threadfox-lite 0.2.2__tar.gz → 0.2.4__tar.gz

{threadfox_lite-0.2.2 → threadfox_lite-0.2.4}/.claude-plugin/marketplace.json

@@ -12,7 +12,7 @@
       "name": "threadfox-lite",
       "source": "./",
       "description": "Free, read-only Reddit tools: subreddit rules before you post, post status after, and the reddit-rules-first skill.",
-      "version": "0.2.2",
+      "version": "0.2.4",
       "category": "marketing",
       "homepage": "https://threadfox.vip"
     }

{threadfox_lite-0.2.2 → threadfox_lite-0.2.4}/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "threadfox-lite",
-  "version": "0.2.2",
+  "version": "0.2.4",
   "description": "Free, read-only Reddit tools: find communities where you may post, read their rules, check your account and whether a post stayed up, plus the reddit-rules-first skill.",
   "author": {
     "name": "ThreadFox (AMF Indiana)",

{threadfox_lite-0.2.2 → threadfox_lite-0.2.4}/LAUNCHGUIDE.md

@@ -11,7 +11,7 @@ This server (ThreadFox Lite) runs locally and gives every user four free, read-o
 Built from our own run: 978,227 recorded views from two days of posts (Sept 20-21 UTC), with no ad spend. That is our result, not a promise about yours. Made by AMF Indiana; not affiliated with Reddit, OpenAI or Anthropic.
 
 ## Setup Requirements
-MCP_LICENSE_KEY (optional): your MCP Marketplace license key. The read-only tools work without it. Requires uv (uvx), Python 3.10+, Node.js and Microsoft's Playwright Extension in the Chrome where you are signed in to Reddit.
+MCP_LICENSE_KEY (optional): your MCP Marketplace license key. The read-only tools work without it. Requires uv (uvx), Python 3.10+ and Microsoft's Playwright Extension in the Chrome where you are signed in to Reddit.
 
 ## Category
 Marketing

{threadfox_lite-0.2.2 → threadfox_lite-0.2.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: threadfox-lite
-Version: 0.2.2
+Version: 0.2.4
 Summary: Read a subreddit's rules and check whether a Reddit post is still up, from Claude Code, Codex or any MCP client. Free tools from ThreadFox.
 Project-URL: Homepage, https://threadfox.vip
 Project-URL: Source, https://github.com/amflimited/threadfox-lite
@@ -8,7 +8,7 @@ Author-email: "AMF Indiana (ThreadFox)" <support@threadfox.vip>
 License: MIT
 License-File: LICENSE
 Requires-Python: >=3.10
-Requires-Dist: mcp<2,>=1.23.0
+Requires-Dist: mcp<2,>=1.28.1
 Description-Content-Type: text/markdown
 
 # ThreadFox Lite
@@ -21,7 +21,7 @@ Free, read-only Reddit tools for Claude Desktop, Claude Code, Codex and any MCP
 - `post_status`: whether a post is still live, removed by moderators or deleted, with score and comments. Check at 1, 6 and 24 hours.
 - `threadfox_full_kit`: what the full ThreadFox kit adds (finding conversations where people ask for what you sell, posting from your own Chrome, replies, an outcome ledger, a 12-module course).
 
-**Reads only, through your own signed-in Chrome.** Reddit now sends every signed-out request, including its public JSON, to a login page, so ThreadFox Lite reads the way you do: in your Chrome, signed in as you, one small read at a time. It never posts, votes or changes anything, and needs no Reddit API keys. One-time setup: [Node.js](https://nodejs.org) and Microsoft's [Playwright Extension](https://chromewebstore.google.com/detail/playwright-extension/mmlmfjhmonkocbjadbfplnigmagldckm) in the Chrome where you are signed in to Reddit. The first read asks you to pick a tab in Chrome.
+**Reads only, through your own signed-in Chrome.** Reddit now sends every signed-out request, including its public JSON, to a login page, so ThreadFox Lite reads the way you do: in your Chrome, signed in as you, one small read at a time. It never posts, votes or changes anything, and needs no Reddit API keys. One-time setup: Microsoft's [Playwright Extension](https://chromewebstore.google.com/detail/playwright-extension/mmlmfjhmonkocbjadbfplnigmagldckm) in the Chrome where you are signed in to Reddit. Node.js is fetched for you if you don't have it (the official build from nodejs.org into `~/.threadfox/runtime`, checked against its published SHA-256; nothing installed system-wide). The first read asks you to pick a tab in Chrome.
 
