@oneciel-ai/ciel-runtime 0.2.3 → 0.2.4

package/ciel_runtime.py

@@ -500,6 +500,7 @@ from ciel_runtime_support.runtime_paths import (CHANNEL_COMPACT_REQUEST_PATH,  #
 from ciel_runtime_support.runtime_restart import forced_upgrade_environment
 from ciel_runtime_support.runtime_restart import running_from_npm_package as detect_running_from_npm_package
 from ciel_runtime_support.secure_json_repository import SecureJsonEffects, SecureJsonRepository
+from ciel_runtime_support.speech_http_controller import SpeechHttpController, SpeechHttpPorts
 from ciel_runtime_support.session_import import ImportSessionHttpController, ImportSessionHttpPorts, ImportSessionLimits, ImportSessionRepository, ImportSessionService, import_record_line, import_tool_text, normalize_import_source
 from ciel_runtime_support.slash_command_assets import ADVISOR_NATIVE_DISABLED_SLASH_COMMAND  # noqa: F401 - compatibility export
 from ciel_runtime_support.slash_command_assets import LEGACY_ADVISOR_CALL_MARKER  # noqa: F401 - compatibility export
@@ -1700,6 +1701,7 @@ def render_router_home_html(cfg: dict[str, Any], provider: str, pcfg: dict[str,
 def render_web_chat_html(cfg: dict[str, Any], provider: str, pcfg: dict[str, Any]) -> str: return web_ui_controller().render_web_chat(cfg, provider, pcfg)
 def handle_web_get(handler: BaseHTTPRequestHandler, path: str) -> bool: return web_ui_controller().handle_get(handler, path)
 
+def speech_http_controller() -> SpeechHttpController: return SpeechHttpController(SpeechHttpPorts(load_config, save_config, write_json, router_log))
 def parse_json_body(raw: bytes) -> dict[str, Any]:
     try:
         value = json.loads(raw.decode("utf-8") if raw else "{}")
@@ -2817,8 +2819,8 @@ def _router_server_context() -> RouterServerContext:
     http_services = RouterHttpServices(
         core=RouterHttpCore(load_config, reject_external_router_request, get_current_provider, parse_json_body, is_client_disconnect_error, router_log),
         get=RouterHttpGetEndpoints(handle_codex_mcp_split_proxy_get, handle_events_get, handle_llm_config_get, handle_channel_mcp_get, handle_web_get,
-                                   handle_chat_get, handle_plan_get, route_runtime_get),
-        post=RouterHttpPostEndpoints(handle_codex_mcp_split_proxy_request, handle_llm_config_post, handle_channel_mcp_post, handle_chat_post,
+                                   lambda handler, path: speech_http_controller().get(handler, path), handle_chat_get, handle_plan_get, route_runtime_get),
+        post=RouterHttpPostEndpoints(handle_codex_mcp_split_proxy_request, lambda handler, path, raw, content_type: speech_http_controller().post(handler, path, raw, content_type), handle_llm_config_post, handle_channel_mcp_post, handle_chat_post,
                                      handle_plan_post, route_runtime_post),
         presentation=RouterHttpPresentation(render_router_home_html, router_health_payload, write_text_response, write_json, list_model_objects_for_request,
                                             resolve_requested_model, model_object),

package/ciel_runtime_support/config_repository.py

@@ -26,6 +26,36 @@ def build_default_config(provider_defaults: dict[str, Any]) -> dict[str, Any]:
             "port": 0,
             "tailscale_https": False,
         },
+        "speech": {
+            "asr": {
+                "enabled": False,
+                "base_url": "http://ciel-asr:8000",
+                "endpoint": "/v1/audio/transcriptions",
+                "model": "Qwen/Qwen3-ASR-0.6B",
+                "language": "auto",
+                "api_key": "",
+                "timeout_seconds": 300,
+            },
+            "tts": {
+                "enabled": False,
+                "base_url": "http://ciel-tts:8091",
+                "endpoint": "/v1/audio/speech",
+                "voices_endpoint": "/v1/audio/voices",
+                "model": "OpenMOSS-Team/MOSS-TTS-Nano",
+                "voice": "default",
+                "language": "ko",
+                "response_format": "wav",
+                "speed": 1.0,
+                "auto_speak": False,
+                "api_key": "",
+                "timeout_seconds": 300,
+            },
+            "tailscale": {
+                "enabled": True,
+                "asr_hostname": "ciel-asr",
+                "tts_hostname": "ciel-tts",
+            },
+        },
         "claude_code": {
             "compat_prompt_for_non_anthropic": True,
             "channels": [],

package/ciel_runtime_support/router_http.py

@@ -90,6 +90,7 @@ class RouterHttpGetEndpoints:
     llm_config: Callable[[Any, str], bool]
     channel_mcp: Callable[[Any, str], bool]
     web: Callable[[Any, str], bool]
+    speech: Callable[[Any, str], bool]
     chat: Callable[[Any, str], bool]
     plan: Callable[[Any, str], bool]
     runtime: Callable[..., bool]
@@ -98,6 +99,7 @@ class RouterHttpGetEndpoints:
 @dataclass(frozen=True, slots=True)
 class RouterHttpPostEndpoints:
     codex_mcp_split: Callable[[Any, str, bytes, str], bool]
+    speech: Callable[[Any, str, bytes, str], bool]
     llm_config: Callable[[Any, str, dict[str, Any]], bool]
     channel_mcp: Callable[[Any, str, dict[str, Any]], bool]
     chat: Callable[[Any, str, dict[str, Any]], bool]
@@ -636,6 +638,8 @@ class RouterHttpHandler(BaseHTTPRequestHandler):
             return
         if endpoints.web(self, path):
             return
+        if endpoints.speech(self, path):
+            return
         if endpoints.chat(self, path) or endpoints.plan(self, path):
             return
         provider, pcfg = services.core.get_current_provider(cfg)
@@ -676,6 +680,8 @@ class RouterHttpHandler(BaseHTTPRequestHandler):
             endpoints = services.post
             if endpoints.codex_mcp_split(self, path, raw, "POST"):
                 return
+            if endpoints.speech(self, path, raw, str(self.headers.get("content-type") or "application/json")):
+                return
             body = services.core.parse_json_body(raw)
             if endpoints.llm_config(self, path, body):
                 return

package/ciel_runtime_support/router_server_context.py

@@ -49,6 +49,8 @@ class RouterServerContext:
             "provider": provider,
             "model": self.health.current_alias(cfg),
             "web_chat": "/ca/web/chat",
+            "web_chat_api": "/ca/web/chat/api",
+            "speech": "/ca/speech/health",
             "chat": "/ca/chat/health",
             "plan": "/ca/plan/artifacts",
             "events": "/ca/events",

package/ciel_runtime_support/runtime_constants.py

@@ -93,7 +93,7 @@ OFFICIAL_CHANNEL_PLUGINS = {
 }
 
 APP_NAME = "Ciel Runtime"
-VERSION = "0.2.3"
+VERSION = "0.2.4"
 CREDITS = "Credits: One Ciel LLC"
 PRELAUNCH_CANCEL = 10
 PRELAUNCH_LAUNCH_CODEX = 11

