diff --git a/src/plugins/discovery.ts b/src/plugins/discovery.ts
index 87c6f01fdef..113ce289308 100644
--- a/src/plugins/discovery.ts
+++ b/src/plugins/discovery.ts
@@ -476,8 +476,17 @@ function resolvePackageEntrySource(params: {
     rejectHardlinks: params.rejectHardlinks ?? true,
   });
   if (!opened.ok) {
-    if (opened.reason !== "validation") {
-      // File missing (ENOENT) or I/O error — skip silently, not a security violation.
+    if (opened.reason === "path") {
+      // File missing (ENOENT) — skip, not a security violation.
+      return null;
+    }
+    if (opened.reason === "io") {
+      // Filesystem error (EACCES, EMFILE, etc.) — warn but don't abort.
+      params.diagnostics.push({
+        level: "warn",
+        message: `extension entry unreadable (I/O error): ${params.entryPath}`,
+        source: params.sourceLabel,
+      });
       return null;
     }
     params.diagnostics.push({