@oneciel-ai/ciel-runtime 0.2.4 → 0.2.6

package/ciel_runtime_support/config_repository.py

@@ -27,6 +27,15 @@ def build_default_config(provider_defaults: dict[str, Any]) -> dict[str, Any]:
             "tailscale_https": False,
         },
         "speech": {
+            "colab": {
+                "enabled": True,
+                "distribution": "Ubuntu-26.04",
+                "auth": "adc",
+                "asr_session": "ciel-asr",
+                "tts_session": "ciel-tts",
+                "asr_accelerator": "T4",
+                "tts_accelerator": "T4",
+            },
             "asr": {
                 "enabled": False,
                 "base_url": "http://ciel-asr:8000",
@@ -44,6 +53,8 @@ def build_default_config(provider_defaults: dict[str, Any]) -> dict[str, Any]:
                 "model": "OpenMOSS-Team/MOSS-TTS-Nano",
                 "voice": "default",
                 "language": "ko",
+                "ref_audio": "",
+                "ref_text": "",
                 "response_format": "wav",
                 "speed": 1.0,
                 "auto_speak": False,

package/ciel_runtime_support/runtime_constants.py

@@ -93,7 +93,7 @@ OFFICIAL_CHANNEL_PLUGINS = {
 }
 
 APP_NAME = "Ciel Runtime"
-VERSION = "0.2.4"
+VERSION = "0.2.6"
 CREDITS = "Credits: One Ciel LLC"
 PRELAUNCH_CANCEL = 10
 PRELAUNCH_LAUNCH_CODEX = 11

package/ciel_runtime_support/speech_http_controller.py

@@ -4,6 +4,7 @@ from __future__ import annotations
 
 import base64
 import json
+import re
 import secrets
 import urllib.error
 import urllib.parse
@@ -65,11 +66,15 @@ class SpeechHttpController:
         public: dict[str, Any] = {"ok": True}
         for name in ("asr", "tts"):
             source = speech.get(name) if isinstance(speech.get(name), dict) else {}
-            item = {key: value for key, value in source.items() if key != "api_key"}
+            item = {key: value for key, value in source.items() if key not in {"api_key", "ref_audio"}}
             item["api_key_set"] = bool(str(source.get("api_key") or "").strip())
+            if name == "tts":
+                item["ref_audio_set"] = bool(str(source.get("ref_audio") or "").strip())
             public[name] = item
         tailscale = speech.get("tailscale")
         public["tailscale"] = dict(tailscale) if isinstance(tailscale, dict) else {}
+        colab = speech.get("colab")
+        public["colab"] = dict(colab) if isinstance(colab, dict) else {}
         public["endpoints"] = self.discovery_payload()["endpoints"]
         return public
 
@@ -127,13 +132,15 @@ class SpeechHttpController:
                     current = {}
                     speech[name] = current
                 for key, value in incoming.items():
-                    if key in {"api_key_set", "clear_api_key"}:
+                    if key in {"api_key_set", "clear_api_key", "ref_audio_set", "clear_ref_audio"}:
                         continue
-                    if key == "api_key" and not str(value or "").strip():
+                    if key in {"api_key", "ref_audio"} and not str(value or "").strip():
                         continue
                     current[key] = self._validated_value(name, key, value)
                 if incoming.get("clear_api_key") is True:
                     current["api_key"] = ""
+                if name == "tts" and incoming.get("clear_ref_audio") is True:
+                    current["ref_audio"] = ""
             tailscale = update.get("tailscale")
             if isinstance(tailscale, dict):
                 current_tailscale = speech.setdefault("tailscale", {})
@@ -143,6 +150,14 @@ class SpeechHttpController:
                 for key in ("enabled", "asr_hostname", "tts_hostname"):
                     if key in tailscale:
                         current_tailscale[key] = tailscale[key]
+            colab = update.get("colab")
+            if isinstance(colab, dict):
+                current_colab = speech.setdefault("colab", {})
+                if not isinstance(current_colab, dict):
+                    current_colab = {}
+                    speech["colab"] = current_colab
+                for key, value in colab.items():
+                    current_colab[key] = self._validated_colab_value(key, value)
             self.ports.save_config(config)
             self.ports.write_json(handler, self.public_config())
         except (UnicodeError, ValueError, TypeError) as exc:
@@ -153,7 +168,7 @@ class SpeechHttpController:
     def _validated_value(service: str, key: str, value: Any) -> Any:
         allowed = {
             "asr": {"enabled", "base_url", "endpoint", "model", "language", "api_key", "timeout_seconds"},
-            "tts": {"enabled", "base_url", "endpoint", "voices_endpoint", "model", "voice", "language", "response_format", "speed", "auto_speak", "api_key", "timeout_seconds"},
+            "tts": {"enabled", "base_url", "endpoint", "voices_endpoint", "model", "voice", "language", "ref_audio", "ref_text", "response_format", "speed", "auto_speak", "api_key", "timeout_seconds"},
         }
         if key not in allowed[service]:
             raise ValueError(f"unsupported {service} setting: {key}")
@@ -164,6 +179,21 @@ class SpeechHttpController:
         if key == "speed":
             return max(0.25, min(4.0, float(value)))
         text = str(value or "").strip()
+        if key == "ref_audio":
+            if len(text) > 14_000_000:
+                raise ValueError("TTS reference audio must be 10 MB or smaller")
+            if text.startswith("data:audio/") and ";base64," in text:
+                try:
+                    audio = base64.b64decode(text.split(",", 1)[1], validate=True)
+                except (ValueError, TypeError) as exc:
+                    raise ValueError("invalid base64 TTS reference audio") from exc
+                if not audio or len(audio) > 10 * 1024 * 1024:
+                    raise ValueError("TTS reference audio must be between 1 byte and 10 MB")
+                return text
+            parsed_ref = urllib.parse.urlparse(text)
+            if parsed_ref.scheme not in {"http", "https"} or not parsed_ref.netloc:
+                raise ValueError("TTS ref_audio must be an audio data URL or HTTP(S) URL")
+            return text
         if key == "base_url":
             parsed = urllib.parse.urlparse(text)
             if parsed.scheme not in {"http", "https"} or not parsed.netloc:
@@ -173,6 +203,36 @@ class SpeechHttpController:
             raise ValueError(f"{service} {key} must begin with /")
         return text
 
