Reported at T224358 for Tool-global-search, but we see the same issue with XTools and our other projects that use Symfony and/or the mediawiki/oauthclient library.
The cookie is set to expire an entire year after login, but users get logged out within as little as half an hour, or sometimes just a matter of minutes.
For XTools specifically, it's worth noting we use MariaDB-based session storage (as the session needs to be shared between the app server and API server), but the symptoms nonetheless are the same as all other tools that use other session storage mechanisms.
I suspect our issue is something fundamental that we're missing with session management in PHP.