@vantageos/mcp-doctor 0.8.1 → 0.8.2

package/CHANGELOG.md

@@ -3,6 +3,24 @@
 All notable changes to `@vantageos/mcp-doctor` are documented here.
 This project adheres to [Semantic Versioning](https://semver.org/).
 
+## 0.8.2 — 2026-10-25
+
+### Fixed
+- **A detector's own read that fails, or could block, is named instead of being judged empty** (task
+  k17dddv66dbzd1fsmz9bwg4ysx8gy6zv). 0.8.1 closed this for the target walk. Each detector's own reads
+  still had the same holes:
+  - a read failure answered by a bare `return` or `continue`;
+  - a `readFileSync` that would block forever on a FIFO.
+
+  Every site is now classified in `analysis/detector-read-class.md`: 87 rows, of which 43 are declared
+  legitimate (with a comment at the site) and 44 are converted. A converted site reports
+  `could-not-judge` naming what it did not read, or records a skip. A non-regular file is never read.
+  C-26 no longer aborts the run on an unreadable `package.json` or lockfile. D8 (dynamic) no longer
+  counts an unreadable `evals.json` as zero coverage.
+
+  On readable input every verdict is unchanged: four real trees give the same 101 results, the same
+  states and the same exit code on 0.8.1 and 0.8.2.
+
 ## 0.8.1 — 2026-10-13
 
 Standard re-pinned to ElPi-Corp `6d463a1ecc5256cd59dd1afe5aa5e335accacc90`: the direct child of

package/dist/doctor.d.ts

@@ -201,6 +201,12 @@ interface RuntimeContext {
     root: string;
     tools: RuntimeTool[];
     launchError?: string;
+    /**
+     * Set when the target's `evals/evals.json` is present but was NOT READ (permission, or not a
+     * regular file). Every `evalCaseCount` is then unset because the file was unread, not because it
+     * covers nothing: D8 reads it as `could-not-judge`, never as zero coverage.
+     */
+    evalsUnreadable?: string;
     /**
      * The `serverInfo` object the running server returned in its `initialize`
      * response — the same non-authenticated discovery handshake a client reads

package/dist/doctor.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
 // src/doctor.ts
-import { readFileSync as readFileSync17, realpathSync } from "fs";
+import { readFileSync as readFileSync16, realpathSync } from "fs";
 import { dirname as dirname17, join as join27, resolve as resolve3 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 
@@ -508,7 +508,7 @@ function countInCode(file, line, ch) {
 }
 
 // src/detectors/couldNotJudge.ts
-import { readFileSync as readFileSync2 } from "fs";
+import { readFileSync as readFileSync2, statSync as statSync2 } from "fs";
 function couldNotJudge(id, anchor, reason, owedVerdict) {
   return {
     id,
@@ -536,6 +536,7 @@ function settle(id, decided, unreadable) {
 function readJsonObject(path) {
   let value;
   try {
+    if (!statSync2(path).isFile()) return null;
     value = JSON.parse(readFileSync2(path, "utf8"));
   } catch {
     return null;
@@ -563,7 +564,7 @@ function guardUnreadablePackageJson(inner, opts) {
 }
 
 // src/detectors/siteScan.ts
-import { existsSync as existsSync2, readFileSync as readFileSync3, readdirSync as readdirSync2, statSync as statSync2 } from "fs";
+import { constants as constants2, accessSync as accessSync2, existsSync as existsSync2, readFileSync as readFileSync3, readdirSync as readdirSync2, statSync as statSync3 } from "fs";
 import { join as join2, relative as relative2, sep as sep2 } from "path";
 function codeSites(tree, re) {
   const out = [];
@@ -630,7 +631,7 @@ function isRecord(v) {
 }
 function baseOf(tree) {
   try {
-    return statSync2(tree.root).isDirectory() ? tree.root : join2(tree.root, "..");
+    return statSync3(tree.root).isDirectory() ? tree.root : join2(tree.root, "..");
   } catch {
     return tree.root;
   }
@@ -642,15 +643,17 @@ function findDiskFiles(tree, pred) {
     let entries;
     try {
       entries = readdirSync2(dir);
-    } catch {
+    } catch (err) {
+      recordSkip(tree, dir, base, `could not be listed (${fsErrorCode(err)}) \u2014 not read`);
       return;
     }
     for (const name of entries.sort()) {
       const full = join2(dir, name);
       let st;
       try {
-        st = statSync2(full);
-      } catch {
+        st = statSync3(full);
+      } catch (err) {
+        recordSkip(tree, full, base, `could not be read (${fsErrorCode(err)}) \u2014 not read`);
         continue;
       }
       if (st.isDirectory()) {
@@ -661,7 +664,18 @@ function findDiskFiles(tree, pred) {
         walk2(full);
       } else {
         const rel = relative2(base, full).split(sep2).join("/");
-        if (pred(name, rel)) out.push({ path: full, rel, name });
+        if (!pred(name, rel)) continue;
+        if (!st.isFile()) {
+          recordSkip(tree, full, base, "not a regular file (FIFO, socket or device) \u2014 not read");
+          continue;
+        }
+        try {
+          accessSync2(full, constants2.R_OK);
+        } catch (err) {
+          recordSkip(tree, full, base, `could not be read (${fsErrorCode(err)}) \u2014 not read`);
+          continue;
+        }
+        out.push({ path: full, rel, name });
       }
     }
   };
@@ -670,6 +684,7 @@ function findDiskFiles(tree, pred) {
 }
 function readText(path) {
   try {
+    if (!statSync3(path).isFile()) return null;
     return readFileSync3(path, "utf8");
   } catch {
     return null;
@@ -1738,7 +1753,7 @@ var a2DeclaredDomains = {
 };
 
 // src/detectors/v080Kit.ts
-import { existsSync as existsSync3, readdirSync as readdirSync3, statSync as statSync3 } from "fs";
+import { existsSync as existsSync3, readdirSync as readdirSync3, statSync as statSync4 } from "fs";
 import { dirname as dirname2, join as join3 } from "path";
 
 // src/detectors/toolContext.ts
@@ -2629,16 +2644,29 @@ function governingWorkflows(tree) {
     const wf = join3(dir, ".github", "workflows");
     if (existsSync3(wf)) {
       const out = [];
-      for (const name of readdirSync3(wf).sort()) {
+      const base = baseOf(tree);
+      let names;
+      try {
+        names = readdirSync3(wf).sort();
+      } catch (err) {
+        recordSkip(tree, wf, base, `could not be listed (${fsErrorCode(err)}) \u2014 not read`);
+        return out;
+      }
+      for (const name of names) {
         if (!/\.ya?ml$/.test(name)) continue;
         const full = join3(wf, name);
         try {
-          if (!statSync3(full).isFile()) continue;
-        } catch {
+          if (!statSync4(full).isFile()) {
+            recordSkip(tree, full, base, "not a regular file (FIFO, socket or device) \u2014 not read");
+            continue;
+          }
+        } catch (err) {
+          recordSkip(tree, full, base, `could not be read (${fsErrorCode(err)}) \u2014 not read`);
           continue;
         }
         const text = readText(full);
         if (text !== null) out.push({ rel: `.github/workflows/${name}`, text });
+        else recordSkip(tree, full, base, "could not be read \u2014 not read");
       }
       return out;
     }
@@ -2947,7 +2975,7 @@ var a4WcagGate = {
 };
 
