Improve MCP startup compatibility and lazy-load CLI commands

[Shockang]

Summary

Fixes the definite GitNexus-side startup bug behind issue #206 and adds a compatibility layer for Content-Length-based clients / bridges:

1. Lazily import CLI command modules so gitnexus mcp does not eagerly load analyze / tree-sitter dependencies during startup.
2. Add a stdio transport that preserves newline-delimited MCP behavior and also accepts Content-Length framing for interoperability.

Protocol note

Official MCP stdio is newline-delimited JSON:

• https://modelcontextprotocol.io/specification/2025-03-26/basic/transports#stdio

So this PR does not change GitNexus away from the spec path. It keeps newline behavior intact and adds optional Content-Length support only as a compatibility shim for deployed clients / bridges that already use it, including:

• eval/bridge/mcp_bridge.py
• my local Codex setup

Changes

• add CompatibleStdioServerTransport
• switch MCP startup to the compatible transport
• add createLazyAction() helper for deferred command loading
• convert src/cli/index.ts to lazy command imports
• preserve the existing direct CLI tool flags / help surface while lazy-loading
• add regression tests for dual-framing transport behavior
• add regression tests for lazy CLI action loading
• add CLI help regression tests so lazy-loading cannot silently drop existing flags

Validation

• npm run build
• npx vitest run test/unit/lazy-action.test.ts test/unit/compatible-stdio-transport.test.ts test/unit/server.test.ts test/unit/cli-index-help.test.ts
• manual MCP smoke test against dist/cli/index.js mcp
  • initialize over Content-Length framing succeeds
  • resources/list succeeds after initialized
• manual newline-delimited MCP smoke test against dist/cli/index.js mcp
  • initialize succeeds
  • resources/list succeeds after initialized
• direct CLI help smoke test
  • dist/cli/index.js query --help shows --context, --goal, --content

Notes

• The only failing GitHub check on this PR is a Vercel authorization gate unrelated to this CLI / MCP change.

Closes #206.

[vercel]

@Shockang is attempting to deploy a commit to the NexusCore Team on Vercel.

A member of the Team first needs to authorize it.

[Shockang]

Adversarial review follow-up: my initial patch accidentally narrowed some existing direct CLI command flags in src/cli/index.ts. I pushed commit 22092b4 to restore the original CLI surface and added test/unit/cli-index-help.test.ts so lazy-loading cannot silently drop those flags again.

Also note that the red Vercel check is an authorization gate unrelated to this CLI / MCP change; local build, unit tests, newline smoke test, and Content-Length smoke test are all green.

[Shockang]

Maintainer-review follow-up: I found one more transport edge case after the previous update.

If a client sends a malformed Content-Length header like Content-Length:\r\n\r\n{}, the compatibility transport could enter an onerror loop because that frame was never discarded. I pushed commit 1e2ed0c to harden that path by discarding malformed buffered input, resetting framing detection, and adding regression coverage for both:

• no infinite error loop on malformed Content-Length
• successful recovery on the next valid frame

Re-validated with:

• npm run build
• npx vitest run test/unit/compatible-stdio-transport.test.ts test/unit/lazy-action.test.ts test/unit/server.test.ts test/unit/cli-index-help.test.ts
• manual malformed-frame recovery smoke test

[magyargergo]

Review & Hardening Contribution

Ran a multi-agent review (architecture, security, performance, simplicity, patterns) and pushed hardening fixes in commit 8229de1:

Security Fixes

• Buffer cap (10 MB): Prevents OOM from oversized Content-Length values or unbounded newline-delimited input
• Iterative empty-line parsing: Replaced recursive readNewlineMessage with a while loop — the old version would stack-overflow on 15K+ consecutive empty lines
• Stricter framing detection: looksLikeContentLength now requires 14+ bytes before matching, preventing false positives from short ambiguous prefixes like "c" or "cont"
• Closed-state guard on send(): Now rejects with a clear error if called after close(), and properly handles write errors instead of swallowing them

Code Quality Fixes

• Loose == → strict === in processReadBuffer
• Simplified processReadBuffer: Removed stale-buffer detection that could never trigger (both error paths already mutate the buffer via discardBufferedInput or subarray)
• Widened constructor types: ReadStream/WriteStream → ReadableStream/WritableStream so PassThrough in tests compiles cleanly

Type Safety

• Compile-time export name validation in createLazyAction: generics now constrain exportName to keyof TModule, so typos like createLazyAction(() => import('./setup.js'), 'typoCommand') produce a TS error instead of a runtime crash
• Proper type guard (isCallable) instead of lint suppression
• Fixed test tsconfig errors: All tests pass both tsconfig.json and tsconfig.test.json

Verification

• npm run build — clean
• tsc --noEmit -p tsconfig.test.json — clean
• 13/13 unit tests passing (5 new regression tests added)

[magyargergo]

Thank you for your contribution @Shockang !