feat: pin hermes-agent v0.12.0 + runtime auto-update

Dockerfile:
- Pin hermes-agent to v2026.4.30 (v0.12.0) release tag
- Write /app/hermes-agent.version for runtime tracking

start.sh: update_hermes_agent_background()
- Queries GitHub releases/latest for newest tag
- Date-style version comparison (2026.4.30 format)
- 5-phase safe update: fetch → checkout → pip install → re-patch → reload signal
- Rollback on failure: git checkout old tag + pip reinstall
- Re-applies Hermes Bot patches (prompt_builder, send_message_tool, etc.)
- Signals entry.py via SIGUSR1 for gateway restart
- Version tracked in /data/hermes/agent.version (persistent)
- Set AGENT_AUTO_UPDATE=false to disable

Dockerfile

@@ -11,8 +11,10 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
 
 WORKDIR /app
 
-# Clone hermes-agent
-RUN git clone --depth 1 https://github.com/NousResearch/hermes-agent.git /app/hermes-agent
+# Clone hermes-agent (pinned to v2026.4.30 = v0.12.0)
+# Runtime auto-update will pull newer releases transparently
+RUN git clone --depth 1 --branch v2026.4.30 https://github.com/NousResearch/hermes-agent.git /app/hermes-agent && \
+    echo "v2026.4.30" > /app/hermes-agent.version
 