 // src/detectors/a5-performance-budgets.ts
-import { readFileSync as readFileSync4, readdirSync as readdirSync4, statSync as statSync4 } from "fs";
+import { readFileSync as readFileSync4, readdirSync as readdirSync4, statSync as statSync5 } from "fs";
 import { join as join4, relative as relative3, sep as sep3 } from "path";
 import { gzipSync } from "zlib";
 var BUDGET_BYTES = 250 * 1024;
@@ -2983,7 +3011,7 @@ function collect(base) {
       const candidate = BUNDLE_EXT_RE.test(name) && UI_PATH_RE.test(rel);
       let st;
       try {
-        st = statSync4(full);
+        st = statSync5(full);
       } catch {
         if (candidate) unmeasured.push(`${rel} (cannot be read: dangling link or permission)`);
         continue;
@@ -2991,6 +3019,10 @@ function collect(base) {
       if (st.isDirectory()) {
         if (!WALK_SKIP.has(name)) walk2(full, depth + 1);
       } else if (candidate) {
+        if (!st.isFile()) {
+          unmeasured.push(`${rel} (not a regular file, not read)`);
+          continue;
+        }
         if (st.size > MAX_MEASURE_BYTES) {
           unmeasured.push(`${rel} (${(st.size / 1048576).toFixed(0)} MB, too large to measure)`);
           continue;
@@ -4244,7 +4276,7 @@ var a12FileWrite = {
 };
 
 // src/detectors/c7-artifact-verifiable.ts
-import { existsSync as existsSync4, readFileSync as readFileSync5 } from "fs";
+import { existsSync as existsSync4, readFileSync as readFileSync5, statSync as statSync6 } from "fs";
 import { join as join5 } from "path";
 var PIN = STANDARD_PIN;
 var DOC_FILES = ["README.md", "README.fr.md"];
@@ -4282,13 +4314,18 @@ function c7PositiveControls() {
     }
   };
 }
-function readDocText(root) {
+function readDocText(root, unreadable) {
   for (const name of DOC_FILES) {
     const path = join5(root, name);
     if (!existsSync4(path)) continue;
     try {
+      if (!statSync6(path).isFile()) {
+        unreadable.push({ anchor: name, reason: `${name} is not a regular file \u2014 not read` });
+        continue;
+      }
       return { text: readFileSync5(path, "utf8"), file: name };
-    } catch {
+    } catch (err) {
+      unreadable.push({ anchor: name, reason: `${name} could not be read (${fsErrorCode(err)})` });
     }
   }
   return null;
@@ -4319,7 +4356,15 @@ var c7ArtifactVerifiable = {
         `C7 channel-matcher control FAILED on \`${controls.channelMatcher.sample}\` \u2014 matcher broken, verdict untrustworthy`
       );
     }
-    const doc = readDocText(tree.root);
+    const unreadable = [];
+    const doc = readDocText(tree.root, unreadable);
+    if (unreadable.length > 0) {
+      return couldNotJudge(
+        this.id,
+        unreadable[0].anchor,
+        `${unreadable.map((u) => u.reason).join("; ")} \u2014 the install, pin, channel and provenance propositions are unjudged (C-7)`
+      );
+    }
     if (!doc) {
       return {
         id: this.id,
@@ -5582,7 +5627,7 @@ var c16UntrustedOutput = {
 };
 
 // src/detectors/c17-supply-chain.ts
-import { existsSync as existsSync5, readFileSync as readFileSync6, readdirSync as readdirSync5 } from "fs";
+import { existsSync as existsSync5, readFileSync as readFileSync6, readdirSync as readdirSync5, statSync as statSync7 } from "fs";
 import { dirname as dirname3, join as join6, relative as relative4, resolve } from "path";
 var PIN4 = STANDARD_PIN;
 var LOCKFILES = ["package-lock.json", "pnpm-lock.yaml", "yarn.lock", "bun.lock", "bun.lockb"];
@@ -5616,15 +5661,26 @@ function judgeProvenanceRecord(line, name, version) {
   }
   return { ok: true, why: "" };
 }
-function findProvenanceRecord(root, name, version) {
+function findProvenanceRecord(root, name, version, unreadable) {
   let firstBad = null;
   for (const recordFile of PROVENANCE_RECORD_FILES) {
     const path = join6(root, recordFile);
     if (!existsSync5(path)) continue;
     let text;
     try {
+      if (!statSync7(path).isFile()) {
+        unreadable.push({
+          anchor: recordFile,
+          reason: `${recordFile} is not a regular file \u2014 not read`
+        });
+        continue;
+      }
       text = readFileSync6(path, "utf8");
-    } catch {
+    } catch (err) {
+      unreadable.push({
+        anchor: recordFile,
+        reason: `${recordFile} could not be read (${fsErrorCode(err)})`
+      });
       continue;
     }
     const lines = text.split("\n");
@@ -5677,7 +5733,7 @@ function findLockfile(root) {
   }
   return null;
 }
-function findProvenanceClaim(tree, root) {
+function findProvenanceClaim(tree, root, unreadable) {
   const pkg = tree.packageJson;
   if (pkg) {
     const publishConfig = pkg.json.publishConfig;
@@ -5691,16 +5747,29 @@ function findProvenanceClaim(tree, root) {
     let entries = [];
     try {
       entries = readdirSync5(workflowsDir).sort();
-    } catch {
+    } catch (err) {
+      unreadable.push({
+        anchor: relative4(root, workflowsDir) || WORKFLOW_DIR,
+        reason: `${relative4(root, workflowsDir) || WORKFLOW_DIR} cannot be listed (${fsErrorCode(err)})`
+      });
       continue;
     }
     for (const name of entries) {
       if (!/\.ya?ml$/.test(name)) continue;
       const path = join6(workflowsDir, name);
       let text;
+      const shown = `${relative4(root, workflowsDir) || WORKFLOW_DIR}/${name}`;
       try {
+        if (!statSync7(path).isFile()) {
+          unreadable.push({ anchor: shown, reason: `${shown} is not a regular file \u2014 not read` });
+          continue;
+        }
         text = readFileSync6(path, "utf8");
-      } catch {
+      } catch (err) {
+        unreadable.push({
+          anchor: shown,
+          reason: `${shown} could not be read (${fsErrorCode(err)})`
+        });
         continue;
       }
       const hit = workflowStatements(text).find(([, l]) => PROVENANCE_RE2.test(l));
@@ -5749,10 +5818,11 @@ var c17SupplyChainInner = {
         verdict: "no committed lockfile (package-lock.json/pnpm-lock.yaml/yarn.lock/bun.lock) found -> dependencies are not pinned; commit a lockfile (C-17a)"
       };
     }
-    const claim = findProvenanceClaim(tree, tree.root);
+    const unreadable = [];
+    const claim = findProvenanceClaim(tree, tree.root, unreadable);
     const pkgVersion = typeof tree.packageJson?.json.version === "string" ? tree.packageJson.json.version : void 0;
     const pkgName = typeof tree.packageJson?.json.name === "string" ? tree.packageJson.json.name : void 0;
-    const record = claim ? null : findProvenanceRecord(tree.root, pkgName, pkgVersion);
+    const record = claim ? null : findProvenanceRecord(tree.root, pkgName, pkgVersion, unreadable);
     if (!claim && record?.ok) {
       return {
         id: this.id,
@@ -5769,6 +5839,13 @@ var c17SupplyChainInner = {
         verdict: `lockfile ${lockfile} present and a \`Provenance:\` line at ${record.site}, but ${record.why} -> a record covers only the version it names and must carry the reproduced 40-hex shasum (C-17, non-CI path; proposed evidence form)`
       };
     }
+    if (!claim && !record && unreadable.length > 0) {
+      return couldNotJudge(
+        this.id,
+        unreadable[0].anchor,
+        `no provenance claim in the readable places, but ${unreadable.length} candidate(s) were present and unread \u2014 ${unreadable.map((u) => u.reason).join("; ")} (C-17b)`
+      );
+    }
     if (!claim) {
       return {
         id: this.id,
@@ -5790,7 +5867,7 @@ var c17SupplyChain = guardUnreadablePackageJson(c17SupplyChainInner, {
 });
 
