figma-relai 0.5.0 → 0.5.2

package/README.md

@@ -83,7 +83,7 @@ file       precedent attached — "…is on purpose" · the edit backs off
 
 The panel's Memory row lists every entry; delete any of them any time. Nothing is recorded silently.
 
-**Kits.** One designer usually runs one product, and its files share the same law. Save this file’s rules under a name and other files can follow it. Figma drops file-carried law on branch merges; a followed kit puts it back — one click, or automatically if you flip that kit’s auto-restore on.
+**Kits.** One designer usually runs one product, and its files share the same law. Save this file’s rules under a name and other files can use it. Figma drops file-carried law on branch merges; the kit puts it back — one click, or automatically if you flip that kit’s auto-restore on.
 
 **AI no-go zones** fence off whole pages — brand masters, legal, the one that is already pixel-perfect. Writes into a guarded page are rejected before they run, with the reason on the receipt, and only you edit the guard list.
 

package/dist/chunk-6ABTHOFJ.js

@@ -0,0 +1,106 @@
+#!/usr/bin/env node
+
+// src/state.ts
+import { mkdirSync, readFileSync, writeFileSync } from "fs";
+import { homedir } from "os";
+import { join } from "path";
+function stateDir() {
+  return process.env.FIGMA_RELAI_STATE_DIR ?? join(homedir(), ".figma-relai");
+}
+function statePath() {
+  return join(stateDir(), "state.json");
+}
+function loadState() {
+  try {
+    return JSON.parse(readFileSync(statePath(), "utf8"));
+  } catch {
+    return {};
+  }
+}
+function saveState(patch) {
+  try {
+    mkdirSync(stateDir(), { recursive: true });
+    const next = { ...loadState(), ...patch, updatedAt: (/* @__PURE__ */ new Date()).toISOString() };
+    writeFileSync(statePath(), JSON.stringify(next, null, 2) + "\n");
+  } catch {
+  }
+}
+
+// src/credentials.ts
+import { chmodSync, mkdirSync as mkdirSync2, readFileSync as readFileSync2, rmSync, writeFileSync as writeFileSync2 } from "fs";
+import { join as join2 } from "path";
+function credentialsPath() {
+  return join2(stateDir(), "credentials.json");
+}
+function readFile() {
+  try {
+    return JSON.parse(readFileSync2(credentialsPath(), "utf8"));
+  } catch {
+    return {};
+  }
+}
+function loadToken() {
+  const fromEnv = process.env.FIGMA_TOKEN?.trim();
+  if (fromEnv) return fromEnv;
+  const fromFile = readFile().token?.trim();
+  return fromFile || void 0;
+}
+function tokenSource() {
+  if (process.env.FIGMA_TOKEN?.trim()) return "env";
+  if (readFile().token?.trim()) return "file";
+  return null;
+}
+function saveToken(token) {
+  const dir = stateDir();
+  mkdirSync2(dir, { recursive: true });
+  try {
+    chmodSync(dir, 448);
+  } catch {
+  }
+  const path = credentialsPath();
+  writeFileSync2(path, JSON.stringify({ token, savedAt: (/* @__PURE__ */ new Date()).toISOString() }, null, 2) + "\n", {
+    mode: 384
+  });
+  try {
+    chmodSync(path, 384);
+  } catch {
+  }
+  return path;
+}
+function clearToken() {
+  try {
+    rmSync(credentialsPath());
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function verifyToken(token) {
+  try {
+    const res = await fetch("https://api.figma.com/v1/me", {
+      headers: { "X-Figma-Token": token }
+    });
+    if (res.status === 403 || res.status === 401) {
+      return { ok: false, reason: "Figma rejected the token (401/403) \u2014 check it was copied whole." };
+    }
+    if (!res.ok) {
+      return { ok: false, reason: `Figma answered ${res.status} ${res.statusText}.` };
+    }
+    const me = await res.json();
+    return { ok: true, handle: me.handle ?? "(unknown)", email: me.email };
+  } catch (err) {
+    return { ok: false, reason: `Could not reach api.figma.com: ${err.message}` };
+  }
+}
+
+export {
+  loadState,
+  saveState,
+  credentialsPath,
+  loadToken,
+  tokenSource,
+  saveToken,
+  clearToken,
+  verifyToken
+};
+//# sourceMappingURL=chunk-6ABTHOFJ.js.map

