(
+fn with_app_plugin_sources(
     mut connectors: Vec<AppInfo>,
     tool_plugin_provenance: &ToolPluginProvenance,
 ) -> Vec<AppInfo> {
@@ -953,7 +953,8 @@ pub fn connector_install_url(name: &str, connector_id: &str) -> String {
     format!("https://chatgpt.com/apps/{slug}/{connector_id}")
 }
 
-pub fn sanitize_name(name: &str) -> String {
+#[cfg(test)]
+pub(crate) fn sanitize_name(name: &str) -> String {
     sanitize_slug(name).replace("-", "_")
 }
 
diff --git a/codex-rs/core/src/environment_context.rs b/codex-rs/core/src/environment_context.rs
index df4e49cf4e..c6da02e499 100644
--- a/codex-rs/core/src/environment_context.rs
+++ b/codex-rs/core/src/environment_context.rs
@@ -26,7 +26,7 @@ pub(crate) struct NetworkContext {
 }
 
 impl EnvironmentContext {
-    pub fn new(
+    pub(crate) fn new(
         cwd: Option<PathBuf>,
         shell: Shell,
         current_date: Option<String>,
@@ -47,7 +47,7 @@ impl EnvironmentContext {
     /// Compares two environment contexts, ignoring the shell. Useful when
     /// comparing turn to turn, since the initial environment_context will
     /// include the shell, and then it is not configurable from turn to turn.
-    pub fn equals_except_shell(&self, other: &EnvironmentContext) -> bool {
+    pub(crate) fn equals_except_shell(&self, other: &EnvironmentContext) -> bool {
         let EnvironmentContext {
             cwd,
             current_date,
@@ -63,7 +63,7 @@ impl EnvironmentContext {
             && self.subagents == *subagents
     }
 
-    pub fn diff_from_turn_context_item(
+    pub(crate) fn diff_from_turn_context_item(
         before: &TurnContextItem,
         after: &TurnContext,
         shell: &Shell,
@@ -92,7 +92,7 @@ impl EnvironmentContext {
         )
     }
 
-    pub fn from_turn_context(turn_context: &TurnContext, shell: &Shell) -> Self {
+    pub(crate) fn from_turn_context(turn_context: &TurnContext, shell: &Shell) -> Self {
         Self::new(
             Some(turn_context.cwd.to_path_buf()),
             shell.clone(),
@@ -103,7 +103,10 @@ impl EnvironmentContext {
         )
     }
 
-    pub fn from_turn_context_item(turn_context_item: &TurnContextItem, shell: &Shell) -> Self {
+    pub(crate) fn from_turn_context_item(
+        turn_context_item: &TurnContextItem,
+        shell: &Shell,
+    ) -> Self {
         Self::new(
             Some(turn_context_item.cwd.clone()),
             shell.clone(),
@@ -114,7 +117,7 @@ impl EnvironmentContext {
         )
     }
 
-    pub fn with_subagents(mut self, subagents: String) -> Self {
+    pub(crate) fn with_subagents(mut self, subagents: String) -> Self {
         if !subagents.is_empty() {
             self.subagents = Some(subagents);
         }
@@ -168,7 +171,7 @@ impl EnvironmentContext {
     ///   <shell>...</shell>
     /// </environment_context>
     /// ```
-    pub fn serialize_to_xml(self) -> String {
+    pub(crate) fn serialize_to_xml(self) -> String {
         let mut lines = Vec::new();
         if let Some(cwd) = self.cwd {
             lines.push(format!("  <cwd>{}</cwd>", cwd.to_string_lossy()));
diff --git a/codex-rs/core/src/exec_policy.rs b/codex-rs/core/src/exec_policy.rs
index dbfab81d32..a249970f54 100644
--- a/codex-rs/core/src/exec_policy.rs
+++ b/codex-rs/core/src/exec_policy.rs
@@ -174,7 +174,7 @@ pub enum ExecPolicyError {
 }
 
 #[derive(Debug, Error)]
-pub enum ExecPolicyUpdateError {
+pub(crate) enum ExecPolicyUpdateError {
     #[error("failed to update rules file {path}: {source}")]
     AppendRule { path: PathBuf, source: AmendError },
 
@@ -535,7 +535,7 @@ pub async fn load_exec_policy(config_stack: &ConfigLayerStack) -> Result<Policy,
 }
 
 /// If a command is not matched by any execpolicy rule, derive a [`Decision`].
-pub fn render_decision_for_unmatched_command(
+pub(crate) fn render_decision_for_unmatched_command(
     approval_policy: AskForApproval,
     sandbox_policy: &SandboxPolicy,
     file_system_sandbox_policy: &FileSystemSandboxPolicy,
diff --git a/codex-rs/core/src/file_watcher.rs b/codex-rs/core/src/file_watcher.rs
index f8f0e4b11f..99d9b14054 100644
--- a/codex-rs/core/src/file_watcher.rs
+++ b/codex-rs/core/src/file_watcher.rs
@@ -182,7 +182,7 @@ struct FileWatcherInner {
 }
 
 /// Coalesces bursts of watch notifications and emits at most once per interval.
-pub struct ThrottledWatchReceiver {
+pub(crate) struct ThrottledWatchReceiver {
     rx: Receiver,
     interval: Duration,
     next_allowed: Option<Instant>,
@@ -190,7 +190,7 @@ pub struct ThrottledWatchReceiver {
 
 impl ThrottledWatchReceiver {
     /// Creates a throttling wrapper around a raw watcher [`Receiver`].
-    pub fn new(rx: Receiver, interval: Duration) -> Self {
+    pub(crate) fn new(rx: Receiver, interval: Duration) -> Self {
         Self {
             rx,
             interval,
@@ -200,7 +200,7 @@ impl ThrottledWatchReceiver {
 
     /// Receives the next event, enforcing the configured minimum delay after
     /// the previous emission.
-    pub async fn recv(&mut self) -> Option<FileWatcherEvent> {
+    pub(crate) async fn recv(&mut self) -> Option<FileWatcherEvent> {
         if let Some(next_allowed) = self.next_allowed {
             sleep_until(next_allowed).await;
         }
diff --git a/codex-rs/core/src/function_tool.rs b/codex-rs/core/src/function_tool.rs
index 240e04361c..be64ea7012 100644
--- a/codex-rs/core/src/function_tool.rs
+++ b/codex-rs/core/src/function_tool.rs
@@ -1,7 +1,7 @@
 use thiserror::Error;
 
 #[derive(Debug, Error, PartialEq)]
-pub enum FunctionCallError {
+pub(crate) enum FunctionCallError {
     #[error("{0}")]
     RespondToModel(String),
     #[error("LocalShellCall without call_id or id")]
diff --git a/codex-rs/core/src/instructions/mod.rs b/codex-rs/core/src/instructions/mod.rs
index 5af9a6e890..a1f77ba5e8 100644
--- a/codex-rs/core/src/instructions/mod.rs
+++ b/codex-rs/core/src/instructions/mod.rs
@@ -1,2 +1 @@
-pub use codex_instructions::USER_INSTRUCTIONS_PREFIX;
 pub(crate) use codex_instructions::UserInstructions;
diff --git a/codex-rs/core/src/lib.rs b/codex-rs/core/src/lib.rs
index d68c2b2992..6f95a6a1d7 100644
--- a/codex-rs/core/src/lib.rs
+++ b/codex-rs/core/src/lib.rs
@@ -10,7 +10,7 @@ mod apps;
 mod arc_monitor;
 mod client;
 mod client_common;
-pub mod codex;
+mod codex;
 mod realtime_context;
 mod realtime_conversation;
 pub use codex::SteerInputError;
@@ -38,13 +38,12 @@ mod flags;
 mod git_info_tests;
 mod guardian;
 mod hook_runtime;
-pub mod instructions;
+mod instructions;
 pub mod landlock;
 pub mod mcp;
 mod mcp_skill_dependencies;
 mod mcp_tool_approval_templates;
 mod network_policy_decision;
-pub mod network_proxy_loader;
 mod original_image_detail;
 pub use codex_mcp::mcp_connection_manager;
 pub use codex_mcp::mcp_connection_manager::MCP_SANDBOX_STATE_CAPABILITY;
@@ -54,7 +53,7 @@ mod mcp_tool_call;
 mod memories;
 pub mod mention_syntax;
 pub mod message_history;
-pub mod utils;
+mod utils;
 pub use utils::path_utils;
 pub mod personality_migration;
 pub mod plugins;
@@ -119,12 +118,11 @@ pub(crate) mod safety;
 pub mod seatbelt;
 mod session_rollout_init_error;
 pub mod shell;
-pub mod shell_snapshot;
+mod shell_snapshot;
 pub mod spawn;
-pub mod state_db_bridge;
 mod thread_rollout_truncation;
 mod tools;
-pub mod turn_diff_tracker;
+mod turn_diff_tracker;
 mod turn_metadata;
 mod turn_timing;
 pub use rollout::ARCHIVED_SESSIONS_SUBDIR;
@@ -163,7 +161,6 @@ pub use client_common::Prompt;
 pub use client_common::REVIEW_PROMPT;
 pub use client_common::ResponseEvent;
 pub use client_common::ResponseStream;
-pub use compact::content_items_to_text;
 pub use event_mapping::parse_turn_item;
 pub use exec_policy::ExecPolicyError;
 pub use exec_policy::check_execpolicy_for_warnings;
@@ -172,5 +169,4 @@ pub use exec_policy::load_exec_policy;
 pub use file_watcher::FileWatcherEvent;
 pub use turn_metadata::build_turn_metadata_header;
 pub mod compact;
-pub mod memory_trace;
 pub mod otel_init;
diff --git a/codex-rs/core/src/mcp.rs b/codex-rs/core/src/mcp.rs
index d82452c54d..eec7f7e498 100644
--- a/codex-rs/core/src/mcp.rs
+++ b/codex-rs/core/src/mcp.rs
@@ -34,7 +34,7 @@ impl McpManager {
         effective_mcp_servers(&mcp_config, auth)
     }
 
