sassymcp 1.12.0__tar.gz

sassymcp-1.12.0/.claude/scheduled_tasks.lock

@@ -0,0 +1 @@
+{"sessionId":"c893b31e-4d63-4157-b42d-1247cac71aec","pid":21192,"acquiredAt":1782209316903}

sassymcp-1.12.0/.claude/skills/sassymcp-shell.md

@@ -0,0 +1,36 @@
+---
+name: sassymcp-shell
+description: Use BEFORE calling sassy_shell, sassy_session_start, or sassy_session_send on a SassyMCP server. Establishes that the default shell is Windows PowerShell so commands are written in PowerShell syntax on the first try (no wasted retries on bash idioms). Also use when generating multi-line scripts to a SassyMCP target.
+---
+
+# SassyMCP Shell Context
+
+The SassyMCP server runs on **Windows**. `sassy_shell` defaults to `shell="powershell"`. Write commands in PowerShell syntax up front — don't reach for bash habits unless you've explicitly switched to `shell="wsl"` or `shell="cmd"`.
+
+## Quick translation
+
+| bash / POSIX | PowerShell |
+|---|---|
+| `cd /d V:\foo` | `Set-Location V:\foo` |
+| `cmd1 && cmd2` | `cmd1; cmd2` (or `if ($?) { cmd2 }`) |
+| `cmd1 \|\| cmd2` | `if (-not $?) { cmd2 }` |
+| `mkdir -p foo/bar` | `New-Item -ItemType Directory -Force foo/bar` |
+| `cat foo` | `Get-Content foo` |
+| `grep pat foo` | `Select-String pat foo` |
+| `which X` | `Get-Command X` |
+| `export FOO=bar` | `$env:FOO = "bar"` |
+| `ls -la` | `Get-ChildItem -Force` |
+| `rm -rf …` | intercepted — use `sassy_safe_delete` |
+| escape with `\` | escape with backtick `` ` `` |
+
+`sassy_shell` auto-rewrites `&&` → `;` and `cd /d` → `Set-Location` for the PowerShell shell, but writing it correctly the first time saves a round-trip.
+
+## Multi-line scripts and file content
+
+- Don't try to embed multi-line PowerShell or here-strings inside a single `sassy_shell` argument — quoting collapses, and `Set-Content @'...'@` content gets keyword-scanned even when it's just data.
+- **Use `sassy_write_file(path, content)` instead** — direct .NET write, bypasses all PowerShell quoting and the shell-keyword scanner. Then invoke the resulting file with `sassy_shell`.
+
+## When to switch shells
+
+- `shell="cmd"`: `.bat` files, `tasklist`/`taskkill`, legacy CMD-only builtins.
+- `shell="wsl"`: real bash — `grep`/`awk`/`sed` pipelines, Linux-native tools, anything where PowerShell equivalents are awkward. WSL receives the command verbatim, no PowerShell rewriting.

