You close the laptop to join a call, come back, and the Hermes desktop loads normally — then asks you to sign in again. Nobody kicked your account: your own client invalidated the session. It happens most often when you use a remote gateway and the desktop together, and it always picks the moment you least want to deal with it.

v0.21.3 (tag v2026.9.14, released September 14, 2026, nicknamed “The Sign-In Patch”) exists for that failure. It is also an update channel for cloud users: Docker images and Hermes Cloud build from the newest release tag, so a fix has to be rolled into a stable tag before it can reach installs that never run hermes update by hand.

Why a wake burst can invalidate a whole session

Start with the pieces. For remote access, a client holds a pair of tokens: an access token (short-lived, used for requests) and a refresh token (long-lived, used to get new access tokens). To limit the damage of a leak, the authorization server rotates the refresh token on every use — the old value dies immediately and only the new one counts. If the old value is presented a second time, the server reads it as a stolen token, and the protective response is to revoke the entire session.

The trouble is that two refresh paths exist: the gateway’s cookie gate and the desktop’s own native bearer route. Both hold the same rotating refresh token. When the desktop wakes from sleep it fires several requests at once — a natural burst — and both paths refresh almost simultaneously, so the same old value is presented twice and the session gets logged out by its own client (#110061, fixes #55712).

The fix coalesces those refreshes: when concurrent requests carry the same rotating token, one performs the rotation and the rest adopt its result instead of presenting the token again. Refresh also moved off the event loop, so a slow identity provider no longer freezes /api/status while it waits.

The Portal side pairs with this change (hermes-portal#1209): a sliding 30-day idle horizon plus a 5-minute grace window on a rotated token, so a request genuinely in flight with the just-rotated value is not read as reuse.

The quieter fix: duplicate state.db writer handles

The same window carries another session-storage fix, this one hiding in the logs. If you have ever seen an N live SessionDB handles warning during diagnostics, it was supposed to mean “more than one process writes this database” — but it also fired on healthy topologies (#110934, fixes #100896 and #103339).

The gateway, the dashboard/Desktop backend, the ACP surface and CLI readers each attached their own writer handle. The rule is now explicit: readers attach read-only, and in-process writers share the one registry handle. Fewer handles means fewer chances for one component to cancel another’s locks — the exact failure class the v0.21.2 patch closed with six PRs, and the one described in our state.db troubleshooting post.

What else is in v0.21.3 (documented properly in v0.22.0)

v0.21.3 is a rolling tag: the ~338 merged PRs, 1,036 non-merge commits and 2,642 changed files since v0.21.2 all sit in this window. Most of it is deliberately left to the v0.22.0 notes, so here is the shape of what is coming, by area:

Area	What shipped
Gateway contract	Server→client JSON-RPC requests replace the *.request / *.respond event pairs (#110521); a Pydantic wire-contract registry generates the TypeScript and OpenRPC types (#110522, #110523)
Models and reasoning	Reasoning effort on every model picker; a composer pill and per-auxiliary effort control in Desktop; OpenRouter OAuth PKCE login
MCP	OAuth refresh tokens bound to the issuer that granted them; a daily re-auth nudge in Desktop
Media	HEIF / HEIC / AVIF image decoding
Providers	Wan 3.0, Kling 3.0 / Kling Image v3, MiniMax H3 Max Turbo, Gemini Omni Flash 1.1 and Meta Muse in the FAL catalogs; the Honcho peer-model setup reworked
Platforms	Slack pasted tables and the Agent Sessions API
Storage and profiles	Multiplexed-profile isolation and gateway-liveness fixes; a refusal to run the WAL journal mode on cross-VM filesystems

The block-by-block list lives on the v0.21.3 release page, and the window diff is at v2026.9.11…v2026.9.14.

What you should do

Manual installs update in one command:

hermes update

Docker and hosted environments rebuild from the new tag:

docker pull nousresearch/hermes-agent:v2026.9.14

If your sessions used to die after the desktop woke up, this upgrade is worth taking first. If they never did, your usage pattern simply missed the concurrent window — the upgrade is just as safe.