add 'watch' command

[finishes #83094032]
hijack takes a flag for --privileged