POST …/shell runs one Android shell command on a Lusor Phone. Use it only when no direct-control action does the job.
command is 1 to 4096 characters.
No output
The response says whether the command ran. It does not include the command’s output.
To see the effect of a command, read the screen with
GET …/state or GET …/screenshot.
Refused commands
Every command is checked against a list of refused patterns before it is sent. A refused command returns403 with error: "denied" and a message naming the reason. It never reaches the phone.
Refused anywhere in the command:
- Shell operators:
|,;,&,$(and backticks. Send one command per request.
- Restarting or resetting the phone (
reboot,wipe, factory reset) and changing its power state. su, and starting another shell such asbashorbusybox.- Recursive deletes (
rm -rin any form), raw disk writes, formatting, and remounting the system as writable. - Installing packages (
pm install), and removing the Lusor app. - Changing read-only system properties, global settings or content providers, and raw service calls.
- Network tools such as
nc,telnetandssh.
403 on any command.
Audit
Every attempt is recorded, whether it ran or was refused, with the workspace, the API key, the phone and the full command. Do not put secrets in commands.Billing
On a Lusor Phone, a shell command with an API key uses Lusor Phone minutes like any other direct action, and can be refused with the same402, 409 and 503 errors. See Billing.
