Expand description
Deliberately small allowlists, not executable-name or prompt heuristics. Installation paths identify supported layouts; they do not authenticate code. Overwritten process titles/argv are not reconstructed from names or environment. If the remaining argv is unrecognizable, even a known installation is rejected.