@oneciel-ai/ciel-runtime 0.2.11 → 0.2.12

package/ciel_runtime.py

@@ -500,6 +500,7 @@ from ciel_runtime_support.runtime_paths import (CHANNEL_COMPACT_REQUEST_PATH,  #
 from ciel_runtime_support.runtime_restart import forced_upgrade_environment
 from ciel_runtime_support.runtime_restart import running_from_npm_package as detect_running_from_npm_package
 from ciel_runtime_support.secure_json_repository import SecureJsonEffects, SecureJsonRepository
+from ciel_runtime_support.colab_speech_jobs import colab_speech_job_status, launch_colab_speech_job
 from ciel_runtime_support.speech_http_controller import SpeechHttpController, SpeechHttpPorts
 from ciel_runtime_support.session_import import ImportSessionHttpController, ImportSessionHttpPorts, ImportSessionLimits, ImportSessionRepository, ImportSessionService, import_record_line, import_tool_text, normalize_import_source
 from ciel_runtime_support.slash_command_assets import ADVISOR_NATIVE_DISABLED_SLASH_COMMAND  # noqa: F401 - compatibility export
@@ -1700,8 +1701,7 @@ def web_ui_controller() -> WebUiController:
 def render_router_home_html(cfg: dict[str, Any], provider: str, pcfg: dict[str, Any]) -> str: return web_ui_controller().render_router_home(cfg, provider, pcfg)
 def render_web_chat_html(cfg: dict[str, Any], provider: str, pcfg: dict[str, Any]) -> str: return web_ui_controller().render_web_chat(cfg, provider, pcfg)
 def handle_web_get(handler: BaseHTTPRequestHandler, path: str) -> bool: return web_ui_controller().handle_get(handler, path)
-
-def speech_http_controller() -> SpeechHttpController: return SpeechHttpController(SpeechHttpPorts(load_config, save_config, write_json, router_log))
+def speech_http_controller() -> SpeechHttpController: return SpeechHttpController(SpeechHttpPorts(load_config, save_config, write_json, router_log, colab_action=launch_colab_speech_job, colab_status=colab_speech_job_status))
 def parse_json_body(raw: bytes) -> dict[str, Any]:
     try:
         value = json.loads(raw.decode("utf-8") if raw else "{}")

