@oneciel-ai/ciel-runtime 0.2.4 → 0.2.5

package/ciel_runtime_support/config_repository.py

@@ -44,6 +44,8 @@ def build_default_config(provider_defaults: dict[str, Any]) -> dict[str, Any]:
                 "model": "OpenMOSS-Team/MOSS-TTS-Nano",
                 "voice": "default",
                 "language": "ko",
+                "ref_audio": "",
+                "ref_text": "",
                 "response_format": "wav",
                 "speed": 1.0,
                 "auto_speak": False,

package/ciel_runtime_support/runtime_constants.py

@@ -93,7 +93,7 @@ OFFICIAL_CHANNEL_PLUGINS = {
 }
 
 APP_NAME = "Ciel Runtime"
-VERSION = "0.2.4"
+VERSION = "0.2.5"
 CREDITS = "Credits: One Ciel LLC"
 PRELAUNCH_CANCEL = 10
 PRELAUNCH_LAUNCH_CODEX = 11

package/ciel_runtime_support/speech_http_controller.py

@@ -65,8 +65,10 @@ class SpeechHttpController:
         public: dict[str, Any] = {"ok": True}
         for name in ("asr", "tts"):
             source = speech.get(name) if isinstance(speech.get(name), dict) else {}
-            item = {key: value for key, value in source.items() if key != "api_key"}
+            item = {key: value for key, value in source.items() if key not in {"api_key", "ref_audio"}}
             item["api_key_set"] = bool(str(source.get("api_key") or "").strip())
+            if name == "tts":
+                item["ref_audio_set"] = bool(str(source.get("ref_audio") or "").strip())
             public[name] = item
         tailscale = speech.get("tailscale")
         public["tailscale"] = dict(tailscale) if isinstance(tailscale, dict) else {}
@@ -127,13 +129,15 @@ class SpeechHttpController:
                     current = {}
                     speech[name] = current
                 for key, value in incoming.items():
-                    if key in {"api_key_set", "clear_api_key"}:
+                    if key in {"api_key_set", "clear_api_key", "ref_audio_set", "clear_ref_audio"}:
                         continue
-                    if key == "api_key" and not str(value or "").strip():
+                    if key in {"api_key", "ref_audio"} and not str(value or "").strip():
                         continue
                     current[key] = self._validated_value(name, key, value)
                 if incoming.get("clear_api_key") is True:
                     current["api_key"] = ""
+                if name == "tts" and incoming.get("clear_ref_audio") is True:
+                    current["ref_audio"] = ""
             tailscale = update.get("tailscale")
             if isinstance(tailscale, dict):
                 current_tailscale = speech.setdefault("tailscale", {})
@@ -153,7 +157,7 @@ class SpeechHttpController:
     def _validated_value(service: str, key: str, value: Any) -> Any:
         allowed = {
             "asr": {"enabled", "base_url", "endpoint", "model", "language", "api_key", "timeout_seconds"},
-            "tts": {"enabled", "base_url", "endpoint", "voices_endpoint", "model", "voice", "language", "response_format", "speed", "auto_speak", "api_key", "timeout_seconds"},
+            "tts": {"enabled", "base_url", "endpoint", "voices_endpoint", "model", "voice", "language", "ref_audio", "ref_text", "response_format", "speed", "auto_speak", "api_key", "timeout_seconds"},
         }
         if key not in allowed[service]:
             raise ValueError(f"unsupported {service} setting: {key}")
@@ -164,6 +168,21 @@ class SpeechHttpController:
         if key == "speed":
             return max(0.25, min(4.0, float(value)))
         text = str(value or "").strip()
+        if key == "ref_audio":
+            if len(text) > 14_000_000:
+                raise ValueError("TTS reference audio must be 10 MB or smaller")
+            if text.startswith("data:audio/") and ";base64," in text:
+                try:
+                    audio = base64.b64decode(text.split(",", 1)[1], validate=True)
+                except (ValueError, TypeError) as exc:
+                    raise ValueError("invalid base64 TTS reference audio") from exc
+                if not audio or len(audio) > 10 * 1024 * 1024:
+                    raise ValueError("TTS reference audio must be between 1 byte and 10 MB")
+                return text
+            parsed_ref = urllib.parse.urlparse(text)
+            if parsed_ref.scheme not in {"http", "https"} or not parsed_ref.netloc:
+                raise ValueError("TTS ref_audio must be an audio data URL or HTTP(S) URL")
+            return text
         if key == "base_url":
             parsed = urllib.parse.urlparse(text)
             if parsed.scheme not in {"http", "https"} or not parsed.netloc:
@@ -237,6 +256,10 @@ class SpeechHttpController:
                     body.setdefault("model", str(config.get("model") or ""))
                     body.setdefault("voice", str(config.get("voice") or "default"))
                     body.setdefault("language", str(config.get("language") or "Auto"))
+                    if str(config.get("ref_audio") or "").strip():
+                        body.setdefault("ref_audio", str(config["ref_audio"]))
+                    if str(config.get("ref_text") or "").strip():
+                        body.setdefault("ref_text", str(config["ref_text"]))
                     body.setdefault("response_format", str(config.get("response_format") or "wav"))
                     body.setdefault("speed", float(config.get("speed") or 1.0))
                 raw = json.dumps(body, ensure_ascii=False).encode("utf-8")

