Summary

Implements the performance audit findings in docs/performance-audit.md, then fixes correctness/concurrency issues found via review and a follow-up targeted sweep.

Performance sweep:

• Add Dictionary-backed name/ID indexes to ShortcutRepository, kept in sync across load/mutate/undo/redo
• Add async preload/reload paths so shortcut file I/O doesn't block first query
• Parallelize GitRepoDiscovery with a bounded worker pool, preserving result ordering and scan limits
• Cut LINQ/allocation churn in Search()/SearchForRootPalette() via span-based query matching
• Reduce undo/redo history retention from 50 → 25 snapshots
• Dedupe WtProfilesService JSON parsing into a single ReadProfilesFromJson path
• Defer default-profile choice enumeration at settings-manager construction, with opt-in startup timing via QUICKSHELL_STARTUP_TRACE=1

Bugs found and fixed during review:

• HIGH: the deferred default-profile choice enumeration validated against the minimal ctor-seeded choice list instead of the live terminal catalog, silently resetting a user's custom default terminal profile on every shortcut launch until they opened the settings form. Now validates against the live catalog.
• HIGH: TerminalCatalog's cached fields were read outside the lock after EnsureCached() returned, so a concurrent InvalidateCache() could null them mid-read and throw NullReferenceException. Bundled the cache into one atomically-swapped snapshot object.
• HIGH: ShortcutForm subscribed to the static, process-lifetime Drafts.Cleared event with no reliable unsubscribe path if the form was abandoned (Escape, navigating away) instead of explicitly saved/canceled, permanently rooting the instance. Subscribes via a weak-reference trampoline now.
• HIGH (bottleneck): GitRepoIndex.EnsureFresh held its lock for the full duration of the multi-second, multi-thousand-directory filesystem scan, serializing every other cache reader/invalidator behind it. The scan now runs off-lock via a coalesced single-flight task.
• MEDIUM: hardened GitRepoDiscovery's pending-work counter so the stop-check and increment can't interleave, closing a theoretical stranded-item race in the parallel worker pool. Also switched child-directory enumeration to a streaming iterator so ShouldStop()/MaxDirectoriesScanned can short-circuit a very wide directory instead of materializing it via ToArray() first.
• MEDIUM: ShortcutRepository.Dispose() disposed the persist timer without waiting for an in-flight callback, then immediately disposed the semaphore/mutex the callback uses — a shutdown race that could throw ObjectDisposedException on a background thread. Switched to Timer.Dispose(WaitHandle) to block until any in-flight callback finishes first.
• MEDIUM: SettingsFormHelpers.ScheduleRefresh's fire-and-forget task had no exception handling, so a failure became an unobserved task exception. Now catches only the expected teardown exceptions (ObjectDisposedException, COMException); anything else still surfaces.
• LOW: ShortcutFormTemplateCache now builds its template outside the lock so one slow build doesn't block unrelated callers.
• LOW: removed dead ScheduleDebouncedReload code whose shared process-static CancellationTokenSource would have incorrectly canceled unrelated callers' pending reloads if it were ever wired up for more than one debounce source.

Security:

• Removed sandbox_mode = "danger-full-access" / approval_policy = "never" from the committed .codex/config.toml — these granted full filesystem/network access with no approval gate to anyone cloning the repo or running Codex in CI. Left a comment pointing at setting them locally (untracked) instead.

Clarity:

• Reworded the recent-workspaces setting's label/description to state plainly it's an on/off toggle with a fixed cap, not a literal count (the underlying NormalizeCount treats any non-zero value as "on").

Test plan

• dotnet build QuickShell.sln
• dotnet test QuickShell.Core.Tests\QuickShell.Core.Tests.csproj — 179 passed
• Manual smoke test of shortcut launch with a custom default terminal profile set

🤖 Generated with Claude Code