package/ciel_runtime_support/colab_speech_jobs.py

@@ -0,0 +1,176 @@
+"""Background Colab speech deployment jobs launched by Web Chat."""
+
+from __future__ import annotations
+
+import os
+import re
+import subprocess
+import threading
+import uuid
+from dataclasses import dataclass
+from pathlib import Path
+from typing import Any
+
+from .runtime_paths import CONFIG_DIR
+
+
+_ACTIONS = {"start", "deploy", "recreate", "status"}
+_SAFE_NAME = re.compile(r"[A-Za-z0-9][A-Za-z0-9._-]{0,127}")
+_SECRET_PATTERN = re.compile(r"(?:tskey-[A-Za-z0-9_-]+|Bearer\s+\S+)", re.IGNORECASE)
+
+
+@dataclass(slots=True)
+class _Job:
+    job_id: str
+    action: str
+    profile: str
+    process: subprocess.Popen[bytes]
+    log_path: Path
+    redactions: tuple[str, ...]
+
+
+class ColabSpeechJobManager:
+    def __init__(self, script_path: Path, state_dir: Path) -> None:
+        self.script_path = script_path
+        self.state_dir = state_dir
+        self._jobs: dict[str, _Job] = {}
+        self._latest = ""
+        self._lock = threading.Lock()
+
+    @staticmethod
+    def _safe_name(value: Any, label: str) -> str:
+        text = str(value or "").strip()
+        if not _SAFE_NAME.fullmatch(text):
+            raise ValueError(f"invalid Colab {label}")
+        return text
+
+    def login_command(self, settings: dict[str, Any], *, reset: bool = False) -> str:
+        profile = self._safe_name(settings.get("profile") or "default", "profile")
+        distribution = self._safe_name(settings.get("distribution") or "Ubuntu-26.04", "distribution")
+        auth = str(settings.get("auth") or "oauth2").strip().lower()
+        if auth not in {"adc", "oauth2"}:
+            raise ValueError("Colab auth must be adc or oauth2")
+        suffix = " -ResetAuthentication" if reset else ""
+        return (
+            "powershell -ExecutionPolicy Bypass -File "
+            f'"{self.script_path}" -Action Login -Distribution "{distribution}" '
+            f'-ColabAuth "{auth}" -Profile "{profile}"{suffix}'
+        )
+
+    @staticmethod
+    def _redact(text: str, redactions: tuple[str, ...]) -> str:
+        result = _SECRET_PATTERN.sub("<redacted>", text)
+        for secret in redactions:
+            result = result.replace(secret, "<redacted>")
+        return result
+
+    def _scrub_completed_log(self, job: _Job) -> None:
+        job.process.wait()
+        try:
+            original = job.log_path.read_text(encoding="utf-8", errors="replace")
+            redacted = self._redact(original, job.redactions)
+            if redacted != original:
+                job.log_path.write_text(redacted, encoding="utf-8")
+        except OSError:
+            pass
+
+    def launch(
+        self,
+        action: str,
+        settings: dict[str, Any],
+        secrets: dict[str, str] | None = None,
+    ) -> dict[str, Any]:
+        normalized = str(action or "").strip().lower()
+        if normalized == "login":
+            return {
+                "ok": True,
+                "requires_terminal": True,
+                "command": self.login_command(settings, reset=bool((secrets or {}).get("reset_authentication"))),
+            }
+        if normalized not in _ACTIONS:
+            raise ValueError("Colab action must be start, deploy, recreate, status, or login")
+        if os.name != "nt":
+            raise RuntimeError("Web-managed Colab deployment currently requires Windows with WSL")
+        if not self.script_path.is_file():
+            raise RuntimeError(f"Colab deployment script is missing: {self.script_path}")
+        profile = self._safe_name(settings.get("profile") or "default", "profile")
+        with self._lock:
+            for job in self._jobs.values():
+                if job.profile == profile and job.process.poll() is None:
+                    raise RuntimeError(f"Colab profile '{profile}' already has a running job")
+            self.state_dir.mkdir(parents=True, exist_ok=True)
+            job_id = uuid.uuid4().hex[:16]
+            log_path = self.state_dir / f"{job_id}.log"
+            command = [
+                "powershell.exe",
+                "-NoProfile",
+                "-ExecutionPolicy",
+                "Bypass",
+                "-File",
+                str(self.script_path),
+                "-Action",
+                normalized.capitalize(),
+                "-Profile",
+                profile,
+            ]
+            environment = os.environ.copy()
+            supplied = secrets or {}
+            for source, target in (("tailscale_auth_key", "TAILSCALE_AUTHKEY"), ("speech_api_key", "CIEL_SPEECH_API_KEY")):
+                value = str(supplied.get(source) or "").strip()
+                if value:
+                    environment[target] = value
+            with log_path.open("wb") as output:
+                process = subprocess.Popen(
+                    command,
+                    cwd=str(self.script_path.parent.parent),
+                    env=environment,
+                    stdin=subprocess.DEVNULL,
+                    stdout=output,
+                    stderr=subprocess.STDOUT,
+                    creationflags=getattr(subprocess, "CREATE_NO_WINDOW", 0),
+                )
+            redactions = tuple(str(supplied.get(key) or "").strip() for key in ("tailscale_auth_key", "speech_api_key") if str(supplied.get(key) or "").strip())
+            job = _Job(job_id, normalized, profile, process, log_path, redactions)
+            self._jobs[job_id] = job
+            self._latest = job_id
+            threading.Thread(target=self._scrub_completed_log, args=(job,), daemon=True).start()
+        return self.status(job_id)
+
+    def status(self, job_id: str = "") -> dict[str, Any]:
+        selected = str(job_id or "").strip() or self._latest
+        with self._lock:
+            job = self._jobs.get(selected)
+            if job is None:
+                return {"ok": True, "job": None}
+            return_code = job.process.poll()
+            try:
+                output = job.log_path.read_text(encoding="utf-8", errors="replace")[-16000:]
+            except OSError:
+                output = ""
+        redacted_output = self._redact(output, job.redactions)
+        return {
+            "ok": return_code in {None, 0},
+            "job": {
+                "id": job.job_id,
+                "action": job.action,
+                "profile": job.profile,
+                "running": return_code is None,
+                "return_code": return_code,
+                "output": redacted_output,
+            },
+        }
+
+
+_SCRIPT_PATH = Path(__file__).resolve().parents[1] / "scripts" / "deploy_colab_speech.ps1"
+_MANAGER = ColabSpeechJobManager(_SCRIPT_PATH, CONFIG_DIR / "colab-jobs")
+
+
+def launch_colab_speech_job(action: str, settings: dict[str, Any], secrets: dict[str, str] | None = None) -> dict[str, Any]:
+    return _MANAGER.launch(action, settings, secrets)
+
+
+def colab_speech_job_status(job_id: str = "") -> dict[str, Any]:
+    return _MANAGER.status(job_id)
+
+
+__all__ = ["ColabSpeechJobManager", "colab_speech_job_status", "launch_colab_speech_job"]

package/ciel_runtime_support/config_repository.py

@@ -32,6 +32,7 @@ def build_default_config(provider_defaults: dict[str, Any]) -> dict[str, Any]:
                 "enabled": True,
                 "distribution": "Ubuntu-26.04",
                 "auth": "adc",
+                "profile": "default",
                 "asr_session": "ciel-asr",
                 "tts_session": "ciel-tts",
                 "asr_accelerator": "T4",

package/ciel_runtime_support/runtime_constants.py

@@ -93,7 +93,7 @@ OFFICIAL_CHANNEL_PLUGINS = {
 }
 
 APP_NAME = "Ciel Runtime"
-VERSION = "0.2.11"
+VERSION = "0.2.12"
 CREDITS = "Credits: One Ciel LLC"
 PRELAUNCH_CANCEL = 10
 PRELAUNCH_LAUNCH_CODEX = 11

package/ciel_runtime_support/speech_http_controller.py

@@ -24,6 +24,8 @@ class SpeechHttpPorts:
     write_json: Callable[..., None]
     log: Callable[[str, str], None]
     urlopen: Callable[..., Any] = urllib.request.urlopen
+    colab_action: Callable[[str, dict[str, Any], dict[str, str]], dict[str, Any]] | None = None
+    colab_status: Callable[[str], dict[str, Any]] | None = None
 
