Avoid passing unescaped args to subprocess.