allowed-tools frontmatter grants a Bash permission exactly once per session, then re-prompts on identical subsequent calls

A Skill's SKILL.md frontmatter includes:

allowed-tools: Bash(python3 ${CLAUDE_PLUGIN_ROOT}/skills/practice/scripts/roll.py *)

Docs state allowed-tools grants apply "while the skill is active," and that a skill's content "stays [in the conversation] for the rest of the session" — implying the grant should hold for the whole session.

Observed: the first invocation of Bash(python3 .../roll.py <args>) in a session runs with no permission prompt, as expected. Every subsequent invocation of the same command pattern (identical prefix, only trailing numeric args differ) — even the exact same full command string used before — prompts for permission, in the same continuous session, same active skill, no restart.

This is fully consistent/reproducible, not intermittent: reproduced across 3 separate sessions, always free on the 1st use, always prompts from the 2nd use onward.

Expected: the grant should hold for the session, per docs.

Repro: any Skill with a Bash(...)-pattern allowed-tools entry, invoked more than once in one session.