feat: initial durable ESP32 voice gateway plugin + patches

- Migrates custom voice gateway from in-tree api_server.py patch to durable plugin
- Auto-restores routes after hermes update (POST /api/esp32/voice + WS /api/esp32/voice/ws)
- Includes live draft ingestion via MacMiniMCP speech_live_transcribe (Apple pipe volatile)
- Includes instant smart reply via apple_llm_quick_reply (3B ANE ~300ms, contextual not generic)
- Guard for missing ipaddress/urlparse imports that caused 500 loop (2026-07-14)
- Tools: esp32_voice_gateway_status, esp32_voice_gateway_restore
- Scripts: restore_after_update.py with 400-not-404 verification
- Installed as ~/.hermes/plugins/esp32-voice-gateway (enabled, survives hermes update)

Verified: routes present, plugin enabled, has_routes=True

.gitignore

@@ -0,0 +1,12 @@
+# ignore Python cache
+__pycache__/
+*.pyc
+*.pyo
+.venv/
+*.egg-info/
+# ignore hermes cache dumps
+*.log
+audio_cache/
+# OS
+.DS_Store
+Thumbs.db

README.md

@@ -0,0 +1,119 @@
+# Hermes ESP32 Voice Gateway
+
+Durable custom voice gateway for Reyna family ESP32 + iPhone Watch devices. Survives `hermes update` (which wipes in-tree patches to `gateway/platforms/api_server.py`).
+
+Upstream issue: ESP32 push-to-talk endpoints `POST /api/esp32/voice` and `WS /api/esp32/voice/ws` with:
+
+- live draft ingestion via Mac mini `speech_live_transcribe` (ApplePipeTranscriber volatile drafts, ~800ms, 2.12% WER)
+- instant smart reply via Mac mini `apple_llm_quick_reply` (Apple 3B ANE ~300ms contextual, not generic template)
+- final transcription prefers `macmini-live-final` over local faster-whisper base (753ms vs 11-13s cold)
+- parallel instant future started at STOP before final transcribe
+- persistence flags `persistent=True`, `is_instant=True`, `keep_instant=True` for iPhone client sticky UI
+- screen animation + TTS via `play_audio_base64` / `play_mp3_base64` to `http://<source_ip>/api/mcp` screens
+- audit log `~/.hermes/.../audio_cache/esp32/voice_requests.jsonl`
+
+## Why a separate repo + plugin
+
+`hermes update` does `git stash --include-untracked` + pull origin/main, dropping local modifications to `api_server.py`. The plugin `esp32-voice-gateway` lives in `~/.hermes/plugins/` (user plugin dir, never overwritten), and on every Hermes start auto-checks whether the custom routes are present. If missing (after an update), it **auto-restores** them from the bundled patch and verifies.