-    pub fn tool_plugin_provenance(&self, config: &Config) -> ToolPluginProvenance {
+    pub(crate) fn tool_plugin_provenance(&self, config: &Config) -> ToolPluginProvenance {
         let mcp_config = config.to_mcp_config(self.plugins_manager.as_ref());
         collect_tool_plugin_provenance(&mcp_config)
     }
diff --git a/codex-rs/core/src/memories/citations.rs b/codex-rs/core/src/memories/citations.rs
index d8642880f1..6371b3a949 100644
--- a/codex-rs/core/src/memories/citations.rs
+++ b/codex-rs/core/src/memories/citations.rs
@@ -3,7 +3,7 @@ use codex_protocol::memory_citation::MemoryCitation;
 use codex_protocol::memory_citation::MemoryCitationEntry;
 use std::collections::HashSet;
 
-pub fn parse_memory_citation(citations: Vec<String>) -> Option<MemoryCitation> {
+pub(crate) fn parse_memory_citation(citations: Vec<String>) -> Option<MemoryCitation> {
     let mut entries = Vec::new();
     let mut rollout_ids = Vec::new();
     let mut seen_rollout_ids = HashSet::new();
@@ -42,7 +42,7 @@ pub fn parse_memory_citation(citations: Vec<String>) -> Option<MemoryCitation> {
     }
 }
 
-pub fn get_thread_id_from_citations(citations: Vec<String>) -> Vec<ThreadId> {
+pub(crate) fn get_thread_id_from_citations(citations: Vec<String>) -> Vec<ThreadId> {
     let mut result = Vec::new();
     if let Some(memory_citation) = parse_memory_citation(citations) {
         for rollout_id in memory_citation.rollout_ids {
diff --git a/codex-rs/core/src/memories/mod.rs b/codex-rs/core/src/memories/mod.rs
index ac49c640ca..ec4124cf20 100644
--- a/codex-rs/core/src/memories/mod.rs
+++ b/codex-rs/core/src/memories/mod.rs
@@ -98,7 +98,7 @@ mod metrics {
 use std::path::Path;
 use std::path::PathBuf;
 
-pub fn memory_root(codex_home: &Path) -> PathBuf {
+pub(crate) fn memory_root(codex_home: &Path) -> PathBuf {
     codex_home.join("memories")
 }
 
diff --git a/codex-rs/core/src/memories/phase1.rs b/codex-rs/core/src/memories/phase1.rs
index 37cb0e9f48..78ace917cc 100644
--- a/codex-rs/core/src/memories/phase1.rs
+++ b/codex-rs/core/src/memories/phase1.rs
@@ -147,7 +147,7 @@ pub(in crate::memories) async fn prune(session: &Arc<Session>, config: &Config)
 }
 
 /// JSON schema used to constrain phase-1 model output.
-pub fn output_schema() -> Value {
+pub(super) fn output_schema() -> Value {
     json!({
         "type": "object",
         "properties": {
diff --git a/codex-rs/core/src/otel_init.rs b/codex-rs/core/src/otel_init.rs
index c732692d62..e735056006 100644
--- a/codex-rs/core/src/otel_init.rs
+++ b/codex-rs/core/src/otel_init.rs
@@ -91,9 +91,3 @@ pub fn build_provider(
         runtime_metrics,
     })
 }
-
-/// Filter predicate for exporting only Codex-owned events via OTEL.
-/// Keeps events that originated from codex_otel module
-pub fn codex_export_filter(meta: &tracing::Metadata<'_>) -> bool {
-    meta.target().starts_with("codex_otel")
-}
diff --git a/codex-rs/core/src/plugins/manager.rs b/codex-rs/core/src/plugins/manager.rs
index 1da98b85cb..b881be7357 100644
--- a/codex-rs/core/src/plugins/manager.rs
+++ b/codex-rs/core/src/plugins/manager.rs
@@ -80,7 +80,7 @@ const DEFAULT_SKILLS_DIR_NAME: &str = "skills";
 const DEFAULT_MCP_CONFIG_FILE: &str = ".mcp.json";
 const DEFAULT_APP_CONFIG_FILE: &str = ".app.json";
 pub const OPENAI_CURATED_MARKETPLACE_NAME: &str = "openai-curated";
-pub const OPENAI_CURATED_MARKETPLACE_DISPLAY_NAME: &str = "OpenAI Curated";
+pub(super) const OPENAI_CURATED_MARKETPLACE_DISPLAY_NAME: &str = "OpenAI Curated";
 static CURATED_REPO_SYNC_STARTED: AtomicBool = AtomicBool::new(false);
 const FEATURED_PLUGIN_IDS_CACHE_TTL: std::time::Duration =
     std::time::Duration::from_secs(60 * 60 * 3);
@@ -1882,7 +1882,7 @@ fn load_apps_from_paths(
     connector_ids
 }
 
-pub fn plugin_telemetry_metadata_from_root(
+pub(crate) fn plugin_telemetry_metadata_from_root(
     plugin_id: &PluginId,
     plugin_root: &Path,
 ) -> PluginTelemetryMetadata {
diff --git a/codex-rs/core/src/plugins/manifest.rs b/codex-rs/core/src/plugins/manifest.rs
index f1253441bd..7aeb36eb12 100644
--- a/codex-rs/core/src/plugins/manifest.rs
+++ b/codex-rs/core/src/plugins/manifest.rs
@@ -39,7 +39,7 @@ pub(crate) struct PluginManifest {
 }
 
 #[derive(Debug, Clone, PartialEq, Eq)]
-pub struct PluginManifestPaths {
+pub(crate) struct PluginManifestPaths {
     pub skills: Option<AbsolutePathBuf>,
     pub mcp_servers: Option<AbsolutePathBuf>,
     pub apps: Option<AbsolutePathBuf>,
diff --git a/codex-rs/core/src/plugins/marketplace.rs b/codex-rs/core/src/plugins/marketplace.rs
index ee775262aa..bce50715d5 100644
--- a/codex-rs/core/src/plugins/marketplace.rs
+++ b/codex-rs/core/src/plugins/marketplace.rs
@@ -19,14 +19,14 @@ use tracing::warn;
 const MARKETPLACE_RELATIVE_PATH: &str = ".agents/plugins/marketplace.json";
 
 #[derive(Debug, Clone, PartialEq, Eq)]
-pub struct ResolvedMarketplacePlugin {
+pub(super) struct ResolvedMarketplacePlugin {
     pub plugin_id: PluginId,
     pub source_path: AbsolutePathBuf,
     pub auth_policy: MarketplacePluginAuthPolicy,
 }
 
 #[derive(Debug, Clone, PartialEq, Eq)]
-pub struct Marketplace {
+pub(super) struct Marketplace {
     pub name: String,
     pub path: AbsolutePathBuf,
     pub interface: Option<MarketplaceInterface>,
@@ -40,7 +40,7 @@ pub struct MarketplaceListError {
 }
 
 #[derive(Debug, Clone, Default, PartialEq, Eq)]
-pub struct MarketplaceListOutcome {
+pub(super) struct MarketplaceListOutcome {
     pub marketplaces: Vec<Marketplace>,
     pub errors: Vec<MarketplaceListError>,
 }
@@ -51,7 +51,7 @@ pub struct MarketplaceInterface {
 }
 
 #[derive(Debug, Clone, PartialEq, Eq)]
-pub struct MarketplacePlugin {
+pub(super) struct MarketplacePlugin {
     pub name: String,
     pub source: MarketplacePluginSource,
     pub policy: MarketplacePluginPolicy,
@@ -155,7 +155,7 @@ impl MarketplaceError {
 
 // Always read the specified marketplace file from disk so installs see the
 // latest marketplace.json contents without any in-memory cache invalidation.
-pub fn resolve_marketplace_plugin(
+pub(super) fn resolve_marketplace_plugin(
     marketplace_path: &AbsolutePathBuf,
     plugin_name: &str,
     restriction_product: Option<Product>,
@@ -205,7 +205,7 @@ pub fn resolve_marketplace_plugin(
     })
 }
 
-pub fn list_marketplaces(
+pub(super) fn list_marketplaces(
     additional_roots: &[AbsolutePathBuf],
 ) -> Result<MarketplaceListOutcome, MarketplaceError> {
     list_marketplaces_with_home(additional_roots, home_dir().as_deref())
diff --git a/codex-rs/core/src/plugins/mod.rs b/codex-rs/core/src/plugins/mod.rs
index a86502c28c..58c2468101 100644
--- a/codex-rs/core/src/plugins/mod.rs
+++ b/codex-rs/core/src/plugins/mod.rs
@@ -43,7 +43,6 @@ pub use manager::RemotePluginSyncResult;
 pub use manager::installed_plugin_telemetry_metadata;
 pub use manager::load_plugin_apps;
 pub use manager::load_plugin_mcp_servers;
-pub use manager::plugin_telemetry_metadata_from_root;
 pub use manifest::PluginManifestInterface;
 pub(crate) use manifest::PluginManifestPaths;
 pub(crate) use manifest::load_plugin_manifest;
diff --git a/codex-rs/core/src/plugins/store.rs b/codex-rs/core/src/plugins/store.rs
index 4316f18002..59852f05e7 100644
--- a/codex-rs/core/src/plugins/store.rs
+++ b/codex-rs/core/src/plugins/store.rs
@@ -15,30 +15,30 @@ pub(crate) const DEFAULT_PLUGIN_VERSION: &str = "local";
 pub(crate) const PLUGINS_CACHE_DIR: &str = "plugins/cache";
 
 #[derive(Debug, Clone, PartialEq, Eq)]
-pub struct PluginInstallResult {
+pub(super) struct PluginInstallResult {
     pub plugin_id: PluginId,
     pub plugin_version: String,
     pub installed_path: AbsolutePathBuf,
 }
 
 #[derive(Debug, Clone)]
-pub struct PluginStore {
+pub(super) struct PluginStore {
     root: AbsolutePathBuf,
 }
 
 impl PluginStore {
-    pub fn new(codex_home: PathBuf) -> Self {
+    pub(super) fn new(codex_home: PathBuf) -> Self {
         Self {
             root: AbsolutePathBuf::try_from(codex_home.join(PLUGINS_CACHE_DIR))
                 .unwrap_or_else(|err| panic!("plugin cache root should be absolute: {err}")),
         }
     }
 
