Mobile (preview)

Not in the stores yet

Every release has a signed Android APK. The iPhone app is not in the App Store yet; build it from apps/ios as below. A phone also works without the apps, through the daemon’s web UI: scan the pairing QR code and the browser opens it.

Native apps for iPhone (SwiftUI, iOS 17+) and Android (Kotlin and Jetpack Compose, Android 8+) are clients of the daemon, like the terminal UI, the web UI and VS Code, made for checking in on agents away from the desk:

• workspaces, tabs and agents with their live status,
• transcripts with tool calls and subagents,
• prompts, photos included,
• approvals, answered from the app or from a notification,
• background jobs,
• notifications when an agent needs you or finishes.

Installing

Android. Download malac-<version>-android.apk from the latest release on the phone and open it. Allow installs from that app when Android asks, and choose Install anyway if Play Protect warns about an unknown developer. Every release is signed with the same key, so a newer APK installs over the old one and keeps your paired daemons.

iPhone. You need Xcode with its iOS platform (Xcode → Settings → Components) and an Apple ID.

brew install xcodegen
cd apps/ios && xcodegen generate && open Malac.xcodeproj

In the Malac target’s Signing & Capabilities, pick your team (change the bundle identifier io.malac.app if Xcode says it is taken), select your phone and run. Turn on Developer Mode on the phone and trust your certificate under Settings → General → VPN & Device Management the first time. With a free Apple ID the build expires after seven days; run it again from Xcode.

Building Android yourself. You need the Android SDK (Android Studio installs it). With the phone connected and USB debugging on:

cd apps/android && ./gradlew :app:installDebug

A debug build installs as “malac debug”, next to the released app.

The apps need malac 1.1 or later on the computer.

Pairing

The apps pair exactly as other devices do; see Remote access.

1. Make the daemon reachable from the phone: on the same network with remote access on (malac daemon start --remote), through a tunnel (malac tunnel cloudflare, tailscale, …), or through an SSH tunnel to its loopback port.
2. On the computer, run malac remote pair, or use Connection → Pair a device in the terminal UI or Settings → Remote access in the web UI.
3. In the app, scan the QR code, or type the daemon’s address and the code.

The app trades the code for a device token of its own and keeps it in the platform’s secure storage: the Keychain on iOS, a key in the Android Keystore on Android. Several daemons can be saved. Revoke a lost phone with malac remote revoke <id>; malac remote devices lists the paired devices.

The same caution applies as for any device: a paired phone can do everything you can, and a daemon on a local network speaks plain HTTP, so prefer a tunnel with HTTPS, Tailscale or SSH on networks that are not yours.

For app developers

The apps use the documented protocol and nothing else: GET /api/hello to find a daemon, POST /api/pair to pair, then the WebSocket and REST API with Authorization: Bearer <token>. A 401 means the device was revoked and must pair again. Any client can do the same.