musingfox · Oct 1, 2026 · Oct 1, 2026 · Oct 1, 2026 · Oct 1, 2026 · Oct 1, 2026
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -7,6 +7,14 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Fixed
+- Over-long text for ElevenLabs and xAI TTS no longer crashes sumvox when it contains Chinese or other multi-byte characters; it is cut at a character boundary.
+- `--rate` is now optional: when omitted, the `rate` from your config (or the engine default) is used instead of being overwritten with 200.
+- An unknown `--tts` value now fails with an error naming it, instead of silently running the whole fallback chain.
+- `--provider` now keeps the matching config entry's `base_url` and `timeout`; `--model` only replaces the model.
+- Concurrent playbacks no longer overwrite each other's temporary audio file.
+- The Google Cloud TTS token request no longer uses system proxy detection, avoiding the macOS CoreFoundation crash.
+
 ## [1.9.0] - 2026-09-04
 
 ### Added

diff --git a/src/audio/player.rs b/src/audio/player.rs
@@ -9,6 +9,7 @@
 use std::io::Read;
 use std::path::{Path, PathBuf};
 use std::process::{Command, Stdio};
+use std::sync::atomic::{AtomicU64, Ordering};
 use std::sync::mpsc;
 use std::time::Duration;
 
@@ -17,6 +18,8 @@ use crate::error::{Result, VoiceError};
 /// Wall-clock cap on a single playback. The cap exists to break a wedged
 /// player, not to police latency, so it is deliberately generous: any realistic
 /// notification or read-aloud summary finishes far inside it.
+static TEMP_SEQ: AtomicU64 = AtomicU64::new(0);
+
 const PLAYBACK_TIMEOUT: Duration = Duration::from_secs(120);
 
 /// Players we try, in descending order of "likely installed AND honours
@@ -334,6 +337,38 @@ pub fn play_bytes(audio_data: &[u8], volume: u32, temp_file_prefix: &str) -> Res
     )
 }
 
+/// A temp path unique to this call, so concurrent playbacks (threads or
+/// processes) never overwrite each other's audio.
+pub(crate) fn unique_temp_path(prefix: &str, ext: &str) -> PathBuf {
+    std::env::temp_dir().join(format!(
+        "{prefix}_{}_{}.{ext}",
+        std::process::id(),
+        TEMP_SEQ.fetch_add(1, Ordering::Relaxed)
+    ))
+}
+
+/// Write `data` to a fresh [`unique_temp_path`]. `create_new` refuses a path
+/// that already exists (including a planted symlink) and the file is
+/// owner-only, since the name is predictable in a shared temp dir.
+pub(crate) fn write_temp_audio(prefix: &str, ext: &str, data: &[u8]) -> Result<PathBuf> {
+    let path = unique_temp_path(prefix, ext);
+    write_exclusive(&path, data)
+        .map_err(|e| VoiceError::Voice(format!("Failed to write temp audio: {}", e)))?;
+    Ok(path)
+}
+
+fn write_exclusive(path: &Path, data: &[u8]) -> std::io::Result<()> {
+    use std::io::Write;
+    use std::os::unix::fs::OpenOptionsExt;
+
+    std::fs::OpenOptions::new()
+        .write(true)
+        .create_new(true)
+        .mode(0o600)
+        .open(path)
+        .and_then(|mut f| f.write_all(data))
-        .and_then(|mut f| f.write_all(data))
+        .and_then(|mut f| {
+            let result = f.write_all(data);
+            drop(f);
+            if result.is_err() {
+                let _ = std::fs::remove_file(path);
+            }
+            result
+        })
-        .and_then(|mut f| f.write_all(data))
+        .and_then(|mut f| {
+            let result = f.write_all(data);
+            drop(f);
+            if result.is_err() {
+                let _ = std::fs::remove_file(path);
+            }
+            result
+        })
+}
+
 /// [`play_bytes`] with the candidate list and timeout injected, for tests.
 pub fn play_bytes_with(
     candidates: &[&str],
@@ -342,19 +377,14 @@ pub fn play_bytes_with(
     temp_file_prefix: &str,
     timeout: Duration,
 ) -> Result<()> {
-    use std::io::Write;
-
     tracing::debug!(
         "Playing {} bytes, volume: {}, prefix: {}",
         audio_data.len(),
         volume,
         temp_file_prefix
     );
 