+    @staticmethod
+    def _validated_colab_value(key: str, value: Any) -> Any:
+        allowed = {
+            "enabled",
+            "distribution",
+            "auth",
+            "asr_session",
+            "tts_session",
+            "asr_accelerator",
+            "tts_accelerator",
+        }
+        if key not in allowed:
+            raise ValueError(f"unsupported colab setting: {key}")
+        if key == "enabled":
+            return bool(value)
+        text = str(value or "").strip()
+        if key == "auth":
+            auth = text.lower()
+            if auth not in {"adc", "oauth2"}:
+                raise ValueError("Colab auth must be adc or oauth2")
+            return auth
+        if key.endswith("_accelerator"):
+            accelerator = text.upper()
+            if accelerator not in {"T4", "L4", "G4", "A100", "H100"}:
+                raise ValueError("unsupported Colab accelerator")
+            return accelerator
+        if not re.fullmatch(r"[A-Za-z0-9][A-Za-z0-9._-]{0,127}", text):
+            raise ValueError(f"invalid Colab {key}")
+        return text
+
     def _probe(self, name: str) -> dict[str, Any]:
         config = self._service_config(name)
         enabled = bool(config.get("enabled"))
@@ -237,6 +297,10 @@ class SpeechHttpController:
                     body.setdefault("model", str(config.get("model") or ""))
                     body.setdefault("voice", str(config.get("voice") or "default"))
                     body.setdefault("language", str(config.get("language") or "Auto"))
+                    if str(config.get("ref_audio") or "").strip():
+                        body.setdefault("ref_audio", str(config["ref_audio"]))
+                    if str(config.get("ref_text") or "").strip():
+                        body.setdefault("ref_text", str(config["ref_text"]))
                     body.setdefault("response_format", str(config.get("response_format") or "wav"))
                     body.setdefault("speed", float(config.get("speed") or 1.0))
                 raw = json.dumps(body, ensure_ascii=False).encode("utf-8")