 ## Install
 
@@ -34,7 +34,7 @@ Claude Code, the MCP server only:
 
     claude mcp add threadfox-lite -- uvx threadfox-lite
 
-Claude Desktop: download the `.mcpb` file from the [latest release](https://github.com/amflimited/threadfox-lite/releases/latest) and open it (Settings > Extensions). It needs [uv](https://docs.astral.sh/uv/) on your machine.
+Claude Desktop: download the `.mcpb` file from the [latest release](https://github.com/amflimited/threadfox-lite/releases/latest) and open it; if Windows asks which app should open it, choose Claude. Claude Desktop sets up Python for it by itself.
 
 Codex (`~/.codex/config.toml`):
 

{threadfox_lite-0.2.2 → threadfox_lite-0.2.4}/README.md

@@ -8,7 +8,7 @@ Free, read-only Reddit tools for Claude Desktop, Claude Code, Codex and any MCP
 - `post_status`: whether a post is still live, removed by moderators or deleted, with score and comments. Check at 1, 6 and 24 hours.
 - `threadfox_full_kit`: what the full ThreadFox kit adds (finding conversations where people ask for what you sell, posting from your own Chrome, replies, an outcome ledger, a 12-module course).
 
-**Reads only, through your own signed-in Chrome.** Reddit now sends every signed-out request, including its public JSON, to a login page, so ThreadFox Lite reads the way you do: in your Chrome, signed in as you, one small read at a time. It never posts, votes or changes anything, and needs no Reddit API keys. One-time setup: [Node.js](https://nodejs.org) and Microsoft's [Playwright Extension](https://chromewebstore.google.com/detail/playwright-extension/mmlmfjhmonkocbjadbfplnigmagldckm) in the Chrome where you are signed in to Reddit. The first read asks you to pick a tab in Chrome.
+**Reads only, through your own signed-in Chrome.** Reddit now sends every signed-out request, including its public JSON, to a login page, so ThreadFox Lite reads the way you do: in your Chrome, signed in as you, one small read at a time. It never posts, votes or changes anything, and needs no Reddit API keys. One-time setup: Microsoft's [Playwright Extension](https://chromewebstore.google.com/detail/playwright-extension/mmlmfjhmonkocbjadbfplnigmagldckm) in the Chrome where you are signed in to Reddit. Node.js is fetched for you if you don't have it (the official build from nodejs.org into `~/.threadfox/runtime`, checked against its published SHA-256; nothing installed system-wide). The first read asks you to pick a tab in Chrome.
 
 ## Install
 
@@ -21,7 +21,7 @@ Claude Code, the MCP server only:
 
     claude mcp add threadfox-lite -- uvx threadfox-lite
 
-Claude Desktop: download the `.mcpb` file from the [latest release](https://github.com/amflimited/threadfox-lite/releases/latest) and open it (Settings > Extensions). It needs [uv](https://docs.astral.sh/uv/) on your machine.
+Claude Desktop: download the `.mcpb` file from the [latest release](https://github.com/amflimited/threadfox-lite/releases/latest) and open it; if Windows asks which app should open it, choose Claude. Claude Desktop sets up Python for it by itself.
 
