@mp3wizard/figma-console-mcp 1.32.3 → 1.34.1

package/dist/cloudflare/core/version-tools.js

@@ -663,7 +663,11 @@ getMetadataChanges) {
                 });
             }
             catch (e) {
-                logger.warn({ err: e }, "Author enrichment lookup failed; continuing without it");
+                // Degrading to null metadata IS surfaced to callers (formatter shows
+                // "metadata not available") — just make sure the underlying reason
+                // lands in the log for debugging.
+                const reason = e instanceof Error ? e.message : String(e);
+                logger.warn({ err: e, reason, page }, "Author enrichment lookup failed; continuing without it");
                 break;
             }
             const versions = response?.versions || [];
@@ -929,6 +933,13 @@ getMetadataChanges) {
             apiCalls += candidates.apiCalls;
             cacheHits += candidates.cacheHits;
             const versions = candidates.versions; // newest-first, all OLDER than start
+            // If the version listing itself failed and NOTHING was collected, the
+            // binary search would run over an empty range and confidently report
+            // "introduced at start_version" when nothing was actually searched.
+            // Fail loudly instead of returning a wrong answer.
+            if (candidates.listFetchFailed && versions.length === 0) {
+                return errorResponse("version_list_unavailable", `version list unavailable: ${candidates.listFetchError ?? "unknown error"} — cannot attribute the change because no version history could be fetched to search. Retry, or check that your token has the file_versions:read scope ('Versions' Read on a PAT).`);
+            }
             // Step 3: Binary search for the LARGEST index (oldest version) where target exists.
             // Existence is assumed monotonic: if target exists at an OLDER version (larger
             // index), it must also exist at all NEWER versions up to start. We search for
@@ -1014,6 +1025,13 @@ getMetadataChanges) {
                     certainty = "exact";
                 }
             }
+            // Version listing failed partway through — the candidate list is
+            // truncated, so the searched range may not cover the true
+            // introduction point. Surface the gap and downgrade confidence.
+            if (candidates.listFetchFailed) {
+                certainty = downgradeCertainty(certainty);
+                notes.push(`Version listing failed partway through the blame walk (${candidates.listFetchError ?? "unknown error"}); only ${versions.length} version(s) were collected and searched. The true introduction point may lie outside the searched range, so attribution_certainty was downgraded one level.`);
+            }
             notes.push("Binary search assumes the target's existence is monotonic (added once, never removed). If the target was added, removed, then re-added, this tool may report a different introduction point than the original.");
             if (usedSelection) {
                 notes.push(`Auto-scoped to node ${resolvedNodeId} from the current Figma selection. Pass node_id explicitly to override.`);
@@ -1058,6 +1076,8 @@ getMetadataChanges) {
         let cursor;
         let apiCalls = 0;
         const cacheHits = 0; // version-list pagination is not snapshot-cached
+        let listFetchFailed = false;
+        let listFetchError;
         // Once we hit start_version's id in the list, switch to "collecting older" mode
         let foundStart = isCurrentSentinel(startVer);
         const MAX_PAGES = 10; // 10 × 50 = 500 versions hard cap on scan
@@ -1071,7 +1091,9 @@ getMetadataChanges) {
                 apiCalls++;
             }
             catch (e) {
-                logger.warn({ err: e }, "Version list fetch failed during blame walk");
+                listFetchFailed = true;
+                listFetchError = e instanceof Error ? e.message : String(e);
+                logger.warn({ err: e, reason: listFetchError, page }, "Version list fetch failed during blame walk");
                 break;
             }
             const versions = response?.versions || [];
@@ -1099,9 +1121,28 @@ getMetadataChanges) {
                 break;
             cursor = last.id;
         }
-        return { versions: collected, apiCalls, cacheHits };
+        return { versions: collected, apiCalls, cacheHits, listFetchFailed, listFetchError };
     };
 }
+/**
+ * Downgrade an attribution_certainty value one confidence level when the
+ * searched version range is known to be incomplete (truncated version listing).
+ * "exact" and "system_attributed" both mean "found the introducing version"
+ * and downgrade to "exists_at_lookback_horizon" (the true introduction may lie
+ * outside the searched range); the horizon case downgrades to
+ * "metadata_unavailable", which is already the floor.
+ */
+function downgradeCertainty(certainty) {
+    switch (certainty) {
+        case "exact":
+        case "system_attributed":
+            return "exists_at_lookback_horizon";
+        case "exists_at_lookback_horizon":
+            return "metadata_unavailable";
+        default:
+            return certainty;
+    }
+}
 // Returns true if the target is present in the given node tree.
 function targetExists(node, target) {
     if (target.target_component_property) {