package/ciel_runtime_support/speech_http_controller.py

@@ -0,0 +1,335 @@
+"""Speech configuration and OpenAI-compatible ASR/TTS proxy endpoints."""
+
+from __future__ import annotations
+
+import base64
+import json
+import secrets
+import urllib.error
+import urllib.parse
+import urllib.request
+from dataclasses import dataclass
+from http.server import BaseHTTPRequestHandler
+from typing import Any, Callable
+
+
+SpeechConfig = dict[str, Any]
+
+
+@dataclass(frozen=True, slots=True)
+class SpeechHttpPorts:
+    load_config: Callable[[], dict[str, Any]]
+    save_config: Callable[[dict[str, Any]], None]
+    write_json: Callable[..., None]
+    log: Callable[[str, str], None]
+    urlopen: Callable[..., Any] = urllib.request.urlopen
+
+
+@dataclass(frozen=True, slots=True)
+class SpeechHttpController:
+    ports: SpeechHttpPorts
+
+    def get(self, handler: BaseHTTPRequestHandler, path: str) -> bool:
+        if path == "/ca/speech/config":
+            self.ports.write_json(handler, self.public_config())
+            return True
+        if path == "/ca/speech/health":
+            self.ports.write_json(handler, self.health_payload())
+            return True
+        if path == "/ca/web/chat/api":
+            self.ports.write_json(handler, self.discovery_payload())
+            return True
+        if path == "/v1/audio/voices":
+            return self._proxy_get(handler, "tts", "voices_endpoint")
+        return False
+
+    def post(
+        self,
+        handler: BaseHTTPRequestHandler,
+        path: str,
+        raw: bytes,
+        content_type: str,
+    ) -> bool:
+        if path == "/ca/speech/config":
+            return self._save_public_config(handler, raw)
+        if path in {"/v1/audio/transcriptions", "/v1/audio/translations"}:
+            return self._proxy_asr(handler, raw, content_type)
+        if path in {"/v1/audio/speech", "/v1/audio/speech/batch"}:
+            return self._proxy_tts(handler, raw, content_type, batch=path.endswith("/batch"))
+        if path == "/v1/audio/voices":
+            return self._proxy_raw(handler, "tts", "voices_endpoint", raw, content_type)
+        return False
+
+    def public_config(self) -> dict[str, Any]:
+        speech = self._speech_config()
+        public: dict[str, Any] = {"ok": True}
+        for name in ("asr", "tts"):
+            source = speech.get(name) if isinstance(speech.get(name), dict) else {}
+            item = {key: value for key, value in source.items() if key != "api_key"}
+            item["api_key_set"] = bool(str(source.get("api_key") or "").strip())
+            public[name] = item
+        tailscale = speech.get("tailscale")
+        public["tailscale"] = dict(tailscale) if isinstance(tailscale, dict) else {}
+        public["endpoints"] = self.discovery_payload()["endpoints"]
+        return public
+
+    def discovery_payload(self) -> dict[str, Any]:
+        return {
+            "ok": True,
+            "web_chat": "/ca/web/chat",
+            "endpoints": {
+                "chat_health": "GET /ca/channel/health",
+                "chat_messages": "GET|POST /ca/channel/messages",
+                "chat_wait": "GET /ca/channel/wait",
+                "chat_stream": "GET /ca/channel/stream",
+                "chat_files": "POST /ca/channel/files",
+                "speech_config": "GET|POST /ca/speech/config",
+                "speech_health": "GET /ca/speech/health",
+                "asr": "POST /v1/audio/transcriptions",
+                "asr_translate": "POST /v1/audio/translations",
+                "tts": "POST /v1/audio/speech",
+                "tts_batch": "POST /v1/audio/speech/batch",
+                "tts_voices": "GET|POST /v1/audio/voices",
+                "models": "GET /v1/models",
+                "responses": "POST /v1/responses",
+                "messages": "POST /v1/messages",
+            },
+        }
+
+    def health_payload(self) -> dict[str, Any]:
+        services = {name: self._probe(name) for name in ("asr", "tts")}
+        return {"ok": all(not item["enabled"] or item["reachable"] for item in services.values()), "services": services}
+
+    def _speech_config(self) -> SpeechConfig:
+        speech = self.ports.load_config().get("speech")
+        return speech if isinstance(speech, dict) else {}
+
+    def _service_config(self, name: str) -> SpeechConfig:
+        service = self._speech_config().get(name)
+        return service if isinstance(service, dict) else {}
+
+    def _save_public_config(self, handler: BaseHTTPRequestHandler, raw: bytes) -> bool:
+        try:
+            update = json.loads(raw.decode("utf-8") if raw else "{}")
+            if not isinstance(update, dict):
+                raise ValueError("configuration body must be a JSON object")
+            config = self.ports.load_config()
+            speech = config.setdefault("speech", {})
+            if not isinstance(speech, dict):
+                speech = {}
+                config["speech"] = speech
+            for name in ("asr", "tts"):
+                incoming = update.get(name)
+                if not isinstance(incoming, dict):
+                    continue
+                current = speech.setdefault(name, {})
+                if not isinstance(current, dict):
+                    current = {}
+                    speech[name] = current
+                for key, value in incoming.items():
+                    if key in {"api_key_set", "clear_api_key"}:
+                        continue
+                    if key == "api_key" and not str(value or "").strip():
+                        continue
+                    current[key] = self._validated_value(name, key, value)
+                if incoming.get("clear_api_key") is True:
+                    current["api_key"] = ""
+            tailscale = update.get("tailscale")
+            if isinstance(tailscale, dict):
+                current_tailscale = speech.setdefault("tailscale", {})
+                if not isinstance(current_tailscale, dict):
+                    current_tailscale = {}
+                    speech["tailscale"] = current_tailscale
+                for key in ("enabled", "asr_hostname", "tts_hostname"):
+                    if key in tailscale:
+                        current_tailscale[key] = tailscale[key]
+            self.ports.save_config(config)
+            self.ports.write_json(handler, self.public_config())
+        except (UnicodeError, ValueError, TypeError) as exc:
+            self.ports.write_json(handler, {"ok": False, "error": str(exc)}, 400)
+        return True
+
+    @staticmethod
+    def _validated_value(service: str, key: str, value: Any) -> Any:
+        allowed = {
+            "asr": {"enabled", "base_url", "endpoint", "model", "language", "api_key", "timeout_seconds"},
+            "tts": {"enabled", "base_url", "endpoint", "voices_endpoint", "model", "voice", "language", "response_format", "speed", "auto_speak", "api_key", "timeout_seconds"},
+        }
+        if key not in allowed[service]:
+            raise ValueError(f"unsupported {service} setting: {key}")
+        if key in {"enabled", "auto_speak"}:
+            return bool(value)
+        if key == "timeout_seconds":
+            return max(1, min(3600, int(value)))
+        if key == "speed":
+            return max(0.25, min(4.0, float(value)))
+        text = str(value or "").strip()
+        if key == "base_url":
+            parsed = urllib.parse.urlparse(text)
+            if parsed.scheme not in {"http", "https"} or not parsed.netloc:
+                raise ValueError(f"invalid {service} base_url")
+            return text.rstrip("/")
+        if key in {"endpoint", "voices_endpoint"} and not text.startswith("/"):
+            raise ValueError(f"{service} {key} must begin with /")
+        return text
+
+    def _probe(self, name: str) -> dict[str, Any]:
+        config = self._service_config(name)
+        enabled = bool(config.get("enabled"))
+        result: dict[str, Any] = {
+            "enabled": enabled,
+            "configured": bool(str(config.get("base_url") or "").strip()),
+            "reachable": False,
+        }
+        if not enabled:
+            return result
+        try:
+            request = urllib.request.Request(self._url(config, "/health"), headers=self._headers(config, "application/json"))
