Project-level permissions replace global permissions instead of merging

[gregoramon]

Description

When a project has a local .claude/settings.local.json file with a permissions block, it appears to replace the global permissions from ~/.claude/settings.local.json rather than merging with them.

Expected Behavior

Global and local permissions should merge:

• Global allow: ["mcp__Ref__ref_search_documentation", "mcp__Ref__ref_read_url", "WebSearch", ...]
• Local allow: ["mcp__expo-mcp__search_documentation"]
• Effective allow: Union of both lists

Actual Behavior

Local permissions replace global:

• Tools allowed globally (e.g., mcp__Ref__ref_read_url) still prompt for permission when a local permissions block exists but doesn't include them
• Users must duplicate all global permissions in every project's local settings

Steps to Reproduce

1. Add "mcp__Ref__ref_read_url" to global ~/.claude/settings.local.json permissions allow list
2. Create a project with .claude/settings.local.json that has a permissions block but doesn't include that tool
3. Try to use the Ref tool - it will prompt for permission despite being globally allowed

Impact

This defeats the purpose of global settings. Users expect global permissions to apply everywhere unless explicitly overridden locally.

Suggested Fix

Merge permission arrays (union for allow, union for deny) rather than replacing them entirely when local settings exist.

---

🤖 Generated with Claude Code

[github-actions]

Found 2 possible duplicate issues:

1. [BUG] permissions from user settings.json is NOT applied at project level #5140
2. [BUG] --scope user MCP servers are not truly user-wide; project configs override without inheritance #16728

This issue will be automatically closed as a duplicate in 3 days.

• If your issue is a duplicate, please close it and 👍 the existing issue instead
• To prevent auto-closure, add a comment or 👎 this comment

🤖 Generated with Claude Code

[jwalls89]

I'm finding the same issue

[anderewrey]

same here.

Official Claude Code documentation mentions there's "merge" of the settings.
https://code.claude.com/docs/en/settings

Precedence: Higher-level configurations (Managed) override lower-level ones (User/Project)
Inheritance: Settings are merged, with more specific settings adding to or overriding broader ones

So the documentation must be adjusted or allowing it correctly!