The fix: split on && || ; |, strip env/nohup/timeout/xargs wrappers, compare Path(token).name, then block nested shells (-c), inline code (python -c, node -e), eval, base64|sh, and $(...) using the regex that already existed.
18 new tests. 170 total. CI green.