+            with self.ports.urlopen(request, timeout=min(10.0, self._timeout(config))) as response:
+                result["status"] = int(getattr(response, "status", 200))
+                result["reachable"] = result["status"] < 500
+        except Exception as exc:
+            result["error"] = f"{type(exc).__name__}: {exc}"
+        return result
+
+    def _proxy_get(self, handler: BaseHTTPRequestHandler, service: str, endpoint_key: str) -> bool:
+        config = self._service_config(service)
+        if not self._require_enabled(handler, service, config):
+            return True
+        request = urllib.request.Request(self._url(config, str(config.get(endpoint_key) or "")), headers=self._headers(config, "application/json"))
+        return self._open_and_write(handler, service, config, request)
+
+    def _proxy_asr(self, handler: BaseHTTPRequestHandler, raw: bytes, content_type: str) -> bool:
+        config = self._service_config("asr")
+        if not self._require_enabled(handler, "asr", config):
+            return True
+        if "application/json" in content_type.lower():
+            try:
+                body = json.loads(raw.decode("utf-8"))
+                if not isinstance(body, dict):
+                    raise ValueError("request must be a JSON object")
+                audio = base64.b64decode(str(body.get("audio_base64") or ""), validate=True)
+                if not audio:
+                    raise ValueError("audio_base64 is required")
+                fields = {
+                    "model": str(body.get("model") or config.get("model") or ""),
+                    "language": str(body.get("language") or config.get("language") or ""),
+                    "response_format": str(body.get("response_format") or "json"),
+                }
+                if fields["language"].lower() == "auto":
+                    fields.pop("language")
+                raw, content_type = self._multipart(fields, "file", str(body.get("filename") or "recording.wav"), str(body.get("content_type") or "audio/wav"), audio)
+            except (ValueError, TypeError, UnicodeError) as exc:
+                self.ports.write_json(handler, {"error": {"type": "invalid_request_error", "message": str(exc)}}, 400)
+                return True
+        return self._proxy_raw(handler, "asr", "endpoint", raw, content_type)
+
+    def _proxy_tts(self, handler: BaseHTTPRequestHandler, raw: bytes, content_type: str, *, batch: bool) -> bool:
+        config = self._service_config("tts")
+        if not self._require_enabled(handler, "tts", config):
+            return True
+        if "application/json" in content_type.lower():
+            try:
+                body = json.loads(raw.decode("utf-8") if raw else "{}")
+                if not isinstance(body, dict):
+                    raise ValueError("request must be a JSON object")
+                if not batch:
+                    body.setdefault("model", str(config.get("model") or ""))
+                    body.setdefault("voice", str(config.get("voice") or "default"))
+                    body.setdefault("language", str(config.get("language") or "Auto"))
+                    body.setdefault("response_format", str(config.get("response_format") or "wav"))
+                    body.setdefault("speed", float(config.get("speed") or 1.0))
+                raw = json.dumps(body, ensure_ascii=False).encode("utf-8")
+            except (ValueError, TypeError, UnicodeError) as exc:
+                self.ports.write_json(handler, {"error": {"type": "invalid_request_error", "message": str(exc)}}, 400)
+                return True
+        endpoint = str(config.get("endpoint") or "/v1/audio/speech") + ("/batch" if batch else "")
+        return self._proxy_bytes(handler, "tts", config, endpoint, raw, content_type)
+
+    def _proxy_raw(self, handler: BaseHTTPRequestHandler, service: str, endpoint_key: str, raw: bytes, content_type: str) -> bool:
+        config = self._service_config(service)
+        if not self._require_enabled(handler, service, config):
+            return True
+        return self._proxy_bytes(handler, service, config, str(config.get(endpoint_key) or ""), raw, content_type)
+
+    def _proxy_bytes(self, handler: BaseHTTPRequestHandler, service: str, config: SpeechConfig, endpoint: str, raw: bytes, content_type: str) -> bool:
+        request = urllib.request.Request(
+            self._url(config, endpoint),
+            data=raw,
+            headers=self._headers(config, content_type or "application/octet-stream"),
+            method="POST",
+        )
+        return self._open_and_write(handler, service, config, request)
+
+    def _open_and_write(self, handler: BaseHTTPRequestHandler, service: str, config: SpeechConfig, request: urllib.request.Request) -> bool:
+        try:
+            with self.ports.urlopen(request, timeout=self._timeout(config)) as response:
+                self._write_bytes(handler, response.read(), int(getattr(response, "status", 200)), str(response.headers.get("content-type") or "application/octet-stream"))
+        except urllib.error.HTTPError as exc:
+            self._write_bytes(handler, exc.read(), int(exc.code), str(exc.headers.get("content-type") or "application/json"))
+        except Exception as exc:
+            self.ports.log("ERROR", f"speech_proxy_failed service={service} error={type(exc).__name__}: {exc}")
+            self.ports.write_json(handler, {"error": {"type": "upstream_error", "message": f"{service.upper()} upstream unavailable: {exc}"}}, 502)
+        return True
+
+    @staticmethod
+    def _require_enabled(handler: BaseHTTPRequestHandler, service: str, config: SpeechConfig) -> bool:
+        if bool(config.get("enabled")) and str(config.get("base_url") or "").strip():
+            return True
+        body = json.dumps({"error": {"type": "service_disabled", "message": f"{service.upper()} is not configured or enabled"}}).encode()
+        handler.send_response(503)
+        handler.send_header("content-type", "application/json")
+        handler.send_header("content-length", str(len(body)))
+        handler.end_headers()
+        handler.wfile.write(body)
+        return False
+
+    @staticmethod
+    def _write_bytes(handler: BaseHTTPRequestHandler, data: bytes, status: int, content_type: str) -> None:
+        handler.send_response(status)
+        handler.send_header("content-type", content_type)
+        handler.send_header("content-length", str(len(data)))
+        handler.send_header("cache-control", "no-store")
+        handler.end_headers()
+        handler.wfile.write(data)
+
+    @staticmethod
+    def _headers(config: SpeechConfig, content_type: str) -> dict[str, str]:
+        headers = {"accept": "*/*", "content-type": content_type}
+        api_key = str(config.get("api_key") or "").strip()
+        if api_key:
+            headers["authorization"] = f"Bearer {api_key}"
+        return headers
+
+    @staticmethod
+    def _url(config: SpeechConfig, endpoint: str) -> str:
+        return str(config.get("base_url") or "").rstrip("/") + "/" + endpoint.lstrip("/")
+
+    @staticmethod
+    def _timeout(config: SpeechConfig) -> float:
+        try:
+            return max(1.0, min(3600.0, float(config.get("timeout_seconds") or 300)))
+        except (TypeError, ValueError):
+            return 300.0
+
+    @staticmethod
+    def _multipart(fields: dict[str, str], file_field: str, filename: str, mime: str, data: bytes) -> tuple[bytes, str]:
+        boundary = "ciel-" + secrets.token_hex(16)
+        chunks: list[bytes] = []
+        for name, value in fields.items():
+            chunks.extend([
+                f"--{boundary}\r\n".encode(),
+                f'Content-Disposition: form-data; name="{name}"\r\n\r\n'.encode(),
+                str(value).encode("utf-8"), b"\r\n",
+            ])
+        safe_filename = filename.replace('"', "_").replace("\r", "_").replace("\n", "_")
+        chunks.extend([
+            f"--{boundary}\r\n".encode(),
+            f'Content-Disposition: form-data; name="{file_field}"; filename="{safe_filename}"\r\n'.encode(),
+            f"Content-Type: {mime}\r\n\r\n".encode(), data, b"\r\n",
+            f"--{boundary}--\r\n".encode(),
+        ])
+        return b"".join(chunks), f"multipart/form-data; boundary={boundary}"
+
+
+__all__ = ["SpeechHttpController", "SpeechHttpPorts"]

package/ciel_runtime_support/web_ui.py

@@ -112,6 +112,22 @@ def render_web_chat_page(
     }}
     .attach-button:hover {{ border-color: var(--accent); }}
     .attach-button:disabled {{ opacity: .55; cursor: not-allowed; }}
+    .recording {{ border-color: #ef4444 !important; color: #fecaca !important; }}
+    .message-actions {{ display: flex; align-items: flex-start; padding: 4px; }}
+    .message-actions button {{ border: 1px solid var(--line); border-radius: 999px; background: #0b111b; color: var(--muted); cursor: pointer; padding: 4px 8px; }}
+    dialog {{ width: min(720px, calc(100vw - 28px)); max-height: calc(100vh - 28px); overflow: auto; border: 1px solid var(--line); border-radius: 10px; background: var(--panel); color: var(--text); padding: 0; }}
+    dialog::backdrop {{ background: rgba(0,0,0,.72); }}
+    .settings-head {{ position: sticky; top: 0; display: flex; justify-content: space-between; align-items: center; gap: 12px; padding: 14px 16px; border-bottom: 1px solid var(--line); background: var(--panel); }}
+    .settings-body {{ padding: 16px; display: grid; gap: 16px; }}
+    .settings-section {{ border: 1px solid var(--line); border-radius: 8px; padding: 12px; display: grid; gap: 10px; }}
+    .settings-section h3 {{ margin: 0; font-size: 14px; }}
+    .settings-grid {{ display: grid; grid-template-columns: repeat(2, minmax(0, 1fr)); gap: 10px; }}
+    .settings-grid label {{ display: grid; gap: 5px; color: var(--muted); font-size: 12px; }}
+    .settings-grid label.wide {{ grid-column: 1 / -1; }}
+    .settings-grid input, .settings-grid select {{ width: 100%; border: 1px solid var(--line); border-radius: 6px; background: #080d14; color: var(--text); padding: 8px; }}
+    .check {{ display: flex !important; grid-auto-flow: column; justify-content: start; align-items: center; gap: 7px !important; }}
+    .check input {{ width: auto; }}
+    .settings-actions {{ display: flex; justify-content: flex-end; gap: 8px; }}
     #fileInput {{ display: none; }}
     .attachment-tray {{ display: flex; gap: 7px; flex-wrap: wrap; min-height: 0; }}
     .attachment-chip {{
@@ -135,6 +151,7 @@ def render_web_chat_page(
       .bubble {{ max-width: 94%; }}
       header {{ align-items: flex-start; flex-direction: column; }}
       .pill {{ white-space: normal; }}
+      .settings-grid {{ grid-template-columns: 1fr; }}
     }}
   </style>
 </head>
@@ -154,6 +171,8 @@ def render_web_chat_page(
         <a href="/">Router Home</a>
         <a href="/ca/events">Events</a>
         <a href="/health">Health JSON</a>
+        <a href="/ca/web/chat/api">Chat API JSON</a>
+        <button class="ghost" id="speechSettingsButton" type="button">Speech Settings</button>
         <button class="ghost" id="shareButton" type="button">Copy Chat Link</button>
         <button class="ghost" id="clearButton" type="button">Clear Chat</button>
       </div>
@@ -173,6 +192,7 @@ def render_web_chat_page(
           <button class="primary" id="sendButton" type="submit">Send</button>
         </div>
         <div class="composer-actions">
+          <button class="attach-button" id="micButton" type="button">Start voice input</button>
           <button class="attach-button" id="attachButton" type="button">Attach files</button>
           <input id="fileInput" type="file" multiple>
           <div class="attachment-tray" id="attachmentTray" aria-live="polite"></div>
@@ -181,6 +201,45 @@ def render_web_chat_page(
       </form>
     </main>
   </div>
+  <dialog id="speechSettingsDialog">
+    <form id="speechSettingsForm">
+      <div class="settings-head"><strong>Speech Settings</strong><button class="ghost" id="speechSettingsClose" type="button">Close</button></div>
+      <div class="settings-body">
+        <section class="settings-section">
+          <h3>STT / Qwen ASR</h3>
+          <div class="settings-grid">
+            <label class="check"><input id="asrEnabled" type="checkbox"> Enable STT</label>
+            <label>Language<input id="asrLanguage" placeholder="auto"></label>
+            <label class="wide">Tailscale base URL<input id="asrBaseUrl" placeholder="http://ciel-asr:8000"></label>
+            <label class="wide">Model<input id="asrModel" placeholder="Qwen/Qwen3-ASR-0.6B"></label>
+            <label class="wide">Remote bearer token<input id="asrApiKey" type="password" autocomplete="new-password" placeholder="Leave blank to keep current token"></label>
+          </div>
+        </section>
+        <section class="settings-section">
+          <h3>TTS / MOSS-TTS-Nano</h3>
+          <div class="settings-grid">
+            <label class="check"><input id="ttsEnabled" type="checkbox"> Enable TTS</label>
+            <label class="check"><input id="ttsAutoSpeak" type="checkbox"> Speak replies automatically</label>
+            <label class="wide">Tailscale base URL<input id="ttsBaseUrl" placeholder="http://ciel-tts:8091"></label>
+            <label>Voice<input id="ttsVoice" placeholder="default"></label>
+            <label>Language<input id="ttsLanguage" placeholder="ko"></label>
+            <label class="wide">Model<input id="ttsModel" placeholder="OpenMOSS-Team/MOSS-TTS-Nano"></label>
+            <label class="wide">Remote bearer token<input id="ttsApiKey" type="password" autocomplete="new-password" placeholder="Leave blank to keep current token"></label>
+          </div>
+        </section>
+        <section class="settings-section">
+          <h3>Tailscale tunnel</h3>
+          <div class="settings-grid">
+            <label class="check"><input id="tailscaleEnabled" type="checkbox"> Use tailnet-only addresses</label>
+            <label>ASR hostname<input id="tailscaleAsrHostname" placeholder="ciel-asr"></label>
+            <label>TTS hostname<input id="tailscaleTtsHostname" placeholder="ciel-tts"></label>
+          </div>
+          <div class="hint">The browser calls Ciel locally. Only the Ciel router connects to these Tailscale services.</div>
+        </section>
+        <div class="settings-actions"><button class="ghost" id="speechHealthButton" type="button">Test connections</button><button class="primary" type="submit">Save</button></div>
+      </div>
+    </form>
+  </dialog>
   <script>
     const MODEL = {json.dumps(model)};
     const transcript = document.getElementById('transcript');
@@ -188,10 +247,16 @@ def render_web_chat_page(
     const prompt = document.getElementById('prompt');
     const sendButton = document.getElementById('sendButton');
     const attachButton = document.getElementById('attachButton');
+    const micButton = document.getElementById('micButton');
     const fileInput = document.getElementById('fileInput');
     const attachmentTray = document.getElementById('attachmentTray');
     const shareButton = document.getElementById('shareButton');
     const clearButton = document.getElementById('clearButton');
+    const speechSettingsButton = document.getElementById('speechSettingsButton');
+    const speechSettingsDialog = document.getElementById('speechSettingsDialog');
+    const speechSettingsForm = document.getElementById('speechSettingsForm');
+    const speechSettingsClose = document.getElementById('speechSettingsClose');
+    const speechHealthButton = document.getElementById('speechHealthButton');
     const statePill = document.getElementById('statePill');
     const SESSION_KEY = 'ciel-runtime-web-chat-session';
     const LAST_ID_KEY = 'ciel-runtime-web-chat-last-id';
@@ -218,6 +283,10 @@ def render_web_chat_page(
     let lastId = Number(localStorage.getItem(scopedLastIdKey) || '0') || 0;
     let eventSource = null;
     let selectedFiles = [];
+    let speechConfig = {{asr: {{enabled: false}}, tts: {{enabled: false, auto_speak: false}}}};
+    let mediaRecorder = null;
+    let mediaStream = null;
+    let recordingChunks = [];
     function setState(text, cls = '') {{
       statePill.textContent = text;
       statePill.className = 'pill ' + cls;
@@ -401,6 +470,16 @@ def render_web_chat_page(
         bubble.innerHTML = renderMarkdown(text);
       }}
       row.appendChild(bubble);
+      if (role === 'assistant') {{
+        const actions = document.createElement('div');
+        actions.className = 'message-actions';
+        const speak = document.createElement('button');
+        speak.type = 'button';
+        speak.textContent = 'Speak';
+        speak.addEventListener('click', () => speakText(text));
+        actions.appendChild(speak);
+        row.appendChild(actions);
+      }}
       if (mode === 'prepend') {{
         transcript.insertBefore(row, transcript.firstChild);
       }} else {{
@@ -424,7 +503,10 @@ def render_web_chat_page(
       const text = message.message || '';
       if (!text.trim()) return;
       addBubble(roleForMessage(message), text, mode, message.id);
-      if (mode !== 'prepend' && message.sender_id !== 'web-user') setState('reply received', 'ok');
+      if (mode !== 'prepend' && message.sender_id !== 'web-user') {{
+        setState('reply received', 'ok');
+        if (speechConfig.tts && speechConfig.tts.enabled && speechConfig.tts.auto_speak) speakText(text);
+      }}
     }}
     function formatBytes(bytes) {{
       const value = Number(bytes || 0);
@@ -471,6 +553,134 @@ def render_web_chat_page(
         reader.readAsDataURL(file);
       }});
     }}
+    function setSpeechForm(config) {{
+      const asr = config.asr || {{}};
+      const tts = config.tts || {{}};
+      const tailscale = config.tailscale || {{}};
+      document.getElementById('asrEnabled').checked = Boolean(asr.enabled);
+      document.getElementById('asrBaseUrl').value = asr.base_url || '';
+      document.getElementById('asrModel').value = asr.model || '';
+      document.getElementById('asrLanguage').value = asr.language || 'auto';
+      document.getElementById('asrApiKey').value = '';