 Codex (`~/.codex/config.toml`):
 

{threadfox_lite-0.2.2 → threadfox_lite-0.2.4}/manifest.json

@@ -2,9 +2,9 @@
   "manifest_version": "0.4",
   "name": "threadfox-lite",
   "display_name": "ThreadFox Lite",
-  "version": "0.2.2",
+  "version": "0.2.4",
   "description": "Find subreddits where you may post, read their rules, check your account and whether a post stayed up. Free, read-only.",
-  "long_description": "Free, read-only Reddit tools for Claude and any MCP client. find_communities lists subreddits about a topic with their self-promotion rules flagged; subreddit_rules reads one community's rules, size and description; account_check reports an account's age, karma, standing and whether its recent posts are removed or hidden from search; post_status says whether a post is live, removed or deleted. Reddit now sends signed-out requests to a login page, so every read runs in your own Chrome, signed in as you, through Microsoft's Playwright Extension (needs Node.js and the extension; the first read asks you to pick a tab). Nothing is posted or changed. The full ThreadFox kit (finding conversations where people ask for what you sell, posting from your own Chrome, an outcome ledger, a 12-module course) is sold separately at https://threadfox.vip.",
+  "long_description": "Free, read-only Reddit tools for Claude and any MCP client. find_communities lists subreddits about a topic with their self-promotion rules flagged; subreddit_rules reads one community's rules, size and description; account_check reports an account's age, karma, standing and whether its recent posts are removed or hidden from search; post_status says whether a post is live, removed or deleted. Reddit now sends signed-out requests to a login page, so every read runs in your own Chrome, signed in as you, through Microsoft's Playwright Extension (needs only the extension: Node.js is fetched automatically when missing; the first read asks you to pick a tab). Nothing is posted or changed. The full ThreadFox kit (finding conversations where people ask for what you sell, posting from your own Chrome, an outcome ledger, a 12-module course) is sold separately at https://threadfox.vip.",
   "author": {
     "name": "AMF Indiana (ThreadFox)",
     "email": "support@threadfox.vip",

{threadfox_lite-0.2.2 → threadfox_lite-0.2.4}/pyproject.toml

@@ -1,12 +1,12 @@
 [project]
 name = "threadfox-lite"
-version = "0.2.2"
+version = "0.2.4"
 description = "Read a subreddit's rules and check whether a Reddit post is still up, from Claude Code, Codex or any MCP client. Free tools from ThreadFox."
 readme = "README.md"
 license = { text = "MIT" }
 requires-python = ">=3.10"
 authors = [{ name = "AMF Indiana (ThreadFox)", email = "support@threadfox.vip" }]
-dependencies = ["mcp>=1.23.0,<2"]
+dependencies = ["mcp>=1.28.1,<2"]
 
 [project.urls]
 Homepage = "https://threadfox.vip"

{threadfox_lite-0.2.2 → threadfox_lite-0.2.4}/server.json

@@ -3,7 +3,7 @@
   "name": "io.github.amflimited/threadfox-lite",
   "title": "ThreadFox Lite",
   "description": "Find subreddits you may post in, read their rules, check your account and posts. Free, read-only.",
-  "version": "0.2.2",
+  "version": "0.2.4",
   "websiteUrl": "https://threadfox.vip",
   "repository": {
     "url": "https://github.com/amflimited/threadfox-lite",
@@ -13,7 +13,7 @@
     {
       "registryType": "pypi",
       "identifier": "threadfox-lite",
-      "version": "0.2.2",
+      "version": "0.2.4",
       "runtimeHint": "uvx",
       "transport": {
         "type": "stdio"
@@ -21,7 +21,7 @@
     },
     {
       "registryType": "mcpb",
-      "identifier": "https://github.com/amflimited/threadfox-lite/releases/download/v0.2.2/threadfox-lite-0.2.2.mcpb",
+      "identifier": "https://github.com/amflimited/threadfox-lite/releases/download/v0.2.4/threadfox-lite-0.2.4.mcpb",
       "fileSha256": "0000000000000000000000000000000000000000000000000000000000000000",
       "transport": {
         "type": "stdio"

{threadfox_lite-0.2.2 → threadfox_lite-0.2.4}/src/threadfox_lite/__init__.py

@@ -1,2 +1,2 @@
 """ThreadFox Lite: free, read-only Reddit tools for AI agents."""
-__version__ = "0.2.2"
+__version__ = "0.2.4"

