Scope the component tests per component, not per plugin

Three assertions generalised from the docs skill to the whole plugin, which
holds only while docs is the only thing here. It is the first component, not
the last.

The scoped-MCP-name test required *every* server in .mcp.json to be named by
skills/docs/SKILL.md, so adding a second server for some later skill would
have failed the docs skill for not knowing about it. Replaced by two tests
that scale: every declared server must be reached by *some* component, and
any component reading MCP resources must name a server to read them from.

The pmndrs-only link check now applies to the docs skill alone, where it
means something — a lookup skill that sends you off-site is a lookup it
cannot vouch for. Other skills keep the https requirement.

Verified by simulating the roadmap: a second skill with its own bundled
server passes clean, while dead server config, an unnamed server and a plain
http link each still fail the test that guards them.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TnvYiz7aGhnBTK2tzExHis

Author: claude

test/manifests.test.mjs

@@ -2,7 +2,7 @@ import test from 'node:test'
 import assert from 'node:assert/strict'
 import { existsSync, readFileSync } from 'node:fs'
 import { join } from 'node:path'
-import { readJson, root, agents, skills } from './helpers.mjs'
+import { readJson, root, agents, skills, asList } from './helpers.mjs'
 
 const plugin = readJson('.claude-plugin', 'plugin.json')
 const marketplace = readJson('.claude-plugin', 'marketplace.json')
@@ -51,6 +51,38 @@ test('README lists every component file the plugin ships', () => {
   }
 })
 
+const scope = (s) => s.replace(/[^A-Za-z0-9_-]/g, '_')
+const components = () => [...skills(), ...agents()]
+
+test('every bundled MCP server is reached by some component', () => {
+  // Which component is deliberately not pinned: a server added for a future
+  // skill has no business being documented by an existing one. What matters is
+  // that nothing in .mcp.json is dead config.
+  for (const key of Object.keys(mcp.mcpServers ?? {})) {
+    const scoped = `plugin:${plugin.name}:${key}`
+    const prefix = `mcp__plugin_${scope(plugin.name)}_${scope(key)}__`
+    const users = components().filter(
+      (c) => c.body.includes(scoped) || asList(c.fields.tools).some((t) => t.startsWith(prefix)),
+    )
+    assert.ok(users.length > 0, `server "${key}" is declared but no skill or agent uses it`)
+  }
+})
+
+test('components that read MCP resources name the server they read from', () => {
+  // ReadMcpResourceTool takes a configured server name. Bundled in a plugin,
+  // that name is plugin:<plugin>:<server> — the bare key from .mcp.json is not
+  // a name anything answers to.
+  const scoped = Object.keys(mcp.mcpServers ?? {}).map((key) => `plugin:${plugin.name}:${key}`)
+  for (const component of components()) {
+    const uses = component.body.includes('ReadMcpResourceTool') || asList(component.fields.tools).includes('ReadMcpResourceTool')
+    if (!uses) continue
+    assert.ok(
+      scoped.some((name) => component.body.includes(name)),
+      `${component.path} reads MCP resources without naming a server; expected one of ${scoped.join(', ')}`,
+    )
+  }
+})
+
 test('every marketplace source resolves on disk', () => {
   for (const entry of marketplace.plugins) {
     if (typeof entry.source !== 'string' || !entry.source.startsWith('.')) continue

test/skills.test.mjs

@@ -1,9 +1,7 @@
 import test from 'node:test'
 import assert from 'node:assert/strict'
-import { readJson, skills, agents } from './helpers.mjs'
+import { skills, agents } from './helpers.mjs'
 
-const plugin = readJson('.claude-plugin', 'plugin.json')
-const mcp = readJson('.mcp.json')
 const all = skills()
 
 test('the plugin ships at least one skill', () => {
@@ -22,21 +20,26 @@ for (const skill of all) {
     assert.ok(fields.description?.length > 60, 'the description is the trigger')
   })
 
-  test(`${path}: documentation links point at docs.pmnd.rs over https`, () => {
+  test(`${path}: links are https`, () => {
     for (const url of body.match(/https?:\/\/[^\s)`>]+/g) ?? []) {
       assert.match(url, /^https:/, `${url} must be https`)
-      assert.ok(
-        /^https:\/\/(docs\.pmnd\.rs|github\.com\/pmndrs)/.test(url),
-        `${url} points outside the pmndrs docs and repos`,
-      )
     }
   })
 }
 
 const docs = all.find((s) => s.fields.name === 'docs')
 
+test('the docs skill only sends readers to pmndrs docs and repos', () => {
+  // Specific to this skill, not a house rule: its whole job is to replace a
+  // remembered API with the published one, so an off-site link is a lookup
+  // that went somewhere it cannot vouch for.
+  for (const url of docs.body.match(/https:\/\/[^\s)`>]+/g) ?? []) {
+    assert.match(url, /^https:\/\/(docs\.pmnd\.rs|github\.com\/pmndrs)/, `${url} points outside pmndrs`)
+  }
+})
+
 test('the docs skill states which libraries are served, and when that was checked', () => {
-  assert.ok(docs, 'skills/docs/SKILL.md is the plugin’s reason to exist')
+  assert.ok(docs, 'skills/docs/SKILL.md is where this plugin started')
 
   const rows = [...docs.body.matchAll(/^\|\s*`([a-z0-9-]+)`\s*\|\s*(\d+)\s*\|/gm)]
   assert.ok(rows.length >= 3, 'the coverage table should list the served libraries with page counts')
@@ -59,13 +62,3 @@ test('the docs skill tells Claude when to delegate, and to an agent that exists'
   const referenced = names.filter((name) => docs.body.includes(name))
   assert.ok(referenced.length > 0, `SKILL.md should route wide lookups to one of: ${names.join(', ')}`)
 })
-
-test('the docs skill uses the scoped MCP server name', () => {
-  for (const key of Object.keys(mcp.mcpServers ?? {})) {
-    const scoped = `plugin:${plugin.name}:${key}`
-    assert.ok(
-      docs.body.includes(scoped),
-      `SKILL.md must name the server as ${scoped}; the bare key "${key}" does not resolve once installed`,
-    )
-  }
-})