feat(builtins): sudo and busybox run their command

[chaliy]

Requested by Михайло · project thread

What changed

• sudo runs its command. It skips its own options. Leading VAR=VALUE operands go through env, and -s/-i cmd go through bash -c. -v/-k succeed and -l lists (ALL) NOPASSWD: ALL. There is one sandbox user, so nothing about identity changes (new L-SUDO-001, TM-ESC-009 updated).
• busybox APPLET args runs the builtin of that name. busybox /bin/ls works too, and --list/--list-full list the builtins.
• Runner help belongs to the inner command. nohup, nice and flock no longer steal the inner command's --help, so nohup tar --help now shows tar's help.

Why

sudo (7 calls) and busybox (10 calls) are among the top missing commands in the gap replay. A typical case is sudo tee /etc/env.conf <<EOF. The old "privilege" hint already said all commands run unrestricted, but the call still failed with 127 and cost the agent a turn.

Before

$ sudo mkdir -p /opt/x; echo $?
bash: sudo: command not found ... All commands run without privilege restrictions.
127
$ busybox tar --help
bash: busybox: command not found

After

$ sudo mkdir -p /opt/x; echo $?
0
$ busybox tar --help | head -1
Usage: tar [OPTION]... [FILE]...

New spec: sudo-busybox.test.sh. Its cases are marked bash_diff, because the reference host's sudo can prompt and busybox may be absent.

Risk

Low. No new capability: the command runs exactly as it would without sudo. su and doas keep the hint.

Checklist

• Spec + integration tests; builtins.json regenerated
• clippy, fmt, lib + integration tests
• knowledge (limitations, threat model, log)

https://claude.ai/code/session_019aFikmptPc91Fj4N2iDXQA

---

Generated by Claude Code

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	bashkit	e8eb807	Commit Preview URL Branch Preview URL	Oct 07 2026, 04:03 PM