package/dist/cloudflare/core/websocket-connector.js

@@ -9,6 +9,40 @@
  */
 import { createChildLogger } from './logger.js';
 const logger = createChildLogger({ component: 'websocket-connector' });
+/**
+ * Number of variants a CREATE_COMPONENT_SET request will produce:
+ * Mode B = componentIds.length; Mode A = the cartesian product of the
+ * property axes ({State:[a,b,c], Size:[s,l]} → 6).
+ */
+export function componentSetVariantCount(params) {
+    if (params.componentIds?.length)
+        return params.componentIds.length;
+    if (params.properties) {
+        let count = 1;
+        for (const values of Object.values(params.properties)) {
+            count *= Math.max(1, values?.length ?? 1);
+        }
+        return count;
+    }
+    return 1;
+}
+/**
+ * Server-hop timeout for CREATE_COMPONENT_SET, scaled by variant count.
+ * The plugin builds all variants in ONE uncancellable pass, so timing out
+ * early doesn't stop the work — it just makes the report contradict the
+ * file state (set gets created after the "failure") and invites duplicate
+ * retries. Budget ~1.2s per variant with a 30s floor and 120s cap, plus a
+ * 5s buffer over the ui.html hop (which uses the same base formula) so the
+ * plugin-side result or error always wins the race.
+ *
+ * NOTE: ui.html's CREATE_COMPONENT_SET route and
+ * cloud-websocket-connector.ts mirror the base formula — keep all three in
+ * sync.
+ */
+export function componentSetTimeoutMs(params) {
+    const count = componentSetVariantCount(params);
+    return Math.min(120000, Math.max(30000, count * 1200)) + 5000;
+}
 export class WebSocketConnector {
     constructor(wsServer) {
         this.wsServer = wsServer;
@@ -188,6 +222,14 @@ export class WebSocketConnector {
         }
         return this.wsServer.sendCommand('INSTANTIATE_COMPONENT', params);
     }
+    async createComponentSet(params) {
+        // Cloning + combining large variant matrices is slow on heavy components
+        // and the plugin-side pass is uncancellable — a fixed 30s ceiling made a
+        // 48-variant set REPORT failure while the plugin kept going and created
+        // the set anyway (retry → duplicates). Scale the timeout with variant
+        // count instead (precedent: the token-import create phase).
+        return this.wsServer.sendCommand('CREATE_COMPONENT_SET', params, componentSetTimeoutMs(params));
+    }
     // ============================================================================
     // Node manipulation
     // ============================================================================