-    pub fn root(&self) -> &AbsolutePathBuf {
+    pub(super) fn root(&self) -> &AbsolutePathBuf {
         &self.root
     }
 
-    pub fn plugin_base_root(&self, plugin_id: &PluginId) -> AbsolutePathBuf {
+    pub(super) fn plugin_base_root(&self, plugin_id: &PluginId) -> AbsolutePathBuf {
         AbsolutePathBuf::try_from(
             self.root
                 .as_path()
@@ -48,7 +48,11 @@ impl PluginStore {
         .unwrap_or_else(|err| panic!("plugin cache path should resolve to an absolute path: {err}"))
     }
 
-    pub fn plugin_root(&self, plugin_id: &PluginId, plugin_version: &str) -> AbsolutePathBuf {
+    pub(super) fn plugin_root(
+        &self,
+        plugin_id: &PluginId,
+        plugin_version: &str,
+    ) -> AbsolutePathBuf {
         AbsolutePathBuf::try_from(
             self.plugin_base_root(plugin_id)
                 .as_path()
@@ -57,7 +61,7 @@ impl PluginStore {
         .unwrap_or_else(|err| panic!("plugin cache path should resolve to an absolute path: {err}"))
     }
 
-    pub fn active_plugin_version(&self, plugin_id: &PluginId) -> Option<String> {
+    pub(super) fn active_plugin_version(&self, plugin_id: &PluginId) -> Option<String> {
         let mut discovered_versions = fs::read_dir(self.plugin_base_root(plugin_id).as_path())
             .ok()?
             .filter_map(Result::ok)
@@ -80,16 +84,16 @@ impl PluginStore {
         }
     }
 
-    pub fn active_plugin_root(&self, plugin_id: &PluginId) -> Option<AbsolutePathBuf> {
+    pub(super) fn active_plugin_root(&self, plugin_id: &PluginId) -> Option<AbsolutePathBuf> {
         self.active_plugin_version(plugin_id)
             .map(|plugin_version| self.plugin_root(plugin_id, &plugin_version))
     }
 
-    pub fn is_installed(&self, plugin_id: &PluginId) -> bool {
+    pub(super) fn is_installed(&self, plugin_id: &PluginId) -> bool {
         self.active_plugin_version(plugin_id).is_some()
     }
 
-    pub fn install(
+    pub(super) fn install(
         &self,
         source_path: AbsolutePathBuf,
         plugin_id: PluginId,
@@ -98,7 +102,7 @@ impl PluginStore {
         self.install_with_version(source_path, plugin_id, plugin_version)
     }
 
-    pub fn install_with_version(
+    pub(super) fn install_with_version(
         &self,
         source_path: AbsolutePathBuf,
         plugin_id: PluginId,
@@ -133,7 +137,7 @@ impl PluginStore {
         })
     }
 
-    pub fn uninstall(&self, plugin_id: &PluginId) -> Result<(), PluginStoreError> {
+    pub(super) fn uninstall(&self, plugin_id: &PluginId) -> Result<(), PluginStoreError> {
         remove_existing_target(self.plugin_base_root(plugin_id).as_path())
     }
 }
diff --git a/codex-rs/core/src/project_doc.rs b/codex-rs/core/src/project_doc.rs
index 1b72f64610..fa2103458f 100644
--- a/codex-rs/core/src/project_doc.rs
+++ b/codex-rs/core/src/project_doc.rs
@@ -34,7 +34,7 @@ pub(crate) const HIERARCHICAL_AGENTS_MESSAGE: &str =
 /// Default filename scanned for project-level docs.
 pub const DEFAULT_PROJECT_DOC_FILENAME: &str = "AGENTS.md";
 /// Preferred local override for project-level docs.
-pub const LOCAL_PROJECT_DOC_FILENAME: &str = "AGENTS.override.md";
+pub(crate) const LOCAL_PROJECT_DOC_FILENAME: &str = "AGENTS.override.md";
 
 /// When both `Config::instructions` and the project doc are present, they will
 /// be concatenated with the following separator.
@@ -125,7 +125,7 @@ pub(crate) async fn get_user_instructions(config: &Config) -> Option<String> {
 /// concatenation of all discovered docs. If no documentation file is found the
 /// function returns `Ok(None)`. Unexpected I/O failures bubble up as `Err` so
 /// callers can decide how to handle them.
-pub async fn read_project_docs(config: &Config) -> std::io::Result<Option<String>> {
+pub(crate) async fn read_project_docs(config: &Config) -> std::io::Result<Option<String>> {
     let max_total = config.project_doc_max_bytes;
 
     if max_total == 0 {
diff --git a/codex-rs/core/src/review_prompts.rs b/codex-rs/core/src/review_prompts.rs
index 988ceff821..ab0e89e8e4 100644
--- a/codex-rs/core/src/review_prompts.rs
+++ b/codex-rs/core/src/review_prompts.rs
@@ -6,10 +6,10 @@ use std::path::Path;
 use std::sync::LazyLock;
 
 #[derive(Clone, Debug, PartialEq)]
-pub struct ResolvedReviewRequest {
-    pub target: ReviewTarget,
-    pub prompt: String,
-    pub user_facing_hint: String,
+pub(crate) struct ResolvedReviewRequest {
+    pub(crate) target: ReviewTarget,
+    pub(crate) prompt: String,
+    pub(crate) user_facing_hint: String,
 }
 
 const UNCOMMITTED_PROMPT: &str = "Review the current code changes (staged, unstaged, and untracked files) and provide prioritized findings.";
@@ -36,7 +36,7 @@ static COMMIT_PROMPT_TEMPLATE: LazyLock<Template> = LazyLock::new(|| {
         .unwrap_or_else(|err| panic!("commit review prompt must parse: {err}"))
 });
 
-pub fn resolve_review_request(
+pub(crate) fn resolve_review_request(
     request: ReviewRequest,
     cwd: &Path,
 ) -> anyhow::Result<ResolvedReviewRequest> {
@@ -53,7 +53,7 @@ pub fn resolve_review_request(
     })
 }
 
-pub fn review_prompt(target: &ReviewTarget, cwd: &Path) -> anyhow::Result<String> {
+pub(crate) fn review_prompt(target: &ReviewTarget, cwd: &Path) -> anyhow::Result<String> {
     match target {
         ReviewTarget::UncommittedChanges => Ok(UNCOMMITTED_PROMPT.to_string()),
         ReviewTarget::BaseBranch { branch } => {
diff --git a/codex-rs/core/src/rollout.rs b/codex-rs/core/src/rollout.rs
index c3a7218710..ec031bd77b 100644
--- a/codex-rs/core/src/rollout.rs
+++ b/codex-rs/core/src/rollout.rs
@@ -36,7 +36,7 @@ impl codex_rollout::RolloutConfigView for Config {
     }
 }
 
-pub mod list {
+pub(crate) mod list {
     pub use codex_rollout::list::*;
 }
 
@@ -44,15 +44,15 @@ pub(crate) mod metadata {
     pub(crate) use codex_rollout::metadata::builder_from_items;
 }
 
-pub mod policy {
+pub(crate) mod policy {
     pub use codex_rollout::policy::*;
 }
 
-pub mod recorder {
-    pub use codex_rollout::recorder::*;
+pub(crate) mod recorder {
+    pub(crate) use codex_rollout::recorder::*;
 }
 
-pub mod session_index {
+pub(crate) mod session_index {
     pub use codex_rollout::session_index::*;
 }
 
diff --git a/codex-rs/core/src/safety.rs b/codex-rs/core/src/safety.rs
index dec7a00876..10f3447499 100644
--- a/codex-rs/core/src/safety.rs
+++ b/codex-rs/core/src/safety.rs
@@ -13,7 +13,7 @@ use codex_sandboxing::SandboxType;
 use codex_sandboxing::get_platform_sandbox;
 
 #[derive(Debug, PartialEq)]
-pub enum SafetyCheck {
+pub(crate) enum SafetyCheck {
     AutoApprove {
         sandbox_type: SandboxType,
         user_explicitly_approved: bool,
@@ -24,7 +24,7 @@ pub enum SafetyCheck {
     },
 }
 
-pub fn assess_patch_safety(
+pub(crate) fn assess_patch_safety(
     action: &ApplyPatchAction,
     policy: AskForApproval,
     sandbox_policy: &SandboxPolicy,
diff --git a/codex-rs/core/src/sandboxing/mod.rs b/codex-rs/core/src/sandboxing/mod.rs
index 0427de7c76..d95f042a70 100644
--- a/codex-rs/core/src/sandboxing/mod.rs
+++ b/codex-rs/core/src/sandboxing/mod.rs
@@ -144,7 +144,7 @@ pub async fn execute_env(
     execute_exec_request(exec_request, stdout_stream, /*after_spawn*/ None).await
 }
 
-pub async fn execute_exec_request_with_after_spawn(
+pub(crate) async fn execute_exec_request_with_after_spawn(
     exec_request: ExecRequest,
     stdout_stream: Option<StdoutStream>,
     after_spawn: Option<Box<dyn FnOnce() + Send>>,
diff --git a/codex-rs/core/src/shell_snapshot.rs b/codex-rs/core/src/shell_snapshot.rs
index 29b50cb9e8..9e9442ba8a 100644
--- a/codex-rs/core/src/shell_snapshot.rs
+++ b/codex-rs/core/src/shell_snapshot.rs
@@ -489,7 +489,10 @@ $envVars | ForEach-Object {
 /// Removes shell snapshots that either lack a matching session rollout file or
 /// whose rollouts have not been updated within the retention window.
 /// The active session id is exempt from cleanup.
-pub async fn cleanup_stale_snapshots(codex_home: &Path, active_session_id: ThreadId) -> Result<()> {
+pub(crate) async fn cleanup_stale_snapshots(
+    codex_home: &Path,
+    active_session_id: ThreadId,
+) -> Result<()> {
     let snapshot_dir = codex_home.join(SNAPSHOT_DIR);
 
     let mut entries = match fs::read_dir(&snapshot_dir).await {
diff --git a/codex-rs/core/src/skills_watcher.rs b/codex-rs/core/src/skills_watcher.rs
index b5a1256cdb..ab3774d817 100644
--- a/codex-rs/core/src/skills_watcher.rs
+++ b/codex-rs/core/src/skills_watcher.rs
@@ -25,7 +25,7 @@ const WATCHER_THROTTLE_INTERVAL: Duration = Duration::from_secs(10);
 const WATCHER_THROTTLE_INTERVAL: Duration = Duration::from_millis(50);
 
