fix: guard EACCES on filesystem probes in ccarch resolver

Path.is_file()/is_dir() only swallow ENOENT/ENOTDIR/EBADF/ELOOP
internally (pathlib._IGNORED_ERRNOS); EACCES re-raises as
PermissionError. A permission-denied path/ancestor dir (locked-down
checkout dir, different-UID Docker mount) crashed resolve() instead
of reporting "missing", breaching the never-raise contract for the
third time.

Add _safe_check() helper wrapping is_file()/is_dir() in try/except
OSError, and route all four probes in resolve() through it. Add
regression test using chmod 000 under tmp_path, skipped under root
(chmod 000 doesn't block root) and restoring permissions in finally
so tmp_path teardown doesn't choke on the unreadable dir.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: pwx603

mcp/ccarch/ccarch/resolver.py

@@ -18,6 +18,21 @@ class Resolved:
     kind: str    # "file" | "dir"
 
 
+def _safe_check(p: Path, kind: str) -> bool:
+    # Path.is_file()/is_dir() only swallow a fixed errno set internally
+    # (pathlib._IGNORED_ERRNOS = ENOENT, ENOTDIR, EBADF, ELOOP) and re-raise
+    # anything else as OSError. EACCES — a permission-denied path or an
+    # ancestor directory we can't stat through, e.g. a locked-down directory
+    # in the checkout or a different-UID Docker mount — is not in that set,
+    # so an unguarded call can crash resolve() on a perfectly realistic
+    # filesystem state. Treat any such probe failure as "not found" rather
+    # than letting it propagate: resolve() must never raise.
+    try:
+        return p.is_file() if kind == "file" else p.is_dir()
+    except OSError:
+        return False
+
+
 def _swap_ext(p: str) -> str | None:
     if p.endswith(".ts"):
         return p[:-3] + ".tsx"
@@ -61,17 +76,17 @@ def resolve(repo_root: Path, cited: str) -> Resolved:
     if is_dir_cite:
         return Resolved(
             path=raw,
-            status="ok" if target.is_dir() else "missing",
+            status="ok" if _safe_check(target, "dir") else "missing",
             kind="dir",
         )
 
-    if target.is_file():
+    if _safe_check(target, "file"):
         return Resolved(path=q, status="ok", kind="file")
-    if target.is_dir():
+    if _safe_check(target, "dir"):
         return Resolved(path=q, status="ok", kind="dir")
 
     alt = _swap_ext(q)
-    if alt and (repo_root / alt).is_file():
+    if alt and _safe_check(repo_root / alt, "file"):
         return Resolved(path=alt, status="moved", kind="file")
 
     return Resolved(path=q, status="missing", kind="file")

mcp/ccarch/tests/test_resolver.py

@@ -1,5 +1,8 @@
+import os
 from pathlib import Path
 
+import pytest
+
 from ccarch.resolver import resolve
 
 REPO = Path(__file__).resolve().parents[3]
@@ -79,3 +82,24 @@ def test_broken_symlink_does_not_raise(tmp_path):
 
     r = resolve(tmp_path, "src/ghost")
     assert r.status == "missing"
+
+
+@pytest.mark.skipif(
+    os.geteuid() == 0,
+    reason="chmod 000 does not block root, so this would pass vacuously",
+)
+def test_permission_denied_dir_does_not_raise(tmp_path):
+    # Path.is_file()/is_dir() only swallow ENOENT/ENOTDIR/EBADF/ELOOP
+    # (pathlib._IGNORED_ERRNOS); EACCES is not in that set, so a
+    # permission-denied ancestor directory makes them re-raise
+    # PermissionError. resolve() must still report "missing", not raise.
+    locked = tmp_path / "src" / "locked"
+    locked.mkdir(parents=True)
+    (locked / "secret.ts").write_text("secret")
+    os.chmod(locked, 0o000)
+    try:
+        r = resolve(tmp_path, "src/locked/secret.ts")
+        assert r.status == "missing"
+    finally:
+        # Restore permissions so tmp_path teardown can clean up the dir.
+        os.chmod(locked, 0o755)