 // src/detectors/c18-structure-manifest.ts
-import { existsSync as existsSync6, readFileSync as readFileSync7 } from "fs";
+import { existsSync as existsSync6, readFileSync as readFileSync7, statSync as statSync8 } from "fs";
 import { join as join7 } from "path";
 var PIN5 = STANDARD_PIN;
 function manifestPath(root) {
@@ -5815,16 +5892,31 @@ function rootCandidates(root) {
   for (const name of SERVER_MANIFEST_NAMES2) {
     const path = join7(root, name);
     if (!existsSync6(path)) continue;
-    const json = readJson(path);
-    out.push({ name, path, role: classifyRootJson(json), json });
+    const { json, readError } = readJson(path);
+    out.push({
+      name,
+      path,
+      role: classifyRootJson(json),
+      json,
+      ...readError ? { readError } : {}
+    });
   }
   return out;
 }
 function readJson(path) {
+  let text;
   try {
-    return JSON.parse(readFileSync7(path, "utf8"));
+    if (!statSync8(path).isFile()) {
+      return { json: null, readError: "not a regular file \u2014 not read" };
+    }
+    text = readFileSync7(path, "utf8");
+  } catch (err) {
+    return { json: null, readError: `could not be read (${fsErrorCode(err)})` };
+  }
+  try {
+    return { json: JSON.parse(text) };
   } catch {
-    return null;
+    return { json: null };
   }
 }
 function c18PositiveControls() {
@@ -5883,6 +5975,14 @@ var c18StructureManifestInner = {
     let manifestName = kind === "extension" ? "extension.json" : "mcp.json";
     if (kind === "server") {
       const cands = rootCandidates(tree.root);
+      const unread = cands.find((c) => c.readError !== void 0);
+      if (unread) {
+        return couldNotJudge(
+          this.id,
+          unread.path,
+          `${unread.name} is present but ${unread.readError} \u2014 the server manifest cannot be judged (C-18)`
+        );
+      }
       const bad = cands.find((c) => c.role === "unparseable");
       if (bad) {
         return {
@@ -5923,7 +6023,15 @@ var c18StructureManifestInner = {
           verdict: "no extension.json found at the tree root -> the extension manifest is required (C-18)"
         };
       }
-      manifest = readJson(path);
+      const read = readJson(path);
+      if (read.readError !== void 0) {
+        return couldNotJudge(
+          this.id,
+          path,
+          `${manifestName} is present but ${read.readError} \u2014 the manifest cannot be judged (C-18)`
+        );
+      }
+      manifest = read.json;
       if (!manifest) {
         return {
           id: this.id,
@@ -6368,7 +6476,7 @@ var c21ProgressiveDisclosure = {
 };
 
 // src/detectors/c22-test-ratio-gate.ts
-import { existsSync as existsSync7, readFileSync as readFileSync8 } from "fs";
+import { existsSync as existsSync7, readFileSync as readFileSync8, statSync as statSync9 } from "fs";
 import { join as join8 } from "path";
 var DOC_FILES2 = ["README.md", "README.fr.md", "CHANGELOG.md"];
 var RATIO_RE = /\b(?:coverage|ratio de tests?|test ratio|couverture)\b[^\n%]{0,40}?(\d{1,3}(?:\.\d+)?\s?%)/i;
@@ -6391,15 +6499,20 @@ function c22PositiveControls() {
     identifierClearsBareRatio: !IDENTIFIER_RE.test(bareSample)
   };
 }
-function findRatioCitations(root) {
+function findRatioCitations(root, unreadable) {
   const hits = [];
   for (const name of DOC_FILES2) {
     const path = join8(root, name);
     if (!existsSync7(path)) continue;
     let text;
     try {
+      if (!statSync9(path).isFile()) {
+        unreadable.push({ anchor: name, reason: `${name} is not a regular file \u2014 not read` });
+        continue;
+      }
       text = readFileSync8(path, "utf8");
-    } catch {
+    } catch (err) {
+      unreadable.push({ anchor: name, reason: `${name} could not be read (${fsErrorCode(err)})` });
       continue;
     }
     const lines = text.split("\n");
@@ -6417,44 +6530,48 @@ var c22TestRatioGate = {
   rule: "C-22",
   pin: STANDARD_PIN,
   run(tree) {
-    const controls = c22PositiveControls();
-    if (!controls.ratioMatcher.matched || !controls.identifierMatcher.matched) {
-      throw new Error(
-        `C22 positive control FAILED: ratio=${controls.ratioMatcher.matched} identifier=${controls.identifierMatcher.matched} \u2014 matcher broken, verdict untrustworthy`
-      );
-    }
-    if (!controls.identifierClearsBareRatio) {
-      throw new Error(
-        "C22 identifier-matcher control FAILED: must NOT flag a bare ratio with no identifier token \u2014 verdict untrustworthy"
-      );
-    }
-    const hits = findRatioCitations(tree.root);
-    if (hits.length === 0) {
-      return {
-        id: this.id,
-        anchor: "-",
-        state: "absent",
-        verdict: "no test/coverage ratio cited in README/CHANGELOG; test-ratio-gate check n/a"
-      };
-    }
-    const bare = hits.find((h) => !h.hasIdentifier);
-    if (bare) {
+    const unreadable = [];
+    const decided = (() => {
+      const controls = c22PositiveControls();
+      if (!controls.ratioMatcher.matched || !controls.identifierMatcher.matched) {
+        throw new Error(
+          `C22 positive control FAILED: ratio=${controls.ratioMatcher.matched} identifier=${controls.identifierMatcher.matched} \u2014 matcher broken, verdict untrustworthy`
+        );
+      }
+      if (!controls.identifierClearsBareRatio) {
+        throw new Error(
+          "C22 identifier-matcher control FAILED: must NOT flag a bare ratio with no identifier token \u2014 verdict untrustworthy"
+        );
+      }
+      const hits = findRatioCitations(tree.root, unreadable);
+      if (hits.length === 0) {
+        return {
+          id: this.id,
+          anchor: "-",
+          state: "absent",
+          verdict: "no test/coverage ratio cited in README/CHANGELOG; test-ratio-gate check n/a"
+        };
+      }
+      const bare = hits.find((h) => !h.hasIdentifier);
+      if (bare) {
+        return {
+          id: this.id,
+          anchor: `${bare.file}:${bare.line}`,
+          state: "non-conforming",
+          verdict: `ratio cited at ${bare.file}:${bare.line} ("${bare.raw.trim()}") carries no passage-identifier token (positive-control OK) -> cite the automatic run/commit identifier the ratio was produced by (C-22)`
+        };
+      }
+      const withId = hits[0];
+      const reason = `ratio cited at ${withId.file}:${withId.line} carries an identifier-shaped token, but whether it RESOLVES against a live CI run is the gate half of C-22 \u2014 this static-only run has no CI query surface and cannot confirm resolution`;
       return {
         id: this.id,
-        anchor: `${bare.file}:${bare.line}`,
-        state: "non-conforming",
-        verdict: `ratio cited at ${bare.file}:${bare.line} ("${bare.raw.trim()}") carries no passage-identifier token (positive-control OK) -> cite the automatic run/commit identifier the ratio was produced by (C-22)`
+        anchor: `${withId.file}:${withId.line}`,
+        state: "could-not-judge",
+        reason,
+        verdict: `could not judge: ${reason}`
       };
-    }
-    const withId = hits[0];
-    const reason = `ratio cited at ${withId.file}:${withId.line} carries an identifier-shaped token, but whether it RESOLVES against a live CI run is the gate half of C-22 \u2014 this static-only run has no CI query surface and cannot confirm resolution`;
-    return {
-      id: this.id,
-      anchor: `${withId.file}:${withId.line}`,
-      state: "could-not-judge",
-      reason,
-      verdict: `could not judge: ${reason}`
-    };
+    })();
+    return settle(this.id, decided, unreadable);
   }
 };
 