 #[derive(Debug, Clone, PartialEq, Eq)]
-pub enum SkillsWatcherEvent {
+pub(crate) enum SkillsWatcherEvent {
     SkillsChanged { paths: Vec<PathBuf> },
 }
 
diff --git a/codex-rs/core/src/tasks/mod.rs b/codex-rs/core/src/tasks/mod.rs
index f33e6886f4..07946ab041 100644
--- a/codex-rs/core/src/tasks/mod.rs
+++ b/codex-rs/core/src/tasks/mod.rs
@@ -224,7 +224,7 @@ where
 }
 
 impl Session {
-    pub async fn spawn_task<T: SessionTask>(
+    pub(crate) async fn spawn_task<T: SessionTask>(
         self: &Arc<Self>,
         turn_context: Arc<TurnContext>,
         input: Vec<UserInput>,
@@ -370,7 +370,7 @@ impl Session {
             .await;
     }
 
-    pub async fn abort_all_tasks(self: &Arc<Self>, reason: TurnAbortReason) {
+    pub(crate) async fn abort_all_tasks(self: &Arc<Self>, reason: TurnAbortReason) {
         if let Some(mut active_turn) = self.take_active_turn().await {
             for task in active_turn.drain_tasks() {
                 self.handle_task_abort(task, reason.clone()).await;
@@ -384,7 +384,7 @@ impl Session {
         }
     }
 
-    pub async fn on_task_finished(
+    pub(crate) async fn on_task_finished(
         self: &Arc<Self>,
         turn_context: Arc<TurnContext>,
         last_agent_message: Option<String>,
diff --git a/codex-rs/core/src/tools/code_mode/execute_handler.rs b/codex-rs/core/src/tools/code_mode/execute_handler.rs
index c46c3e0458..175cc37664 100644
--- a/codex-rs/core/src/tools/code_mode/execute_handler.rs
+++ b/codex-rs/core/src/tools/code_mode/execute_handler.rs
@@ -10,7 +10,7 @@ use super::PUBLIC_TOOL_NAME;
 use super::build_enabled_tools;
 use super::handle_runtime_response;
 
-pub struct CodeModeExecuteHandler;
+pub(crate) struct CodeModeExecuteHandler;
 
 impl CodeModeExecuteHandler {
     async fn execute(
diff --git a/codex-rs/core/src/tools/code_mode/wait_handler.rs b/codex-rs/core/src/tools/code_mode/wait_handler.rs
index 8a9d24c1ff..5e4ce0d77f 100644
--- a/codex-rs/core/src/tools/code_mode/wait_handler.rs
+++ b/codex-rs/core/src/tools/code_mode/wait_handler.rs
@@ -12,7 +12,7 @@ use super::ExecContext;
 use super::WAIT_TOOL_NAME;
 use super::handle_runtime_response;
 
-pub struct CodeModeWaitHandler;
+pub(crate) struct CodeModeWaitHandler;
 
 #[derive(Debug, Deserialize)]
 struct ExecWaitArgs {
diff --git a/codex-rs/core/src/tools/context.rs b/codex-rs/core/src/tools/context.rs
index 7c486640ee..9cbbf583bc 100644
--- a/codex-rs/core/src/tools/context.rs
+++ b/codex-rs/core/src/tools/context.rs
@@ -24,17 +24,17 @@ use std::sync::Arc;
 use std::time::Duration;
 use tokio::sync::Mutex;
 
-pub type SharedTurnDiffTracker = Arc<Mutex<TurnDiffTracker>>;
+pub(crate) type SharedTurnDiffTracker = Arc<Mutex<TurnDiffTracker>>;
 
 #[derive(Clone, Copy, Debug, Eq, PartialEq)]
-pub enum ToolCallSource {
+pub(crate) enum ToolCallSource {
     Direct,
     JsRepl,
     CodeMode,
 }
 
 #[derive(Clone)]
-pub struct ToolInvocation {
+pub(crate) struct ToolInvocation {
     pub session: Arc<Session>,
     pub turn: Arc<TurnContext>,
     pub tracker: SharedTurnDiffTracker,
@@ -77,7 +77,7 @@ impl ToolPayload {
     }
 }
 
-pub trait ToolOutput: Send {
+pub(crate) trait ToolOutput: Send {
     fn log_preview(&self) -> String;
 
     fn success_for_logging(&self) -> bool;
@@ -119,7 +119,7 @@ impl ToolOutput for CallToolResult {
 }
 
 #[derive(Clone)]
-pub struct ToolSearchOutput {
+pub(crate) struct ToolSearchOutput {
     pub tools: Vec<ToolSearchOutputTool>,
 }
 
@@ -159,14 +159,14 @@ impl ToolOutput for ToolSearchOutput {
     }
 }
 
-pub struct FunctionToolOutput {
+pub(crate) struct FunctionToolOutput {
     pub body: Vec<FunctionCallOutputContentItem>,
     pub success: Option<bool>,
     pub post_tool_use_response: Option<JsonValue>,
 }
 
 impl FunctionToolOutput {
-    pub fn from_text(text: String, success: Option<bool>) -> Self {
+    pub(crate) fn from_text(text: String, success: Option<bool>) -> Self {
         Self {
             body: vec![FunctionCallOutputContentItem::InputText { text }],
             success,
@@ -174,7 +174,7 @@ impl FunctionToolOutput {
         }
     }
 
-    pub fn from_content(
+    pub(crate) fn from_content(
         content: Vec<FunctionCallOutputContentItem>,
         success: Option<bool>,
     ) -> Self {
@@ -185,7 +185,7 @@ impl FunctionToolOutput {
         }
     }
 
-    pub fn into_text(self) -> String {
+    pub(crate) fn into_text(self) -> String {
         function_call_output_content_items_to_text(&self.body).unwrap_or_default()
     }
 }
@@ -210,12 +210,12 @@ impl ToolOutput for FunctionToolOutput {
     }
 }
 
-pub struct ApplyPatchToolOutput {
+pub(crate) struct ApplyPatchToolOutput {
     pub text: String,
 }
 
 impl ApplyPatchToolOutput {
-    pub fn from_text(text: String) -> Self {
+    pub(crate) fn from_text(text: String) -> Self {
         Self { text }
     }
 }
@@ -245,7 +245,7 @@ impl ToolOutput for ApplyPatchToolOutput {
     }
 }
 
-pub struct AbortedToolOutput {
+pub(crate) struct AbortedToolOutput {
     pub message: String,
 }
 
@@ -283,7 +283,7 @@ impl ToolOutput for AbortedToolOutput {
 }
 
 #[derive(Debug, Clone, PartialEq)]
-pub struct ExecCommandToolOutput {
+pub(crate) struct ExecCommandToolOutput {
     pub event_call_id: String,
     pub chunk_id: String,
     pub wall_time: Duration,
diff --git a/codex-rs/core/src/tools/events.rs b/codex-rs/core/src/tools/events.rs
index 58438cf563..4ddcfb4538 100644
--- a/codex-rs/core/src/tools/events.rs
+++ b/codex-rs/core/src/tools/events.rs
@@ -34,7 +34,7 @@ pub(crate) struct ToolEventCtx<'a> {
 }
 
 impl<'a> ToolEventCtx<'a> {
-    pub fn new(
+    pub(crate) fn new(
         session: &'a Session,
         turn: &'a TurnContext,
         call_id: &'a str,
@@ -109,7 +109,7 @@ pub(crate) enum ToolEmitter {
 }
 
 impl ToolEmitter {
-    pub fn shell(
+    pub(crate) fn shell(
         command: Vec<String>,
         cwd: PathBuf,
         source: ExecCommandSource,
@@ -125,14 +125,14 @@ impl ToolEmitter {
         }
     }
 
-    pub fn apply_patch(changes: HashMap<PathBuf, FileChange>, auto_approved: bool) -> Self {
+    pub(crate) fn apply_patch(changes: HashMap<PathBuf, FileChange>, auto_approved: bool) -> Self {
         Self::ApplyPatch {
             changes,
             auto_approved,
         }
     }
 
-    pub fn unified_exec(
+    pub(crate) fn unified_exec(
         command: &[String],
         cwd: PathBuf,
         source: ExecCommandSource,
@@ -148,7 +148,7 @@ impl ToolEmitter {
         }
     }
 
-    pub async fn emit(&self, ctx: ToolEventCtx<'_>, stage: ToolEventStage) {
+    pub(crate) async fn emit(&self, ctx: ToolEventCtx<'_>, stage: ToolEventStage) {
         match (self, stage) {
             (
                 Self::Shell {
@@ -286,7 +286,7 @@ impl ToolEmitter {
         }
     }
 
-    pub async fn begin(&self, ctx: ToolEventCtx<'_>) {
+    pub(crate) async fn begin(&self, ctx: ToolEventCtx<'_>) {
         self.emit(ctx, ToolEventStage::Begin).await;
     }
 
@@ -303,7 +303,7 @@ impl ToolEmitter {
         }
     }
 
-    pub async fn finish(
+    pub(crate) async fn finish(
         &self,
         ctx: ToolEventCtx<'_>,
         out: Result<ExecToolCallOutput, ToolError>,
diff --git a/codex-rs/core/src/tools/handlers/agent_jobs.rs b/codex-rs/core/src/tools/handlers/agent_jobs.rs
index fe30f3d750..51919ba262 100644
--- a/codex-rs/core/src/tools/handlers/agent_jobs.rs
+++ b/codex-rs/core/src/tools/handlers/agent_jobs.rs
@@ -34,7 +34,7 @@ use tokio::time::Instant;
 use tokio::time::timeout;
 use uuid::Uuid;
 
