@oneciel-ai/ciel-runtime 0.2.2 → 0.2.4

package/ciel_runtime_support/web_ui.py

@@ -112,6 +112,22 @@ def render_web_chat_page(
     }}
     .attach-button:hover {{ border-color: var(--accent); }}
     .attach-button:disabled {{ opacity: .55; cursor: not-allowed; }}
+    .recording {{ border-color: #ef4444 !important; color: #fecaca !important; }}
+    .message-actions {{ display: flex; align-items: flex-start; padding: 4px; }}
+    .message-actions button {{ border: 1px solid var(--line); border-radius: 999px; background: #0b111b; color: var(--muted); cursor: pointer; padding: 4px 8px; }}
+    dialog {{ width: min(720px, calc(100vw - 28px)); max-height: calc(100vh - 28px); overflow: auto; border: 1px solid var(--line); border-radius: 10px; background: var(--panel); color: var(--text); padding: 0; }}
+    dialog::backdrop {{ background: rgba(0,0,0,.72); }}
+    .settings-head {{ position: sticky; top: 0; display: flex; justify-content: space-between; align-items: center; gap: 12px; padding: 14px 16px; border-bottom: 1px solid var(--line); background: var(--panel); }}
+    .settings-body {{ padding: 16px; display: grid; gap: 16px; }}
+    .settings-section {{ border: 1px solid var(--line); border-radius: 8px; padding: 12px; display: grid; gap: 10px; }}
+    .settings-section h3 {{ margin: 0; font-size: 14px; }}
+    .settings-grid {{ display: grid; grid-template-columns: repeat(2, minmax(0, 1fr)); gap: 10px; }}
+    .settings-grid label {{ display: grid; gap: 5px; color: var(--muted); font-size: 12px; }}
+    .settings-grid label.wide {{ grid-column: 1 / -1; }}
+    .settings-grid input, .settings-grid select {{ width: 100%; border: 1px solid var(--line); border-radius: 6px; background: #080d14; color: var(--text); padding: 8px; }}
+    .check {{ display: flex !important; grid-auto-flow: column; justify-content: start; align-items: center; gap: 7px !important; }}
+    .check input {{ width: auto; }}
+    .settings-actions {{ display: flex; justify-content: flex-end; gap: 8px; }}
     #fileInput {{ display: none; }}
     .attachment-tray {{ display: flex; gap: 7px; flex-wrap: wrap; min-height: 0; }}
     .attachment-chip {{
@@ -135,6 +151,7 @@ def render_web_chat_page(
       .bubble {{ max-width: 94%; }}
       header {{ align-items: flex-start; flex-direction: column; }}
       .pill {{ white-space: normal; }}
+      .settings-grid {{ grid-template-columns: 1fr; }}
     }}
   </style>
 </head>
@@ -154,6 +171,8 @@ def render_web_chat_page(
         <a href="/">Router Home</a>
         <a href="/ca/events">Events</a>
         <a href="/health">Health JSON</a>
+        <a href="/ca/web/chat/api">Chat API JSON</a>
+        <button class="ghost" id="speechSettingsButton" type="button">Speech Settings</button>
         <button class="ghost" id="shareButton" type="button">Copy Chat Link</button>
         <button class="ghost" id="clearButton" type="button">Clear Chat</button>
       </div>
@@ -173,6 +192,7 @@ def render_web_chat_page(
           <button class="primary" id="sendButton" type="submit">Send</button>
         </div>
         <div class="composer-actions">
+          <button class="attach-button" id="micButton" type="button">Start voice input</button>
           <button class="attach-button" id="attachButton" type="button">Attach files</button>
           <input id="fileInput" type="file" multiple>
           <div class="attachment-tray" id="attachmentTray" aria-live="polite"></div>
@@ -181,6 +201,45 @@ def render_web_chat_page(
       </form>
     </main>
   </div>
+  <dialog id="speechSettingsDialog">
+    <form id="speechSettingsForm">
+      <div class="settings-head"><strong>Speech Settings</strong><button class="ghost" id="speechSettingsClose" type="button">Close</button></div>
+      <div class="settings-body">
+        <section class="settings-section">
+          <h3>STT / Qwen ASR</h3>
+          <div class="settings-grid">
+            <label class="check"><input id="asrEnabled" type="checkbox"> Enable STT</label>
+            <label>Language<input id="asrLanguage" placeholder="auto"></label>
+            <label class="wide">Tailscale base URL<input id="asrBaseUrl" placeholder="http://ciel-asr:8000"></label>
+            <label class="wide">Model<input id="asrModel" placeholder="Qwen/Qwen3-ASR-0.6B"></label>
+            <label class="wide">Remote bearer token<input id="asrApiKey" type="password" autocomplete="new-password" placeholder="Leave blank to keep current token"></label>
+          </div>
+        </section>
+        <section class="settings-section">
