fix(cli): send the app-server initialized notification

[mldangelo-oai]

Summary

The skill command client sends the MCP notification name to Codex app-server after initialization. Send the app-server protocol's initialized notification before login or thread creation.

Changes

• Correct the notification name in the existing skill command flow.
• Require initialization before thread creation in the saved-thread subprocess fixture and update the authentication handshake assertions.

Testing

• Verified the notification against the JSON schema generated by pinned Codex 0.162.0-alpha.12.
• The stricter saved-thread regression fails before the change and passes afterward.
• bun test --timeout 30000 --seed 12345 tests-ts/cli-skills.test.ts tests-ts/cli-authentication.test.ts: 201 passed, 0 failed, using an isolated trusted temporary checkout.
• pnpm run types, pnpm run format, and git diff --check: passed.
• Full SDK suite, seed 12345: 3,570 passed, 53 skipped, 0 failed.
• Full SDK suite, randomized seed 1978397544: 3,570 passed, 53 skipped, 0 failed.
• Three independent native reviews and fresh verification passed on the final commit.

Risk and rollout

One production-line change; commands, options, permissions, and output remain compatible. The pinned app-server currently tolerates the old notification, so this corrects the protocol mismatch without claiming a current scan failure. Existing authentication and thread-flow tests cover ordering.

Public disclosure review

• No customer, partner, prospect, or user identities, data, or identifying details are included.
• No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
• I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-05T12:44:25.460747Z	387ab61	PR opened
🔒 Security Review	✅ Completed 2026-10-05T12:45:46.818593Z	387ab61	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[alandelong-oai]

Reviewed the full contribution at 387ab61e49cdb3b17a2b2bf63bf8fc04651c21eb with selected base e4eff6521926241c1ad1df1bb6395b71135e56d3, including changed tests and touched context, using three independent reviews followed by root synthesis.

No supported introduced finding.

Static source review; tests were inspected but not executed. CI, mergeability and integration are separate.