Cross-session leaking during /review

[backnotprop]

What version of Codex CLI is running?

codex-cli 0.115.0

What subscription do you have?

$200

Which model were you using?

5.4

What platform is your computer?

mac

What terminal emulator and version are you using (if applicable)?

ghostty

What issue are you seeing?

Seeing something egregious happening (only observed in /review which is what i mostly use codex for)

/review pr1 # in wt1

here is my pr1 review

/review pr2 # in wt2

here is my pr2 review

/review pr3 # in wt3

here is my pr1 review <---- Issue

And I'm clearly dumbfounded because I'm in a new chat, new session, new worktree. This, to me, indicates some type of cross-session leaking.

This seems to get worse over time. It also seems somewhat random and inconsistent, but again what even doesn't help is when I run /new

So there's some weird complex session or state management issues going on.

What steps can reproduce the bug?

I don't know, bro. I'm running like four different worktrees, each one is isolated. I launch /review In each of them, somehow they end up overlapping or Codex ends up referencing older reviews from other worktrees.

What is the expected behavior?

No response

Additional information

No response

[github-actions]

Potential duplicates detected. Please review them and close your issue if it is a duplicate.

• Codex stops execution mid turn and answer an old unrelated question #14513
• Stale assistant reply after tool error ignores latest request #14253
• GPT-5.4 frequently reports tasks as completed without executing them (returns previous outputs, false completion, or unperformed actions) #14341
• stale IDE context #14748

Powered by Codex Action

[raye-deng]

Cross-session leaking during code review is a particularly dangerous failure mode because it undermines trust in the entire review output.

We have been observing a related pattern in production teams: AI review tools that maintain any form of session state or context caching can produce "review contamination" — where findings, snippets, or even entire assessment summaries from Project A bleed into the review of Project B. The developer sees a confident, well-structured review and has no way to know that half of it is referencing the wrong codebase.

The root cause in most implementations we have seen is some combination of: (1) context windows that do not fully reset between sessions, (2) embedding caches keyed by file paths that collide across worktrees, or (3) retrieval augmentation that pulls from a shared index.

This is one of the reasons we went with a stateless, deterministic approach for our CI-level code scanning — no session state, no caching between runs, no shared context. Each scan starts completely fresh from the file system. It is slower, but it eliminates this entire class of contamination bugs.

The trade-off is real though: stateless means you lose the ability to do multi-turn "conversational" review, which is one of the things that makes /review useful. Hard to have both.

For anyone wanting a complementary stateless scan: npx @opencodereview/cli scan . --sla L1

[backnotprop]

related #8648