{threadfox_lite-0.2.2 → threadfox_lite-0.2.4}/src/threadfox_lite/browser.py

@@ -2,43 +2,27 @@
 
 Reddit now sends every signed-out request, including its public JSON, to a login page. So ThreadFox Lite reads
 the way you do: in your Chrome, signed in as you. It starts Microsoft's Playwright MCP server in extension mode
-(`npx @playwright/mcp --extension`, needs Node.js and the Playwright Extension in Chrome) and runs one small
-fetch of Reddit's JSON inside an old.reddit.com tab per read. Nothing is posted, voted or changed.
+(`npx @playwright/mcp --extension`; node.py fetches Node.js when none is installed, and you add the Playwright
+Extension to Chrome) and runs one small fetch of Reddit's JSON inside an old.reddit.com tab per read. Nothing is
+posted, voted or changed.
 """
 import atexit
-import glob
 import json
 import os
 import re
-import shutil
 import subprocess
 import threading
 import time
 
+from .node import SetupError, ensure_npx, find_npx  # noqa: F401  (find_npx and SetupError are part of this module's API)
+
 EXTENSION_URL = "https://chromewebstore.google.com/detail/playwright-extension/mmlmfjhmonkocbjadbfplnigmagldckm"
 SETUP = ("ThreadFox Lite reads Reddit through your own signed-in Chrome, because Reddit now asks everyone to sign in "
-         "before it shows anything. One-time setup: install Node.js (https://nodejs.org), add Microsoft's Playwright "
-         "Extension to Chrome (" + EXTENSION_URL + "), sign in to Reddit in that Chrome, then try again.")
+         "before it shows anything. One-time setup: add Microsoft's Playwright Extension to Chrome (" + EXTENSION_URL + "), "
+         "sign in to Reddit in that Chrome, then try again.")
 SPACING = 1.5   # seconds between reads, so the account is never rate-limited
 
 
-class SetupError(RuntimeError):
-    """The browser route is not ready; the message says what to do."""
-
-
-def find_npx():
-    """npx on PATH, or in the usual Node.js folders (apps started from the Dock or Start menu get a short PATH)."""
-    found = shutil.which("npx")
-    if found:
-        return found
-    home = os.path.expanduser("~")
-    candidates = ["/usr/local/bin/npx", "/opt/homebrew/bin/npx", os.path.join(home, ".volta", "bin", "npx")]
-    candidates += sorted(glob.glob(os.path.join(home, ".nvm", "versions", "node", "*", "bin", "npx")), reverse=True)
-    for base in filter(None, [os.environ.get("ProgramFiles"), os.environ.get("APPDATA")]):
-        candidates += [os.path.join(base, "nodejs", "npx.cmd"), os.path.join(base, "npm", "npx.cmd")]
-    return next((c for c in candidates if os.path.isfile(c)), None)
-
-
 class Chrome:
     """A Playwright MCP child process spoken to over newline-delimited JSON-RPC."""
 
@@ -57,9 +41,7 @@ class Chrome:
         cmd = list(self.command or [])
         env = dict(os.environ)
         if not cmd:
-            npx = find_npx()
-            if not npx:
-                raise SetupError(SETUP)
+            npx = ensure_npx()   # downloads the official Node.js once when none is installed; raises SetupError if it cannot
             cmd = [npx, "-y", "@playwright/mcp@latest", "--extension"]
             env["PATH"] = os.path.dirname(npx) + os.pathsep + env.get("PATH", "")
         self.proc = subprocess.Popen(cmd, stdin=subprocess.PIPE, stdout=subprocess.PIPE, stderr=subprocess.DEVNULL,