+
+### What's tracked here
+
+- `patch/api_server_esp32_live_draft_with_llm.patch` — full 1675-line patch that is currently running on Adolfo's Pi (verified 2026-07-14)
+- `hermes_plugin/` — Hermes user plugin (`plugin.yaml` + `__init__.py`) installable via `hermes plugins install`
+- `scripts/restore_after_update.py` — manual restore + verification (400 not 404 check)
+- `docs/` — original excerpts + audit references
+
+## Quick start
+
+### 1. Create repo on Gitea
+
+The token in `~/.git-credentials` only has `write:repository`, not `write:user`, so repo creation via API is blocked. Create an empty repo via Gitea UI:
+
+https://git.reynafamily.com/repo/create
+
+- Name: `hermes-esp32-voice-gateway`
+- Visibility: private (contains no secrets, but references family device IPs)
+- Uncheck initialize README
+
+Then:
+
+```bash
+cd ~/Projects/hermes-esp32-voice-gateway
+git remote add origin https://adolforeyna:TOKEN@git.reynafamily.com/adolforeyna/hermes-esp32-voice-gateway.git
+git push -u origin main
+```
+
+(TOKEN is the existing `~/.git-credentials` token — `git` credential helper already does this)
+
+### 2. Install the durable plugin
+
+```bash
+# From this repo
+cp -r hermes_plugin ~/.hermes/plugins/esp32-voice-gateway
+# or symlink for dev
+# ln -s ~/Projects/hermes-esp32-voice-gateway/hermes_plugin ~/.hermes/plugins/esp32-voice-gateway
+hermes plugins enable esp32-voice-gateway
+hermes gateway restart
+```
+
+### 3. Verify
+
+```bash
+# Routes should be 400 (not 404) when hit without WS upgrade:
+curl -s -o /dev/null -w "%{http_code}" -H "Authorization: Bearer $API_SERVER_KEY" http://127.0.0.1:8642/api/esp32/voice/ws
+# -> 400 (means route exists, missing Upgrade header) — NOT 404
+# POST empty should be 400 not 404:
+curl -s -o /dev/null -w "%{http_code}" -H "Authorization: Bearer $API_SERVER_KEY" http://127.0.0.1:8642/api/esp32/voice -X POST --data-binary @/dev/null
+# -> 400
+```
+
+### 4. After `hermes update`
+
+The plugin auto-restores on next import (gateway start). Check logs:
+
+```bash
+grep -i "esp32.*restore\|esp32.*patch\|ESP32" ~/.hermes/logs/gateway.log | tail -20
+# If auto-restore happened, it logs patched file + needs restart:
+systemctl --user status hermes-gateway-kids hermes-gateway --no-pager
+# The plugin will request one restart cycle; if stuck in deactivating, run:
+# pkill -9 -f "hermes_cli.main gateway run"; systemctl --user reset-failed hermes-gateway*; systemctl --user start hermes-gateway
+```
+
+Manual restore:
+
+```bash
+~/Projects/hermes-esp32-voice-gateway/scripts/restore_after_update.py
+```
+
+## Architecture (for reference)
+
+- Incoming: iPhone 192.168.68.150:8080 `iphone6` (WAV POST) + ESP32 tablets 192.168.68.129 `grace-esp32`/`elias-esp32` (WS PCM s16le 16k mono)
+- Gateway: `gateway/platforms/api_server.py` `APIServerAdapter`
+  - `POST /api/esp32/voice` → saves WAV, transcribes (macmini-live-final preferred), runs Hermes agent turn, TTS → WAV (ffmpeg to 16k mono), `FileResponse`
+  - `WS /api/esp32/voice/ws` → ingest s16le binary frames, every 800ms snapshot → `_s16le_to_wav_bytes` → `speech_live_transcribe` (Mac mini pipe volatile) fallback tiny → emit `draft`/`interim_transcript`, on STOP → parallel instant future `apple_llm_quick_reply` (must be >30 chars, else use final transcript for context), final transcribe Mac mini full buffer (11588ms fallback if Mac down), emit `instant_response persistent=True` + `response_text is_instant=True` + `done instant_ok` + `thinking keep_instant`, background ` _run_esp32_voice_background` (screen animation/text/image/audio via `http://<source_ip>/api/mcp`)
+- MacMiniMCP: `~/Projects/MacMiniMCP` (canonical on Mac) 37 tools including `speech_live_transcribe`, `apple_llm_quick_reply`, `speech_synthesize_base64`, `voicebox_quick_reply` (Aiden boy)
+- Pitfalls documented in `hermes-multi-profile-voice-gateways` skill references: `esp32-voice-500-import-loop.md`, `esp32-voice-gateway-update-survival.md`, etc.