package/ciel_runtime_support/web_ui.py

@@ -224,6 +224,9 @@ def render_web_chat_page(
             <label>Voice<input id="ttsVoice" placeholder="default"></label>
             <label>Language<input id="ttsLanguage" placeholder="ko"></label>
             <label class="wide">Model<input id="ttsModel" placeholder="OpenMOSS-Team/MOSS-TTS-Nano"></label>
+            <label class="wide">Reference voice (required by MOSS-TTS-Nano)<input id="ttsReferenceAudio" type="file" accept="audio/*"><span class="hint" id="ttsReferenceAudioStatus">No reference voice configured</span></label>
+            <label class="wide">Reference transcript (optional)<input id="ttsReferenceText" placeholder="Transcript of the reference clip"></label>
+            <label class="check wide"><input id="ttsClearReferenceAudio" type="checkbox"> Remove the saved reference voice</label>
             <label class="wide">Remote bearer token<input id="ttsApiKey" type="password" autocomplete="new-password" placeholder="Leave blank to keep current token"></label>
           </div>
         </section>
@@ -287,6 +290,7 @@ def render_web_chat_page(
     let mediaRecorder = null;
     let mediaStream = null;
     let recordingChunks = [];
+    let pendingTtsReferenceAudio = '';
     function setState(text, cls = '') {{
       statePill.textContent = text;
       statePill.className = 'pill ' + cls;
@@ -553,6 +557,14 @@ def render_web_chat_page(
         reader.readAsDataURL(file);
       }});
     }}
+    function fileToDataUrl(file) {{
+      return new Promise((resolve, reject) => {{
+        const reader = new FileReader();
+        reader.onload = () => resolve(String(reader.result || ''));
+        reader.onerror = () => reject(reader.error || new Error('Could not read file'));
+        reader.readAsDataURL(file);
+      }});
+    }}
     function setSpeechForm(config) {{
       const asr = config.asr || {{}};
       const tts = config.tts || {{}};
@@ -569,6 +581,11 @@ def render_web_chat_page(
       document.getElementById('ttsModel').value = tts.model || '';
       document.getElementById('ttsVoice').value = tts.voice || 'default';
       document.getElementById('ttsLanguage').value = tts.language || 'ko';
+      document.getElementById('ttsReferenceText').value = tts.ref_text || '';
+      document.getElementById('ttsReferenceAudioStatus').textContent = tts.ref_audio_set ? 'Reference voice saved securely on this Ciel router' : 'No reference voice configured';
+      document.getElementById('ttsClearReferenceAudio').checked = false;
+      document.getElementById('ttsReferenceAudio').value = '';
+      pendingTtsReferenceAudio = '';
       document.getElementById('ttsApiKey').value = '';
       document.getElementById('ttsApiKey').placeholder = tts.api_key_set ? 'Token is set; leave blank to keep it' : 'Optional remote bearer token';
       document.getElementById('tailscaleEnabled').checked = tailscale.enabled !== false;
@@ -601,6 +618,9 @@ def render_web_chat_page(
           model: document.getElementById('ttsModel').value,
           voice: document.getElementById('ttsVoice').value,
           language: document.getElementById('ttsLanguage').value,
+          ref_audio: pendingTtsReferenceAudio,
+          ref_text: document.getElementById('ttsReferenceText').value,
+          clear_ref_audio: document.getElementById('ttsClearReferenceAudio').checked,
           api_key: document.getElementById('ttsApiKey').value,
         }},
         tailscale: {{
@@ -888,6 +908,18 @@ def render_web_chat_page(
       speechSettingsDialog.showModal();
     }});
     speechSettingsClose.addEventListener('click', () => speechSettingsDialog.close());
+    document.getElementById('ttsReferenceAudio').addEventListener('change', async event => {{
+      const file = event.target.files && event.target.files[0];
+      if (!file) return;
+      if (file.size > 10 * 1024 * 1024) {{
+        event.target.value = '';
+        addBubble('system', 'Reference voice must be 10 MB or smaller.');
+        return;
+      }}
+      pendingTtsReferenceAudio = await fileToDataUrl(file);
+      document.getElementById('ttsClearReferenceAudio').checked = false;
+      document.getElementById('ttsReferenceAudioStatus').textContent = file.name + ' (' + formatBytes(file.size) + ') ready to save';
+    }});
     speechSettingsForm.addEventListener('submit', async event => {{
       event.preventDefault();
       try {{

