It's repairable, although not necessarily economical to do so.

One option (I hope you have chroot?) is to chroot /mnt/initfs (then that busybox works), (re)mount both the SD root and the flash root under the initfs, and proceed copying and linking merrily away...

If you can't do that, and don't have cp, it gets to be a huge pain to continue working, and you might be better to reboot into flash -- somehow that doesn't feel safe, but I don't really see any reason it should be harder to repair from outside...

If you want to keep working via ssh, you'll need to:

• mount the flash root somewhere, e.g.
  Code:

  mount -t jffs2 /dev/mtdblock4 /floppy

  (Since mount is busybox, this probably has to be done chrooted into /mnt/initfs, though...)
• use tar and untar to copy busybox (and whatever else) over.

You'll need to get busybox in, and then you can use it as ls, cp, ln, etc.
I don't know how up you are with busybox, but it normally plays the role given by the zeroth argument, i.e. whatever it was invoked as. So /bin/ln is actually a symlink to busybox. But if you invoke it as busybox, it will play the role given by the first argument, so once you get /bin/busybox in, you can doAnd so on.

And I just checked -- mount and chroot are both busybox. I think you're going to have to boot to flash after all.