Hey, thanks for the report. I can see the screenshot. This is a bug in the allowlist command parser. The parser incorrectly treats -- the end-of-options marker as a command name. It also seems to miss terraform, which is the actual command here. The team is aware of allowlist parsing issues.
On the second part, granular control for subcommands like terraform plan separately from terraform apply has been requested by other users too:
Feel free to upvote it to help us prioritize it.
Let me know if anything else comes up.