package/docs/COLAB_SPEECH.md

@@ -5,8 +5,8 @@ Ciel Runtime can proxy its web chat and OpenAI-compatible audio API to two Colab
 ## One-time prerequisites
 
 1. Authenticate the Colab CLI inside WSL. The installed CLI currently uses Google Application Default Credentials, so run `~/google-cloud-sdk/bin/gcloud auth application-default login` in `Ubuntu-26.04`.
-2. Create a reusable or ephemeral Tailscale auth key. In each Colab account/notebook Secret store, add `TAILSCALE_AUTHKEY` and grant notebook access.
-3. Optionally add the same `CIEL_SPEECH_API_KEY` secret to both workers. Enter that value once in Web Chat > Speech Settings; Ciel stores it server-side and never returns it to the browser.
+2. Create a reusable Tailscale auth key (two workers must register) and set it only for the current PowerShell process with `$env:TAILSCALE_AUTHKEY = Read-Host`. Alternatively, use a separate fresh key for each worker. The CLI passes the key without writing it to the repository. A Colab `TAILSCALE_AUTHKEY` Secret is also supported as a fallback.
+3. Optionally set `$env:CIEL_SPEECH_API_KEY = Read-Host` before deployment. Enter that value once in Web Chat > Speech Settings; Ciel stores it server-side and never returns it to the browser.
 
 ## Deploy
 
@@ -18,6 +18,8 @@ From PowerShell at the repository root:
 
 The script creates `ciel-asr` and `ciel-tts` T4 sessions, installs Qwen3-ASR-0.6B and MOSS-TTS-Nano, starts Tailscale in userspace networking mode, publishes each localhost model server with Tailscale Serve, and saves both returned `base_url` values into Web Chat > Speech Settings automatically.
 
