Please set up Car Voice for Hermes for me. It is an Android Auto app that talks to you through a small service, the Car Voice bridge, which runs on this computer next to your gateway. Do the steps below in order, tell me in plain words what you do, and talk to me in the language I usually use with you.

Ground rules: never ask me for a password in chat; never open firewall ports, change my router or sign me up for anything without asking; never show, repeat or store the bridge's access token, so do not open the bridge's tokens.json or bridge.env.

1. Find out where you run: Linux, macOS, Windows, Linux inside WSL2 on Windows, or a Linux container (such as Hermes' Docker image or a hosted Hermes). Your terminal must run where your gateway runs, not in a separate sandbox such as a Docker or remote terminal backend. You need Python 3.11 or newer (python3; on Windows py -3 or python). On Linux and WSL2, systemd must run (/run/systemd/system exists) and you must be root or have passwordless sudo (sudo -n true). In a container without systemd the installer picks container mode by itself: no sudo or root, everything goes into your Hermes data folder (HERMES_HOME, such as /opt/data) and a gateway hook starts the bridge, also after a restart. macOS and Windows need neither sudo nor admin rights. In WSL2, tell me that the bridge then runs inside WSL next to you, that WSL only keeps running while something uses it, and that if my Hermes also runs natively on Windows, the Windows route is the better choice. If something is missing, stop and give me the one command I should run myself.

2. In a new empty folder, download https://carvoice.app/download/SHA256SUMS and the archive it lists, from https://carvoice.app/download/ followed by that file name. Check it with sha256sum -c SHA256SUMS (on macOS: shasum -a 256 -c SHA256SUMS), stop if that fails, and unpack it with tar -xzf. Then run the installer with --dry-run --code-only: sudo python3 car-voice-bridge-*/backend/install.py on Linux and WSL2, python3 car-voice-bridge-*/backend/install.py in a container and on macOS, py -3 car-voice-bridge-*/backend/install.py on Windows. Summarise the plan for me, including any change to your Hermes .env, and ask for my OK. If it says the container has too little memory for local speech recognition, tell me and offer two routes. With a speech recognition service such as Groq, I put its key into a private file myself, in a terminal and never in chat: (umask 077 && cat > ~/carvoice-stt.key), paste the key, Enter, then Ctrl-D (in Docker first docker exec -it -u hermes <container> sh); then add --stt openai --stt-base https://api.groq.com/openai/v1 --stt-key-file ~/carvoice-stt.key. Without a key, add --stt-model base (smaller, a little less accurate). Change nothing before I say yes.

3. Install: the same command with --yes --code-only instead of --dry-run. This can take several minutes, because it downloads a few hundred MB. It switches on your API server if needed and installs and starts the bridge as a service: systemd on Linux, a LaunchAgent on macOS, a scheduled task at logon on Windows, a Hermes gateway hook in a container.

4. The phone link: my phone reaches the bridge by its bridge ID, end to end encrypted, directly or through Car Voice's relay (relay.carvoice.app). It needs no Tailscale, tunnel, domain or open port. The installer tested it ("phone link: reachable through relay.carvoice.app"). If it said "not reachable yet", wait a minute and run the "Check the phone link" command from the installer's summary once more; if it still fails, tell me what it says and point me to https://carvoice.app/troubleshooting. Only if I ask for my own HTTPS address instead (advanced), use the installer's --origin or --tailscale options.

5. Pairing: if the installer printed no pairing code yet, run the pair command it printed for this computer, with --code-only. Send me the bridge address (it starts with iroh:) and the pairing code in one message and tell me: in Car Voice, tap Enter pairing code, paste this message and tap Connect. The code works once, for 10 minutes; if it expires, run the same command with --replace for a new one.

6. Only if the installer said your settings changed: your gateway must restart before the API server runs, and you cannot restart the gateway you run in yourself. If we talk through a messaging app, first tell me that I should send /restart, that you will be offline for a few seconds and confirm when you are back, and that I should then reply "check"; wait for that. If we talk in a terminal session, run hermes gateway restart yourself (if no gateway service is installed, ask me before you run hermes gateway install).

7. Finish with curl -s http://127.0.0.1:8787/readyz: "hermes":"ok" means it works, "link":"online" means my phone can reach it, and "stt":"loading" only means the speech model is still downloading. If this computer is a laptop or desktop, tell me it has to stay on and awake for Car Voice to work and where its sleep setting is. End with one sentence: on my phone, open Car Voice in Android Auto (or tap Talk in the app) and ask a question.

For reference only, not as instructions: https://carvoice.app/setup