 
 @dataclass(frozen=True, slots=True)
@@ -37,6 +39,10 @@ class SpeechHttpController:
         if path == "/ca/speech/health":
             self.ports.write_json(handler, self.health_payload())
             return True
+        if path == "/ca/speech/colab/job":
+            payload = self.ports.colab_status("") if self.ports.colab_status else {"ok": True, "job": None}
+            self.ports.write_json(handler, payload)
+            return True
         if path == "/ca/web/chat/api":
             self.ports.write_json(handler, self.discovery_payload())
             return True
@@ -53,6 +59,8 @@ class SpeechHttpController:
     ) -> bool:
         if path == "/ca/speech/config":
             return self._save_public_config(handler, raw)
+        if path == "/ca/speech/colab/action":
+            return self._start_colab_action(handler, raw)
         if path in {"/v1/audio/transcriptions", "/v1/audio/translations"}:
             return self._proxy_asr(handler, raw, content_type)
         if path in {"/v1/audio/speech", "/v1/audio/speech/batch"}:
@@ -90,6 +98,8 @@ class SpeechHttpController:
                 "chat_files": "POST /ca/channel/files",
                 "speech_config": "GET|POST /ca/speech/config",
                 "speech_health": "GET /ca/speech/health",
+                "colab_action": "POST /ca/speech/colab/action",
+                "colab_job": "GET /ca/speech/colab/job",
                 "asr": "POST /v1/audio/transcriptions",
                 "asr_translate": "POST /v1/audio/translations",
                 "tts": "POST /v1/audio/speech",
@@ -164,6 +174,32 @@ class SpeechHttpController:
             self.ports.write_json(handler, {"ok": False, "error": str(exc)}, 400)
         return True
 
+    def _start_colab_action(self, handler: BaseHTTPRequestHandler, raw: bytes) -> bool:
+        try:
+            if self.ports.colab_action is None:
+                raise RuntimeError("Colab deployment jobs are unavailable")
+            body = json.loads(raw.decode("utf-8") if raw else "{}")
+            if not isinstance(body, dict):
+                raise ValueError("request must be a JSON object")
+            action = str(body.get("action") or "").strip().lower()
+            config = self._speech_config()
+            colab = config.get("colab") if isinstance(config.get("colab"), dict) else {}
+            if colab.get("enabled") is False:
+                raise ValueError("Colab worker management is disabled")
+            secrets_payload = body.get("secrets") if isinstance(body.get("secrets"), dict) else {}
+            secrets = {
+                "tailscale_auth_key": str(secrets_payload.get("tailscale_auth_key") or ""),
+                "speech_api_key": str(secrets_payload.get("speech_api_key") or ""),
+                "reset_authentication": "1" if body.get("reset_authentication") is True else "",
+            }
+            result = self.ports.colab_action(action, dict(colab), secrets)
+            self.ports.write_json(handler, result)
+        except (UnicodeError, json.JSONDecodeError, ValueError, TypeError) as exc:
+            self.ports.write_json(handler, {"ok": False, "error": str(exc)}, 400)
+        except RuntimeError as exc:
+            self.ports.write_json(handler, {"ok": False, "error": str(exc)}, 409)
+        return True
+
     @staticmethod
     def _validated_value(service: str, key: str, value: Any) -> Any:
         allowed = {
@@ -215,6 +251,7 @@ class SpeechHttpController:
             "enabled",
             "distribution",
             "auth",
+            "profile",
             "asr_session",
             "tts_session",
             "asr_accelerator",

