Project-level permissions replace global permissions instead of merging

Description

When a project has a local .claude/settings.local.json file with a permissions block, it appears to replace the global permissions from ~/.claude/settings.local.json rather than merging with them.

Expected Behavior

Global and local permissions should merge:

• Global allow: ["mcp__Ref__ref_search_documentation", "mcp__Ref__ref_read_url", "WebSearch", ...]
• Local allow: ["mcp__expo-mcp__search_documentation"]
• Effective allow: Union of both lists

Actual Behavior

Local permissions replace global:

• Tools allowed globally (e.g., mcp__Ref__ref_read_url) still prompt for permission when a local permissions block exists but doesn't include them
• Users must duplicate all global permissions in every project's local settings

Steps to Reproduce

1. Add "mcp__Ref__ref_read_url" to global ~/.claude/settings.local.json permissions allow list
2. Create a project with .claude/settings.local.json that has a permissions block but doesn't include that tool
3. Try to use the Ref tool - it will prompt for permission despite being globally allowed

Impact

This defeats the purpose of global settings. Users expect global permissions to apply everywhere unless explicitly overridden locally.

Suggested Fix

Merge permission arrays (union for allow, union for deny) rather than replacing them entirely when local settings exist.

---
🤖 Generated with Claude Code