package/ciel_runtime_support/web_ui.py

@@ -224,9 +224,25 @@ def render_web_chat_page(
             <label>Voice<input id="ttsVoice" placeholder="default"></label>
             <label>Language<input id="ttsLanguage" placeholder="ko"></label>
             <label class="wide">Model<input id="ttsModel" placeholder="OpenMOSS-Team/MOSS-TTS-Nano"></label>
+            <label class="wide">Reference voice (required by MOSS-TTS-Nano)<input id="ttsReferenceAudio" type="file" accept="audio/*"><span class="hint" id="ttsReferenceAudioStatus">No reference voice configured</span></label>
+            <label class="wide">Reference transcript (optional)<input id="ttsReferenceText" placeholder="Transcript of the reference clip"></label>
+            <label class="check wide"><input id="ttsClearReferenceAudio" type="checkbox"> Remove the saved reference voice</label>
             <label class="wide">Remote bearer token<input id="ttsApiKey" type="password" autocomplete="new-password" placeholder="Leave blank to keep current token"></label>
           </div>
         </section>
+        <section class="settings-section">
+          <h3>Colab CLI connection</h3>
+          <div class="settings-grid">
+            <label class="check"><input id="colabEnabled" type="checkbox"> Manage workers with Colab CLI</label>
+            <label>WSL distribution<input id="colabDistribution" placeholder="Ubuntu-26.04"></label>
+            <label>Authentication<select id="colabAuth"><option value="adc">ADC</option><option value="oauth2">OAuth2</option></select></label>
+            <label>ASR session<input id="colabAsrSession" placeholder="ciel-asr"></label>
+            <label>TTS session<input id="colabTtsSession" placeholder="ciel-tts"></label>
+            <label>ASR GPU<select id="colabAsrAccelerator"><option>T4</option><option>L4</option><option>G4</option><option>A100</option><option>H100</option></select></label>
+            <label>TTS GPU<select id="colabTtsAccelerator"><option>T4</option><option>L4</option><option>G4</option><option>A100</option><option>H100</option></select></label>
+          </div>
+          <div class="hint">Saved here for scripts/deploy_colab_speech.ps1. Credentials remain in the Colab CLI profile and are never stored by Ciel.</div>
+        </section>
         <section class="settings-section">
           <h3>Tailscale tunnel</h3>
           <div class="settings-grid">
@@ -287,6 +303,7 @@ def render_web_chat_page(
     let mediaRecorder = null;
     let mediaStream = null;
     let recordingChunks = [];
+    let pendingTtsReferenceAudio = '';
     function setState(text, cls = '') {{
       statePill.textContent = text;
       statePill.className = 'pill ' + cls;
@@ -553,9 +570,18 @@ def render_web_chat_page(
         reader.readAsDataURL(file);
       }});
     }}
+    function fileToDataUrl(file) {{
+      return new Promise((resolve, reject) => {{
+        const reader = new FileReader();
+        reader.onload = () => resolve(String(reader.result || ''));
+        reader.onerror = () => reject(reader.error || new Error('Could not read file'));
+        reader.readAsDataURL(file);
+      }});
+    }}
     function setSpeechForm(config) {{
       const asr = config.asr || {{}};
       const tts = config.tts || {{}};
+      const colab = config.colab || {{}};
       const tailscale = config.tailscale || {{}};
       document.getElementById('asrEnabled').checked = Boolean(asr.enabled);
       document.getElementById('asrBaseUrl').value = asr.base_url || '';
@@ -569,8 +595,20 @@ def render_web_chat_page(
       document.getElementById('ttsModel').value = tts.model || '';
       document.getElementById('ttsVoice').value = tts.voice || 'default';
       document.getElementById('ttsLanguage').value = tts.language || 'ko';
+      document.getElementById('ttsReferenceText').value = tts.ref_text || '';
+      document.getElementById('ttsReferenceAudioStatus').textContent = tts.ref_audio_set ? 'Reference voice saved securely on this Ciel router' : 'No reference voice configured';
+      document.getElementById('ttsClearReferenceAudio').checked = false;
+      document.getElementById('ttsReferenceAudio').value = '';
+      pendingTtsReferenceAudio = '';
       document.getElementById('ttsApiKey').value = '';
       document.getElementById('ttsApiKey').placeholder = tts.api_key_set ? 'Token is set; leave blank to keep it' : 'Optional remote bearer token';
+      document.getElementById('colabEnabled').checked = colab.enabled !== false;
+      document.getElementById('colabDistribution').value = colab.distribution || 'Ubuntu-26.04';
+      document.getElementById('colabAuth').value = colab.auth || 'adc';
+      document.getElementById('colabAsrSession').value = colab.asr_session || 'ciel-asr';
+      document.getElementById('colabTtsSession').value = colab.tts_session || 'ciel-tts';
+      document.getElementById('colabAsrAccelerator').value = colab.asr_accelerator || 'T4';
+      document.getElementById('colabTtsAccelerator').value = colab.tts_accelerator || 'T4';
       document.getElementById('tailscaleEnabled').checked = tailscale.enabled !== false;
       document.getElementById('tailscaleAsrHostname').value = tailscale.asr_hostname || 'ciel-asr';
       document.getElementById('tailscaleTtsHostname').value = tailscale.tts_hostname || 'ciel-tts';
@@ -601,8 +639,20 @@ def render_web_chat_page(
           model: document.getElementById('ttsModel').value,
           voice: document.getElementById('ttsVoice').value,
           language: document.getElementById('ttsLanguage').value,
+          ref_audio: pendingTtsReferenceAudio,
+          ref_text: document.getElementById('ttsReferenceText').value,
+          clear_ref_audio: document.getElementById('ttsClearReferenceAudio').checked,
           api_key: document.getElementById('ttsApiKey').value,
         }},
+        colab: {{
+          enabled: document.getElementById('colabEnabled').checked,
+          distribution: document.getElementById('colabDistribution').value,
+          auth: document.getElementById('colabAuth').value,
+          asr_session: document.getElementById('colabAsrSession').value,
+          tts_session: document.getElementById('colabTtsSession').value,
+          asr_accelerator: document.getElementById('colabAsrAccelerator').value,
+          tts_accelerator: document.getElementById('colabTtsAccelerator').value,
+        }},
         tailscale: {{
           enabled: document.getElementById('tailscaleEnabled').checked,
           asr_hostname: document.getElementById('tailscaleAsrHostname').value,
@@ -888,6 +938,18 @@ def render_web_chat_page(
       speechSettingsDialog.showModal();
     }});
     speechSettingsClose.addEventListener('click', () => speechSettingsDialog.close());
+    document.getElementById('ttsReferenceAudio').addEventListener('change', async event => {{
+      const file = event.target.files && event.target.files[0];
+      if (!file) return;
+      if (file.size > 10 * 1024 * 1024) {{
+        event.target.value = '';
+        addBubble('system', 'Reference voice must be 10 MB or smaller.');
+        return;
+      }}
+      pendingTtsReferenceAudio = await fileToDataUrl(file);
+      document.getElementById('ttsClearReferenceAudio').checked = false;
+      document.getElementById('ttsReferenceAudioStatus').textContent = file.name + ' (' + formatBytes(file.size) + ') ready to save';
+    }});
     speechSettingsForm.addEventListener('submit', async event => {{
       event.preventDefault();
       try {{

package/docs/COLAB_SPEECH.md

@@ -5,8 +5,8 @@ Ciel Runtime can proxy its web chat and OpenAI-compatible audio API to two Colab
 ## One-time prerequisites
 