package/ciel_runtime_support/web_ui.py

@@ -254,12 +254,18 @@ def render_web_chat_page(
             <label class="check"><input id="colabEnabled" type="checkbox"> Manage workers with Colab CLI</label>
             <label>WSL distribution<input id="colabDistribution" placeholder="Ubuntu-26.04"></label>
             <label>Authentication<select id="colabAuth"><option value="adc">ADC</option><option value="oauth2">OAuth2</option></select></label>
+            <label>Account profile<input id="colabProfile" placeholder="default"></label>
             <label>ASR session<input id="colabAsrSession" placeholder="ciel-asr"></label>
             <label>TTS session<input id="colabTtsSession" placeholder="ciel-tts"></label>
             <label>ASR GPU<select id="colabAsrAccelerator"><option>T4</option><option>L4</option><option>G4</option><option>A100</option><option>H100</option></select></label>
             <label>TTS GPU<select id="colabTtsAccelerator"><option>T4</option><option>L4</option><option>G4</option><option>A100</option><option>H100</option></select></label>
+            <label class="wide">Tailscale auth key for this run<input id="colabTailscaleAuthKey" type="password" autocomplete="new-password" placeholder="Not saved; Colab Secret may be used instead"></label>
+            <label class="wide">Speech API key for this run<input id="colabSpeechApiKey" type="password" autocomplete="new-password" placeholder="Not saved; optional"></label>
+            <label class="check wide"><input id="colabResetAuthentication" type="checkbox"> Forget this profile's current login before generating a login command</label>
           </div>
-          <div class="hint">Saved here for scripts/deploy_colab_speech.ps1. Credentials remain in the Colab CLI profile and are never stored by Ciel.</div>
+          <div class="settings-actions"><button class="ghost" id="colabLoginButton" type="button">Copy login command</button><button class="ghost" id="colabStatusButton" type="button">Check sessions</button><button class="ghost" id="colabStartButton" type="button">Start missing</button><button class="primary" id="colabDeployButton" type="button">Recover &amp; deploy</button><button class="ghost" id="colabRecreateButton" type="button">Recreate all</button></div>
+          <pre class="hint" id="colabJobStatus">No Colab deployment job has been started.</pre>
+          <div class="hint">Named account profiles get an isolated WSL HOME, OAuth token, session state, and history; <code>default</code> keeps the existing Colab CLI login for compatibility. Login remains an interactive CLI step; deployment jobs run in the background. Ephemeral keys above are passed only to that job and are never saved by Ciel.</div>
         </section>
         <section class="settings-section">
           <h3>Tailscale tunnel</h3>
@@ -747,10 +753,14 @@ def render_web_chat_page(
       document.getElementById('colabEnabled').checked = colab.enabled !== false;
       document.getElementById('colabDistribution').value = colab.distribution || 'Ubuntu-26.04';
       document.getElementById('colabAuth').value = colab.auth || 'adc';
+      document.getElementById('colabProfile').value = colab.profile || 'default';
       document.getElementById('colabAsrSession').value = colab.asr_session || 'ciel-asr';
       document.getElementById('colabTtsSession').value = colab.tts_session || 'ciel-tts';
       document.getElementById('colabAsrAccelerator').value = colab.asr_accelerator || 'T4';
       document.getElementById('colabTtsAccelerator').value = colab.tts_accelerator || 'T4';
+      document.getElementById('colabTailscaleAuthKey').value = '';
+      document.getElementById('colabSpeechApiKey').value = '';
+      document.getElementById('colabResetAuthentication').checked = false;
       document.getElementById('tailscaleEnabled').checked = tailscale.enabled !== false;
       document.getElementById('tailscaleAsrHostname').value = tailscale.asr_hostname || 'ciel-asr';
       document.getElementById('tailscaleTtsHostname').value = tailscale.tts_hostname || 'ciel-tts';
@@ -793,6 +803,7 @@ def render_web_chat_page(
           enabled: document.getElementById('colabEnabled').checked,
           distribution: document.getElementById('colabDistribution').value,
           auth: document.getElementById('colabAuth').value,
+          profile: document.getElementById('colabProfile').value,
           asr_session: document.getElementById('colabAsrSession').value,
           tts_session: document.getElementById('colabTtsSession').value,
           asr_accelerator: document.getElementById('colabAsrAccelerator').value,
@@ -811,6 +822,48 @@ def render_web_chat_page(
       setSpeechForm(data);
       return data;
     }}
+    function renderColabJob(payload) {{
+      const output = document.getElementById('colabJobStatus');
+      const job = payload && payload.job;
+      if (!job) {{ output.textContent = 'No Colab deployment job has been started.'; return; }}
+      const state = job.running ? 'running' : job.return_code === 0 ? 'completed' : `failed (${{job.return_code}})`;
+      output.textContent = `${{job.action}} · profile ${{job.profile}} · ${{state}}\n${{job.output || ''}}`.trim();
+      output.scrollTop = output.scrollHeight;
+    }}
+    async function pollColabJob() {{
+      const response = await fetch('/ca/speech/colab/job', {{headers: {{'accept': 'application/json'}}, cache: 'no-store'}});
+      const data = await response.json();
+      renderColabJob(data);
+      if (data.job && data.job.running) setTimeout(() => pollColabJob().catch(() => {{}}), 2000);
+      else if (data.job) setState(data.job.return_code === 0 ? 'Colab job complete' : 'Colab job failed', data.job.return_code === 0 ? 'ok' : 'error');
+      return data;
+    }}
+    async function runColabAction(action) {{
+      await saveSpeechConfig();
+      const payload = {{
+        action,
+        reset_authentication: document.getElementById('colabResetAuthentication').checked,
+        secrets: {{
+          tailscale_auth_key: document.getElementById('colabTailscaleAuthKey').value,
+          speech_api_key: document.getElementById('colabSpeechApiKey').value,
+        }},
+      }};
+      const response = await fetch('/ca/speech/colab/action', {{method: 'POST', headers: {{'content-type': 'application/json', 'accept': 'application/json'}}, body: JSON.stringify(payload)}});
+      const data = await response.json();
+      document.getElementById('colabTailscaleAuthKey').value = '';
+      document.getElementById('colabSpeechApiKey').value = '';
+      if (!response.ok || !data.ok) throw new Error(data.error || `HTTP ${{response.status}}`);
+      if (data.requires_terminal) {{
+        await navigator.clipboard.writeText(data.command);
+        document.getElementById('colabJobStatus').textContent = 'Login command copied. Run it in a local terminal and complete authentication for the selected Google account.\\n\\n' + data.command;
+        setState('login command copied', 'ok');
+        return data;
+      }}
+      renderColabJob(data);
+      setState(`Colab ${{action}} started`, 'ok');
+      setTimeout(() => pollColabJob().catch(() => {{}}), 1000);
+      return data;
+    }}
     function stopActiveSpeech() {{
       if (speechGenerationController) speechGenerationController.abort();
       speechGenerationController = null;
@@ -1276,6 +1329,14 @@ def render_web_chat_page(
       speechSettingsDialog.showModal();
     }});
     speechSettingsClose.addEventListener('click', () => speechSettingsDialog.close());
+    document.getElementById('colabLoginButton').addEventListener('click', () => runColabAction('login').catch(err => addBubble('system', 'Colab login command failed: ' + String(err && err.message ? err.message : err))));
+    document.getElementById('colabStatusButton').addEventListener('click', () => runColabAction('status').catch(err => addBubble('system', 'Colab status failed: ' + String(err && err.message ? err.message : err))));
+    document.getElementById('colabStartButton').addEventListener('click', () => runColabAction('start').catch(err => addBubble('system', 'Colab start failed: ' + String(err && err.message ? err.message : err))));
+    document.getElementById('colabDeployButton').addEventListener('click', () => runColabAction('deploy').catch(err => addBubble('system', 'Colab deployment failed: ' + String(err && err.message ? err.message : err))));
+    document.getElementById('colabRecreateButton').addEventListener('click', () => {{
+      if (!confirm('Release both sessions in this account profile, create new instances, and redeploy ASR/TTS?')) return;
+      runColabAction('recreate').catch(err => addBubble('system', 'Colab recreation failed: ' + String(err && err.message ? err.message : err)));
+    }});
     document.getElementById('ttsReferenceAudio').addEventListener('change', async event => {{
       const file = event.target.files && event.target.files[0];
       if (!file) return;

