Repository navigation
malac 0.1.1
A security and packaging update. Existing installs can upgrade with malac update; running sessions keep working on 0.1.0 until they are restarted.
Security
- A project's
.malac/config.tomlcan no longer setmemory,weborupdatesettings. Before this, a cloned repository could point memory recall at its own server and have malac send a key from your environment as the token. Settrust_project_config = truein your user config if you rely on project-level settings for these. - Subagents of a read-only agent are read-only too.
New
- VS Code extension:
malac-vscode-0.1.1.vsix. Install withcode --install-extension malac-vscode-0.1.1.vsix, or Extensions → … → Install from VSIX. It also works in Cursor, Windsurf and VSCodium. - Homebrew:
brew tap lobirus/malac https://github.com/lobirus/malac && brew install lobirus/malac/malac.
Downloads
| File | For |
|---|---|
malac-0.1.1-macos.pkg |
macOS installer, Apple Silicon and Intel |
malac-0.1.1-aarch64-apple-darwin.tar.gz |
macOS on Apple Silicon |
malac-0.1.1-x86_64-apple-darwin.tar.gz |
macOS on Intel |
malac-vscode-0.1.1.vsix |
VS Code and compatible editors |
SHA256SUMS |
Checksums (shasum -a 256 -c SHA256SUMS) |
On Linux, the install script builds from source: curl -fsSL https://raw.githubusercontent.com/lobirus/malac/main/install.sh | sh. The .pkg is not signed yet; if macOS blocks it, right-click it and choose Open.