package/dist/cloudflare/core/websocket-server.js

@@ -28,6 +28,41 @@ try {
 catch {
     // Non-critical — version will show as 0.0.0
 }
+/**
+ * Extract the PLUGIN_VERSION constant from figma-desktop-bridge/code.js source.
+ * Returns null when the constant is absent or malformed.
+ */
+export function parseBundledPluginVersion(codeJsSource) {
+    const match = codeJsSource.match(/var PLUGIN_VERSION\s*=\s*'(\d+\.\d+\.\d+)'/);
+    return match ? match[1] : null;
+}
+// The version of the plugin files THIS package ships — i.e. what a manifest
+// re-import would install. This is deliberately NOT the package version:
+// server-only releases (deps, docs, server code) bump package.json without
+// touching figma-desktop-bridge/, and comparing the plugin against
+// SERVER_VERSION would falsely nag users to re-import an already-current
+// plugin (seen live: plugin 1.33.0 + server 1.33.1 → spurious update banner).
+let BUNDLED_PLUGIN_VERSION = SERVER_VERSION;
+try {
+    const parsed = parseBundledPluginVersion(readFileSync(join(PACKAGE_ROOT, 'figma-desktop-bridge', 'code.js'), 'utf-8'));
+    if (parsed)
+        BUNDLED_PLUGIN_VERSION = parsed;
+}
+catch {
+    // Non-critical — fall back to SERVER_VERSION (pre-v1.33.2 behavior)
+}
+/** Version of the plugin files bundled with this server (what a re-import installs). */
+export function getBundledPluginVersion() {
+    return BUNDLED_PLUGIN_VERSION;
+}
+/**
+ * A plugin needs re-importing when it reports no version (predates version
+ * reporting) or a version different from the plugin files this server ships.
+ * The server's own package version is irrelevant here.
+ */
+export function computePluginUpdateAvailable(pluginVersion, bundledPluginVersion) {
+    return !pluginVersion || pluginVersion !== bundledPluginVersion;
+}
 const logger = createChildLogger({ component: 'websocket-server' });
 export class FigmaWebSocketServer extends EventEmitter {
     constructor(options) {
@@ -113,10 +148,12 @@ export class FigmaWebSocketServer extends EventEmitter {
                         // Mitigate Cross-Site WebSocket Hijacking (CSWSH):
                         // Reject connections from unexpected browser origins.
                         const origin = info.origin;
+                        // Exact match only — startsWith would let e.g.
+                        // https://www.figma.com.attacker.example through.
                         const allowed = !origin || // No origin — local process (e.g. Node.js client)
                             origin === 'null' || // Sandboxed iframe / Figma Desktop plugin UI
-                            origin.startsWith('https://www.figma.com') ||
-                            origin.startsWith('https://figma.com');
+                            origin === 'https://www.figma.com' ||
+                            origin === 'https://figma.com';
                         if (allowed) {
                             callback(true);
                         }
@@ -250,15 +287,35 @@ export class FigmaWebSocketServer extends EventEmitter {
         // Response to a command we sent
         if (message.id && this.pendingRequests.has(message.id)) {
             const pending = this.pendingRequests.get(message.id);
-            clearTimeout(pending.timeoutId);
-            this.pendingRequests.delete(message.id);
-            if (message.error) {
-                pending.reject(new Error(message.error));
+            // Verify the response arrived on the socket belonging to the file the
+            // command targeted — a matching id alone must not let a different
+            // client resolve (or spoof) another file's request.
+            const sender = this.findClientByWs(ws);
+            const socketVerified = sender
+                ? sender.fileKey === pending.targetFileKey
+                // Pre-identification socket (no FILE_INFO yet): only safe when it is
+                // unambiguous — exactly one socket connected to the server at all.
+                : (this.wss?.clients.size ?? 0) === 1;
+            if (!socketVerified) {
+                logger.warn({
+                    id: message.id,
+                    method: pending.method,
+                    senderFileKey: sender?.fileKey ?? null,
+                    targetFileKey: pending.targetFileKey,
+                }, 'Ignoring response from unexpected socket (id matched, sender did not) — treating as unsolicited');
+                // Leave the pending request in place; fall through to unsolicited handling.
             }
             else {
-                pending.resolve(message.result);
+                clearTimeout(pending.timeoutId);
+                this.pendingRequests.delete(message.id);
+                if (message.error) {
+                    pending.reject(new Error(message.error));
+                }
+                else {
+                    pending.resolve(message.result);
+                }
+                return;
             }
-            return;
         }
         // Unsolicited data from plugin (FILE_INFO, events, forwarded data)
         if (message.type) {
@@ -384,7 +441,15 @@ export class FigmaWebSocketServer extends EventEmitter {
             if (this._activeFileKey === previousEntry.fileKey) {
                 this._activeFileKey = null;
             }
+            // In-flight commands to the old file can never receive a response now —
+            // reject them immediately instead of leaving them to hang until timeout
+            // (mirrors the same-file replacement path below).
+            this.rejectPendingRequestsForFile(previousEntry.fileKey, 'Plugin switched files');
             logger.info({ oldFileKey: previousEntry.fileKey, newFileKey: fileKey }, 'WebSocket client switched files');
+            this.emit('fileDisconnected', {
+                fileKey: previousEntry.fileKey,
+                fileName: previousEntry.client.fileInfo.fileName,
+            });
         }
         // If same fileKey already connected with a DIFFERENT ws, clean up old connection
         const existing = this.clients.get(fileKey);
@@ -401,6 +466,30 @@ export class FigmaWebSocketServer extends EventEmitter {
                 existing.ws.close(1000, 'Replaced by same file reconnection');
             }
         }
+        // Version handshake: the plugin reports its code.js version in FILE_INFO.
+        // Figma caches plugin files at the app level, so a version mismatch means
+        // the user is running stale plugin code and must re-import manifest.json.
+        // A missing version means the plugin predates version reporting — also stale.
+        // Compared against the BUNDLED plugin version (what a re-import would
+        // install), NOT the server's package version — server-only releases don't
+        // change the plugin files, so they must not trigger the re-import banner.
+        const bundledPluginVersion = this.options.bundledPluginVersion ?? BUNDLED_PLUGIN_VERSION;
+        const pluginVersion = data.pluginVersion || null;
+        const pluginUpdateAvailable = computePluginUpdateAvailable(pluginVersion, bundledPluginVersion);
+        if (pluginUpdateAvailable) {
+            logger.warn({ fileKey, pluginVersion, bundledPluginVersion, serverVersion: SERVER_VERSION }, 'Imported plugin version differs from the plugin files bundled with this server — re-import manifest.json to update');
+            try {
+                ws.send(JSON.stringify({
+                    type: 'PLUGIN_UPDATE_AVAILABLE',
+                    serverVersion: SERVER_VERSION,
+                    bundledPluginVersion,
+                    pluginVersion,
+                }));
+            }
+            catch {
+                // Non-critical notification — never let it disrupt registration
+            }
+        }
         // Create client connection (preserve per-file state from previous connection of same file)
         this.clients.set(fileKey, {
             ws,
@@ -411,6 +500,8 @@ export class FigmaWebSocketServer extends EventEmitter {
                 currentPageId: data.currentPageId || null,
                 editorType: data.editorType || 'figma',
                 connectedAt: Date.now(),
+                pluginVersion,
+                pluginUpdateAvailable,
             },
             selection: existing?.selection || null,
             documentChanges: existing?.documentChanges || [],