fix: auto-update fails after container rebuild

Two root causes:

1. Shallow clone (--depth 1) prevents tag checkout
Dockerfile pins hermes-agent with 'git clone --depth 1 --branch v2026.4.30'.
After rebuild, the clone is shallow and 'git rev-parse <newer-tag>' always
fails because the target commit is outside the shallow boundary.
Fix: 'git fetch --unshallow' at startup before any tag operations.

2. Version file / actual code mismatch
After rebuild, /app/hermes-agent resets to Dockerfile pinned version (v2026.4.30)
but /data/hermes/agent.version (persistent) still records the newer version from
the previous auto-update. The updater reads version file -> 'already latest' ->
skips update, while actual code is still old.
Fix: Compare actual git tag with recorded version. If mismatch detected, force
re-apply the update regardless of version comparison result.

start.sh

@@ -457,15 +457,45 @@ update_hermes_agent_background() {
     API_URL="https://api.github.com/repos/${AGENT_REPO}/releases/latest"
     EXTRAS="feishu,mcp,cron,pty"
 
-    # Current version (from Dockerfile build or previous update)
+    # ── Phase 0: Unshallow the clone if needed ──
+    # Dockerfile uses `git clone --depth 1` which prevents checking out
+    # any tag/commit outside the shallow boundary.
+    # Without this, `git rev-parse <tag>` ALWAYS fails after a rebuild.
+    if [ -f "$AGENT_DIR/.git/shallow" ]; then
+        echo "[$(date)] Agent auto-update: unshallowing clone (Dockerfile --depth 1)..."
+        if git -C "$AGENT_DIR" fetch --unshallow origin 2>&1 | tail -3; then
+            echo "[$(date)] Agent auto-update: clone unshallowed successfully"
+        else
+            echo "[$(date)] Agent auto-update: unshallow failed, tag checkout may not work"
+        fi
+    fi
+
+    # ── Phase 1: Detect actual code version vs recorded version ──
+    # After a HF Space rebuild, /app/hermes-agent is re-cloned at the
+    # Dockerfile pinned version, but /data/hermes/agent.version (persistent)
+    # still says the newer version from the previous auto-update.
+    # This mismatch causes the updater to think it's already up to date.
+    ACTUAL_TAG=$(git -C "$AGENT_DIR" describe --tags --exact-match 2>/dev/null || echo "")
+    BUILD_VERSION="$(cat /app/hermes-agent.version 2>/dev/null | head -1)"
+
+    # Current version from persistent storage (survives rebuilds)
     CURRENT_VERSION="$(cat "$VERSION_FILE" 2>/dev/null | head -1)"
     if [ -z "$CURRENT_VERSION" ]; then
-        # Try build-time version file
-        CURRENT_VERSION="$(cat /app/hermes-agent.version 2>/dev/null | head -1)"
+        CURRENT_VERSION="$BUILD_VERSION"
         [ -z "$CURRENT_VERSION" ] && CURRENT_VERSION="v2026.4.30"
         echo "$CURRENT_VERSION" > "$VERSION_FILE"
     fi
 
+    # Detect rebuild mismatch: actual git tag ≠ recorded version
+    NEED_FORCE=false
+    if [ -n "$ACTUAL_TAG" ] && [ "$ACTUAL_TAG" != "$CURRENT_VERSION" ]; then
+        echo "[$(date)] Agent auto-update: REBUILD DETECTED (actual=$ACTUAL_TAG, recorded=$CURRENT_VERSION)"
+        echo "[$(date)] Agent auto-update: code was reset to Dockerfile version by container rebuild"
+        NEED_FORCE=true
+        # Reset comparison baseline to actual (old) code version
+        CURRENT_VERSION="$ACTUAL_TAG"
+    fi
+
     # Version comparison helper: strip leading 'v', compare date-style like 2026.4.30
     compare_date_versions() {
         local a="${1#v}" b="${2#v}"
@@ -479,9 +509,9 @@ update_hermes_agent_background() {
         return 1  # equal or older
     }
 
-    echo "[$(date)] Agent auto-update: checking (current: $CURRENT_VERSION)..."
+    echo "[$(date)] Agent auto-update: checking (current: $CURRENT_VERSION, actual: $ACTUAL_TAG, latest: querying...)"
 
