fix: resolve wifi crashes, shell injections, race conditions, and add debug mode

- Remove transient NEED_AUTH/DISCONNECTED error paths from wifi connect
- Guard double-callback in connect_wifi_bssid/connect_wifi_with_password
- Shell-quote user paths in wallpaper, screenshot, screenrecorder services
- Fix OSD hide-timer use-after-free and applet_window stale source ID
- Fix brightness poll timer leak on read failure
- Fix spotlight search stale idle source removal
- Lock dbusmenu _cache mutation under _registry_lock
- Fix entry.revision written outside _registry_lock scope
- Add fabric-cli exec wrapper for lock screen (lock_screen.lock())
- Replace hyprlock with lock screen in power menu and dropdown
- Add debug mode toggle in settings (controls log verbosity)
- Add diagnostic logging to globalmenu click chain

src/window/globalmenu/dbusmenu.py

@@ -123,10 +123,9 @@ class DBusMenuClient:
             return None
 
     def get_layout(self, force_refresh=False):
-        if self._cache and self._cache_valid and not force_refresh:
-            return self._cache
-
         with self._lock:
+            if self._cache and self._cache_valid and not force_refresh:
+                return self._cache
             if self._fetching:
                 return self._cache or []
             self._fetching = True
@@ -261,6 +260,10 @@ class DBusMenuClient:
             return False
 
     def click_item(self, item_id, pid=0):
+        logger.debug(
+            f"[dbusmenu] click_item: item_id={item_id}, "
+            f"service={self.service_name}, path={self.object_path}"
+        )
         try:
             self._call(
                 "Event",
@@ -269,7 +272,7 @@ class DBusMenuClient:
             self.invalidate()
         except Exception as e:
             logger.warning(
-                f"[dbusmenu] self._call( 'Event', GLib.Variant('(isvu)', (item_id, 'cl... failed: {e}"
+                f"[dbusmenu] click_item: Event call failed for item_id={item_id}: {e}"
             )
 
     def invalidate(self):
@@ -369,9 +372,10 @@ class DBusMenuClient:
                 layout = layout.get_variant()
             parsed = self._parse_dbusmenu(layout).children
             if parent_id == 0:
-                self._hash_cache = self._hash(parsed)
-                self._cache = parsed
-                self._cache_valid = True
+                with self._lock:
+                    self._hash_cache = self._hash(parsed)
+                    self._cache = parsed
+                    self._cache_valid = True
             return parsed
         except Exception as e:
             logger.error(f"[Menu] update_layout error: {e}")
@@ -403,5 +407,6 @@ class DBusMenuClient:
                 result.append(item)
             return result
 
-        self._cache = walk(self._cache)
-        self._hash_cache = None
+        with self._lock:
+            self._cache = walk(self._cache)
+            self._hash_cache = None

src/window/globalmenu/service.py

@@ -372,9 +372,26 @@ class GlobalMenuService(Service):
         """Return the registry entry and PID for the currently active window."""
         with self._state_lock:
             pid = self._current_pid
+        if pid == 0:
+            logger.warning(
+                "[GlobalMenuService] _resolve_current_entry: _current_pid is 0"
+            )
+            return None, 0
         with self._registry_lock:
             svc = self._pid_to_service.get(pid)
             entry = self._service_registry.get(svc) if svc else None
+        if not svc:
+            logger.warning(
+                f"[GlobalMenuService] _resolve_current_entry: no service for pid {pid}"
+            )
+        elif not entry:
+            logger.warning(
+                f"[GlobalMenuService] _resolve_current_entry: no entry for service '{svc}' (pid {pid})"
+            )
+        elif not entry.importer:
+            logger.warning(
+                f"[GlobalMenuService] _resolve_current_entry: importer is None for '{svc}' (pid {pid})"
+            )
         return entry, pid
 
     def _register_new_service(
@@ -510,7 +527,7 @@ class GlobalMenuService(Service):
             entry = self._service_registry.get(svc_name)
             if not entry or not entry.importer:
                 return
-        entry.revision = revision
+            entry.revision = revision
         subtree = entry.importer.update_layout(parent_id, revision)
         if subtree is None:
             return
@@ -1066,8 +1083,15 @@ class GlobalMenuService(Service):
     def click_item(self, item_id: int) -> bool:
         entry, pid = self._resolve_current_entry()
         if entry and entry.importer:
+            logger.debug(
+                f"[GlobalMenuService] click_item: item_id={item_id}, "
+                f"service={entry.service_name}, importer={type(entry.importer).__name__}"
+            )
             entry.importer.click_item(item_id, pid=pid)
             return True
+        logger.warning(
+            f"[GlobalMenuService] click_item FAILED: item_id={item_id}, entry={entry}, pid={pid}"
+        )
         return False
 
     def about_to_show(self, item_id: int) -> bool: