@oneciel-ai/ciel-runtime 0.2.3 → 0.2.5

package/ciel_runtime.py

@@ -500,6 +500,7 @@ from ciel_runtime_support.runtime_paths import (CHANNEL_COMPACT_REQUEST_PATH,  #
 from ciel_runtime_support.runtime_restart import forced_upgrade_environment
 from ciel_runtime_support.runtime_restart import running_from_npm_package as detect_running_from_npm_package
 from ciel_runtime_support.secure_json_repository import SecureJsonEffects, SecureJsonRepository
+from ciel_runtime_support.speech_http_controller import SpeechHttpController, SpeechHttpPorts
 from ciel_runtime_support.session_import import ImportSessionHttpController, ImportSessionHttpPorts, ImportSessionLimits, ImportSessionRepository, ImportSessionService, import_record_line, import_tool_text, normalize_import_source
 from ciel_runtime_support.slash_command_assets import ADVISOR_NATIVE_DISABLED_SLASH_COMMAND  # noqa: F401 - compatibility export
 from ciel_runtime_support.slash_command_assets import LEGACY_ADVISOR_CALL_MARKER  # noqa: F401 - compatibility export
@@ -1700,6 +1701,7 @@ def render_router_home_html(cfg: dict[str, Any], provider: str, pcfg: dict[str,
 def render_web_chat_html(cfg: dict[str, Any], provider: str, pcfg: dict[str, Any]) -> str: return web_ui_controller().render_web_chat(cfg, provider, pcfg)
 def handle_web_get(handler: BaseHTTPRequestHandler, path: str) -> bool: return web_ui_controller().handle_get(handler, path)
 
+def speech_http_controller() -> SpeechHttpController: return SpeechHttpController(SpeechHttpPorts(load_config, save_config, write_json, router_log))
 def parse_json_body(raw: bytes) -> dict[str, Any]:
     try:
         value = json.loads(raw.decode("utf-8") if raw else "{}")
@@ -2817,8 +2819,8 @@ def _router_server_context() -> RouterServerContext:
     http_services = RouterHttpServices(
         core=RouterHttpCore(load_config, reject_external_router_request, get_current_provider, parse_json_body, is_client_disconnect_error, router_log),
         get=RouterHttpGetEndpoints(handle_codex_mcp_split_proxy_get, handle_events_get, handle_llm_config_get, handle_channel_mcp_get, handle_web_get,
-                                   handle_chat_get, handle_plan_get, route_runtime_get),
-        post=RouterHttpPostEndpoints(handle_codex_mcp_split_proxy_request, handle_llm_config_post, handle_channel_mcp_post, handle_chat_post,
+                                   lambda handler, path: speech_http_controller().get(handler, path), handle_chat_get, handle_plan_get, route_runtime_get),
+        post=RouterHttpPostEndpoints(handle_codex_mcp_split_proxy_request, lambda handler, path, raw, content_type: speech_http_controller().post(handler, path, raw, content_type), handle_llm_config_post, handle_channel_mcp_post, handle_chat_post,
                                      handle_plan_post, route_runtime_post),
         presentation=RouterHttpPresentation(render_router_home_html, router_health_payload, write_text_response, write_json, list_model_objects_for_request,
                                             resolve_requested_model, model_object),

package/ciel_runtime_support/config_repository.py

@@ -26,6 +26,38 @@ def build_default_config(provider_defaults: dict[str, Any]) -> dict[str, Any]:
             "port": 0,
             "tailscale_https": False,
         },
+        "speech": {
+            "asr": {
+                "enabled": False,
+                "base_url": "http://ciel-asr:8000",
+                "endpoint": "/v1/audio/transcriptions",
+                "model": "Qwen/Qwen3-ASR-0.6B",
+                "language": "auto",
+                "api_key": "",
+                "timeout_seconds": 300,
+            },
+            "tts": {
+                "enabled": False,
+                "base_url": "http://ciel-tts:8091",
+                "endpoint": "/v1/audio/speech",
+                "voices_endpoint": "/v1/audio/voices",
+                "model": "OpenMOSS-Team/MOSS-TTS-Nano",
+                "voice": "default",
+                "language": "ko",
+                "ref_audio": "",
+                "ref_text": "",
+                "response_format": "wav",
+                "speed": 1.0,
+                "auto_speak": False,
+                "api_key": "",
+                "timeout_seconds": 300,
+            },
+            "tailscale": {
+                "enabled": True,
+                "asr_hostname": "ciel-asr",
+                "tts_hostname": "ciel-tts",
+            },
+        },
         "claude_code": {
             "compat_prompt_for_non_anthropic": True,
             "channels": [],

package/ciel_runtime_support/router_http.py

@@ -90,6 +90,7 @@ class RouterHttpGetEndpoints:
     llm_config: Callable[[Any, str], bool]
     channel_mcp: Callable[[Any, str], bool]
     web: Callable[[Any, str], bool]
+    speech: Callable[[Any, str], bool]
     chat: Callable[[Any, str], bool]
     plan: Callable[[Any, str], bool]
     runtime: Callable[..., bool]
@@ -98,6 +99,7 @@ class RouterHttpGetEndpoints:
 @dataclass(frozen=True, slots=True)
 class RouterHttpPostEndpoints:
     codex_mcp_split: Callable[[Any, str, bytes, str], bool]
+    speech: Callable[[Any, str, bytes, str], bool]
     llm_config: Callable[[Any, str, dict[str, Any]], bool]
     channel_mcp: Callable[[Any, str, dict[str, Any]], bool]
     chat: Callable[[Any, str, dict[str, Any]], bool]
@@ -636,6 +638,8 @@ class RouterHttpHandler(BaseHTTPRequestHandler):
             return
         if endpoints.web(self, path):
             return
+        if endpoints.speech(self, path):
+            return
         if endpoints.chat(self, path) or endpoints.plan(self, path):
             return
         provider, pcfg = services.core.get_current_provider(cfg)
@@ -676,6 +680,8 @@ class RouterHttpHandler(BaseHTTPRequestHandler):
             endpoints = services.post
             if endpoints.codex_mcp_split(self, path, raw, "POST"):
                 return
+            if endpoints.speech(self, path, raw, str(self.headers.get("content-type") or "application/json")):
+                return
             body = services.core.parse_json_body(raw)
             if endpoints.llm_config(self, path, body):
                 return

package/ciel_runtime_support/router_server_context.py

@@ -49,6 +49,8 @@ class RouterServerContext:
             "provider": provider,
             "model": self.health.current_alias(cfg),
             "web_chat": "/ca/web/chat",
+            "web_chat_api": "/ca/web/chat/api",
+            "speech": "/ca/speech/health",
             "chat": "/ca/chat/health",
             "plan": "/ca/plan/artifacts",
             "events": "/ca/events",

package/ciel_runtime_support/runtime_constants.py

@@ -93,7 +93,7 @@ OFFICIAL_CHANNEL_PLUGINS = {
 }
 
 APP_NAME = "Ciel Runtime"
-VERSION = "0.2.3"
+VERSION = "0.2.5"
 CREDITS = "Credits: One Ciel LLC"
 PRELAUNCH_CANCEL = 10
 PRELAUNCH_LAUNCH_CODEX = 11

