phase2: sanitize SDK host command symlinks