 1. Authenticate the Colab CLI inside WSL. The installed CLI currently uses Google Application Default Credentials, so run `~/google-cloud-sdk/bin/gcloud auth application-default login` in `Ubuntu-26.04`.
-2. Create a reusable or ephemeral Tailscale auth key. In each Colab account/notebook Secret store, add `TAILSCALE_AUTHKEY` and grant notebook access.
-3. Optionally add the same `CIEL_SPEECH_API_KEY` secret to both workers. Enter that value once in Web Chat > Speech Settings; Ciel stores it server-side and never returns it to the browser.
+2. Create a reusable Tailscale auth key (two workers must register) and set it only for the current PowerShell process with `$env:TAILSCALE_AUTHKEY = Read-Host`. Alternatively, use a separate fresh key for each worker. The CLI passes the key without writing it to the repository. A Colab `TAILSCALE_AUTHKEY` Secret is also supported as a fallback.
+3. Optionally set `$env:CIEL_SPEECH_API_KEY = Read-Host` before deployment. Enter that value once in Web Chat > Speech Settings; Ciel stores it server-side and never returns it to the browser.
 
 ## Deploy
 
@@ -16,7 +16,11 @@ From PowerShell at the repository root:
 .\scripts\deploy_colab_speech.ps1
 ```
 
-The script creates `ciel-asr` and `ciel-tts` T4 sessions, installs Qwen3-ASR-0.6B and MOSS-TTS-Nano, starts Tailscale in userspace networking mode, publishes each localhost model server with Tailscale Serve, and saves both returned `base_url` values into Web Chat > Speech Settings automatically.
+Set the WSL distribution, authentication mode, ASR/TTS session names, and accelerators in **Web Chat > Speech Settings > Colab CLI connection**. These values are available through `GET|POST /ca/speech/config`; Ciel does not store Colab credentials. The deployment script reads the saved values automatically. Command-line parameters such as `-Distribution`, `-ColabAuth`, `-AsrSession`, and `-AsrAccelerator` override them for one run.
+
+The script reuses matching active sessions when possible, otherwise creates them, installs Qwen3-ASR-0.6B and MOSS-TTS-Nano, starts Tailscale in userspace networking mode, publishes each localhost model server with Tailscale Serve, and saves both returned `base_url` values into Web Chat > Speech Settings automatically.
+
+MOSS-TTS-Nano is a voice-cloning model without built-in speakers. Deployment configures the project's official `zh_1.wav` sample so the first request works immediately. In Web Chat > Speech Settings, upload a reference voice clip (10 MB maximum) to replace it. Ciel stores uploaded audio only in the local protected runtime configuration, omits it from configuration responses, and adds it to TTS requests automatically. API clients can instead pass `ref_audio` as an HTTP(S) URL or base64 audio data URL to `POST /v1/audio/speech`.
 
 Colab sessions are ephemeral. Re-run the bootstrap after a runtime reset. The workers are reachable only by devices in the same tailnet unless an administrator separately enables Tailscale Funnel.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oneciel-ai/ciel-runtime",
-  "version": "0.2.4",
+  "version": "0.2.6",
   "description": "Universal AI coding-agent runtime and model-routing layer for Claude, Codex, AGY, and compatible runtimes.",
   "license": "MIT",
   "author": "One Ciel LLC",

package/scripts/colab/bootstrap_moss_tts.py

@@ -9,6 +9,7 @@ from __future__ import annotations
 import json
 import os
 from pathlib import Path
+import site
 import shutil
 import subprocess
 import sys
@@ -38,7 +39,18 @@ def secret(name: str, *, required: bool = False) -> str:
 
 
 def run(*args: str, check: bool = True) -> subprocess.CompletedProcess[str]:
-    print("+", " ".join(args))
+    visible: list[str] = []
+    redact_next = False
+    for arg in args:
+        if redact_next:
+            visible.append("<redacted>")
+            redact_next = False
+        elif arg.startswith("--auth-key="):
+            visible.append("--auth-key=<redacted>")
+        else:
+            visible.append(arg)
+            redact_next = arg == "--api-key"
+    print("+", " ".join(visible))
     return subprocess.run(args, check=check, text=True, capture_output=False)
 
 
@@ -52,29 +64,33 @@ def start_tailscale(auth_key: str) -> tuple[str, str]:
     install_tailscale()
     LOG_DIR.mkdir(parents=True, exist_ok=True)