sassymcp-1.12.0/.claude/skills/sassymcp-update.md

@@ -0,0 +1,65 @@
+---
+name: sassymcp-update
+description: Use when the user wants to check, review, or apply a SassyMCP update — e.g. "is there a new version of sassymcp?", "update sassymcp", "what changed in the latest sassymcp release?", "show the sassymcp changelog". Walks through Kali-style apt-update / apt-show / apt-upgrade against this server's GitHub Releases (or the license-gated sassyconsultingllc.com endpoint when SASSYMCP_LICENSE_KEY is set). Never auto-installs — surfaces the asset, downloads to staging, and hands the user the run command.
+---
+
+# SassyMCP Update Walkthrough
+
+This skill walks through the four updater tools added in v1.3.0:
+
+| Step | Tool | apt analogue |
+|---|---|---|
+| 1 | `sassy_update_check` | `apt update` — refresh remote state |
+| 2 | `sassy_update_changelog` | `apt show <pkg>` — read release notes |
+| 3 | `sassy_update_list` | `apt list --upgradable` — see assets |
+| 4 | `sassy_update_apply` | `apt upgrade` (download phase) — stage the install |
+
+## When to invoke
+
+Trigger when the user asks anything like:
+- "check for sassymcp updates"
+- "is there a new version?"
+- "what's in the latest release?"
+- "update sassymcp" / "upgrade sassymcp"
+- "show me the changelog"
+- "download the new MSI"
+
+## Workflow
+
+1. **Call `sassy_update_check`** with `force=False` (cached, 5 min TTL).
+   - If `upgradable: false` — tell the user they're on the latest, stop.
+   - If `upgradable: true` — surface the `summary` field (e.g. `1.2.0 → 1.3.0 available`).
+
+2. **Call `sassy_update_changelog`** with no `tag` (defaults to latest).
+   - Show the user the `name`, `published_at`, and `body` so they know what's
+     in the release before downloading 100+ MB.
+
+3. **Ask the user which asset they want**:
+   - Portable zip (`sassymcp-v*-portable.zip`, ~123 MB) — exe + tools + launchers.
+     Extract anywhere; delete the folder to remove. **Recommended.**
+   - Standalone exe (`sassymcp.exe`, ~35 MB) — no bundled tools.
+   - Or skip — they read the changelog and don't want to upgrade right now.
+
+4. **Call `sassy_update_apply`** with the chosen `asset_name`.
+   - Returns `downloaded_to` (a path under `%LOCALAPPDATA%\SassyMCP\updates\`)
+     and `next_step` — for a portable zip this is an `Expand-Archive`
+     command targeting `%LOCALAPPDATA%\SassyMCP\<tag>\`; for the standalone
+     exe it's the path to the exe.
+   - Echo the `next_step` to the user verbatim — **do not** auto-execute it.
+     Updates apply on next launch; this is an explicit user action by design.
+
+## License-aware download
+
+If the env var `SASSYMCP_LICENSE_KEY` is set, `sassy_update_apply`
+automatically rewrites the download URL to the gated
+`https://sassyconsultingllc.com/download/sassymcp/windows/<asset>?key=...`
+endpoint. The user gets the same file from the licensed mirror instead of
+public GitHub Releases.
+
+## What this skill does NOT do
+
+- **Never auto-runs the installer.** UAC + user intent. Always returns the
+  command for the user to run themselves.
+- **Never modifies the running server.** Update applies on next launch.
+- **Never blocks a downgrade.** If the user passes an older `tag` to
+  `sassy_update_apply`, that's their call.

sassymcp-1.12.0/.gitattributes

@@ -0,0 +1,6 @@
+# Shell scripts must stay LF — a CRLF shebang breaks them on macOS/Linux.
+*.sh text eol=lf
+
+# Windows batch/PowerShell scripts use CRLF.
+*.bat text eol=crlf
+*.ps1 text eol=crlf

sassymcp-1.12.0/.github/ISSUE_TEMPLATE/bug_report.md

@@ -0,0 +1,40 @@
+<!--
+   Copyright (c) 2026 Shane Smith / Sassy Consulting LLC. All rights reserved.
+   Proprietary source. This notice is Copyright Management Information (17 U.S.C. 1202); removal or alteration prohibited.
+   CodeMark: SCLLC1-SassyMCP-Q3OSLI6ULAIQ
+-->
+---
+name: Bug Report
+about: Something isn't working right
+title: "[Bug] "
+labels: bug
+assignees: ''
+---
+
+**What happened?**
+A clear description of the bug.
+
+**Steps to reproduce**
+1.
+2.
+3.
+
+**Expected behavior**
+What should have happened.
+
+**Environment**
+- SassyMCP version: v1.1.0
+- MCP client: (Claude Desktop / Grok Desktop / Cursor / other)
+- Transport mode: (stdio / HTTP / SSE)
+- Windows version:
+- Running from: (exe / source)
+
+**Relevant logs**
+Paste any error output or server logs here.
+
+```
+(paste logs here)
+```
+
+**Screenshots**
+If applicable, add screenshots.