+MOSS-TTS-Nano is a voice-cloning model without built-in speakers. Deployment configures the project's official `zh_1.wav` sample so the first request works immediately. In Web Chat > Speech Settings, upload a reference voice clip (10 MB maximum) to replace it. Ciel stores uploaded audio only in the local protected runtime configuration, omits it from configuration responses, and adds it to TTS requests automatically. API clients can instead pass `ref_audio` as an HTTP(S) URL or base64 audio data URL to `POST /v1/audio/speech`.
+
 Colab sessions are ephemeral. Re-run the bootstrap after a runtime reset. The workers are reachable only by devices in the same tailnet unless an administrator separately enables Tailscale Funnel.
 
 ## API surface

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oneciel-ai/ciel-runtime",
-  "version": "0.2.4",
+  "version": "0.2.5",
   "description": "Universal AI coding-agent runtime and model-routing layer for Claude, Codex, AGY, and compatible runtimes.",
   "license": "MIT",
   "author": "One Ciel LLC",

package/scripts/colab/bootstrap_moss_tts.py

@@ -9,6 +9,7 @@ from __future__ import annotations
 import json
 import os
 from pathlib import Path
+import site
 import shutil
 import subprocess
 import sys
@@ -38,7 +39,18 @@ def secret(name: str, *, required: bool = False) -> str:
 
 
 def run(*args: str, check: bool = True) -> subprocess.CompletedProcess[str]:
-    print("+", " ".join(args))
+    visible: list[str] = []
+    redact_next = False
+    for arg in args:
+        if redact_next:
+            visible.append("<redacted>")
+            redact_next = False
+        elif arg.startswith("--auth-key="):
+            visible.append("--auth-key=<redacted>")
+        else:
+            visible.append(arg)
+            redact_next = arg == "--api-key"
+    print("+", " ".join(visible))
     return subprocess.run(args, check=check, text=True, capture_output=False)
 
 
@@ -52,29 +64,33 @@ def start_tailscale(auth_key: str) -> tuple[str, str]:
     install_tailscale()
     LOG_DIR.mkdir(parents=True, exist_ok=True)
     tail_log = (LOG_DIR / "tailscale-tts.log").open("ab")
-    subprocess.Popen(
-        ["tailscaled", f"--socket={SOCKET}", f"--state={STATE}", "--tun=userspace-networking"],
-        stdout=tail_log,
-        stderr=subprocess.STDOUT,
-        start_new_session=True,
-    )
+    if not Path(SOCKET).exists():
+        subprocess.Popen(
+            ["tailscaled", f"--socket={SOCKET}", f"--state={STATE}", "--tun=userspace-networking"],
+            stdout=tail_log,
+            stderr=subprocess.STDOUT,
+            start_new_session=True,
+        )
     for _ in range(60):
         if Path(SOCKET).exists():
             break
         time.sleep(1)
-    run("tailscale", f"--socket={SOCKET}", "up", f"--auth-key={auth_key}", f"--hostname={HOSTNAME}", "--accept-dns=true", "--reset")
+    login = run("tailscale", f"--socket={SOCKET}", "up", f"--auth-key={auth_key}", f"--hostname={HOSTNAME}", "--accept-dns=true", "--reset", check=False)
+    if login.returncode:
+        raise RuntimeError("Tailscale authentication failed; use a valid reusable key or a fresh key for this second worker")
     status = subprocess.check_output(["tailscale", f"--socket={SOCKET}", "status", "--json"], text=True)
     dns_name = str(json.loads(status).get("Self", {}).get("DNSName") or HOSTNAME).rstrip(".")
-    serve = run("tailscale", f"--socket={SOCKET}", "serve", "--bg", "--https=443", f"http://127.0.0.1:{PORT}", check=False)
-    if serve.returncode == 0:
-        return dns_name, f"https://{dns_name}"
     run("tailscale", f"--socket={SOCKET}", "serve", "--bg", "--http=80", f"http://127.0.0.1:{PORT}")
     return dns_name, f"http://{dns_name}"
 