package/ciel_runtime_support/speech_http_controller.py

@@ -0,0 +1,358 @@
+"""Speech configuration and OpenAI-compatible ASR/TTS proxy endpoints."""
+
+from __future__ import annotations
+
+import base64
+import json
+import secrets
+import urllib.error
+import urllib.parse
+import urllib.request
+from dataclasses import dataclass
+from http.server import BaseHTTPRequestHandler
+from typing import Any, Callable
+
+
+SpeechConfig = dict[str, Any]
+
+
+@dataclass(frozen=True, slots=True)
+class SpeechHttpPorts:
+    load_config: Callable[[], dict[str, Any]]
+    save_config: Callable[[dict[str, Any]], None]
+    write_json: Callable[..., None]
+    log: Callable[[str, str], None]
+    urlopen: Callable[..., Any] = urllib.request.urlopen
+
+
+@dataclass(frozen=True, slots=True)
+class SpeechHttpController:
+    ports: SpeechHttpPorts
+
+    def get(self, handler: BaseHTTPRequestHandler, path: str) -> bool:
+        if path == "/ca/speech/config":
+            self.ports.write_json(handler, self.public_config())
+            return True
+        if path == "/ca/speech/health":
+            self.ports.write_json(handler, self.health_payload())
+            return True
+        if path == "/ca/web/chat/api":
+            self.ports.write_json(handler, self.discovery_payload())
+            return True
+        if path == "/v1/audio/voices":
+            return self._proxy_get(handler, "tts", "voices_endpoint")
+        return False
+
+    def post(
+        self,
+        handler: BaseHTTPRequestHandler,
+        path: str,
+        raw: bytes,
+        content_type: str,
+    ) -> bool:
+        if path == "/ca/speech/config":
+            return self._save_public_config(handler, raw)
+        if path in {"/v1/audio/transcriptions", "/v1/audio/translations"}:
+            return self._proxy_asr(handler, raw, content_type)
+        if path in {"/v1/audio/speech", "/v1/audio/speech/batch"}:
+            return self._proxy_tts(handler, raw, content_type, batch=path.endswith("/batch"))
+        if path == "/v1/audio/voices":
+            return self._proxy_raw(handler, "tts", "voices_endpoint", raw, content_type)
+        return False
+
+    def public_config(self) -> dict[str, Any]:
+        speech = self._speech_config()
+        public: dict[str, Any] = {"ok": True}
+        for name in ("asr", "tts"):
+            source = speech.get(name) if isinstance(speech.get(name), dict) else {}
+            item = {key: value for key, value in source.items() if key not in {"api_key", "ref_audio"}}
+            item["api_key_set"] = bool(str(source.get("api_key") or "").strip())
+            if name == "tts":
+                item["ref_audio_set"] = bool(str(source.get("ref_audio") or "").strip())
+            public[name] = item
+        tailscale = speech.get("tailscale")
+        public["tailscale"] = dict(tailscale) if isinstance(tailscale, dict) else {}
+        public["endpoints"] = self.discovery_payload()["endpoints"]
+        return public
+
+    def discovery_payload(self) -> dict[str, Any]:
+        return {
+            "ok": True,
+            "web_chat": "/ca/web/chat",
+            "endpoints": {
+                "chat_health": "GET /ca/channel/health",
+                "chat_messages": "GET|POST /ca/channel/messages",
+                "chat_wait": "GET /ca/channel/wait",
+                "chat_stream": "GET /ca/channel/stream",
+                "chat_files": "POST /ca/channel/files",
+                "speech_config": "GET|POST /ca/speech/config",
+                "speech_health": "GET /ca/speech/health",
+                "asr": "POST /v1/audio/transcriptions",
+                "asr_translate": "POST /v1/audio/translations",
+                "tts": "POST /v1/audio/speech",
+                "tts_batch": "POST /v1/audio/speech/batch",
+                "tts_voices": "GET|POST /v1/audio/voices",
+                "models": "GET /v1/models",
+                "responses": "POST /v1/responses",
+                "messages": "POST /v1/messages",
+            },
+        }
+
+    def health_payload(self) -> dict[str, Any]:
+        services = {name: self._probe(name) for name in ("asr", "tts")}
+        return {"ok": all(not item["enabled"] or item["reachable"] for item in services.values()), "services": services}
+
+    def _speech_config(self) -> SpeechConfig:
+        speech = self.ports.load_config().get("speech")
+        return speech if isinstance(speech, dict) else {}
+
+    def _service_config(self, name: str) -> SpeechConfig:
+        service = self._speech_config().get(name)
+        return service if isinstance(service, dict) else {}
+
+    def _save_public_config(self, handler: BaseHTTPRequestHandler, raw: bytes) -> bool:
+        try:
+            update = json.loads(raw.decode("utf-8") if raw else "{}")
+            if not isinstance(update, dict):
+                raise ValueError("configuration body must be a JSON object")
+            config = self.ports.load_config()
+            speech = config.setdefault("speech", {})
+            if not isinstance(speech, dict):
+                speech = {}
+                config["speech"] = speech
+            for name in ("asr", "tts"):
+                incoming = update.get(name)
+                if not isinstance(incoming, dict):
+                    continue
+                current = speech.setdefault(name, {})
+                if not isinstance(current, dict):
+                    current = {}
+                    speech[name] = current
+                for key, value in incoming.items():
+                    if key in {"api_key_set", "clear_api_key", "ref_audio_set", "clear_ref_audio"}:
+                        continue
+                    if key in {"api_key", "ref_audio"} and not str(value or "").strip():
+                        continue
+                    current[key] = self._validated_value(name, key, value)
+                if incoming.get("clear_api_key") is True:
+                    current["api_key"] = ""
+                if name == "tts" and incoming.get("clear_ref_audio") is True:
+                    current["ref_audio"] = ""
+            tailscale = update.get("tailscale")
+            if isinstance(tailscale, dict):
+                current_tailscale = speech.setdefault("tailscale", {})
+                if not isinstance(current_tailscale, dict):
+                    current_tailscale = {}
+                    speech["tailscale"] = current_tailscale
+                for key in ("enabled", "asr_hostname", "tts_hostname"):
+                    if key in tailscale:
+                        current_tailscale[key] = tailscale[key]
+            self.ports.save_config(config)
+            self.ports.write_json(handler, self.public_config())
+        except (UnicodeError, ValueError, TypeError) as exc:
+            self.ports.write_json(handler, {"ok": False, "error": str(exc)}, 400)
+        return True
+
+    @staticmethod
+    def _validated_value(service: str, key: str, value: Any) -> Any:
+        allowed = {
+            "asr": {"enabled", "base_url", "endpoint", "model", "language", "api_key", "timeout_seconds"},
+            "tts": {"enabled", "base_url", "endpoint", "voices_endpoint", "model", "voice", "language", "ref_audio", "ref_text", "response_format", "speed", "auto_speak", "api_key", "timeout_seconds"},
+        }
+        if key not in allowed[service]:
+            raise ValueError(f"unsupported {service} setting: {key}")
+        if key in {"enabled", "auto_speak"}:
+            return bool(value)
+        if key == "timeout_seconds":
+            return max(1, min(3600, int(value)))
+        if key == "speed":
+            return max(0.25, min(4.0, float(value)))
+        text = str(value or "").strip()
+        if key == "ref_audio":
+            if len(text) > 14_000_000:
+                raise ValueError("TTS reference audio must be 10 MB or smaller")
+            if text.startswith("data:audio/") and ";base64," in text:
+                try:
+                    audio = base64.b64decode(text.split(",", 1)[1], validate=True)
+                except (ValueError, TypeError) as exc:
+                    raise ValueError("invalid base64 TTS reference audio") from exc
+                if not audio or len(audio) > 10 * 1024 * 1024:
+                    raise ValueError("TTS reference audio must be between 1 byte and 10 MB")
+                return text
+            parsed_ref = urllib.parse.urlparse(text)
+            if parsed_ref.scheme not in {"http", "https"} or not parsed_ref.netloc:
+                raise ValueError("TTS ref_audio must be an audio data URL or HTTP(S) URL")
+            return text
+        if key == "base_url":
+            parsed = urllib.parse.urlparse(text)
+            if parsed.scheme not in {"http", "https"} or not parsed.netloc:
+                raise ValueError(f"invalid {service} base_url")
+            return text.rstrip("/")
+        if key in {"endpoint", "voices_endpoint"} and not text.startswith("/"):
+            raise ValueError(f"{service} {key} must begin with /")
+        return text
+
+    def _probe(self, name: str) -> dict[str, Any]:
+        config = self._service_config(name)
+        enabled = bool(config.get("enabled"))
+        result: dict[str, Any] = {
+            "enabled": enabled,
+            "configured": bool(str(config.get("base_url") or "").strip()),
+            "reachable": False,
+        }
+        if not enabled:
+            return result
+        try:
+            request = urllib.request.Request(self._url(config, "/health"), headers=self._headers(config, "application/json"))
+            with self.ports.urlopen(request, timeout=min(10.0, self._timeout(config))) as response:
+                result["status"] = int(getattr(response, "status", 200))
+                result["reachable"] = result["status"] < 500
+        except Exception as exc:
+            result["error"] = f"{type(exc).__name__}: {exc}"
+        return result
+
+    def _proxy_get(self, handler: BaseHTTPRequestHandler, service: str, endpoint_key: str) -> bool:
+        config = self._service_config(service)
+        if not self._require_enabled(handler, service, config):
+            return True
+        request = urllib.request.Request(self._url(config, str(config.get(endpoint_key) or "")), headers=self._headers(config, "application/json"))
+        return self._open_and_write(handler, service, config, request)
+
+    def _proxy_asr(self, handler: BaseHTTPRequestHandler, raw: bytes, content_type: str) -> bool:
+        config = self._service_config("asr")
+        if not self._require_enabled(handler, "asr", config):
+            return True
+        if "application/json" in content_type.lower():
+            try:
+                body = json.loads(raw.decode("utf-8"))
+                if not isinstance(body, dict):
+                    raise ValueError("request must be a JSON object")
+                audio = base64.b64decode(str(body.get("audio_base64") or ""), validate=True)
+                if not audio:
+                    raise ValueError("audio_base64 is required")
+                fields = {
+                    "model": str(body.get("model") or config.get("model") or ""),
+                    "language": str(body.get("language") or config.get("language") or ""),
+                    "response_format": str(body.get("response_format") or "json"),
+                }
+                if fields["language"].lower() == "auto":
+                    fields.pop("language")
+                raw, content_type = self._multipart(fields, "file", str(body.get("filename") or "recording.wav"), str(body.get("content_type") or "audio/wav"), audio)
+            except (ValueError, TypeError, UnicodeError) as exc:
+                self.ports.write_json(handler, {"error": {"type": "invalid_request_error", "message": str(exc)}}, 400)
+                return True
+        return self._proxy_raw(handler, "asr", "endpoint", raw, content_type)
+
+    def _proxy_tts(self, handler: BaseHTTPRequestHandler, raw: bytes, content_type: str, *, batch: bool) -> bool:
+        config = self._service_config("tts")
+        if not self._require_enabled(handler, "tts", config):
+            return True
+        if "application/json" in content_type.lower():
+            try:
+                body = json.loads(raw.decode("utf-8") if raw else "{}")
+                if not isinstance(body, dict):
+                    raise ValueError("request must be a JSON object")
+                if not batch:
+                    body.setdefault("model", str(config.get("model") or ""))
+                    body.setdefault("voice", str(config.get("voice") or "default"))
+                    body.setdefault("language", str(config.get("language") or "Auto"))
+                    if str(config.get("ref_audio") or "").strip():
+                        body.setdefault("ref_audio", str(config["ref_audio"]))
+                    if str(config.get("ref_text") or "").strip():
+                        body.setdefault("ref_text", str(config["ref_text"]))
+                    body.setdefault("response_format", str(config.get("response_format") or "wav"))
+                    body.setdefault("speed", float(config.get("speed") or 1.0))
+                raw = json.dumps(body, ensure_ascii=False).encode("utf-8")
+            except (ValueError, TypeError, UnicodeError) as exc:
+                self.ports.write_json(handler, {"error": {"type": "invalid_request_error", "message": str(exc)}}, 400)
+                return True
+        endpoint = str(config.get("endpoint") or "/v1/audio/speech") + ("/batch" if batch else "")
+        return self._proxy_bytes(handler, "tts", config, endpoint, raw, content_type)
+
+    def _proxy_raw(self, handler: BaseHTTPRequestHandler, service: str, endpoint_key: str, raw: bytes, content_type: str) -> bool:
+        config = self._service_config(service)
+        if not self._require_enabled(handler, service, config):
+            return True
+        return self._proxy_bytes(handler, service, config, str(config.get(endpoint_key) or ""), raw, content_type)
+
+    def _proxy_bytes(self, handler: BaseHTTPRequestHandler, service: str, config: SpeechConfig, endpoint: str, raw: bytes, content_type: str) -> bool:
+        request = urllib.request.Request(
+            self._url(config, endpoint),
+            data=raw,
+            headers=self._headers(config, content_type or "application/octet-stream"),
+            method="POST",
+        )
+        return self._open_and_write(handler, service, config, request)
+
+    def _open_and_write(self, handler: BaseHTTPRequestHandler, service: str, config: SpeechConfig, request: urllib.request.Request) -> bool:
+        try:
+            with self.ports.urlopen(request, timeout=self._timeout(config)) as response:
+                self._write_bytes(handler, response.read(), int(getattr(response, "status", 200)), str(response.headers.get("content-type") or "application/octet-stream"))
+        except urllib.error.HTTPError as exc:
+            self._write_bytes(handler, exc.read(), int(exc.code), str(exc.headers.get("content-type") or "application/json"))
+        except Exception as exc:
+            self.ports.log("ERROR", f"speech_proxy_failed service={service} error={type(exc).__name__}: {exc}")
+            self.ports.write_json(handler, {"error": {"type": "upstream_error", "message": f"{service.upper()} upstream unavailable: {exc}"}}, 502)
+        return True
+
+    @staticmethod
+    def _require_enabled(handler: BaseHTTPRequestHandler, service: str, config: SpeechConfig) -> bool:
+        if bool(config.get("enabled")) and str(config.get("base_url") or "").strip():
+            return True
+        body = json.dumps({"error": {"type": "service_disabled", "message": f"{service.upper()} is not configured or enabled"}}).encode()
+        handler.send_response(503)
+        handler.send_header("content-type", "application/json")
+        handler.send_header("content-length", str(len(body)))
+        handler.end_headers()
+        handler.wfile.write(body)
+        return False
+
+    @staticmethod
+    def _write_bytes(handler: BaseHTTPRequestHandler, data: bytes, status: int, content_type: str) -> None:
+        handler.send_response(status)
+        handler.send_header("content-type", content_type)
+        handler.send_header("content-length", str(len(data)))
+        handler.send_header("cache-control", "no-store")
+        handler.end_headers()
+        handler.wfile.write(data)
+
+    @staticmethod
+    def _headers(config: SpeechConfig, content_type: str) -> dict[str, str]:
+        headers = {"accept": "*/*", "content-type": content_type}
+        api_key = str(config.get("api_key") or "").strip()
+        if api_key:
+            headers["authorization"] = f"Bearer {api_key}"
+        return headers
+
+    @staticmethod
+    def _url(config: SpeechConfig, endpoint: str) -> str:
+        return str(config.get("base_url") or "").rstrip("/") + "/" + endpoint.lstrip("/")
+
+    @staticmethod
+    def _timeout(config: SpeechConfig) -> float:
+        try:
+            return max(1.0, min(3600.0, float(config.get("timeout_seconds") or 300)))
+        except (TypeError, ValueError):
+            return 300.0
+
+    @staticmethod
+    def _multipart(fields: dict[str, str], file_field: str, filename: str, mime: str, data: bytes) -> tuple[bytes, str]:
+        boundary = "ciel-" + secrets.token_hex(16)
+        chunks: list[bytes] = []
+        for name, value in fields.items():
+            chunks.extend([
+                f"--{boundary}\r\n".encode(),
+                f'Content-Disposition: form-data; name="{name}"\r\n\r\n'.encode(),
+                str(value).encode("utf-8"), b"\r\n",
+            ])
+        safe_filename = filename.replace('"', "_").replace("\r", "_").replace("\n", "_")
+        chunks.extend([
+            f"--{boundary}\r\n".encode(),
+            f'Content-Disposition: form-data; name="{file_field}"; filename="{safe_filename}"\r\n'.encode(),
+            f"Content-Type: {mime}\r\n\r\n".encode(), data, b"\r\n",
+            f"--{boundary}--\r\n".encode(),
+        ])
+        return b"".join(chunks), f"multipart/form-data; boundary={boundary}"
+
+
+__all__ = ["SpeechHttpController", "SpeechHttpPorts"]

