laurentiu021 · laurentiu021 · May 13, 2026 · May 13, 2026 · coderabbitai · May 13, 2026
@@ -6,6 +6,49 @@ adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ## [Unreleased]
 
+## [0.49.0] - 2026-05-13
+
+### Fixed
+- **Binding: BatteryInfo** — add NotifyPropertyChangedFor on DesignCapacityMWh,
+  FullChargeCapacityMWh, EstimatedRuntimeMinutes for computed properties
+  HealthPercent, WearPercent, RuntimeDisplay (BIND-001).
+- **Binding: DiskHealthReport** — add NotifyPropertyChangedFor on HealthStatus,
+  TemperatureC, WearPercent, PowerOnHours, ReadErrors, WriteErrors for 6+
+  computed properties (BIND-002).
+- **Binding: FriendlyEventEntry** — add NotifyPropertyChangedFor on Timestamp
+  and Severity for RelativeTime, FullTimestamp, SeverityIcon, SeverityColor
+  (BIND-003).
+- **Binding: PerformanceProfile** — add NotifyPropertyChangedFor on
+  ActivePlanName and ActivePlanGuid for ProfileSummary (BIND-004).
+- **Binding: ProcessEntry** — add NotifyPropertyChangedFor on MemoryBytes for
+  MemoryDisplay (BIND-005).
+- **Binding: DiskUsageEntry** — add NotifyPropertyChangedFor on SizeBytes for
+  SizeDisplay (BIND-006).
+- **Binding: InstalledApp** — add NotifyPropertyChangedFor on SizeBytes for
+  SizeDisplay (BIND-007).
+- **Memory: DeepCleanupViewModel** — replace anonymous PropertyChanged lambda
+  with named handler, unsubscribe on rescan and Dispose (MEM-006).
+- **Memory: ShortcutCleanerViewModel** — replace anonymous PropertyChanged
+  lambda with named handler, unsubscribe on rescan and Dispose (MEM-007).
+- **Bug: MemoryTestService** — set ReverseDirection=true on EventLogQuery so
+  the cutoff break works correctly with newest-first ordering (BUG-002).
+- **Bug: PerformanceService** — fix CreateRestorePointAsync by embedding
+  description directly in script instead of using AddParameter which doesn't
+  create script-scope variables (BUG-003).
+- **Bug: SpeedTestView/CleanupView/DeepCleanupView/NetworkRepairView/
+  SystemHealthView/TracerouteView/AboutView** — replace FlexVis converter
+  misuse on IsEnabled with dedicated BoolInverterConverter (BUG-004, BUG-005).
+- **Security: ServiceManagerService** — replace weak quote-only validation with
+  strict allowlist regex for sc.exe service name arguments (SEC-006).
+- **Performance: LogsViewModel** — use CollectionView.Count directly instead of
+  iterating entire filtered view via Cast/Count (PERF-002).
+- **Performance: NetworkSharedState** — simplify buffer trimming to remove from
+  front sequentially (PERF-003).
+- **Performance: MarkdownTextBlock** — use static compiled Regex instead of
+  creating new state machine on every parse call (PERF-004).
+- **Performance: DiskAnalyzerService** — use StringComparison.OrdinalIgnoreCase
+  instead of allocating ToLowerInvariant copy on every path (PERF-006).
+
 ## [0.48.0] - 2026-05-13
 
 ### Fixed

@@ -17,6 +17,7 @@
             <!-- ============================================================ -->
             <BooleanToVisibilityConverter x:Key="BoolToVis"/>
             <h:FlexibleBoolToVisibilityConverter x:Key="FlexVis"/>
+            <h:BoolInverterConverter x:Key="BoolInvert"/>
             <h:HexToBrushConverter x:Key="HexBrush"/>
             <h:OutputKindToBrushConverter x:Key="KindBrush"/>
             <h:ProcessStatusToBrushConverter x:Key="StatusBrush"/>

@@ -81,14 +81,18 @@ private static void OnMarkdownChanged(DependencyObject d, DependencyPropertyChan
         }
     }
 