+
+## Contributing
+
+This repo is Reyna family private. Changes to the voice gateway should update both:
+
+1. `patch/api_server_esp32_live_draft_with_llm.patch` (regenerated from `git diff` of `~/.hermes/hermes-agent/gateway/platforms/api_server.py`)
+2. The plugin's restore logic (it just reapplies patch, so keeping patch current is enough)
+
+Regenerate patch:
+
+```bash
+cd ~/.hermes/hermes-agent
+git diff gateway/platforms/api_server.py > ~/Projects/hermes-esp32-voice-gateway/patch/api_server_esp32_live_draft_with_llm.patch
+cp ~/.hermes/esp32_live_draft_with_llm_patch.patch ~/Projects/hermes-esp32-voice-gateway/patch/ 2>/dev/null || true
+```
+
+## TODO
+
+- [ ] Extract to true standalone plugin that injects routes at runtime without touching file (eliminate patch reapply entirely). Requires hooking `APIServerAdapter.connect` — current plugin does auto-restore via file patch for reliability.
+- [ ] Add integration test that curls both endpoints after restore.
+
+## License
+
+Private - Reyna family.

hermes_plugin/__init__.py

@@ -0,0 +1,304 @@
+"""
+Reyna family ESP32 Voice Gateway - durable Hermes plugin
+Survives `hermes update` which wipes in-tree patches to gateway/platforms/api_server.py.
+
+What it does:
+- On Hermes import (plugin load), checks if api_server.py has ESP32 routes.
+- If missing (after update), auto-restores from bundled patch + logs actionable warning.
+- Exposes tools for manual verify/restore from inside Hermes chat (via slash or tool).
+
+The actual voice logic stays in api_server.py (patched file) because it's 1600+ lines
+deeply integrated with APIServerAdapter internals (ResponseStore, _run_agent, TTS, transcription,
+screen MCP). Extracting as runtime monkeypatch would be brittle. The durable strategy is:
+  1. Patch file lives in this repo + bundled in plugin as `patch/*.patch`
+  2. Plugin's register() does self-heal check (fast ~10ms)
+  3. Gateway auto-restarts handled by operator (can't restart self from inside gateway - see skill pitfalls)
+
+Future: true runtime injection plugin that patches APIServerAdapter.connect to add routes
+without touching file — feasible but needs tracking _handle_esp32_* methods. Kept separate as v2.
+"""
+
+import logging
+import subprocess
+import sys
+from pathlib import Path
+from typing import Optional
+
+logger = logging.getLogger(__name__)
+
+PLUGIN_DIR = Path(__file__).parent
+PATCH_DIR = PLUGIN_DIR / "patch"
+# repo root for dev checkout (symlinked plugin)
+REPO_PATCH = PLUGIN_DIR.parent / "patch" / "api_server_esp32_live_draft_with_llm.patch"
+
+
+def _find_hermes_agent_dir() -> Optional[Path]:
+    # Try standard locations
+    candidates = [
+        Path.home() / ".hermes" / "hermes-agent",
+        Path(__file__).resolve().parents[3],  # if running from within hermes-agent/plugins/esp32-...
+    ]
+    # Also check HERMES_AGENT_DIR env
+    import os
+    env_dir = os.getenv("HERMES_AGENT_DIR")
+    if env_dir:
+        candidates.insert(0, Path(env_dir))
+    # pip install location
+    try:
+        import hermes_cli
+        candidates.append(Path(hermes_cli.__file__).parents[1])
+    except Exception:
+        pass
+    for c in candidates:
+        if (c / "gateway" / "platforms" / "api_server.py").exists():
+            return c
+    return None
+
+
+def _api_server_has_esp32() -> bool:
+    agent_dir = _find_hermes_agent_dir()
+    if not agent_dir:
+        return False
+    api_file = agent_dir / "gateway" / "platforms" / "api_server.py"
+    try:
+        txt = api_file.read_text()[:5000]  # top matter + first routes
+        # quick check
+        if "ESP32_AUDIO_MAX_BYTES" not in api_file.read_text()[:20000]:
+            return False
+        # full route registration present?
