diff --git a/README.md b/README.md
index 1a066ee..bb57b1e 100644
--- a/README.md
+++ b/README.md
@@ -84,6 +84,18 @@ TV Remote entity, the Nvidia Remote Protocol (PIN pairing), or ADB
 media-session mode (ADB enabled + host). The `no_state_source` form error
 fires only when none of the three is present; ADB-only setups are valid.
 
+### Raw `adb_command` service (opt-in)
+
+When enabled in the integration's options (`adb_command_enabled`, **default
+off**), the integration registers the `nvidia_shield.adb_command` service:
+send a raw ADB shell command to the entry's persistent connection
+(`{"command": "your-command", "entity_id": "media_player.<yours>"}` — the
+entity is optional when exactly one entry provides the service). This is the
+same security posture as the Home Assistant core `androidtv` integration: a
+documented, opt-in escape hatch for debugging and automation, registered at
+setup and unregistered when the last participating entity unloads. It
+rejects (logs a warning, sends nothing) when the ADB connection is down.
+
 ### Migration from mediasession2mqtt + universal-player glue
 
 The `mediasession2mqtt` bridge sensors and the universal media player YAML
diff --git a/custom_components/nvidia_shield/const.py b/custom_components/nvidia_shield/const.py
index 648f79c..d6f52b4 100644
--- a/custom_components/nvidia_shield/const.py
+++ b/custom_components/nvidia_shield/const.py
@@ -96,6 +96,20 @@ ZEROCONF_SERVICE_TYPE = "_androidtvremote2._tcp.local."
 # consumed by app_name after the androidtv-entity and protocol-push tiers.
 CONF_APP_NAME_MAP = "app_name_map"
 
+# P4-2a adb_command service: rawADB shell on this entry — OFF by default
+# (same security posture as the core androidtv integration).
+CONF_ADB_COMMAND_ENABLED = "adb_command_enabled"
+SERVICE_ADB_COMMAND = "adb_command"
+
+# P4-2c BrowseMedia app directory fallback when the options map is empty
+# (curated; the packages are the plan's reference apps).
+DEFAULT_APP_DIRECTORY = {
+    "ar.tvplayer.tv": "TiviMate",
+    "com.github.damontecres.wholphin": "Wholphin",
+    "com.netflix.ninja": "Netflix",
+    "com.google.android.youtube.tv": "YouTube",
+}
+
 CHANNEL_DIGIT_DELAY = 0.1
 CONF_CHANNEL_DIGIT_DELAY = "channel_digit_delay"
 CONF_CHANNEL_SEND_ENTER = "channel_send_enter"
diff --git a/custom_components/nvidia_shield/strings.json b/custom_components/nvidia_shield/strings.json
index 1918d0e..4624fb6 100644
--- a/custom_components/nvidia_shield/strings.json
+++ b/custom_components/nvidia_shield/strings.json
@@ -78,7 +78,8 @@
           "adb_store_app_info": "Show App Media Info",
           "adb_host": "ADB Host",
           "adb_port": "ADB Port",
-          "app_name_map": "Apps name/icon map"
+          "app_name_map": "Apps name/icon map",
+          "adb_command_enabled": "Enable raw ADB shell service"
         },
         "data_description": {
           "jellyfin_entity": "The Jellyfin media_player for this device. Session stream info is read from the HA Jellyfin integration's existing coordinator \u2014 no extra config needed.",
@@ -89,7 +90,8 @@
           "adb_store_app_info": "Show title and artist from non-Jellyfin apps. Disable for privacy.",
           "adb_host": "IP address for ADB connection. Leave blank to auto-detect from the Android TV Remote integration.",
           "adb_port": "ADB port (default 5555).",
-          "app_name_map": "One entry per line, package=name (e.g. ar.tvplayer.tv=TiviMate). The friendly name resolves after the Android TV Remote entity and the protocol push; icons follow the media image lookup by name. Leave blank to clear."
+          "app_name_map": "One entry per line, package=name (e.g. ar.tvplayer.tv=TiviMate). The friendly name resolves after the Android TV Remote entity and the protocol push; icons follow the media image lookup by name. Leave blank to clear.",
+          "adb_command_enabled": "Adds the nvidia_shield.adb_command service (raw ADB shell over the persistent connection). Security-relevant: leave off unless you need it \u2014 it is the same opt-in posture as the core androidtv integration."
         }
       }
     }
diff --git a/custom_components/nvidia_shield/translations/en.json b/custom_components/nvidia_shield/translations/en.json
index 1918d0e..4624fb6 100644
--- a/custom_components/nvidia_shield/translations/en.json
+++ b/custom_components/nvidia_shield/translations/en.json
@@ -78,7 +78,8 @@
           "adb_store_app_info": "Show App Media Info",
           "adb_host": "ADB Host",
           "adb_port": "ADB Port",
-          "app_name_map": "Apps name/icon map"
+          "app_name_map": "Apps name/icon map",
+          "adb_command_enabled": "Enable raw ADB shell service"
         },
         "data_description": {
           "jellyfin_entity": "The Jellyfin media_player for this device. Session stream info is read from the HA Jellyfin integration's existing coordinator \u2014 no extra config needed.",
@@ -89,7 +90,8 @@
           "adb_store_app_info": "Show title and artist from non-Jellyfin apps. Disable for privacy.",
           "adb_host": "IP address for ADB connection. Leave blank to auto-detect from the Android TV Remote integration.",
           "adb_port": "ADB port (default 5555).",
-          "app_name_map": "One entry per line, package=name (e.g. ar.tvplayer.tv=TiviMate). The friendly name resolves after the Android TV Remote entity and the protocol push; icons follow the media image lookup by name. Leave blank to clear."
+          "app_name_map": "One entry per line, package=name (e.g. ar.tvplayer.tv=TiviMate). The friendly name resolves after the Android TV Remote entity and the protocol push; icons follow the media image lookup by name. Leave blank to clear.",
+          "adb_command_enabled": "Adds the nvidia_shield.adb_command service (raw ADB shell over the persistent connection). Security-relevant: leave off unless you need it \u2014 it is the same opt-in posture as the core androidtv integration."
         }
       }
     }