+    // PERF-004: Pre-compiled regex avoids creating a new state machine on every call.
+    private static readonly Regex InlineFormattingRegex = new(
+        @"\*\*(.+?)\*\*|`([^`]+)`", RegexOptions.Compiled);
+
     /// <summary>
     /// Parses a single line for **bold** and `code` inline formatting
     /// and appends the resulting Inlines to the TextBlock.
     /// </summary>
     private static void AddFormattedText(TextBlock tb, string text)
     {
         // Merge bold and code patterns, process left-to-right
-        var combined = Regex.Matches(text, @"\*\*(.+?)\*\*|`([^`]+)`");
+        var combined = InlineFormattingRegex.Matches(text);
         var pos = 0;
 
         foreach (Match m in combined)

@@ -57,6 +57,20 @@
         => throw new NotSupportedException();
 }
 
+/// <summary>
+/// Inverts a boolean value. Use for IsEnabled bindings where the source
+/// property indicates a "busy" state and the target should be disabled.
+/// </summary>
+[ValueConversion(typeof(bool), typeof(bool))]
+public sealed class BoolInverterConverter : IValueConverter
+{
+    public object Convert(object value, Type targetType, object parameter, CultureInfo culture)
+        => value is bool b ? !b : true;
+
+    public object ConvertBack(object value, Type targetType, object parameter, CultureInfo culture)
+        => value is bool b ? !b : true;
+}
+
 public class BoolToElevationBadgeBrushConverter : IValueConverter
 {
     public object Convert(object value, Type targetType, object parameter, CultureInfo culture)

@@ -15,10 +15,19 @@ public partial class BatteryInfo : ObservableObject
     [ObservableProperty] private string _name = "";
     [ObservableProperty] private string _status = "";          // Charging / Discharging / Full / AC (no battery)
     [ObservableProperty] private int _chargePercent;            // 0-100
-    [ObservableProperty] private uint _designCapacityMWh;       // milliwatt-hours
-    [ObservableProperty] private uint _fullChargeCapacityMWh;
+    [ObservableProperty]
+    [NotifyPropertyChangedFor(nameof(HealthPercent))]
+    [NotifyPropertyChangedFor(nameof(WearPercent))]
+    private uint _designCapacityMWh;       // milliwatt-hours
+
+    [ObservableProperty]
+    [NotifyPropertyChangedFor(nameof(HealthPercent))]
+    [NotifyPropertyChangedFor(nameof(WearPercent))]
+    private uint _fullChargeCapacityMWh;
     [ObservableProperty] private int _cycleCount;
-    [ObservableProperty] private int _estimatedRuntimeMinutes;  // -1 = unlimited (AC)
+    [ObservableProperty]
+    [NotifyPropertyChangedFor(nameof(RuntimeDisplay))]
+    private int _estimatedRuntimeMinutes;  // -1 = unlimited (AC)
     [ObservableProperty] private string _chemistry = "";        // LiIon, NiMH, etc.
     [ObservableProperty] private string _manufacturer = "";
 

@@ -17,13 +17,39 @@ public partial class DiskHealthReport : ObservableObject
     [ObservableProperty] private string _mediaType = "";       // HDD / SSD / NVMe
     [ObservableProperty] private string _busType = "";
     [ObservableProperty] private double _sizeGB;
-    [ObservableProperty] private string _healthStatus = "";    // Healthy / Warning / Unhealthy
-    [ObservableProperty] private double? _temperatureC;
+    [ObservableProperty]
+    [NotifyPropertyChangedFor(nameof(HealthPercent))]
+    [NotifyPropertyChangedFor(nameof(HealthPercentColorHex))]
+    private string _healthStatus = "";    // Healthy / Warning / Unhealthy
+    [ObservableProperty]
+    [NotifyPropertyChangedFor(nameof(HealthPercent))]
+    [NotifyPropertyChangedFor(nameof(HealthPercentColorHex))]
+    [NotifyPropertyChangedFor(nameof(TemperatureColorHex))]
+    [NotifyPropertyChangedFor(nameof(TemperatureGauge))]
+    private double? _temperatureC;
+
     [ObservableProperty] private double? _temperatureMaxC;
-    [ObservableProperty] private int? _wearPercent;            // 0 = new, 100 = worn out (SSD only)
-    [ObservableProperty] private long? _powerOnHours;
-    [ObservableProperty] private long? _readErrors;
-    [ObservableProperty] private long? _writeErrors;
+
+    [ObservableProperty]
+    [NotifyPropertyChangedFor(nameof(HealthPercent))]
+    [NotifyPropertyChangedFor(nameof(HealthPercentColorHex))]
+    [NotifyPropertyChangedFor(nameof(WearGauge))]
+    [NotifyPropertyChangedFor(nameof(WearColorHex))]
+    private int? _wearPercent;            // 0 = new, 100 = worn out (SSD only)
+
+    [ObservableProperty]
+    [NotifyPropertyChangedFor(nameof(PowerOnDisplay))]
+    private long? _powerOnHours;
+
+    [ObservableProperty]
+    [NotifyPropertyChangedFor(nameof(HealthPercent))]
+    [NotifyPropertyChangedFor(nameof(HealthPercentColorHex))]
+    private long? _readErrors;
+
+    [ObservableProperty]
+    [NotifyPropertyChangedFor(nameof(HealthPercent))]
+    [NotifyPropertyChangedFor(nameof(HealthPercentColorHex))]
+    private long? _writeErrors;
     [ObservableProperty] private long? _startStopCount;
     [ObservableProperty] private string _verdict = "";         // plain-English summary
     [ObservableProperty] private string _verdictColorHex = "#9AA0A6";