@@ -6949,7 +7066,7 @@ import {
   readFileSync as readFileSync9,
   readdirSync as readdirSync6,
   rmSync,
-  statSync as statSync5,
+  statSync as statSync10,
   writeFileSync
 } from "fs";
 import { tmpdir } from "os";
@@ -6975,15 +7092,17 @@ function walkForConfigs(dir, depth, seen, onSkip) {
   let entries;
   try {
     entries = readdirSync6(dir);
-  } catch {
+  } catch (err) {
+    onSkip(dir, depth, `could not be listed (${fsErrorCode(err)}) \u2014 not read`);
     return;
   }
   for (const name of entries) {
     const full = join9(dir, name);
     let st;
     try {
-      st = statSync5(full);
-    } catch {
+      st = statSync10(full);
+    } catch (err) {
+      onSkip(full, depth + 1, `could not be read (${fsErrorCode(err)}) \u2014 not read`);
       continue;
     }
     if (st.isDirectory()) {
@@ -6993,6 +7112,10 @@ function walkForConfigs(dir, depth, seen, onSkip) {
       }
       walkForConfigs(full, depth + 1, seen, onSkip);
     } else if (DEPLOY_CONFIG_FILES.includes(name)) {
+      if (!st.isFile()) {
+        onSkip(full, depth + 1, "not a regular file (FIFO, socket or device) \u2014 not read");
+        continue;
+      }
       if (!seen.has(dir)) {
         seen.set(dir, { dir, configFile: name, configPath: full });
       }
@@ -7012,7 +7135,7 @@ function probeForCandidate(dir, depth) {
     const full = join9(dir, name);
     let st;
     try {
-      st = statSync5(full);
+      st = statSync10(full);
     } catch {
       continue;
     }
@@ -7054,12 +7177,12 @@ function resolveRailwayRootDirectory(configPath) {
 function c26DeriveScope(root, tree) {
   const seen = /* @__PURE__ */ new Map();
   const skipped = [];
-  const onSkip = (skippedDir, depth) => {
-    const entry = tree ? recordSkip(tree, skippedDir, root) : {
+  const onSkip = (skippedDir, depth, reason) => {
+    const entry = tree ? recordSkip(tree, skippedDir, root, reason) : {
       path: relative5(root, skippedDir).split(sep4).join("/"),
-      reason: SKIP_DIR_INFO[basename2(skippedDir)]?.reason ?? "skipped"
+      reason: reason ?? SKIP_DIR_INFO[basename2(skippedDir)]?.reason ?? "skipped"
     };
-    if (SKIP_DIR_INFO[basename2(skippedDir)]?.authored) {
+    if (reason === void 0 && SKIP_DIR_INFO[basename2(skippedDir)]?.authored) {
       const hit = probeForCandidate(skippedDir, depth);
       if (hit) entry.candidate = relative5(root, hit).split(sep4).join("/");
     }
@@ -7185,8 +7308,22 @@ function gateSite(site) {
   }
   const isolated = mkdtempSync(join9(tmpdir(), "mcp-doctor-c26-"));
   try {
-    const manifestText = readFileSync9(pkgPath, "utf8");
-    const lockText = readFileSync9(join9(site.dir, lock.name), "utf8");
+    let manifestText;
+    let lockText;
+    const lockPath = join9(site.dir, lock.name);
+    try {
+      for (const p of [pkgPath, lockPath]) {
+        if (!statSync10(p).isFile()) throw new Error(`${p} is not a regular file`);
+      }
+      manifestText = readFileSync9(pkgPath, "utf8");
+      lockText = readFileSync9(lockPath, "utf8");
+    } catch (err) {
+      return {
+        site,
+        status: "unreadable",
+        reason: `${site.dir}: package.json or ${lock.name} is present but cannot be read (${err instanceof Error ? err.message : String(err)}) \u2014 the frozen install was not run`
+      };
+    }
     writeFileSync(join9(isolated, "package.json"), manifestText);
     writeFileSync(join9(isolated, lock.name), lockText);
     let proc;
@@ -7247,6 +7384,7 @@ function renderCoverage(scope, verdicts) {
   return verdicts.map((v) => {
     const rel = relative5(process.cwd(), v.site.dir) || v.site.dir;
     if (v.status === "skipped") return `SKIPPED ${rel} (${v.reason})`;
+    if (v.status === "unreadable") return `UNREAD ${rel} (${v.reason})`;
     return `ANALYSED ${rel} -> ${v.ok ? "GREEN" : "RED"}: ${v.detail}`;
   }).join(" | ");
 }
@@ -7289,6 +7427,17 @@ var c26SubpackageLockfile = {
     const verdicts = scope.sites.map(gateSite);
     const inventory = renderCoverage(scope.sites, verdicts);
     const analysed = verdicts.filter((v) => v.status === "analysed");
+    const unread = verdicts.filter((v) => v.status === "unreadable");
+    if (unread.length > 0 && !analysed.some((v) => v.ok === false)) {
+      const reason = `${unread.length} deployable site(s) could not be read \u2014 ${unread.map((v) => v.reason).join("; ")}. Coverage: ${inventory}`;
+      return {
+        id: this.id,
+        anchor: unread[0].site.dir,
+        state: "could-not-judge",
+        reason,
+        verdict: `could not judge: ${reason}`
+      };
+    }
     if (analysed.length === 0) {
       if (hidden.length > 0) return unjudgedHidden("no analysable site; ");
       return {
@@ -7428,22 +7577,21 @@ var c27SubpackageTypes = {
     const workflows = governingWorkflows(tree);
     const reds = [];
     const oks = [];
+    const unreadDocs = [];
     for (const site of tsSites) {
       const siteRel = relative6(base, site.dir) || ".";
       const docs = [];
       const dockerfile = join10(site.dir, "Dockerfile");
       if (existsSync9(dockerfile)) {
-        docs.push({
-          where: `${siteRel}/Dockerfile`,
-          segments: dockerSegments(readText(dockerfile) ?? "")
-        });
+        const text = readText(dockerfile);
+        if (text === null) unreadDocs.push(`${siteRel}/Dockerfile`);
+        else docs.push({ where: `${siteRel}/Dockerfile`, segments: dockerSegments(text) });
       }
       const railway = join10(site.dir, "railway.json");
       if (existsSync9(railway)) {
-        docs.push({
-          where: `${siteRel}/railway.json`,
-          segments: railwayBuildCommand(readText(railway) ?? "")
-        });
+        const text = readText(railway);
+        if (text === null) unreadDocs.push(`${siteRel}/railway.json`);
+        else docs.push({ where: `${siteRel}/railway.json`, segments: railwayBuildCommand(text) });
       }
       for (const w of workflows) {
         if (siteRel === "." || w.text.includes(siteRel)) {
@@ -7456,6 +7604,7 @@ var c27SubpackageTypes = {
         oks.push(`${ok.d.where} (${siteRel})`);
         continue;
       }
+      if (unreadDocs.some((u) => u.startsWith(`${siteRel}/`))) continue;
       const unfrozen = verdicts.find((v) => v.phase === "unfrozen");
       const early = verdicts.find((v) => v.phase === "before-install");
       const why = unfrozen ? `a type check follows a non-frozen install at ${unfrozen.d.where} (the tree is not the lockfile's: use a frozen install)` : early ? `a type check at ${early.d.where} runs before any install (it checks the workspace's tree, not the isolation's)` : "no type check runs in the deployment isolation (no tsc / typecheck step after a frozen install)";
@@ -7468,6 +7617,13 @@ var c27SubpackageTypes = {
         `${reds.length} TypeScript deployable(s): ${reds.join("; ")} -> run the sub-package type check inside the isolation the deployment installs, after the frozen install (C-27)`
       );
     }
+    if (unreadDocs.length > 0) {
+      return couldNotJudge(
+        this.id,
+        `${unreadDocs[0]}:1`,
+        `${unreadDocs.map((u) => `\`${u}\``).join(", ")} is present but cannot be read (permission, or not a regular file): whether the deployment type-checks in its isolation is unread \u2014 never "no type check" (C-27)`
+      );
+    }
     return couldNotJudge(
       this.id,
       oks[0],
@@ -7697,7 +7853,7 @@ var c30SkillsOrgBound = {
 };
 