 
-def wait_for_server(api_key: str) -> None:
+def wait_for_server(api_key: str, process: subprocess.Popen[bytes]) -> None:
     headers = {"authorization": f"Bearer {api_key}"} if api_key else {}
     for _ in range(240):
+        if process.poll() is not None:
+            log_path = LOG_DIR / "moss-tts.log"
+            log_tail = log_path.read_text(encoding="utf-8", errors="replace")[-12000:] if log_path.exists() else "log unavailable"
+            raise RuntimeError(f"MOSS TTS exited with status {process.returncode}:\n{log_tail}")
         try:
             with urllib.request.urlopen(urllib.request.Request(f"http://127.0.0.1:{PORT}/health", headers=headers), timeout=3) as response:
                 if response.status < 500:
@@ -84,20 +100,48 @@ def wait_for_server(api_key: str) -> None:
     raise RuntimeError("MOSS TTS did not become healthy; inspect /content/ciel-speech-logs/moss-tts.log")
 
 
+def server_is_healthy(api_key: str) -> bool:
+    headers = {"authorization": f"Bearer {api_key}"} if api_key else {}
+    try:
+        with urllib.request.urlopen(urllib.request.Request(f"http://127.0.0.1:{PORT}/health", headers=headers), timeout=3) as response:
+            return response.status < 500
+    except Exception:
+        return False
+
+
 def main() -> None:
     auth_key = secret("TAILSCALE_AUTHKEY", required=True)
     api_key = secret("CIEL_SPEECH_API_KEY")
-    run(sys.executable, "-m", "pip", "install", "-U", "vllm-omni==0.24.0")
+    run(
+        sys.executable,
+        "-m",
+        "pip",
+        "install",
+        "-U",
+        "nvidia-cuda-runtime==13.0.96",
+        "vllm==0.24.0",
+        "vllm-omni==0.24.0",
+    )
     LOG_DIR.mkdir(parents=True, exist_ok=True)
-    command = [
-        "vllm", "serve", "OpenMOSS-Team/MOSS-TTS-Nano", "--omni", "--host", "127.0.0.1", "--port", str(PORT),
-        "--gpu-memory-utilization", "0.72", "--trust-remote-code", "--enforce-eager",
-    ]
-    if api_key:
-        command.extend(["--api-key", api_key])
-    server_log = (LOG_DIR / "moss-tts.log").open("ab")
-    subprocess.Popen(command, stdout=server_log, stderr=subprocess.STDOUT, start_new_session=True)
-    wait_for_server(api_key)
+    if not server_is_healthy(api_key):
+        command = [
+            "vllm-omni", "serve", "OpenMOSS-Team/MOSS-TTS-Nano", "--omni", "--host", "127.0.0.1", "--port", str(PORT),
+            "--gpu-memory-utilization", "0.72",
+        ]
+        if api_key:
+            command.extend(["--api-key", api_key])
+        server_env = os.environ.copy()
+        cuda_runtime_libraries = [
+            library
+            for package_dir in site.getsitepackages()
+            for library in Path(package_dir).glob("**/libcudart.so.13")
+        ]
+        if cuda_runtime_libraries:
+            existing_library_path = server_env.get("LD_LIBRARY_PATH", "")
+            server_env["LD_LIBRARY_PATH"] = str(cuda_runtime_libraries[0].parent) + (f":{existing_library_path}" if existing_library_path else "")
+        server_log = (LOG_DIR / "moss-tts.log").open("ab")
+        process = subprocess.Popen(command, stdout=server_log, stderr=subprocess.STDOUT, start_new_session=True, env=server_env)
+        wait_for_server(api_key, process)
     dns_name, base_url = start_tailscale(auth_key)
     print(json.dumps({"ok": True, "role": "tts", "hostname": dns_name, "base_url": base_url, "model": "OpenMOSS-Team/MOSS-TTS-Nano", "api_key_set": bool(api_key)}, indent=2))
 

package/scripts/colab/bootstrap_qwen_asr.py

@@ -38,7 +38,18 @@ def secret(name: str, *, required: bool = False) -> str:
 
 
 def run(*args: str, check: bool = True) -> subprocess.CompletedProcess[str]:
-    print("+", " ".join(args))
+    visible: list[str] = []
+    redact_next = False
+    for arg in args:
+        if redact_next:
+            visible.append("<redacted>")
+            redact_next = False
+        elif arg.startswith("--auth-key="):
+            visible.append("--auth-key=<redacted>")
+        else:
+            visible.append(arg)
+            redact_next = arg == "--api-key"
+    print("+", " ".join(visible))
     return subprocess.run(args, check=check, text=True, capture_output=False)
 