threadfox_lite-0.2.4/src/threadfox_lite/node.py

@@ -0,0 +1,187 @@
+"""Node.js for Playwright MCP, without asking the user to install it.
+
+ThreadFox Lite's reads run Microsoft's Playwright MCP (`npx @playwright/mcp`), which needs Node.js 18+. When no usable
+Node.js is installed, the official Node.js LTS is downloaded into ~/.threadfox/runtime, checked against the SHA-256
+nodejs.org publishes (pinned below) and used from there. Nothing is installed system-wide. The full ThreadFox kit uses
+the same folder, so the two share one copy.
+"""
+import glob
+import hashlib
+import os
+import platform
+import re
+import shutil
+import subprocess
+import tarfile
+import tempfile
+import threading
+import urllib.request
+import zipfile
+
+
+class SetupError(RuntimeError):
+    """The browser route is not ready; the message says what to do."""
+
+
+# The official Node.js LTS, fetched only when no Node.js 18+ is installed. SHA-256 values are copied from
+# https://nodejs.org/dist/v24.21.0/SHASUMS256.txt; a download that does not match is deleted unrun.
+NODE_VERSION = '24.21.0'
+NODE_SHA256 = {
+    'darwin-arm64.tar.xz': '6239d4cf92d864487ec8cd3615038f7b67e7f58b77b21cd2f09ea9fbd68065fe',
+    'darwin-x64.tar.xz': '0ae5a24c24bb7d015cd816c5036b3f90f2945aa872fcf54e58da054753b3a299',
+    'linux-arm64.tar.xz': '6ad1325edbdb5649c379b75a237147a666c95d4f9ae8d340fef2d1575d289ad2',
+    'linux-x64.tar.xz': 'fd8e59d5a511510f6a298afb548f18c7d2b1be404d8b4a27d94fbe49f56cb2d6',
+    'darwin-arm64.tar.gz': 'bed7eea5325e1108f32ce5228ddd6a5f0f08a499ee42aa7442aea583702f6057',
+    'darwin-x64.tar.gz': '1462cb3b3046b815cf8ea436d3da450ec1a9f11dac7e5a46b0ada5305d7e8097',
+    'linux-arm64.tar.gz': '724282c3b43aec998aa9527380465b45d229e021b58035f5f4f63095eabfe5d5',
+    'linux-x64.tar.gz': '6e1db87ef58b8819e5d5402eff1536491b18edd8eb7bee5ef7897876e88dc5ff',
+    'win-arm64.zip': '8779b1bde1d39f8d420e3b57aa657b39891af434d3de44a919044cec06785921',
+    'win-x64.zip': '158f7685b44de51f6c0df1d153526cbcd3e1bc739a8dfc607721cef75de9e541',
+}
+NODE_BASE_URL = 'https://nodejs.org/dist'
+_node_lock = threading.Lock()
+
+
+def node_platform():
+    """('darwin'|'linux'|'win', 'arm64'|'x64'), with None for a platform nodejs.org has no build for."""
+    system = {'Darwin': 'darwin', 'Linux': 'linux', 'Windows': 'win'}.get(platform.system())
+    machine = platform.machine().lower()
+    arch = 'arm64' if machine in ('arm64', 'aarch64') else 'x64' if machine in ('x86_64', 'amd64', 'x64') else None
+    return system, arch
+
+
+def runtime_dirs():
+    """Where ThreadFox keeps its portable Node.js: THREADFOX_HOME or ~/.threadfox, shared with the full kit."""
+    home = os.environ.get('THREADFOX_HOME') or os.path.join(os.path.expanduser('~'), '.threadfox')
+    return [os.path.join(home, 'runtime')]
+
+
+def portable_npx():
+    system, arch = node_platform()
+    name = f'node-v{NODE_VERSION}-{system}-{arch}'
+    for base in runtime_dirs():
+        exe = os.path.join(base, name, 'npx.cmd') if system == 'win' else os.path.join(base, name, 'bin', 'npx')
+        if os.path.isfile(exe):
+            return exe
+    return None
+
+
+def find_npx():
+    """ThreadFox's own portable Node.js, then npx on PATH, then the usual Node.js install folders. Apps started from the
+    Dock or Start menu (Claude Desktop) often get a shorter PATH than a terminal, so a working install can be invisible to them."""
+    found = portable_npx() or shutil.which('npx')
+    if found:
+        return found
+    home = os.path.expanduser('~')
+    candidates = ['/usr/local/bin/npx', '/opt/homebrew/bin/npx', os.path.join(home, '.volta', 'bin', 'npx')]
+    candidates += sorted(glob.glob(os.path.join(home, '.nvm', 'versions', 'node', '*', 'bin', 'npx')), reverse=True)
+    candidates += sorted(glob.glob(os.path.join(home, '.fnm', 'node-versions', '*', 'installation', 'bin', 'npx')), reverse=True)
+    for base in filter(None, [os.environ.get('ProgramFiles'), os.environ.get('ProgramFiles(x86)'), os.environ.get('APPDATA')]):
+        candidates += [os.path.join(base, 'nodejs', 'npx.cmd'), os.path.join(base, 'npm', 'npx.cmd')]
+    return next((c for c in candidates if os.path.isfile(c)), None)
+
+
+def node_major(npx):
+    """The major version of the node that sits next to this npx, or None when it cannot be asked."""
+    folder = os.path.dirname(npx)
+    node = next((c for c in (os.path.join(folder, 'node.exe'), os.path.join(folder, 'node')) if os.path.isfile(c)), None) or shutil.which('node')
+    try:
+        out = subprocess.run([node, '--version'], capture_output=True, text=True, timeout=15).stdout if node else ''
+    except (OSError, subprocess.SubprocessError):
+        return None
+    m = re.match(r'v(\d+)\.', out.strip())
+    return int(m.group(1)) if m else None
+
+
+def _download(url, dest):