package/dist/chunk-6ABTHOFJ.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/state.ts","../src/credentials.ts"],"sourcesContent":["import { mkdirSync, readFileSync, writeFileSync } from \"node:fs\";\nimport { homedir } from \"node:os\";\nimport { join } from \"node:path\";\n\n// Persisted pairing state so the AI reconnects to the same room across\n// sessions without the designer re-pasting a join command.\n\nexport interface RelaiState {\n  room?: string;\n  updatedAt?: string;\n}\n\nexport function stateDir(): string {\n  return process.env.FIGMA_RELAI_STATE_DIR ?? join(homedir(), \".figma-relai\");\n}\n\nfunction statePath(): string {\n  return join(stateDir(), \"state.json\");\n}\n\nexport function loadState(): RelaiState {\n  try {\n    return JSON.parse(readFileSync(statePath(), \"utf8\")) as RelaiState;\n  } catch {\n    return {};\n  }\n}\n\nexport function saveState(patch: Partial<RelaiState>): void {\n  try {\n    mkdirSync(stateDir(), { recursive: true });\n    const next = { ...loadState(), ...patch, updatedAt: new Date().toISOString() };\n    writeFileSync(statePath(), JSON.stringify(next, null, 2) + \"\\n\");\n  } catch {\n    // State persistence is best-effort; pairing still works via list_rooms\n  }\n}\n","import { chmodSync, mkdirSync, readFileSync, rmSync, writeFileSync } from \"node:fs\";\nimport { stateDir } from \"./state.js\";\nimport { join } from \"node:path\";\n\n// A Figma personal access token is account-wide and long-lived, so it never\n// travels the relay socket — the plugin has no business holding it. It lives\n// either in the MCP config env or in a 0600 file this process owns, and both\n// are read here so every consumer resolves it the same way.\n\nexport type TokenSource = \"env\" | \"file\" | null;\n\ninterface CredentialsFile {\n  token?: string;\n  savedAt?: string;\n}\n\nexport function credentialsPath(): string {\n  return join(stateDir(), \"credentials.json\");\n}\n\nfunction readFile(): CredentialsFile {\n  try {\n    return JSON.parse(readFileSync(credentialsPath(), \"utf8\")) as CredentialsFile;\n  } catch {\n    return {};\n  }\n}\n\n/** env wins over the stored file so a per-project override stays possible. */\nexport function loadToken(): string | undefined {\n  const fromEnv = process.env.FIGMA_TOKEN?.trim();\n  if (fromEnv) return fromEnv;\n  const fromFile = readFile().token?.trim();\n  return fromFile || undefined;\n}\n\nexport function tokenSource(): TokenSource {\n  if (process.env.FIGMA_TOKEN?.trim()) return \"env\";\n  if (readFile().token?.trim()) return \"file\";\n  return null;\n}\n\nexport function saveToken(token: string): string {\n  const dir = stateDir();\n  mkdirSync(dir, { recursive: true });\n  try {\n    chmodSync(dir, 0o700);\n  } catch {\n    // Directory permissions are best-effort (Windows, exotic filesystems)\n  }\n  const path = credentialsPath();\n  // Create with the restrictive mode rather than widening then narrowing:\n  // an 0644 window, however brief, is a window.