+        content = api_file.read_text()
+        return "/api/esp32/voice" in content and "_handle_esp32_voice_ws" in content
+    except Exception:
+        return False
+
+
+def _find_patch_file() -> Optional[Path]:
+    # Search order: bundled patch in plugin, repo patch, hermes-home fallback
+    for p in [
+        PATCH_DIR / "api_server_esp32_live_draft_with_llm.patch",
+        REPO_PATCH,
+        Path.home() / ".hermes" / "esp32_live_draft_with_llm_patch.patch",
+        Path.home() / ".hermes" / "esp32_voice_patch.patch",
+        PATCH_DIR / "esp32_live_draft_with_llm_patch.patch",
+    ]:
+        if p.exists():
+            return p
+    # Also search inside plugin dir itself (dev checkout)
+    for pattern in ["*.patch"]:
+        for f in PATCH_DIR.glob(pattern):
+            if f.stat().st_size > 1000:
+                return f
+    return None
+
+
+def _try_apply_patch(patch_path: Path, agent_dir: Path) -> bool:
+    """Apply patch via git apply. Returns True if applied or already applied."""
+    api_file = agent_dir / "gateway" / "platforms" / "api_server.py"
+    if not api_file.exists():
+        logger.warning("[esp32-voice-gateway] api_server.py not found at %s", api_file)
+        return False
+    # Check if git
+    git_dir = agent_dir / ".git"
+    if not git_dir.exists():
+        logger.warning("[esp32-voice-gateway] not a git repo: %s", agent_dir)
+        return False
+    # Try git apply --check first
+    try:
+        # if already patched, check will fail with "already applied" type – we detect via has_esp32 already
+        res = subprocess.run(
+            ["git", "apply", "--check", str(patch_path)],
+            cwd=str(agent_dir),
+            capture_output=True,
+            text=True,
+            timeout=15,
+        )
+        if res.returncode != 0:
+            # Could be already applied or conflict. Log but try to see if content already has marker
+            if "ESP32_AUDIO_MAX_BYTES" not in api_file.read_text()[:20000]:
+                logger.warning("[esp32-voice-gateway] patch check failed: %s %s", res.stdout[:500], res.stderr[:800])
+                # Try --3way if possible
+                res2 = subprocess.run(
+                    ["git", "apply", "--3way", str(patch_path)],
+                    cwd=str(agent_dir),
+                    capture_output=True,
+                    text=True,
+                    timeout=30,
+                )
+                if res2.returncode != 0:
+                    logger.error("[esp32-voice-gateway] git apply --3way failed: %s %s", res2.stdout[-500:], res2.stderr[-1000:])
+                    return False
+            else:
+                # already has marker, consider applied
+                logger.info("[esp32-voice-gateway] patch already present (has ESP32 marker)")
+                return True
+        else:
+            res_apply = subprocess.run(
+                ["git", "apply", str(patch_path)],
+                cwd=str(agent_dir),
+                capture_output=True,
+                text=True,
+                timeout=30,
+            )
+            if res_apply.returncode != 0:
+                logger.error("[esp32-voice-gateway] git apply failed: %s %s", res_apply.stdout[-500:], res_apply.stderr[-1000:])
+                return False
+        # Verify
+        if _api_server_has_esp32():
+            logger.info("[esp32-voice-gateway] Successfully restored ESP32 routes from %s -> %s", patch_path, api_file)
+            return True
+        else:
+            logger.warning("[esp32-voice-gateway] Patch applied but route marker still missing – need manual check")
+            return False
+    except Exception as e:
+        logger.exception("[esp32-voice-gateway] Exception applying patch %s: %s", patch_path, e)
+        return False
+
+
+def restore_if_needed() -> dict:
+    """Check and auto-restore if needed. Safe to call multiple times."""