@@ -14,7 +14,9 @@ public partial class DiskUsageEntry : ObservableObject
 {
     [ObservableProperty] private string _name = "";
     [ObservableProperty] private string _fullPath = "";
-    [ObservableProperty] private long _sizeBytes;
+    [ObservableProperty]
+    [NotifyPropertyChangedFor(nameof(SizeDisplay))]
+    private long _sizeBytes;
     [ObservableProperty] private double _percentage;
     [ObservableProperty] private int _fileCount;
     [ObservableProperty] private int _folderCount;

@@ -13,11 +13,17 @@ namespace SysManager.Models;
 /// </summary>
 public partial class FriendlyEventEntry : ObservableObject
 {
-    [ObservableProperty] private DateTime _timestamp;
+    [ObservableProperty]
+    [NotifyPropertyChangedFor(nameof(RelativeTime))]
+    [NotifyPropertyChangedFor(nameof(FullTimestamp))]
+    private DateTime _timestamp;
     [ObservableProperty] private string _logName = "";          // System / Application / Security / Setup
     [ObservableProperty] private string _providerName = "";      // source
     [ObservableProperty] private int _eventId;
-    [ObservableProperty] private EventSeverity _severity;
+    [ObservableProperty]
+    [NotifyPropertyChangedFor(nameof(SeverityIcon))]
+    [NotifyPropertyChangedFor(nameof(SeverityColor))]
+    private EventSeverity _severity;
     [ObservableProperty] private string _severityLabel = "";
     [ObservableProperty] private string _message = "";           // first line / summary
     [ObservableProperty] private string _fullMessage = "";       // full rendered text

@@ -18,7 +18,9 @@ public partial class InstalledApp : ObservableObject
     [ObservableProperty] private string _version = "";
     [ObservableProperty] private string _source = "";
     [ObservableProperty] private string _status = "";
-    [ObservableProperty] private long _sizeBytes;
+    [ObservableProperty]
+    [NotifyPropertyChangedFor(nameof(SizeDisplay))]
+    private long _sizeBytes;
     [ObservableProperty] private string _publisher = "";
     [ObservableProperty] private ImageSource? _icon;
     [ObservableProperty] private string _uninstallString = "";

@@ -14,8 +14,13 @@ namespace SysManager.Models;
 public partial class PerformanceProfile : ObservableObject
 {
     // ── Power plan ──
-    [ObservableProperty] private string _activePlanName = "";
-    [ObservableProperty] private string _activePlanGuid = "";
+    [ObservableProperty]
+    [NotifyPropertyChangedFor(nameof(ProfileSummary))]
+    private string _activePlanName = "";
+
+    [ObservableProperty]
+    [NotifyPropertyChangedFor(nameof(ProfileSummary))]
+    private string _activePlanGuid = "";
 
     // ── Visual effects ──
     [ObservableProperty] private bool _visualEffectsReduced;