-pub struct BatchJobHandler;
+pub(crate) struct BatchJobHandler;
 
 const DEFAULT_AGENT_JOB_CONCURRENCY: usize = 16;
 const MAX_AGENT_JOB_CONCURRENCY: usize = 64;
@@ -224,7 +224,7 @@ mod spawn_agents_on_csv {
     /// Each CSV row becomes a job item. The instruction string is a template where `{column}`
     /// placeholders are filled with values from that row. Results are reported by workers via
     /// `report_agent_job_result`, then exported to CSV on completion.
-    pub async fn handle(
+    pub(super) async fn handle(
         session: Arc<Session>,
         turn: Arc<TurnContext>,
         arguments: String,
@@ -468,7 +468,7 @@ mod spawn_agents_on_csv {
 mod report_agent_job_result {
     use super::*;
 
-    pub async fn handle(
+    pub(super) async fn handle(
         session: Arc<Session>,
         arguments: String,
     ) -> Result<FunctionToolOutput, FunctionCallError> {
diff --git a/codex-rs/core/src/tools/handlers/apply_patch.rs b/codex-rs/core/src/tools/handlers/apply_patch.rs
index 00b1173aa4..5eef3659cb 100644
--- a/codex-rs/core/src/tools/handlers/apply_patch.rs
+++ b/codex-rs/core/src/tools/handlers/apply_patch.rs
@@ -33,7 +33,7 @@ use codex_utils_absolute_path::AbsolutePathBuf;
 use std::collections::BTreeSet;
 use std::sync::Arc;
 
-pub struct ApplyPatchHandler;
+pub(crate) struct ApplyPatchHandler;
 
 fn file_paths_for_action(action: &ApplyPatchAction) -> Vec<AbsolutePathBuf> {
     let mut keys = Vec::new();
diff --git a/codex-rs/core/src/tools/handlers/dynamic.rs b/codex-rs/core/src/tools/handlers/dynamic.rs
index 5f73f096e2..3bd0ccba22 100644
--- a/codex-rs/core/src/tools/handlers/dynamic.rs
+++ b/codex-rs/core/src/tools/handlers/dynamic.rs
@@ -17,7 +17,7 @@ use std::time::Instant;
 use tokio::sync::oneshot;
 use tracing::warn;
 
-pub struct DynamicToolHandler;
+pub(crate) struct DynamicToolHandler;
 
 impl ToolHandler for DynamicToolHandler {
     type Output = FunctionToolOutput;
diff --git a/codex-rs/core/src/tools/handlers/js_repl.rs b/codex-rs/core/src/tools/handlers/js_repl.rs
index 5493a7a904..d01c490550 100644
--- a/codex-rs/core/src/tools/handlers/js_repl.rs
+++ b/codex-rs/core/src/tools/handlers/js_repl.rs
@@ -22,8 +22,8 @@ use codex_protocol::exec_output::StreamOutput;
 use codex_protocol::models::FunctionCallOutputContentItem;
 use codex_protocol::protocol::ExecCommandSource;
 
-pub struct JsReplHandler;
-pub struct JsReplResetHandler;
+pub(crate) struct JsReplHandler;
+pub(crate) struct JsReplResetHandler;
 
 fn join_outputs(stdout: &str, stderr: &str) -> String {
     if stdout.is_empty() {
diff --git a/codex-rs/core/src/tools/handlers/list_dir.rs b/codex-rs/core/src/tools/handlers/list_dir.rs
index be4e356c5c..a94981b0aa 100644
--- a/codex-rs/core/src/tools/handlers/list_dir.rs
+++ b/codex-rs/core/src/tools/handlers/list_dir.rs
@@ -16,7 +16,7 @@ use crate::tools::handlers::parse_arguments;
 use crate::tools::registry::ToolHandler;
 use crate::tools::registry::ToolKind;
 
-pub struct ListDirHandler;
+pub(crate) struct ListDirHandler;
 
 const MAX_ENTRY_LENGTH: usize = 500;
 const INDENTATION_SPACES: usize = 2;
diff --git a/codex-rs/core/src/tools/handlers/mcp.rs b/codex-rs/core/src/tools/handlers/mcp.rs
index 6eaccaf81a..2b74b5a967 100644
--- a/codex-rs/core/src/tools/handlers/mcp.rs
+++ b/codex-rs/core/src/tools/handlers/mcp.rs
@@ -8,7 +8,7 @@ use crate::tools::registry::ToolHandler;
 use crate::tools::registry::ToolKind;
 use codex_protocol::mcp::CallToolResult;
 
-pub struct McpHandler;
+pub(crate) struct McpHandler;
 impl ToolHandler for McpHandler {
     type Output = CallToolResult;
 
diff --git a/codex-rs/core/src/tools/handlers/mcp_resource.rs b/codex-rs/core/src/tools/handlers/mcp_resource.rs
index d0b7ddc5a8..445955c343 100644
--- a/codex-rs/core/src/tools/handlers/mcp_resource.rs
+++ b/codex-rs/core/src/tools/handlers/mcp_resource.rs
@@ -30,7 +30,7 @@ use codex_protocol::protocol::McpInvocation;
 use codex_protocol::protocol::McpToolCallBeginEvent;
 use codex_protocol::protocol::McpToolCallEndEvent;
 
-pub struct McpResourceHandler;
+pub(crate) struct McpResourceHandler;
 
 #[derive(Debug, Deserialize, Default)]
 struct ListResourcesArgs {
diff --git a/codex-rs/core/src/tools/handlers/mod.rs b/codex-rs/core/src/tools/handlers/mod.rs
index f0a62b8c14..0a6a69b7b0 100644
--- a/codex-rs/core/src/tools/handlers/mod.rs
+++ b/codex-rs/core/src/tools/handlers/mod.rs
@@ -1,5 +1,5 @@
 pub(crate) mod agent_jobs;
-pub mod apply_patch;
+pub(crate) mod apply_patch;
 mod dynamic;
 mod js_repl;
 mod list_dir;
@@ -32,25 +32,25 @@ use crate::function_tool::FunctionCallError;
 use crate::sandboxing::SandboxPermissions;
 pub(crate) use crate::tools::code_mode::CodeModeExecuteHandler;
 pub(crate) use crate::tools::code_mode::CodeModeWaitHandler;
-pub use apply_patch::ApplyPatchHandler;
+pub(crate) use apply_patch::ApplyPatchHandler;
 use codex_protocol::models::PermissionProfile;
 use codex_protocol::protocol::AskForApproval;
-pub use dynamic::DynamicToolHandler;
-pub use js_repl::JsReplHandler;
-pub use js_repl::JsReplResetHandler;
-pub use list_dir::ListDirHandler;
-pub use mcp::McpHandler;
-pub use mcp_resource::McpResourceHandler;
-pub use plan::PlanHandler;
-pub use request_permissions::RequestPermissionsHandler;
-pub use request_user_input::RequestUserInputHandler;
-pub use shell::ShellCommandHandler;
-pub use shell::ShellHandler;
-pub use test_sync::TestSyncHandler;
-pub use tool_search::ToolSearchHandler;
-pub use tool_suggest::ToolSuggestHandler;
-pub use unified_exec::UnifiedExecHandler;
-pub use view_image::ViewImageHandler;
+pub(crate) use dynamic::DynamicToolHandler;
+pub(crate) use js_repl::JsReplHandler;
+pub(crate) use js_repl::JsReplResetHandler;
+pub(crate) use list_dir::ListDirHandler;
+pub(crate) use mcp::McpHandler;
+pub(crate) use mcp_resource::McpResourceHandler;
+pub(crate) use plan::PlanHandler;
+pub(crate) use request_permissions::RequestPermissionsHandler;
+pub(crate) use request_user_input::RequestUserInputHandler;
+pub(crate) use shell::ShellCommandHandler;
+pub(crate) use shell::ShellHandler;
+pub(crate) use test_sync::TestSyncHandler;
+pub(crate) use tool_search::ToolSearchHandler;
+pub(crate) use tool_suggest::ToolSuggestHandler;
+pub(crate) use unified_exec::UnifiedExecHandler;
+pub(crate) use view_image::ViewImageHandler;
 
 fn parse_arguments<T>(arguments: &str) -> Result<T, FunctionCallError>
 where
diff --git a/codex-rs/core/src/tools/handlers/multi_agents.rs b/codex-rs/core/src/tools/handlers/multi_agents.rs
index df66543da6..984e09a968 100644
--- a/codex-rs/core/src/tools/handlers/multi_agents.rs
+++ b/codex-rs/core/src/tools/handlers/multi_agents.rs
@@ -63,7 +63,7 @@ pub(crate) use send_input::Handler as SendInputHandler;
 pub(crate) use spawn::Handler as SpawnAgentHandler;
 pub(crate) use wait::Handler as WaitAgentHandler;
 
-pub mod close_agent;
+pub(crate) mod close_agent;
 mod resume_agent;
 mod send_input;
 mod spawn;
diff --git a/codex-rs/core/src/tools/handlers/plan.rs b/codex-rs/core/src/tools/handlers/plan.rs
index fb1c708ada..b9fc97dcba 100644
--- a/codex-rs/core/src/tools/handlers/plan.rs
+++ b/codex-rs/core/src/tools/handlers/plan.rs
@@ -13,9 +13,9 @@ use codex_protocol::plan_tool::UpdatePlanArgs;
 use codex_protocol::protocol::EventMsg;
 use serde_json::Value as JsonValue;
 
-pub struct PlanHandler;
+pub(crate) struct PlanHandler;
 
-pub struct PlanToolOutput;
+pub(crate) struct PlanToolOutput;
 
 const PLAN_UPDATED_MESSAGE: &str = "Plan updated";
 
diff --git a/codex-rs/core/src/tools/handlers/request_permissions.rs b/codex-rs/core/src/tools/handlers/request_permissions.rs
index 2590b9d7dd..f048f52e6d 100644
--- a/codex-rs/core/src/tools/handlers/request_permissions.rs
+++ b/codex-rs/core/src/tools/handlers/request_permissions.rs
@@ -9,7 +9,7 @@ use crate::tools::handlers::parse_arguments_with_base_path;
 use crate::tools::registry::ToolHandler;
 use crate::tools::registry::ToolKind;
 