-    let tmp_path = std::env::temp_dir().join(format!("{}.wav", temp_file_prefix));
-    std::fs::File::create(&tmp_path)
-        .and_then(|mut f| f.write_all(audio_data))
-        .map_err(|e| VoiceError::Voice(format!("Failed to write temp WAV: {}", e)))?;
+    let tmp_path = write_temp_audio(temp_file_prefix, "wav", audio_data)?;
 
     // Capture the result before cleanup so the temp file is removed on every
     // path — including a spawn failure, which a bare `?` would have skipped,
@@ -598,13 +628,50 @@ mod tests {
         crate::audio::wav_header::create_wav_file(&[0x00, 0x00], 24000, 1, 16)
     }
 
+    fn leftover_temp_files(prefix: &str) -> usize {
+        std::fs::read_dir(std::env::temp_dir())
+            .unwrap()
+            .filter_map(|e| e.ok())
+            .filter(|e| e.file_name().to_string_lossy().starts_with(prefix))
+            .count()
+    }
+
+    #[test]
+    fn test_unique_temp_path_differs_per_call() {
+        let a = unique_temp_path("sumvox_test_unique", "wav");
+        let b = unique_temp_path("sumvox_test_unique", "wav");
+        assert_ne!(a, b);
+        assert_eq!(a.extension().unwrap(), "wav");
+    }
+
+    #[test]
+    fn test_write_temp_audio_refuses_existing_path_and_is_owner_only() {
+        use std::os::unix::fs::PermissionsExt;
+
+        let path = write_temp_audio("sumvox_test_write", "wav", b"x").unwrap();
+        let mode = std::fs::metadata(&path).unwrap().permissions().mode();
+        assert_eq!(mode & 0o777, 0o600);
+
+        let planted = unique_temp_path("sumvox_test_planted", "wav");
+        std::fs::write(&planted, b"planted").unwrap();
+        assert!(
+            write_exclusive(&planted, b"x").is_err(),
+            "an existing path must not be reused"
+        );
+        assert_eq!(std::fs::read(&planted).unwrap(), b"planted");
+
+        let _ = std::fs::remove_file(&path);
+        let _ = std::fs::remove_file(&planted);
+    }
+
     #[test]
     fn test_play_bytes_with_removes_temp_file_on_success() {
         let prefix = "sumvox_test_bytes_ok";
         let result = play_bytes_with(&["true"], &create_test_wav(), 50, prefix, FIVE_SECONDS);
         assert!(result.is_ok(), "unexpected error: {:?}", result.err());
-        assert!(
-            !std::env::temp_dir().join(format!("{prefix}.wav")).exists(),
+        assert_eq!(
+            leftover_temp_files(prefix),
+            0,
             "temp file must not survive a successful playback"
         );
     }
@@ -616,8 +683,9 @@ mod tests {
             .expect_err("a player exiting non-zero must never report success")
             .to_string();
         assert!(err.contains("Audio playback failed"), "unexpected: {err}");
-        assert!(
-            !std::env::temp_dir().join(format!("{prefix}.wav")).exists(),
+        assert_eq!(
+            leftover_temp_files(prefix),
+            0,
             "temp file must be removed on the error path too"
         );
     }

diff --git a/src/cli.rs b/src/cli.rs
@@ -48,15 +48,15 @@ pub struct SayArgs {
     #[arg(long)]
     pub voice: Option<String>,
 
-    /// Speech rate in words per minute
+    /// Speech rate in words per minute (overrides the configured rate)
     ///
     /// macos: passed to `say -r`.
     /// espeak: passed to `espeak-ng -s` (clamped to 80-450).
     /// piper: mapped onto --length-scale, where 200 is piper's default speed and
     /// a higher value speaks faster.
     /// Ignored by the cloud engines (google, cloud_tts, xai, elevenlabs, openai).
-    #[arg(long, default_value = "200")]
-    pub rate: u32,
+    #[arg(long)]
+    pub rate: Option<u32>,
 
     /// Volume level (0-100)
     #[arg(long)]
@@ -99,15 +99,15 @@ pub struct SumArgs {
     #[arg(long)]
     pub voice: Option<String>,
 
-    /// Speech rate in words per minute
+    /// Speech rate in words per minute (overrides the configured rate)
     ///
     /// macos: passed to `say -r`.
     /// espeak: passed to `espeak-ng -s` (clamped to 80-450).
     /// piper: mapped onto --length-scale, where 200 is piper's default speed and
     /// a higher value speaks faster.
     /// Ignored by the cloud engines (google, cloud_tts, xai, elevenlabs, openai).
-    #[arg(long, default_value = "200")]
-    pub rate: u32,
+    #[arg(long)]
+    pub rate: Option<u32>,
 