sassymcp-1.12.0/.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,8 @@
+# Copyright (c) 2026 Shane Smith / Sassy Consulting LLC. All rights reserved.
+# Proprietary source. This notice is Copyright Management Information (17 U.S.C. 1202); removal or alteration prohibited.
+# CodeMark: SCLLC1-SassyMCP-TBNJIBENT44G
+blank_issues_enabled: true
+contact_links:
+  - name: Documentation
+    url: https://github.com/sassyconsultingllc/SassyMCP#readme
+    about: Check the README for setup and usage guides

sassymcp-1.12.0/.github/ISSUE_TEMPLATE/feature_request.md

@@ -0,0 +1,24 @@
+<!--
+   Copyright (c) 2026 Shane Smith / Sassy Consulting LLC. All rights reserved.
+   Proprietary source. This notice is Copyright Management Information (17 U.S.C. 1202); removal or alteration prohibited.
+   CodeMark: SCLLC1-SassyMCP-O3YBHELD3QCV
+-->
+---
+name: Feature Request
+about: Suggest a new tool or improvement
+title: "[Feature] "
+labels: enhancement
+assignees: ''
+---
+
+**What would you like?**
+A clear description of the feature or improvement.
+
+**Why?**
+What problem does this solve or what workflow does it enable?
+
+**Which module would this belong to?**
+(e.g., core, android, system, github, new module)
+
+**Alternatives considered**
+Any workarounds you've tried or other approaches.

