From be5a9082b1186767b6535d919ae8f6e361c37c4e Mon Sep 17 00:00:00 2001
From: "keycard-sdk-release[bot]"
 <313094260+keycard-sdk-release[bot]@users.noreply.github.com>
Date: Thu, 15 Oct 2026 19:47:53 +0000
Subject: [PATCH] =?UTF-8?q?bump:=20keycardai-mcp=20=E2=86=92=202.3.3?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Auto-bump for keycardai-mcp.
---
 packages/mcp/CHANGELOG.md   | 6 ++++++
 packages/mcp/pyproject.toml | 2 +-
 2 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/packages/mcp/CHANGELOG.md b/packages/mcp/CHANGELOG.md
index 63d1df4a..26ab05ed 100644
--- a/packages/mcp/CHANGELOG.md
+++ b/packages/mcp/CHANGELOG.md
@@ -1,3 +1,9 @@
+## 2.3.3-keycardai-mcp (2026-10-15)
+
+
+- fix(keycardai-mcp): refresh expired tokens instead of forcing a new sign-in (ECO-453)
+- The MCP client now refreshes a stored token before it expires and tries one refresh on a 401 before starting a new sign-in. A refused refresh (invalid_grant, or insufficient_authorization when the user no longer resolves) clears the tokens and falls back to sign-in; other refresh errors surface without prompting. Requires keycardai-oauth 0.33.0 or later.
+
 ## 2.3.2-keycardai-mcp (2026-09-16)
 
 ## 2.3.1-keycardai-mcp (2026-09-15)
diff --git a/packages/mcp/pyproject.toml b/packages/mcp/pyproject.toml
index dc1eff02..037edc19 100644
--- a/packages/mcp/pyproject.toml
+++ b/packages/mcp/pyproject.toml
@@ -142,7 +142,7 @@ filterwarnings = [
 
 [tool.commitizen]
 name = "cz_customize"
-version = "2.3.2"
+version = "2.3.3"
 tag_format = "${version}-keycardai-mcp"
 # Ignores sibling packages' tags only; it must not match this package's own tag, because commitizen applies ignored formats before tag_format.
 ignored_tag_formats = ["${version}-keycardai-(?!mcp$).*"]