@mp3wizard/figma-console-mcp 1.22.4 → 1.22.6

package/README.md

@@ -17,12 +17,11 @@
 
 Figma Console MCP connects AI assistants (like Claude) to Figma, enabling:
 
-- **🐛 Plugin debugging** - Capture console logs, errors, and stack traces
-- **📸 Visual debugging** - Take screenshots for context
 - **🎨 Design system extraction** - Pull variables, components, and styles
+- **📸 Visual debugging** - Take screenshots for context
 - **✏️ Design creation** - Create UI components, frames, and layouts directly in Figma
 - **🔧 Variable management** - Create, update, rename, and delete design tokens
-- **⚡ Real-time monitoring** - Watch logs as plugins execute
+- **⚡ Real-time monitoring** - Watch console logs from the Desktop Bridge plugin
 - **📌 FigJam boards** - Create stickies, flowcharts, tables, and code blocks on collaborative boards
 - **♿ Accessibility scanning** - 14 WCAG design checks with conformance level tagging, component scorecards, axe-core code scanning, design-to-code parity
 - **☁️ Cloud Write Relay** - Web AI clients (Claude.ai, v0, Replit) can design in Figma via cloud pairing
@@ -792,9 +791,11 @@ The architecture supports adding new apps with minimal boilerplate — each app
 
 ## 🛤️ Roadmap
 
-**Current Status:** v1.17.0 (Stable) - Production-ready with FigJam + Slides support, Cloud Write Relay, Design System Kit, WebSocket-only connectivity, smart multi-file tracking, 94+ tools, Comments API, and MCP Apps
+**Current Status:** v1.22.4 (Stable) - Production-ready with 14 WCAG accessibility rules, Phase B lint checks (disabled variant context + token misuse detection), FigJam + Slides support, Cloud Write Relay, Design System Kit, WebSocket-only connectivity, smart multi-file tracking, 94+ tools, Comments API, and MCP Apps
 
 **Recent Releases:**
+- [x] **v1.22.4** - Security: fix 6 Medium hono/node-server CVEs via package.json overrides (CVE-2026-39406 through CVE-2026-39410, GHSA-26pp-8wgv-hjvm, GHSA-xpcf-pg52-r92g)
+- [x] **v1.22.3** - Phase B accessibility: disabled variant context check, token misuse detection, WCAG interpretation fixes from accessibility consultant review, rule count 13 to 14
 - [x] **v1.17.0** - Figma Slides Support: 15 new tools for managing presentations — slides, transitions, content, reordering, and navigation. Inspired by Toni Haidamous (PR #11).
 - [x] **v1.16.0** - FigJam Support: 9 new tools for creating and reading FigJam boards — stickies, flowcharts, tables, code blocks, and connection graphs. Community-contributed by klgral and lukemoderwell.
 - [x] **v1.12.0** - Cloud Write Relay: web AI clients (Claude.ai, v0, Replit, Lovable) can create and modify Figma designs via cloud relay pairing — no Node.js required
@@ -839,6 +840,24 @@ npm run build
 
 ---
 
+## 🔒 Network Transparency
+
+All outbound network connections made by this MCP server:
+
+| Destination | Protocol | Purpose | Data Sent |
+|-------------|----------|---------|-----------|
+| `api.figma.com` | HTTPS | REST API (files, variables, components, styles, images, comments) | File keys, node IDs, API parameters |
+| `www.figma.com` | HTTPS | OAuth 2.0 authorization flow | Client ID, auth codes, refresh tokens |
+| `figma-console-mcp.southleft.com` | WSS/HTTPS | Cloud relay for web AI clients (Cloud Mode only) | Metadata only: fileName, fileKey, currentPage |
+| Figma S3 CDN | HTTPS | Rendered image downloads (temporary URLs) | None (download only) |
+| `localhost:9223-9232` | WS | Desktop Bridge plugin (local only) | Plugin commands/responses |
+
+**Not present:** telemetry, analytics, tracking, third-party data services, obfuscated code, or environment variable leakage. Full audit available in [`Security review report/`](Security%20review%20report/).
+
+> **Local Mode users:** `src/local.ts` does not connect to the cloud relay — only Figma API and localhost WebSocket.
+
+---
+
 ## 📄 License
 