     /// Volume level (0-100)
     #[arg(long)]

diff --git a/src/config.rs b/src/config.rs
@@ -843,6 +843,7 @@ mod tests {
 
     #[test]
     fn test_get_openai_api_key_from_config() {
+        let _env = crate::test_support::env_guard();
         let provider = openai_tts_provider(Some("sk-test".to_string()));
         assert_eq!(provider.get_openai_api_key(), Some("sk-test".to_string()));
 

diff --git a/src/main.rs b/src/main.rs
@@ -11,6 +11,8 @@ mod notify_log;
 mod pipeline;
 mod provider_factory;
 mod queue;
+#[cfg(test)]
+mod test_support;
 mod transcript;
 mod tts;
 

diff --git a/src/pipeline.rs b/src/pipeline.rs
@@ -4,7 +4,7 @@
 use std::time::Duration;
 
 use crate::config::{effective_disable_thinking, SumvoxConfig, TtsProviderConfig};
-use crate::error::Result;
+use crate::error::{Result, VoiceError};
 use crate::llm::{GenerationRequest, LlmProvider};
 use crate::notify_log;
 use crate::provider_factory::ProviderFactory;
@@ -18,7 +18,7 @@ use crate::tts::{
 pub struct TtsOptions {
     pub engine: String,
     pub voice: Option<String>,
-    pub rate: u32,
+    pub rate: Option<u32>,
     pub volume: Option<u32>,
 }
 
@@ -27,7 +27,7 @@ impl Default for TtsOptions {
         Self {
             engine: "auto".to_string(),
             voice: None,
-            rate: 200,
+            rate: None,
             volume: None,
         }
     }
@@ -119,6 +119,7 @@ pub async fn generate_summary(
             model_name,
             timeout,
             api_key.as_deref(),
+            matching_provider,
         ) {
             Ok(provider) => {
                 if !provider.is_available() {
@@ -215,44 +216,77 @@ async fn generate_with_fallback(attempts: &mut dyn Iterator<Item = LlmAttempt>)
     String::new()
 }
 
+enum EngineChoice<'a> {
+    Engine(TtsEngine),
+    Named(&'a TtsProviderConfig),
+}
+
+/// Interpret `--tts`: "auto"/empty, a known engine alias, or the exact name of a
+/// configured provider. Anything else is an error rather than a silent fallback.
+fn select_engine<'a>(name: &str, providers: &'a [TtsProviderConfig]) -> Result<EngineChoice<'a>> {
+    if name.is_empty() {
+        return Ok(EngineChoice::Engine(TtsEngine::Auto));
+    }
+    if let Ok(engine) = name.parse::<TtsEngine>() {
+        return Ok(EngineChoice::Engine(engine));
+    }
+    providers
+        .iter()
+        .find(|p| p.name.to_lowercase() == name)
+        .map(EngineChoice::Named)
+        .ok_or_else(|| {
+            VoiceError::Config(format!(
+                "Unknown TTS engine '{}': not a known engine or a configured provider name",
+                name
+            ))
+        })
+}
+
 /// Speak text using TTS
 pub async fn speak_text(config: &SumvoxConfig, tts_opts: &TtsOptions, text: &str) -> Result<()> {
+    // The raw engine name disambiguates entries that share one TtsEngine
+    // (cloud_tts vs gemini_tts); resolve_tts_provider matches it exactly first.
+    let engine_name = tts_opts.engine.to_lowercase();
+    let choice = select_engine(&engine_name, &config.tts.providers)?;
+
     // Record every agent voice report (even when muted) for the menu bar app.
     notify_log::record(text);
     if notify_log::is_muted() {
         tracing::info!("Voice muted via menu bar app, skipping TTS");
         return Ok(());
     }
 
