Not just that, the commands also have often slight variations in each new session. They still do the same, but the variations are enough so it isn't matched by the allowlist any more.

Exactly. It’s no surprise that people just blindly hit accept on permission prompts after the 80th time Claude code asks if it’s allowed to read-only parse a csv.