 MIT - See [LICENSE](LICENSE) file for details.

package/dist/cloudflare/core/cloud-websocket-connector.js

@@ -32,25 +32,27 @@ export class CloudWebSocketConnector {
         return this.sendCommand('GET_VARIABLES_DATA', {}, 10000);
     }
     async getVariables(fileKey) {
+        // IMPORTANT: bare try/catch with top-level `return`, NO inner IIFE.
+        // See issue #68 + the matching note in websocket-connector.ts. The plugin
+        // (code.js) wraps every EXECUTE_CODE payload in its own async IIFE; nesting
+        // another swallows the inner return and silently drops the variables.
         const code = `
-      (async () => {
-        try {
-          if (typeof figma === 'undefined') {
-            throw new Error('Figma API not available in this context');
-          }
-          const variables = await figma.variables.getLocalVariablesAsync();
-          const collections = await figma.variables.getLocalVariableCollectionsAsync();
-          return {
-            success: true,
-            timestamp: Date.now(),
-            fileMetadata: { fileName: figma.root.name, fileKey: figma.fileKey || null },
-            variables: variables.map(function(v) { return { id: v.id, name: v.name, key: v.key, resolvedType: v.resolvedType, valuesByMode: v.valuesByMode, variableCollectionId: v.variableCollectionId, scopes: v.scopes, description: v.description, hiddenFromPublishing: v.hiddenFromPublishing }; }),
-            variableCollections: collections.map(function(c) { return { id: c.id, name: c.name, key: c.key, modes: c.modes, defaultModeId: c.defaultModeId, variableIds: c.variableIds }; })
-          };
-        } catch (error) {
-          return { success: false, error: error.message };
+      try {
+        if (typeof figma === 'undefined') {
+          throw new Error('Figma API not available in this context');
         }
-      })()
+        const variables = await figma.variables.getLocalVariablesAsync();
+        const collections = await figma.variables.getLocalVariableCollectionsAsync();
+        return {
+          success: true,
+          timestamp: Date.now(),
+          fileMetadata: { fileName: figma.root.name, fileKey: figma.fileKey || null },
+          variables: variables.map(function(v) { return { id: v.id, name: v.name, key: v.key, resolvedType: v.resolvedType, valuesByMode: v.valuesByMode, variableCollectionId: v.variableCollectionId, scopes: v.scopes, description: v.description, hiddenFromPublishing: v.hiddenFromPublishing }; }),
+          variableCollections: collections.map(function(c) { return { id: c.id, name: c.name, key: c.key, modes: c.modes, defaultModeId: c.defaultModeId, variableIds: c.variableIds }; })
+        };
+      } catch (error) {
+        return { success: false, error: error.message };
+      }
     `;
         return this.sendCommand('EXECUTE_CODE', { code, timeout: 30000 }, 32000);
     }