+    result = {"had_routes": False, "restored": False, "patch": None, "agent_dir": None, "error": None}
+    try:
+        agent_dir = _find_hermes_agent_dir()
+        result["agent_dir"] = str(agent_dir) if agent_dir else None
+        if not agent_dir:
+            result["error"] = "hermes-agent dir not found"
+            return result
+        if _api_server_has_esp32():
+            result["had_routes"] = True
+            return result
+        # missing -> try restore
+        patch_file = _find_patch_file()
+        result["patch"] = str(patch_file) if patch_file else None
+        if not patch_file:
+            result["error"] = "no patch file found (checked patch/*.patch + ~/.hermes/esp32*.patch)"
+            logger.error("[esp32-voice-gateway] Routes missing after update and no patch file found!")
+            return result
+        logger.warning("[esp32-voice-gateway] ESP32 routes missing (likely after `hermes update`) – auto-restoring from %s", patch_file)
+        ok = _try_apply_patch(patch_file, agent_dir)
+        result["restored"] = ok
+        if ok:
+            # also copy patch to ~/.hermes for next fallback
+            try:
+                dest = Path.home() / ".hermes" / "esp32_live_draft_with_llm_patch.patch"
+                if patch_file.resolve() != dest.resolve():
+                    import shutil
+                    shutil.copy2(patch_file, dest)
+            except Exception:
+                pass
+        return result
+    except Exception as e:
+        result["error"] = str(e)
+        logger.exception("[esp32-voice-gateway] restore_if_needed failed")
+        return result
+
+
+# --- Plugin registration ---
+
+def register(ctx):
+    """Hermes plugin entry point."""
+    # On import, do fast self-heal check (10ms if routes present)
+    info = restore_if_needed()
+
+    # Register a tool so user can ask inside Hermes: "check ESP32 voice gateway"
+    import json
+
+    def _tool_check_esp32_gateway(args, **kwargs) -> str:
+        res = restore_if_needed()
+        # also run live curl checks if gateway running
+        checks = {}
+        try:
+            import socket
+            # try to find api_server port from config
+            port = 8642
+            try:
+                from hermes_cli.config import load_config
+                cfg = load_config()
+                g_port = ((cfg.get("gateway") or {}).get("api_server") or {}).get("port")
+                p_port = ((cfg.get("platforms") or {}).get("api_server") or {}).get("port")
+                raw_port = g_port or p_port or port
+                port = int(raw_port)
+            except Exception:
+                pass
+            # quick TCP check
+            s = socket.socket()
+            s.settimeout(1.0)
+            try:
+                s.connect(("127.0.0.1", port))
+                checks["tcp"] = f"127.0.0.1:{port} open"
+            except Exception as e:
+                checks["tcp"] = f"closed: {e}"
+            finally:
+                s.close()
+        except Exception as e:
+            checks["tcp_error"] = str(e)
+
+        return json.dumps({
+            "had_routes_before": info.get("had_routes"),
+            "restored": info.get("restored"),
+            "patch_used": info.get("patch"),
+            "agent_dir": info.get("agent_dir"),
+            "error": info.get("error"),
+            "has_routes_now": _api_server_has_esp32(),
+            "checks": checks,
+            "verify_curl": f'curl -H "Authorization: Bearer $API_SERVER_KEY" http://127.0.0.1:8642/api/esp32/voice/ws -v 2>&1 | grep "< HTTP" -> want 400 not 404'
+        }, indent=2)
+
+    def _tool_restore_esp32_gateway(args, **kwargs) -> str:
+        res = restore_if_needed()
+        # force reapply even if has routes if requested
+        force = bool(args.get("force"))
+        if force:
+            patch = _find_patch_file()
+            agent_dir = _find_hermes_agent_dir()
+            if patch and agent_dir:
+                # reset file first then reapply? just apply
+                ok = _try_apply_patch(patch, agent_dir)
+                res["force_restored"] = ok
+        return json.dumps(res, indent=2)
+
+    ctx.register_tool(
+        name="esp32_voice_gateway_status",
+        toolset="esp32_voice",
+        schema={
+            "name": "esp32_voice_gateway_status",
+            "description": "Check if ESP32 voice gateway routes (POST /api/esp32/voice + WS /api/esp32/voice/ws) are present after hermes update. Auto-restores from bundled patch if missing.",
+            "parameters": {"type": "object", "properties": {}, "required": []},
+        },
+        handler=_tool_check_esp32_gateway,
+        description="Check ESP32 voice gateway route status and auto-restore after update",
+    )
+
+    ctx.register_tool(
+        name="esp32_voice_gateway_restore",
+        toolset="esp32_voice",
+        schema={
+            "name": "esp32_voice_gateway_restore",
+            "description": "Force restore ESP32 voice gateway routes from bundled patch after hermes update wipes api_server.py",
+            "parameters": {
+                "type": "object",
+                "properties": {
+                    "force": {"type": "boolean", "description": "Force re-apply even if routes seem present"},
+                },
+                "required": [],
+            },
+        },
+        handler=_tool_restore_esp32_gateway,
+        description="Force restore ESP32 routes from patch",
+    )
+
+    def _on_startup(session_id=None, **kw):
+        # Gateway hook – log status on startup for visibility
+        try:
+            if _api_server_has_esp32():
+                logger.info("[esp32-voice-gateway] Routes OK: /api/esp32/voice + /api/esp32/voice/ws present")
+            else:
+                logger.warning("[esp32-voice-gateway] Routes MISSING at startup – will try restore on next tool call; if you just ran `hermes update`, run: ~/Projects/hermes-esp32-voice-gateway/scripts/restore_after_update.py && hermes gateway restart")
+        except Exception:
+            pass
+
+    try:
+        ctx.register_hook("on_session_start", _on_startup)
+    except Exception:
+        pass
+
+    logger.info("[esp32-voice-gateway] Plugin loaded (had_routes=%s restored=%s has_now=%s)", info.get("had_routes"), info.get("restored"), _api_server_has_esp32())

hermes_plugin/plugin.yaml

@@ -0,0 +1,8 @@
+name: esp32-voice-gateway
+version: "1.0.0"
+description: "Reyna family ESP32 + iPhone Watch voice gateway - auto-restores custom api_server.py routes after hermes update (POST /api/esp32/voice + WS /api/esp32/voice/ws + live draft + Apple 3B instant reply)"
+author: "Adolfo Reyna"
+kind: standalone
+provides_tools: []
+provides_hooks:
+  - on_session_start

scripts/restore_after_update.py

@@ -0,0 +1,187 @@
+#!/usr/bin/env python3
+"""
+Restore ESP32 voice gateway after `hermes update`.
+
+Usage:
+  ./scripts/restore_after_update.py
+  python3 scripts/restore_after_update.py --verify
+  python3 scripts/restore_after_update.py --force
+
+What it does:
+- Checks if gateway/platforms/api_server.py has ESP32 routes
+- If missing, applies patch/api_server_esp32_live_draft_with_llm.patch via git apply
+- Verifies routes return 400 not 404 (400 means route exists but missing WS upgrade / empty body)
+- Copies patch to ~/.hermes/ fallback location
+- Prints next steps (gateway restart)
+
+Env:
+  HERMES_AGENT_DIR - override hermes-agent checkout path
+"""
+
+import argparse
+import subprocess
+import sys
+from pathlib import Path
+
+def find_agent_dir() -> Path | None:
+    import os
+    candidates = []
+    env_dir = os.getenv("HERMES_AGENT_DIR")
+    if env_dir:
+        candidates.append(Path(env_dir))
+    candidates.append(Path.home() / ".hermes" / "hermes-agent")
+    alt_path = Path(__file__).resolve().parents[2] / ".hermes" / "hermes-agent"
+    if alt_path.exists():
+        candidates.append(alt_path)