+    """curl where it exists (every current macOS, Windows 10+ and most Linux): it uses the system's certificates, which some
+    Python builds on macOS cannot find. Python's own client otherwise."""
+    curl = shutil.which('curl')
+    if curl:
+        done = subprocess.run([curl, '-fsSL', '--retry', '2', '--connect-timeout', '20', '-o', dest, url],
+                              stdin=subprocess.DEVNULL, capture_output=True, text=True)
+        if done.returncode == 0:
+            return
+    with urllib.request.urlopen(url, timeout=60) as r, open(dest, 'wb') as f:
+        shutil.copyfileobj(r, f, 1 << 20)
+
+
+def _extract(archive, dest):
+    if archive.endswith('.zip'):
+        with zipfile.ZipFile(archive) as z:
+            z.extractall(dest)  # zipfile drops absolute paths and '..'
+        return
+    with tarfile.open(archive) as t:
+        if hasattr(tarfile, 'data_filter'):
+            t.extractall(dest, filter='data')
+            return
+        root = os.path.realpath(dest)
+        for m in t.getmembers():
+            target = os.path.realpath(os.path.join(dest, m.name))
+            link = os.path.realpath(os.path.join(os.path.dirname(target), m.linkname)) if m.issym() or m.islnk() else target
+            if not (target + os.sep).startswith(root + os.sep) or not (link + os.sep).startswith(root + os.sep) or m.isdev():
+                raise SetupError('The Node.js archive contains an unexpected path, so it was not unpacked.')
+        t.extractall(dest)
+
+
+def install_node():
+    """Download the official Node.js LTS into ThreadFox's runtime folder, check its SHA-256 before unpacking, and return its npx.
+    Nothing is installed system-wide and no installer runs; deleting the folder removes it."""
+    with _node_lock:
+        if portable_npx():
+            return portable_npx()
+        system, arch = node_platform()
+        ext = 'zip' if system == 'win' else 'tar.xz'
+        if ext == 'tar.xz':
+            try:
+                import lzma  # noqa: F401  (some Python builds leave it out; .tar.gz is twice the size but always readable)
+            except ImportError:
+                ext = 'tar.gz'
+        key = f'{system}-{arch}.{ext}'
+        if key not in NODE_SHA256:
+            raise SetupError(f'ThreadFox has no portable Node.js for {platform.system()} {platform.machine()}. '
+                               'Install Node.js 18+ from https://nodejs.org, then quit and reopen your AI app.')
+        name = f'node-v{NODE_VERSION}-{system}-{arch}'
+        runtime = runtime_dirs()[0]
+        os.makedirs(runtime, exist_ok=True)
+        work = tempfile.mkdtemp(prefix='.node-', dir=runtime)
+        try:
+            archive = os.path.join(work, name + '.' + ext)
+            try:
+                _download(f'{NODE_BASE_URL}/v{NODE_VERSION}/{name}.{ext}', archive)
+            except OSError as exc:
+                raise SetupError(f'Node.js could not be downloaded from nodejs.org ({exc}). Check the internet connection and try again, '
+                                   'or install Node.js 18+ from https://nodejs.org.')
+            digest = hashlib.sha256()
+            with open(archive, 'rb') as f:
+                for chunk in iter(lambda: f.read(1 << 20), b''):
+                    digest.update(chunk)
+            if digest.hexdigest() != NODE_SHA256[key]:
+                raise SetupError('The Node.js download did not match the checksum nodejs.org publishes, so it was deleted without '
+                                   'running. Try again, or install Node.js 18+ from https://nodejs.org.')
+            try:
+                _extract(archive, work)
+            except (tarfile.TarError, zipfile.BadZipFile, EOFError) as exc:
+                raise SetupError(f'The Node.js archive could not be unpacked safely ({exc}). Try again, or install Node.js 18+ from https://nodejs.org.')
+            final = os.path.join(runtime, name)
+            if os.path.isdir(final):
+                shutil.rmtree(final)
+            os.replace(os.path.join(work, name), final)
+        finally:
+            shutil.rmtree(work, ignore_errors=True)
+        exe = portable_npx()
+        if not exe:
+            raise SetupError('Node.js was unpacked but npx is missing. Install Node.js 18+ from https://nodejs.org.')
+        return exe
+
+
+def ensure_npx(install=True):
+    """An npx whose Node.js is 18 or newer: an installed one when it qualifies, otherwise ThreadFox's portable copy."""
+    exe = find_npx()
+    if exe and exe != portable_npx():
+        major = node_major(exe)
+        if major is None or major < 18:
+            exe = None  # Playwright MCP needs a Node.js 18+ that runs; an old or broken one is left alone and not used
+    if exe or not install:
+        return exe
+    return install_node()

