Bash(awk *) traded a single permission prompt for an unbounded write
grant — awk writes files via print redirection, so the rule permitted
arbitrary filesystem writes under the guise of a text-processing tool.
Scripts that call awk internally are unaffected: permission rules match
the top-level command string only, so make targets and ci/test.sh keep
working. Only direct awk invocation now prompts. Shell glue needed more
than once belongs in a named make target that can be allowlisted for
what it actually does.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
jpmschweitzerandClaude Opus 5
4a8f0884fe