package/docs/COLAB_SPEECH.md

@@ -20,6 +20,24 @@ Set the WSL distribution, authentication mode, ASR/TTS session names, and accele
 
 The script reuses matching active sessions when possible, otherwise creates them, installs Qwen3-ASR-0.6B and MOSS-TTS-Nano, starts Tailscale in userspace networking mode, publishes each localhost model server with Tailscale Serve, and saves both returned `base_url` values into Web Chat > Speech Settings automatically.
 
+### Session recovery and account profiles
+
+Web Chat > Speech Settings exposes **Check sessions**, **Start missing**, **Recover & deploy**, and **Recreate all**. Start creates only missing or expired ASR/TTS sessions. Recover creates missing sessions and then runs both bootstrap scripts. Recreate explicitly releases both sessions before creating and deploying replacements. These actions are also available through `POST /ca/speech/colab/action`, while `GET /ca/speech/colab/job` returns the latest background-job state and redacted output.
+
+The `default` account profile reuses the existing WSL Colab CLI login. Every other profile name receives an isolated WSL `HOME`, so its OAuth token, ADC credentials, session state, and history cannot mix with another Google account. Choose OAuth2 for the simplest multi-account flow, click **Copy login command**, run that command in a local terminal, and complete the copy/paste authorization prompt with the intended Google account. The optional reset checkbox removes credentials only inside the selected profile before login.
+
+Equivalent CLI actions are:
+
+```powershell
+.\scripts\deploy_colab_speech.ps1 -Action Login -Profile second-account -ColabAuth oauth2
+.\scripts\deploy_colab_speech.ps1 -Action Status -Profile second-account
+.\scripts\deploy_colab_speech.ps1 -Action Start -Profile second-account
+.\scripts\deploy_colab_speech.ps1 -Action Deploy -Profile second-account
+.\scripts\deploy_colab_speech.ps1 -Action Recreate -Profile second-account
+```
+
+Tailscale and speech API keys entered in Web Chat are passed only to the selected background deployment process and are not persisted. They can instead be stored as authorized Colab Secrets for the selected Google account.
+
 MOSS-TTS-Nano is a voice-cloning model without built-in speakers. Deployment configures the project's official `zh_1.wav` sample so the first request works immediately. In Web Chat > Speech Settings, upload a reference voice clip (10 MB maximum) to replace it. Ciel stores uploaded audio only in the local protected runtime configuration, omits it from configuration responses, and adds it to TTS requests automatically. API clients can instead pass `ref_audio` as an HTTP(S) URL or base64 audio data URL to `POST /v1/audio/speech`.
 