+          <h3>TTS / MOSS-TTS-Nano</h3>
+          <div class="settings-grid">
+            <label class="check"><input id="ttsEnabled" type="checkbox"> Enable TTS</label>
+            <label class="check"><input id="ttsAutoSpeak" type="checkbox"> Speak replies automatically</label>
+            <label class="wide">Tailscale base URL<input id="ttsBaseUrl" placeholder="http://ciel-tts:8091"></label>
+            <label>Voice<input id="ttsVoice" placeholder="default"></label>
+            <label>Language<input id="ttsLanguage" placeholder="ko"></label>
+            <label class="wide">Model<input id="ttsModel" placeholder="OpenMOSS-Team/MOSS-TTS-Nano"></label>
+            <label class="wide">Remote bearer token<input id="ttsApiKey" type="password" autocomplete="new-password" placeholder="Leave blank to keep current token"></label>
+          </div>
+        </section>
+        <section class="settings-section">
+          <h3>Tailscale tunnel</h3>
+          <div class="settings-grid">
+            <label class="check"><input id="tailscaleEnabled" type="checkbox"> Use tailnet-only addresses</label>
+            <label>ASR hostname<input id="tailscaleAsrHostname" placeholder="ciel-asr"></label>
+            <label>TTS hostname<input id="tailscaleTtsHostname" placeholder="ciel-tts"></label>
+          </div>
+          <div class="hint">The browser calls Ciel locally. Only the Ciel router connects to these Tailscale services.</div>
+        </section>
+        <div class="settings-actions"><button class="ghost" id="speechHealthButton" type="button">Test connections</button><button class="primary" type="submit">Save</button></div>
+      </div>
+    </form>
+  </dialog>
   <script>
     const MODEL = {json.dumps(model)};
     const transcript = document.getElementById('transcript');
@@ -188,10 +247,16 @@ def render_web_chat_page(
     const prompt = document.getElementById('prompt');
     const sendButton = document.getElementById('sendButton');
     const attachButton = document.getElementById('attachButton');
+    const micButton = document.getElementById('micButton');
     const fileInput = document.getElementById('fileInput');
     const attachmentTray = document.getElementById('attachmentTray');
     const shareButton = document.getElementById('shareButton');
     const clearButton = document.getElementById('clearButton');
+    const speechSettingsButton = document.getElementById('speechSettingsButton');
+    const speechSettingsDialog = document.getElementById('speechSettingsDialog');
+    const speechSettingsForm = document.getElementById('speechSettingsForm');
+    const speechSettingsClose = document.getElementById('speechSettingsClose');
+    const speechHealthButton = document.getElementById('speechHealthButton');
     const statePill = document.getElementById('statePill');
     const SESSION_KEY = 'ciel-runtime-web-chat-session';
     const LAST_ID_KEY = 'ciel-runtime-web-chat-last-id';
@@ -218,6 +283,10 @@ def render_web_chat_page(
     let lastId = Number(localStorage.getItem(scopedLastIdKey) || '0') || 0;
     let eventSource = null;
     let selectedFiles = [];
+    let speechConfig = {{asr: {{enabled: false}}, tts: {{enabled: false, auto_speak: false}}}};
+    let mediaRecorder = null;
+    let mediaStream = null;
+    let recordingChunks = [];
     function setState(text, cls = '') {{
       statePill.textContent = text;
       statePill.className = 'pill ' + cls;
@@ -401,6 +470,16 @@ def render_web_chat_page(
         bubble.innerHTML = renderMarkdown(text);
       }}
       row.appendChild(bubble);
+      if (role === 'assistant') {{
+        const actions = document.createElement('div');
+        actions.className = 'message-actions';
+        const speak = document.createElement('button');
+        speak.type = 'button';
+        speak.textContent = 'Speak';
+        speak.addEventListener('click', () => speakText(text));
+        actions.appendChild(speak);
+        row.appendChild(actions);
+      }}
       if (mode === 'prepend') {{
         transcript.insertBefore(row, transcript.firstChild);
       }} else {{
@@ -424,7 +503,10 @@ def render_web_chat_page(
       const text = message.message || '';
       if (!text.trim()) return;
       addBubble(roleForMessage(message), text, mode, message.id);
-      if (mode !== 'prepend' && message.sender_id !== 'web-user') setState('reply received', 'ok');
+      if (mode !== 'prepend' && message.sender_id !== 'web-user') {{
+        setState('reply received', 'ok');
