diff --git a/fedac/native/Dockerfile.builder b/fedac/native/Dockerfile.builder
index a3241e2263..15a9de882a 100644
--- a/fedac/native/Dockerfile.builder
+++ b/fedac/native/Dockerfile.builder
@@ -14,7 +14,8 @@ RUN dnf install -y --setopt=install_weak_deps=False \
     gcc ccache make cpio lz4 bc perl flex bison diffutils \
     elfutils-libelf-devel openssl-devel \
     gnu-efi-devel \
-    curl jq git tar xz findutils pkgconf-pkg-config zstd xorriso \
+    curl jq file git tar xz findutils pkgconf-pkg-config zstd xorriso \
+    bash \
     ca-certificates \
     alsa-lib-devel libdrm-devel flite-devel SDL3-devel \
     ffmpeg-free-devel \
diff --git a/fedac/native/docker-build.sh b/fedac/native/docker-build.sh
index 304f06355c..43621cdb08 100644
--- a/fedac/native/docker-build.sh
+++ b/fedac/native/docker-build.sh
@@ -144,9 +144,41 @@ for cmd in sh sleep mkdir mount umount cat echo ls cp mv rm ln chmod chown \
     mktemp printf seq stat basename dirname env expr true false readlink \
     realpath rmdir uniq yes tar gzip gunzip hostname id ip modprobe \
     mkswap swapon vi df du diff xargs nohup pgrep killall cut whoami awk \
-    sync poweroff reboot halt mknod udhcpc; do
+    sync poweroff reboot halt mknod udhcpc \
+    pwd tty logger clear reset man less more tac nl fold cmp hexdump md5sum \
+    sha256sum sha512sum base64 nslookup ping traceroute pgrep pkill timeout \
+    stty sysctl free uptime uname usleep unzip zcat; do
     ln -s busybox "$IROOT/bin/$cmd"
 done
+# Real GNU bash — busybox's sh applet lacks bashisms (arrays, process
+# substitution, [[ ]], $'…' escapes, etc.) that Claude Code CLI's Bash tool
+# leans on, plus a lot of user-supplied commands. Ship the full binary from
+# the builder image + its shared lib dependencies so `bash -c "..."` works
+# without surprises.
+BASH_BIN=$(command -v bash)
+if [ -n "$BASH_BIN" ] && [ -f "$BASH_BIN" ]; then
+    cp -L "$BASH_BIN" "$IROOT/bin/bash"
+    chmod +x "$IROOT/bin/bash"
+    for dep in $(ldd "$BASH_BIN" 2>/dev/null | grep -oP '/\S+'); do
+        base=$(basename "$dep")
+        [ ! -f "$IROOT/lib64/$base" ] && cp -L "$(readlink -f "$dep")" "$IROOT/lib64/$base" 2>/dev/null || true
+    done
+    log "  Bundled GNU bash for Claude Code CLI"
+else
+    log "  bash not found on builder — Claude CLI Bash tool may fail"
+fi
+
+# Additional tools Claude's Bash tool commonly wants: jq for JSON, file
+# for type detection, strace for debugging. Best-effort — skip if absent.
+for bin in jq file strace; do
+    SRC_BIN=$(command -v "$bin" 2>/dev/null || true)
+    [ -z "$SRC_BIN" ] && continue
+    cp -L "$SRC_BIN" "$IROOT/bin/$bin"
+    for dep in $(ldd "$SRC_BIN" 2>/dev/null | grep -oP '/\S+'); do
+        base=$(basename "$dep")
+        [ ! -f "$IROOT/lib64/$base" ] && cp -L "$(readlink -f "$dep")" "$IROOT/lib64/$base" 2>/dev/null || true
+    done
+done
 # udhcpc also expected at /sbin/ by wifi.c
 ln -sf ../bin/busybox "$IROOT/sbin/udhcpc" 2>/dev/null || true
 
diff --git a/fedac/native/initramfs/init b/fedac/native/initramfs/init
index 0b5fdae352..f46cba855a 100755
--- a/fedac/native/initramfs/init
+++ b/fedac/native/initramfs/init
@@ -62,6 +62,14 @@ export SSL_CERT_FILE="/etc/pki/tls/certs/ca-bundle.crt"
 export CURL_CA_BUNDLE="/etc/pki/tls/certs/ca-bundle.crt"
 export SSL_CERT_DIR="/etc/ssl/certs"
 export HOME="/tmp"
+# Claude Code CLI (/bin/claude) reads SHELL to know which interpreter to
+# spawn for its Bash tool. Without this it errors with "SHELL env var
+# isn't set". /bin/sh is busybox — good enough to run short commands.
+# TERM gives rich output; COLORTERM hints truecolor so the CLI uses colors.
+export SHELL="/bin/sh"
+export TERM="${TERM:-xterm-256color}"
+export COLORTERM="truecolor"
+export EDITOR="/bin/vi"
 
 # ── Mount USB config/log partition (for config.json, wifi creds, logs) ──
 # Prefer the writable config partition over the boot partitions.