-pub struct RequestPermissionsHandler;
+pub(crate) struct RequestPermissionsHandler;
 
 impl ToolHandler for RequestPermissionsHandler {
     type Output = FunctionToolOutput;
diff --git a/codex-rs/core/src/tools/handlers/request_user_input.rs b/codex-rs/core/src/tools/handlers/request_user_input.rs
index dcc9445a94..defcf6b529 100644
--- a/codex-rs/core/src/tools/handlers/request_user_input.rs
+++ b/codex-rs/core/src/tools/handlers/request_user_input.rs
@@ -10,7 +10,7 @@ use codex_tools::REQUEST_USER_INPUT_TOOL_NAME;
 use codex_tools::normalize_request_user_input_args;
 use codex_tools::request_user_input_unavailable_message;
 
-pub struct RequestUserInputHandler {
+pub(crate) struct RequestUserInputHandler {
     pub default_mode_request_user_input: bool,
 }
 
diff --git a/codex-rs/core/src/tools/handlers/shell.rs b/codex-rs/core/src/tools/handlers/shell.rs
index 6f662ff493..9498979c60 100644
--- a/codex-rs/core/src/tools/handlers/shell.rs
+++ b/codex-rs/core/src/tools/handlers/shell.rs
@@ -40,7 +40,7 @@ use codex_protocol::protocol::ExecCommandSource;
 use codex_shell_command::is_safe_command::is_known_safe_command;
 use codex_tools::ShellCommandBackendConfig;
 
-pub struct ShellHandler;
+pub(crate) struct ShellHandler;
 
 #[derive(Clone, Copy, Debug, Eq, PartialEq)]
 enum ShellCommandBackend {
@@ -48,7 +48,7 @@ enum ShellCommandBackend {
     ZshFork,
 }
 
-pub struct ShellCommandHandler {
+pub(crate) struct ShellCommandHandler {
     backend: ShellCommandBackend,
 }
 
diff --git a/codex-rs/core/src/tools/handlers/test_sync.rs b/codex-rs/core/src/tools/handlers/test_sync.rs
index ad2647243a..4b5c3b395d 100644
--- a/codex-rs/core/src/tools/handlers/test_sync.rs
+++ b/codex-rs/core/src/tools/handlers/test_sync.rs
@@ -16,7 +16,7 @@ use crate::tools::handlers::parse_arguments;
 use crate::tools::registry::ToolHandler;
 use crate::tools::registry::ToolKind;
 
-pub struct TestSyncHandler;
+pub(crate) struct TestSyncHandler;
 
 const DEFAULT_TIMEOUT_MS: u64 = 1_000;
 
diff --git a/codex-rs/core/src/tools/handlers/tool_search.rs b/codex-rs/core/src/tools/handlers/tool_search.rs
index dd203e93b5..3c34a8e2dc 100644
--- a/codex-rs/core/src/tools/handlers/tool_search.rs
+++ b/codex-rs/core/src/tools/handlers/tool_search.rs
@@ -14,12 +14,12 @@ use codex_tools::ToolSearchResultSource;
 use codex_tools::collect_tool_search_output_tools;
 use std::collections::HashMap;
 
-pub struct ToolSearchHandler {
+pub(crate) struct ToolSearchHandler {
     tools: HashMap<String, ToolInfo>,
 }
 
 impl ToolSearchHandler {
-    pub fn new(tools: HashMap<String, ToolInfo>) -> Self {
+    pub(crate) fn new(tools: HashMap<String, ToolInfo>) -> Self {
         Self { tools }
     }
 }
diff --git a/codex-rs/core/src/tools/handlers/tool_suggest.rs b/codex-rs/core/src/tools/handlers/tool_suggest.rs
index 380aebd51b..4b0eae5d31 100644
--- a/codex-rs/core/src/tools/handlers/tool_suggest.rs
+++ b/codex-rs/core/src/tools/handlers/tool_suggest.rs
@@ -25,7 +25,7 @@ use crate::tools::handlers::parse_arguments;
 use crate::tools::registry::ToolHandler;
 use crate::tools::registry::ToolKind;
 
-pub struct ToolSuggestHandler;
+pub(crate) struct ToolSuggestHandler;
 
 impl ToolHandler for ToolSuggestHandler {
     type Output = FunctionToolOutput;
diff --git a/codex-rs/core/src/tools/handlers/unified_exec.rs b/codex-rs/core/src/tools/handlers/unified_exec.rs
index dfe8c42752..be5c33dd63 100644
--- a/codex-rs/core/src/tools/handlers/unified_exec.rs
+++ b/codex-rs/core/src/tools/handlers/unified_exec.rs
@@ -34,7 +34,7 @@ use serde::Deserialize;
 use std::path::PathBuf;
 use std::sync::Arc;
 
-pub struct UnifiedExecHandler;
+pub(crate) struct UnifiedExecHandler;
 
 #[derive(Debug, Deserialize)]
 pub(crate) struct ExecCommandArgs {
diff --git a/codex-rs/core/src/tools/handlers/view_image.rs b/codex-rs/core/src/tools/handlers/view_image.rs
index 5fa005bac8..ace3735e1f 100644
--- a/codex-rs/core/src/tools/handlers/view_image.rs
+++ b/codex-rs/core/src/tools/handlers/view_image.rs
@@ -20,7 +20,7 @@ use crate::tools::registry::ToolKind;
 use codex_protocol::protocol::EventMsg;
 use codex_protocol::protocol::ViewImageToolCallEvent;
 
-pub struct ViewImageHandler;
+pub(crate) struct ViewImageHandler;
 
 const VIEW_IMAGE_UNSUPPORTED_MESSAGE: &str =
     "view_image is not allowed because you do not support image inputs";
@@ -163,7 +163,7 @@ impl ToolHandler for ViewImageHandler {
     }
 }
 
-pub struct ViewImageOutput {
+pub(crate) struct ViewImageOutput {
     image_url: String,
     image_detail: Option<ImageDetail>,
 }
diff --git a/codex-rs/core/src/tools/js_repl/mod.rs b/codex-rs/core/src/tools/js_repl/mod.rs
index 0cfbd2a60c..2a46a4c2f5 100644
--- a/codex-rs/core/src/tools/js_repl/mod.rs
+++ b/codex-rs/core/src/tools/js_repl/mod.rs
@@ -103,14 +103,14 @@ impl JsReplHandle {
 
 #[derive(Clone, Debug, Deserialize)]
 #[serde(deny_unknown_fields)]
-pub struct JsReplArgs {
+pub(crate) struct JsReplArgs {
     pub code: String,
     #[serde(default)]
     pub timeout_ms: Option<u64>,
 }
 
 #[derive(Clone, Debug)]
-pub struct JsExecResult {
+pub(crate) struct JsExecResult {
     pub output: String,
     pub content_items: Vec<FunctionCallOutputContentItem>,
 }
@@ -359,7 +359,7 @@ fn with_model_kernel_failure_message(
     )
 }
 
-pub struct JsReplManager {
+pub(crate) struct JsReplManager {
     node_path: Option<PathBuf>,
     node_module_dirs: Vec<PathBuf>,
     tmp_dir: tempfile::TempDir,
@@ -801,7 +801,7 @@ impl JsReplManager {
         )
     }
 
-    pub async fn reset(&self) -> Result<(), FunctionCallError> {
+    pub(crate) async fn reset(&self) -> Result<(), FunctionCallError> {
         let _permit = self.exec_lock.clone().acquire_owned().await.map_err(|_| {
             FunctionCallError::RespondToModel("js_repl execution unavailable".to_string())
         })?;
@@ -810,7 +810,10 @@ impl JsReplManager {
         Ok(())
     }
 
-    pub async fn interrupt_turn_exec(&self, turn_id: &str) -> Result<bool, FunctionCallError> {
+    pub(crate) async fn interrupt_turn_exec(
+        &self,
+        turn_id: &str,
+    ) -> Result<bool, FunctionCallError> {
         let _permit = self.exec_lock.clone().acquire_owned().await.map_err(|_| {
             FunctionCallError::RespondToModel("js_repl execution unavailable".to_string())
         })?;
@@ -833,7 +836,7 @@ impl JsReplManager {
         }
     }
 
-    pub async fn execute(
+    pub(crate) async fn execute(
         &self,
         session: Arc<Session>,
         turn: Arc<TurnContext>,
diff --git a/codex-rs/core/src/tools/mod.rs b/codex-rs/core/src/tools/mod.rs
index f94f896d20..df5be2389b 100644
--- a/codex-rs/core/src/tools/mod.rs
+++ b/codex-rs/core/src/tools/mod.rs
@@ -1,22 +1,22 @@
-pub mod code_mode;
-pub mod context;
-pub mod events;
+pub(crate) mod code_mode;
+pub(crate) mod context;
+pub(crate) mod events;
 pub(crate) mod handlers;
-pub mod js_repl;
+pub(crate) mod js_repl;
 pub(crate) mod network_approval;
-pub mod orchestrator;
-pub mod parallel;
-pub mod registry;
-pub mod router;
-pub mod runtimes;
-pub mod sandboxing;
-pub mod spec;
+pub(crate) mod orchestrator;
+pub(crate) mod parallel;
+pub(crate) mod registry;
+pub(crate) mod router;
+pub(crate) mod runtimes;
+pub(crate) mod sandboxing;
+pub(crate) mod spec;
 
 use codex_protocol::exec_output::ExecToolCallOutput;
 use codex_utils_output_truncation::TruncationPolicy;
 use codex_utils_output_truncation::formatted_truncate_text;
 use codex_utils_output_truncation::truncate_text;
-pub use router::ToolRouter;
+pub(crate) use router::ToolRouter;
 use serde::Serialize;
 
 // Telemetry preview limits: keep log events smaller than model budgets.
@@ -27,7 +27,7 @@ pub(crate) const TELEMETRY_PREVIEW_TRUNCATION_NOTICE: &str =
 
