CALLE-AI · Ray-56 · Aug 4, 2026 · Aug 4, 2026
diff --git a/.changeset/lucky-poems-argue.md b/.changeset/lucky-poems-argue.md
diff --git a/.changeset/olive-donkeys-smile.md b/.changeset/olive-donkeys-smile.md
diff --git a/packages/cli/CHANGELOG.md b/packages/cli/CHANGELOG.md
@@ -1,5 +1,16 @@
 # @call-e/cli
 
+## 0.3.8
+
+### Patch Changes
+
+- [#71](https://github.com/CALLE-AI/call-e-integrations/pull/71) [`bc70f48`](https://github.com/CALLE-AI/call-e-integrations/commit/bc70f486e996b7aff845c11242838d4e11e5e079) Thanks [@EazyHood](https://github.com/EazyHood)! - Open the browser without cmd.exe on Windows during `auth login`.
+
+  `cmd /c start "" <url>` let cmd parse the OAuth URL, and `&` is a command separator there, so the URL was truncated at the first `&` (losing `redirect_uri`, `state` and `scope`) and the rest of the query string was run as shell commands. The opener is now `rundll32`, which takes the URL as a single argument, named by its fully qualified `%SystemRoot%\System32` path so the executable is not resolved through the current working directory.
+
+- Updated dependencies [[`566008b`](https://github.com/CALLE-AI/call-e-integrations/commit/566008bab86008bc9019c45478122beeaffa5f60)]:
+  - @call-e/core@0.2.4
+
 ## 0.3.7
 
 ### Patch Changes

diff --git a/packages/cli/lib/config.js b/packages/cli/lib/config.js
@@ -39,7 +39,7 @@ export const DEFAULT_SERVER_NAME = "calle";
 export const DEFAULT_POLL_TIMEOUT_SECONDS = 300;
 export const DEFAULT_TELEMETRY_TIMEOUT_SECONDS = 1.5;
 export const DEFAULT_CACHE_ROOT = path.join(os.homedir(), ".calle-mcp", "cli");
-export const CLI_VERSION = "0.3.7";
+export const CLI_VERSION = "0.3.8";
 
 function firstOptionValue(value) {
   return Array.isArray(value) ? value[0] : value;

diff --git a/packages/cli/package.json b/packages/cli/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@call-e/cli",
-  "version": "0.3.7",
+  "version": "0.3.8",
   "description": "CLI wrapper for brokered MCP login and CALL-E MCP client configuration.",
   "type": "module",
   "license": "MIT",

diff --git a/packages/core/CHANGELOG.md b/packages/core/CHANGELOG.md
@@ -1,5 +1,15 @@
 # @call-e/core
 
+## 0.2.4
+
+### Patch Changes
+
+- [#72](https://github.com/CALLE-AI/call-e-integrations/pull/72) [`566008b`](https://github.com/CALLE-AI/call-e-integrations/commit/566008bab86008bc9019c45478122beeaffa5f60) Thanks [@EazyHood](https://github.com/EazyHood)! - Read numeric token expiries, and refresh instead of caching forever when one cannot be read.
+
+  A broker that sends the expiry as epoch seconds or milliseconds arrived here as a string such as `"1700000000000"`, which `new Date()` reads as `Invalid Date`. A valid expiry was therefore indistinguishable from no expiry at all, and the token was cached as if it never expired. Numeric expiries are now parsed explicitly, with values below 1e11 taken as seconds and the rest as milliseconds; a negative or non-finite value is rejected rather than being turned into a nonsense date by `new Date("-1")`.
+
+  An expiry that still cannot be read no longer means "never expires": the entry is treated as expired so the next call refreshes it.
+
 ## 0.2.3
 
 ### Patch Changes

diff --git a/packages/core/package.json b/packages/core/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@call-e/core",
-  "version": "0.2.3",
+  "version": "0.2.4",
   "description": "Shared CALL-E runtime helpers for brokered auth, local token cache, and MCP HTTP calls.",
   "type": "module",
   "types": "./lib/index.d.ts",