sassymcp-1.12.0/.github/workflows/release.yml

@@ -0,0 +1,415 @@
+# Copyright (c) 2026 Shane Smith / Sassy Consulting LLC. All rights reserved.
+# Proprietary source. This notice is Copyright Management Information (17 U.S.C. 1202); removal or alteration prohibited.
+# CodeMark: SCLLC1-SassyMCP-G725NZONYF5R
+name: Release
+
+on:
+  push:
+    tags:
+      - "v*.*.*"
+  workflow_dispatch:
+    # Allow manual builds against any branch without tagging. The build jobs
+    # produce artifacts; the release/publish jobs only fire on real tag pushes.
+
+permissions:
+  contents: write   # needed for gh release create
+
+env:
+  # Opt in to Node 24 for all JavaScript actions in this workflow. Github
+  # deprecated Node 20 in Sept 2025; node24 becomes the default June 2026.
+  # Setting this now silences the warnings and confirms forward-compat.
+  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
+
+jobs:
+  build-exe:
+    name: Build sassymcp.exe (Windows)
+    runs-on: windows-latest
+    defaults:
+      run:
+        shell: pwsh   # windows-latest defaults to pwsh; making it explicit
+    outputs:
+      version: ${{ steps.version.outputs.value }}
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.11"
+          cache: pip
+
+      - name: Read version from sassymcp/__init__.py
+        id: version
+        run: |
+          $content = Get-Content sassymcp/__init__.py -Raw
+          if ($content -match '__version__\s*=\s*"([^"]+)"') {
+            $v = $Matches[1]
+            "value=$v" | Out-File -FilePath $env:GITHUB_OUTPUT -Append
+            Write-Host "Version: $v"
+          } else {
+            Write-Error "Could not parse __version__"
+            exit 1
+          }
+
+      - name: Verify tag matches __version__
+        if: startsWith(github.ref, 'refs/tags/')
+        run: |
+          $tagVersion = "${{ github.ref_name }}".TrimStart("v")
+          $sourceVersion = "${{ steps.version.outputs.value }}"
+          if ($tagVersion -ne $sourceVersion) {
+            Write-Error "Tag $tagVersion does not match __version__ $sourceVersion. Bump sassymcp/__init__.py before tagging."
+            exit 1
+          }
+
+      - name: Install dependencies + PyInstaller
+        # Install base deps only — the [all] extras (playwright,
+        # pytesseract, watchdog) are lazy-imported with graceful
+        # fallbacks, so excluding them keeps the shipped exe at ~35 MB
+        # instead of ~73 MB. Users who need OCR or playwright
+        # screenshots install those into their own Python.
+        run: |
+          python -m pip install --upgrade pip
+          python -m pip install pyinstaller
+          python -m pip install -e .
+
+      - name: Build sassymcp.exe via PyInstaller
+        run: |
+          pyinstaller --clean --noconfirm sassymcp.spec
+
+      - name: Verify exe exists
+        run: |
+          if (-not (Test-Path dist\sassymcp.exe)) {
+            Write-Error "PyInstaller did not produce dist\sassymcp.exe"
+            exit 1
+          }
+          $size = (Get-Item dist\sassymcp.exe).Length / 1MB
+          Write-Host "Built dist\sassymcp.exe ($([math]::Round($size, 1)) MB)"
+
+      - name: Smoke-test exe
+        run: |
+          # argparse exits 0 after printing --help, which is the success signal.
+          $output = & .\dist\sassymcp.exe --help 2>&1
+          if ($LASTEXITCODE -ne 0) {
+            Write-Error "sassymcp.exe --help exited $LASTEXITCODE; output: $output"
+            exit 1
+          }
+
+      - name: Upload exe artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: sassymcp-exe
+          path: dist/sassymcp.exe
+          if-no-files-found: error
+
+  build-dxt:
+    name: Build sassymcp.dxt
+    runs-on: windows-latest
+    needs: build-exe
+    defaults:
+      run:
+        shell: pwsh
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "20"
+
+      - name: Download exe artifact
+        uses: actions/download-artifact@v4
+        with:
+          name: sassymcp-exe
+          path: .
+
+      - name: Build MCPB (+ byte-identical .dxt)
+        # build-mcpb.ps1 packs the bundle via the official @anthropic-ai/mcpb
+        # CLI (needs npx, hence setup-node above) and emits BOTH dist\*.mcpb and
+        # a byte-identical dist\*.dxt. It auto-syncs mcpb/manifest.json's version
+        # to sassymcp/__init__.py. Renamed from the old build-dxt.ps1 (now in
+        # scripts/_DELETE_/), which this job still referenced — so every release
+        # since the rename failed at "scripts/build-dxt.ps1 not recognized".
+        run: |
+          & scripts/build-mcpb.ps1
+
+      - name: Verify DXT exists
+        run: |
+          $dxt = Get-ChildItem dist\sassymcp-v*.dxt | Select-Object -First 1
+          if (-not $dxt) {
+            Write-Error "build-dxt.ps1 did not produce a DXT file"
+            exit 1
+          }
+          Write-Host "Built $($dxt.Name) ($([math]::Round($dxt.Length / 1MB, 1)) MB)"
+
+      - name: Upload DXT artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: sassymcp-dxt