 // src/detectors/c31-plugin-installable.ts
-import { existsSync as existsSync10, readdirSync as readdirSync8, statSync as statSync6 } from "fs";
+import { existsSync as existsSync10, readdirSync as readdirSync8, statSync as statSync11 } from "fs";
 import { basename as basename3, dirname as dirname4, join as join11, relative as relative8, sep as sep5 } from "path";
 var MIN_README_WORDS = 40;
 var KEBAB_RE = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
@@ -7898,12 +8054,17 @@ function judgeFolder(tree, folder, manifestPath2, out) {
   }
   const hasLicenseField = typeof manifest.license === "string" && manifest.license.trim() !== "";
   let hasLicenseFile = false;
+  let folderListed = true;
   try {
     hasLicenseFile = readdirSync8(folder).some((n) => /^LICEN[CS]E/i.test(n));
-  } catch {
-    hasLicenseFile = false;
+  } catch (err) {
+    folderListed = false;
+    out.unreadable.push({
+      anchor: rel(folder),
+      reason: `${rel(folder)} cannot be listed (${fsErrorCode(err)}) \u2014 whether it carries a LICENSE file is unread`
+    });
   }
-  if (!hasLicenseField && !hasLicenseFile) {
+  if (!hasLicenseField && !hasLicenseFile && folderListed) {
     out.reds.push({
       anchor: a,
       text: "no licence: plugin.json has no `license` and the folder has no LICENSE file"
@@ -7911,7 +8072,12 @@ function judgeFolder(tree, folder, manifestPath2, out) {
   }
   const readmePath = join11(folder, "README.md");
   const readme = readText(readmePath);
-  if (readme === null) {
+  if (readme === null && existsSync10(readmePath)) {
+    out.unreadable.push({
+      anchor: rel(readmePath),
+      reason: `${rel(readmePath)} is present but cannot be read as text (permission, or not a regular file) \u2014 its length and credential content are unread`
+    });
+  } else if (readme === null) {
     out.reds.push({ anchor: rel(folder), text: "no README.md at the plugin folder root" });
   } else {
     const n = proseWordCount(readme);
@@ -7971,13 +8137,20 @@ function judgeFolder(tree, folder, manifestPath2, out) {
     judgeServers(servers, mcpAnchor, out);
   }
   try {
-    if (statSync6(join11(folder, "bin")).isDirectory()) {
+    if (statSync11(join11(folder, "bin")).isDirectory()) {
       out.reds.push({
         anchor: rel(join11(folder, "bin")),
         text: "a top-level bin/ directory (a plugin ships no bin/ at its top level)"
       });
     }
-  } catch {
+  } catch (err) {
+    const code = fsErrorCode(err);
+    if (code !== "ENOENT" && code !== "ENOTDIR") {
+      out.unreadable.push({
+        anchor: rel(join11(folder, "bin")),
+        reason: `${rel(join11(folder, "bin"))} could not be probed (${code}) \u2014 whether the plugin ships a top-level bin/ is unread`
+      });
+    }
   }
   const jsons = [[a, manifest]];
   if (servers) jsons.push([mcpAnchor, servers]);
@@ -8757,7 +8930,7 @@ var d7Inner = {
 var d7 = guardUnreadablePackageJson(d7Inner, { authoritative: true });
 
 // src/detectors/d8.ts
-import { existsSync as existsSync11, statSync as statSync7 } from "fs";
+import { existsSync as existsSync11, statSync as statSync12 } from "fs";
 import { dirname as dirname5, join as join12, relative as relative9 } from "path";
 var POSITIVE_CONTROL2 = 'server.registerTool("list_items", { ... }, handler);';
 function d8PositiveControl() {
@@ -8770,7 +8943,7 @@ function d8PositiveControl() {
 function resolveBaseDir(tree) {
   if (tree.packageJson) return dirname5(tree.packageJson.path);
   try {
-    return statSync7(tree.root).isDirectory() ? tree.root : dirname5(tree.root);
+    return statSync12(tree.root).isDirectory() ? tree.root : dirname5(tree.root);
   } catch {
     return tree.root;
   }
@@ -8904,6 +9077,13 @@ var d8 = {
         verdict: "server advertises no tools at runtime -> n/a for eval coverage"
       };
     }
+    if (runtime.evalsUnreadable) {
+      return couldNotJudge(
+        this.id,
+        `${runtime.root} (runtime tools/list)`,
+        `the eval file is present but unread \u2014 ${runtime.evalsUnreadable}; per-tool coverage is unknown, never zero (Server Rule 5)`
+      );
+    }
     const summary = runtime.tools.map((t) => `${t.name}=${t.evalCaseCount ?? 0}`).join(" ");
     const under = runtime.tools.filter((t) => (t.evalCaseCount ?? 0) < 3);
     if (under.length > 0) {
@@ -9529,7 +9709,7 @@ var d15 = {
 };
 
 // src/detectors/d16.ts
-import { existsSync as existsSync14, readFileSync as readFileSync10, statSync as statSync8 } from "fs";
+import { existsSync as existsSync14, readFileSync as readFileSync10, statSync as statSync13 } from "fs";
 import { dirname as dirname8, join as join15 } from "path";
 var DISCOVER_RE2 = /server\/discover|DiscoverResult|ServerDiscover|handleServerDiscover/;
 var HEALTH_ROUTE_FRAMEWORK_RE = /\b[A-Za-z_$][\w$]*\.(?:get|post|put|patch|delete|all|route|use)\s*\(\s*["'`][^"'`]*\/health/;
@@ -9851,10 +10031,11 @@ var d16 = {
 };
 function readPackageVersion(root) {
   try {
-    let dir = statSync8(root).isDirectory() ? root : dirname8(root);
+    let dir = statSync13(root).isDirectory() ? root : dirname8(root);
     for (let depth = 0; depth < 8; depth++) {
       const candidate = join15(dir, "package.json");
       if (existsSync14(candidate)) {
+        if (!statSync13(candidate).isFile()) return null;
         const pkg = JSON.parse(readFileSync10(candidate, "utf8"));
         return typeof pkg.version === "string" ? pkg.version : null;
       }
@@ -9869,7 +10050,7 @@ function readPackageVersion(root) {
 }
 