package/ciel_runtime_support/web_ui.py

@@ -112,6 +112,22 @@ def render_web_chat_page(
     }}
     .attach-button:hover {{ border-color: var(--accent); }}
     .attach-button:disabled {{ opacity: .55; cursor: not-allowed; }}
+    .recording {{ border-color: #ef4444 !important; color: #fecaca !important; }}
+    .message-actions {{ display: flex; align-items: flex-start; padding: 4px; }}
+    .message-actions button {{ border: 1px solid var(--line); border-radius: 999px; background: #0b111b; color: var(--muted); cursor: pointer; padding: 4px 8px; }}
+    dialog {{ width: min(720px, calc(100vw - 28px)); max-height: calc(100vh - 28px); overflow: auto; border: 1px solid var(--line); border-radius: 10px; background: var(--panel); color: var(--text); padding: 0; }}
+    dialog::backdrop {{ background: rgba(0,0,0,.72); }}
+    .settings-head {{ position: sticky; top: 0; display: flex; justify-content: space-between; align-items: center; gap: 12px; padding: 14px 16px; border-bottom: 1px solid var(--line); background: var(--panel); }}
+    .settings-body {{ padding: 16px; display: grid; gap: 16px; }}
+    .settings-section {{ border: 1px solid var(--line); border-radius: 8px; padding: 12px; display: grid; gap: 10px; }}
+    .settings-section h3 {{ margin: 0; font-size: 14px; }}
+    .settings-grid {{ display: grid; grid-template-columns: repeat(2, minmax(0, 1fr)); gap: 10px; }}
+    .settings-grid label {{ display: grid; gap: 5px; color: var(--muted); font-size: 12px; }}
+    .settings-grid label.wide {{ grid-column: 1 / -1; }}
+    .settings-grid input, .settings-grid select {{ width: 100%; border: 1px solid var(--line); border-radius: 6px; background: #080d14; color: var(--text); padding: 8px; }}
+    .check {{ display: flex !important; grid-auto-flow: column; justify-content: start; align-items: center; gap: 7px !important; }}
+    .check input {{ width: auto; }}
+    .settings-actions {{ display: flex; justify-content: flex-end; gap: 8px; }}
     #fileInput {{ display: none; }}
     .attachment-tray {{ display: flex; gap: 7px; flex-wrap: wrap; min-height: 0; }}
     .attachment-chip {{
@@ -135,6 +151,7 @@ def render_web_chat_page(
       .bubble {{ max-width: 94%; }}
       header {{ align-items: flex-start; flex-direction: column; }}
       .pill {{ white-space: normal; }}
+      .settings-grid {{ grid-template-columns: 1fr; }}
     }}
   </style>
 </head>
@@ -154,6 +171,8 @@ def render_web_chat_page(
         <a href="/">Router Home</a>
         <a href="/ca/events">Events</a>
         <a href="/health">Health JSON</a>
+        <a href="/ca/web/chat/api">Chat API JSON</a>
+        <button class="ghost" id="speechSettingsButton" type="button">Speech Settings</button>
         <button class="ghost" id="shareButton" type="button">Copy Chat Link</button>
         <button class="ghost" id="clearButton" type="button">Clear Chat</button>
       </div>
@@ -173,6 +192,7 @@ def render_web_chat_page(
           <button class="primary" id="sendButton" type="submit">Send</button>
         </div>
         <div class="composer-actions">
+          <button class="attach-button" id="micButton" type="button">Start voice input</button>
           <button class="attach-button" id="attachButton" type="button">Attach files</button>
           <input id="fileInput" type="file" multiple>
           <div class="attachment-tray" id="attachmentTray" aria-live="polite"></div>
@@ -181,6 +201,48 @@ def render_web_chat_page(
       </form>
     </main>
   </div>
+  <dialog id="speechSettingsDialog">
+    <form id="speechSettingsForm">
+      <div class="settings-head"><strong>Speech Settings</strong><button class="ghost" id="speechSettingsClose" type="button">Close</button></div>
+      <div class="settings-body">
+        <section class="settings-section">
+          <h3>STT / Qwen ASR</h3>
+          <div class="settings-grid">
+            <label class="check"><input id="asrEnabled" type="checkbox"> Enable STT</label>
+            <label>Language<input id="asrLanguage" placeholder="auto"></label>
+            <label class="wide">Tailscale base URL<input id="asrBaseUrl" placeholder="http://ciel-asr:8000"></label>
+            <label class="wide">Model<input id="asrModel" placeholder="Qwen/Qwen3-ASR-0.6B"></label>
+            <label class="wide">Remote bearer token<input id="asrApiKey" type="password" autocomplete="new-password" placeholder="Leave blank to keep current token"></label>
+          </div>
+        </section>
+        <section class="settings-section">
+          <h3>TTS / MOSS-TTS-Nano</h3>
+          <div class="settings-grid">
+            <label class="check"><input id="ttsEnabled" type="checkbox"> Enable TTS</label>
+            <label class="check"><input id="ttsAutoSpeak" type="checkbox"> Speak replies automatically</label>
+            <label class="wide">Tailscale base URL<input id="ttsBaseUrl" placeholder="http://ciel-tts:8091"></label>
+            <label>Voice<input id="ttsVoice" placeholder="default"></label>
+            <label>Language<input id="ttsLanguage" placeholder="ko"></label>
+            <label class="wide">Model<input id="ttsModel" placeholder="OpenMOSS-Team/MOSS-TTS-Nano"></label>
+            <label class="wide">Reference voice (required by MOSS-TTS-Nano)<input id="ttsReferenceAudio" type="file" accept="audio/*"><span class="hint" id="ttsReferenceAudioStatus">No reference voice configured</span></label>
+            <label class="wide">Reference transcript (optional)<input id="ttsReferenceText" placeholder="Transcript of the reference clip"></label>
+            <label class="check wide"><input id="ttsClearReferenceAudio" type="checkbox"> Remove the saved reference voice</label>
+            <label class="wide">Remote bearer token<input id="ttsApiKey" type="password" autocomplete="new-password" placeholder="Leave blank to keep current token"></label>
+          </div>
+        </section>
+        <section class="settings-section">
+          <h3>Tailscale tunnel</h3>
+          <div class="settings-grid">
+            <label class="check"><input id="tailscaleEnabled" type="checkbox"> Use tailnet-only addresses</label>
+            <label>ASR hostname<input id="tailscaleAsrHostname" placeholder="ciel-asr"></label>
+            <label>TTS hostname<input id="tailscaleTtsHostname" placeholder="ciel-tts"></label>
+          </div>
+          <div class="hint">The browser calls Ciel locally. Only the Ciel router connects to these Tailscale services.</div>
+        </section>
+        <div class="settings-actions"><button class="ghost" id="speechHealthButton" type="button">Test connections</button><button class="primary" type="submit">Save</button></div>
+      </div>
+    </form>
+  </dialog>
   <script>
     const MODEL = {json.dumps(model)};
     const transcript = document.getElementById('transcript');
@@ -188,10 +250,16 @@ def render_web_chat_page(
     const prompt = document.getElementById('prompt');
     const sendButton = document.getElementById('sendButton');
     const attachButton = document.getElementById('attachButton');
+    const micButton = document.getElementById('micButton');
     const fileInput = document.getElementById('fileInput');
     const attachmentTray = document.getElementById('attachmentTray');
     const shareButton = document.getElementById('shareButton');
     const clearButton = document.getElementById('clearButton');
+    const speechSettingsButton = document.getElementById('speechSettingsButton');
+    const speechSettingsDialog = document.getElementById('speechSettingsDialog');
+    const speechSettingsForm = document.getElementById('speechSettingsForm');
+    const speechSettingsClose = document.getElementById('speechSettingsClose');
+    const speechHealthButton = document.getElementById('speechHealthButton');
     const statePill = document.getElementById('statePill');
     const SESSION_KEY = 'ciel-runtime-web-chat-session';
     const LAST_ID_KEY = 'ciel-runtime-web-chat-last-id';
@@ -218,6 +286,11 @@ def render_web_chat_page(
     let lastId = Number(localStorage.getItem(scopedLastIdKey) || '0') || 0;
     let eventSource = null;
     let selectedFiles = [];
+    let speechConfig = {{asr: {{enabled: false}}, tts: {{enabled: false, auto_speak: false}}}};
+    let mediaRecorder = null;
+    let mediaStream = null;
+    let recordingChunks = [];
+    let pendingTtsReferenceAudio = '';
     function setState(text, cls = '') {{
       statePill.textContent = text;
       statePill.className = 'pill ' + cls;
@@ -401,6 +474,16 @@ def render_web_chat_page(
         bubble.innerHTML = renderMarkdown(text);
       }}
       row.appendChild(bubble);
+      if (role === 'assistant') {{
+        const actions = document.createElement('div');
+        actions.className = 'message-actions';
+        const speak = document.createElement('button');
+        speak.type = 'button';
+        speak.textContent = 'Speak';
+        speak.addEventListener('click', () => speakText(text));
+        actions.appendChild(speak);
+        row.appendChild(actions);
+      }}
       if (mode === 'prepend') {{
         transcript.insertBefore(row, transcript.firstChild);
       }} else {{
@@ -424,7 +507,10 @@ def render_web_chat_page(
       const text = message.message || '';
       if (!text.trim()) return;
       addBubble(roleForMessage(message), text, mode, message.id);
-      if (mode !== 'prepend' && message.sender_id !== 'web-user') setState('reply received', 'ok');
+      if (mode !== 'prepend' && message.sender_id !== 'web-user') {{
+        setState('reply received', 'ok');
+        if (speechConfig.tts && speechConfig.tts.enabled && speechConfig.tts.auto_speak) speakText(text);
+      }}
     }}
     function formatBytes(bytes) {{
       const value = Number(bytes || 0);
@@ -471,6 +557,150 @@ def render_web_chat_page(
         reader.readAsDataURL(file);
       }});
     }}
+    function fileToDataUrl(file) {{
+      return new Promise((resolve, reject) => {{
+        const reader = new FileReader();
+        reader.onload = () => resolve(String(reader.result || ''));
+        reader.onerror = () => reject(reader.error || new Error('Could not read file'));
+        reader.readAsDataURL(file);
+      }});
+    }}
+    function setSpeechForm(config) {{
+      const asr = config.asr || {{}};
+      const tts = config.tts || {{}};
+      const tailscale = config.tailscale || {{}};
+      document.getElementById('asrEnabled').checked = Boolean(asr.enabled);
+      document.getElementById('asrBaseUrl').value = asr.base_url || '';
+      document.getElementById('asrModel').value = asr.model || '';
+      document.getElementById('asrLanguage').value = asr.language || 'auto';
+      document.getElementById('asrApiKey').value = '';
+      document.getElementById('asrApiKey').placeholder = asr.api_key_set ? 'Token is set; leave blank to keep it' : 'Optional remote bearer token';