+        if (speechConfig.tts && speechConfig.tts.enabled && speechConfig.tts.auto_speak) speakText(text);
+      }}
     }}
     function formatBytes(bytes) {{
       const value = Number(bytes || 0);
@@ -471,6 +553,134 @@ def render_web_chat_page(
         reader.readAsDataURL(file);
       }});
     }}
+    function setSpeechForm(config) {{
+      const asr = config.asr || {{}};
+      const tts = config.tts || {{}};
+      const tailscale = config.tailscale || {{}};
+      document.getElementById('asrEnabled').checked = Boolean(asr.enabled);
+      document.getElementById('asrBaseUrl').value = asr.base_url || '';
+      document.getElementById('asrModel').value = asr.model || '';
+      document.getElementById('asrLanguage').value = asr.language || 'auto';
+      document.getElementById('asrApiKey').value = '';
+      document.getElementById('asrApiKey').placeholder = asr.api_key_set ? 'Token is set; leave blank to keep it' : 'Optional remote bearer token';
+      document.getElementById('ttsEnabled').checked = Boolean(tts.enabled);
+      document.getElementById('ttsAutoSpeak').checked = Boolean(tts.auto_speak);
+      document.getElementById('ttsBaseUrl').value = tts.base_url || '';
+      document.getElementById('ttsModel').value = tts.model || '';
+      document.getElementById('ttsVoice').value = tts.voice || 'default';
+      document.getElementById('ttsLanguage').value = tts.language || 'ko';
+      document.getElementById('ttsApiKey').value = '';
+      document.getElementById('ttsApiKey').placeholder = tts.api_key_set ? 'Token is set; leave blank to keep it' : 'Optional remote bearer token';
+      document.getElementById('tailscaleEnabled').checked = tailscale.enabled !== false;
+      document.getElementById('tailscaleAsrHostname').value = tailscale.asr_hostname || 'ciel-asr';
+      document.getElementById('tailscaleTtsHostname').value = tailscale.tts_hostname || 'ciel-tts';
+      micButton.disabled = !asr.enabled;
+      micButton.title = asr.enabled ? 'Record speech and transcribe it' : 'Enable STT in Speech Settings first';
+    }}
+    async function loadSpeechConfig() {{
+      const response = await fetch('/ca/speech/config', {{headers: {{'accept': 'application/json'}}}});
+      const data = await response.json();
+      if (!response.ok || !data.ok) throw new Error(data.error || `HTTP ${{response.status}}`);
+      speechConfig = data;
+      setSpeechForm(data);
+      return data;
+    }}
+    async function saveSpeechConfig() {{
+      const payload = {{
+        asr: {{
+          enabled: document.getElementById('asrEnabled').checked,
+          base_url: document.getElementById('asrBaseUrl').value,
+          model: document.getElementById('asrModel').value,
+          language: document.getElementById('asrLanguage').value,
+          api_key: document.getElementById('asrApiKey').value,
+        }},
+        tts: {{
+          enabled: document.getElementById('ttsEnabled').checked,
+          auto_speak: document.getElementById('ttsAutoSpeak').checked,
+          base_url: document.getElementById('ttsBaseUrl').value,
+          model: document.getElementById('ttsModel').value,
+          voice: document.getElementById('ttsVoice').value,
+          language: document.getElementById('ttsLanguage').value,
+          api_key: document.getElementById('ttsApiKey').value,
+        }},
+        tailscale: {{
+          enabled: document.getElementById('tailscaleEnabled').checked,
+          asr_hostname: document.getElementById('tailscaleAsrHostname').value,
+          tts_hostname: document.getElementById('tailscaleTtsHostname').value,
+        }},
+      }};
+      const response = await fetch('/ca/speech/config', {{method: 'POST', headers: {{'content-type': 'application/json', 'accept': 'application/json'}}, body: JSON.stringify(payload)}});
+      const data = await response.json();
+      if (!response.ok || !data.ok) throw new Error(data.error || `HTTP ${{response.status}}`);
+      speechConfig = data;
+      setSpeechForm(data);
+      return data;
+    }}
+    async function speakText(text) {{
+      if (!speechConfig.tts || !speechConfig.tts.enabled) {{
+        setState('TTS disabled', 'error');
+        return;
+      }}
+      try {{
+        setState('generating speech');
+        const response = await fetch('/v1/audio/speech', {{
+          method: 'POST',
+          headers: {{'content-type': 'application/json'}},
+          body: JSON.stringify({{input: String(text || ''), model: speechConfig.tts.model, voice: speechConfig.tts.voice, language: speechConfig.tts.language, response_format: speechConfig.tts.response_format || 'wav'}})