package/dist/cloudflare/core/design-code-tools.js

@@ -2180,7 +2180,11 @@ const codeSpecSchema = z.object({
         semanticElement: z.string().optional().describe("Semantic HTML element (e.g., 'button', 'a', 'input')"),
         supportsDisabled: z.boolean().optional().describe("Whether code supports disabled/aria-disabled state"),
         supportsError: z.boolean().optional().describe("Whether code supports aria-invalid/error state"),
-        renderedSize: z.tuple([z.number(), z.number()]).optional().describe("Rendered size [width, height] in px"),
+        // NOTE: Use array-with-length, NOT z.tuple — tuples emit JSON Schema `items: [...]`
+        // (array of schemas), which Gemini's stricter Function Calling validator rejects with
+        // "is not of type 'object', 'boolean'". See issue #64. A constrained array emits
+        // `items: { type: 'number' }` which all major MCP clients accept.
+        renderedSize: z.array(z.number()).min(2).max(2).optional().describe("Rendered size [width, height] in px"),
     }).optional().describe("Accessibility properties from code. Tip: use figma_scan_code_accessibility with mapToCodeSpec:true to auto-generate this from component HTML."),
     metadata: z.object({
         name: z.string().optional(),
@@ -2350,16 +2354,22 @@ export function registerDesignCodeTools(server, getFigmaAPI, getCurrentUrl, vari
                     logger.warn("Enrichment failed, proceeding without token data");
                 }
             }
+            // Cast to the structural CodeSpec interface. The Zod schema infers
+            // `accessibility.renderedSize` as `number[]` (post-#64 fix uses
+            // `z.array(z.number()).min(2).max(2)` for Gemini compat), but at runtime
+            // the validator guarantees exactly two numbers, matching CodeSpec's
+            // `[number, number]`. TypeScript can't bridge the inference gap.
+            const codeSpecTyped = codeSpec;
             // Run all comparators (use nodeForVisual for design properties, nodeForAPI for component API)
             const discrepancies = [];
-            compareVisual(nodeForVisual, codeSpec, discrepancies);
-            compareSpacing(nodeForVisual, codeSpec, discrepancies);
-            compareTypography(nodeForVisual, codeSpec, discrepancies);
-            compareTokens(enrichedData, codeSpec, discrepancies);
-            compareComponentAPI(nodeForAPI, codeSpec, discrepancies);
-            compareAccessibility(node, codeSpec, discrepancies);
-            compareNaming(node, codeSpec, discrepancies);
-            compareMetadata(node, componentMeta, codeSpec, discrepancies);
+            compareVisual(nodeForVisual, codeSpecTyped, discrepancies);
+            compareSpacing(nodeForVisual, codeSpecTyped, discrepancies);
+            compareTypography(nodeForVisual, codeSpecTyped, discrepancies);
+            compareTokens(enrichedData, codeSpecTyped, discrepancies);
+            compareComponentAPI(nodeForAPI, codeSpecTyped, discrepancies);
+            compareAccessibility(node, codeSpecTyped, discrepancies);
+            compareNaming(node, codeSpecTyped, discrepancies);
+            compareMetadata(node, componentMeta, codeSpecTyped, discrepancies);
             // Sort by severity
             const severityOrder = {
                 critical: 0,
@@ -2410,7 +2420,7 @@ export function registerDesignCodeTools(server, getFigmaAPI, getCurrentUrl, vari
                         : [],
                     tokenCoverage: enrichedData?.token_coverage,
                 },
-                codeData: codeSpec,
+                codeData: codeSpecTyped,
             };
             return {
                 content: [{ type: "text", text: JSON.stringify(result) }],

package/dist/cloudflare/core/figma-tools.js

@@ -1549,18 +1549,27 @@ export function registerFigmaAPITools(server, getFigmaAPI, getCurrentUrl, getCon
                     const desktopResult = refreshCache
                         ? await connector.getVariables(fileKey)
                         : await connector.getVariablesFromPluginUI(fileKey);
-                    if (desktopResult.success && desktopResult.variables) {
+                    // EXECUTE_CODE responses come back wrapped one level deeper:
+                    // `{ success: true, result: { success: true, variables, ... } }`
+                    // because handleResult in ui-full.html nests the script return value
+                    // under `result`. The plugin-UI cache path (GET_VARIABLES_DATA) does
+                    // not nest. Unwrap when we detect the EXECUTE_CODE shape so both
+                    // paths produce a uniform { success, variables, ... } below. See #68.
+                    const variableData = desktopResult?.result?.variables
+                        ? desktopResult.result
+                        : desktopResult;
+                    if (variableData?.success && variableData?.variables) {
                         logger.info({
-                            variableCount: desktopResult.variables.length,
-                            collectionCount: desktopResult.variableCollections?.length
+                            variableCount: variableData.variables.length,
+                            collectionCount: variableData.variableCollections?.length
                         }, "Successfully retrieved variables via Desktop connection!");
                         // Prepare data for caching (using the raw data, not enriched)
                         const dataForCache = {
                             fileKey,
                             source: "desktop_connection",
-                            timestamp: desktopResult.timestamp || Date.now(),
-                            variables: desktopResult.variables,
-                            variableCollections: desktopResult.variableCollections,
+                            timestamp: variableData.timestamp || Date.now(),
+                            variables: variableData.variables,
+                            variableCollections: variableData.variableCollections,
                         };
                         // Store in cache with LRU eviction
                         if (variablesCache) {