+      document.getElementById('ttsEnabled').checked = Boolean(tts.enabled);
+      document.getElementById('ttsAutoSpeak').checked = Boolean(tts.auto_speak);
+      document.getElementById('ttsBaseUrl').value = tts.base_url || '';
+      document.getElementById('ttsModel').value = tts.model || '';
+      document.getElementById('ttsVoice').value = tts.voice || 'default';
+      document.getElementById('ttsLanguage').value = tts.language || 'ko';
+      document.getElementById('ttsReferenceText').value = tts.ref_text || '';
+      document.getElementById('ttsReferenceAudioStatus').textContent = tts.ref_audio_set ? 'Reference voice saved securely on this Ciel router' : 'No reference voice configured';
+      document.getElementById('ttsClearReferenceAudio').checked = false;
+      document.getElementById('ttsReferenceAudio').value = '';
+      pendingTtsReferenceAudio = '';
+      document.getElementById('ttsApiKey').value = '';
+      document.getElementById('ttsApiKey').placeholder = tts.api_key_set ? 'Token is set; leave blank to keep it' : 'Optional remote bearer token';
+      document.getElementById('tailscaleEnabled').checked = tailscale.enabled !== false;
+      document.getElementById('tailscaleAsrHostname').value = tailscale.asr_hostname || 'ciel-asr';
+      document.getElementById('tailscaleTtsHostname').value = tailscale.tts_hostname || 'ciel-tts';
+      micButton.disabled = !asr.enabled;
+      micButton.title = asr.enabled ? 'Record speech and transcribe it' : 'Enable STT in Speech Settings first';
+    }}
+    async function loadSpeechConfig() {{
+      const response = await fetch('/ca/speech/config', {{headers: {{'accept': 'application/json'}}}});
+      const data = await response.json();
+      if (!response.ok || !data.ok) throw new Error(data.error || `HTTP ${{response.status}}`);
+      speechConfig = data;
+      setSpeechForm(data);
+      return data;
+    }}
+    async function saveSpeechConfig() {{
+      const payload = {{
+        asr: {{
+          enabled: document.getElementById('asrEnabled').checked,
+          base_url: document.getElementById('asrBaseUrl').value,
+          model: document.getElementById('asrModel').value,
+          language: document.getElementById('asrLanguage').value,
+          api_key: document.getElementById('asrApiKey').value,
+        }},
+        tts: {{
+          enabled: document.getElementById('ttsEnabled').checked,
+          auto_speak: document.getElementById('ttsAutoSpeak').checked,
+          base_url: document.getElementById('ttsBaseUrl').value,
+          model: document.getElementById('ttsModel').value,
+          voice: document.getElementById('ttsVoice').value,
+          language: document.getElementById('ttsLanguage').value,
+          ref_audio: pendingTtsReferenceAudio,
+          ref_text: document.getElementById('ttsReferenceText').value,
+          clear_ref_audio: document.getElementById('ttsClearReferenceAudio').checked,
+          api_key: document.getElementById('ttsApiKey').value,
+        }},
+        tailscale: {{
+          enabled: document.getElementById('tailscaleEnabled').checked,
+          asr_hostname: document.getElementById('tailscaleAsrHostname').value,
+          tts_hostname: document.getElementById('tailscaleTtsHostname').value,
+        }},
+      }};
+      const response = await fetch('/ca/speech/config', {{method: 'POST', headers: {{'content-type': 'application/json', 'accept': 'application/json'}}, body: JSON.stringify(payload)}});
+      const data = await response.json();
+      if (!response.ok || !data.ok) throw new Error(data.error || `HTTP ${{response.status}}`);
+      speechConfig = data;
+      setSpeechForm(data);
+      return data;
+    }}
+    async function speakText(text) {{
+      if (!speechConfig.tts || !speechConfig.tts.enabled) {{
+        setState('TTS disabled', 'error');
+        return;
+      }}
+      try {{
+        setState('generating speech');
+        const response = await fetch('/v1/audio/speech', {{
+          method: 'POST',
+          headers: {{'content-type': 'application/json'}},
+          body: JSON.stringify({{input: String(text || ''), model: speechConfig.tts.model, voice: speechConfig.tts.voice, language: speechConfig.tts.language, response_format: speechConfig.tts.response_format || 'wav'}})
+        }});
+        if (!response.ok) throw new Error(await response.text() || `HTTP ${{response.status}}`);
+        const blob = await response.blob();
+        const url = URL.createObjectURL(blob);
+        const audio = new Audio(url);
+        audio.addEventListener('ended', () => URL.revokeObjectURL(url), {{once: true}});
+        audio.addEventListener('error', () => URL.revokeObjectURL(url), {{once: true}});
+        await audio.play();
+        setState('speaking', 'ok');
+      }} catch (err) {{
+        setState('TTS error', 'error');
+        addBubble('system', 'TTS failed: ' + String(err && err.message ? err.message : err));
+      }}
+    }}
+    async function transcribeRecording(blob) {{
+      setState('transcribing');
+      const audio_base64 = await fileToBase64(blob);
+      const response = await fetch('/v1/audio/transcriptions', {{
+        method: 'POST',
+        headers: {{'content-type': 'application/json', 'accept': 'application/json'}},
+        body: JSON.stringify({{audio_base64, filename: 'web-chat-recording.webm', content_type: blob.type || 'audio/webm', model: speechConfig.asr.model, language: speechConfig.asr.language}})
+      }});
+      const text = await response.text();
+      let data = {{}};
+      try {{ data = text ? JSON.parse(text) : {{}}; }} catch {{}}
+      if (!response.ok) throw new Error((data.error && (data.error.message || data.error)) || text || `HTTP ${{response.status}}`);
+      const transcriptText = String(data.text || data.transcript || '').trim();
+      if (!transcriptText) throw new Error('ASR returned no transcript');
+      prompt.value = prompt.value ? prompt.value + ' ' + transcriptText : transcriptText;
+      prompt.focus();
+      setState('transcribed', 'ok');
+    }}
+    async function startVoiceInput() {{
+      if (!navigator.mediaDevices || !window.MediaRecorder) throw new Error('This browser does not support microphone recording');
+      mediaStream = await navigator.mediaDevices.getUserMedia({{audio: true}});
+      recordingChunks = [];
+      mediaRecorder = new MediaRecorder(mediaStream);
+      mediaRecorder.addEventListener('dataavailable', event => {{ if (event.data && event.data.size) recordingChunks.push(event.data); }});
+      mediaRecorder.addEventListener('stop', async () => {{
+        const blob = new Blob(recordingChunks, {{type: mediaRecorder.mimeType || 'audio/webm'}});
+        if (mediaStream) mediaStream.getTracks().forEach(track => track.stop());
+        mediaStream = null;
+        micButton.textContent = 'Start voice input';
+        micButton.classList.remove('recording');
+        try {{ await transcribeRecording(blob); }} catch (err) {{ setState('STT error', 'error'); addBubble('system', 'STT failed: ' + String(err && err.message ? err.message : err)); }}
+      }}, {{once: true}});
+      mediaRecorder.start();
+      micButton.textContent = 'Stop and transcribe';
+      micButton.classList.add('recording');
+      setState('recording', 'error');
+    }}
+    function stopVoiceInput() {{
+      if (mediaRecorder && mediaRecorder.state !== 'inactive') mediaRecorder.stop();
+    }}
     async function uploadAttachment(file) {{
       const content = await fileToBase64(file);
       const response = await fetch('/ca/channel/files', {{
@@ -663,6 +893,54 @@ def render_web_chat_page(
       }}
     }});
     attachButton.addEventListener('click', () => fileInput.click());
+    micButton.addEventListener('click', async () => {{
+      if (mediaRecorder && mediaRecorder.state !== 'inactive') {{
+        stopVoiceInput();
+        return;
+      }}
+      try {{ await startVoiceInput(); }} catch (err) {{
+        setState('microphone error', 'error');
+        addBubble('system', 'Microphone failed: ' + String(err && err.message ? err.message : err));
+      }}
+    }});
+    speechSettingsButton.addEventListener('click', async () => {{
+      try {{ await loadSpeechConfig(); }} catch (err) {{ addBubble('system', 'Could not load speech settings: ' + String(err && err.message ? err.message : err)); }}
+      speechSettingsDialog.showModal();
+    }});
+    speechSettingsClose.addEventListener('click', () => speechSettingsDialog.close());
+    document.getElementById('ttsReferenceAudio').addEventListener('change', async event => {{
+      const file = event.target.files && event.target.files[0];
+      if (!file) return;
+      if (file.size > 10 * 1024 * 1024) {{
+        event.target.value = '';
+        addBubble('system', 'Reference voice must be 10 MB or smaller.');
+        return;
+      }}
+      pendingTtsReferenceAudio = await fileToDataUrl(file);
+      document.getElementById('ttsClearReferenceAudio').checked = false;
+      document.getElementById('ttsReferenceAudioStatus').textContent = file.name + ' (' + formatBytes(file.size) + ') ready to save';
+    }});
+    speechSettingsForm.addEventListener('submit', async event => {{
+      event.preventDefault();
+      try {{
+        await saveSpeechConfig();
+        speechSettingsDialog.close();
+        setState('speech settings saved', 'ok');
+      }} catch (err) {{
+        setState('settings error', 'error');
+        addBubble('system', 'Speech settings failed: ' + String(err && err.message ? err.message : err));
+      }}
+    }});
+    speechHealthButton.addEventListener('click', async () => {{
+      try {{
+        await saveSpeechConfig();
+        const response = await fetch('/ca/speech/health', {{headers: {{'accept': 'application/json'}}}});
+        const data = await response.json();
+        const asr = data.services && data.services.asr;
+        const tts = data.services && data.services.tts;
+        addBubble('system', `Speech health — ASR: ${{asr && asr.reachable ? 'reachable' : asr && asr.enabled ? 'unreachable' : 'disabled'}}, TTS: ${{tts && tts.reachable ? 'reachable' : tts && tts.enabled ? 'unreachable' : 'disabled'}}.`);
+      }} catch (err) {{ addBubble('system', 'Speech health check failed: ' + String(err && err.message ? err.message : err)); }}
+    }});
     fileInput.addEventListener('change', () => {{
       addSelectedFiles(fileInput.files);
       fileInput.value = '';
@@ -706,6 +984,7 @@ def render_web_chat_page(
       if (transcript.scrollTop < 48) loadOlderHistory();
     }});
     addBubble('system', `Connected to active session bridge for ${{MODEL}}. Messages are queued on channel ${{channel}} and replies stream back from /ca/channel/stream.`);
+    loadSpeechConfig().catch(() => {{ micButton.disabled = true; }});
     loadInitialHistory().finally(startChannelStream);
     prompt.focus();
   </script>

