How does it work without SSH?
Commands use PHP APIs inside the permissions of the hosting account.
Execution model
The browser sends the command to lil.php. lil-terminal runs the matching built-in command or installed module as PHP with the same permissions as the website.
No system terminal is required. If a command needs an optional PHP extension, lil-terminal checks for it before use and reports the unavailable capability or uses a documented fallback where one exists.
Security boundary
lil-terminal cannot exceed the filesystem, database or network permissions granted to PHP by the hosting provider. It does not magically become root and does not bypass hosting isolation.