remove temporary ownership re-exports (#16626)

Stacked on #16508.

This removes the temporary `codex-core` / `codex-login` re-export shims
from the ownership split and rewrites callsites to import directly from
`codex-model-provider-info`, `codex-models-manager`, `codex-api`,
`codex-protocol`, `codex-feedback`, and `codex-response-debug-context`.

No behavior change intended; this is the mechanical import cleanup layer
split out from the ownership move.

---------

Co-authored-by: Codex <noreply@openai.com>

codex-rs/login/src/auth/auth_tests.rs

@@ -2,6 +2,7 @@ use super::*;
 use crate::auth::storage::FileAuthStorage;
 use crate::auth::storage::get_auth_file;
 use crate::token_data::IdTokenInfo;
+use codex_app_server_protocol::AuthMode;
 use codex_protocol::account::PlanType as AccountPlanType;
 use codex_protocol::auth::KnownPlan as InternalKnownPlan;
 use codex_protocol::auth::PlanType as InternalPlanType;
@@ -107,7 +108,7 @@ async fn pro_account_with_no_api_key_uses_chatgpt_auth() {
     .unwrap()
     .unwrap();
     assert_eq!(None, auth.api_key());
-    assert_eq!(crate::AuthMode::Chatgpt, auth.auth_mode());
+    assert_eq!(AuthMode::Chatgpt, auth.auth_mode());
     assert_eq!(auth.get_chatgpt_user_id().as_deref(), Some("user-12345"));
 
     let auth_dot_json = auth
@@ -157,7 +158,7 @@ async fn loads_api_key_from_auth_json() {
     )
     .unwrap()
     .unwrap();
-    assert_eq!(auth.auth_mode(), crate::AuthMode::ApiKey);
+    assert_eq!(auth.auth_mode(), AuthMode::ApiKey);
     assert_eq!(auth.api_key(), Some("sk-test-key"));
 
     assert!(auth.get_token_data().is_err());
@@ -283,7 +284,7 @@ async fn external_bearer_only_auth_manager_uses_cached_provider_token() {
 
     assert_eq!(first.as_deref(), Some("provider-token"));
     assert_eq!(second.as_deref(), Some("provider-token"));
-    assert_eq!(manager.auth_mode(), Some(crate::AuthMode::ApiKey));
+    assert_eq!(manager.auth_mode(), Some(AuthMode::ApiKey));
     assert_eq!(manager.get_api_auth_mode(), Some(ApiAuthMode::ApiKey));
 }
 

codex-rs/login/src/auth/external_bearer.rs

@@ -2,6 +2,7 @@ use super::manager::ExternalAuth;
 use super::manager::ExternalAuthRefreshContext;
 use super::manager::ExternalAuthTokens;
 use async_trait::async_trait;
+use codex_app_server_protocol::AuthMode;
 use codex_protocol::config_types::ModelProviderAuthInfo;
 use std::fmt;
 use std::io;
@@ -28,8 +29,8 @@ impl BearerTokenRefresher {
 
 #[async_trait]
 impl ExternalAuth for BearerTokenRefresher {
-    fn auth_mode(&self) -> crate::AuthMode {
-        crate::AuthMode::ApiKey
+    fn auth_mode(&self) -> AuthMode {
+        AuthMode::ApiKey
     }
 
     async fn resolve(&self) -> io::Result<Option<ExternalAuthTokens>> {

codex-rs/login/src/auth/manager.rs

@@ -14,6 +14,7 @@ use std::sync::Mutex;
 use std::sync::RwLock;
 use tokio::sync::Mutex as AsyncMutex;
 
+use codex_app_server_protocol::AuthMode;
 use codex_app_server_protocol::AuthMode as ApiAuthMode;
 use codex_protocol::config_types::ForcedLoginMethod;
 use codex_protocol::config_types::ModelProviderAuthInfo;
@@ -149,7 +150,7 @@ pub struct ExternalAuthRefreshContext {
 /// credentials on demand via `refresh()`.
 pub trait ExternalAuth: Send + Sync {
     /// Indicates which top-level auth mode this external provider supplies.
-    fn auth_mode(&self) -> crate::AuthMode;
+    fn auth_mode(&self) -> AuthMode;
 
     /// Returns cached or immediately available auth, if this provider can resolve it synchronously
     /// from the caller's perspective.
@@ -226,10 +227,10 @@ impl CodexAuth {
         )
     }
 
