Permissions array gets completely overwritten instead of appending new permissions

Bug Description

When approving a new command permission in Claude Code, the entire permissions.allow array in .claude/settings.local.json gets replaced with only the newly approved permission, losing all previously configured permissions.

Steps to Reproduce

1. Have multiple permissions configured in .claude/settings.local.json
2. Run a new command that requires permission approval in Claude Code
3. Approve the permission
4. Check .claude/settings.local.json - all previous permissions are gone

Expected Behavior

The new permission should be appended to the existing permissions.allow array, preserving all previously configured permissions.

Actual Behavior

The entire permissions.allow array is replaced with only the newly approved permission, causing data loss.

Example

Before approving WebFetch(domain:github.com):

{
  "permissions": {
    "allow": [
      "Bash(npm run build:*)",
      "Bash(curl:*)",
      "Bash(git:*)"
    ]
  }
}

After approving WebFetch(domain:github.com):

{
  "permissions": {
    "allow": [
      "WebFetch(domain:github.com)"  // All previous permissions lost\!
    ]
  }
}

Impact

• Users lose all their previously configured permissions
• Have to manually restore from backups
• Disrupts workflow as previously approved commands need re-approval
• Security implications as users might approve broader permissions to avoid repeated approvals

Workaround

Currently backing up .claude/settings.local.json before each session.

Environment

• Claude Code version: Latest
• OS: macOS
• Project: Local project with .claude/settings.local.json