 /// Format the combined exec output for sending back to the model.
 /// Includes exit code and duration metadata; truncates large bodies safely.
-pub fn format_exec_output_for_model_structured(
+pub(crate) fn format_exec_output_for_model_structured(
     exec_output: &ExecToolCallOutput,
     truncation_policy: TruncationPolicy,
 ) -> String {
@@ -66,7 +66,7 @@ pub fn format_exec_output_for_model_structured(
     serde_json::to_string(&payload).expect("serialize ExecOutput")
 }
 
-pub fn format_exec_output_for_model_freeform(
+pub(crate) fn format_exec_output_for_model_freeform(
     exec_output: &ExecToolCallOutput,
     truncation_policy: TruncationPolicy,
 ) -> String {
@@ -93,7 +93,7 @@ pub fn format_exec_output_for_model_freeform(
     sections.join("\n")
 }
 
-pub fn format_exec_output_str(
+pub(crate) fn format_exec_output_str(
     exec_output: &ExecToolCallOutput,
     truncation_policy: TruncationPolicy,
 ) -> String {
diff --git a/codex-rs/core/src/tools/orchestrator.rs b/codex-rs/core/src/tools/orchestrator.rs
index b1f64cfc74..0eac370709 100644
--- a/codex-rs/core/src/tools/orchestrator.rs
+++ b/codex-rs/core/src/tools/orchestrator.rs
@@ -42,7 +42,7 @@ pub(crate) struct OrchestratorRunResult<Out> {
 }
 
 impl ToolOrchestrator {
-    pub fn new() -> Self {
+    pub(crate) fn new() -> Self {
         Self {
             sandbox: SandboxManager::new(),
         }
@@ -98,7 +98,7 @@ impl ToolOrchestrator {
         }
     }
 
-    pub async fn run<Rq, Out, T>(
+    pub(crate) async fn run<Rq, Out, T>(
         &mut self,
         tool: &mut T,
         req: &Rq,
diff --git a/codex-rs/core/src/tools/registry.rs b/codex-rs/core/src/tools/registry.rs
index 2723d8a9a4..c9f286dc50 100644
--- a/codex-rs/core/src/tools/registry.rs
+++ b/codex-rs/core/src/tools/registry.rs
@@ -30,12 +30,12 @@ use serde_json::Value;
 use tracing::warn;
 
 #[derive(Clone, Copy, Debug, PartialEq, Eq, Hash)]
-pub enum ToolKind {
+pub(crate) enum ToolKind {
     Function,
     Mcp,
 }
 
-pub trait ToolHandler: Send + Sync {
+pub(crate) trait ToolHandler: Send + Sync {
     type Output: ToolOutput + 'static;
 
     fn kind(&self) -> ToolKind;
@@ -187,7 +187,7 @@ pub(crate) fn tool_handler_key(tool_name: &str, namespace: Option<&str>) -> Stri
     }
 }
 
-pub struct ToolRegistry {
+pub(crate) struct ToolRegistry {
     handlers: HashMap<String, Arc<dyn AnyToolHandler>>,
 }
 
@@ -442,24 +442,24 @@ impl ToolRegistry {
     }
 }
 
-pub struct ToolRegistryBuilder {
+pub(crate) struct ToolRegistryBuilder {
     handlers: HashMap<String, Arc<dyn AnyToolHandler>>,
     specs: Vec<ConfiguredToolSpec>,
 }
 
 impl ToolRegistryBuilder {
-    pub fn new() -> Self {
+    pub(crate) fn new() -> Self {
         Self {
             handlers: HashMap::new(),
             specs: Vec::new(),
         }
     }
 
-    pub fn push_spec(&mut self, spec: ToolSpec) {
+    pub(crate) fn push_spec(&mut self, spec: ToolSpec) {
         self.push_spec_with_parallel_support(spec, /*supports_parallel_tool_calls*/ false);
     }
 
-    pub fn push_spec_with_parallel_support(
+    pub(crate) fn push_spec_with_parallel_support(
         &mut self,
         spec: ToolSpec,
         supports_parallel_tool_calls: bool,
@@ -468,7 +468,7 @@ impl ToolRegistryBuilder {
             .push(ConfiguredToolSpec::new(spec, supports_parallel_tool_calls));
     }
 
-    pub fn register_handler<H>(&mut self, name: impl Into<String>, handler: Arc<H>)
+    pub(crate) fn register_handler<H>(&mut self, name: impl Into<String>, handler: Arc<H>)
     where
         H: ToolHandler + 'static,
     {
@@ -501,7 +501,7 @@ impl ToolRegistryBuilder {
     //     }
     // }
 
-    pub fn build(self) -> (Vec<ConfiguredToolSpec>, ToolRegistry) {
+    pub(crate) fn build(self) -> (Vec<ConfiguredToolSpec>, ToolRegistry) {
         let registry = ToolRegistry::new(self.handlers);
         (self.specs, registry)
     }
diff --git a/codex-rs/core/src/tools/router.rs b/codex-rs/core/src/tools/router.rs
index 4fd64715bb..7d2890c4cc 100644
--- a/codex-rs/core/src/tools/router.rs
+++ b/codex-rs/core/src/tools/router.rs
@@ -23,17 +23,17 @@ use std::collections::HashMap;
 use std::sync::Arc;
 use tracing::instrument;
 
-pub use crate::tools::context::ToolCallSource;
+pub(crate) use crate::tools::context::ToolCallSource;
 
 #[derive(Clone, Debug)]
-pub struct ToolCall {
+pub(crate) struct ToolCall {
     pub tool_name: String,
     pub tool_namespace: Option<String>,
     pub call_id: String,
     pub payload: ToolPayload,
 }
 
-pub struct ToolRouter {
+pub(crate) struct ToolRouter {
     registry: ToolRegistry,
     specs: Vec<ConfiguredToolSpec>,
     model_visible_specs: Vec<ToolSpec>,
@@ -47,7 +47,7 @@ pub(crate) struct ToolRouterParams<'a> {
 }
 
 impl ToolRouter {
-    pub fn from_config(config: &ToolsConfig, params: ToolRouterParams<'_>) -> Self {
+    pub(crate) fn from_config(config: &ToolsConfig, params: ToolRouterParams<'_>) -> Self {
         let ToolRouterParams {
             mcp_tools,
             app_tools,
@@ -87,25 +87,25 @@ impl ToolRouter {
         }
     }
 
-    pub fn specs(&self) -> Vec<ToolSpec> {
+    pub(crate) fn specs(&self) -> Vec<ToolSpec> {
         self.specs
             .iter()
             .map(|config| config.spec.clone())
             .collect()
     }
 
-    pub fn model_visible_specs(&self) -> Vec<ToolSpec> {
+    pub(crate) fn model_visible_specs(&self) -> Vec<ToolSpec> {
         self.model_visible_specs.clone()
     }
 
-    pub fn find_spec(&self, tool_name: &str) -> Option<ToolSpec> {
+    pub(crate) fn find_spec(&self, tool_name: &str) -> Option<ToolSpec> {
         self.specs
             .iter()
             .find(|config| config.name() == tool_name)
             .map(|config| config.spec.clone())
     }
 
-    pub fn tool_supports_parallel(&self, tool_name: &str) -> bool {
+    pub(crate) fn tool_supports_parallel(&self, tool_name: &str) -> bool {
         self.specs
             .iter()
             .filter(|config| config.supports_parallel_tool_calls)
@@ -113,7 +113,7 @@ impl ToolRouter {
     }
 
     #[instrument(level = "trace", skip_all, err)]
-    pub async fn build_tool_call(
+    pub(crate) async fn build_tool_call(
         session: &Session,
         item: ResponseItem,
     ) -> Result<Option<ToolCall>, FunctionCallError> {
@@ -211,7 +211,7 @@ impl ToolRouter {
     }
 
     #[instrument(level = "trace", skip_all, err)]
-    pub async fn dispatch_tool_call_with_code_mode_result(
+    pub(crate) async fn dispatch_tool_call_with_code_mode_result(
         &self,
         session: Arc<Session>,
         turn: Arc<TurnContext>,
diff --git a/codex-rs/core/src/tools/runtimes/apply_patch.rs b/codex-rs/core/src/tools/runtimes/apply_patch.rs
index a6dc8885a4..0df27299aa 100644
--- a/codex-rs/core/src/tools/runtimes/apply_patch.rs
+++ b/codex-rs/core/src/tools/runtimes/apply_patch.rs
@@ -34,7 +34,7 @@ use std::collections::HashMap;
 use std::path::PathBuf;
 
 #[derive(Debug)]
-pub struct ApplyPatchRequest {
+pub(crate) struct ApplyPatchRequest {
     pub action: ApplyPatchAction,
     pub file_paths: Vec<AbsolutePathBuf>,
     pub changes: std::collections::HashMap<PathBuf, FileChange>,
@@ -45,10 +45,10 @@ pub struct ApplyPatchRequest {
 }
 
 #[derive(Default)]
-pub struct ApplyPatchRuntime;
+pub(crate) struct ApplyPatchRuntime;
 
 impl ApplyPatchRuntime {
-    pub fn new() -> Self {
+    pub(crate) fn new() -> Self {
         Self
     }
 
diff --git a/codex-rs/core/src/tools/runtimes/mod.rs b/codex-rs/core/src/tools/runtimes/mod.rs
index 53890a89b7..a4b44ff0ec 100644
--- a/codex-rs/core/src/tools/runtimes/mod.rs
+++ b/codex-rs/core/src/tools/runtimes/mod.rs
@@ -12,9 +12,9 @@ use codex_sandboxing::SandboxCommand;
 use std::collections::HashMap;
 use std::path::Path;
 
-pub mod apply_patch;
-pub mod shell;
-pub mod unified_exec;
+pub(crate) mod apply_patch;
+pub(crate) mod shell;
+pub(crate) mod unified_exec;
 
 /// Shared helper to construct sandbox transform inputs from a tokenized command line.
 /// Validates that at least a program is present.
diff --git a/codex-rs/core/src/tools/runtimes/shell.rs b/codex-rs/core/src/tools/runtimes/shell.rs
index ba8713254a..04a8437730 100644
--- a/codex-rs/core/src/tools/runtimes/shell.rs
+++ b/codex-rs/core/src/tools/runtimes/shell.rs
@@ -43,7 +43,7 @@ use std::collections::HashMap;
 use std::path::PathBuf;
 