+      document.getElementById('asrApiKey').placeholder = asr.api_key_set ? 'Token is set; leave blank to keep it' : 'Optional remote bearer token';
+      document.getElementById('ttsEnabled').checked = Boolean(tts.enabled);
+      document.getElementById('ttsAutoSpeak').checked = Boolean(tts.auto_speak);
+      document.getElementById('ttsBaseUrl').value = tts.base_url || '';
+      document.getElementById('ttsModel').value = tts.model || '';
+      document.getElementById('ttsVoice').value = tts.voice || 'default';
+      document.getElementById('ttsLanguage').value = tts.language || 'ko';
+      document.getElementById('ttsApiKey').value = '';
+      document.getElementById('ttsApiKey').placeholder = tts.api_key_set ? 'Token is set; leave blank to keep it' : 'Optional remote bearer token';
+      document.getElementById('tailscaleEnabled').checked = tailscale.enabled !== false;
+      document.getElementById('tailscaleAsrHostname').value = tailscale.asr_hostname || 'ciel-asr';
+      document.getElementById('tailscaleTtsHostname').value = tailscale.tts_hostname || 'ciel-tts';
+      micButton.disabled = !asr.enabled;
+      micButton.title = asr.enabled ? 'Record speech and transcribe it' : 'Enable STT in Speech Settings first';
+    }}
+    async function loadSpeechConfig() {{
+      const response = await fetch('/ca/speech/config', {{headers: {{'accept': 'application/json'}}}});
+      const data = await response.json();
+      if (!response.ok || !data.ok) throw new Error(data.error || `HTTP ${{response.status}}`);
+      speechConfig = data;
+      setSpeechForm(data);
+      return data;
+    }}
+    async function saveSpeechConfig() {{
+      const payload = {{
+        asr: {{
+          enabled: document.getElementById('asrEnabled').checked,
+          base_url: document.getElementById('asrBaseUrl').value,
+          model: document.getElementById('asrModel').value,
+          language: document.getElementById('asrLanguage').value,
+          api_key: document.getElementById('asrApiKey').value,
+        }},
+        tts: {{
+          enabled: document.getElementById('ttsEnabled').checked,
+          auto_speak: document.getElementById('ttsAutoSpeak').checked,
+          base_url: document.getElementById('ttsBaseUrl').value,
+          model: document.getElementById('ttsModel').value,
+          voice: document.getElementById('ttsVoice').value,
+          language: document.getElementById('ttsLanguage').value,
+          api_key: document.getElementById('ttsApiKey').value,
+        }},
+        tailscale: {{
+          enabled: document.getElementById('tailscaleEnabled').checked,
+          asr_hostname: document.getElementById('tailscaleAsrHostname').value,
+          tts_hostname: document.getElementById('tailscaleTtsHostname').value,
+        }},
+      }};
+      const response = await fetch('/ca/speech/config', {{method: 'POST', headers: {{'content-type': 'application/json', 'accept': 'application/json'}}, body: JSON.stringify(payload)}});
+      const data = await response.json();
+      if (!response.ok || !data.ok) throw new Error(data.error || `HTTP ${{response.status}}`);
+      speechConfig = data;
+      setSpeechForm(data);
+      return data;
+    }}
+    async function speakText(text) {{
+      if (!speechConfig.tts || !speechConfig.tts.enabled) {{
+        setState('TTS disabled', 'error');
+        return;
+      }}
+      try {{
+        setState('generating speech');
+        const response = await fetch('/v1/audio/speech', {{
+          method: 'POST',
+          headers: {{'content-type': 'application/json'}},
+          body: JSON.stringify({{input: String(text || ''), model: speechConfig.tts.model, voice: speechConfig.tts.voice, language: speechConfig.tts.language, response_format: speechConfig.tts.response_format || 'wav'}})
+        }});
+        if (!response.ok) throw new Error(await response.text() || `HTTP ${{response.status}}`);
+        const blob = await response.blob();
+        const url = URL.createObjectURL(blob);
+        const audio = new Audio(url);
+        audio.addEventListener('ended', () => URL.revokeObjectURL(url), {{once: true}});
+        audio.addEventListener('error', () => URL.revokeObjectURL(url), {{once: true}});
+        await audio.play();
+        setState('speaking', 'ok');
+      }} catch (err) {{
+        setState('TTS error', 'error');
+        addBubble('system', 'TTS failed: ' + String(err && err.message ? err.message : err));
+      }}
+    }}
+    async function transcribeRecording(blob) {{
+      setState('transcribing');
+      const audio_base64 = await fileToBase64(blob);
+      const response = await fetch('/v1/audio/transcriptions', {{
+        method: 'POST',
+        headers: {{'content-type': 'application/json', 'accept': 'application/json'}},
+        body: JSON.stringify({{audio_base64, filename: 'web-chat-recording.webm', content_type: blob.type || 'audio/webm', model: speechConfig.asr.model, language: speechConfig.asr.language}})
+      }});
+      const text = await response.text();
+      let data = {{}};
+      try {{ data = text ? JSON.parse(text) : {{}}; }} catch {{}}
+      if (!response.ok) throw new Error((data.error && (data.error.message || data.error)) || text || `HTTP ${{response.status}}`);
+      const transcriptText = String(data.text || data.transcript || '').trim();
+      if (!transcriptText) throw new Error('ASR returned no transcript');
+      prompt.value = prompt.value ? prompt.value + ' ' + transcriptText : transcriptText;
+      prompt.focus();
+      setState('transcribed', 'ok');
+    }}
+    async function startVoiceInput() {{
+      if (!navigator.mediaDevices || !window.MediaRecorder) throw new Error('This browser does not support microphone recording');
+      mediaStream = await navigator.mediaDevices.getUserMedia({{audio: true}});
+      recordingChunks = [];
+      mediaRecorder = new MediaRecorder(mediaStream);
+      mediaRecorder.addEventListener('dataavailable', event => {{ if (event.data && event.data.size) recordingChunks.push(event.data); }});
+      mediaRecorder.addEventListener('stop', async () => {{
+        const blob = new Blob(recordingChunks, {{type: mediaRecorder.mimeType || 'audio/webm'}});
+        if (mediaStream) mediaStream.getTracks().forEach(track => track.stop());
+        mediaStream = null;
+        micButton.textContent = 'Start voice input';
+        micButton.classList.remove('recording');
+        try {{ await transcribeRecording(blob); }} catch (err) {{ setState('STT error', 'error'); addBubble('system', 'STT failed: ' + String(err && err.message ? err.message : err)); }}
+      }}, {{once: true}});
+      mediaRecorder.start();
+      micButton.textContent = 'Stop and transcribe';
+      micButton.classList.add('recording');
+      setState('recording', 'error');
+    }}
+    function stopVoiceInput() {{
+      if (mediaRecorder && mediaRecorder.state !== 'inactive') mediaRecorder.stop();
+    }}
     async function uploadAttachment(file) {{
       const content = await fileToBase64(file);
       const response = await fetch('/ca/channel/files', {{
@@ -663,6 +873,42 @@ def render_web_chat_page(
       }}
     }});
     attachButton.addEventListener('click', () => fileInput.click());
+    micButton.addEventListener('click', async () => {{
+      if (mediaRecorder && mediaRecorder.state !== 'inactive') {{
+        stopVoiceInput();
+        return;
+      }}
+      try {{ await startVoiceInput(); }} catch (err) {{
+        setState('microphone error', 'error');
+        addBubble('system', 'Microphone failed: ' + String(err && err.message ? err.message : err));
+      }}
+    }});
+    speechSettingsButton.addEventListener('click', async () => {{
+      try {{ await loadSpeechConfig(); }} catch (err) {{ addBubble('system', 'Could not load speech settings: ' + String(err && err.message ? err.message : err)); }}
+      speechSettingsDialog.showModal();
+    }});
+    speechSettingsClose.addEventListener('click', () => speechSettingsDialog.close());
+    speechSettingsForm.addEventListener('submit', async event => {{
+      event.preventDefault();
+      try {{
+        await saveSpeechConfig();
+        speechSettingsDialog.close();
+        setState('speech settings saved', 'ok');
+      }} catch (err) {{
+        setState('settings error', 'error');
+        addBubble('system', 'Speech settings failed: ' + String(err && err.message ? err.message : err));
+      }}
+    }});
+    speechHealthButton.addEventListener('click', async () => {{
+      try {{
+        await saveSpeechConfig();
+        const response = await fetch('/ca/speech/health', {{headers: {{'accept': 'application/json'}}}});
+        const data = await response.json();
+        const asr = data.services && data.services.asr;
+        const tts = data.services && data.services.tts;
+        addBubble('system', `Speech health — ASR: ${{asr && asr.reachable ? 'reachable' : asr && asr.enabled ? 'unreachable' : 'disabled'}}, TTS: ${{tts && tts.reachable ? 'reachable' : tts && tts.enabled ? 'unreachable' : 'disabled'}}.`);
+      }} catch (err) {{ addBubble('system', 'Speech health check failed: ' + String(err && err.message ? err.message : err)); }}
+    }});
     fileInput.addEventListener('change', () => {{
       addSelectedFiles(fileInput.files);
       fileInput.value = '';
@@ -706,6 +952,7 @@ def render_web_chat_page(
       if (transcript.scrollTop < 48) loadOlderHistory();
     }});
     addBubble('system', `Connected to active session bridge for ${{MODEL}}. Messages are queued on channel ${{channel}} and replies stream back from /ca/channel/stream.`);
+    loadSpeechConfig().catch(() => {{ micButton.disabled = true; }});
     loadInitialHistory().finally(startChannelStream);
     prompt.focus();
   </script>