 Colab sessions are ephemeral. Re-run the bootstrap after a runtime reset. The workers are reachable only by devices in the same tailnet unless an administrator separately enables Tailscale Funnel.
@@ -40,6 +58,8 @@ Web backend ownership is scoped to the normalized workspace and router port. A s
 
 - `GET|POST /ca/speech/config`
 - `GET /ca/speech/health`
+- `POST /ca/speech/colab/action`
+- `GET /ca/speech/colab/job`
 - `POST /v1/audio/transcriptions`
 - `POST /v1/audio/translations`
 - `POST /v1/audio/speech`

package/install.ps1

@@ -12,6 +12,11 @@ if (Test-Path $supportDir) {
     Remove-Item -Recurse -Force $supportDir
 }
 Copy-Item -Recurse -Force "ciel_runtime_support" $supportDir
+$scriptsDir = Join-Path $shareDir "scripts"
+if (Test-Path $scriptsDir) {
+    Remove-Item -Recurse -Force $scriptsDir
+}
+Copy-Item -Recurse -Force "scripts" $scriptsDir
 Copy-Item -Force "ciel-runtime-menu.py" (Join-Path $binDir "ciel-runtime-menu.py")
 Copy-Item -Force "ciel-runtime-tool-guard.py" (Join-Path $binDir "ciel-runtime-tool-guard.py")
 Copy-Item -Force "ciel-runtime" (Join-Path $binDir "ciel-runtime")

package/install.sh

@@ -11,6 +11,9 @@ install -m 755 ciel_runtime.py "$SHARE_DIR/ciel_runtime.py"
 rm -rf "$SHARE_DIR/ciel_runtime_support"
 mkdir -p "$SHARE_DIR/ciel_runtime_support"
 cp -R ciel_runtime_support/. "$SHARE_DIR/ciel_runtime_support/"
+rm -rf "$SHARE_DIR/scripts"
+mkdir -p "$SHARE_DIR/scripts"
+cp -R scripts/. "$SHARE_DIR/scripts/"
 install -m 755 ciel-runtime-menu.py "$BIN_DIR/ciel-runtime-menu"
 install -m 755 ciel-runtime-tool-guard.py "$BIN_DIR/ciel-runtime-tool-guard"
 install -m 755 ciel-runtime "$BIN_DIR/ciel-runtime"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oneciel-ai/ciel-runtime",
-  "version": "0.2.11",
+  "version": "0.2.12",
   "description": "Universal AI coding-agent runtime and model-routing layer for Claude, Codex, AGY, and compatible runtimes.",
   "license": "MIT",
   "author": "One Ciel LLC",

package/scripts/configure_speech_workers.py

@@ -16,6 +16,7 @@ DEFAULT_COLAB_SETTINGS: dict[str, Any] = {
     "enabled": True,
     "distribution": "Ubuntu-26.04",
     "auth": "adc",
+    "profile": "default",
     "asr_session": "ciel-asr",
     "tts_session": "ciel-tts",
     "asr_accelerator": "T4",
@@ -39,6 +40,7 @@ def configure(
     *,
     distribution: str | None = None,
     auth: str | None = None,
+    profile: str | None = None,
     asr_session: str | None = None,
     tts_session: str | None = None,
     asr_accelerator: str | None = None,
@@ -54,6 +56,7 @@ def configure(
     overrides = {
         "distribution": distribution,
         "auth": auth,
+        "profile": profile,
         "asr_session": asr_session,
         "tts_session": tts_session,
         "asr_accelerator": asr_accelerator,
@@ -77,6 +80,7 @@ def main() -> int:
     parser.add_argument("--tts-reference-audio", default=DEFAULT_TTS_REFERENCE_AUDIO)
     parser.add_argument("--distribution")
     parser.add_argument("--auth", choices=("adc", "oauth2"))
+    parser.add_argument("--profile")
     parser.add_argument("--asr-session")
     parser.add_argument("--tts-session")
     parser.add_argument("--asr-accelerator")
@@ -94,6 +98,7 @@ def main() -> int:
         args.tts_reference_audio,
         distribution=args.distribution,
         auth=args.auth,
+        profile=args.profile,
         asr_session=args.asr_session,
         tts_session=args.tts_session,
         asr_accelerator=args.asr_accelerator,