+        }});
+        if (!response.ok) throw new Error(await response.text() || `HTTP ${{response.status}}`);
+        const blob = await response.blob();
+        const url = URL.createObjectURL(blob);
+        const audio = new Audio(url);
+        audio.addEventListener('ended', () => URL.revokeObjectURL(url), {{once: true}});
+        audio.addEventListener('error', () => URL.revokeObjectURL(url), {{once: true}});
+        await audio.play();
+        setState('speaking', 'ok');
+      }} catch (err) {{
+        setState('TTS error', 'error');
+        addBubble('system', 'TTS failed: ' + String(err && err.message ? err.message : err));
+      }}
+    }}
+    async function transcribeRecording(blob) {{
+      setState('transcribing');
+      const audio_base64 = await fileToBase64(blob);
+      const response = await fetch('/v1/audio/transcriptions', {{
+        method: 'POST',
+        headers: {{'content-type': 'application/json', 'accept': 'application/json'}},
+        body: JSON.stringify({{audio_base64, filename: 'web-chat-recording.webm', content_type: blob.type || 'audio/webm', model: speechConfig.asr.model, language: speechConfig.asr.language}})
+      }});
+      const text = await response.text();
+      let data = {{}};
+      try {{ data = text ? JSON.parse(text) : {{}}; }} catch {{}}
+      if (!response.ok) throw new Error((data.error && (data.error.message || data.error)) || text || `HTTP ${{response.status}}`);
+      const transcriptText = String(data.text || data.transcript || '').trim();
+      if (!transcriptText) throw new Error('ASR returned no transcript');
+      prompt.value = prompt.value ? prompt.value + ' ' + transcriptText : transcriptText;
+      prompt.focus();
+      setState('transcribed', 'ok');
+    }}
+    async function startVoiceInput() {{
+      if (!navigator.mediaDevices || !window.MediaRecorder) throw new Error('This browser does not support microphone recording');
+      mediaStream = await navigator.mediaDevices.getUserMedia({{audio: true}});
+      recordingChunks = [];
+      mediaRecorder = new MediaRecorder(mediaStream);
+      mediaRecorder.addEventListener('dataavailable', event => {{ if (event.data && event.data.size) recordingChunks.push(event.data); }});
+      mediaRecorder.addEventListener('stop', async () => {{
+        const blob = new Blob(recordingChunks, {{type: mediaRecorder.mimeType || 'audio/webm'}});
+        if (mediaStream) mediaStream.getTracks().forEach(track => track.stop());
+        mediaStream = null;
+        micButton.textContent = 'Start voice input';
+        micButton.classList.remove('recording');
+        try {{ await transcribeRecording(blob); }} catch (err) {{ setState('STT error', 'error'); addBubble('system', 'STT failed: ' + String(err && err.message ? err.message : err)); }}
+      }}, {{once: true}});
+      mediaRecorder.start();
+      micButton.textContent = 'Stop and transcribe';
+      micButton.classList.add('recording');
+      setState('recording', 'error');
+    }}
+    function stopVoiceInput() {{
+      if (mediaRecorder && mediaRecorder.state !== 'inactive') mediaRecorder.stop();
+    }}
     async function uploadAttachment(file) {{
       const content = await fileToBase64(file);
       const response = await fetch('/ca/channel/files', {{
@@ -663,6 +873,42 @@ def render_web_chat_page(
       }}
     }});
     attachButton.addEventListener('click', () => fileInput.click());
+    micButton.addEventListener('click', async () => {{
+      if (mediaRecorder && mediaRecorder.state !== 'inactive') {{
+        stopVoiceInput();
+        return;
+      }}
+      try {{ await startVoiceInput(); }} catch (err) {{
+        setState('microphone error', 'error');
+        addBubble('system', 'Microphone failed: ' + String(err && err.message ? err.message : err));
+      }}
+    }});
+    speechSettingsButton.addEventListener('click', async () => {{
+      try {{ await loadSpeechConfig(); }} catch (err) {{ addBubble('system', 'Could not load speech settings: ' + String(err && err.message ? err.message : err)); }}
+      speechSettingsDialog.showModal();
+    }});
+    speechSettingsClose.addEventListener('click', () => speechSettingsDialog.close());
+    speechSettingsForm.addEventListener('submit', async event => {{
+      event.preventDefault();
+      try {{
+        await saveSpeechConfig();
+        speechSettingsDialog.close();
+        setState('speech settings saved', 'ok');