\n  writeFileSync(path, JSON.stringify({ token, savedAt: new Date().toISOString() }, null, 2) + \"\\n\", {\n    mode: 0o600,\n  });\n  try {\n    chmodSync(path, 0o600);\n  } catch {\n    // Pre-existing file may keep its mode on some platforms; reported by doctor\n  }\n  return path;\n}\n\nexport function clearToken(): boolean {\n  try {\n    rmSync(credentialsPath());\n    return true;\n  } catch {\n    return false;\n  }\n}\n\n/** Confirms the token is live and tells the caller whose it is. */\nexport async function verifyToken(\n  token: string\n): Promise<{ ok: true; handle: string; email?: string } | { ok: false; reason: string }> {\n  try {\n    const res = await fetch(\"https://api.figma.com/v1/me\", {\n      headers: { \"X-Figma-Token\": token },\n    });\n    if (res.status === 403 || res.status === 401) {\n      return { ok: false, reason: \"Figma rejected the token (401/403) — check it was copied whole.\" };\n    }\n    if (!res.ok) {\n      return { ok: false, reason: `Figma answered ${res.status} ${res.statusText}.` };\n    }\n    const me = (await res.json()) as { handle?: string; email?: string };\n    return { ok: true, handle: me.handle ?? \"(unknown)\", email: me.email };\n  } catch (err) {\n    return { ok: false, reason: `Could not reach api.figma.com: ${(err as Error).message}` };\n  }\n}\n"],"mappings":";;;AAAA,SAAS,WAAW,cAAc,qBAAqB;AACvD,SAAS,eAAe;AACxB,SAAS,YAAY;AAUd,SAAS,WAAmB;AACjC,SAAO,QAAQ,IAAI,yBAAyB,KAAK,QAAQ,GAAG,cAAc;AAC5E;AAEA,SAAS,YAAoB;AAC3B,SAAO,KAAK,SAAS,GAAG,YAAY;AACtC;AAEO,SAAS,YAAwB;AACtC,MAAI;AACF,WAAO,KAAK,MAAM,aAAa,UAAU,GAAG,MAAM,CAAC;AAAA,EACrD,QAAQ;AACN,WAAO,CAAC;AAAA,EACV;AACF;AAEO,SAAS,UAAU,OAAkC;AAC1D,MAAI;AACF,cAAU,SAAS,GAAG,EAAE,WAAW,KAAK,CAAC;AACzC,UAAM,OAAO,EAAE,GAAG,UAAU,GAAG,GAAG,OAAO,YAAW,oBAAI,KAAK,GAAE,YAAY,EAAE;AAC7E,kBAAc,UAAU,GAAG,KAAK,UAAU,MAAM,MAAM,CAAC,IAAI,IAAI;AAAA,EACjE,QAAQ;AAAA,EAER;AACF;;;ACpCA,SAAS,WAAW,aAAAA,YAAW,gBAAAC,eAAc,QAAQ,iBAAAC,sBAAqB;AAE1E,SAAS,QAAAC,aAAY;AAcd,SAAS,kBAA0B;AACxC,SAAOA,MAAK,SAAS,GAAG,kBAAkB;AAC5C;AAEA,SAAS,WAA4B;AACnC,MAAI;AACF,WAAO,KAAK,MAAMC,cAAa,gBAAgB,GAAG,MAAM,CAAC;AAAA,EAC3D,QAAQ;AACN,WAAO,CAAC;AAAA,EACV;AACF;AAGO,SAAS,YAAgC;AAC9C,QAAM,UAAU,QAAQ,IAAI,aAAa,KAAK;AAC9C,MAAI,QAAS,QAAO;AACpB,QAAM,WAAW,SAAS,EAAE,OAAO,KAAK;AACxC,SAAO,YAAY;AACrB;AAEO,SAAS,cAA2B;AACzC,MAAI,QAAQ,IAAI,aAAa,KAAK,EAAG,QAAO;AAC5C,MAAI,SAAS,EAAE,OAAO,KAAK,EAAG,QAAO;AACrC,SAAO;AACT;AAEO,SAAS,UAAU,OAAuB;AAC/C,QAAM,MAAM,SAAS;AACrB,EAAAC,WAAU,KAAK,EAAE,WAAW,KAAK,CAAC;AAClC,MAAI;AACF,cAAU,KAAK,GAAK;AAAA,EACtB,QAAQ;AAAA,EAER;AACA,QAAM,OAAO,gBAAgB;AAG7B,EAAAC,eAAc,MAAM,KAAK,UAAU,EAAE,OAAO,UAAS,oBAAI,KAAK,GAAE,YAAY,EAAE,GAAG,MAAM,CAAC,IAAI,MAAM;AAAA,IAChG,MAAM;AAAA,EACR,CAAC;AACD,MAAI;AACF,cAAU,MAAM,GAAK;AAAA,EACvB,QAAQ;AAAA,EAER;AACA,SAAO;AACT;AAEO,SAAS,aAAsB;AACpC,MAAI;AACF,WAAO,gBAAgB,CAAC;AACxB,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAGA,eAAsB,YACpB,OACuF;AACvF,MAAI;AACF,UAAM,MAAM,MAAM,MAAM,+BAA+B;AAAA,MACrD,SAAS,EAAE,iBAAiB,MAAM;AAAA,IACpC,CAAC;AACD,QAAI,IAAI,WAAW,OAAO,IAAI,WAAW,KAAK;AAC5C,aAAO,EAAE,IAAI,OAAO,QAAQ,uEAAkE;AAAA,IAChG;AACA,QAAI,CAAC,IAAI,IAAI;AACX,aAAO,EAAE,IAAI,OAAO,QAAQ,kBAAkB,IAAI,MAAM,IAAI,IAAI,UAAU,IAAI;AAAA,IAChF;AACA,UAAM,KAAM,MAAM,IAAI,KAAK;AAC3B,WAAO,EAAE,IAAI,MAAM,QAAQ,GAAG,UAAU,aAAa,OAAO,GAAG,MAAM;AAAA,EACvE,SAAS,KAAK;AACZ,WAAO,EAAE,IAAI,OAAO,QAAQ,kCAAmC,IAAc,OAAO,GAAG;AAAA,EACzF;AACF;","names":["mkdirSync","readFileSync","writeFileSync","join","readFileSync","mkdirSync","writeFileSync"]}

