feat: route plugin external fetches (probe + models) through CORS proxy ai-assistant-fig.dynv6.net; bump 0.1.17

package.json

@@ -1,6 +1,6 @@
 {
   "name": "figma-ai-plugin",
-  "version": "0.1.16",
+  "version": "0.1.17",
   "private": true,
   "dependencies": {
     "@create-figma-plugin/ui": "^4.0.3",

src/main.ts

@@ -1,10 +1,19 @@
 import { emit, on, showUI } from '@create-figma-plugin/utilities'
 
+// CORS proxy (dev). Figma plugin has origin:null, so direct calls to APIs without
+// Access-Control-Allow-Origin fail. Route external requests through this proxy, which
+// adds `Access-Control-Allow-Origin: *`. Target host must be in the proxy allowlist
+// (api.apinex.bond, apinex.bond, example.com) — no token needed for those.
+const CORS_PROXY = 'https://ai-assistant-fig.dynv6.net/proxy'
+function viaProxy (target: string): string {
+  return CORS_PROXY + '?url=' + encodeURIComponent(target)
+}
+
 // Probe whether the plugin sandbox can reach the public internet.
 // Used on plugin open (so the user sees network status immediately) and before each model fetch.
 async function probeConnectivity () {
   try {
-    const pr = await fetch('https://example.com')
+    const pr = await fetch(viaProxy('https://example.com'))
     emit('PROBE_RESULT', { msg: 'example.com reachable · status=' + pr.status })
   } catch (pe) {
     emit('PROBE_RESULT', { msg: 'example.com UNREACHABLE · ' + (pe != null ? (typeof pe === 'string' ? pe : JSON.stringify(pe)) : 'unknown') })
@@ -529,7 +538,7 @@ export default function () {
         .replace(/^@url:\s*/i, '')    // drop '@url:' annotation if pasted from chat
         .trim()
         .replace(/\/+$/, '')          // drop trailing slashes
-      const res = await fetch(base + '/models', {
+      const res = await fetch(viaProxy(base + '/models'), {
         headers: { Authorization: 'Bearer ' + payload.apiKey }
       })
       const raw = await res.text()

src/ui.tsx

@@ -30,7 +30,7 @@ const MIN_WINDOW_SIZE = { width: 320, height: 200 }
 // very high — actual clamp is done by main via clampWindowSize (bounds*zoom).
 
 // Full plugin version shown in the footer status bar. Keep in sync with package.json "version".
-const PLUGIN_VERSION = '0.1.16'
+const PLUGIN_VERSION = '0.1.17'
 
 const fieldStyle = {
   display: 'flex',