Codex bug let a new login reuse the old account's session

Codex was carrying a stale WebSocket session across account switches, according to PR #44489, merged September 9. The Responses WebSocket session and its incremental response state could survive a login change both within a single turn and between turns, meaning a new account could inherit connection state that belonged to whoever was logged in before.

That matters because Codex uses that incremental state to avoid resending full input on every request. If the session doesn't know the account changed, it can carry forward context, including a previous_response_id, that has nothing to do with the current user's conversation. For anyone switching between a personal and work account, or between test and production credentials, that's a session boundary that isn't actually a boundary.

The fix tracks auth ownership on cached sessions and forces a reconnect when ownership changes. That reconnect clears the incremental state and the x-codex-turn-state header, so the next request goes out with full input instead of a stale reference to a prior response. Prewarm requests, which build connections ahead of time to cut latency, now check ownership before building request metadata, so a prewarmed session can't get handed to the wrong account either.

The commit doesn't say how long the bug had been in place or whether any user-facing sessions actually crossed accounts before the fix, just that the reuse was possible under both conditions it names. Worth watching is whether other stateful pieces of Codex's session cache, beyond the WebSocket and turn-state header, get the same ownership check in a follow-up.