fix(agents): keep Figma REST design fields and branch keys - #1043
fix(agents): keep Figma REST design fields and branch keys#1043cursor[bot] wants to merge 5 commits into
Conversation
Cursor Cloud Agents cannot complete Figma MCP OAuth. Record the 401 challenge, the official Cloud-unsupported decision, and a REST FIGMA_ACCESS_TOKEN whoami helper that never prints the secret. Co-authored-by: Seongho Bae <seonghobae@users.noreply.github.com>
Semgrep p/default flagged urllib.request.urlopen in figma_rest_auth.py as dynamic-urllib-use-detected. Open api.figma.com over TLS with a literal host and path, and refuse any other URL. Co-authored-by: Seongho Bae <seonghobae@users.noreply.github.com>
Whoami alone does not read a Figma file. Add a pinned api.figma.com GET /v1/files helper with allowlisted keys and node ids, and record the operator path in ADR, changelog, and APA 7 doctoring so Cloud Agents can continue design-to-code. Co-authored-by: Seongho Bae <seonghobae@users.noreply.github.com>
Cloud Agent file read now returns geometry, solid fills, text, and auto-layout instead of name/type only, uses branch keys from branch URLs, accepts instance node ids, and stops claiming MCP-equivalent design-to-code. Co-authored-by: Seongho Bae <seonghobae@users.noreply.github.com>
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| connection = http.client.HTTPSConnection( | ||
| "api.figma.com", | ||
| timeout=REQUEST_TIMEOUT_SECONDS, | ||
| ) |
| connection = http.client.HTTPSConnection( | ||
| FIGMA_API_HOST, | ||
| timeout=REQUEST_TIMEOUT_SECONDS, | ||
| ) |
|
This branch is stale against current |
|
Closing as superseded by the current-head Figma REST/auth implementation in #1146, which consolidates the file/page loading, Cloud Agent auth fallback, design fields, and branch-key contract coverage. |
|
Superseded by #1146. |
|
Closing this stale Figma REST lane as superseded by current-main successor #1146. The successor retains component and component-set catalogs, style metadata, node style references, token-free output, design-to-code doctoring, and current-base verification. No predecessor check, review, approval, or auto-merge state transfers. |
3 participants
Summary
#1034 closed the whoami-only gap from #1028 by adding
figma_rest_file.py, then overclaimed the same way #1028 did: the default outline kept onlyid/name/type, so a Cloud Agent still could not implement a frame. This successor keeps the allowlisted REST path and fills the buyer-visible fields Figma already returns.outline_nodenow keepsabsoluteBoundingBox, SOLID fills, TEXTcharactersand type, auto-layout padding, and constraints./design/<file_key>/branch/<branch_key>/...) GET the branch key, not main.I12:34;56:78) are valid--node-idvalues andnodesmap keys.thumbnailUrl, bounded component/style names, and Figma/S3 image hosts pass through.get_design_context.Prefer this head over #1028, #1032, and #1034. Keep those draft or unmerged.
Developer experience
dynamic-urllib-use-detectedstays inapplicable (urllib.request.urlopenis not used).get_design_context), CWE-22/918, branch keys, and instance ids.User experience
FIGMA_ACCESS_TOKENis stored, runpython3 scripts/ci/figma_rest_auth.pythenpython3 scripts/ci/figma_rest_file.py '<figma-url>'.--imagesonly when a PNG preview is needed (URLs expire in 30 days).get_design_context, continue on Desktop/CLI Figma MCP Connect.Test plan
tests/test_figma_rest_auth.pyandtests/test_figma_rest_file.py— control-character tokens, branch URLs, instance ids, design fields, host allowlist, live unauthenticated/v1/meand/v1/filescoverage run -m pytest tests/test_figma_rest_auth.py tests/test_figma_rest_file.py(100% on both helpers)interrogate(100% on both helpers)FIGMA_ACCESS_TOKENis added, run the two helpers against a real file and a branch URL