+      }} catch (err) {{
+        setState('settings error', 'error');
+        addBubble('system', 'Speech settings failed: ' + String(err && err.message ? err.message : err));
+      }}
+    }});
+    speechHealthButton.addEventListener('click', async () => {{
+      try {{
+        await saveSpeechConfig();
+        const response = await fetch('/ca/speech/health', {{headers: {{'accept': 'application/json'}}}});
+        const data = await response.json();
+        const asr = data.services && data.services.asr;
+        const tts = data.services && data.services.tts;
+        addBubble('system', `Speech health — ASR: ${{asr && asr.reachable ? 'reachable' : asr && asr.enabled ? 'unreachable' : 'disabled'}}, TTS: ${{tts && tts.reachable ? 'reachable' : tts && tts.enabled ? 'unreachable' : 'disabled'}}.`);
+      }} catch (err) {{ addBubble('system', 'Speech health check failed: ' + String(err && err.message ? err.message : err)); }}
+    }});
     fileInput.addEventListener('change', () => {{
       addSelectedFiles(fileInput.files);
       fileInput.value = '';
@@ -706,6 +952,7 @@ def render_web_chat_page(
       if (transcript.scrollTop < 48) loadOlderHistory();
     }});
     addBubble('system', `Connected to active session bridge for ${{MODEL}}. Messages are queued on channel ${{channel}} and replies stream back from /ca/channel/stream.`);
+    loadSpeechConfig().catch(() => {{ micButton.disabled = true; }});
     loadInitialHistory().finally(startChannelStream);
     prompt.focus();
   </script>

package/ciel_runtime_support/workspace_router_selection.py

@@ -0,0 +1,86 @@
+"""Select an isolated router port for the current working directory."""
+
+from __future__ import annotations
+
+import json
+import os
+import socket
+import urllib.request
+from pathlib import Path
+from typing import Any, Callable, Mapping
+
+
+def workspace_identity(value: Any) -> str:
+    text = str(value or "").strip()
+    if not text:
+        return ""
+    try:
+        return os.path.normcase(str(Path(text).resolve(strict=False)))
+    except Exception:
+        return os.path.normcase(text)
+
+
+def probe_router_health(port: int, timeout: float = 0.15) -> dict[str, Any] | None:
+    try:
+        with urllib.request.urlopen(f"http://127.0.0.1:{port}/health", timeout=timeout) as response:
+            payload = json.loads(response.read().decode("utf-8", errors="replace"))
+        return payload if isinstance(payload, dict) and payload.get("ok") is True else None
+    except Exception:
+        return None
+
+
+def port_is_free(port: int) -> bool:
+    probe = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
+    try:
+        probe.bind(("127.0.0.1", port))
+        return True
+    except OSError:
+        return False
+    finally:
+        probe.close()
+
+
+def select_workspace_router_port(
+    base_port: int,
+    workspace: Path,
+    environ: Mapping[str, str],
+    *,
+    health: Callable[[int], dict[str, Any] | None] = probe_router_health,
+    available: Callable[[int], bool] = port_is_free,
+    scan_size: int = 32,
+) -> int:
+    """Reuse the same workspace port, otherwise select the first free port."""
+
+    if str(environ.get("CIEL_RUNTIME_ROUTER_PORT") or "").strip():
+        return base_port
+    target = workspace_identity(
+        environ.get("CIEL_RUNTIME_LAUNCH_CWD") or workspace
+    )
+    unknown_base_health: dict[str, Any] | None = None
+    for offset in range(max(1, scan_size)):
+        port = base_port + offset
+        if port > 65535:
+            break
+        observed = health(port)
+        if observed is not None:
+            running_workspace = workspace_identity(observed.get("workspace"))
+            if running_workspace and running_workspace == target:
+                return port
+            if offset == 0 and not running_workspace:
+                unknown_base_health = observed
+            continue
+        if available(port):
+            if offset == 0 and unknown_base_health is not None:
+                continue
+            return port
+    raise RuntimeError(
+        f"no free ciel-runtime router port found in {base_port}-{min(65535, base_port + scan_size - 1)}"
+    )
+
+
+__all__ = [
+    "port_is_free",
+    "probe_router_health",
+    "select_workspace_router_port",
+    "workspace_identity",
+]

package/docs/COLAB_SPEECH.md

@@ -0,0 +1,32 @@
+# Colab speech workers
+
+Ciel Runtime can proxy its web chat and OpenAI-compatible audio API to two Colab workers over a tailnet-only Tailscale tunnel.