package/docs/COLAB_SPEECH.md

@@ -0,0 +1,32 @@
+# Colab speech workers
+
+Ciel Runtime can proxy its web chat and OpenAI-compatible audio API to two Colab workers over a tailnet-only Tailscale tunnel.
+
+## One-time prerequisites
+
+1. Authenticate the Colab CLI inside WSL. The installed CLI currently uses Google Application Default Credentials, so run `~/google-cloud-sdk/bin/gcloud auth application-default login` in `Ubuntu-26.04`.
+2. Create a reusable or ephemeral Tailscale auth key. In each Colab account/notebook Secret store, add `TAILSCALE_AUTHKEY` and grant notebook access.
+3. Optionally add the same `CIEL_SPEECH_API_KEY` secret to both workers. Enter that value once in Web Chat > Speech Settings; Ciel stores it server-side and never returns it to the browser.
+
+## Deploy
+
+From PowerShell at the repository root:
+
+```powershell
+.\scripts\deploy_colab_speech.ps1
+```
+
+The script creates `ciel-asr` and `ciel-tts` T4 sessions, installs Qwen3-ASR-0.6B and MOSS-TTS-Nano, starts Tailscale in userspace networking mode, publishes each localhost model server with Tailscale Serve, and saves both returned `base_url` values into Web Chat > Speech Settings automatically.
+
+Colab sessions are ephemeral. Re-run the bootstrap after a runtime reset. The workers are reachable only by devices in the same tailnet unless an administrator separately enables Tailscale Funnel.
+
+## API surface
+
+- `GET|POST /ca/speech/config`
+- `GET /ca/speech/health`
+- `POST /v1/audio/transcriptions`
+- `POST /v1/audio/translations`
+- `POST /v1/audio/speech`
+- `POST /v1/audio/speech/batch`
+- `GET|POST /v1/audio/voices`
+- `GET /ca/web/chat/api` lists chat, model, message, response, file, and speech endpoints.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oneciel-ai/ciel-runtime",
-  "version": "0.2.3",
+  "version": "0.2.4",
   "description": "Universal AI coding-agent runtime and model-routing layer for Claude, Codex, AGY, and compatible runtimes.",
   "license": "MIT",
   "author": "One Ciel LLC",
@@ -36,6 +36,9 @@
     "ciel-runtime-stop.cmd",
     "ciel-runtime-stop.ps1",
     "npm-bin/",
+    "scripts/colab/",
+    "scripts/configure_speech_workers.py",
+    "scripts/deploy_colab_speech.ps1",
     "install.sh",
     "install.ps1",
     "README.md",