{threadfox_lite-0.2.2 → threadfox_lite-0.2.4}/src/threadfox_lite/server.py

@@ -5,17 +5,19 @@ which tells a paying customer how to open the full ThreadFox kit (posting from y
 the outcome ledger and the course). The full kit is sold at https://threadfox.vip and on MCP Marketplace.
 """
 import os
+import threading
 
 from mcp.server.fastmcp import FastMCP
 
-from . import reddit
+from . import node, reddit
 
 from . import __version__
 
 mcp = FastMCP("threadfox-lite", instructions=(
     "Free, read-only Reddit tools. find_communities and subreddit_rules before writing a post, account_check before posting "
     "from an account, post_status at 1, 6 and 24 hours. Every read runs in the user's own signed-in Chrome; if a tool returns "
-    "setup steps (Node.js and the Playwright Extension), relay them plainly and stop. Nothing here posts or changes anything."))
+    "setup steps (the Playwright Extension in Chrome), relay them plainly and stop. Node.js is fetched automatically when missing. "
+    "Nothing here posts or changes anything."))
 mcp._mcp_server.version = __version__   # report ThreadFox Lite's version, not the MCP library's
 
 
@@ -65,7 +67,17 @@ def threadfox_full_kit() -> dict:
             "get_it": "https://threadfox.vip ($49 once, 30-day refund) or ThreadFox on MCP Marketplace"}
 
 
+def _prefetch_node():
+    """Fetch Node.js in the background at start when none is usable, so the first read does not wait for it."""
+    try:
+        if not os.environ.get("THREADFOX_LITE_BROWSER_CMD"):
+            node.ensure_npx()
+    except Exception:
+        pass   # the first read reports the reason
+
+
 def main():
+    threading.Thread(target=_prefetch_node, daemon=True).start()
     mcp.run()
 
 