package/dist/cloudflare/core/websocket-connector.js

@@ -33,26 +33,32 @@ export class WebSocketConnector {
         return this.wsServer.sendCommand('GET_VARIABLES_DATA', {}, 10000, fileKey);
     }
     async getVariables(fileKey) {
-        // Execute the same variables-fetching code in the plugin worker context
+        // Execute the same variables-fetching code in the plugin worker context.
+        //
+        // IMPORTANT: Do NOT wrap this in an inner `(async () => { ... })()` IIFE.
+        // figma-desktop-bridge/code.js already wraps every EXECUTE_CODE payload in
+        // `(async function() { <code> })()`. An inner IIFE turns `return X` into a
+        // statement-expression that builds (but doesn't return) a Promise — the
+        // outer async returns undefined, and the result is silently dropped. See
+        // issue #68. The bare try/catch with top-level `return` is the contract
+        // code.js expects.
         const code = `
-      (async () => {
-        try {
-          if (typeof figma === 'undefined') {
-            throw new Error('Figma API not available in this context');
-          }
-          const variables = await figma.variables.getLocalVariablesAsync();
-          const collections = await figma.variables.getLocalVariableCollectionsAsync();
-          return {
-            success: true,
-            timestamp: Date.now(),
-            fileMetadata: { fileName: figma.root.name, fileKey: figma.fileKey || null },
-            variables: variables.map(function(v) { return { id: v.id, name: v.name, key: v.key, resolvedType: v.resolvedType, valuesByMode: v.valuesByMode, variableCollectionId: v.variableCollectionId, scopes: v.scopes, description: v.description, hiddenFromPublishing: v.hiddenFromPublishing }; }),
-            variableCollections: collections.map(function(c) { return { id: c.id, name: c.name, key: c.key, modes: c.modes, defaultModeId: c.defaultModeId, variableIds: c.variableIds }; })
-          };
-        } catch (error) {
-          return { success: false, error: error.message };
+      try {
+        if (typeof figma === 'undefined') {
+          throw new Error('Figma API not available in this context');
         }
-      })()
+        const variables = await figma.variables.getLocalVariablesAsync();
+        const collections = await figma.variables.getLocalVariableCollectionsAsync();
+        return {
+          success: true,
+          timestamp: Date.now(),
+          fileMetadata: { fileName: figma.root.name, fileKey: figma.fileKey || null },
+          variables: variables.map(function(v) { return { id: v.id, name: v.name, key: v.key, resolvedType: v.resolvedType, valuesByMode: v.valuesByMode, variableCollectionId: v.variableCollectionId, scopes: v.scopes, description: v.description, hiddenFromPublishing: v.hiddenFromPublishing }; }),
+          variableCollections: collections.map(function(c) { return { id: c.id, name: c.name, key: c.key, modes: c.modes, defaultModeId: c.defaultModeId, variableIds: c.variableIds }; })
+        };
+      } catch (error) {
+        return { success: false, error: error.message };
+      }
     `;
         return this.wsServer.sendCommand('EXECUTE_CODE', { code, timeout: 30000 }, 32000, fileKey);
     }

