On a Friday afternoon you finally create an account. You had been running on the free tier for three weeks with Gmail, Notion and your calendar connected. You open settings, sign in, get a cheerful welcome — and then open the Connectors page. Empty. Every app needs authorizing again.

That was not a glitch. Signing in replaced the free-tier identity with your account and left the connected apps on the old identity, which nothing on the machine used any more. Three PRs merged on October 23, 2026 rebuild that path end to end.

Three rough edges before

1. Upgrading ran a different flow. Signing in on top of the free tier registered the free tier for transfer, showed a special consent page with its own code, polled until the transfer finished, and only then got the account token. With no free tier on disk, /login and hermes auth upgrade refused to start at all.
2. Apps had to be reconnected by hand. Sign-in saved the account over the free tier; the apps stayed behind it.
3. Opening the Connectors page built an identity in the background — even if you never connected anything. And the “sign in” offer only appeared for people on the free trial model, so anyone on their own key who connected apps never saw it.

Now: one plain device login, then a handoff

#143235 makes every Nous sign-in a plain device login. Desktop, /login in the CLI, TUI and chat apps, and hermes auth upgrade all run one flow: show the normal device page and code, wait for approval (or expiry, or cancel), save the account. No special consent page, no transfer polling.

Then the part that matters: after the save lands, #143234 asks the Nous Portal to move the free tier’s connected apps into that account, using the account’s own sign-in token. The details are what make it trustworthy:

• No network call at save time. Hermes only notes “move pending”; the move happens once the save is finished.
• No prompt. The result is shown afterwards.
• Before any request goes out, Hermes checks the token belongs to the account that replaced the free tier. The apps only ever go to that account. If you signed in to a different account before a retry ran, status says the move is waiting for the first account.
• If the Portal is busy or unreachable, it retries later — including after a restart.
• hermes auth status nous changes from a bare logged in to “logged in, plus what moved or what needs reconnecting”.

#143248 fixes the third edge: opening the Connectors page creates nothing. The page lists apps from the Portal’s public catalog, which needs no sign-in. Connecting an app creates the identity at that point, and the page switches to your own catalog, accounts and rules. If you connected an app but are not on the trial, you get your own offer — “Keep your connected apps” — instead of the trial’s.

The CLI hint got corrected too: hermes connectors used to tell you to run hermes login, a command that no longer exists. It now says hermes auth upgrade.

What you actually type

The surface got simpler, not more complicated — every path leads to the same place:

hermes auth status nous     # account or free tier, plus handoff state
hermes auth upgrade         # sign in with a Nous account, keeping your connectors

Inside a session it is /login, on every surface: Desktop, CLI, TUI, messaging platforms. hermes model and hermes auth add nous keep their own flags (--portal-url, --ca-bundle, --insecure) but run the same device login underneath and print the same handoff result.

The desktop flow is unified as well: a cancel stops within a second and saves nothing; an expired code shows a timeout screen instead of a generic error; and the result screen tells you who signed in and what moved.

Boundaries worth knowing first

• Older clients still call the old endpoints. The PR says the server’s old transfer endpoints were not retired in this change, because older Hermes versions still call them.
• The new offer text is English only for now (called out in #143248); other languages fall back to it.
• The Connectors page’s public catalog depends on a Portal route shipping first. Until it is live, someone with no Nous identity sees no hosted apps on the page; everyone else is unaffected.
• Opening one app’s tool list, renaming or removing an account, and saving rules still create the identity — by then you have picked an app, so it is an explicit request. hermes connectors list and the agent’s status check still create an identity too, on purpose.

How this differs from the earlier free-tier post

On October 13 we wrote about the scoped guest token for free-tier connectors — a token whose only scope is connectors:invoke, and which skips the browser challenge. This post is the next chapter: what happens to those connections when a real account replaces the free identity. For the naming rules around multiple connector accounts, see the named accounts guide; for the rest of hermes auth (add, list, reset, priority, refresh), the command reference is the short version.

Release status

All three PRs merged to main on October 23, 2026 as one stack. The latest release is still v0.22.4 from October 21, so these behaviours are main-only until the next release reaches the stable channel. On v0.22.4 the sign-in path is still the old one — check the update channel guide before assuming you have it.