v2026.9.14

# Hermes Agent v0.21.3 (v2026.9.14)

**Release Date:** September 14, 2026

> Patch release. This tag rolls up the ~338 PRs merged since v0.21.2 into a stable tagged release for downstream consumers (Docker images, Hermes Cloud, hosted deployments). It exists so the remote-gateway sign-in fixes below reach Cloud agents, which auto-update to the newest release tag.

## What this patch ships for remote Desktop / Cloud users

- **Remote dashboard sessions no longer expire on refresh bursts** (#110061, fixes #55712; salvage #71548 @Doud-FR, #55717 @liuhao1024). Both refresh paths on the gateway (cookie gate and the desktop's native bearer route) now coalesce concurrent requests carrying the same rotating refresh token, so a Desktop wake burst can no longer replay an already-rotated token into the Portal's reuse detection and revoke the whole session. Refresh also runs off the event loop, so a slow identity provider no longer freezes `/api/status`. Pairs with Portal-side NousResearch/hermes-portal#1209 (sliding 30-day idle horizon, 5-minute rotated-token grace).

## Also requested for this tag

- **Long-lived processes stop leaking duplicate state.db writer handles** (#110934, fixes #100896 #103339; salvage #107974 @kshitijk4poor, mapping @Rroven): gateway, dashboard/Desktop backend, ACP and CLI readers attach read-only and in-process writers share the registry handle, so the `N live SessionDB handles` precursor stops firing on a healthy topology.

## About this release

Measured at commit `9b419a2d3c2657c192008e732149d61170b32c01`, the window since v0.21.2 contains **1,036 non-merge commits** across **2,642 changed files** (+131,690 / −37,096) and **338 merged PRs**.

Also in the window, undocumented here on purpose: server→client JSON-RPC requests and a Pydantic wire-contract registry with generated TS/OpenRPC for the TUI/Desktop gateway (#110521, #110522); reasoning-effort selection on every model picker, a composer pill and per-auxiliary control in Desktop; OpenRouter OAuth PKCE login; HEIF/HEIC/AVIF image decoding; the Honcho peer-model setup rework; MCP OAuth refresh tokens bound to their issuer; a daily MCP re-auth nudge in Desktop; Wan 3.0, Kling 3.0 / Kling Image v3, MiniMax H3 Max Turbo, Gemini Omni Flash 1.1 and Meta Muse in the FAL catalogs; Slack pasted tables and the Agent Sessions API; multiplexed-profile isolation and gateway-liveness fixes; and the state.db WAL refusal on cross-VM filesystems.

**Full curated release notes for this window ship with v0.22.0**, which will document everything from v0.21.0 onward — highlights, feature areas, and complete contributor credits. Nothing in this window is skipped.

## Updating

- `hermes update` (git installs), or re-run the installer one-liner.
- Docker / Hermes Cloud: images build from this tag (`nousresearch/hermes-agent:v2026.9.14`).

**Full changelog:** https://github.com/NousResearch/hermes-agent/compare/v2026.9.11...v2026.9.14