package/scripts/colab/bootstrap_moss_tts.py

@@ -0,0 +1,106 @@
+"""Bootstrap MOSS-TTS-Nano with vLLM-Omni on Colab and Tailscale Serve.
+
+Required Colab Secret: TAILSCALE_AUTHKEY
+Optional Colab Secret: CIEL_SPEECH_API_KEY
+"""
+
+from __future__ import annotations
+
+import json
+import os
+from pathlib import Path
+import shutil
+import subprocess
+import sys
+import time
+import urllib.request
+
+
+HOSTNAME = os.environ.get("CIEL_TTS_HOSTNAME", "ciel-tts")
+PORT = 8091
+SOCKET = "/tmp/ciel-tts-tailscaled.sock"
+STATE = "/tmp/ciel-tts-tailscaled.state"
+LOG_DIR = Path("/content/ciel-speech-logs")
+
+
+def secret(name: str, *, required: bool = False) -> str:
+    value = str(os.environ.get(name) or "").strip()
+    if not value:
+        try:
+            from google.colab import userdata  # type: ignore
+
+            value = str(userdata.get(name) or "").strip()
+        except Exception:
+            value = ""
+    if required and not value:
+        raise RuntimeError(f"Add {name} to Colab Secrets and allow notebook access, then rerun this script.")
+    return value
+
+
+def run(*args: str, check: bool = True) -> subprocess.CompletedProcess[str]:
+    print("+", " ".join(args))
+    return subprocess.run(args, check=check, text=True, capture_output=False)
+
+
+def install_tailscale() -> None:
+    if shutil.which("tailscale"):
+        return
+    run("bash", "-lc", "curl -fsSL https://tailscale.com/install.sh | sh")
+
+
+def start_tailscale(auth_key: str) -> tuple[str, str]:
+    install_tailscale()
+    LOG_DIR.mkdir(parents=True, exist_ok=True)
+    tail_log = (LOG_DIR / "tailscale-tts.log").open("ab")
+    subprocess.Popen(
+        ["tailscaled", f"--socket={SOCKET}", f"--state={STATE}", "--tun=userspace-networking"],
+        stdout=tail_log,
+        stderr=subprocess.STDOUT,
+        start_new_session=True,
+    )
+    for _ in range(60):
+        if Path(SOCKET).exists():
+            break
+        time.sleep(1)
+    run("tailscale", f"--socket={SOCKET}", "up", f"--auth-key={auth_key}", f"--hostname={HOSTNAME}", "--accept-dns=true", "--reset")
+    status = subprocess.check_output(["tailscale", f"--socket={SOCKET}", "status", "--json"], text=True)
+    dns_name = str(json.loads(status).get("Self", {}).get("DNSName") or HOSTNAME).rstrip(".")
+    serve = run("tailscale", f"--socket={SOCKET}", "serve", "--bg", "--https=443", f"http://127.0.0.1:{PORT}", check=False)
+    if serve.returncode == 0:
+        return dns_name, f"https://{dns_name}"
+    run("tailscale", f"--socket={SOCKET}", "serve", "--bg", "--http=80", f"http://127.0.0.1:{PORT}")
+    return dns_name, f"http://{dns_name}"
+
+
+def wait_for_server(api_key: str) -> None:
+    headers = {"authorization": f"Bearer {api_key}"} if api_key else {}
+    for _ in range(240):
+        try:
+            with urllib.request.urlopen(urllib.request.Request(f"http://127.0.0.1:{PORT}/health", headers=headers), timeout=3) as response:
+                if response.status < 500:
+                    return
+        except Exception:
+            time.sleep(2)
+    raise RuntimeError("MOSS TTS did not become healthy; inspect /content/ciel-speech-logs/moss-tts.log")
+
+
+def main() -> None:
+    auth_key = secret("TAILSCALE_AUTHKEY", required=True)
+    api_key = secret("CIEL_SPEECH_API_KEY")
+    run(sys.executable, "-m", "pip", "install", "-U", "vllm-omni==0.24.0")
+    LOG_DIR.mkdir(parents=True, exist_ok=True)
+    command = [
+        "vllm", "serve", "OpenMOSS-Team/MOSS-TTS-Nano", "--omni", "--host", "127.0.0.1", "--port", str(PORT),
+        "--gpu-memory-utilization", "0.72", "--trust-remote-code", "--enforce-eager",
+    ]
+    if api_key:
+        command.extend(["--api-key", api_key])
+    server_log = (LOG_DIR / "moss-tts.log").open("ab")
+    subprocess.Popen(command, stdout=server_log, stderr=subprocess.STDOUT, start_new_session=True)
+    wait_for_server(api_key)
+    dns_name, base_url = start_tailscale(auth_key)
+    print(json.dumps({"ok": True, "role": "tts", "hostname": dns_name, "base_url": base_url, "model": "OpenMOSS-Team/MOSS-TTS-Nano", "api_key_set": bool(api_key)}, indent=2))
+
+
+if __name__ == "__main__":
+    main()