 # Build venv
 RUN python3 -m venv /app/venv

start.sh

@@ -444,6 +444,129 @@ for i in $(seq 1 60); do
     sleep 2
 done
 
+# ── Auto-update hermes-agent if newer release exists ──
+# hermes-agent is pip install -e (editable), so git pull + pip upgrade = instant.
+# Safety: update runs in background; if pip fails, old code stays intact.
+# Set AGENT_AUTO_UPDATE=false to disable.
+update_hermes_agent_background() {
+    [ "${AGENT_AUTO_UPDATE}" = "false" ] && return
+
+    AGENT_REPO="NousResearch/hermes-agent"
+    AGENT_DIR="/app/hermes-agent"
+    VERSION_FILE="/data/hermes/agent.version"
+    API_URL="https://api.github.com/repos/${AGENT_REPO}/releases/latest"
+    EXTRAS="feishu,mcp,cron,pty"
+
+    # Current version (from Dockerfile build or previous update)
+    CURRENT_VERSION="$(cat "$VERSION_FILE" 2>/dev/null | head -1)"
+    if [ -z "$CURRENT_VERSION" ]; then
+        # Try build-time version file
+        CURRENT_VERSION="$(cat /app/hermes-agent.version 2>/dev/null | head -1)"
+        [ -z "$CURRENT_VERSION" ] && CURRENT_VERSION="v2026.4.30"
+        echo "$CURRENT_VERSION" > "$VERSION_FILE"
+    fi
+
+    # Version comparison helper: strip leading 'v', compare date-style like 2026.4.30
+    compare_date_versions() {
+        local a="${1#v}" b="${2#v}"
+        IFS='.' read -ra A <<< "$a"
+        IFS='.' read -ra B <<< "$b"
+        for i in 0 1 2; do
+            local ai=${A[$i]:-0} bi=${B[$i]:-0}
+            if [ "$bi" -gt "$ai" ] 2>/dev/null; then return 0; fi
+            if [ "$bi" -lt "$ai" ] 2>/dev/null; then return 1; fi
+        done
+        return 1  # equal or older
+    }
+
+    echo "[$(date)] Agent auto-update: checking (current: $CURRENT_VERSION)..."
+
+    # Query GitHub API
+    LATEST_JSON=$(curl -sf --connect-timeout 10 --max-time 20 "$API_URL" 2>/dev/null)
+    if [ $? -ne 0 ] || [ -z "$LATEST_JSON" ]; then
+        echo "[$(date)] Agent auto-update: failed to reach GitHub API, skipping"
+        return
+    fi
+
+    LATEST_TAG=$(echo "$LATEST_JSON" | python3 -c "import json,sys; print(json.load(sys.stdin).get('tag_name',''))" 2>/dev/null)
+    if [ -z "$LATEST_TAG" ]; then
+        echo "[$(date)] Agent auto-update: could not parse latest tag, skipping"
+        return
+    fi
+
+    echo "[$(date)] Agent auto-update: latest release is $LATEST_TAG"
+
+    # Compare
+    if compare_date_versions "$CURRENT_VERSION" "$LATEST_TAG"; then
+        echo "[$(date)] Agent auto-update: upgrading $CURRENT_VERSION → $LATEST_TAG ..."
+    else
+        echo "[$(date)] Agent auto-update: $CURRENT_VERSION is up to date"
+        return
+    fi
+
+    # Phase 1: git fetch + checkout new tag (non-destructive)
+    cd "$AGENT_DIR"
+    if ! git fetch --tags origin 2>&1 | tail -3; then
+        echo "[$(date)] Agent auto-update: git fetch failed, aborting"
+        return
+    fi
+
+    # Verify tag exists
+    if ! git rev-parse "$LATEST_TAG" >/dev/null 2>&1; then
+        echo "[$(date)] Agent auto-update: tag $LATEST_TAG not found, aborting"
+        return
+    fi
+
+    # Phase 2: checkout new version
+    if ! git checkout "$LATEST_TAG" 2>&1 | tail -3; then
+        echo "[$(date)] Agent auto-update: git checkout failed, aborting"
+        # Try to recover to previous version
+        git checkout "$CURRENT_VERSION" 2>/dev/null
+        return
+    fi
+
+    # Phase 3: update pip dependencies (editable install)
+    echo "[$(date)] Agent auto-update: updating pip dependencies..."
+    if ! pip install --quiet -e "/app/hermes-agent[${EXTRAS}]" 2>&1 | tail -10; then
+        echo "[$(date)] Agent auto-update: pip install failed, rolling back"
+        git checkout "$CURRENT_VERSION" 2>/dev/null
+        pip install --quiet -e "/app/hermes-agent[${EXTRAS}]" 2>/dev/null
+        return
+    fi
+
+    # Phase 4: reinstall our patches on top of new version
+    echo "[$(date)] Agent auto-update: re-applying Hermes Bot patches..."
+    if [ -f "/app/scripts/patch_file_delivery.py" ]; then
+        python3 /app/scripts/patch_file_delivery.py 2>/dev/null
+    fi
+    if [ -f "/app/scripts/patch_auto_media.py" ]; then
+        python3 /app/scripts/patch_auto_media.py 2>/dev/null
+    fi
+    if [ -f "/app/scripts/patch_resolve_media_paths.py" ]; then
+        python3 /app/scripts/patch_resolve_media_paths.py 2>/dev/null
+    fi
+    # Copy patch files if they exist
+    for patch_file in prompt_builder.py send_message_tool.py; do
+        if [ -f "/app/patches/hermes-agent/agent/$patch_file" ] && [ -f "$AGENT_DIR/agent/$patch_file" ]; then
+            cp "/app/patches/hermes-agent/agent/$patch_file" "$AGENT_DIR/agent/$patch_file" 2>/dev/null
+        fi
+    done
+
+    # Save new version
+    echo "$LATEST_TAG" > "$VERSION_FILE"
+    echo "$(date '+%Y-%m-%d %H:%M:%S')" >> "$VERSION_FILE"
+    echo "[$(date)] Agent auto-update: upgraded to $LATEST_TAG ✓ (restart needed for full effect)"
+
+    # Phase 5: schedule gateway restart for clean reload
+    # Send SIGUSR1 to entry.py to trigger gateway restart cycle
+    ENTRY_PID=$(pgrep -f "python3 /app/entry.py" 2>/dev/null | head -1)
+    if [ -n "$ENTRY_PID" ]; then
+        kill -USR1 "$ENTRY_PID" 2>/dev/null && \
+            echo "[$(date)] Agent auto-update: sent reload signal to entry.py (PID: $ENTRY_PID)" || \
+            echo "[$(date)] Agent auto-update: gateway will use new code on next conversation"
+    fi
+}
+
 # ── Auto-update hermes-web-ui if newer release exists ──
 # Runs asynchronously so it doesn't block startup.
 # Check: GitHub releases/latest → compare with saved version → build if newer.
@@ -585,6 +708,9 @@ node index.js >> /data/hermes/logs/webui.log 2>&1 &
 WEBUI_PID=$!
 echo "[$(date)] WebUI BFF PID: $WEBUI_PID"
 
+# Trigger hermes-agent auto-update in background (framework first, then UI)
+update_hermes_agent_background &
+
 # Trigger WebUI auto-update in background (non-blocking)
 # Will check GitHub, build if newer, and hot-swap
 update_webui_background &