@vantageos/mcp-doctor 0.3.1 → 0.3.2

package/CHANGELOG.md

@@ -3,6 +3,37 @@
 All notable changes to `@vantageos/mcp-doctor` are documented here.
 This project adheres to [Semantic Versioning](https://semver.org/).
 
+## 0.3.2 — 2026-10-04
+
+### Changed — read this if your CI distinguishes exit codes
+- **Unreadable input is now `could-not-judge` (exit 2), no longer a crash (exit 1).**
+  A tree holding input a detector could not read — malformed JSON in an extension
+  manifest or `evals.json`, a computed or non-literal value where a literal is
+  required — used to abort the run with a stack trace and exit 1, the code this
+  tool uses for *a violation*. It now completes the run, names the unreadable
+  file in the row, and exits 2 (no violation, but part of the tree was not judged).
+  Pipelines that treat any non-zero exit as failure are unaffected. Pipelines that
+  distinguish 1 from 2 must read the new state: a run that used to exit 1 on
+  unreadable input now exits 2. (#46)
+
+### Fixed
+- **A manifest that parses but is wrong is `non-conforming`.** It is a finding
+  (exit 1) rather than an abstention or a crash. (#46)
+- **An unparseable `package.json` is `could-not-judge` for C17, D10 and D7** (and C14, D12), where each had judged an empty manifest and reported the emptiness as a finding (C17, D10 non-conforming) or an absence (D7), so the run exited 1 instead of 2. The parse failure is now recorded once at load time and every detector reading that file honours it.
+- **Tools declared as descriptor objects are now found.** Five detectors (D3, D4, D8, D11, DServer2) and C19 reported "no registered tools" on servers that declare their tools as descriptor objects (`{ name, inputSchema }`). They now find those tools. A tree that serves tools but where none can be located reads `could-not-judge`, not `absent`. On a real vCRM tree, the "no registered tools found" rows went from 1 to 0, and D11 is now a real finding. (#48)
+- **`package.json` is now what npm publishes.** `npm publish` of 0.3.1 printed
+  "npm auto-corrected some errors in your package.json": `bin` was `"./dist/doctor.js"`
+  and is now `"dist/doctor.js"`, and `files` is reformatted, both exactly as
+  `npm pkg fix` writes them. A new test, `tests/publish-manifest-clean.test.ts`,
+  runs `npm publish --dry-run` and fails if that warning returns, and asserts the
+  tarball lists `dist/doctor.js`, `README.md` and `LICENSE`.
+
+### Docs
+- README: the states table and the known limits no longer say unreadable input is
+  handled in band by D9 only.
+
+---
+
 ## 0.3.1 — 2026-10-04
 
 ### Fixed

package/README.md

@@ -63,8 +63,8 @@ exit: 0 clean, 1 a violation, 2 an abstention with no violation
 |---|---|---|
 | `present` | the standard item is satisfied | none |
 | `absent` | the detector found nothing to judge — see the caveat below | none |
-| `non-conforming` | the item is present and wrong | **exit 1** |
-| `could-not-judge` | the detector could not read its input and says so in the row — in 0.3.1, only D9 does this (no `package.json` above the root); see the limits below | **exit 2**, unless something else is non-conforming |
+| `non-conforming` | the item is present and wrong (this includes a manifest that parses but holds a wrong value) | **exit 1** |
+| `could-not-judge` | the detector could not read its input and says so in the row — malformed JSON, a computed or non-literal value, no `package.json` above the root; the run completes and the row names the file | **exit 2**, unless something else is non-conforming |
 
 The exit code keeps three outcomes distinct, which is what makes the tool safe in CI:
 
@@ -73,16 +73,12 @@ The exit code keeps three outcomes distinct, which is what makes the tool safe i
 - **2** — no violation, but at least one detector abstained. **An abstention is never a pass**: it
   means part of the tree was not judged, and the row names which part and why.
 
-**Two known limits in 0.3.1, stated rather than hidden:**
+**One known limit in 0.3.2, stated rather than hidden:**
 
 - **`absent` currently means two things.** It is used both for "this rule does not apply here" and,
   for some detectors, "this is required and missing". The second should move the exit code and
   today does not. Until that is split, read an `absent` row against the rule it names rather than
   treating it as harmless.
-- **Unreadable input is handled in band by D9 only.** In 0.3.1, D9 reports `could-not-judge` when no
-  `package.json` sits above the scanned root, and the run completes. Several other detectors still
-  **throw** on unreadable input — a malformed manifest, a computed value — which aborts the run with
-  exit 1 and a stack trace, indistinguishable from a violation. Converting them is in progress.
 
 By design, a detector whose own internal self-check fails stops the run — that is the instrument
 reporting that it is broken, and silencing it would hide the fault behind a normal-looking table.

package/dist/doctor.d.ts

@@ -13,9 +13,15 @@ interface SourceFile {
 interface Tree {
     root: string;
     files: SourceFile[];
+    /**
+     * `unreadable` is set (with the parse error) when the file exists but is not a
+     * JSON object; `json` is then `{}` and MUST NOT be read as the file's content.
+     * Detectors that read this file go through `guardUnreadablePackageJson`.
+     */
     packageJson: {
         path: string;
         json: Record<string, unknown>;
+        unreadable?: string;
     } | null;
 }