The root issue is not the button, it is that the allowlist stores the full command string, including whatever was in it. We ran into this ourselves: approve `curl -H "Authorization: Bearer sk-..."` once and that token sits in settings.local.json until someone happens to reread the file.

Two rules that stuck for us: secrets go into commands only via env vars ($TOKEN, never the value), and .claude/ lives in the machine-wide global gitignore, not in the repo. With those, "Don't ask again" is fine and a commit has nothing to leak.

I always thought Kiro did a better job with permission prompts and falls more in line with what I set up except for I manage permissions on the host.

Example

``` # cat -A /tmp/foo/bar/baz.md

# permission options cat -A /tmp/foo/bar/baz.md cat /tmp/foo/bar/baz.md cat /tmp/foo/bar/* cat /tmp/* cat * ```

I'm sure there's improvements to make but I always found it silly to over complicate the permissions if I'm trying to prevent common operations from being prevented