package/scripts/deploy_colab_speech.ps1

@@ -1,4 +1,8 @@
 param(
+    [ValidateSet('Login', 'Status', 'Start', 'Deploy', 'Recreate')]
+    [string]$Action = 'Deploy',
+    [string]$Profile,
+    [switch]$ResetAuthentication,
     [string]$Distribution,
     [string]$ColabAuth,
     [string]$AsrSession,
@@ -15,12 +19,15 @@ $settings = $settingsJson | ConvertFrom-Json
 if ($settings.enabled -eq $false) { throw "Colab worker management is disabled in Web Chat > Speech Settings." }
 if ([string]::IsNullOrWhiteSpace($Distribution)) { $Distribution = [string]$settings.distribution }
 if ([string]::IsNullOrWhiteSpace($ColabAuth)) { $ColabAuth = [string]$settings.auth }
+if ([string]::IsNullOrWhiteSpace($Profile)) { $Profile = [string]$settings.profile }
+if ([string]::IsNullOrWhiteSpace($Profile)) { $Profile = "default" }
 if ([string]::IsNullOrWhiteSpace($AsrSession)) { $AsrSession = [string]$settings.asr_session }
 if ([string]::IsNullOrWhiteSpace($TtsSession)) { $TtsSession = [string]$settings.tts_session }
 if ([string]::IsNullOrWhiteSpace($AsrAccelerator)) { $AsrAccelerator = [string]$settings.asr_accelerator }
 if ([string]::IsNullOrWhiteSpace($TtsAccelerator)) { $TtsAccelerator = [string]$settings.tts_accelerator }
 if ($Distribution -notmatch '^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$') { throw "Invalid WSL distribution name." }
 if ($ColabAuth -notin @('adc', 'oauth2')) { throw "ColabAuth must be adc or oauth2." }
+if ($Profile -notmatch '^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$') { throw "Invalid Colab account profile name." }
 foreach ($session in @($AsrSession, $TtsSession)) {
     if ($session -notmatch '^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$') { throw "Invalid Colab session name: $session" }
 }
@@ -29,42 +36,98 @@ foreach ($accelerator in @($AsrAccelerator, $TtsAccelerator)) {
 }
 $wslRepo = (& wsl -d $Distribution -- wslpath -a ($repo -replace '\\', '/')).Trim()
 if (-not $wslRepo) { throw "Could not resolve the repository path in WSL." }
-$bootstrapEnv = ""
+$wslHome = (& wsl -d $Distribution -- bash -lc 'printf %s "$HOME"').Trim()
+$colabExecutable = (& wsl -d $Distribution -- bash -lc 'command -v colab').Trim()
+if (-not $wslHome -or -not $colabExecutable) { throw "Could not locate the WSL home directory or Colab CLI." }
+$profileHome = if ($Profile -eq 'default') { $wslHome } else { "$wslHome/.config/ciel-runtime/colab-profiles/$Profile" }
+& wsl -d $Distribution -- mkdir -p $profileHome
+if ($LASTEXITCODE -ne 0) { throw "Could not create the Colab account profile directory." }
+
+function Invoke-Colab([string[]]$Arguments) {
+    & wsl -d $Distribution -- env "HOME=$profileHome" $colabExecutable --auth $ColabAuth @Arguments
+}
+
+if ($Action -eq 'Login') {
+    if ($ResetAuthentication) {
+        $tokenPath = "$profileHome/.config/colab-cli/token.json"
+        $adcPath = "$profileHome/.config/gcloud/application_default_credentials.json"
+        & wsl -d $Distribution -- rm -f $tokenPath $adcPath
+        if ($LASTEXITCODE -ne 0) { throw "Could not reset authentication for profile '$Profile'." }
+    }
+    Write-Host "Authenticating isolated Colab account profile: $Profile ($ColabAuth)"
+    if ($ColabAuth -eq 'adc') {
+        $scopes = 'openid,https://www.googleapis.com/auth/cloud-platform,https://www.googleapis.com/auth/userinfo.email,https://www.googleapis.com/auth/colaboratory'
+        & wsl -d $Distribution -- env "HOME=$profileHome" gcloud auth application-default login --scopes=$scopes
+    } else {
+        Invoke-Colab @('sessions')
+    }
+    if ($LASTEXITCODE -ne 0) { throw "Colab authentication failed for profile '$Profile'." }
+    Write-Host "Colab profile '$Profile' is authenticated."
+    exit 0
+}
+
+if ($Action -eq 'Status') {
+    Write-Host "Colab sessions for isolated account profile: $Profile"
+    Invoke-Colab @('sessions')
+    if ($LASTEXITCODE -ne 0) { throw "Could not read Colab sessions for profile '$Profile'. Run the Login action first." }
+    exit 0
+}
 if ($env:TAILSCALE_AUTHKEY) {
     if ($env:TAILSCALE_AUTHKEY -notmatch '^tskey-[A-Za-z0-9_-]+$') { throw "TAILSCALE_AUTHKEY has an unexpected format." }
-    $bootstrapEnv += " --env TAILSCALE_AUTHKEY=$($env:TAILSCALE_AUTHKEY)"
 }
 if ($env:CIEL_SPEECH_API_KEY) {
     if ($env:CIEL_SPEECH_API_KEY -match '[\s''"]') { throw "CIEL_SPEECH_API_KEY cannot contain whitespace or quotes for CLI deployment." }
-    $bootstrapEnv += " --env CIEL_SPEECH_API_KEY=$($env:CIEL_SPEECH_API_KEY)"
 }
 