     tail_log = (LOG_DIR / "tailscale-tts.log").open("ab")
-    subprocess.Popen(
-        ["tailscaled", f"--socket={SOCKET}", f"--state={STATE}", "--tun=userspace-networking"],
-        stdout=tail_log,
-        stderr=subprocess.STDOUT,
-        start_new_session=True,
-    )
+    if not Path(SOCKET).exists():
+        subprocess.Popen(
+            ["tailscaled", f"--socket={SOCKET}", f"--state={STATE}", "--tun=userspace-networking"],
+            stdout=tail_log,
+            stderr=subprocess.STDOUT,
+            start_new_session=True,
+        )
     for _ in range(60):
         if Path(SOCKET).exists():
             break
         time.sleep(1)
-    run("tailscale", f"--socket={SOCKET}", "up", f"--auth-key={auth_key}", f"--hostname={HOSTNAME}", "--accept-dns=true", "--reset")
+    login = run("tailscale", f"--socket={SOCKET}", "up", f"--auth-key={auth_key}", f"--hostname={HOSTNAME}", "--accept-dns=true", "--reset", check=False)
+    if login.returncode:
+        raise RuntimeError("Tailscale authentication failed; use a valid reusable key or a fresh key for this second worker")
     status = subprocess.check_output(["tailscale", f"--socket={SOCKET}", "status", "--json"], text=True)
     dns_name = str(json.loads(status).get("Self", {}).get("DNSName") or HOSTNAME).rstrip(".")
-    serve = run("tailscale", f"--socket={SOCKET}", "serve", "--bg", "--https=443", f"http://127.0.0.1:{PORT}", check=False)
-    if serve.returncode == 0:
-        return dns_name, f"https://{dns_name}"
     run("tailscale", f"--socket={SOCKET}", "serve", "--bg", "--http=80", f"http://127.0.0.1:{PORT}")
     return dns_name, f"http://{dns_name}"
 
 
-def wait_for_server(api_key: str) -> None:
+def wait_for_server(api_key: str, process: subprocess.Popen[bytes]) -> None:
     headers = {"authorization": f"Bearer {api_key}"} if api_key else {}
     for _ in range(240):
+        if process.poll() is not None:
+            log_path = LOG_DIR / "moss-tts.log"
+            log_tail = log_path.read_text(encoding="utf-8", errors="replace")[-12000:] if log_path.exists() else "log unavailable"
+            raise RuntimeError(f"MOSS TTS exited with status {process.returncode}:\n{log_tail}")
         try:
             with urllib.request.urlopen(urllib.request.Request(f"http://127.0.0.1:{PORT}/health", headers=headers), timeout=3) as response:
                 if response.status < 500:
@@ -84,20 +100,48 @@ def wait_for_server(api_key: str) -> None:
     raise RuntimeError("MOSS TTS did not become healthy; inspect /content/ciel-speech-logs/moss-tts.log")
 
 
+def server_is_healthy(api_key: str) -> bool:
+    headers = {"authorization": f"Bearer {api_key}"} if api_key else {}
+    try:
+        with urllib.request.urlopen(urllib.request.Request(f"http://127.0.0.1:{PORT}/health", headers=headers), timeout=3) as response:
+            return response.status < 500
+    except Exception:
+        return False
+
+
 def main() -> None:
     auth_key = secret("TAILSCALE_AUTHKEY", required=True)
     api_key = secret("CIEL_SPEECH_API_KEY")
-    run(sys.executable, "-m", "pip", "install", "-U", "vllm-omni==0.24.0")
+    run(
+        sys.executable,
+        "-m",
+        "pip",
+        "install",
+        "-U",
+        "nvidia-cuda-runtime==13.0.96",
+        "vllm==0.24.0",
+        "vllm-omni==0.24.0",
+    )
     LOG_DIR.mkdir(parents=True, exist_ok=True)
-    command = [
-        "vllm", "serve", "OpenMOSS-Team/MOSS-TTS-Nano", "--omni", "--host", "127.0.0.1", "--port", str(PORT),
-        "--gpu-memory-utilization", "0.72", "--trust-remote-code", "--enforce-eager",
-    ]
-    if api_key:
-        command.extend(["--api-key", api_key])
-    server_log = (LOG_DIR / "moss-tts.log").open("ab")
-    subprocess.Popen(command, stdout=server_log, stderr=subprocess.STDOUT, start_new_session=True)
-    wait_for_server(api_key)
+    if not server_is_healthy(api_key):
+        command = [
+            "vllm-omni", "serve", "OpenMOSS-Team/MOSS-TTS-Nano", "--omni", "--host", "127.0.0.1", "--port", str(PORT),
+            "--gpu-memory-utilization", "0.72",
+        ]
+        if api_key:
+            command.extend(["--api-key", api_key])
+        server_env = os.environ.copy()
+        cuda_runtime_libraries = [
+            library
+            for package_dir in site.getsitepackages()
