This release includes 1 security fix for security teams reviewing exposed deployments.
Published 3mo
AI Agents & Assistants
✓ No known CVEs patched
This release patches 1 known CVE
Topics
ai-agents
blazor
cli-agents
c#
.net
ollama
+1 more
tui
Affected surfaces
rce_ssrf
breaking_upgrade
Summary
AI summaryFixes timeout retry deadlock that could hang for up to 15 minutes.
Full changelog
Changelog
All notable changes to MandoCode will be documented in this file.
[0.9.6] - 2026-04-06
Added
- Unit test project with 65 tests covering
InputStateMachineandDiffService- Text input, cursor movement, backspace/delete, submit
- Command autocomplete filtering, dropdown navigation, accept/dismiss
- Command history navigation with saved input restoration
- Paste handling with newline-to-space conversion
- Static helper tests (
IsCommand,GetCommandName) using parameterized[Theory]tests - Diff computation for new files, modifications, deletions, identical content
- Line ending normalization (Windows
\r\n, old Mac\r) - Large file fallback with sampled diffs
- Context collapse with configurable context lines
- Empty response recovery — when the model returns blank (context overflow), MandoCode now shows a helpful message instead of freezing with a blank screen
- Rendering timeout guard — markdown rendering runs with a 30-second timeout and a "Rendering..." spinner after 1 second, preventing permanent freezes on large responses. Falls back to raw text if rendering exceeds the limit.
Fixed
- Timeout retry deadlock — when a request timed out (5-minute limit),
RetryPolicywas treating the timeout as a transient error and retrying the entire request including all file reads. With 2 retries, this could silently hang for up to 15 minutes. Now the cancellation token is properly passed toRetryPolicyso timeouts fail fast. - Silent exception suppression — replaced 6 bare
catch { }blocks withcatch (Exception ex)logging toDebug.WriteLineacrossTerminalThemeService,App.razor,FileSystemPlugin,FunctionInvocationFilter, andShellCommandHandler - Shell command injection surface —
ShellCommandHandlerandFileSystemPluginnow useProcessStartInfo.ArgumentListfor proper argument escaping instead of manual string concatenation withcmd.Replace("\"", "\\\"") - Inconsistent config validation —
Program.csaccepted anymaxTokens > 0whileValidateAndClamp()enforced[256, 131072]. All validation now uses centralized constants and helpers onMandoCodeConfig
Changed
- Config validation constants (
MinTemperature,MaxTemperature,MinMaxTokens,MaxMaxTokens) and helpers (IsValidTemperature,IsValidMaxTokens) are now defined once onMandoCodeConfigand referenced byProgram.cs,ConfigurationWizard.cs, andValidateAndClamp()
Security Fixes
- ShellCommandHandler and FileSystemPlugin now use ProcessStartInfo.ArgumentList for proper argument escaping, mitigating command injection surface
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About MandoCode
All releases →Related context
Related tools
Beta — feedback welcome: [email protected]