figma-relai 0.7.11 → 0.8.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +6 -2
- package/dist/{chunk-5IKROMKE.js → chunk-62ZA4AUN.js} +912 -433
- package/dist/chunk-62ZA4AUN.js.map +1 -0
- package/dist/{chunk-VS2FNFYC.js → chunk-INWZM5QK.js} +2 -1
- package/dist/{doctor-MZDRG46R.js → doctor-NWSX36QP.js} +2 -2
- package/dist/index.js +519 -190
- package/dist/index.js.map +1 -1
- package/dist/{login-2B44IDGS.js → login-V4PWGEPJ.js} +2 -2
- package/dist/{manifest-TO6EQLRL.js → manifest-SP2IBSUR.js} +3 -3
- package/package.json +1 -1
- package/dist/chunk-5IKROMKE.js.map +0 -1
- /package/dist/{chunk-VS2FNFYC.js.map → chunk-INWZM5QK.js.map} +0 -0
- /package/dist/{doctor-MZDRG46R.js.map → doctor-NWSX36QP.js.map} +0 -0
- /package/dist/{login-2B44IDGS.js.map → login-V4PWGEPJ.js.map} +0 -0
- /package/dist/{manifest-TO6EQLRL.js.map → manifest-SP2IBSUR.js.map} +0 -0
package/README.md
CHANGED
|
@@ -142,6 +142,8 @@ Figma plugin executes Plugin API calls
|
|
|
142
142
|
|
|
143
143
|
The relay lives inside the MCP server, so there is no extra process to keep alive. When several MCP clients run at once, the first one hosts the relay and the others connect to it; if the host exits, a survivor takes over. Both sides remember their room, rejoin after restarts or sleep, and find each other without any copy-pasting. The `join_room` tool exists for one rare case only: two Figma files running the plugin at the same time.
|
|
144
144
|
|
|
145
|
+
Every write and every failure ends with a `[relai]` line that says whether Figma changed: `applied`, `not_applied`, or `unknown` — it may have, so read the canvas before trying again. Failures are marked as errors and name a code; scripts can read the same receipt from the result's `_meta`. With several files open, a call can carry `room` to go to one plugin, or `expect_file` to refuse unless the target file has that exact name. Text longer than 50,000 characters is cut before it reaches the AI, and the full text is saved on your machine in `~/.figma-relai/results/` (readable only by you, the newest 50 files, none kept longer than a day); the cut notice names the file.
|
|
146
|
+
|
|
145
147
|
The receipts above are real timings: rule checks run in the plugin before each write, small edits land sub-second, and the 45,509-node audit took 3.9s.
|
|
146
148
|
|
|
147
149
|
Ports are fixed by Figma's plugin sandbox: the manifest allowlists `ws://localhost:9055–9057`, and other ports cannot work without editing `manifest.json`. That's why there is no port setting in the UI.
|
|
@@ -201,13 +203,15 @@ Start with `npx figma-relai doctor` — one command that checks Node, the relay
|
|
|
201
203
|
|
|
202
204
|
**RELAY says LINK but AGENT says WAITING.** The plumbing is fine — the AI just hasn't called a Figma tool yet in this session. Ask it something about the file.
|
|
203
205
|
|
|
204
|
-
**"Multiple Figma plugins are connected."** Two files are running the plugin. Tell the AI to `join_room` with the room name shown in the plugin you want to control.
|
|
206
|
+
**"Multiple Figma plugins are connected."** Two files are running the plugin. Tell the AI to `join_room` with the room name shown in the plugin you want to control, or to pass `room` or `expect_file` on each call.
|
|
207
|
+
|
|
208
|
+
**`room_changed`.** The plugin moved to a different file — a branch, or another document — since the last call, so the call was not sent. Sending it again continues in the new file; `join_room` back if that is not the file you meant.
|
|
205
209
|
|
|
206
210
|
**The first `npx` run is slow.** It downloads the package once; later starts are fast.
|
|
207
211
|
|
|
208
212
|
## Security
|
|
209
213
|
|
|
210
|
-
The relay binds to `127.0.0.1` only and has no authentication: any process on your machine that can reach it can list the open rooms, with each room's file name, and join one. `execute_figma` runs AI-written code inside Figma's plugin sandbox; it is on by default, every run is visible in the activity feed, and the designer can disable it. Scripts are not atomic — a failed script's earlier changes persist. Full threat model: [SECURITY.md](SECURITY.md).
|
|
214
|
+
The relay binds to `127.0.0.1` only and has no authentication: any process on your machine that can reach it can list the open rooms, with each room's file name, and join one. It refuses connections from ordinary web pages, but that check narrows who can connect; it is not authentication. `execute_figma` runs AI-written code inside Figma's plugin sandbox; it is on by default, every run is visible in the activity feed, and the designer can disable it. Scripts are not atomic — a failed script's earlier changes persist. Full threat model: [SECURITY.md](SECURITY.md).
|
|
211
215
|
|
|
212
216
|
## For contributors
|
|
213
217
|
|