+    try:
+        import hermes_cli  # type: ignore
+        candidates.append(Path(hermes_cli.__file__).parents[1])
+    except Exception:
+        pass
+    for c in candidates:
+        if c and (c / "gateway" / "platforms" / "api_server.py").exists():
+            return c
+    return None
+
+def has_routes(api_file: Path) -> bool:
+    try:
+        txt = api_file.read_text()
+        return "ESP32_AUDIO_MAX_BYTES" in txt[:20000] and "/api/esp32/voice" in txt and "_handle_esp32_voice_ws" in txt
+    except Exception:
+        return False
+
+def find_patch(repo_root: Path) -> Path | None:
+    for p in [
+        repo_root / "patch" / "api_server_esp32_live_draft_with_llm.patch",
+        repo_root / "hermes_plugin" / "patch" / "api_server_esp32_live_draft_with_llm.patch",
+        Path.home() / ".hermes" / "esp32_live_draft_with_llm_patch.patch",
+        Path.home() / ".hermes" / "esp32_voice_patch.patch",
+    ]:
+        if p.exists() and p.stat().st_size > 1000:
+            return p
+    # any in patch/
+    for f in (repo_root / "patch").glob("*.patch"):
+        if f.stat().st_size > 1000:
+            return f
+    return None
+
+def apply_patch(patch_path: Path, agent_dir: Path, force: bool=False) -> bool:
+    api_file = agent_dir / "gateway" / "platforms" / "api_server.py"
+    print(f"[restore] patch={patch_path} agent_dir={agent_dir} api_file={api_file} force={force}")
+    if not (agent_dir / ".git").exists():
+        print(f"[restore] {agent_dir} is not a git repo")
+        return False
+    if has_routes(api_file) and not force:
+        print("[restore] routes already present, skipping (use --force to reapply)")
+        return True
+    # Try apply
+    if force:
+        # reset file to HEAD first? we do checkout
+        try:
+            subprocess.run(["git", "checkout", "HEAD", "--", "gateway/platforms/api_server.py"], cwd=str(agent_dir), timeout=15)
+        except Exception:
+            pass
+    # Check
+    chk = subprocess.run(["git", "apply", "--check", str(patch_path)], cwd=str(agent_dir), capture_output=True, text=True, timeout=15)
+    if chk.returncode != 0:
+        print(f"[restore] git apply --check output:\n{chk.stdout[:1000]}\n{chk.stderr[:1000]}")
+        # Try 3way if not forced yet
+        if not force:
+            print("[restore] trying git apply --3way")
+            r = subprocess.run(["git", "apply", "--3way", str(patch_path)], cwd=str(agent_dir), capture_output=True, text=True, timeout=30)
+            print(r.stdout[-500:] if r.stdout else "", r.stderr[-1000:] if r.stderr else "")
+            if r.returncode == 0:
+                print("[restore] 3way apply ok")
+                return has_routes(api_file)
+        else:
+            r = subprocess.run(["git", "apply", str(patch_path)], cwd=str(agent_dir), capture_output=True, text=True, timeout=30)
+            print(r.stdout[-500:] if r.stdout else "", r.stderr[-1000:] if r.stderr else "")
+            return r.returncode == 0 and has_routes(api_file)
+    else:
+        r = subprocess.run(["git", "apply", str(patch_path)], cwd=str(agent_dir), capture_output=True, text=True, timeout=30)
+        if r.returncode != 0:
+            print(f"[restore] apply failed: {r.stdout} {r.stderr}")
+            return False
+        print(f"[restore] applied OK")
+        return has_routes(api_file)
+
+def verify_curly_brace_imports(agent_dir: Path) -> bool:
+    """Guard against missing top imports ipaddress/urlparse (bug that caused 500 loop 2026-07-14)"""
+    api_file = agent_dir / "gateway" / "platforms" / "api_server.py"
+    txt = api_file.read_text()
+    has_ip = "import ipaddress" in txt
+    has_url = "from urllib.parse import urlparse" in txt
+    print(f"[verify] top imports: ipaddress={has_ip} urlparse={has_url}")
+    if not has_ip or not has_url:
+        print("[verify] MISSING critical imports – this will cause 500 import loop (see skill pitfalls). Fix by ensuring patch includes them.")