+          path: dist/sassymcp-v*.dxt
+          if-no-files-found: error
+
+  build-vsix:
+    name: Build sassymcp-vscode-*.vsix
+    runs-on: ubuntu-latest
+    # No `needs:` — the VSIX doesn't depend on the .exe artifact. Build in
+    # parallel with build-exe to shave a few minutes off the pipeline.
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "20"
+          cache: npm
+          cache-dependency-path: sassymcp-vscode/package-lock.json
+
+      - name: Sync sassymcp-vscode/package.json version with __init__.py
+        # The package.json version drives the produced .vsix filename. Keep
+        # it locked to the canonical __version__ so the VSIX, the DXT, and
+        # the GitHub release tag all carry the same string.
+        run: |
+          set -euo pipefail
+          version=$(python3 -c 'import re,sys; m=re.search(r"__version__\s*=\s*\"([^\"]+)\"", open("sassymcp/__init__.py").read()); print(m.group(1)) if m else sys.exit("could not parse __version__")')
+          echo "Syncing sassymcp-vscode/package.json to version $version"
+          # Update only the top-level "version" field. jq preserves formatting
+          # well enough for our purposes; install jq if not present (it is on
+          # ubuntu-latest by default but be explicit).
+          which jq >/dev/null || sudo apt-get update && sudo apt-get install -y jq
+          tmp=$(mktemp)
+          jq --arg v "$version" '.version = $v' sassymcp-vscode/package.json > "$tmp"
+          mv "$tmp" sassymcp-vscode/package.json
+          # Show the change for the run log
+          grep '"version"' sassymcp-vscode/package.json | head -1
+
+      - name: Install extension dependencies
+        working-directory: sassymcp-vscode
+        run: npm ci
+
+      - name: Compile TypeScript
+        working-directory: sassymcp-vscode
+        run: npm run compile
+
+      - name: Ensure dist/ exists
+        # vsce --out path must be a real directory or vsce errors. Repo root.
+        run: mkdir -p dist
+
+      - name: Package VSIX
+        working-directory: sassymcp-vscode
+        run: npx --yes @vscode/vsce package --out ../dist/
+
+      - name: Verify VSIX exists
+        run: |
+          ls -la dist/
+          if ! ls dist/sassymcp-*.vsix 1> /dev/null 2>&1; then
+            echo "vsce did not produce a VSIX"
+            exit 1
+          fi
+
+      - name: Upload VSIX artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: sassymcp-vsix
+          path: dist/sassymcp-*.vsix
+          if-no-files-found: error
+
+  build-macos:
+    name: Build sassymcp (macOS ${{ matrix.arch }})
+    runs-on: ${{ matrix.runner }}
+    # Build each arch on a native runner — PyInstaller can't cross-compile, and
+    # building x86_64 on an Intel runner + arm64 on an Apple Silicon runner is
+    # what lets us lipo a true universal2 binary in build-macos-universal.
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - runner: macos-13   # Intel (x86_64)
+            arch: x86_64
+          - runner: macos-14   # Apple Silicon (arm64)
+            arch: arm64
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.11"
+          cache: pip
+
+      - name: Verify tag matches __version__
+        if: startsWith(github.ref, 'refs/tags/')
+        run: |
+          set -euo pipefail
+          tag="${GITHUB_REF_NAME#v}"
+          src=$(python3 -c 'import re,sys; m=re.search(r"__version__\s*=\s*\"([^\"]+)\"", open("sassymcp/__init__.py").read()); print(m.group(1)) if m else sys.exit("could not parse __version__")')
+          if [ "$tag" != "$src" ]; then
+            echo "Tag $tag does not match __version__ $src. Bump sassymcp/__init__.py before tagging."
+            exit 1
+          fi
+
+      - name: Install dependencies + PyInstaller
+        # Base deps only — the [all] extras (playwright/pytesseract/watchdog)
+        # are lazy-imported with graceful fallbacks, mirroring build-exe. The
+        # spec is platform-aware: pyobjc is pulled on macOS via sys_platform
+        # markers, pywinauto is excluded.
+        run: |
+          python -m pip install --upgrade pip
+          python -m pip install pyinstaller
+          python -m pip install -e .
+
+      - name: Confirm runner arch
+        run: |
+          set -euo pipefail
+          echo "uname -m: $(uname -m) (expected ${{ matrix.arch }})"
+          test "$(uname -m)" = "${{ matrix.arch }}"
+
+      - name: Build sassymcp via PyInstaller
+        run: pyinstaller --clean --noconfirm sassymcp.spec
+
+      - name: Verify + smoke-test
+        run: |
+          set -euo pipefail
+          test -f dist/sassymcp || { echo "PyInstaller did not produce dist/sassymcp"; exit 1; }
+          chmod +x dist/sassymcp
+          file dist/sassymcp
+          # argparse exits 0 after --help — the success signal.
+          ./dist/sassymcp --help >/dev/null
+          echo "OK (${{ matrix.arch }})"
+
+      - name: Upload per-arch artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: sassymcp-macos-${{ matrix.arch }}