+            for library in Path(package_dir).glob("**/libcudart.so.13")
+        ]
+        if cuda_runtime_libraries:
+            existing_library_path = server_env.get("LD_LIBRARY_PATH", "")
+            server_env["LD_LIBRARY_PATH"] = str(cuda_runtime_libraries[0].parent) + (f":{existing_library_path}" if existing_library_path else "")
+        server_log = (LOG_DIR / "moss-tts.log").open("ab")
+        process = subprocess.Popen(command, stdout=server_log, stderr=subprocess.STDOUT, start_new_session=True, env=server_env)
+        wait_for_server(api_key, process)
     dns_name, base_url = start_tailscale(auth_key)
     print(json.dumps({"ok": True, "role": "tts", "hostname": dns_name, "base_url": base_url, "model": "OpenMOSS-Team/MOSS-TTS-Nano", "api_key_set": bool(api_key)}, indent=2))
 

package/scripts/colab/bootstrap_qwen_asr.py

@@ -38,7 +38,18 @@ def secret(name: str, *, required: bool = False) -> str:
 
 
 def run(*args: str, check: bool = True) -> subprocess.CompletedProcess[str]:
-    print("+", " ".join(args))
+    visible: list[str] = []
+    redact_next = False
+    for arg in args:
+        if redact_next:
+            visible.append("<redacted>")
+            redact_next = False
+        elif arg.startswith("--auth-key="):
+            visible.append("--auth-key=<redacted>")
+        else:
+            visible.append(arg)
+            redact_next = arg == "--api-key"
+    print("+", " ".join(visible))
     return subprocess.run(args, check=check, text=True, capture_output=False)
 
 
@@ -62,12 +73,11 @@ def start_tailscale(auth_key: str) -> tuple[str, str]:
         if Path(SOCKET).exists():
             break
         time.sleep(1)
-    run("tailscale", f"--socket={SOCKET}", "up", f"--auth-key={auth_key}", f"--hostname={HOSTNAME}", "--accept-dns=true", "--reset")
+    login = run("tailscale", f"--socket={SOCKET}", "up", f"--auth-key={auth_key}", f"--hostname={HOSTNAME}", "--accept-dns=true", "--reset", check=False)
+    if login.returncode:
+        raise RuntimeError("Tailscale authentication failed; use a valid reusable key or a fresh key for this worker")
     status = subprocess.check_output(["tailscale", f"--socket={SOCKET}", "status", "--json"], text=True)
     dns_name = str(json.loads(status).get("Self", {}).get("DNSName") or HOSTNAME).rstrip(".")
-    serve = run("tailscale", f"--socket={SOCKET}", "serve", "--bg", "--https=443", f"http://127.0.0.1:{PORT}", check=False)
-    if serve.returncode == 0:
-        return dns_name, f"https://{dns_name}"
     run("tailscale", f"--socket={SOCKET}", "serve", "--bg", "--http=80", f"http://127.0.0.1:{PORT}")
     return dns_name, f"http://{dns_name}"
 

package/scripts/configure_speech_workers.py

@@ -3,6 +3,7 @@
 from __future__ import annotations
 
 import argparse
+import json
 from pathlib import Path
 import sys
 from typing import Any
@@ -10,25 +11,94 @@ from typing import Any
 sys.path.insert(0, str(Path(__file__).resolve().parents[1]))
 
 
-def configure(asr_base_url: str, tts_base_url: str) -> dict[str, Any]:
+DEFAULT_TTS_REFERENCE_AUDIO = "https://raw.githubusercontent.com/OpenMOSS/MOSS-TTS-Nano/main/assets/audio/zh_1.wav"
+DEFAULT_COLAB_SETTINGS: dict[str, Any] = {
+    "enabled": True,
+    "distribution": "Ubuntu-26.04",
+    "auth": "adc",
+    "asr_session": "ciel-asr",
+    "tts_session": "ciel-tts",
+    "asr_accelerator": "T4",
+    "tts_accelerator": "T4",
+}
+
+
+def colab_settings(config: dict[str, Any] | None = None) -> dict[str, Any]:
+    import ciel_runtime
+
+    active = config if config is not None else ciel_runtime.load_config()
+    speech = active.get("speech") if isinstance(active.get("speech"), dict) else {}
+    saved = speech.get("colab") if isinstance(speech.get("colab"), dict) else {}
+    return {**DEFAULT_COLAB_SETTINGS, **saved}
+
+
+def configure(
+    asr_base_url: str,
+    tts_base_url: str,
+    tts_reference_audio: str = DEFAULT_TTS_REFERENCE_AUDIO,
+    *,
+    distribution: str | None = None,
+    auth: str | None = None,
+    asr_session: str | None = None,
+    tts_session: str | None = None,
+    asr_accelerator: str | None = None,
+    tts_accelerator: str | None = None,
+) -> dict[str, Any]:
     import ciel_runtime
 
     config = ciel_runtime.load_config()
     speech = config.setdefault("speech", {})
     asr = speech.setdefault("asr", {})
