- Strip execution prefixes (`env NAME=v`, `sudo -u user`, `command`,
`nice -n N`, `timeout DURATION`, `stdbuf`, `ionice`, `setsid`, ...) with
their options before argv0 is classified, so `env PGHOST=db psql -c
"drop table users"` is gated like the bare client.
- Recognise a shell's `-c` inside a short-option cluster (`bash -lc`,
`sh -ec`) when recursing into the command string.
- Skip filename-like words (`truncate.db`, `-f truncate.sql`,
`--file=x.sql`) in the SQL phrase scan, both for client arguments and
for the flattened command text; `dd if=disk.img` stays matched.
L4XB
a0f22b0b67