package/dist/{chunk-2MSOOX4G.js → chunk-7KACLWNP.js}

@@ -2,6 +2,9 @@
 import {
   loadUserSkills
 } from "./chunk-SDINVROO.js";
+import {
+  loadToken
+} from "./chunk-6ABTHOFJ.js";
 import {
   __export
 } from "./chunk-2H7UOFLK.js";
@@ -12,7 +15,7 @@ function createServer() {
   return new McpServer(
     {
       name: "Relai",
-      version: "0.5.0"
+      version: "0.5.2"
     },
     {
       instructions: `
@@ -515,10 +518,12 @@ var RelayCore = class {
   staleTimer = null;
   version;
   log;
+  features;
   constructor(options = {}) {
     this.version = options.version ?? "unknown";
     this.log = options.log ?? (() => {
     });
+    this.features = options.features ?? null;
   }
   handleOpen(ws) {
     this.lastActivity.set(ws, Date.now());
@@ -534,9 +539,21 @@ var RelayCore = class {
       return;
     }
     switch (data.type) {
-      case "hello":
-        this.send(ws, { type: "hello", server: "figma-relai", version: this.version });
+      case "hello": {
+        const hello = {
+          type: "hello",
+          server: "figma-relai",
+          version: this.version
+        };
+        if (this.features) {
+          try {
+            hello.features = this.features();
+          } catch {
+          }
+        }
+        this.send(ws, hello);
         return;
+      }
       case "join": {
         const room = data.room;
         if (!room || typeof room !== "string") {
@@ -1747,10 +1764,10 @@ function register15(server, sendCommand) {
       unresolved: z16.boolean().optional().describe("list: only unresolved threads")
     },
     async ({ action, fileUrl, message, commentId, nodeId, x, y, since, unresolved }) => {
-      const token = process.env.FIGMA_TOKEN;
+      const token = loadToken();
       if (!token) {
         return textResult(
-          'Comments need a Figma personal access token. Generate one at figma.com \u2192 Settings \u2192 Security \u2192 Personal access tokens (enable comment scopes), then add it to the MCP config: "env": { "FIGMA_TOKEN": "figd_..." } and restart. Everything else works without it.'
+          'Comments need a Figma personal access token. Generate one at figma.com \u2192 Settings \u2192 Security \u2192 Personal access tokens (enable comment scopes), then store it with `npx figma-relai login` (it is verified and written to ~/.figma-relai/credentials.json, mode 0600). An MCP config "env": { "FIGMA_TOKEN": "figd_..." } still works and takes precedence. Everything else works without it.'
         );
       }
       try {
@@ -1922,10 +1939,10 @@ function register16(server, sendCommand) {
   );
 }
 async function fetchLibraryCatalog(libraryFileUrl) {
-  const token = process.env.FIGMA_TOKEN;
+  const token = loadToken();
   if (!token) {
     return {
-      note: "Full library catalogs need a FIGMA_TOKEN env var (personal access token, file read scope). Without it, components the file already uses are still listed above \u2014 or keep a 'DS palette' page with one instance of each key component so they show up there."
+      note: "Full library catalogs need a personal access token (file content read scope): store it once with `npx figma-relai login`, or set FIGMA_TOKEN in the MCP config env. Without it, components the file already uses are still listed above \u2014 or keep a 'DS palette' page with one instance of each key component so they show up there."
     };
   }
   const fileKey = parseFileKey(libraryFileUrl);
@@ -3870,4 +3887,4 @@ export {
   listToolCatalog,
   registerPrompts
 };
-//# sourceMappingURL=chunk-2MSOOX4G.js.map
+//# sourceMappingURL=chunk-7KACLWNP.js.map