     tts = speech.setdefault("tts", {})
+    colab = colab_settings(config)
+    overrides = {
+        "distribution": distribution,
+        "auth": auth,
+        "asr_session": asr_session,
+        "tts_session": tts_session,
+        "asr_accelerator": asr_accelerator,
+        "tts_accelerator": tts_accelerator,
+    }
+    colab.update({key: value for key, value in overrides.items() if value is not None})
+    colab["enabled"] = True
+    speech["colab"] = colab
     asr.update({"enabled": True, "base_url": asr_base_url.rstrip("/"), "model": "Qwen/Qwen3-ASR-0.6B"})
     tts.update({"enabled": True, "base_url": tts_base_url.rstrip("/"), "model": "OpenMOSS-Team/MOSS-TTS-Nano"})
+    if tts_reference_audio and not str(tts.get("ref_audio") or "").strip():
+        tts["ref_audio"] = tts_reference_audio
     ciel_runtime.save_config(config)
-    return {"asr": asr["base_url"], "tts": tts["base_url"]}
+    return {"asr": asr["base_url"], "tts": tts["base_url"], "colab": colab}
 
 
 def main() -> int:
     parser = argparse.ArgumentParser()
-    parser.add_argument("--asr-base-url", required=True)
-    parser.add_argument("--tts-base-url", required=True)
+    parser.add_argument("--asr-base-url")
+    parser.add_argument("--tts-base-url")
+    parser.add_argument("--tts-reference-audio", default=DEFAULT_TTS_REFERENCE_AUDIO)
+    parser.add_argument("--distribution")
+    parser.add_argument("--auth", choices=("adc", "oauth2"))
+    parser.add_argument("--asr-session")
+    parser.add_argument("--tts-session")
+    parser.add_argument("--asr-accelerator")
+    parser.add_argument("--tts-accelerator")
+    parser.add_argument("--print-colab-settings", action="store_true")
     args = parser.parse_args()
-    result = configure(args.asr_base_url, args.tts_base_url)
+    if args.print_colab_settings:
+        print(json.dumps(colab_settings(), separators=(",", ":")))
+        return 0
+    if not args.asr_base_url or not args.tts_base_url:
+        parser.error("--asr-base-url and --tts-base-url are required unless --print-colab-settings is used")
+    result = configure(
+        args.asr_base_url,
+        args.tts_base_url,
+        args.tts_reference_audio,
+        distribution=args.distribution,
+        auth=args.auth,
+        asr_session=args.asr_session,
+        tts_session=args.tts_session,
+        asr_accelerator=args.asr_accelerator,
+        tts_accelerator=args.tts_accelerator,
+    )
     print(f"Configured Ciel speech workers: ASR={result['asr']} TTS={result['tts']}")
     return 0
 

package/scripts/deploy_colab_speech.ps1

@@ -1,34 +1,70 @@
 param(
-    [string]$Distribution = "Ubuntu-26.04",
-    [string]$AsrSession = "ciel-asr",
-    [string]$TtsSession = "ciel-tts"
+    [string]$Distribution,
+    [string]$ColabAuth,
+    [string]$AsrSession,
+    [string]$TtsSession,
+    [string]$AsrAccelerator,
+    [string]$TtsAccelerator
 )
 
 $ErrorActionPreference = "Stop"
 $repo = (Resolve-Path (Join-Path $PSScriptRoot "..")).Path
+$settingsJson = (& python (Join-Path $PSScriptRoot "configure_speech_workers.py") --print-colab-settings) -join "`n"
+if ($LASTEXITCODE -ne 0) { throw "Could not read Ciel Colab settings." }
+$settings = $settingsJson | ConvertFrom-Json
+if ($settings.enabled -eq $false) { throw "Colab worker management is disabled in Web Chat > Speech Settings." }
+if ([string]::IsNullOrWhiteSpace($Distribution)) { $Distribution = [string]$settings.distribution }
+if ([string]::IsNullOrWhiteSpace($ColabAuth)) { $ColabAuth = [string]$settings.auth }
+if ([string]::IsNullOrWhiteSpace($AsrSession)) { $AsrSession = [string]$settings.asr_session }
+if ([string]::IsNullOrWhiteSpace($TtsSession)) { $TtsSession = [string]$settings.tts_session }
+if ([string]::IsNullOrWhiteSpace($AsrAccelerator)) { $AsrAccelerator = [string]$settings.asr_accelerator }
+if ([string]::IsNullOrWhiteSpace($TtsAccelerator)) { $TtsAccelerator = [string]$settings.tts_accelerator }
+if ($Distribution -notmatch '^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$') { throw "Invalid WSL distribution name." }
+if ($ColabAuth -notin @('adc', 'oauth2')) { throw "ColabAuth must be adc or oauth2." }
+foreach ($session in @($AsrSession, $TtsSession)) {
+    if ($session -notmatch '^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$') { throw "Invalid Colab session name: $session" }