@@ -16,7 +16,9 @@ public partial class ProcessEntry : ObservableObject
     [ObservableProperty] private string _name = "";
     [ObservableProperty] private string _description = "";
     [ObservableProperty] private double _cpuPercent;
-    [ObservableProperty] private long _memoryBytes;
+    [ObservableProperty]
+    [NotifyPropertyChangedFor(nameof(MemoryDisplay))]
+    private long _memoryBytes;
     [ObservableProperty] private string _status = "";
     [ObservableProperty] private string _userName = "";
     [ObservableProperty] private DateTime _startTime;

@@ -180,7 +180,7 @@ private static (long size, int files, int folders) MeasureFolder(string path, Ca
 
     private static bool ShouldSkip(string path)
     {
-        var lower = path.ToLowerInvariant();
-        return SkipSegments.Any(seg => lower.Contains(seg));
+        // PERF-006: Use OrdinalIgnoreCase instead of allocating a lowercase copy.
+        return SkipSegments.Any(seg => path.Contains(seg, StringComparison.OrdinalIgnoreCase));
     }
 }
@@ -35,7 +35,8 @@ public async Task<MemoryErrorSummary> CheckErrorLogsAsync(CancellationToken ct =
                 using var reader = new System.Diagnostics.Eventing.Reader.EventLogReader(
                     new System.Diagnostics.Eventing.Reader.EventLogQuery("System",
                         System.Diagnostics.Eventing.Reader.PathType.LogName,
-                        "*[System[Provider[@Name='Microsoft-Windows-WHEA-Logger' or @Name='Microsoft-Windows-MemoryDiagnostics-Results']]]"));
+                        "*[System[Provider[@Name='Microsoft-Windows-WHEA-Logger' or @Name='Microsoft-Windows-MemoryDiagnostics-Results']]]")
+                    { ReverseDirection = true });
 
                 var cutoff = DateTime.Now.AddDays(-30);
                 System.Diagnostics.Eventing.Reader.EventRecord? rec;

@@ -511,9 +511,11 @@ await _ps.RunProcessAsync("powercfg.exe",
     /// </summary>
     public async Task<bool> CreateRestorePointAsync(string description, CancellationToken ct = default)
     {
-        var script = "Checkpoint-Computer -Description $desc -RestorePointType 'MODIFY_SETTINGS'";
-        var parameters = new Dictionary<string, object?> { ["desc"] = description };
-        var results = await _ps.RunAsync(script, parameters, ct).ConfigureAwait(false);
+        // BUG-003: Embed description directly in the script with single-quote
+        // escaping. AddParameter doesn't create script-scope variables.
+        var safeDesc = (description ?? "SysManager Restore Point").Replace("'", "''");
+        var script = $"Checkpoint-Computer -Description '{safeDesc}' -RestorePointType 'MODIFY_SETTINGS'";
+        var results = await _ps.RunAsync(script, null, ct).ConfigureAwait(false);
         return results != null;
     }
 

@@ -123,8 +123,11 @@ public static void StopService(string serviceName)
     /// <summary>Change the startup type of a service via sc.exe. Requires admin.</summary>
     public static async Task SetStartupTypeAsync(string serviceName, string startType, PowerShellRunner ps, CancellationToken ct = default)
     {
-        // Validate inputs to prevent command injection via sc.exe arguments
-        if (serviceName.Contains('"') || serviceName.Contains('\0'))
+        // SEC-006: Strict allowlist for service names — alphanumeric, spaces,
+        // hyphens, underscores, dots, and dollar signs only (covers all valid
+        // Windows service names including instance names like MSSQL$INSTANCE).
+        if (string.IsNullOrWhiteSpace(serviceName) ||
+            !System.Text.RegularExpressions.Regex.IsMatch(serviceName, @"^[\w\s\-.$]+$"))
             throw new ArgumentException("Invalid service name.", nameof(serviceName));
 
         var allowedTypes = new[] { "auto", "delayed-auto", "demand", "disabled" };

@@ -112,10 +112,21 @@ private void AddLocation(string label, string path)
     partial void OnIsCleaningChanged(bool value) => IsBusy = IsScanning || IsCleaning || IsLargeScanning;
     partial void OnIsLargeScanningChanged(bool value) => IsBusy = IsScanning || IsCleaning || IsLargeScanning;
 
