[BUG] additionalDirectories approved in one project leak into all projects via global settings (project contamination)

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

When I approve file access to paths outside the primary working directory in Project A, those paths are stored as additionalDirectories in the global settings file (~/.claude/settings.json). When I later open an unrelated Project B, those paths appear as "Additional working directories" in the environment context.

This causes subagents to search in completely unrelated project directories. For example, a subagent tasked with "explore the CV page" in my portfolio project wandered into a different project (Dave-CV) because its path happened to contain "CV" and it was listed as an additional working directory.

This has happened multiple times across sessions.

---
Claude Code VS Code extension
Windows 11
2.1.76 (Claude Code)

What Should Happen?

additionalDirectories should be scoped to the project where access was approved — stored in <project>/.claude/settings.json, not the global ~/.claude/settings.json. Opening a different project should not show directories from unrelated projects.

Error Messages/Logs

# From ~/.claude/settings.json (global, NOT project-specific):

"additionalDirectories": [
  "e:\\SynologyDrive\\PROJECTS\\Dave-CV\\src\\app\\api\\video",
  "C:\\Users\\Milan\\.claude\\plugins\\cache\\claude-plugins-official\\superpowers\\5.0.5\\commands",
  "e:\\SynologyDrive\\PROJECTS\\Dave-CV\\docs\\superpowers",
  "e:\\SynologyDrive\\PROJECTS\\Dave-CV\\.claude"
]

# These Dave-CV paths were approved during a Dave-CV session but appear
# as "Additional working directories" when working in an unrelated project (portfolio-steve).

Steps to Reproduce

1. Open Project A in VS Code with Claude Code extension
2. During a session, approve file access to a path outside the project root (e.g., approve reading a file in another project's directory)
3. The path gets added to ~/.claude/settings.json under permissions.additionalDirectories
4. Close the session. Open Project B (completely unrelated)
5. Start a new Claude Code session in Project B
6. The environment context now shows Project A's paths as "Additional working directories"
7. Subagents may search those unrelated directories, causing confusion and wasted tokens

Claude Model

Opus

Is this a regression?

I don't know

Last Working Version

_No response_

Claude Code Version

2.1.76

Platform

Anthropic API

Operating System

Windows

Terminal/Shell

VS Code integrated terminal

Additional Information

_No response_