package/docs/COLAB_SPEECH.md

@@ -0,0 +1,34 @@
+# Colab speech workers
+
+Ciel Runtime can proxy its web chat and OpenAI-compatible audio API to two Colab workers over a tailnet-only Tailscale tunnel.
+
+## One-time prerequisites
+
+1. Authenticate the Colab CLI inside WSL. The installed CLI currently uses Google Application Default Credentials, so run `~/google-cloud-sdk/bin/gcloud auth application-default login` in `Ubuntu-26.04`.
+2. Create a reusable Tailscale auth key (two workers must register) and set it only for the current PowerShell process with `$env:TAILSCALE_AUTHKEY = Read-Host`. Alternatively, use a separate fresh key for each worker. The CLI passes the key without writing it to the repository. A Colab `TAILSCALE_AUTHKEY` Secret is also supported as a fallback.
+3. Optionally set `$env:CIEL_SPEECH_API_KEY = Read-Host` before deployment. Enter that value once in Web Chat > Speech Settings; Ciel stores it server-side and never returns it to the browser.
+
+## Deploy
+
+From PowerShell at the repository root:
+
+```powershell
+.\scripts\deploy_colab_speech.ps1
+```
+
+The script creates `ciel-asr` and `ciel-tts` T4 sessions, installs Qwen3-ASR-0.6B and MOSS-TTS-Nano, starts Tailscale in userspace networking mode, publishes each localhost model server with Tailscale Serve, and saves both returned `base_url` values into Web Chat > Speech Settings automatically.
+
+MOSS-TTS-Nano is a voice-cloning model without built-in speakers. Deployment configures the project's official `zh_1.wav` sample so the first request works immediately. In Web Chat > Speech Settings, upload a reference voice clip (10 MB maximum) to replace it. Ciel stores uploaded audio only in the local protected runtime configuration, omits it from configuration responses, and adds it to TTS requests automatically. API clients can instead pass `ref_audio` as an HTTP(S) URL or base64 audio data URL to `POST /v1/audio/speech`.
+
+Colab sessions are ephemeral. Re-run the bootstrap after a runtime reset. The workers are reachable only by devices in the same tailnet unless an administrator separately enables Tailscale Funnel.
+
+## API surface
+
+- `GET|POST /ca/speech/config`
+- `GET /ca/speech/health`
+- `POST /v1/audio/transcriptions`
+- `POST /v1/audio/translations`
+- `POST /v1/audio/speech`
+- `POST /v1/audio/speech/batch`
+- `GET|POST /v1/audio/voices`
+- `GET /ca/web/chat/api` lists chat, model, message, response, file, and speech endpoints.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oneciel-ai/ciel-runtime",
-  "version": "0.2.3",
+  "version": "0.2.5",
   "description": "Universal AI coding-agent runtime and model-routing layer for Claude, Codex, AGY, and compatible runtimes.",
   "license": "MIT",
   "author": "One Ciel LLC",
@@ -36,6 +36,9 @@
     "ciel-runtime-stop.cmd",
     "ciel-runtime-stop.ps1",
     "npm-bin/",
+    "scripts/colab/",
+    "scripts/configure_speech_workers.py",
+    "scripts/deploy_colab_speech.ps1",
     "install.sh",
     "install.ps1",
     "README.md",

