fix(agents): keep Figma REST design fields and branch keys - #1043
Draft
cursor[bot] wants to merge 5 commits into
Draft
fix(agents): keep Figma REST design fields and branch keys#1043cursor[bot] wants to merge 5 commits into
cursor[bot] wants to merge 5 commits into
Conversation
Cursor Cloud Agents cannot complete Figma MCP OAuth. Record the 401 challenge, the official Cloud-unsupported decision, and a REST FIGMA_ACCESS_TOKEN whoami helper that never prints the secret. Co-authored-by: Seongho Bae <seonghobae@users.noreply.github.com>
Semgrep p/default flagged urllib.request.urlopen in figma_rest_auth.py as dynamic-urllib-use-detected. Open api.figma.com over TLS with a literal host and path, and refuse any other URL. Co-authored-by: Seongho Bae <seonghobae@users.noreply.github.com>
Whoami alone does not read a Figma file. Add a pinned api.figma.com GET /v1/files helper with allowlisted keys and node ids, and record the operator path in ADR, changelog, and APA 7 doctoring so Cloud Agents can continue design-to-code. Co-authored-by: Seongho Bae <seonghobae@users.noreply.github.com>
Cloud Agent file read now returns geometry, solid fills, text, and auto-layout instead of name/type only, uses branch keys from branch URLs, accepts instance node ids, and stops claiming MCP-equivalent design-to-code. Co-authored-by: Seongho Bae <seonghobae@users.noreply.github.com>
5 tasks
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
Comment on lines
+120
to
+123
| connection = http.client.HTTPSConnection( | ||
| "api.figma.com", | ||
| timeout=REQUEST_TIMEOUT_SECONDS, | ||
| ) |
Comment on lines
+208
to
+211
| connection = http.client.HTTPSConnection( | ||
| FIGMA_API_HOST, | ||
| timeout=REQUEST_TIMEOUT_SECONDS, | ||
| ) |
Contributor
|
This branch is stale against current |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
#1034 closed the whoami-only gap from #1028 by adding
figma_rest_file.py, then overclaimed the same way #1028 did: the default outline kept onlyid/name/type, so a Cloud Agent still could not implement a frame. This successor keeps the allowlisted REST path and fills the buyer-visible fields Figma already returns.outline_nodenow keepsabsoluteBoundingBox, SOLID fills, TEXTcharactersand type, auto-layout padding, and constraints./design/<file_key>/branch/<branch_key>/...) GET the branch key, not main.I12:34;56:78) are valid--node-idvalues andnodesmap keys.thumbnailUrl, bounded component/style names, and Figma/S3 image hosts pass through.get_design_context.Prefer this head over #1028, #1032, and #1034. Keep those draft or unmerged.
Developer experience
dynamic-urllib-use-detectedstays inapplicable (urllib.request.urlopenis not used).get_design_context), CWE-22/918, branch keys, and instance ids.User experience
FIGMA_ACCESS_TOKENis stored, runpython3 scripts/ci/figma_rest_auth.pythenpython3 scripts/ci/figma_rest_file.py '<figma-url>'.--imagesonly when a PNG preview is needed (URLs expire in 30 days).get_design_context, continue on Desktop/CLI Figma MCP Connect.Test plan
tests/test_figma_rest_auth.pyandtests/test_figma_rest_file.py— control-character tokens, branch URLs, instance ids, design fields, host allowlist, live unauthenticated/v1/meand/v1/filescoverage run -m pytest tests/test_figma_rest_auth.py tests/test_figma_rest_file.py(100% on both helpers)interrogate(100% on both helpers)FIGMA_ACCESS_TOKENis added, run the two helpers against a real file and a branch URL