@radicool/throughline 0.21.1 → 0.21.3

package/README.md

@@ -73,7 +73,7 @@ Everything above was created during a single working session and synced directly
 
 | | |
 |---|---|
-| **A supported agent** | Required — [Claude Code](https://docs.claude.com/en/docs/claude-code) (native plugin), or **Cursor**, **Codex**, or any **AGENTS.md**-aware agent via `npx @radicool/throughline init`. |
+| **A supported agent** | Required — [Claude Code](https://docs.claude.com/en/docs/claude-code) (native plugin), or **Cursor**, **Codex**, or any **AGENTS.md**-aware agent via `npx @radicool/throughline@0.21.3 init`. |
 | **Figma** | Required, **desktop app** (the browser version causes connection errors). **Professional plan or higher recommended** — multi-mode variables (Light/Dark, brand themes) need it. |
 | **Figma access token** | Required — read/write your file. The setup skill walks you through it; your token stays yours and is never shared in chat. |
 | **GitHub** (or similar) | Optional — only when you're ready to graduate to a real remote repo with PRs and CI. |
@@ -82,7 +82,7 @@ Everything above was created during a single working session and synced directly
 
 ThroughLine runs one local server, and it doesn't upload anything itself.
 
-- **One local MCP server.** Installing the plugin registers [`figma-console-mcp`](https://www.npmjs.com/package/figma-console-mcp), pinned to version 1.40.8, which your agent starts on your computer with `npx`. It reaches the Figma desktop app through the Desktop Bridge plugin you run in Figma. That's how ThroughLine reads and writes your file. It reads your `FIGMA_ACCESS_TOKEN` from your environment for the Figma calls the bridge can't make.
+- **One local MCP server.** Installing the plugin registers [`figma-console-mcp`](https://www.npmjs.com/package/figma-console-mcp), pinned to version 1.40.8, which your agent starts on your computer with `npx`. It reaches the Figma desktop app through the Desktop Bridge plugin you run in Figma. That's how ThroughLine reads and writes your file. For the Figma calls the bridge can't make, it uses a Figma access token if you give it one. Claude Code asks for the token as a plugin setting and keeps it in your system's secure credential store. It's optional. The Cursor, Codex and generic installs read it from `FIGMA_ACCESS_TOKEN` instead.
 - **Files in your repo.** The skills write design-system files where you point them: token sources, the Style Dictionary build, components, stories, `design-system.json`, and the proof records in `design-system/proof/`. The helper scripts they install read and write local files and make no network calls.
 - **Chromatic, if you choose it.** Setting up Chromatic adds a CI workflow that uploads your Storybook to your Chromatic project, using a `CHROMATIC_PROJECT_TOKEN` you place yourself. Skip that step and nothing goes to Chromatic.
 
@@ -114,9 +114,9 @@ Update anytime with `/plugin marketplace update throughline-marketplace`.
 Run the installer in your project — it stamps in the skills, the reference docs, the scripts, and the Figma MCP config for your tool:
 
 ```
-npx @radicool/throughline init --target=cursor    # → .cursor/rules + .cursor/mcp.json
-npx @radicool/throughline init --target=codex      # → prompts/ + AGENTS.md index + codex-mcp.toml
-npx @radicool/throughline init --target=generic    # → skills/ + AGENTS.md index
+npx @radicool/throughline@0.21.3 init --target=cursor    # → .cursor/rules + .cursor/mcp.json
+npx @radicool/throughline@0.21.3 init --target=codex      # → prompts/ + AGENTS.md index + codex-mcp.toml
+npx @radicool/throughline@0.21.3 init --target=generic    # → skills/ + AGENTS.md index
 ```
 
 It's safe to re-run (it merges `AGENTS.md` and `.cursor/mcp.json` non-destructively) and stages everything the skills read into `.throughline/`. Then open the `figma-environment-setup` skill/rule/prompt for your tool to begin. For Codex, add the printed `codex-mcp.toml` block to your Codex config to enable Figma access.

package/adapters/codex/prompts/figma-environment-setup.md

@@ -272,11 +272,20 @@ them through it:
 
 **Secret-handling rule (non-negotiable):** the token value must never pass
 through the chat. Do not ask the user to paste it to you. Instead, tell them
-exactly where it goes (the plugin's MCP configuration expects it in an
-environment variable named `FIGMA_ACCESS_TOKEN`) and have them place it there
-themselves, following the plugin's setup notes. If they're unsure where that is,
-walk them to it, but you never see or handle the token. Reassure them this is
-normal and good — their password-like token stays theirs.
+exactly where it goes and have them place it there themselves:
+
+- **Installed as a plugin through `/plugin`:** run `/plugin`, open the
+  **Installed** tab, select ThroughLine, and choose **Configure options**. The
+  token goes in the **Figma access token** field, which masks it and keeps it in
+  the system's secure credential store. The plugin may already have asked for it
+  when it was first turned on. A `FIGMA_ACCESS_TOKEN` set in their shell is not
+  read in this case.
+- **Otherwise:** the MCP configuration reads it from an environment variable
+  named `FIGMA_ACCESS_TOKEN`; follow the setup notes for their agent.
+
+If they're unsure where that is, walk them to it, but you never see or handle
+the token. Reassure them this is normal and good — their password-like token
+stays theirs.
 