-    # Query GitHub API
+    # ── Phase 2: Query GitHub API for latest release ──
     LATEST_JSON=$(curl -sf --connect-timeout 10 --max-time 20 "$API_URL" 2>/dev/null)
     if [ $? -ne 0 ] || [ -z "$LATEST_JSON" ]; then
         echo "[$(date)] Agent auto-update: failed to reach GitHub API, skipping"
@@ -496,45 +526,56 @@ update_hermes_agent_background() {
 
     echo "[$(date)] Agent auto-update: latest release is $LATEST_TAG"
 
-    # Compare
+    # ── Phase 3: Decide if update is needed ──
     if compare_date_versions "$CURRENT_VERSION" "$LATEST_TAG"; then
         echo "[$(date)] Agent auto-update: upgrading $CURRENT_VERSION → $LATEST_TAG ..."
+    elif [ "$NEED_FORCE" = "true" ]; then
+        # Rebuild detected: latest = recorded version, but code is still old.
+        # Re-apply the update to restore correct version.
+        echo "[$(date)] Agent auto-update: re-applying $LATEST_TAG after rebuild (code was reset to $ACTUAL_TAG)"
     else
         echo "[$(date)] Agent auto-update: $CURRENT_VERSION is up to date"
         return
     fi
 
-    # Phase 1: git fetch + checkout new tag (non-destructive)
+    # ── Phase 4: git fetch + checkout new tag (non-destructive) ──
     cd "$AGENT_DIR"
     if ! git fetch --tags origin 2>&1 | tail -3; then
         echo "[$(date)] Agent auto-update: git fetch failed, aborting"
         return
     fi
 
-    # Verify tag exists
+    # Verify tag exists (after unshallow, this should succeed)
     if ! git rev-parse "$LATEST_TAG" >/dev/null 2>&1; then
-        echo "[$(date)] Agent auto-update: tag $LATEST_TAG not found, aborting"
-        return
+        echo "[$(date)] Agent auto-update: tag $LATEST_TAG not found locally, fetching explicitly..."
+        if ! git fetch origin "refs/tags/$LATEST_TAG:refs/tags/$LATEST_TAG" 2>&1; then
+            echo "[$(date)] Agent auto-update: explicit tag fetch failed, aborting"
+            return
+        fi
+        if ! git rev-parse "$LATEST_TAG" >/dev/null 2>&1; then
+            echo "[$(date)] Agent auto-update: tag $LATEST_TAG still not found, aborting"
+            return
+        fi
     fi
 
-    # Phase 2: checkout new version
+    # Phase 5: checkout new version
     if ! git checkout "$LATEST_TAG" 2>&1 | tail -3; then
         echo "[$(date)] Agent auto-update: git checkout failed, aborting"
         # Try to recover to previous version
-        git checkout "$CURRENT_VERSION" 2>/dev/null
+        git checkout "$ACTUAL_TAG" 2>/dev/null
         return
     fi
 
-    # Phase 3: update pip dependencies (editable install)
+    # Phase 6: update pip dependencies (editable install)
     echo "[$(date)] Agent auto-update: updating pip dependencies..."
     if ! pip install --quiet -e "/app/hermes-agent[${EXTRAS}]" 2>&1 | tail -10; then
         echo "[$(date)] Agent auto-update: pip install failed, rolling back"
-        git checkout "$CURRENT_VERSION" 2>/dev/null
+        git checkout "$ACTUAL_TAG" 2>/dev/null
         pip install --quiet -e "/app/hermes-agent[${EXTRAS}]" 2>/dev/null
         return
     fi
 
-    # Phase 4: reinstall our patches on top of new version
+    # Phase 7: reinstall our patches on top of new version
     echo "[$(date)] Agent auto-update: re-applying Hermes Bot patches..."
     if [ -f "/app/scripts/patch_file_delivery.py" ]; then
         python3 /app/scripts/patch_file_delivery.py 2>/dev/null
@@ -569,7 +610,7 @@ update_hermes_agent_background() {
     echo "$(date '+%Y-%m-%d %H:%M:%S')" >> "$VERSION_FILE"
     echo "[$(date)] Agent auto-update: upgraded to $LATEST_TAG ✓ (restart needed for full effect)"
 
-    # Phase 5: schedule gateway restart for clean reload
+    # Phase 8: schedule gateway restart for clean reload
     # Send SIGUSR1 to entry.py to trigger gateway restart cycle
     ENTRY_PID=$(pgrep -f "python3 /app/entry.py" 2>/dev/null | head -1)
     if [ -n "$ENTRY_PID" ]; then