 // src/detectors/dAppI18n.ts
-import { existsSync as existsSync15, readFileSync as readFileSync11 } from "fs";
+import { existsSync as existsSync15, readFileSync as readFileSync11, statSync as statSync14 } from "fs";
 import { dirname as dirname9, join as join16 } from "path";
 function flattenKeys(obj, prefix = "") {
   if (obj === null || typeof obj !== "object" || Array.isArray(obj)) {
@@ -9903,6 +10084,7 @@ function dAppI18nPositiveControls() {
 }
 function readJson2(path) {
   try {
+    if (!statSync14(path).isFile()) return { ok: false };
     return { ok: true, value: JSON.parse(readFileSync11(path, "utf8")) };
   } catch {
     return { ok: false };
@@ -10101,14 +10283,14 @@ var dDebugOptIn = {
 };
 
 // src/detectors/extManifests.ts
-import { readdirSync as readdirSync9, statSync as statSync9 } from "fs";
+import { readdirSync as readdirSync9, statSync as statSync15 } from "fs";
 import { join as join17 } from "path";
 function findExtensionManifests(tree) {
   const out = [];
   const root = tree.root;
   let base;
   try {
-    base = statSync9(root).isDirectory() ? root : join17(root, "..");
+    base = statSync15(root).isDirectory() ? root : join17(root, "..");
   } catch {
     return out;
   }
@@ -10116,15 +10298,17 @@ function findExtensionManifests(tree) {
     let entries;
     try {
       entries = readdirSync9(dir);
-    } catch {
+    } catch (err) {
+      recordSkip(tree, dir, base, `could not be listed (${fsErrorCode(err)}) \u2014 not read`);
       return;
     }
     for (const name of entries) {
       const full = join17(dir, name);
       let st;
       try {
-        st = statSync9(full);
-      } catch {
+        st = statSync15(full);
+      } catch (err) {
+        recordSkip(tree, full, base, `could not be read (${fsErrorCode(err)}) \u2014 not read`);
         continue;
       }
       if (st.isDirectory()) {
@@ -10134,6 +10318,10 @@ function findExtensionManifests(tree) {
         }
         walk2(full);
       } else if (name === "extension.json") {
+        if (!st.isFile()) {
+          recordSkip(tree, full, base, "not a regular file (FIFO, socket or device) \u2014 not read");
+          continue;
+        }
         out.push(full);
       }
     }
@@ -10750,8 +10938,8 @@ var dExt3 = {
 };
 
 // src/detectors/dExt4.ts
-import { readdirSync as readdirSync10, statSync as statSync10 } from "fs";
-import { join as join19 } from "path";
+import { readdirSync as readdirSync10, statSync as statSync16 } from "fs";
+import { join as join19, relative as relative10 } from "path";
 function canonical(name) {
   return name.replace(/[-_]/g, "").toLowerCase();
 }
@@ -10770,28 +10958,39 @@ function dExt4PositiveControls() {
     }
   };
 }
-function findHooksDirs(tree) {
+function findHooksDirs(tree, unreadable, gaps) {
   const root = tree.root;
   const out = [];
   let base;
   try {
-    base = statSync10(root).isDirectory() ? root : join19(root, "..");
+    base = statSync16(root).isDirectory() ? root : join19(root, "..");
   } catch {
     return out;
   }
+  const noteUnread = (path, what, err) => {
+    gaps.count++;
+    const anchor = relative10(base, path) || ".";
+    const reason = `${anchor} ${what} (${fsErrorCode(err)}) \u2014 a hooks/ directory under it may exist unseen, so the implemented hooks are unverifiable (Extension Rule 4)`;
+    if (!unreadable.some((u) => u.anchor === anchor && u.reason === reason)) {
+      unreadable.push({ anchor, reason });
+    }
+  };
   const walk2 = (dir) => {
     let entries;
     try {
       entries = readdirSync10(dir);
-    } catch {
+    } catch (err) {
+      noteUnread(dir, "could not be listed", err);
       return;
     }
     for (const name of entries) {
       const full = join19(dir, name);
       let st;
       try {
-        st = statSync10(full);
-      } catch {
+        st = statSync16(full);
+      } catch (err) {
+        if (fsErrorCode(err) !== "ENOENT" && fsErrorCode(err) !== "ELOOP")
+          noteUnread(full, "could not be read", err);
         continue;
       }
       if (!st.isDirectory()) continue;
@@ -10804,7 +11003,8 @@ function findHooksDirs(tree) {
         let files;
         try {
           files = readdirSync10(full);
-        } catch {
+        } catch (err) {
+          noteUnread(full, "could not be listed", err);
           files = [];
         }
         for (const f of files) {
@@ -10882,7 +11082,8 @@ var dExt4 = {
     }
     const unreadable = [];
     const decided = (() => {
-      const hooksDirs = findHooksDirs(tree);
+      const hooksDirGaps = { count: 0 };
+      const hooksDirs = findHooksDirs(tree, unreadable, hooksDirGaps);
       const { sites, unresolved } = findFactorySites(tree);
       for (const anchor of unresolved) {
         unreadable.push({
@@ -10926,6 +11127,7 @@ var dExt4 = {
           continue;
         }
         const phantom = [...declared].filter((h) => !implemented.has(h));
+        if (phantom.length > 0 && hooksDirGaps.count > 0) continue;
         if (phantom.length > 0) {
           return {
             id: this.id,
@@ -11313,30 +11515,41 @@ var dExt8 = {
 };
 