+    private void OnCategoryPropertyChanged(object? sender, System.ComponentModel.PropertyChangedEventArgs e)
+    {
+        if (e.PropertyName == nameof(CleanupCategory.IsSelected))
+        {
+            OnPropertyChanged(nameof(TotalSelectedBytes));
+            OnPropertyChanged(nameof(TotalSelectedDisplay));
+        }
+    }
+
     protected override void Dispose(bool disposing)
     {
         if (disposing)
         {
+            foreach (var c in Categories)
+                c.PropertyChanged -= OnCategoryPropertyChanged;
             _scanCts?.Dispose();
             _cleanCts?.Dispose();
             _largeCts?.Dispose();
@@ -154,19 +165,14 @@ private async Task ScanAsync()
 
             // Batch-update the observable collection to avoid per-item UI
             // re-renders that can stall the dispatcher on large lists.
+            // MEM-006: Unsubscribe from old categories before clearing to prevent
+            // PropertyChanged lambda leaks across rescans.
+            foreach (var old in Categories)
+                old.PropertyChanged -= OnCategoryPropertyChanged;
             Categories.Clear();
             var catList = cats.ToList();
             foreach (var c in catList)
-            {
-                c.PropertyChanged += (_, e) =>
-                {
-                    if (e.PropertyName == nameof(CleanupCategory.IsSelected))
-                    {
-                        OnPropertyChanged(nameof(TotalSelectedBytes));
-                        OnPropertyChanged(nameof(TotalSelectedDisplay));
-                    }
-                };
-            }
+                c.PropertyChanged += OnCategoryPropertyChanged;
             foreach (var c in catList) Categories.Add(c);
             var total = cats.Sum(c => c.TotalSizeBytes);
             ScanSummary = $"Found {CleanupCategory.HumanSize(total)} across {cats.Count} categories. Untick anything you want to keep.";

@@ -67,7 +67,9 @@
 
     private void UpdateVisibleCount()
     {
-        VisibleCount = EntriesView.Cast<object>().Count();
+        // PERF-002: Use CollectionView.Count directly instead of iterating
+        // the entire filtered collection via Cast<object>().Count().
+        VisibleCount = ((CollectionView)EntriesView).Count;
         HasNoResults = Entries.Count > 0 && VisibleCount == 0;
     }
 

@@ -425,12 +425,11 @@
         while (removeCount < buffer.Count && buffer[removeCount].DateTime < cutoff)
             removeCount++;
 
-        // Batch removal from end-to-start avoids O(n²) shifting
-        if (removeCount > 0)
-        {
-            for (int i = removeCount - 1; i >= 0; i--)
-                buffer.RemoveAt(i);
-        }
+        // PERF-003: Remove stale items from the front. Removing from index 0
+        // repeatedly is O(n*removeCount) but unavoidable with ObservableCollection.
+        // We remove forward (always index 0) which is simpler and equivalent.
+        for (int i = 0; i < removeCount; i++)
+            buffer.RemoveAt(0);
     }
 
     internal void TrimAllBuffers()
@@ -451,7 +450,7 @@
        Labeler = v => new DateTime((long)v).ToString("HH:mm:ss"),
        TextSize = 12,
        NamePaint = new SolidColorPaint(SKColor.Parse("A3ADBF")),
        LabelsPaint = new SolidColorPaint(SKColor.Parse("E6E9EE")) { FontFamily = "Segoe UI" },
        SeparatorsPaint = new SolidColorPaint(SKColor.Parse("2A3244").WithAlpha(80))
    };

@@ -460,8 +459,8 @@
        Name = name,
        MinLimit = 0,
        TextSize = 13,
        NamePaint = new SolidColorPaint(SKColor.Parse("E6E9EE")) { FontFamily = "Segoe UI" },
        LabelsPaint = new SolidColorPaint(SKColor.Parse("E6E9EE")) { FontFamily = "Segoe UI" },
        SeparatorsPaint = new SolidColorPaint(SKColor.Parse("2A3244").WithAlpha(80)) { StrokeThickness = 1 },
        Labeler = v => $"{v:F0} ms",
        NameTextSize = 14,
@@ -475,7 +474,7 @@
        MinStep = 1,
        TextSize = 12,
        NamePaint = new SolidColorPaint(SKColor.Parse("A3ADBF")),
        LabelsPaint = new SolidColorPaint(SKColor.Parse("E6E9EE")) { FontFamily = "Segoe UI" },
        SeparatorsPaint = new SolidColorPaint(SKColor.Parse("2A3244").WithAlpha(80))
    };