 #[derive(Clone, Debug)]
-pub struct ShellRequest {
+pub(crate) struct ShellRequest {
     pub command: Vec<String>,
     pub cwd: PathBuf,
     pub timeout_ms: Option<u64>,
@@ -86,7 +86,7 @@ pub(crate) enum ShellRuntimeBackend {
 }
 
 #[derive(Default)]
-pub struct ShellRuntime {
+pub(crate) struct ShellRuntime {
     backend: ShellRuntimeBackend,
 }
 
@@ -99,7 +99,7 @@ pub(crate) struct ApprovalKey {
 }
 
 impl ShellRuntime {
-    pub fn new() -> Self {
+    pub(crate) fn new() -> Self {
         Self {
             backend: ShellRuntimeBackend::Generic,
         }
diff --git a/codex-rs/core/src/tools/runtimes/unified_exec.rs b/codex-rs/core/src/tools/runtimes/unified_exec.rs
index 3858150da5..14236d3560 100644
--- a/codex-rs/core/src/tools/runtimes/unified_exec.rs
+++ b/codex-rs/core/src/tools/runtimes/unified_exec.rs
@@ -48,7 +48,7 @@ use std::path::PathBuf;
 /// Request payload used by the unified-exec runtime after approvals and
 /// sandbox preferences have been resolved for the current turn.
 #[derive(Clone, Debug)]
-pub struct UnifiedExecRequest {
+pub(crate) struct UnifiedExecRequest {
     pub command: Vec<String>,
     pub process_id: i32,
     pub cwd: PathBuf,
@@ -67,7 +67,7 @@ pub struct UnifiedExecRequest {
 /// Cache key for approval decisions that can be reused across equivalent
 /// unified-exec launches.
 #[derive(serde::Serialize, Clone, Debug, Eq, PartialEq, Hash)]
-pub struct UnifiedExecApprovalKey {
+pub(crate) struct UnifiedExecApprovalKey {
     pub command: Vec<String>,
     pub cwd: PathBuf,
     pub tty: bool,
@@ -77,14 +77,17 @@ pub struct UnifiedExecApprovalKey {
 
 /// Runtime adapter that keeps policy and sandbox orchestration on the
 /// unified-exec side while delegating process startup to the manager.
-pub struct UnifiedExecRuntime<'a> {
+pub(crate) struct UnifiedExecRuntime<'a> {
     manager: &'a UnifiedExecProcessManager,
     shell_mode: UnifiedExecShellMode,
 }
 
 impl<'a> UnifiedExecRuntime<'a> {
     /// Creates a runtime bound to the shared unified-exec process manager.
-    pub fn new(manager: &'a UnifiedExecProcessManager, shell_mode: UnifiedExecShellMode) -> Self {
+    pub(crate) fn new(
+        manager: &'a UnifiedExecProcessManager,
+        shell_mode: UnifiedExecShellMode,
+    ) -> Self {
         Self {
             manager,
             shell_mode,
diff --git a/codex-rs/core/src/tools/sandboxing.rs b/codex-rs/core/src/tools/sandboxing.rs
index c2671aabf0..2cbca39e9d 100644
--- a/codex-rs/core/src/tools/sandboxing.rs
+++ b/codex-rs/core/src/tools/sandboxing.rs
@@ -43,7 +43,7 @@ pub(crate) struct ApprovalStore {
 }
 
 impl ApprovalStore {
-    pub fn get<K>(&self, key: &K) -> Option<ReviewDecision>
+    pub(crate) fn get<K>(&self, key: &K) -> Option<ReviewDecision>
     where
         K: Serialize,
     {
@@ -51,7 +51,7 @@ impl ApprovalStore {
         self.map.get(&s).cloned()
     }
 
-    pub fn put<K>(&mut self, key: K, value: ReviewDecision)
+    pub(crate) fn put<K>(&mut self, key: K, value: ReviewDecision)
     where
         K: Serialize,
     {
@@ -148,7 +148,7 @@ pub(crate) enum ExecApprovalRequirement {
 }
 
 impl ExecApprovalRequirement {
-    pub fn proposed_execpolicy_amendment(&self) -> Option<&ExecPolicyAmendment> {
+    pub(crate) fn proposed_execpolicy_amendment(&self) -> Option<&ExecPolicyAmendment> {
         match self {
             Self::NeedsApproval {
                 proposed_execpolicy_amendment: Some(prefix),
@@ -332,7 +332,7 @@ pub(crate) struct SandboxAttempt<'a> {
 }
 
 impl<'a> SandboxAttempt<'a> {
-    pub fn env_for(
+    pub(crate) fn env_for(
         &self,
         command: SandboxCommand,
         options: ExecOptions,
diff --git a/codex-rs/core/src/turn_diff_tracker.rs b/codex-rs/core/src/turn_diff_tracker.rs
index 2353e49e82..3b7fb130a8 100644
--- a/codex-rs/core/src/turn_diff_tracker.rs
+++ b/codex-rs/core/src/turn_diff_tracker.rs
@@ -30,7 +30,7 @@ struct BaselineFileInfo {
 /// 3. To compute the aggregated unified diff, compare each baseline snapshot to the current file on disk entirely in-memory
 ///    using the `similar` crate and emit unified diffs with rewritten external paths.
 #[derive(Default)]
-pub struct TurnDiffTracker {
+pub(crate) struct TurnDiffTracker {
     /// Map external path -> internal filename (uuid).
     external_to_temp_name: HashMap<PathBuf, String>,
     /// Internal filename -> baseline file info.
@@ -43,7 +43,7 @@ pub struct TurnDiffTracker {
 }
 
 impl TurnDiffTracker {
-    pub fn new() -> Self {
+    pub(crate) fn new() -> Self {
         Self::default()
     }
 
@@ -51,7 +51,7 @@ impl TurnDiffTracker {
     /// - Creates an in-memory baseline snapshot for files that already exist on disk when first seen.
     /// - For additions, we intentionally do not create a baseline snapshot so that diffs are proper additions.
     /// - Also updates internal mappings for move/rename events.
-    pub fn on_patch_begin(&mut self, changes: &HashMap<PathBuf, FileChange>) {
+    pub(crate) fn on_patch_begin(&mut self, changes: &HashMap<PathBuf, FileChange>) {
         for (path, change) in changes.iter() {
             // Ensure a stable internal filename exists for this external path.
             if !self.external_to_temp_name.contains_key(path) {
@@ -222,7 +222,7 @@ impl TurnDiffTracker {
     /// Recompute the aggregated unified diff by comparing all of the in-memory snapshots that were
     /// collected before the first time they were touched by apply_patch during this turn with
     /// the current repo state.
-    pub fn get_unified_diff(&mut self) -> Result<Option<String>> {
+    pub(crate) fn get_unified_diff(&mut self) -> Result<Option<String>> {
         let mut aggregated = String::new();
 
         // Compute diffs per tracked internal file in a stable order by external path.
diff --git a/codex-rs/core/src/unified_exec/mod.rs b/codex-rs/core/src/unified_exec/mod.rs
index eb25f4ddc8..8c06775e10 100644
--- a/codex-rs/core/src/unified_exec/mod.rs
+++ b/codex-rs/core/src/unified_exec/mod.rs
@@ -76,7 +76,7 @@ pub(crate) struct UnifiedExecContext {
 }
 
 impl UnifiedExecContext {
-    pub fn new(session: Arc<Session>, turn: Arc<TurnContext>, call_id: String) -> Self {
+    pub(crate) fn new(session: Arc<Session>, turn: Arc<TurnContext>, call_id: String) -> Self {
         Self {
             session,
             turn,
diff --git a/codex-rs/core/src/user_shell_command.rs b/codex-rs/core/src/user_shell_command.rs
index 1678dae3e2..43d6bd9768 100644
--- a/codex-rs/core/src/user_shell_command.rs
+++ b/codex-rs/core/src/user_shell_command.rs
@@ -33,7 +33,7 @@ fn format_user_shell_command_body(
     sections.join("\n")
 }
 
-pub fn format_user_shell_command_record(
+pub(crate) fn format_user_shell_command_record(
     command: &str,
     exec_output: &ExecToolCallOutput,
     turn_context: &TurnContext,
@@ -42,7 +42,7 @@ pub fn format_user_shell_command_record(
     USER_SHELL_COMMAND_FRAGMENT.wrap(body)
 }
 
-pub fn user_shell_command_record_item(
+pub(crate) fn user_shell_command_record_item(
     command: &str,
     exec_output: &ExecToolCallOutput,
     turn_context: &TurnContext,
diff --git a/codex-rs/core/src/util.rs b/codex-rs/core/src/util.rs
index 97fb44ba11..34d3462005 100644
--- a/codex-rs/core/src/util.rs
+++ b/codex-rs/core/src/util.rs
@@ -100,7 +100,7 @@ pub(crate) fn error_or_panic(message: impl std::string::ToString) {
     }
 }
 
-pub fn resolve_path(base: &Path, path: &PathBuf) -> PathBuf {
+pub(crate) fn resolve_path(base: &Path, path: &PathBuf) -> PathBuf {
     if path.is_absolute() {
         path.clone()
     } else {
diff --git a/codex-rs/core/src/web_search.rs b/codex-rs/core/src/web_search.rs
index d3c895c5fa..81f71979d4 100644
--- a/codex-rs/core/src/web_search.rs
+++ b/codex-rs/core/src/web_search.rs
@@ -15,7 +15,7 @@ fn search_action_detail(query: &Option<String>, queries: &Option<Vec<String>>) -
     })
 }
 
-pub fn web_search_action_detail(action: &WebSearchAction) -> String {
+pub(crate) fn web_search_action_detail(action: &WebSearchAction) -> String {
     match action {
         WebSearchAction::Search { query, queries } => search_action_detail(query, queries),
         WebSearchAction::OpenPage { url } => url.clone().unwrap_or_default(),