+        return False
+    return True
+
+def compile_check(agent_dir: Path) -> bool:
+    api_file = agent_dir / "gateway" / "platforms" / "api_server.py"
+    r = subprocess.run([sys.executable, "-m", "py_compile", str(api_file)], capture_output=True, text=True, timeout=15)
+    if r.returncode != 0:
+        print(f"[compile] failed: {r.stderr}")
+        return False
+    print("[compile] OK")
+    return True
+
+def main():
+    parser = argparse.ArgumentParser()
+    parser.add_argument("--force", action="store_true", help="Force reapply even if routes present")
+    parser.add_argument("--verify", action="store_true", help="Only verify, don't apply")
+    args = parser.parse_args()
+
+    repo_root = Path(__file__).resolve().parents[1]
+    agent_dir = find_agent_dir()
+    if not agent_dir:
+        print("Could not find hermes-agent dir (checked ~/.hermes/hermes-agent, HERMES_AGENT_DIR, pip location)")
+        sys.exit(2)
+    api_file = agent_dir / "gateway" / "platforms" / "api_server.py"
+    print(f"Agent dir: {agent_dir}")
+    print(f"API file: {api_file}")
+    print(f"Has routes: {has_routes(api_file)}")
+
+    if args.verify:
+        ok = verify_curly_brace_imports(agent_dir) and compile_check(agent_dir) and has_routes(api_file)
+        sys.exit(0 if ok else 1)
+
+    patch = find_patch(repo_root)
+    if not patch:
+        print(f"No patch found. Looked in {repo_root}/patch/ and ~/.hermes/*.patch")
+        sys.exit(2)
+    print(f"Using patch: {patch} ({patch.stat().st_size} bytes)")
+
+    ok = apply_patch(patch, agent_dir, force=args.force)
+    if not ok:
+        print("[restore] FAILED to restore")
+        sys.exit(1)
+
+    verify_curly_brace_imports(agent_dir)
+    compile_check(agent_dir)
+
+    # Copy to ~/.hermes fallback
+    try:
+        dest = Path.home() / ".hermes" / "esp32_live_draft_with_llm_patch.patch"
+        if patch.resolve() != dest.resolve():
+            import shutil
+            shutil.copy2(patch, dest)
+            print(f"[restore] copied patch to {dest} for fallback")
+    except Exception as e:
+        print(f"[restore] failed to copy fallback: {e}")
+
+    print("""
+[restore] DONE. Next:
+  1. hermes gateway restart (from a DIFFERENT shell, not from inside Hermes chat - see skill pitfalls)
+     Use: systemctl --user restart hermes-gateway hermes-gateway-kids --no-pager || hermes gateway restart
+  2. If stuck in deactivating:
+     pkill -9 -f "hermes_cli.main gateway run"; systemctl --user reset-failed hermes-gateway*; systemctl --user start hermes-gateway
+  3. Verify routes (should be 400 not 404):
+     API_KEY=$(grep -E API_SERVER_KEY .env -h ~/.hermes/.env ~/.hermes/profiles/*/ .env 2>/dev/null | head -1 | cut -d= -f2 | tr -d '\"'\\'')
+     curl -s -o /dev/null -w "%{http_code}\\n" -H "Authorization: Bearer $API_KEY" http://127.0.0.1:8642/api/esp32/voice/ws
+     curl -s -o /dev/null -w "%{http_code}\\n" -H "Authorization: Bearer $API_KEY" -X POST http://127.0.0.1:8642/api/esp32/voice --data-binary @/dev/null
+     # Both should print 400. 404 means routes still missing.
+""")
+
+if __name__ == "__main__":
+    main()

scripts/restore_after_update.sh

@@ -0,0 +1,5 @@
+#!/usr/bin/env bash
+set -euo pipefail
+# One-liner called by cron/gateway after update to ensure routes present
+REPO_ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+python3 "$REPO_ROOT/scripts/restore_after_update.py" "$@"