package/dist/cloudflare/index.js

@@ -69,7 +69,7 @@ export class FigmaConsoleMCPv3 extends McpAgent {
         super(...arguments);
         this.server = new McpServer({
             name: "Figma Console MCP",
-            version: "1.22.0",
+            version: "1.22.4",
         });
         this.browserManager = null;
         this.consoleMonitor = null;
@@ -1055,7 +1055,7 @@ export default {
             });
             const statelessServer = new McpServer({
                 name: "Figma Console MCP",
-                version: "1.22.0",
+                version: "1.22.4",
             });
             // ================================================================
             // Cloud Write Relay — Pairing Tool (stateless /mcp path)
@@ -1690,7 +1690,7 @@ export default {
             return new Response(JSON.stringify({
                 status: "healthy",
                 service: "Figma Console MCP",
-                version: "1.22.0",
+                version: "1.22.4",
                 endpoints: {
                     mcp: ["/sse", "/mcp"],
                     oauth_mcp_spec: ["/.well-known/oauth-authorization-server", "/authorize", "/token", "/oauth/register"],

package/dist/core/design-code-tools.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"design-code-tools.d.ts","sourceRoot":"","sources":["../../src/core/design-code-tools.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEzE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAK/C,OAAO,KAAK,EAUX,uBAAuB,EACvB,MAAM,wBAAwB,CAAC;AAShC,oDAAoD;AACpD,wBAAgB,cAAc,CAAC,KAAK,EAAE;IAAE,CAAC,EAAE,MAAM,CAAC;IAAC,CAAC,EAAE,MAAM,CAAC;IAAC,CAAC,EAAE,MAAM,CAAC;IAAC,CAAC,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAU7F;AAED,4FAA4F;AAC5F,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAWpD;AAED,8CAA8C;AAC9C,wBAAgB,YAAY,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,SAAS,GAAE,MAAU,GAAG,OAAO,CAEjF;AAED,qDAAqD;AACrD,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAEzG;AAiED,oEAAoE;AACpE,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,MAAM,GAAG,KAAK,CAAC;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC,CAqBpG;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAUxD;AAMD,sEAAsE;AACtE,UAAU,iBAAiB;IAC1B,qCAAqC;IACrC,QAAQ,EAAE,MAAM,CAAC;IACjB,kCAAkC;IAClC,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,sCAAsC;IACtC,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,uEAAuE;IACvE,iBAAiB,EAAE,KAAK,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,CAAC;IAC/D,0BAA0B;IAC1B,kBAAkB,EAAE,MAAM,EAAE,CAAC;IAC7B,yCAAyC;IACzC,eAAe,EAAE,MAAM,EAAE,CAAC;CAC1B;AAED;;;GAGG;AACH,wBAAgB,yBAAyB,CAAC,WAAW,EAAE,MAAM,GAAG,iBAAiB,CA0KhF;AAMD,mDAAmD;AACnD,UAAU,gBAAgB;IACzB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,KAAK,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC5F,OAAO,EAAE,KAAK,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC9F,UAAU,EAAE,KAAK,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACjG,KAAK,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC7C;AAED,uCAAuC;AACvC,UAAU,aAAa;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,cAAc,EAAE,MAAM,CAAC;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;IACtB,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC1C;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,GAAG,EAAE,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,gBAAgB,EAAE,CAqBpG;AAoED;;GAEG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,GAAG,EAAE,KAAK,GAAE,MAAU,EAAE,QAAQ,GAAE,MAAU,GAAG,aAAa,EAAE,CAiCzG;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,GAAG,EAAE,KAAK,GAAE,MAAU,EAAE,QAAQ,GAAE,MAAU,GAAG,MAAM,CAqB3F;AAmHD;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,GAAG,GAAG,GAAG,CAKhD;AAED,oGAAoG;AACpG,