 Write-Host "Checking Colab CLI authentication..."
-& wsl -d $Distribution -- bash -lc "colab --auth $ColabAuth status >/dev/null"
+Invoke-Colab @('sessions') | Out-Null
 if ($LASTEXITCODE -ne 0) {
-    throw "Colab CLI is not authenticated with '$ColabAuth' in WSL '$Distribution'."
+    throw "Colab profile '$Profile' is not authenticated with '$ColabAuth' in WSL '$Distribution'. Run -Action Login -Profile '$Profile' first."
 }
 
 function Ensure-ColabSession([string]$Session, [string]$Accelerator, [string]$Role) {
-    & wsl -d $Distribution -- bash -lc "colab --auth $ColabAuth status --session '$Session' >/dev/null 2>&1"
+    Invoke-Colab @('status', '--session', $Session) *> $null
     if ($LASTEXITCODE -eq 0) {
         Write-Host "Reusing $Role $Accelerator session: $Session"
         return
     }
     Write-Host "Creating $Role $Accelerator session: $Session"
-    & wsl -d $Distribution -- bash -lc "colab --auth $ColabAuth new --gpu $Accelerator --session '$Session'"
+    Invoke-Colab @('new', '--gpu', $Accelerator, '--session', $Session)
     if ($LASTEXITCODE -ne 0) { throw "Could not create $Role Colab session." }
 }
 
+function Stop-ColabSession([string]$Session, [string]$Role) {
+    Write-Host "Releasing existing $Role session if present: $Session"
+    Invoke-Colab @('stop', '--session', $Session) *> $null
+}
+
+if ($Action -eq 'Recreate') {
+    Stop-ColabSession $AsrSession "ASR"
+    Stop-ColabSession $TtsSession "TTS"
+}
+
 Ensure-ColabSession $AsrSession $AsrAccelerator "ASR"
 Ensure-ColabSession $TtsSession $TtsAccelerator "TTS"
 
+if ($Action -eq 'Start') {
+    Write-Host "Colab sessions are allocated for profile '$Profile'. Run -Action Deploy to install and connect the workers."
+    exit 0
+}
+
 Write-Host "Installing Qwen3-ASR and its Tailscale service..."
-$asrOutput = (& wsl -d $Distribution -- bash -lc "colab --auth $ColabAuth exec --session '$AsrSession'$bootstrapEnv --file '$wslRepo/scripts/colab/bootstrap_qwen_asr.py'" 2>&1 | Tee-Object -Variable asrDisplay) -join "`n"
+$asrArguments = @('exec', '--session', $AsrSession)
+if ($env:TAILSCALE_AUTHKEY) { $asrArguments += @('--env', "TAILSCALE_AUTHKEY=$($env:TAILSCALE_AUTHKEY)") }
+if ($env:CIEL_SPEECH_API_KEY) { $asrArguments += @('--env', "CIEL_SPEECH_API_KEY=$($env:CIEL_SPEECH_API_KEY)") }
+$asrArguments += @('--file', "$wslRepo/scripts/colab/bootstrap_qwen_asr.py")
+$asrOutput = (Invoke-Colab $asrArguments 2>&1 | Tee-Object -Variable asrDisplay) -join "`n"
 if ($LASTEXITCODE -ne 0) { throw "ASR bootstrap failed." }
 
 Write-Host "Installing MOSS-TTS-Nano and its Tailscale service..."
-$ttsOutput = (& wsl -d $Distribution -- bash -lc "colab --auth $ColabAuth exec --session '$TtsSession'$bootstrapEnv --file '$wslRepo/scripts/colab/bootstrap_moss_tts.py'" 2>&1 | Tee-Object -Variable ttsDisplay) -join "`n"
+$ttsArguments = @('exec', '--session', $TtsSession)
+if ($env:TAILSCALE_AUTHKEY) { $ttsArguments += @('--env', "TAILSCALE_AUTHKEY=$($env:TAILSCALE_AUTHKEY)") }
+if ($env:CIEL_SPEECH_API_KEY) { $ttsArguments += @('--env', "CIEL_SPEECH_API_KEY=$($env:CIEL_SPEECH_API_KEY)") }
+$ttsArguments += @('--file', "$wslRepo/scripts/colab/bootstrap_moss_tts.py")
+$ttsOutput = (Invoke-Colab $ttsArguments 2>&1 | Tee-Object -Variable ttsDisplay) -join "`n"
 if ($LASTEXITCODE -ne 0) { throw "TTS bootstrap failed." }
 
 function Read-BootstrapResult([string]$Text, [string]$Role) {
@@ -77,7 +140,7 @@ function Read-BootstrapResult([string]$Text, [string]$Role) {
 
 $asr = Read-BootstrapResult $asrOutput "asr"
 $tts = Read-BootstrapResult $ttsOutput "tts"
-& python (Join-Path $PSScriptRoot "configure_speech_workers.py") --asr-base-url $asr.base_url --tts-base-url $tts.base_url --distribution $Distribution --auth $ColabAuth --asr-session $AsrSession --tts-session $TtsSession --asr-accelerator $AsrAccelerator --tts-accelerator $TtsAccelerator
+& python (Join-Path $PSScriptRoot "configure_speech_workers.py") --asr-base-url $asr.base_url --tts-base-url $tts.base_url --distribution $Distribution --auth $ColabAuth --profile $Profile --asr-session $AsrSession --tts-session $TtsSession --asr-accelerator $AsrAccelerator --tts-accelerator $TtsAccelerator
 if ($LASTEXITCODE -ne 0) { throw "Workers started, but Ciel speech configuration failed." }
 
 Write-Host "Both services are running and connected to Web Chat > Speech Settings."