Codex desktop "Control other devices" authorization fails due to account mismatch during remote control enrollment

What happened

In Codex Desktop, opening Settings -> Control other devices and attempting to authorize remote control fails with the UI message shown in Chinese as:

远程控制授权失败

The local logs show that the enrollment request reaches the backend and receives a challenge/client id, but Codex then rejects the response locally with an account mismatch.

Expected behavior

Remote control authorization should complete when the user is signed in with the same ChatGPT account.

Environment

• Codex Desktop: 26.513.20950 (CFBundleVersion 2816)
• macOS: 26.3 (25D125)
• Architecture: arm64
• Auth mode: ChatGPT login
• Feature area: Control other devices / remote control enrollment

Evidence from logs

The same pattern reproduces across multiple attempts. Sensitive account ids, user ids, OAuth subject ids, challenge ids, and client ids are redacted below.

2026-05-15T09:20:54.408Z info [remote-control-websocket] remote_control_client_enrollment_start_request \
  hasExistingEnrollment=false \
  headerChatGptAccountId=<account-id> \
  localEnrollmentAccountUserId=null \
  localEnrollmentClientId=null \
  responseAccountUserId=null \
  responseChallengeId=null \
  responseClientId=null \
  selectedAccountUserId=<chatgpt-user-id>__<account-id> \
  tokenAccountId=<account-id> \
  tokenAccountUserId=<chatgpt-user-id>__<account-id> \
  tokenAuthUserId=<chatgpt-user-id> \
  tokenSubject=<oauth-subject>

2026-05-15T09:20:55.477Z info [remote-control-websocket] remote_control_client_enrollment_start_response \
  hasExistingEnrollment=false \
  headerChatGptAccountId=<account-id> \
  localEnrollmentAccountUserId=null \
  localEnrollmentClientId=null \
  responseAccountUserId=<chatgpt-user-id> \
  responseChallengeId=<challenge-id> \
  responseClientId=<client-id> \
  selectedAccountUserId=<chatgpt-user-id>__<account-id> \
  tokenAccountId=<account-id> \
  tokenAccountUserId=<chatgpt-user-id>__<account-id> \
  tokenAuthUserId=<chatgpt-user-id> \
  tokenSubject=<oauth-subject>

2026-05-15T09:20:55.477Z warning [remote-control-websocket] remote_control_client_enrollment_start_account_mismatch \
  hasExistingEnrollment=false \
  headerChatGptAccountId=<account-id> \
  responseAccountUserId=<chatgpt-user-id> \
  selectedAccountUserId=<chatgpt-user-id>__<account-id> \
  tokenAccountUserId=<chatgpt-user-id>__<account-id> \
  tokenAuthUserId=<chatgpt-user-id>

2026-05-15T09:20:55.479Z warning [electron-message-handler] [remote-connections/settings] remote_control_authorize_failed \
  errorMessage="Remote control enrollment start does not match current account." \
  errorName=Error \
  errorStack="Error: Remote control enrollment start does not match current account.\n    at Object.postMessage (app://-/assets/vscode-api-DH_DWhkY.js:1:57272)"

Why this looks like a bug

The local token and selected account use an account-scoped user identifier:

<chatgpt-user-id>__<account-id>

But the enrollment start response returns the plain ChatGPT user id:

<chatgpt-user-id>

Those appear to refer to the same user/account context, but the desktop client compares them as different values and throws:

Remote control enrollment start does not match current account.

Impact

This blocks enabling Control other devices even though the enrollment backend responds successfully.

Notes

A sign-out/sign-in refresh may be a possible workaround, but the observed failure is specifically the local account-id comparison after a successful enrollment start response, not a network or macOS permission failure.