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEnD;AAED,uDAAuD;AACvD,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAE1D;AA8uDD,gFAAgF;AAChF,wBAAgB,kBAAkB,CACjC,QAAQ,EAAE,MAAM,EAChB,aAAa,EAAE,MAAM,EACrB,QAAQ,EAAE,MAAM,EAChB,UAAU,CAAC,EAAE,MAAM,GACjB,uBAAuB,CAazB;AAqJD,wBAAgB,uBAAuB,CACtC,MAAM,EAAE,SAAS,EACjB,WAAW,EAAE,MAAM,OAAO,CAAC,QAAQ,CAAC,EACpC,aAAa,EAAE,MAAM,MAAM,GAAG,IAAI,EAClC,cAAc,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE;IAAE,IAAI,EAAE,GAAG,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC,EAC9D,OAAO,CAAC,EAAE;IAAE,YAAY,CAAC,EAAE,OAAO,CAAA;CAAE,EACpC,mBAAmB,CAAC,EAAE,MAAM,OAAO,CAAC,GAAG,CAAC,GACtC,IAAI,CAijBN"}
+{"version":3,"file":"design-code-tools.d.ts","sourceRoot":"","sources":["../../src/core/design-code-tools.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEzE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAK/C,OAAO,KAAK,EAUX,uBAAuB,EACvB,MAAM,wBAAwB,CAAC;AAShC,oDAAoD;AACpD,wBAAgB,cAAc,CAAC,KAAK,EAAE;IAAE,CAAC,EAAE,MAAM,CAAC;IAAC,CAAC,EAAE,MAAM,CAAC;IAAC,CAAC,EAAE,MAAM,CAAC;IAAC,CAAC,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAU7F;AAED,4FAA4F;AAC5F,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAWpD;AAED,8CAA8C;AAC9C,wBAAgB,YAAY,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,SAAS,GAAE,MAAU,GAAG,OAAO,CAEjF;AAED,qDAAqD;AACrD,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAEzG;AAiED,oEAAoE;AACpE,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,MAAM,GAAG,KAAK,CAAC;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC,CAqBpG;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAUxD;AAMD,sEAAsE;AACtE,UAAU,iBAAiB;IAC1B,qCAAqC;IACrC,QAAQ,EAAE,MAAM,CAAC;IACjB,kCAAkC;IAClC,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,sCAAsC;IACtC,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,uEAAuE;IACvE,iBAAiB,EAAE,KAAK,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,CAAC;IAC/D,0BAA0B;IAC1B,kBAAkB,EAAE,MAAM,EAAE,CAAC;IAC7B,yCAAyC;IACzC,eAAe,EAAE,MAAM,EAAE,CAAC;CAC1B;AAED;;;GAGG;AACH,wBAAgB,yBAAyB,CAAC,WAAW,EAAE,MAAM,GAAG,iBAAiB,CA0KhF;AAMD,mDAAmD;AACnD,UAAU,gBAAgB;IACzB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,KAAK,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC5F,OAAO,EAAE,KAAK,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC9F,UAAU,EAAE,KAAK,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACjG,KAAK,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC7C;AAED,uCAAuC;AACvC,UAAU,aAAa;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,cAAc,EAAE,MAAM,CAAC;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;IACtB,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC1C;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,GAAG,EAAE,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,gBAAgB,EAAE,CAqBpG;AAoED;;GAEG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,GAAG,EAAE,KAAK,GAAE,MAAU,EAAE,QAAQ,GAAE,MAAU,GAAG,aAAa,EAAE,CAiCzG;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,GAAG,EAAE,KAAK,GAAE,MAAU,EAAE,QAAQ,GAAE,MAAU,GAAG,MAAM,CAqB3F;AAmHD;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,GAAG,GAAG,GAAG,CAKhD;AAED,oGAAoG;AACpG,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEnD;AAED,uDAAuD;AACvD,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAE1D;AA8uDD,gFAAgF;AAChF,wBAAgB,kBAAkB,CACjC,QAAQ,EAAE,MAAM,EAChB,aAAa,EAAE,MAAM,EACrB,QAAQ,EAAE,MAAM,EAChB,UAAU,CAAC,EAAE,MAAM,GACjB,uBAAuB,CAazB;AAyJD,wBAAgB,uBAAuB,CACtC,MAAM,EAAE,SAAS,EACjB,WAAW,EAAE,MAAM,OAAO,CAAC,QAAQ,CAAC,EACpC,aAAa,EAAE,MAAM,MAAM,GAAG,IAAI,EAClC,cAAc,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE;IAAE,IAAI,EAAE,GAAG,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC,EAC9D,OAAO,CAAC,EAAE;IAAE,YAAY,CAAC,EAAE,OAAO,CAAA;CAAE,EACpC,mBAAmB,CAAC,EAAE,MAAM,OAAO,CAAC,GAAG,CAAC,GACtC,IAAI,CAwjBN"}