+
+## One-time prerequisites
+
+1. Authenticate the Colab CLI inside WSL. The installed CLI currently uses Google Application Default Credentials, so run `~/google-cloud-sdk/bin/gcloud auth application-default login` in `Ubuntu-26.04`.
+2. Create a reusable or ephemeral Tailscale auth key. In each Colab account/notebook Secret store, add `TAILSCALE_AUTHKEY` and grant notebook access.
+3. Optionally add the same `CIEL_SPEECH_API_KEY` secret to both workers. Enter that value once in Web Chat > Speech Settings; Ciel stores it server-side and never returns it to the browser.
+
+## Deploy
+
+From PowerShell at the repository root:
+
+```powershell
+.\scripts\deploy_colab_speech.ps1
+```
+
+The script creates `ciel-asr` and `ciel-tts` T4 sessions, installs Qwen3-ASR-0.6B and MOSS-TTS-Nano, starts Tailscale in userspace networking mode, publishes each localhost model server with Tailscale Serve, and saves both returned `base_url` values into Web Chat > Speech Settings automatically.
+
+Colab sessions are ephemeral. Re-run the bootstrap after a runtime reset. The workers are reachable only by devices in the same tailnet unless an administrator separately enables Tailscale Funnel.
+
+## API surface
+
+- `GET|POST /ca/speech/config`
+- `GET /ca/speech/health`
+- `POST /v1/audio/transcriptions`
+- `POST /v1/audio/translations`
+- `POST /v1/audio/speech`
+- `POST /v1/audio/speech/batch`
+- `GET|POST /v1/audio/voices`
+- `GET /ca/web/chat/api` lists chat, model, message, response, file, and speech endpoints.

package/docs/Configuration.md

@@ -89,6 +89,56 @@
 | `CIEL_RUNTIME_THINKING_PASSBACK_MAX` | Thinking 패스백 최대 토큰 (기본: `4096`) |
 | `CIEL_RUNTIME_PYTHON` | 사용할 Python 실행 파일 경로 |
 | `CIEL_RUNTIME_SKIP_POSTINSTALL_STOP` | npm 설치 후 stop 건너뜀 |
+| `CIEL_RUNTIME_RUNAWAY_GUARD` | 반복 폭주 가드 (기본: 켜짐, `off`로 비활성화) |
+| `CIEL_RUNTIME_RUNAWAY_CONTINUE` | 루프 감지 후 턴 이어가기 (기본: 켜짐, `off`면 감지만 하고 종료) |
+| `CIEL_RUNTIME_RUNAWAY_RETRIES` | 수집 경로 재시도 횟수 (기본: `2`, 최대 `4`) |
+| `CIEL_RUNTIME_COLLECT_STREAM` | 수집 경로 스트림 읽기 (기본: 켜짐, `off`면 단일 POST로 회귀) |
+| `CIEL_RUNTIME_RUNAWAY_MIN_REPEATS` | 연속 반복 최소 횟수 (기본: `10`) |
+| `CIEL_RUNTIME_RUNAWAY_MIN_CHARS` | 반복 구간 최소 길이 (기본: `2000`) |
+| `CIEL_RUNTIME_RUNAWAY_MAX_PERIOD` | 반복 블록 최대 길이 (기본: `4096`) |
+| `CIEL_RUNTIME_RUNAWAY_MIN_DENSITY` | 비연속 반복 최소 밀도 % (기본: `70`) |
+
+---
+
+## 반복 폭주 가드
+
+모델이 같은 문장을 끝없이 되풀이하는 생성 루프에 빠지면 라우터가 이를 끊는다.
+업스트림 연결을 즉시 닫으므로 남은 루프는 생성되지도, 과금되지도 않는다.
+
+### 판정
+
+두 가지 정확 규칙으로만 판단한다. 의미 판단이나 유사도 점수는 쓰지 않는다.
+
+1. **연속 반복** — 같은 블록이 바로 뒤에 붙어 `MIN_REPEATS`회 이상,
+   `MIN_CHARS`자 이상 반복될 때.
