Feature request: Additive merging for permissions across settings files

Problem

Settings files use complete override rather than additive merging. When a project-level .claude/settings.local.json exists, it completely replaces the global ~/.claude/settings.local.json permissions rather than extending them.

This means users cannot:

1. Define global permissions that apply to all projects (e.g., mcp__atlassian__* for JIRA/Confluence access)
2. AND have project-specific settings that add additional permissions

Current behavior

Given:

• ~/.claude/settings.local.json with "allow": ["mcp__atlassian__*"]
• .claude/settings.local.json with "allow": []

Result: Atlassian MCP tools are blocked because the project-level empty array overrides the global permissions.

Desired behavior

Project-level allow arrays should merge additively with global allow arrays, so users can:

• Set baseline permissions globally
• Add project-specific permissions without losing global ones

Workarounds (all suboptimal)

1. Duplicate all global permissions in every project's settings file
2. Don't use project-level settings files at all
3. Accept that global permissions won't work if any project has local settings

Suggested implementation

Merge allow arrays from all applicable settings files (global + project), then apply deny rules on top. This would allow:

• Global baseline permissions
• Project-specific additions
• Project-specific denials that override global allows

---

Co-Authored-By: Claude <noreply@anthropic.com>