+          path: dist/sassymcp
+          if-no-files-found: error
+
+  build-macos-universal:
+    name: Merge macOS universal2 binary
+    runs-on: macos-latest
+    needs: build-macos
+    steps:
+      - name: Download x86_64 build
+        uses: actions/download-artifact@v4
+        with:
+          name: sassymcp-macos-x86_64
+          path: x86_64
+
+      - name: Download arm64 build
+        uses: actions/download-artifact@v4
+        with:
+          name: sassymcp-macos-arm64
+          path: arm64
+
+      - name: lipo into a universal2 binary
+        run: |
+          set -euo pipefail
+          mkdir -p dist
+          lipo -create -output dist/sassymcp-macos x86_64/sassymcp arm64/sassymcp
+          chmod +x dist/sassymcp-macos
+          echo "=== archs ==="
+          lipo -archs dist/sassymcp-macos
+          file dist/sassymcp-macos
+          lipo -archs dist/sassymcp-macos | grep -q x86_64
+          lipo -archs dist/sassymcp-macos | grep -q arm64
+          echo "universal2 OK ($(du -h dist/sassymcp-macos | cut -f1))"
+
+      - name: Smoke-test universal binary
+        # macos-latest is arm64; the binary runs its arm64 slice natively.
+        run: |
+          set -euo pipefail
+          ./dist/sassymcp-macos --help >/dev/null
+          echo "universal --help OK"
+
+      # NOTE: this binary is UNSIGNED. On download, Gatekeeper quarantines it
+      # ("unidentified developer"); users clear it with `xattr -dr
+      # com.apple.quarantine sassymcp-macos` or right-click → Open. To ship
+      # signed+notarized, add an Apple Developer ID cert + notarytool step here
+      # (needs an Apple Developer account + secrets).
+      - name: Upload universal artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: sassymcp-macos
+          path: dist/sassymcp-macos
+          if-no-files-found: error
+
+  release:
+    name: GitHub Release
+    runs-on: ubuntu-latest
+    needs: [build-exe, build-dxt, build-vsix, build-macos-universal]
+    # Only fire on real tag pushes; workflow_dispatch builds the artifacts
+    # for verification but never publishes a release.
+    if: startsWith(github.ref, 'refs/tags/')
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Download all artifacts
+        uses: actions/download-artifact@v4
+        with:
+          path: release-artifacts
+
+      - name: List downloaded artifacts
+        run: find release-artifacts -type f
+
+      - name: Look up release notes for this version
+        id: notes
+        run: |
+          set -euo pipefail
+          version="${{ github.ref_name }}"
+          notes_file="docs/releases/${version}.md"
+          if [ -f "$notes_file" ]; then
+            echo "notes_file=$notes_file" >> "$GITHUB_OUTPUT"
+            echo "Using $notes_file"
+          else
+            echo "notes_file=" >> "$GITHUB_OUTPUT"
+            echo "No docs/releases/${version}.md — falling back to auto-generated notes"
+          fi
+
+      - name: Create GitHub Release with all artifacts
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          set -euo pipefail
+          if [ -n "${{ steps.notes.outputs.notes_file }}" ]; then
+            gh release create "${{ github.ref_name }}" \
+              release-artifacts/sassymcp-exe/sassymcp.exe \
+              release-artifacts/sassymcp-macos/sassymcp-macos \
+              release-artifacts/sassymcp-dxt/*.dxt \
+              release-artifacts/sassymcp-vsix/*.vsix \
+              --title "${{ github.ref_name }}" \
+              --notes-file "${{ steps.notes.outputs.notes_file }}"
+          else
+            gh release create "${{ github.ref_name }}" \
+              release-artifacts/sassymcp-exe/sassymcp.exe \
+              release-artifacts/sassymcp-macos/sassymcp-macos \
+              release-artifacts/sassymcp-dxt/*.dxt \
+              release-artifacts/sassymcp-vsix/*.vsix \
+              --title "${{ github.ref_name }}" \
+              --generate-notes
+          fi
+
+  publish-vsix:
+    name: Publish VSIX to VS Code Marketplace
+    runs-on: ubuntu-latest
+    needs: build-vsix
+    # GitHub Actions does not allow `secrets.*` in job-level `if`. Gate this
+    # job on a repository VARIABLE (Settings -> Variables) instead. Set
+    # PUBLISH_VSIX=true once VSCE_PAT is configured in repo secrets. Also
+    # require a real tag — workflow_dispatch builds shouldn't auto-publish.
+    if: ${{ startsWith(github.ref, 'refs/tags/') && vars.PUBLISH_VSIX == 'true' }}
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "20"
+
+      - name: Download VSIX
+        uses: actions/download-artifact@v4
+        with:
+          name: sassymcp-vsix
+          path: dist
+
+      - name: Publish to Marketplace
+        env:
+          VSCE_PAT: ${{ secrets.VSCE_PAT }}
+        run: |
+          if [ -z "$VSCE_PAT" ]; then
+            echo "VSCE_PAT secret is empty; cannot publish."
+            exit 1
+          fi
+          npx --yes @vscode/vsce publish --packagePath dist/sassymcp-*.vsix