+2. **비연속 반복** — 같은 블록이 사이사이 다른 문구를 끼고 되풀이될 때.
+   횟수는 2배, 그리고 해당 구간의 `MIN_DENSITY`% 이상이 그 블록 자체여야 한다.
+
+2번은 임계값이지 증명이 아니다. 실제로 대부분이 한 블록의 반복인 정상 출력
+(데이터가 거의 없는 표, 거의 동일한 로그 줄 묶음)은 같은 밀도에 근접할 수 있다.
+그런 워크로드에서는 `CIEL_RUNTIME_RUNAWAY_MIN_DENSITY`를 올리거나
+`CIEL_RUNTIME_RUNAWAY_GUARD=off`로 끄면 된다. 1번 규칙은 그런 판단이 필요 없다.
+
+### 감지 후 동작
+
+턴을 죽이지 않고 이어가는 것이 기본이다. 무엇을 할 수 있는지는 경로마다 다르다.
+
+- **수집 경로** (Codex): 클라이언트로 나간 바이트도, 실행된 툴도 없으므로 응답을
+  버리고 **다시 요청한다.** 사용자에게는 아무 메시지도 보이지 않는다. 재시도는
+  같은 조건 → `effort=high` → `effort=low`(사고 끄기) 순으로 올라간다.
+  DeepSeek이 문서에서 권하는 대응(*"Retry or lower reasoning effort"*)과 같고,
+  샘플링이 확률적(`do_sample: true, temperature: 1.0`)이라 재시도는 실제로 다른 결과다.
+  세 프로토콜(Ollama NDJSON, OpenAI chat SSE, Anthropic Messages SSE) 모두
+  스트림으로 읽어 조립하므로 루프가 다 만들어지기 전에 끊긴다. 전송 방식만
+  되돌리려면 `CIEL_RUNTIME_COLLECT_STREAM=off`.
+- **스트리밍 경로** (Claude Code): 이미 나간 바이트는 되돌릴 수 없으므로 재시도가
+  불가능하다. 대신 짧은 알림과 함께 `TaskList` 툴 호출을 합성해 CLI가 다음 턴을
+  가져가게 한다. 직전 어시스턴트 턴에 같은 알림이 이미 있으면 합성하지 않고
+  종료한다 — 복구 자체가 루프가 되는 것을 막는다.
+
+알림 문구에는 측정값을 넣지 않는다. 그 텍스트는 어시스턴트 메시지에 남아 다음 턴에
+모델이 다시 읽기 때문이다. 반복 블록 길이·횟수·원문은 라우터 로그
+(`collect_runaway_repetition`, `ollama_stream_runaway_repetition` 등)에만 기록된다.
 
 ---
 

package/docs/Test-Suite.md

@@ -43,6 +43,7 @@
 |------|-----------|
 | `test_router_debug.py` | 라우터 디버그 기능 |
 | `test_upstream_filter.py` | 업스트림 필터링 |
+| `test_mid_conversation_system_projection.py` | 대화를 닫는 시스템 메시지의 chat wire 투영 |
 | `test_upstream_cancel.py` | 업스트림 요청 취소 |
 | `test_provider_wire_normalization.py` | 제공자 Wire 형식 정규화 |
 | `test_channel_bridge.py` | 채널 브릿지 |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oneciel-ai/ciel-runtime",
-  "version": "0.2.2",
+  "version": "0.2.4",
   "description": "Universal AI coding-agent runtime and model-routing layer for Claude, Codex, AGY, and compatible runtimes.",
   "license": "MIT",
   "author": "One Ciel LLC",
@@ -36,6 +36,9 @@
     "ciel-runtime-stop.cmd",
     "ciel-runtime-stop.ps1",
     "npm-bin/",
+    "scripts/colab/",
+    "scripts/configure_speech_workers.py",
+    "scripts/deploy_colab_speech.ps1",
     "install.sh",
     "install.ps1",
     "README.md",

package/scripts/colab/bootstrap_moss_tts.py

@@ -0,0 +1,106 @@
+"""Bootstrap MOSS-TTS-Nano with vLLM-Omni on Colab and Tailscale Serve.