 // src/detectors/dExt9.ts
-import { readFileSync as readFileSync13, readdirSync as readdirSync11, statSync as statSync11 } from "fs";
-import { join as join23 } from "path";
-function collectHooksDirSources(tree, unreadable) {
+import { readFileSync as readFileSync13, readdirSync as readdirSync11, statSync as statSync17 } from "fs";
+import { join as join23, relative as relative11 } from "path";
+function collectHooksDirSources(tree, unreadable, gaps) {
   const root = tree.root;
   const out = [];
   let base;
   try {
-    base = statSync11(root).isDirectory() ? root : join23(root, "..");
+    base = statSync17(root).isDirectory() ? root : join23(root, "..");
   } catch {
     return out;
   }
+  const noteUnread = (path, what, err) => {
+    gaps.count++;
+    const anchor = relative11(base, path) || ".";
+    const reason = `${anchor} ${what} (${fsErrorCode(err)}) \u2014 a hooks/ directory under it may exist unseen, so the timeout guards are undeterminable (Extension Rule 9)`;
+    if (!unreadable.some((u) => u.anchor === anchor && u.reason === reason)) {
+      unreadable.push({ anchor, reason });
+    }
+  };
   const walk2 = (dir) => {
     let entries;
     try {
       entries = readdirSync11(dir);
-    } catch {
+    } catch (err) {
+      noteUnread(dir, "could not be listed", err);
       return;
     }
     for (const name of entries) {
       const full = join23(dir, name);
       let st;
       try {
-        st = statSync11(full);
-      } catch {
+        st = statSync17(full);
+      } catch (err) {
+        if (fsErrorCode(err) !== "ENOENT" && fsErrorCode(err) !== "ELOOP")
+          noteUnread(full, "could not be read", err);
         continue;
       }
       if (!st.isDirectory()) continue;
@@ -11348,7 +11561,8 @@ function collectHooksDirSources(tree, unreadable) {
         let files;
         try {
           files = readdirSync11(full);
-        } catch {
+        } catch (err) {
+          noteUnread(full, "could not be listed", err);
           files = [];
         }
         for (const f of files) {
@@ -11358,6 +11572,7 @@ function collectHooksDirSources(tree, unreadable) {
           const filePath = join23(full, f);
           let body;
           try {
+            if (!statSync17(filePath).isFile()) throw new Error("not a regular file");
             body = readFileSync13(filePath, "utf8");
           } catch {
             const shortPath = filePath.split("/").slice(-2).join("/");
@@ -11461,8 +11676,9 @@ var dExt9 = {
     }
     const unreadable = [];
     const decided = (() => {
+      const hooksDirGaps = { count: 0 };
       const hookSources = [
-        ...collectHooksDirSources(tree, unreadable),
+        ...collectHooksDirSources(tree, unreadable, hooksDirGaps),
         ...collectFactorySources(tree)
       ];
       const implByToken = /* @__PURE__ */ new Map();
@@ -11511,6 +11727,7 @@ var dExt9 = {
           const hasImplTimeout = implSources.some((s) => hasImplTimeoutGuard(s.body));
           if (!hasManifestTimeout && !hasImplTimeout) noTimeout.push(hook);
         }
+        if (noTimeout.length > 0 && hooksDirGaps.count > 0) continue;
         if (noTimeout.length > 0) {
           return {
             id: this.id,
@@ -12524,7 +12741,6 @@ var dServer14 = {
 };
 
 // src/detectors/e5-extension-isolation.ts
-import { readFileSync as readFileSync14 } from "fs";
 var GLOBAL_RES = [
   /\b(?:globalThis|global|window|self)\s*(?:\.\s*[\w$]+|\[[^\]]+\])\s*=(?!=)/,
   /Object\.(?:assign|defineProperty|defineProperties|setPrototypeOf)\(\s*(?:globalThis|global|window|self)\b/,
@@ -12555,11 +12771,8 @@ var e5ExtensionIsolation = {
     const manifests = findExtensionManifests(tree);
     const own = /* @__PURE__ */ new Set();
     for (const m of manifests) {
-      try {
-        const j = JSON.parse(readFileSync14(m, "utf8"));
-        if (typeof j.identifier === "string") own.add(j.identifier);
-      } catch {
-      }
+      const j = readJsonObject(m);
+      if (j && typeof j.identifier === "string") own.add(j.identifier);
     }
     const defined = tree.files.some(
       (f) => isProductSource(f.rel) && uncommentedLines(f).some((r) => /\bdefineExtension\s*\(/.test(r))
@@ -12989,8 +13202,8 @@ var e10MrtrOnly = {
 };
 
 // src/detectors/e11-surfaces-derived.ts
-import { existsSync as existsSync20, statSync as statSync12 } from "fs";
-import { dirname as dirname14, join as join24, relative as relative10, sep as sep6 } from "path";
+import { existsSync as existsSync20, statSync as statSync18 } from "fs";
+import { dirname as dirname14, join as join24, relative as relative12, sep as sep6 } from "path";
 var ALL = ["chat", "cowork", "claude-code"];
 function excludedSurfaces(c) {
   const cause = /* @__PURE__ */ new Map();
@@ -13006,10 +13219,17 @@ function excludedSurfaces(c) {
   if (c.localMcp) exclude("chat", "a local MCP command excludes chat");
   return cause;
 }
-function isDir(p) {
+function isDir(p, anchor, unreadable) {
   try {
-    return statSync12(p).isDirectory();
-  } catch {
+    return statSync18(p).isDirectory();
+  } catch (err) {
+    const code = fsErrorCode(err);
+    if (code !== "ENOENT" && code !== "ENOTDIR") {
+      unreadable.push({
+        anchor,
+        reason: `${anchor} could not be probed (${code}) \u2014 whether this component exists is unread`
+      });
+    }
     return false;
   }
 }
@@ -13048,7 +13268,7 @@ var e11SurfacesDerived = {
         continue;
       }
       const folder = dirname14(m.path);
-      const rel = (p) => relative10(tree.root, p).split(sep6).join("/") || ".";
+      const rel = (p) => relative12(tree.root, p).split(sep6).join("/") || ".";
       if (!Array.isArray(j.surfaces)) {
         reds.push({
           anchor: m.rel,
@@ -13084,9 +13304,9 @@ var e11SurfacesDerived = {
         }
       }
       const cause = excludedSurfaces({
-        bin: isDir(join24(folder, "bin")),
-        hooks: isDir(join24(folder, "hooks")),
-        agents: isDir(join24(folder, "agents")),
+        bin: isDir(join24(folder, "bin"), rel(join24(folder, "bin")), unreadable),
+        hooks: isDir(join24(folder, "hooks"), rel(join24(folder, "hooks")), unreadable),
+        agents: isDir(join24(folder, "agents"), rel(join24(folder, "agents")), unreadable),
         localMcp
       });
       for (const s of declared) {
@@ -15432,8 +15652,8 @@ var s27ElicitationFloor = {
 };
 
