Skip to main content
POST …/shell runs one Android shell command on a Lusor Phone. Use it only when no direct-control action does the job.
command is 1 to 4096 characters.

No output

The response says whether the command ran. It does not include the command’s output. To see the effect of a command, read the screen with GET …/state or GET …/screenshot.

Refused commands

Every command is checked against a list of refused patterns before it is sent. A refused command returns 403 with error: "denied" and a message naming the reason. It never reaches the phone. Refused anywhere in the command:
  • Shell operators: |, ;, &, $( and backticks. Send one command per request.
Refused commands include:
  • Restarting or resetting the phone (reboot, wipe, factory reset) and changing its power state.
  • su, and starting another shell such as bash or busybox.
  • Recursive deletes (rm -r in any form), raw disk writes, formatting, and remounting the system as writable.
  • Installing packages (pm install), and removing the Lusor app.
  • Changing read-only system properties, global settings or content providers, and raw service calls.
  • Network tools such as nc, telnet and ssh.
The list may grow. Build for a 403 on any command.

Audit

Every attempt is recorded, whether it ran or was refused, with the workspace, the API key, the phone and the full command. Do not put secrets in commands.

Billing

On a Lusor Phone, a shell command with an API key uses Lusor Phone minutes like any other direct action, and can be refused with the same 402, 409 and 503 errors. See Billing.