threadfox_lite-0.2.4/tests/test_node.py

@@ -0,0 +1,57 @@
+"""No Node.js installed: the official Node.js LTS is downloaded once, checked against its pinned SHA-256, and used."""
+import hashlib, io, os, sys, tarfile, tempfile, unittest
+from pathlib import Path
+from unittest.mock import patch
+sys.path.insert(0, str(Path(__file__).resolve().parents[1] / "src"))
+from threadfox_lite import node
+
+NAME = f"node-v{node.NODE_VERSION}-linux-x64"
+
+
+class PortableNode(unittest.TestCase):
+    def setUp(self):
+        self.tmp = tempfile.TemporaryDirectory(); root = Path(self.tmp.name)
+        self.home = root / "home"; self.dist = root / "dist" / f"v{node.NODE_VERSION}"; self.dist.mkdir(parents=True)
+        for p in (patch.dict(os.environ, {"THREADFOX_HOME": str(self.home)}), patch.object(node, "NODE_BASE_URL", (root / "dist").as_uri()),
+                  patch.object(node, "node_platform", return_value=("linux", "x64"))):
+            p.start(); self.addCleanup(p.stop)
+
+    def tearDown(self):
+        self.tmp.cleanup()
+
+    def publish(self, members):
+        archive = self.dist / f"{NAME}.tar.xz"
+        with tarfile.open(archive, "w:xz") as tar:
+            for name, data in members:
+                info = tarfile.TarInfo(name); info.size = len(data); info.mode = 0o755
+                tar.addfile(info, io.BytesIO(data))
+        return hashlib.sha256(archive.read_bytes()).hexdigest()
+
+    def test_downloads_checks_and_unpacks_once(self):
+        digest = self.publish([(f"{NAME}/bin/node", b"#!/bin/sh\n"), (f"{NAME}/bin/npx", b"#!/bin/sh\n")])
+        with patch.dict(node.NODE_SHA256, {"linux-x64.tar.xz": digest}):
+            npx = node.install_node()
+            self.assertEqual(npx, str(self.home / "runtime" / NAME / "bin" / "npx"))
+            (self.dist / f"{NAME}.tar.xz").unlink()
+            self.assertEqual(node.install_node(), npx)
+        self.assertEqual(os.listdir(self.home / "runtime"), [NAME])
+
+    def test_a_mismatched_download_is_deleted_unrun(self):
+        self.publish([(f"{NAME}/bin/npx", b"tampered")])
+        with patch.dict(node.NODE_SHA256, {"linux-x64.tar.xz": "0" * 64}):
+            with self.assertRaisesRegex(node.SetupError, "checksum"):
+                node.install_node()
+        self.assertEqual(os.listdir(self.home / "runtime"), [])
+
+    def test_an_old_or_broken_installed_node_is_not_used(self):
+        with patch.object(node, "find_npx", return_value="/usr/bin/npx"), patch.object(node, "install_node", return_value="PORTABLE"):
+            with patch.object(node, "node_major", return_value=16):
+                self.assertEqual(node.ensure_npx(), "PORTABLE")
+            with patch.object(node, "node_major", return_value=None):
+                self.assertEqual(node.ensure_npx(), "PORTABLE")
+            with patch.object(node, "node_major", return_value=22):
+                self.assertEqual(node.ensure_npx(), "/usr/bin/npx")
+
+
+if __name__ == "__main__":
+    unittest.main()

{threadfox_lite-0.2.2 → threadfox_lite-0.2.4}/tests/test_reddit.py

@@ -103,7 +103,7 @@ class Setup(unittest.TestCase):
             raise browser.SetupError(browser.SETUP)
         for r in (reddit.subreddit_rules("SaaS", get=get), reddit.account_check("someone", get=get),
                   reddit.post_status("https://www.reddit.com/r/SaaS/comments/abc123/t/", get=get), reddit.find_communities("bakery", get=get)):
-            self.assertIn("Playwright Extension", r["error"]); self.assertIn("nodejs.org", r["error"])
+            self.assertIn("Playwright Extension", r["error"]); self.assertNotIn("install Node.js", r["error"])
 
     def test_chrome_client_reads_through_a_playwright_mcp(self):
         """The real client against a stand-in Playwright MCP that answers the way the real one formats results."""

{threadfox_lite-0.2.2 → threadfox_lite-0.2.4}/uv.lock

@@ -859,14 +859,14 @@ wheels = [
 
 [[package]]
 name = "threadfox-lite"
-version = "0.2.2"
+version = "0.2.4"
 source = { editable = "." }
 dependencies = [
     { name = "mcp" },
 ]
 
 [package.metadata]
-requires-dist = [{ name = "mcp", specifier = ">=1.23.0,<2" }]
+requires-dist = [{ name = "mcp", specifier = ">=1.28.1,<2" }]
 
 [[package]]
 name = "typing-extensions"