 // src/detectors/s28-claim-forwarded.ts
-import { existsSync as existsSync21, readFileSync as readFileSync15, readdirSync as readdirSync12, statSync as statSync13 } from "fs";
-import { dirname as dirname15, join as join25, relative as relative11 } from "path";
+import { existsSync as existsSync21, readFileSync as readFileSync14, readdirSync as readdirSync12, statSync as statSync19 } from "fs";
+import { dirname as dirname15, join as join25, relative as relative13 } from "path";
 var PIN11 = STANDARD_PIN;
 var CLAIM_TOKEN = /\bverified(?:Org|Person)\b/;
 var ANY_CLAIM = /\bverified(?:Actor|Org|Person)\b/g;
@@ -15491,11 +15711,12 @@ function splitTop(m, from, to) {
   if (start < to && m.slice(start, to).trim() !== "") parts.push([start, to]);
   return parts;
 }
-function listTs(dir, out = []) {
+function listTs(dir, unread, out = []) {
   let names;
   try {
     names = readdirSync12(dir);
-  } catch {
+  } catch (err) {
+    unread.push(`${dir} could not be listed (${fsErrorCode(err)})`);
     return out;
   }
   for (const n of names) {
@@ -15503,19 +15724,23 @@ function listTs(dir, out = []) {
     const p = join25(dir, n);
     let st;
     try {
-      st = statSync13(p);
-    } catch {
+      st = statSync19(p);
+    } catch (err) {
+      unread.push(`${p} could not be read (${fsErrorCode(err)})`);
       continue;
     }
-    if (st.isDirectory()) listTs(p, out);
-    else if (n.endsWith(".ts") && !n.endsWith(".test.ts") && !n.endsWith(".d.ts")) out.push(p);
+    if (st.isDirectory()) listTs(p, unread, out);
+    else if (n.endsWith(".ts") && !n.endsWith(".test.ts") && !n.endsWith(".d.ts")) {
+      if (!st.isFile()) unread.push(`${p} is not a regular file \u2014 not read`);
+      else out.push(p);
+    }
   }
   return out;
 }
 function discoverBackend(root) {
   let dir = root;
   try {
-    if (!statSync13(root).isDirectory()) dir = dirname15(root);
+    if (!statSync19(root).isDirectory()) dir = dirname15(root);
   } catch {
     return void 0;
   }
@@ -15528,22 +15753,23 @@ function discoverBackend(root) {
   }
   return void 0;
 }
-function readDoors(backendRoot) {
+function readDoors(backendRoot, unread) {
   const doors = /* @__PURE__ */ new Map();
-  for (const path of listTs(backendRoot)) {
+  for (const path of listTs(backendRoot, unread)) {
     let text;
     try {
-      text = readFileSync15(path, "utf8");
-    } catch {
+      text = readFileSync14(path, "utf8");
+    } catch (err) {
+      unread.push(`${path} could not be read (${fsErrorCode(err)})`);
       continue;
     }
     const file = {
       path,
-      rel: relative11(backendRoot, path),
+      rel: relative13(backendRoot, path),
       lines: text.split("\n").map((raw, i) => ({ n: i + 1, raw, comment: false }))
     };
     const m = masked(file);
-    const module = relative11(backendRoot, path).replace(/\.ts$/, "").split("\\").join("/");
+    const module = relative13(backendRoot, path).replace(/\.ts$/, "").split("\\").join("/");
     const re = /\bexport\s+const\s+([A-Za-z_$][\w$]*)\s*=\s*(?:query|mutation|action)\s*\(/g;
     for (let hit = re.exec(m); hit; hit = re.exec(m)) {
       const open = hit.index + hit[0].length - 1;
@@ -15656,7 +15882,9 @@ function scanS28(tree) {
   const scan = { violate: [], conform: [], cnj: [], calls: 0, backend: void 0 };
   const backendRoot = tree.backendRoot ?? discoverBackend(tree.root);
   scan.backend = backendRoot;
-  const doors = backendRoot ? readDoors(backendRoot) : void 0;
+  const unread = [];
+  const doors = backendRoot ? readDoors(backendRoot, unread) : void 0;
+  const unreadNote = unread.length > 0 ? `; backend source NOT read: ${unread.join("; ")}` : "";
   const files = tree.files.map((f) => ({ f, text: rawText(f), m: masked(f) }));
   const actorDoors = /* @__PURE__ */ new Set();
   for (const { text } of files) {
@@ -15776,7 +16004,7 @@ function scanS28(tree) {
       if (!info) {
         scan.cnj.push(
           site(
-            `forwards no verified claim and the door ${door} is not defined in the supplied backend (${backendRoot})`
+            `forwards no verified claim and the door ${door} is not defined in the supplied backend (${backendRoot})${unreadNote}`
           )
         );
         continue;
@@ -16623,12 +16851,12 @@ var detectors = registered.map(
 
 // src/runtime/launch.ts
 import { spawnSync as spawnSync2 } from "child_process";
-import { existsSync as existsSync22, readFileSync as readFileSync16, statSync as statSync14 } from "fs";
+import { existsSync as existsSync22, readFileSync as readFileSync15, statSync as statSync20 } from "fs";
 import { dirname as dirname16, isAbsolute, join as join26, resolve as resolve2 } from "path";
 function findPackageDir(target) {
   let dir;
   try {
-    dir = statSync14(target).isDirectory() ? target : dirname16(target);
+    dir = statSync20(target).isDirectory() ? target : dirname16(target);
   } catch {
     return null;
   }
@@ -16658,7 +16886,10 @@ function deriveLaunchPlan(target) {
   }
   let pkg;
   try {
-    pkg = JSON.parse(readFileSync16(join26(pkgDir, "package.json"), "utf8"));
+    if (!statSync20(join26(pkgDir, "package.json")).isFile()) {
+      return { error: `${join26(pkgDir, "package.json")} is not a regular file \u2014 not read` };
+    }
+    pkg = JSON.parse(readFileSync15(join26(pkgDir, "package.json"), "utf8"));
   } catch (err) {
     return {
       error: `could not parse ${join26(pkgDir, "package.json")}: ${err instanceof Error ? err.message : String(err)}`
@@ -16796,29 +17027,41 @@ send({ jsonrpc: "2.0", id: 1, method: "initialize", params: { protocolVersion: "
 function readEvalCounts(target) {
   const counts = /* @__PURE__ */ new Map();
   const pkgDir = findPackageDir(target) ?? (statSyncSafe(target) ? target : null);
-  if (!pkgDir) return counts;
+  if (!pkgDir) return { counts };
   let dir = pkgDir;
   for (let depth = 0; depth < 8; depth++) {
     const candidate = join26(dir, "evals", "evals.json");
     if (existsSync22(candidate)) {
+      let text;
+      try {
+        if (!statSync20(candidate).isFile()) {
+          return { counts, unreadable: `${candidate} is not a regular file \u2014 not read` };
+        }
+        text = readFileSync15(candidate, "utf8");
+      } catch (err) {
+        return {
+          counts,
+          unreadable: `${candidate} could not be read (${fsErrorCode(err)})`
+        };
+      }
       try {
-        const parsed = JSON.parse(readFileSync16(candidate, "utf8"));
+        const parsed = JSON.parse(text);
         for (const c of parsed.cases ?? []) {
           if (c && typeof c.tool === "string") counts.set(c.tool, (counts.get(c.tool) ?? 0) + 1);
         }
       } catch {
       }
-      return counts;
+      return { counts };
     }
     const parent = dirname16(dir);
     if (parent === dir) break;
     dir = parent;
   }
-  return counts;
+  return { counts };
 }
 function statSyncSafe(p) {
   try {
-    return statSync14(p).isDirectory();
+    return statSync20(p).isDirectory();
   } catch {
     return false;
   }
@@ -16926,7 +17169,7 @@ function launchAndIntrospect(target) {
   if (parsed.launchError) {
     return { root: target, tools: [], launchError: parsed.launchError };
   }
-  const evalCounts = readEvalCounts(target);
+  const { counts: evalCounts, unreadable: evalsUnreadable } = readEvalCounts(target);
   const tools = (parsed.tools ?? []).map((t) => {
     const name = t.name;
     const count = evalCounts.get(name);
@@ -16940,6 +17183,7 @@ function launchAndIntrospect(target) {
     tools,
     ...parsed.serverInfo ? { serverInfo: parsed.serverInfo } : {},
     ...expectedCommit ? { expectedCommit } : {},
+    ...evalsUnreadable ? { evalsUnreadable } : {},
     ...Array.isArray(parsed.cursorProbes) ? { cursorProbes: parsed.cursorProbes.map(readCursorProbe) } : {}
   };
 }
@@ -17198,7 +17442,7 @@ var USAGE = [
 function readVersion() {
   try {
     const here = dirname17(fileURLToPath2(import.meta.url));
-    const manifest = JSON.parse(readFileSync17(join27(here, "..", "package.json"), "utf8"));
+    const manifest = JSON.parse(readFileSync16(join27(here, "..", "package.json"), "utf8"));
     return manifest.version ?? null;
   } catch {
     return null;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vantageos/mcp-doctor",
-  "version": "0.8.1",
+  "version": "0.8.2",
   "description": "Static MCP conformance checker: audits an MCP server source tree against the MCP 2026-07-28 standard and emits a conformance-diff table (file:line | present | absent | non-conforming | verdict).",
   "type": "module",
   "main": "./dist/doctor.js",