-    // The raw engine name disambiguates entries that share one TtsEngine
-    // (cloud_tts vs gemini_tts); resolve_tts_provider matches it exactly first.
-    let engine_name = tts_opts.engine.to_lowercase();
-    let tts_engine = tts_opts.engine.parse().unwrap_or(TtsEngine::Auto);
-
     // Create TTS provider: CLI override or config fallback chain
-    let provider: Box<dyn TtsProvider> = match tts_engine {
-        TtsEngine::Auto => {
+    let provider: Box<dyn TtsProvider> = match choice {
+        EngineChoice::Named(entry) => resolve_tts_provider(
+            &config.tts.providers,
+            &[entry.name.to_lowercase().as_str()],
+            tts_opts.voice.as_deref(),
+            tts_opts.rate,
+            tts_opts.volume,
+        )?,
+        EngineChoice::Engine(TtsEngine::Auto) => {
             // Use config fallback chain
             create_tts_from_config(&config.tts.providers)?
         }
         // An explicitly selected engine overrides which configured provider to use;
         // all attributes come from that config entry, with only explicit CLI/hook
         // voice/volume layered on top. Nothing is hardcoded.
-        TtsEngine::MacOS => resolve_tts_provider(
+        EngineChoice::Engine(TtsEngine::MacOS) => resolve_tts_provider(
             &config.tts.providers,
             &["macos", "say"],
             tts_opts.voice.as_deref(),
             tts_opts.rate,
             tts_opts.volume,
         )?,
-        TtsEngine::Google => resolve_tts_provider(
+        EngineChoice::Engine(TtsEngine::Google) => resolve_tts_provider(
             &config.tts.providers,
             &["google", "google_tts", "gcloud", "gemini"],
             tts_opts.voice.as_deref(),
             tts_opts.rate,
             tts_opts.volume,
         )?,
-        TtsEngine::CloudTts => resolve_tts_provider(
+        EngineChoice::Engine(TtsEngine::CloudTts) => resolve_tts_provider(
             &config.tts.providers,
             &[
                 engine_name.as_str(),
@@ -265,42 +299,42 @@ pub async fn speak_text(config: &SumvoxConfig, tts_opts: &TtsOptions, text: &str
             tts_opts.rate,
             tts_opts.volume,
         )?,
-        TtsEngine::AudioFile => resolve_tts_provider(
+        EngineChoice::Engine(TtsEngine::AudioFile) => resolve_tts_provider(
             &config.tts.providers,
             &["audio_file", "audio", "file"],
             tts_opts.voice.as_deref(),
             tts_opts.rate,
             tts_opts.volume,
         )?,
-        TtsEngine::Xai => resolve_tts_provider(
+        EngineChoice::Engine(TtsEngine::Xai) => resolve_tts_provider(
             &config.tts.providers,
             &["xai", "xai_tts", "grok"],
             tts_opts.voice.as_deref(),
             tts_opts.rate,
             tts_opts.volume,
         )?,
-        TtsEngine::ElevenLabs => resolve_tts_provider(
+        EngineChoice::Engine(TtsEngine::ElevenLabs) => resolve_tts_provider(
             &config.tts.providers,
             &["elevenlabs", "eleven_labs", "11labs"],
             tts_opts.voice.as_deref(),
             tts_opts.rate,
             tts_opts.volume,
         )?,
-        TtsEngine::OpenAi => resolve_tts_provider(
+        EngineChoice::Engine(TtsEngine::OpenAi) => resolve_tts_provider(
             &config.tts.providers,
             &["openai", "openai_tts"],
             tts_opts.voice.as_deref(),
             tts_opts.rate,
             tts_opts.volume,
         )?,
-        TtsEngine::Espeak => resolve_tts_provider(
+        EngineChoice::Engine(TtsEngine::Espeak) => resolve_tts_provider(
             &config.tts.providers,
             &["espeak", "espeak_ng", "espeak-ng"],
             tts_opts.voice.as_deref(),
             tts_opts.rate,
             tts_opts.volume,
         )?,
-        TtsEngine::Piper => resolve_tts_provider(
+        EngineChoice::Engine(TtsEngine::Piper) => resolve_tts_provider(
             &config.tts.providers,
             &["piper", "piper_tts"],
             tts_opts.voice.as_deref(),
@@ -321,8 +355,8 @@ pub async fn speak_text(config: &SumvoxConfig, tts_opts: &TtsOptions, text: &str
     }
 
     // Speak with error handling and fallback for Auto mode
-    match tts_engine {
-        TtsEngine::Auto => {
+    match choice {
+        EngineChoice::Engine(TtsEngine::Auto) => {
             // For Auto mode, try all providers in config order
             // Pass volume override so hook-level volume (stop_volume/notification_volume) is applied
             speak_with_provider_fallback(&config.tts.providers, text, tts_opts.volume).await