fix: avoid pinVersion regression from upstream placeholder version

Upstream main declares [project] version 0.0.0 between releases, which made
the nightly pin regress from 0.21.4 to 0.0.0. Fall back to the latest release
tag's version when the HEAD version is the placeholder, and correct the
current candidate's pinVersion to match. Factor the pyproject version lookup
into update-common.sh so both channels share one implementation.

nightly.nix

@@ -2,7 +2,7 @@
 # Auto-updated by scripts/update-nightly.sh — do not edit manually.
 { pkgs }:
 pkgs.callPackage ./package.nix {
-  pinVersion = "0.0.0-unstable-2026-09-29.536802c0";
+  pinVersion = "0.21.5-unstable-2026-09-29.536802c0";
   pinRev = "536802c00e4f93061fc46b134dc029ff695f364f";
   pinHash = "sha256-5IdY6zQjaGCWkz2Mg8UT2a2VZ+6RH1xsL2gI9VjRQg4=";
 }

scripts/update-common.sh

@@ -11,6 +11,14 @@ extract_sri_hash() {
   sed -nE 's/.*got:[[:space:]]*(sha256-[A-Za-z0-9+\/=]+).*/\1/p' "$1" | head -1
 }
 
+# Echo the ``[project]`` version from upstream's pyproject.toml at a git ref
+# (branch, tag or commit sha).
+upstream_pyproject_version() {
+  gh api -H "Accept: application/vnd.github.raw+json" \
+    "/repos/NousResearch/hermes-agent/contents/pyproject.toml?ref=${1}" |
+    python3 -c 'import sys, tomllib; print(tomllib.load(sys.stdin.buffer)["project"]["version"])'
+}
+
 realize_flake_source() {
   nix build "$1.src" --no-link --print-out-paths 2>/dev/null | tail -1 || true
 }

scripts/update-nightly.sh

@@ -28,11 +28,23 @@ if [[ "$current_rev" == "$head_sha" ]]; then
   exit 0
 fi
 
-upstream_version=$(
+upstream_version=$(upstream_pyproject_version "$head_sha")
-  gh api -H "Accept: application/vnd.github.raw+json" \
+
-    "/repos/NousResearch/hermes-agent/contents/pyproject.toml?ref=${head_sha}" |
+# Upstream resets the [project] version to a placeholder (0.0.0) on main between
-    python3 -c 'import sys, tomllib; print(tomllib.load(sys.stdin.buffer)["project"]["version"])'
+# releases. Pinning that verbatim would regress pinVersion from a real release to
-)
+# 0.0.0; update-pins.sh aborts the stable channel on such a downgrade, but the
+# nightly tracks unreleased HEAD, so fall back to the latest release's version.
+if [[ "$upstream_version" == "0.0.0" ]]; then
+  release_tag=$(gh api /repos/NousResearch/hermes-agent/releases/latest --jq '.tag_name // empty' || true)
+  if [[ -n "$release_tag" ]]; then
+    release_version=$(upstream_pyproject_version "$release_tag" || true)
+    if [[ -n "$release_version" && "$release_version" != "0.0.0" ]]; then
+      log "Upstream ${head_sha:0:12} declares a placeholder version; using ${release_tag} version ${release_version}"
+      upstream_version="$release_version"
+    fi
+  fi
+fi
+
 python3 - "$upstream_version" <<'PY' || die "upstream pyproject contains an invalid version"
 import re, sys
 raise SystemExit(0 if re.fullmatch(r"\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?", sys.argv[1]) else 1)

scripts/update-pins.sh

@@ -34,11 +34,7 @@ for _depth in 1 2 3 4 5; do
 done
 [[ "$tag_type" == "commit" && -n "$tag_sha" ]] || die "release tag does not resolve to a commit"
 
-upstream_version=$(
+upstream_version=$(upstream_pyproject_version "$tag_sha")
-  gh api -H "Accept: application/vnd.github.raw+json" \
-    "/repos/NousResearch/hermes-agent/contents/pyproject.toml?ref=${tag_sha}" |
-    python3 -c 'import sys, tomllib; print(tomllib.load(sys.stdin.buffer)["project"]["version"])'
-)
 current_version=$(awk -F'"' '/pinVersion \? "/{print $2; exit}' "$package_file")
 current_rev=$(awk -F'"' '/pinRev \? "/{print $2; exit}' "$package_file")
 [[ -n "$current_version" && -n "$current_rev" ]] || die "could not read current stable pin"