 
@@ -62,12 +73,11 @@ def start_tailscale(auth_key: str) -> tuple[str, str]:
         if Path(SOCKET).exists():
             break
         time.sleep(1)
-    run("tailscale", f"--socket={SOCKET}", "up", f"--auth-key={auth_key}", f"--hostname={HOSTNAME}", "--accept-dns=true", "--reset")
+    login = run("tailscale", f"--socket={SOCKET}", "up", f"--auth-key={auth_key}", f"--hostname={HOSTNAME}", "--accept-dns=true", "--reset", check=False)
+    if login.returncode:
+        raise RuntimeError("Tailscale authentication failed; use a valid reusable key or a fresh key for this worker")
     status = subprocess.check_output(["tailscale", f"--socket={SOCKET}", "status", "--json"], text=True)
     dns_name = str(json.loads(status).get("Self", {}).get("DNSName") or HOSTNAME).rstrip(".")
-    serve = run("tailscale", f"--socket={SOCKET}", "serve", "--bg", "--https=443", f"http://127.0.0.1:{PORT}", check=False)
-    if serve.returncode == 0:
-        return dns_name, f"https://{dns_name}"
     run("tailscale", f"--socket={SOCKET}", "serve", "--bg", "--http=80", f"http://127.0.0.1:{PORT}")
     return dns_name, f"http://{dns_name}"
 

package/scripts/configure_speech_workers.py

@@ -10,7 +10,10 @@ from typing import Any
 sys.path.insert(0, str(Path(__file__).resolve().parents[1]))
 
 
-def configure(asr_base_url: str, tts_base_url: str) -> dict[str, Any]:
+DEFAULT_TTS_REFERENCE_AUDIO = "https://raw.githubusercontent.com/OpenMOSS/MOSS-TTS-Nano/main/assets/audio/zh_1.wav"
+
+
+def configure(asr_base_url: str, tts_base_url: str, tts_reference_audio: str = DEFAULT_TTS_REFERENCE_AUDIO) -> dict[str, Any]:
     import ciel_runtime
 
     config = ciel_runtime.load_config()
@@ -19,6 +22,8 @@ def configure(asr_base_url: str, tts_base_url: str) -> dict[str, Any]:
     tts = speech.setdefault("tts", {})
     asr.update({"enabled": True, "base_url": asr_base_url.rstrip("/"), "model": "Qwen/Qwen3-ASR-0.6B"})
     tts.update({"enabled": True, "base_url": tts_base_url.rstrip("/"), "model": "OpenMOSS-Team/MOSS-TTS-Nano"})
+    if tts_reference_audio and not str(tts.get("ref_audio") or "").strip():
+        tts["ref_audio"] = tts_reference_audio
     ciel_runtime.save_config(config)
     return {"asr": asr["base_url"], "tts": tts["base_url"]}
 
@@ -27,8 +32,9 @@ def main() -> int:
     parser = argparse.ArgumentParser()
     parser.add_argument("--asr-base-url", required=True)
     parser.add_argument("--tts-base-url", required=True)
+    parser.add_argument("--tts-reference-audio", default=DEFAULT_TTS_REFERENCE_AUDIO)
     args = parser.parse_args()
-    result = configure(args.asr_base_url, args.tts_base_url)
+    result = configure(args.asr_base_url, args.tts_base_url, args.tts_reference_audio)
     print(f"Configured Ciel speech workers: ASR={result['asr']} TTS={result['tts']}")
     return 0
 

