🍌 Peelr

A sovereign browser. One app — the engine ships inside it. Your keys live in your own rs:// origin.

v0.3.6 · alpha · unsigned · linux · macos · windows

🐧 Linux · AppImage117 MB · x86_64 · chmod +x and run 🐧 Linux · tar.gz111 MB · x86_64 · no FUSE needed 🐧 Linux · AppImage117 MB · arm64 · chmod +x and run 🐧 Linux · tar.gz111 MB · arm64 · no FUSE needed 🍎 macOS · Apple Silicon105 MB · M1–M4 · ad-hoc signed 🍎 macOS · Intel113 MB · x86_64 · ad-hoc signed 🪟 Windows · installer85 MB · x86_64 · SmartScreen will warn 🪟 Windows · portable116 MB · x86_64 · unzip and run

Phones

Android runs a real Reticulum node. iOS cannot, and that is not an oversight.

📱 Any phone · mesh clientInstallable web app · Android + iOS · works today 🤖 Android · APK44 MB · arm64 + x86_64 · Android 7+ · no Play Store 🤖 Android · zipped44 MB · if Chrome stalls the .apk at 100% — unzip, then install

🍎 iOS · appBlocked by Apple, twice over — see below

What the Android build is, and is not. It is a real Reticulum node on the phone: it holds its own identity, attaches to the mesh over an ordinary internet connection, and is addressable by other nodes. No LoRa, no radio, no pairing — Reticulum is carrier agnostic, so TCP carries it exactly as a radio would. It is not the desktop browser: Text-O and holon resolution over the mesh are not in it yet. Alpha, and it says so on its own first screen.

iOS is shut twice. App Review guideline 2.5.6 requires apps that browse the web to use WebKit; an alternative engine is permitted only in the EEA, under a separate Apple entitlement. A WebKit shell cannot carry rs:// privileged origins, so the thing that shipped would not be Peelr. Independently of that, this project has no Apple Developer ID — the same absence that leaves the macOS builds above unsigned.
Android is real work in progress. Android does permit a custom scheme, an intercepted WebView, and a native Reticulum library, so a true Peelr is buildable there. It is a second application rather than a build flag. It will arrive as an APK you install from this page; no Play Store account sits in the path.

What works on a phone today: open the mesh client and add it to your home screen. Your keys stay in that browser and the rendezvous still only forwards blobs it cannot read — but it is WebRTC only, and it is not the sovereign browser.

Verify what you downloaded. Nothing here is signed by a certificate your computer recognises — there is no Apple Developer ID and no Authenticode cert behind this project yet, so macOS and Windows will both interrupt you. That is the operating system saying it cannot tell who built this, which is true. Checksums are the honest substitute:

curl -O https://peelr.lol/dl/SHA256SUMS
sha256sum -c SHA256SUMS --ignore-missing   # macOS: shasum -a 256 -c
certutil -hashfile Peelr-0.3.6-win-x64.exe SHA256   # Windows

Full manifest: /dl/latest.json · /dl/SHA256SUMS

Run it

Linux

chmod +x Peelr-0.3.6-linux-x86_64.AppImage     # or -linux-arm64
./Peelr-0.3.6-linux-x86_64.AppImage

# no libfuse2 on your distro (Ubuntu 22.04+, Fedora, Arch)? either:
./Peelr-0.3.6-linux-x86_64.AppImage --appimage-extract-and-run
# ...or just take the tar.gz, which needs no FUSE at all.

macOS

unzip Peelr-0.3.6-mac-arm64.zip -d /Applications     # -mac-x64 on an Intel Mac
xattr -dr com.apple.quarantine /Applications/Peelr.app
open /Applications/Peelr.app

The app is ad-hoc signed — sealed and identified as lol.peelr.browser, which is what lets Apple Silicon execute it at all. It is not signed by an Apple Developer ID, so macOS quarantines it on download and will say it is damaged or cannot be opened. That message means unverified, not corrupt. Check the hash, then clear the quarantine flag with the xattr line above — or right-click the app and choose Open.

Windows

certutil -hashfile Peelr-0.3.6-win-x64.exe SHA256
# compare against SHA256SUMS, then run it

SmartScreen will show “Windows protected your PC” because the installer carries no Authenticode signature. Verify the hash first, then More info → Run anyway. The portable zip needs no installer: unzip it and run Peelr.exe.

What actually works today

Sovereign origins. rs://, peelr://, plr://, rspace:// are registered as standard privileged schemes; the aliases normalize to one rs:// substrate rather than each becoming its own origin.
Text-O ships inside. The whole messenger is a holon at rs://texto — the app's code is content-addressed and served from your own node. No separate download.
Holons resolve from peers. Open an rs:// address your machine doesn't have and Peelr asks the mesh. The peer returns the holon with an inclusion proof under its signed root, so you verify what you were handed instead of trusting who handed it to you. Tested between two installs: one served a page the other had never seen, over WebRTC, with no server in the path.
Holons are provable. Peelr commits what it serves into an Urkel trie and signs the root with a self-certifying authority key, so a peer can verify a fetched holon against a trusted root instead of trusting the server.
The mesh works over plain HTTPS. Peelr prefers a native Reticulum bridge on 127.0.0.1:4243, and when there isn't one — which is every fresh install, since no HTTP tunnel can carry raw RNS — it falls back to WebRTC data channels negotiated through the blind rendezvous at peelr.lol/api/mesh-signal. That relay only ever forwards opaque SDP/ICE blobs; once the channel is open, traffic goes peer-to-peer and the server is out of the path entirely. Share the mesh id Peelr shows you, paste a friend's, and sealed Text-O messages ride directly between your two machines.
Hard NATs may still not connect. Peer discovery uses public STUN only — no TURN relay is deployed, so two peers both behind symmetric NAT will fail to open a channel. Holon sync between peers still rides the native Reticulum carrier, so it stays dark until a bridge is reachable.
Not signed, not audited. Alpha. Treat it as a preview, not a daily driver.

💬 Prefer no install? Join the mesh from a normal browser — keys stay in your browser, and the rendezvous at peelr.lol/api/mesh-signal only ever forwards opaque SDP/ICE blobs it cannot read. Live now; no install, no account.

Build from source

git clone ssh://[email protected]:223/jeffemmett/rspace-online
git clone ssh://[email protected]:223/jeffemmett/peelr-browser
cd peelr-browser
npm install          # vendors the rspace modules into src/**/rs/_real
npm start            # run from source
npm run dist:linux   # -> dist/Peelr-<version>-linux-x86_64.AppImage
# macOS and Windows artifacts cross-build from Linux; see docs/RELEASING.md

Source access is currently invite-only while the git host moves.