package/dist/core/design-code-tools.js

@@ -2180,7 +2180,11 @@ const codeSpecSchema = z.object({
         semanticElement: z.string().optional().describe("Semantic HTML element (e.g., 'button', 'a', 'input')"),
         supportsDisabled: z.boolean().optional().describe("Whether code supports disabled/aria-disabled state"),
         supportsError: z.boolean().optional().describe("Whether code supports aria-invalid/error state"),
-        renderedSize: z.tuple([z.number(), z.number()]).optional().describe("Rendered size [width, height] in px"),
+        // NOTE: Use array-with-length, NOT z.tuple — tuples emit JSON Schema `items: [...]`
+        // (array of schemas), which Gemini's stricter Function Calling validator rejects with
+        // "is not of type 'object', 'boolean'". See issue #64. A constrained array emits
+        // `items: { type: 'number' }` which all major MCP clients accept.
+        renderedSize: z.array(z.number()).min(2).max(2).optional().describe("Rendered size [width, height] in px"),
     }).optional().describe("Accessibility properties from code. Tip: use figma_scan_code_accessibility with mapToCodeSpec:true to auto-generate this from component HTML."),
     metadata: z.object({
         name: z.string().optional(),
@@ -2350,16 +2354,22 @@ export function registerDesignCodeTools(server, getFigmaAPI, getCurrentUrl, vari
                     logger.warn("Enrichment failed, proceeding without token data");
                 }
             }
+            // Cast to the structural CodeSpec interface. The Zod schema infers
+            // `accessibility.renderedSize` as `number[]` (post-#64 fix uses
+            // `z.array(z.number()).min(2).max(2)` for Gemini compat), but at runtime
+            // the validator guarantees exactly two numbers, matching CodeSpec's
+            // `[number, number]`. TypeScript can't bridge the inference gap.
+            const codeSpecTyped = codeSpec;
             // Run all comparators (use nodeForVisual for design properties, nodeForAPI for component API)
             const discrepancies = [];
-            compareVisual(nodeForVisual, codeSpec, discrepancies);
-            compareSpacing(nodeForVisual, codeSpec, discrepancies);
-            compareTypography(nodeForVisual, codeSpec, discrepancies);
-            compareTokens(enrichedData, codeSpec, discrepancies);
-            compareComponentAPI(nodeForAPI, codeSpec, discrepancies);
-            compareAccessibility(node, codeSpec, discrepancies);
-            compareNaming(node, codeSpec, discrepancies);
-            compareMetadata(node, componentMeta, codeSpec, discrepancies);
+            compareVisual(nodeForVisual, codeSpecTyped, discrepancies);
+            compareSpacing(nodeForVisual, codeSpecTyped, discrepancies);
+            compareTypography(nodeForVisual, codeSpecTyped, discrepancies);
+            compareTokens(enrichedData, codeSpecTyped, discrepancies);
+            compareComponentAPI(nodeForAPI, codeSpecTyped, discrepancies);
+            compareAccessibility(node, codeSpecTyped, discrepancies);
+            compareNaming(node, codeSpecTyped, discrepancies);
+            compareMetadata(node, componentMeta, codeSpecTyped, discrepancies);
             // Sort by severity
             const severityOrder = {
                 critical: 0,
@@ -2410,7 +2420,7 @@ export function registerDesignCodeTools(server, getFigmaAPI, getCurrentUrl, vari
                         : [],
                     tokenCoverage: enrichedData?.token_coverage,
                 },
-                codeData: codeSpec,
+                codeData: codeSpecTyped,
             };
             return {
                 content: [{ type: "text", text: JSON.stringify(result) }],