package/scripts/deploy_colab_speech.ps1

@@ -8,27 +8,36 @@ $ErrorActionPreference = "Stop"
 $repo = (Resolve-Path (Join-Path $PSScriptRoot "..")).Path
 $wslRepo = (& wsl -d $Distribution -- wslpath -a ($repo -replace '\\', '/')).Trim()
 if (-not $wslRepo) { throw "Could not resolve the repository path in WSL." }
+$bootstrapEnv = ""
+if ($env:TAILSCALE_AUTHKEY) {
+    if ($env:TAILSCALE_AUTHKEY -notmatch '^tskey-[A-Za-z0-9_-]+$') { throw "TAILSCALE_AUTHKEY has an unexpected format." }
+    $bootstrapEnv += " --env TAILSCALE_AUTHKEY=$($env:TAILSCALE_AUTHKEY)"
+}
+if ($env:CIEL_SPEECH_API_KEY) {
+    if ($env:CIEL_SPEECH_API_KEY -match '[\s''"]') { throw "CIEL_SPEECH_API_KEY cannot contain whitespace or quotes for CLI deployment." }
+    $bootstrapEnv += " --env CIEL_SPEECH_API_KEY=$($env:CIEL_SPEECH_API_KEY)"
+}
 
 Write-Host "Checking Colab CLI authentication..."
-& wsl -d $Distribution -- bash -lc "colab status >/dev/null"
+& wsl -d $Distribution -- bash -lc "colab --auth adc status >/dev/null"
 if ($LASTEXITCODE -ne 0) {
     throw "Colab CLI is not authenticated. Configure ADC in WSL (gcloud auth application-default login), then rerun."
 }
 
 Write-Host "Creating ASR T4 session: $AsrSession"
-& wsl -d $Distribution -- bash -lc "colab new --gpu T4 --session '$AsrSession'"
+& wsl -d $Distribution -- bash -lc "colab --auth adc new --gpu T4 --session '$AsrSession'"
 if ($LASTEXITCODE -ne 0) { throw "Could not create ASR Colab session." }
 
 Write-Host "Creating TTS T4 session: $TtsSession"
-& wsl -d $Distribution -- bash -lc "colab new --gpu T4 --session '$TtsSession'"
+& wsl -d $Distribution -- bash -lc "colab --auth adc new --gpu T4 --session '$TtsSession'"
 if ($LASTEXITCODE -ne 0) { throw "Could not create TTS Colab session." }
 
 Write-Host "Installing Qwen3-ASR and its Tailscale service..."
-$asrOutput = (& wsl -d $Distribution -- bash -lc "colab exec --session '$AsrSession' --file '$wslRepo/scripts/colab/bootstrap_qwen_asr.py'" 2>&1 | Tee-Object -Variable asrDisplay) -join "`n"
+$asrOutput = (& wsl -d $Distribution -- bash -lc "colab --auth adc exec --session '$AsrSession'$bootstrapEnv --file '$wslRepo/scripts/colab/bootstrap_qwen_asr.py'" 2>&1 | Tee-Object -Variable asrDisplay) -join "`n"
 if ($LASTEXITCODE -ne 0) { throw "ASR bootstrap failed." }
 
 Write-Host "Installing MOSS-TTS-Nano and its Tailscale service..."
-$ttsOutput = (& wsl -d $Distribution -- bash -lc "colab exec --session '$TtsSession' --file '$wslRepo/scripts/colab/bootstrap_moss_tts.py'" 2>&1 | Tee-Object -Variable ttsDisplay) -join "`n"
+$ttsOutput = (& wsl -d $Distribution -- bash -lc "colab --auth adc exec --session '$TtsSession'$bootstrapEnv --file '$wslRepo/scripts/colab/bootstrap_moss_tts.py'" 2>&1 | Tee-Object -Variable ttsDisplay) -join "`n"
 if ($LASTEXITCODE -ne 0) { throw "TTS bootstrap failed." }
 
 function Read-BootstrapResult([string]$Text, [string]$Role) {