+}
+foreach ($accelerator in @($AsrAccelerator, $TtsAccelerator)) {
+    if ($accelerator -notin @('T4', 'L4', 'G4', 'A100', 'H100')) { throw "Unsupported Colab accelerator: $accelerator" }
+}
 $wslRepo = (& wsl -d $Distribution -- wslpath -a ($repo -replace '\\', '/')).Trim()
 if (-not $wslRepo) { throw "Could not resolve the repository path in WSL." }
+$bootstrapEnv = ""
+if ($env:TAILSCALE_AUTHKEY) {
+    if ($env:TAILSCALE_AUTHKEY -notmatch '^tskey-[A-Za-z0-9_-]+$') { throw "TAILSCALE_AUTHKEY has an unexpected format." }
+    $bootstrapEnv += " --env TAILSCALE_AUTHKEY=$($env:TAILSCALE_AUTHKEY)"
+}
+if ($env:CIEL_SPEECH_API_KEY) {
+    if ($env:CIEL_SPEECH_API_KEY -match '[\s''"]') { throw "CIEL_SPEECH_API_KEY cannot contain whitespace or quotes for CLI deployment." }
+    $bootstrapEnv += " --env CIEL_SPEECH_API_KEY=$($env:CIEL_SPEECH_API_KEY)"
+}
 
 Write-Host "Checking Colab CLI authentication..."
-& wsl -d $Distribution -- bash -lc "colab status >/dev/null"
+& wsl -d $Distribution -- bash -lc "colab --auth $ColabAuth status >/dev/null"
 if ($LASTEXITCODE -ne 0) {
-    throw "Colab CLI is not authenticated. Configure ADC in WSL (gcloud auth application-default login), then rerun."
+    throw "Colab CLI is not authenticated with '$ColabAuth' in WSL '$Distribution'."
 }
 
-Write-Host "Creating ASR T4 session: $AsrSession"
-& wsl -d $Distribution -- bash -lc "colab new --gpu T4 --session '$AsrSession'"
-if ($LASTEXITCODE -ne 0) { throw "Could not create ASR Colab session." }
+function Ensure-ColabSession([string]$Session, [string]$Accelerator, [string]$Role) {
+    & wsl -d $Distribution -- bash -lc "colab --auth $ColabAuth status --session '$Session' >/dev/null 2>&1"
+    if ($LASTEXITCODE -eq 0) {
+        Write-Host "Reusing $Role $Accelerator session: $Session"
+        return
+    }
+    Write-Host "Creating $Role $Accelerator session: $Session"
+    & wsl -d $Distribution -- bash -lc "colab --auth $ColabAuth new --gpu $Accelerator --session '$Session'"
+    if ($LASTEXITCODE -ne 0) { throw "Could not create $Role Colab session." }
+}
 
-Write-Host "Creating TTS T4 session: $TtsSession"
-& wsl -d $Distribution -- bash -lc "colab new --gpu T4 --session '$TtsSession'"
-if ($LASTEXITCODE -ne 0) { throw "Could not create TTS Colab session." }
+Ensure-ColabSession $AsrSession $AsrAccelerator "ASR"
+Ensure-ColabSession $TtsSession $TtsAccelerator "TTS"
 
 Write-Host "Installing Qwen3-ASR and its Tailscale service..."
-$asrOutput = (& wsl -d $Distribution -- bash -lc "colab exec --session '$AsrSession' --file '$wslRepo/scripts/colab/bootstrap_qwen_asr.py'" 2>&1 | Tee-Object -Variable asrDisplay) -join "`n"
+$asrOutput = (& wsl -d $Distribution -- bash -lc "colab --auth $ColabAuth exec --session '$AsrSession'$bootstrapEnv --file '$wslRepo/scripts/colab/bootstrap_qwen_asr.py'" 2>&1 | Tee-Object -Variable asrDisplay) -join "`n"
 if ($LASTEXITCODE -ne 0) { throw "ASR bootstrap failed." }
 
 Write-Host "Installing MOSS-TTS-Nano and its Tailscale service..."
-$ttsOutput = (& wsl -d $Distribution -- bash -lc "colab exec --session '$TtsSession' --file '$wslRepo/scripts/colab/bootstrap_moss_tts.py'" 2>&1 | Tee-Object -Variable ttsDisplay) -join "`n"
+$ttsOutput = (& wsl -d $Distribution -- bash -lc "colab --auth $ColabAuth exec --session '$TtsSession'$bootstrapEnv --file '$wslRepo/scripts/colab/bootstrap_moss_tts.py'" 2>&1 | Tee-Object -Variable ttsDisplay) -join "`n"
 if ($LASTEXITCODE -ne 0) { throw "TTS bootstrap failed." }
 
 function Read-BootstrapResult([string]$Text, [string]$Role) {
@@ -41,7 +77,7 @@ function Read-BootstrapResult([string]$Text, [string]$Role) {
 
 $asr = Read-BootstrapResult $asrOutput "asr"
 $tts = Read-BootstrapResult $ttsOutput "tts"
-& python (Join-Path $PSScriptRoot "configure_speech_workers.py") --asr-base-url $asr.base_url --tts-base-url $tts.base_url
+& python (Join-Path $PSScriptRoot "configure_speech_workers.py") --asr-base-url $asr.base_url --tts-base-url $tts.base_url --distribution $Distribution --auth $ColabAuth --asr-session $AsrSession --tts-session $TtsSession --asr-accelerator $AsrAccelerator --tts-accelerator $TtsAccelerator
 if ($LASTEXITCODE -ne 0) { throw "Workers started, but Ciel speech configuration failed." }
 
 Write-Host "Both services are running and connected to Web Chat > Speech Settings."