package/scripts/colab/bootstrap_moss_tts.py

@@ -0,0 +1,150 @@
+"""Bootstrap MOSS-TTS-Nano with vLLM-Omni on Colab and Tailscale Serve.
+
+Required Colab Secret: TAILSCALE_AUTHKEY
+Optional Colab Secret: CIEL_SPEECH_API_KEY
+"""
+
+from __future__ import annotations
+
+import json
+import os
+from pathlib import Path
+import site
+import shutil
+import subprocess
+import sys
+import time
+import urllib.request
+
+
+HOSTNAME = os.environ.get("CIEL_TTS_HOSTNAME", "ciel-tts")
+PORT = 8091
+SOCKET = "/tmp/ciel-tts-tailscaled.sock"
+STATE = "/tmp/ciel-tts-tailscaled.state"
+LOG_DIR = Path("/content/ciel-speech-logs")
+
+
+def secret(name: str, *, required: bool = False) -> str:
+    value = str(os.environ.get(name) or "").strip()
+    if not value:
+        try:
+            from google.colab import userdata  # type: ignore
+
+            value = str(userdata.get(name) or "").strip()
+        except Exception:
+            value = ""
+    if required and not value:
+        raise RuntimeError(f"Add {name} to Colab Secrets and allow notebook access, then rerun this script.")
+    return value
+
+
+def run(*args: str, check: bool = True) -> subprocess.CompletedProcess[str]:
+    visible: list[str] = []
+    redact_next = False
+    for arg in args:
+        if redact_next:
+            visible.append("<redacted>")
+            redact_next = False
+        elif arg.startswith("--auth-key="):
+            visible.append("--auth-key=<redacted>")
+        else:
+            visible.append(arg)
+            redact_next = arg == "--api-key"
+    print("+", " ".join(visible))
+    return subprocess.run(args, check=check, text=True, capture_output=False)
+
+
+def install_tailscale() -> None:
+    if shutil.which("tailscale"):
+        return
+    run("bash", "-lc", "curl -fsSL https://tailscale.com/install.sh | sh")
+
+
+def start_tailscale(auth_key: str) -> tuple[str, str]:
+    install_tailscale()
+    LOG_DIR.mkdir(parents=True, exist_ok=True)
+    tail_log = (LOG_DIR / "tailscale-tts.log").open("ab")
+    if not Path(SOCKET).exists():
+        subprocess.Popen(
+            ["tailscaled", f"--socket={SOCKET}", f"--state={STATE}", "--tun=userspace-networking"],
+            stdout=tail_log,
+            stderr=subprocess.STDOUT,
+            start_new_session=True,
+        )
+    for _ in range(60):
+        if Path(SOCKET).exists():
+            break
+        time.sleep(1)
+    login = run("tailscale", f"--socket={SOCKET}", "up", f"--auth-key={auth_key}", f"--hostname={HOSTNAME}", "--accept-dns=true", "--reset", check=False)
+    if login.returncode:
+        raise RuntimeError("Tailscale authentication failed; use a valid reusable key or a fresh key for this second worker")
+    status = subprocess.check_output(["tailscale", f"--socket={SOCKET}", "status", "--json"], text=True)
+    dns_name = str(json.loads(status).get("Self", {}).get("DNSName") or HOSTNAME).rstrip(".")
+    run("tailscale", f"--socket={SOCKET}", "serve", "--bg", "--http=80", f"http://127.0.0.1:{PORT}")
+    return dns_name, f"http://{dns_name}"
+
+
+def wait_for_server(api_key: str, process: subprocess.Popen[bytes]) -> None:
+    headers = {"authorization": f"Bearer {api_key}"} if api_key else {}
+    for _ in range(240):
+        if process.poll() is not None:
+            log_path = LOG_DIR / "moss-tts.log"
+            log_tail = log_path.read_text(encoding="utf-8", errors="replace")[-12000:] if log_path.exists() else "log unavailable"
+            raise RuntimeError(f"MOSS TTS exited with status {process.returncode}:\n{log_tail}")
+        try:
+            with urllib.request.urlopen(urllib.request.Request(f"http://127.0.0.1:{PORT}/health", headers=headers), timeout=3) as response:
+                if response.status < 500:
+                    return
+        except Exception:
+            time.sleep(2)
+    raise RuntimeError("MOSS TTS did not become healthy; inspect /content/ciel-speech-logs/moss-tts.log")
+
+
+def server_is_healthy(api_key: str) -> bool:
+    headers = {"authorization": f"Bearer {api_key}"} if api_key else {}
+    try:
+        with urllib.request.urlopen(urllib.request.Request(f"http://127.0.0.1:{PORT}/health", headers=headers), timeout=3) as response:
+            return response.status < 500
+    except Exception:
+        return False
+
+
+def main() -> None:
+    auth_key = secret("TAILSCALE_AUTHKEY", required=True)
+    api_key = secret("CIEL_SPEECH_API_KEY")
+    run(
+        sys.executable,
+        "-m",
+        "pip",
+        "install",
+        "-U",
+        "nvidia-cuda-runtime==13.0.96",
+        "vllm==0.24.0",
+        "vllm-omni==0.24.0",
+    )
+    LOG_DIR.mkdir(parents=True, exist_ok=True)
+    if not server_is_healthy(api_key):
+        command = [
+            "vllm-omni", "serve", "OpenMOSS-Team/MOSS-TTS-Nano", "--omni", "--host", "127.0.0.1", "--port", str(PORT),
+            "--gpu-memory-utilization", "0.72",
+        ]
+        if api_key:
+            command.extend(["--api-key", api_key])
+        server_env = os.environ.copy()
+        cuda_runtime_libraries = [
+            library
+            for package_dir in site.getsitepackages()
+            for library in Path(package_dir).glob("**/libcudart.so.13")
+        ]
+        if cuda_runtime_libraries:
+            existing_library_path = server_env.get("LD_LIBRARY_PATH", "")
+            server_env["LD_LIBRARY_PATH"] = str(cuda_runtime_libraries[0].parent) + (f":{existing_library_path}" if existing_library_path else "")
+        server_log = (LOG_DIR / "moss-tts.log").open("ab")
+        process = subprocess.Popen(command, stdout=server_log, stderr=subprocess.STDOUT, start_new_session=True, env=server_env)
+        wait_for_server(api_key, process)
+    dns_name, base_url = start_tailscale(auth_key)
+    print(json.dumps({"ok": True, "role": "tts", "hostname": dns_name, "base_url": base_url, "model": "OpenMOSS-Team/MOSS-TTS-Nano", "api_key_set": bool(api_key)}, indent=2))
+
+
+if __name__ == "__main__":
+    main()

package/scripts/colab/bootstrap_qwen_asr.py

@@ -0,0 +1,116 @@
+"""Bootstrap Qwen3-ASR on a Colab T4 and publish it only to the tailnet.
+
+Required Colab Secret: TAILSCALE_AUTHKEY
+Optional Colab Secret: CIEL_SPEECH_API_KEY
+"""
+
+from __future__ import annotations
+
+import json
+import os
+from pathlib import Path
+import shutil
+import subprocess
+import sys
+import time
+import urllib.request
+
+
+HOSTNAME = os.environ.get("CIEL_ASR_HOSTNAME", "ciel-asr")
+PORT = 8000
+SOCKET = "/tmp/ciel-asr-tailscaled.sock"
+STATE = "/tmp/ciel-asr-tailscaled.state"
+LOG_DIR = Path("/content/ciel-speech-logs")
+
+
+def secret(name: str, *, required: bool = False) -> str:
+    value = str(os.environ.get(name) or "").strip()
+    if not value:
+        try:
+            from google.colab import userdata  # type: ignore
+
+            value = str(userdata.get(name) or "").strip()
+        except Exception:
+            value = ""
+    if required and not value:
+        raise RuntimeError(f"Add {name} to Colab Secrets and allow notebook access, then rerun this script.")
+    return value
+
+
+def run(*args: str, check: bool = True) -> subprocess.CompletedProcess[str]:
+    visible: list[str] = []
+    redact_next = False
+    for arg in args:
+        if redact_next:
+            visible.append("<redacted>")
+            redact_next = False
+        elif arg.startswith("--auth-key="):
+            visible.append("--auth-key=<redacted>")
+        else:
+            visible.append(arg)
+            redact_next = arg == "--api-key"
+    print("+", " ".join(visible))
+    return subprocess.run(args, check=check, text=True, capture_output=False)
+
+
+def install_tailscale() -> None:
+    if shutil.which("tailscale"):
+        return
+    run("bash", "-lc", "curl -fsSL https://tailscale.com/install.sh | sh")
+
+
+def start_tailscale(auth_key: str) -> tuple[str, str]:
+    install_tailscale()
+    LOG_DIR.mkdir(parents=True, exist_ok=True)
+    tail_log = (LOG_DIR / "tailscale-asr.log").open("ab")
+    subprocess.Popen(
+        ["tailscaled", f"--socket={SOCKET}", f"--state={STATE}", "--tun=userspace-networking"],
+        stdout=tail_log,
+        stderr=subprocess.STDOUT,
+        start_new_session=True,
+    )
+    for _ in range(60):
+        if Path(SOCKET).exists():
+            break
+        time.sleep(1)
+    login = run("tailscale", f"--socket={SOCKET}", "up", f"--auth-key={auth_key}", f"--hostname={HOSTNAME}", "--accept-dns=true", "--reset", check=False)
+    if login.returncode:
+        raise RuntimeError("Tailscale authentication failed; use a valid reusable key or a fresh key for this worker")
+    status = subprocess.check_output(["tailscale", f"--socket={SOCKET}", "status", "--json"], text=True)
+    dns_name = str(json.loads(status).get("Self", {}).get("DNSName") or HOSTNAME).rstrip(".")
+    run("tailscale", f"--socket={SOCKET}", "serve", "--bg", "--http=80", f"http://127.0.0.1:{PORT}")
+    return dns_name, f"http://{dns_name}"
+
+
+def wait_for_server(api_key: str) -> None:
+    headers = {"authorization": f"Bearer {api_key}"} if api_key else {}
+    for _ in range(180):
+        try:
+            with urllib.request.urlopen(urllib.request.Request(f"http://127.0.0.1:{PORT}/health", headers=headers), timeout=3) as response:
+                if response.status < 500:
+                    return
+        except Exception:
+            time.sleep(2)
+    raise RuntimeError("Qwen ASR did not become healthy; inspect /content/ciel-speech-logs/qwen-asr.log")
+
+
+def main() -> None:
+    auth_key = secret("TAILSCALE_AUTHKEY", required=True)
+    api_key = secret("CIEL_SPEECH_API_KEY")
+    run(sys.executable, "-m", "pip", "install", "-U", "qwen-asr[vllm]", "vllm[audio]")
+    LOG_DIR.mkdir(parents=True, exist_ok=True)
+    command = [
+        "qwen-asr-serve", "Qwen/Qwen3-ASR-0.6B", "--host", "127.0.0.1", "--port", str(PORT),
+        "--gpu-memory-utilization", "0.78", "--max-model-len", "8192",
+    ]
+    if api_key:
+        command.extend(["--api-key", api_key])
+    server_log = (LOG_DIR / "qwen-asr.log").open("ab")
+    subprocess.Popen(command, stdout=server_log, stderr=subprocess.STDOUT, start_new_session=True)
+    wait_for_server(api_key)
+    dns_name, base_url = start_tailscale(auth_key)
+    print(json.dumps({"ok": True, "role": "asr", "hostname": dns_name, "base_url": base_url, "model": "Qwen/Qwen3-ASR-0.6B", "api_key_set": bool(api_key)}, indent=2))
+
+
+if __name__ == "__main__":
+    main()

