Herdr OS · USB installer for Chrome
Stock R1 to Herdr OS, from this tab.
The same commands as our install scripts, sent over USB by the browser. Five steps, about an hour, most of it waiting. Each step says what it will do before it runs, and nothing is erased until you confirm it by name.
The installer needs WebUSB, which Chrome and Edge have on a computer, opened over HTTPS. Safari and Firefox don't support it. You can still dry-run every step here to read the exact commands.
- Quit adb on this computer. A running adb server holds the R1 and the browser can't reach it. Run
adb kill-serverand close other flashing tools. - Use a USB-C data cable straight into the computer, not a hub.
- Know the risks. Unlocking voids the warranty. Rabbit's flash tool can always put stock rabbitOS back.
Unlock the bootloader
What this does
- First, on Rabbit's side: follow Rabbit's unlock article. In OS3, settings → r1, request developer mode for this R1 (warranty acknowledgment and its IMEI). Then, with the R1 on and online, settings → r1 → device modification → unlock. That only gives the R1 permission; nothing is unlocked yet.
- Enter fastboot. The R1 has no volume keys. Power it off, press the button below, then plug it in. For about 1.5 seconds it shows a serial port; choose MT65xx Preloader in Chrome's list fast. If you miss it, unplug and plug in again: once Chrome knows the port, the page catches it on its own and answers
FASTBOOT. - Check the permission. Runs
fastboot flashing get_unlock_ability, which must say 1. If it says 0, reboot the R1, leave it online a minute and request the unlock again. - Unlock. Runs
fastboot flashing unlock, then checksgetvar unlocked. This erases the R1. If it asks, confirm with the side button.
Flash LineageOS
What this does
- Reads four small images out of Rabbit's firmware zip, on this computer: vbmeta, vbmeta_system, vbmeta_vendor and the empty userdata.
- Decompresses the LineageOS image in the browser.
- Turns verified boot off: patched vbmeta images on both slots.
- Erases all data the way Rabbit's restore does: erase userdata, then the empty userdata image.
- Reboots into fastbootd, cancels any half-done update, reads the active slot and deletes Rabbit's
productpartition there (its launcher and services). - Writes LineageOS to that slot's
systemand reboots. Rabbit's kernel and vendor stay. First boot takes a few minutes.
Files from your disk
Start with the R1 in fastboot (step 1's button). Afterwards, go through LineageOS setup on the R1, connect to Wi-Fi and turn on USB debugging if it isn't already.
Root with Magisk
What this does
- Downloads Magisk v30.7 from this site and checks its sha256.
- Restarts adb as root (LineageOS is a userdebug build) and reads the active slot.
- Installs the Magisk app and copies Magisk's patch script and binaries to the R1.
- Copies the R1's own boot image and patches it there with Magisk's script.
- Saves the unpatched boot image to your downloads. Keep it: flashing it back unroots.
- Reboots to fastboot, writes the patched image to the active slot's
bootand reboots.
Start with LineageOS booted and USB debugging on. Magisk shows “additional setup” until the next step finishes it.
Install Herdr OS
What this does
- Downloads the app, the Magisk module and Magisk, and checks each sha256.
- Finishes Magisk's setup and installs the module (button and wheel mapping, power defaults).
- Installs the app with its permissions, grants it root and makes it the home screen.
- Sets a 15 s screen timeout, low brightness, the screen density, a dark theme in the R1's orange and a one-line lock clock.
- Disables the installed system apps from our debloat list (reversible with
pm enable).The 35 packages
com.android.launcher3 · org.lineageos.trebuchet · org.lineageos.jelly · org.lineageos.etar · org.lineageos.eleven · org.lineageos.recorder · org.lineageos.aperture · org.lineageos.glimpse · org.lineageos.audiofx · org.lineageos.updater · com.android.camera2 · com.android.gallery3d · com.android.contacts · com.android.dialer · com.android.messaging · com.android.email · com.android.calendar · com.android.deskclock · com.android.calculator2 · com.android.music · com.android.musicfx · com.android.soundrecorder · com.android.egg · com.android.htmlviewer · com.android.traceur · com.stevesoltys.seedvault · com.android.printspooler · com.android.bips · com.android.wallpaper.livepicker · com.android.wallpaperbackup · com.android.dreams.basic · com.android.dreams.phototable · com.android.calllogbackup · com.android.bluetoothmidiservice · com.google.android.apps.googlecamera.fishfood
- Reboots. Speech keys aren't sent from here: you type them on the R1 later.
Safe to run again, for example after an app update.
Pair with your bridge
What this does
The R1 talks only to the bridge on the computer that runs Herdr. Start it there (Node 24 or newer), then print a one-time pairing code as a QR code.
- Run the bridge
cd bridge && node src/main.ts serve --tailscale - Print a pairing QR code
node src/main.ts enroll --qr --tailscale - Scan it on the R1Machines & pairing, Scan QR code. Point the camera at the code and confirm the bridge address it shows.
The QR code holds only the bridge address and the one-time code, and it expires with the code. Tailscale on the R1, TLS and other options are in docs/HERDR.md.