 ### 4c. Run the desktop bridge plugin and pair
 

package/adapters/cursor/.cursor/rules/figma-environment-setup.mdc

@@ -276,11 +276,20 @@ them through it:
 
 **Secret-handling rule (non-negotiable):** the token value must never pass
 through the chat. Do not ask the user to paste it to you. Instead, tell them
-exactly where it goes (the plugin's MCP configuration expects it in an
-environment variable named `FIGMA_ACCESS_TOKEN`) and have them place it there
-themselves, following the plugin's setup notes. If they're unsure where that is,
-walk them to it, but you never see or handle the token. Reassure them this is
-normal and good — their password-like token stays theirs.
+exactly where it goes and have them place it there themselves:
+
+- **Installed as a plugin through `/plugin`:** run `/plugin`, open the
+  **Installed** tab, select ThroughLine, and choose **Configure options**. The
+  token goes in the **Figma access token** field, which masks it and keeps it in
+  the system's secure credential store. The plugin may already have asked for it
+  when it was first turned on. A `FIGMA_ACCESS_TOKEN` set in their shell is not
+  read in this case.
+- **Otherwise:** the MCP configuration reads it from an environment variable
+  named `FIGMA_ACCESS_TOKEN`; follow the setup notes for their agent.
+
+If they're unsure where that is, walk them to it, but you never see or handle
+the token. Reassure them this is normal and good — their password-like token
+stays theirs.
 
 ### 4c. Run the desktop bridge plugin and pair
 

package/adapters/generic/skills/figma-environment-setup/SKILL.md

@@ -272,11 +272,20 @@ them through it:
 
 **Secret-handling rule (non-negotiable):** the token value must never pass
 through the chat. Do not ask the user to paste it to you. Instead, tell them
-exactly where it goes (the plugin's MCP configuration expects it in an
-environment variable named `FIGMA_ACCESS_TOKEN`) and have them place it there
-themselves, following the plugin's setup notes. If they're unsure where that is,
-walk them to it, but you never see or handle the token. Reassure them this is
-normal and good — their password-like token stays theirs.
+exactly where it goes and have them place it there themselves:
+
+- **Installed as a plugin through `/plugin`:** run `/plugin`, open the
+  **Installed** tab, select ThroughLine, and choose **Configure options**. The
+  token goes in the **Figma access token** field, which masks it and keeps it in
+  the system's secure credential store. The plugin may already have asked for it
+  when it was first turned on. A `FIGMA_ACCESS_TOKEN` set in their shell is not
+  read in this case.
+- **Otherwise:** the MCP configuration reads it from an environment variable
+  named `FIGMA_ACCESS_TOKEN`; follow the setup notes for their agent.
+
+If they're unsure where that is, walk them to it, but you never see or handle
+the token. Reassure them this is normal and good — their password-like token
+stays theirs.
 
 ### 4c. Run the desktop bridge plugin and pair
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@radicool/throughline",
-  "version": "0.21.1",
+  "version": "0.21.3",
   "description": "Build a complete design system end to end — author in Figma, sync tokens to code, generate Storybook. Usable from Claude Code, Cursor, Codex, or any AGENTS.md agent.",
   "type": "module",
   "bin": {

package/scripts/README.md

@@ -245,7 +245,7 @@ the committed `adapters/<target>/` tree plus the runtime payload
 (`references/` + `scripts/`, minus `scripts/adapters/`) into `.throughline/`,
 rewriting `${CLAUDE_PLUGIN_ROOT}` → `.throughline`:
 
-    npx @radicool/throughline init --target=cursor|codex|generic
+    npx @radicool/throughline@0.21.3 init --target=cursor|codex|generic
 
 See `scripts/install.mjs` (pure core + CLI + `install.test.mjs`).
 

package/scripts/adapters/read-sources.mjs

@@ -21,9 +21,15 @@ function readJson(path) {
   return JSON.parse(readFileSync(path, 'utf8'));
 }
 
+// `${user_config.KEY}` only resolves inside Claude Code; other agents read the
+// same value from the environment variable of the uppercased key.
+export function userConfigToEnv(text) {
+  return text.replace(/\$\{user_config\.([A-Za-z_][A-Za-z0-9_]*)\}/g, (_, key) => `\${${key.toUpperCase()}}`);
+}
+
 export function readSources(repoRoot) {
   const plugin = readJson(join(repoRoot, '.claude-plugin', 'plugin.json'));
-  const mcp = readJson(join(repoRoot, '.mcp.json'));
+  const mcp = JSON.parse(userConfigToEnv(readFileSync(join(repoRoot, '.mcp.json'), 'utf8')));
 
   const skillsDir = join(repoRoot, 'skills');
   const skills = readdirSync(skillsDir, { withFileTypes: true })