package/scripts/colab/bootstrap_qwen_asr.py

@@ -0,0 +1,106 @@
+"""Bootstrap Qwen3-ASR on a Colab T4 and publish it only to the tailnet.
+
+Required Colab Secret: TAILSCALE_AUTHKEY
+Optional Colab Secret: CIEL_SPEECH_API_KEY
+"""
+
+from __future__ import annotations
+
+import json
+import os
+from pathlib import Path
+import shutil
+import subprocess
+import sys
+import time
+import urllib.request
+
+
+HOSTNAME = os.environ.get("CIEL_ASR_HOSTNAME", "ciel-asr")
+PORT = 8000
+SOCKET = "/tmp/ciel-asr-tailscaled.sock"
+STATE = "/tmp/ciel-asr-tailscaled.state"
+LOG_DIR = Path("/content/ciel-speech-logs")
+
+
+def secret(name: str, *, required: bool = False) -> str:
+    value = str(os.environ.get(name) or "").strip()
+    if not value:
+        try:
+            from google.colab import userdata  # type: ignore
+
+            value = str(userdata.get(name) or "").strip()
+        except Exception:
+            value = ""
+    if required and not value:
+        raise RuntimeError(f"Add {name} to Colab Secrets and allow notebook access, then rerun this script.")
+    return value
+
+
+def run(*args: str, check: bool = True) -> subprocess.CompletedProcess[str]:
+    print("+", " ".join(args))
+    return subprocess.run(args, check=check, text=True, capture_output=False)
+
+
+def install_tailscale() -> None:
+    if shutil.which("tailscale"):
+        return
+    run("bash", "-lc", "curl -fsSL https://tailscale.com/install.sh | sh")
+
+
+def start_tailscale(auth_key: str) -> tuple[str, str]:
+    install_tailscale()
+    LOG_DIR.mkdir(parents=True, exist_ok=True)
+    tail_log = (LOG_DIR / "tailscale-asr.log").open("ab")
+    subprocess.Popen(
+        ["tailscaled", f"--socket={SOCKET}", f"--state={STATE}", "--tun=userspace-networking"],
+        stdout=tail_log,
+        stderr=subprocess.STDOUT,
+        start_new_session=True,
+    )
+    for _ in range(60):
+        if Path(SOCKET).exists():
+            break
+        time.sleep(1)
+    run("tailscale", f"--socket={SOCKET}", "up", f"--auth-key={auth_key}", f"--hostname={HOSTNAME}", "--accept-dns=true", "--reset")
+    status = subprocess.check_output(["tailscale", f"--socket={SOCKET}", "status", "--json"], text=True)
+    dns_name = str(json.loads(status).get("Self", {}).get("DNSName") or HOSTNAME).rstrip(".")
+    serve = run("tailscale", f"--socket={SOCKET}", "serve", "--bg", "--https=443", f"http://127.0.0.1:{PORT}", check=False)
+    if serve.returncode == 0:
+        return dns_name, f"https://{dns_name}"
+    run("tailscale", f"--socket={SOCKET}", "serve", "--bg", "--http=80", f"http://127.0.0.1:{PORT}")
+    return dns_name, f"http://{dns_name}"
+
+
+def wait_for_server(api_key: str) -> None:
+    headers = {"authorization": f"Bearer {api_key}"} if api_key else {}
+    for _ in range(180):
+        try:
+            with urllib.request.urlopen(urllib.request.Request(f"http://127.0.0.1:{PORT}/health", headers=headers), timeout=3) as response:
+                if response.status < 500:
+                    return
+        except Exception:
+            time.sleep(2)
+    raise RuntimeError("Qwen ASR did not become healthy; inspect /content/ciel-speech-logs/qwen-asr.log")
+
+
+def main() -> None:
+    auth_key = secret("TAILSCALE_AUTHKEY", required=True)
+    api_key = secret("CIEL_SPEECH_API_KEY")
+    run(sys.executable, "-m", "pip", "install", "-U", "qwen-asr[vllm]", "vllm[audio]")
+    LOG_DIR.mkdir(parents=True, exist_ok=True)
+    command = [
+        "qwen-asr-serve", "Qwen/Qwen3-ASR-0.6B", "--host", "127.0.0.1", "--port", str(PORT),
+        "--gpu-memory-utilization", "0.78", "--max-model-len", "8192",
+    ]
+    if api_key:
+        command.extend(["--api-key", api_key])
+    server_log = (LOG_DIR / "qwen-asr.log").open("ab")
+    subprocess.Popen(command, stdout=server_log, stderr=subprocess.STDOUT, start_new_session=True)
+    wait_for_server(api_key)
+    dns_name, base_url = start_tailscale(auth_key)
+    print(json.dumps({"ok": True, "role": "asr", "hostname": dns_name, "base_url": base_url, "model": "Qwen/Qwen3-ASR-0.6B", "api_key_set": bool(api_key)}, indent=2))
+
+
+if __name__ == "__main__":
+    main()

package/scripts/configure_speech_workers.py

@@ -0,0 +1,37 @@
+"""Persist deployed speech worker URLs in the active Ciel Runtime config."""
+
+from __future__ import annotations
+
+import argparse
+from pathlib import Path
+import sys
+from typing import Any
+
+sys.path.insert(0, str(Path(__file__).resolve().parents[1]))
+
+
+def configure(asr_base_url: str, tts_base_url: str) -> dict[str, Any]:
+    import ciel_runtime
+
+    config = ciel_runtime.load_config()
+    speech = config.setdefault("speech", {})
+    asr = speech.setdefault("asr", {})
+    tts = speech.setdefault("tts", {})
+    asr.update({"enabled": True, "base_url": asr_base_url.rstrip("/"), "model": "Qwen/Qwen3-ASR-0.6B"})
+    tts.update({"enabled": True, "base_url": tts_base_url.rstrip("/"), "model": "OpenMOSS-Team/MOSS-TTS-Nano"})
+    ciel_runtime.save_config(config)
+    return {"asr": asr["base_url"], "tts": tts["base_url"]}
+
+
+def main() -> int:
+    parser = argparse.ArgumentParser()
+    parser.add_argument("--asr-base-url", required=True)
+    parser.add_argument("--tts-base-url", required=True)
+    args = parser.parse_args()
+    result = configure(args.asr_base_url, args.tts_base_url)
+    print(f"Configured Ciel speech workers: ASR={result['asr']} TTS={result['tts']}")
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

package/scripts/deploy_colab_speech.ps1

@@ -0,0 +1,47 @@
+param(
+    [string]$Distribution = "Ubuntu-26.04",
+    [string]$AsrSession = "ciel-asr",
+    [string]$TtsSession = "ciel-tts"
+)
+
+$ErrorActionPreference = "Stop"
+$repo = (Resolve-Path (Join-Path $PSScriptRoot "..")).Path
+$wslRepo = (& wsl -d $Distribution -- wslpath -a ($repo -replace '\\', '/')).Trim()
+if (-not $wslRepo) { throw "Could not resolve the repository path in WSL." }
+
+Write-Host "Checking Colab CLI authentication..."
+& wsl -d $Distribution -- bash -lc "colab status >/dev/null"
+if ($LASTEXITCODE -ne 0) {
+    throw "Colab CLI is not authenticated. Configure ADC in WSL (gcloud auth application-default login), then rerun."
+}
+
+Write-Host "Creating ASR T4 session: $AsrSession"
+& wsl -d $Distribution -- bash -lc "colab new --gpu T4 --session '$AsrSession'"
+if ($LASTEXITCODE -ne 0) { throw "Could not create ASR Colab session." }
+
+Write-Host "Creating TTS T4 session: $TtsSession"
+& wsl -d $Distribution -- bash -lc "colab new --gpu T4 --session '$TtsSession'"
+if ($LASTEXITCODE -ne 0) { throw "Could not create TTS Colab session." }
+
+Write-Host "Installing Qwen3-ASR and its Tailscale service..."
+$asrOutput = (& wsl -d $Distribution -- bash -lc "colab exec --session '$AsrSession' --file '$wslRepo/scripts/colab/bootstrap_qwen_asr.py'" 2>&1 | Tee-Object -Variable asrDisplay) -join "`n"
+if ($LASTEXITCODE -ne 0) { throw "ASR bootstrap failed." }
+
+Write-Host "Installing MOSS-TTS-Nano and its Tailscale service..."
+$ttsOutput = (& wsl -d $Distribution -- bash -lc "colab exec --session '$TtsSession' --file '$wslRepo/scripts/colab/bootstrap_moss_tts.py'" 2>&1 | Tee-Object -Variable ttsDisplay) -join "`n"
+if ($LASTEXITCODE -ne 0) { throw "TTS bootstrap failed." }
+
+function Read-BootstrapResult([string]$Text, [string]$Role) {
+    $matches = [regex]::Matches($Text, '(?s)\{\s*"ok"\s*:\s*true.*?\}')
+    if ($matches.Count -eq 0) { throw "Could not find the $Role bootstrap result in Colab output." }
+    $result = $matches[$matches.Count - 1].Value | ConvertFrom-Json
+    if ($result.role -ne $Role -or -not $result.base_url) { throw "Invalid $Role bootstrap result." }
+    return $result
+}
+
+$asr = Read-BootstrapResult $asrOutput "asr"
+$tts = Read-BootstrapResult $ttsOutput "tts"
+& python (Join-Path $PSScriptRoot "configure_speech_workers.py") --asr-base-url $asr.base_url --tts-base-url $tts.base_url
+if ($LASTEXITCODE -ne 0) { throw "Workers started, but Ciel speech configuration failed." }
+
+Write-Host "Both services are running and connected to Web Chat > Speech Settings."