-    pub fn auth_mode(&self) -> crate::AuthMode {
+    pub fn auth_mode(&self) -> AuthMode {
         match self {
-            Self::ApiKey(_) => crate::AuthMode::ApiKey,
-            Self::Chatgpt(_) | Self::ChatgptAuthTokens(_) => crate::AuthMode::Chatgpt,
+            Self::ApiKey(_) => AuthMode::ApiKey,
+            Self::Chatgpt(_) | Self::ChatgptAuthTokens(_) => AuthMode::Chatgpt,
         }
     }
 
@@ -242,11 +243,11 @@ impl CodexAuth {
     }
 
     pub fn is_api_key_auth(&self) -> bool {
-        self.auth_mode() == crate::AuthMode::ApiKey
+        self.auth_mode() == AuthMode::ApiKey
     }
 
     pub fn is_chatgpt_auth(&self) -> bool {
-        self.auth_mode() == crate::AuthMode::Chatgpt
+        self.auth_mode() == AuthMode::Chatgpt
     }
 
     pub fn is_external_chatgpt_tokens(&self) -> bool {
@@ -503,15 +504,15 @@ pub fn enforce_login_restrictions(config: &AuthConfig) -> std::io::Result<()> {
 
     if let Some(required_method) = config.forced_login_method {
         let method_violation = match (required_method, auth.auth_mode()) {
-            (ForcedLoginMethod::Api, crate::AuthMode::ApiKey) => None,
-            (ForcedLoginMethod::Chatgpt, crate::AuthMode::Chatgpt)
-            | (ForcedLoginMethod::Chatgpt, crate::AuthMode::ChatgptAuthTokens) => None,
-            (ForcedLoginMethod::Api, crate::AuthMode::Chatgpt)
-            | (ForcedLoginMethod::Api, crate::AuthMode::ChatgptAuthTokens) => Some(
+            (ForcedLoginMethod::Api, AuthMode::ApiKey) => None,
+            (ForcedLoginMethod::Chatgpt, AuthMode::Chatgpt)
+            | (ForcedLoginMethod::Chatgpt, AuthMode::ChatgptAuthTokens) => None,
+            (ForcedLoginMethod::Api, AuthMode::Chatgpt)
+            | (ForcedLoginMethod::Api, AuthMode::ChatgptAuthTokens) => Some(
                 "API key login is required, but ChatGPT is currently being used. Logging out."
                     .to_string(),
             ),
-            (ForcedLoginMethod::Chatgpt, crate::AuthMode::ApiKey) => Some(
+            (ForcedLoginMethod::Chatgpt, AuthMode::ApiKey) => Some(
                 "ChatGPT login is required, but an API key is currently being used. Logging out."
                     .to_string(),
             ),
@@ -1429,14 +1430,14 @@ impl AuthManager {
             .and_then(|guard| guard.as_ref().cloned())
     }
 
-    fn external_auth_mode(&self) -> Option<crate::AuthMode> {
+    fn external_auth_mode(&self) -> Option<AuthMode> {
         self.external_auth()
             .as_ref()
             .map(|external_auth| external_auth.auth_mode())
     }
 
     fn has_external_api_key_auth(&self) -> bool {
-        self.external_auth_mode() == Some(crate::AuthMode::ApiKey)
+        self.external_auth_mode() == Some(AuthMode::ApiKey)
     }
 
     async fn resolve_external_api_key_auth(&self) -> Option<CodexAuth> {
@@ -1550,9 +1551,9 @@ impl AuthManager {
         self.auth_cached().as_ref().map(CodexAuth::api_auth_mode)
     }
 
-    pub fn auth_mode(&self) -> Option<crate::AuthMode> {
+    pub fn auth_mode(&self) -> Option<AuthMode> {
         if self.has_external_api_key_auth() {
-            return Some(crate::AuthMode::ApiKey);
+            return Some(AuthMode::ApiKey);
         }
         self.auth_cached().as_ref().map(CodexAuth::auth_mode)
     }
@@ -1602,7 +1603,7 @@ impl AuthManager {
             .refresh(context)
             .await
             .map_err(RefreshTokenError::Transient)?;
-        if external_auth.auth_mode() == crate::AuthMode::ApiKey {
+        if external_auth.auth_mode() == AuthMode::ApiKey {
             return Ok(());
         }
         let Some(chatgpt_metadata) = refreshed.chatgpt_metadata() else {