@radicool/throughline 0.21.1 → 0.21.2

package/README.md

@@ -82,7 +82,7 @@ Everything above was created during a single working session and synced directly
 
 ThroughLine runs one local server, and it doesn't upload anything itself.
 
-- **One local MCP server.** Installing the plugin registers [`figma-console-mcp`](https://www.npmjs.com/package/figma-console-mcp), pinned to version 1.40.8, which your agent starts on your computer with `npx`. It reaches the Figma desktop app through the Desktop Bridge plugin you run in Figma. That's how ThroughLine reads and writes your file. It reads your `FIGMA_ACCESS_TOKEN` from your environment for the Figma calls the bridge can't make.
+- **One local MCP server.** Installing the plugin registers [`figma-console-mcp`](https://www.npmjs.com/package/figma-console-mcp), pinned to version 1.40.8, which your agent starts on your computer with `npx`. It reaches the Figma desktop app through the Desktop Bridge plugin you run in Figma. That's how ThroughLine reads and writes your file. For the Figma calls the bridge can't make, it uses a Figma access token if you give it one. Claude Code asks for the token as a plugin setting and keeps it in your system's secure credential store. It's optional. The Cursor, Codex and generic installs read it from `FIGMA_ACCESS_TOKEN` instead.
 - **Files in your repo.** The skills write design-system files where you point them: token sources, the Style Dictionary build, components, stories, `design-system.json`, and the proof records in `design-system/proof/`. The helper scripts they install read and write local files and make no network calls.
 - **Chromatic, if you choose it.** Setting up Chromatic adds a CI workflow that uploads your Storybook to your Chromatic project, using a `CHROMATIC_PROJECT_TOKEN` you place yourself. Skip that step and nothing goes to Chromatic.
 

package/adapters/codex/prompts/figma-environment-setup.md

@@ -272,11 +272,20 @@ them through it:
 
 **Secret-handling rule (non-negotiable):** the token value must never pass
 through the chat. Do not ask the user to paste it to you. Instead, tell them
-exactly where it goes (the plugin's MCP configuration expects it in an
-environment variable named `FIGMA_ACCESS_TOKEN`) and have them place it there
-themselves, following the plugin's setup notes. If they're unsure where that is,
-walk them to it, but you never see or handle the token. Reassure them this is
-normal and good — their password-like token stays theirs.
+exactly where it goes and have them place it there themselves:
+
+- **Installed as a plugin through `/plugin`:** run `/plugin`, open the
+  **Installed** tab, select ThroughLine, and choose **Configure options**. The
+  token goes in the **Figma access token** field, which masks it and keeps it in
+  the system's secure credential store. The plugin may already have asked for it
+  when it was first turned on. A `FIGMA_ACCESS_TOKEN` set in their shell is not
+  read in this case.
+- **Otherwise:** the MCP configuration reads it from an environment variable
+  named `FIGMA_ACCESS_TOKEN`; follow the setup notes for their agent.
+
+If they're unsure where that is, walk them to it, but you never see or handle
+the token. Reassure them this is normal and good — their password-like token
+stays theirs.
 
 ### 4c. Run the desktop bridge plugin and pair
 

package/adapters/cursor/.cursor/rules/figma-environment-setup.mdc

@@ -276,11 +276,20 @@ them through it:
 
 **Secret-handling rule (non-negotiable):** the token value must never pass
 through the chat. Do not ask the user to paste it to you. Instead, tell them
-exactly where it goes (the plugin's MCP configuration expects it in an
-environment variable named `FIGMA_ACCESS_TOKEN`) and have them place it there
-themselves, following the plugin's setup notes. If they're unsure where that is,
-walk them to it, but you never see or handle the token. Reassure them this is
-normal and good — their password-like token stays theirs.
+exactly where it goes and have them place it there themselves:
+
+- **Installed as a plugin through `/plugin`:** run `/plugin`, open the
+  **Installed** tab, select ThroughLine, and choose **Configure options**. The
+  token goes in the **Figma access token** field, which masks it and keeps it in
+  the system's secure credential store. The plugin may already have asked for it
+  when it was first turned on. A `FIGMA_ACCESS_TOKEN` set in their shell is not
+  read in this case.
+- **Otherwise:** the MCP configuration reads it from an environment variable
+  named `FIGMA_ACCESS_TOKEN`; follow the setup notes for their agent.
+
+If they're unsure where that is, walk them to it, but you never see or handle
+the token. Reassure them this is normal and good — their password-like token
+stays theirs.
 
 ### 4c. Run the desktop bridge plugin and pair
 

package/adapters/generic/skills/figma-environment-setup/SKILL.md

@@ -272,11 +272,20 @@ them through it:
 
 **Secret-handling rule (non-negotiable):** the token value must never pass
 through the chat. Do not ask the user to paste it to you. Instead, tell them
-exactly where it goes (the plugin's MCP configuration expects it in an
-environment variable named `FIGMA_ACCESS_TOKEN`) and have them place it there
-themselves, following the plugin's setup notes. If they're unsure where that is,
-walk them to it, but you never see or handle the token. Reassure them this is
-normal and good — their password-like token stays theirs.
+exactly where it goes and have them place it there themselves:
+
+- **Installed as a plugin through `/plugin`:** run `/plugin`, open the
+  **Installed** tab, select ThroughLine, and choose **Configure options**. The
+  token goes in the **Figma access token** field, which masks it and keeps it in
+  the system's secure credential store. The plugin may already have asked for it
+  when it was first turned on. A `FIGMA_ACCESS_TOKEN` set in their shell is not
+  read in this case.
+- **Otherwise:** the MCP configuration reads it from an environment variable
+  named `FIGMA_ACCESS_TOKEN`; follow the setup notes for their agent.
+
+If they're unsure where that is, walk them to it, but you never see or handle
+the token. Reassure them this is normal and good — their password-like token
+stays theirs.
 
 ### 4c. Run the desktop bridge plugin and pair
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@radicool/throughline",
-  "version": "0.21.1",
+  "version": "0.21.2",
   "description": "Build a complete design system end to end — author in Figma, sync tokens to code, generate Storybook. Usable from Claude Code, Cursor, Codex, or any AGENTS.md agent.",
   "type": "module",
   "bin": {

package/scripts/adapters/read-sources.mjs

@@ -21,9 +21,15 @@ function readJson(path) {
   return JSON.parse(readFileSync(path, 'utf8'));
 }
 
+// `${user_config.KEY}` only resolves inside Claude Code; other agents read the
+// same value from the environment variable of the uppercased key.
+export function userConfigToEnv(text) {
+  return text.replace(/\$\{user_config\.([A-Za-z_][A-Za-z0-9_]*)\}/g, (_, key) => `\${${key.toUpperCase()}}`);
+}
+
 export function readSources(repoRoot) {
   const plugin = readJson(join(repoRoot, '.claude-plugin', 'plugin.json'));
-  const mcp = readJson(join(repoRoot, '.mcp.json'));
+  const mcp = JSON.parse(userConfigToEnv(readFileSync(join(repoRoot, '.mcp.json'), 'utf8')));
 
   const skillsDir = join(repoRoot, 'skills');
   const skills = readdirSync(skillsDir, { withFileTypes: true })