package/scripts/configure_speech_workers.py

@@ -0,0 +1,43 @@
+"""Persist deployed speech worker URLs in the active Ciel Runtime config."""
+
+from __future__ import annotations
+
+import argparse
+from pathlib import Path
+import sys
+from typing import Any
+
+sys.path.insert(0, str(Path(__file__).resolve().parents[1]))
+
+
+DEFAULT_TTS_REFERENCE_AUDIO = "https://raw.githubusercontent.com/OpenMOSS/MOSS-TTS-Nano/main/assets/audio/zh_1.wav"
+
+
+def configure(asr_base_url: str, tts_base_url: str, tts_reference_audio: str = DEFAULT_TTS_REFERENCE_AUDIO) -> dict[str, Any]:
+    import ciel_runtime
+
+    config = ciel_runtime.load_config()
+    speech = config.setdefault("speech", {})
+    asr = speech.setdefault("asr", {})
+    tts = speech.setdefault("tts", {})
+    asr.update({"enabled": True, "base_url": asr_base_url.rstrip("/"), "model": "Qwen/Qwen3-ASR-0.6B"})
+    tts.update({"enabled": True, "base_url": tts_base_url.rstrip("/"), "model": "OpenMOSS-Team/MOSS-TTS-Nano"})
+    if tts_reference_audio and not str(tts.get("ref_audio") or "").strip():
+        tts["ref_audio"] = tts_reference_audio
+    ciel_runtime.save_config(config)
+    return {"asr": asr["base_url"], "tts": tts["base_url"]}
+
+
+def main() -> int:
+    parser = argparse.ArgumentParser()
+    parser.add_argument("--asr-base-url", required=True)
+    parser.add_argument("--tts-base-url", required=True)
+    parser.add_argument("--tts-reference-audio", default=DEFAULT_TTS_REFERENCE_AUDIO)
+    args = parser.parse_args()
+    result = configure(args.asr_base_url, args.tts_base_url, args.tts_reference_audio)
+    print(f"Configured Ciel speech workers: ASR={result['asr']} TTS={result['tts']}")
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

package/scripts/deploy_colab_speech.ps1

@@ -0,0 +1,56 @@
+param(
+    [string]$Distribution = "Ubuntu-26.04",
+    [string]$AsrSession = "ciel-asr",
+    [string]$TtsSession = "ciel-tts"
+)
+
+$ErrorActionPreference = "Stop"
+$repo = (Resolve-Path (Join-Path $PSScriptRoot "..")).Path
+$wslRepo = (& wsl -d $Distribution -- wslpath -a ($repo -replace '\\', '/')).Trim()
+if (-not $wslRepo) { throw "Could not resolve the repository path in WSL." }
+$bootstrapEnv = ""
+if ($env:TAILSCALE_AUTHKEY) {
+    if ($env:TAILSCALE_AUTHKEY -notmatch '^tskey-[A-Za-z0-9_-]+$') { throw "TAILSCALE_AUTHKEY has an unexpected format." }
+    $bootstrapEnv += " --env TAILSCALE_AUTHKEY=$($env:TAILSCALE_AUTHKEY)"
+}
+if ($env:CIEL_SPEECH_API_KEY) {
+    if ($env:CIEL_SPEECH_API_KEY -match '[\s''"]') { throw "CIEL_SPEECH_API_KEY cannot contain whitespace or quotes for CLI deployment." }
+    $bootstrapEnv += " --env CIEL_SPEECH_API_KEY=$($env:CIEL_SPEECH_API_KEY)"
+}
+
+Write-Host "Checking Colab CLI authentication..."
+& wsl -d $Distribution -- bash -lc "colab --auth adc status >/dev/null"
+if ($LASTEXITCODE -ne 0) {
+    throw "Colab CLI is not authenticated. Configure ADC in WSL (gcloud auth application-default login), then rerun."
+}
+
+Write-Host "Creating ASR T4 session: $AsrSession"
+& wsl -d $Distribution -- bash -lc "colab --auth adc new --gpu T4 --session '$AsrSession'"
+if ($LASTEXITCODE -ne 0) { throw "Could not create ASR Colab session." }
+
+Write-Host "Creating TTS T4 session: $TtsSession"
+& wsl -d $Distribution -- bash -lc "colab --auth adc new --gpu T4 --session '$TtsSession'"
+if ($LASTEXITCODE -ne 0) { throw "Could not create TTS Colab session." }
+
+Write-Host "Installing Qwen3-ASR and its Tailscale service..."
+$asrOutput = (& wsl -d $Distribution -- bash -lc "colab --auth adc exec --session '$AsrSession'$bootstrapEnv --file '$wslRepo/scripts/colab/bootstrap_qwen_asr.py'" 2>&1 | Tee-Object -Variable asrDisplay) -join "`n"
+if ($LASTEXITCODE -ne 0) { throw "ASR bootstrap failed." }
+
+Write-Host "Installing MOSS-TTS-Nano and its Tailscale service..."
+$ttsOutput = (& wsl -d $Distribution -- bash -lc "colab --auth adc exec --session '$TtsSession'$bootstrapEnv --file '$wslRepo/scripts/colab/bootstrap_moss_tts.py'" 2>&1 | Tee-Object -Variable ttsDisplay) -join "`n"
+if ($LASTEXITCODE -ne 0) { throw "TTS bootstrap failed." }
+
+function Read-BootstrapResult([string]$Text, [string]$Role) {
+    $matches = [regex]::Matches($Text, '(?s)\{\s*"ok"\s*:\s*true.*?\}')
+    if ($matches.Count -eq 0) { throw "Could not find the $Role bootstrap result in Colab output." }
+    $result = $matches[$matches.Count - 1].Value | ConvertFrom-Json
+    if ($result.role -ne $Role -or -not $result.base_url) { throw "Invalid $Role bootstrap result." }
+    return $result
+}
+
+$asr = Read-BootstrapResult $asrOutput "asr"
+$tts = Read-BootstrapResult $ttsOutput "tts"
+& python (Join-Path $PSScriptRoot "configure_speech_workers.py") --asr-base-url $asr.base_url --tts-base-url $tts.base_url
+if ($LASTEXITCODE -ne 0) { throw "Workers started, but Ciel speech configuration failed." }
+
+Write-Host "Both services are running and connected to Web Chat > Speech Settings."