+
+Required Colab Secret: TAILSCALE_AUTHKEY
+Optional Colab Secret: CIEL_SPEECH_API_KEY
+"""
+
+from __future__ import annotations
+
+import json
+import os
+from pathlib import Path
+import shutil
+import subprocess
+import sys
+import time
+import urllib.request
+
+
+HOSTNAME = os.environ.get("CIEL_TTS_HOSTNAME", "ciel-tts")
+PORT = 8091
+SOCKET = "/tmp/ciel-tts-tailscaled.sock"
+STATE = "/tmp/ciel-tts-tailscaled.state"
+LOG_DIR = Path("/content/ciel-speech-logs")
+
+
+def secret(name: str, *, required: bool = False) -> str:
+    value = str(os.environ.get(name) or "").strip()
+    if not value:
+        try:
+            from google.colab import userdata  # type: ignore
+
+            value = str(userdata.get(name) or "").strip()
+        except Exception:
+            value = ""
+    if required and not value:
+        raise RuntimeError(f"Add {name} to Colab Secrets and allow notebook access, then rerun this script.")
+    return value
+
+
+def run(*args: str, check: bool = True) -> subprocess.CompletedProcess[str]:
+    print("+", " ".join(args))
+    return subprocess.run(args, check=check, text=True, capture_output=False)
+
+
+def install_tailscale() -> None:
+    if shutil.which("tailscale"):
+        return
+    run("bash", "-lc", "curl -fsSL https://tailscale.com/install.sh | sh")
+
+
+def start_tailscale(auth_key: str) -> tuple[str, str]:
+    install_tailscale()
+    LOG_DIR.mkdir(parents=True, exist_ok=True)
+    tail_log = (LOG_DIR / "tailscale-tts.log").open("ab")
+    subprocess.Popen(
+        ["tailscaled", f"--socket={SOCKET}", f"--state={STATE}", "--tun=userspace-networking"],
+        stdout=tail_log,
+        stderr=subprocess.STDOUT,
+        start_new_session=True,
+    )
+    for _ in range(60):
+        if Path(SOCKET).exists():
+            break
+        time.sleep(1)
+    run("tailscale", f"--socket={SOCKET}", "up", f"--auth-key={auth_key}", f"--hostname={HOSTNAME}", "--accept-dns=true", "--reset")
+    status = subprocess.check_output(["tailscale", f"--socket={SOCKET}", "status", "--json"], text=True)
+    dns_name = str(json.loads(status).get("Self", {}).get("DNSName") or HOSTNAME).rstrip(".")
+    serve = run("tailscale", f"--socket={SOCKET}", "serve", "--bg", "--https=443", f"http://127.0.0.1:{PORT}", check=False)
+    if serve.returncode == 0:
+        return dns_name, f"https://{dns_name}"
+    run("tailscale", f"--socket={SOCKET}", "serve", "--bg", "--http=80", f"http://127.0.0.1:{PORT}")
+    return dns_name, f"http://{dns_name}"
+
+
+def wait_for_server(api_key: str) -> None:
+    headers = {"authorization": f"Bearer {api_key}"} if api_key else {}
+    for _ in range(240):
+        try:
+            with urllib.request.urlopen(urllib.request.Request(f"http://127.0.0.1:{PORT}/health", headers=headers), timeout=3) as response:
+                if response.status < 500:
+                    return
+        except Exception:
+            time.sleep(2)
+    raise RuntimeError("MOSS TTS did not become healthy; inspect /content/ciel-speech-logs/moss-tts.log")
+
+
+def main() -> None:
+    auth_key = secret("TAILSCALE_AUTHKEY", required=True)
+    api_key = secret("CIEL_SPEECH_API_KEY")
+    run(sys.executable, "-m", "pip", "install", "-U", "vllm-omni==0.24.0")
+    LOG_DIR.mkdir(parents=True, exist_ok=True)
+    command = [
+        "vllm", "serve", "OpenMOSS-Team/MOSS-TTS-Nano", "--omni", "--host", "127.0.0.1", "--port", str(PORT),
+        "--gpu-memory-utilization", "0.72", "--trust-remote-code", "--enforce-eager",
+    ]
+    if api_key:
+        command.extend(["--api-key", api_key])
+    server_log = (LOG_DIR / "moss-tts.log").open("ab")
+    subprocess.Popen(command, stdout=server_log, stderr=subprocess.STDOUT, start_new_session=True)
+    wait_for_server(api_key)
+    dns_name, base_url = start_tailscale(auth_key)
+    print(json.dumps({"ok": True, "role": "tts", "hostname": dns_name, "base_url": base_url, "model": "OpenMOSS-Team/MOSS-TTS-Nano", "api_key_set": bool(api_key)}, indent=2))
+
+
+if __name__ == "__main__":
+    main()