[BUG] permissions precedence not followed between user settings and local project settings

[GomezDerek]

Preflight Checklist

• I have searched existing issues and this hasn't been reported yet
• This is a single bug report (please file separate reports for different bugs)
• I am using the latest version of Claude Code

What's Wrong?

Local project settings permissions are overridden by user settings permissions. If a bash command is allowed by .claude/settings.local.json but it's denied in ~/.claude/settings.json, Claude Code will be denied execution permission.

What Should Happen?

Claude Code should have permissions to execute the bash command allowed in .claude/settings.local.json

Local project settings should take precedence and override user settings. According to the docs, https://code.claude.com/docs/en/settings#settings-precedence

Settings are applied in order of precedence (highest to lowest):

1. Enterprise managed policies (managed-settings.json)

• Deployed by IT/DevOps
• Cannot be overridden

2. Command line arguments

• Temporary overrides for a specific session

3. Local project settings (.claude/settings.local.json)

• Personal project-specific settings

4. Shared project settings (.claude/settings.json)

• Team-shared project settings in source control

5. User settings (~/.claude/settings.json)

• Personal global settings

Furthermore, https://code.claude.com/docs/en/settings#key-points-about-the-configuration-system

• Precedence: Higher-level configurations (Enterprise) override lower-level ones (User/Project)
• Inheritance: Settings are merged, with more specific settings adding to or overriding broader ones

Error Messages/Logs

Bash(ls)
  ⎿  Error: Permission to use Bash with command ls has been denied.

Bash(ls -la)
  ⎿  Error: Permission to use Bash with command ls -la has been denied.

Steps to Reproduce

1. Add "Bash(ls:*)" to the deny list in user settings, ~/.claude/settings.json
2. Add "Bash(ls:*)" to the allow list in local project settings, .claude/settings.local.json
3. Start a Claude Code instance and prompt run the ls bash command

Claude Model

Sonnet (default)

Is this a regression?

I don't know

Last Working Version

No response

Claude Code Version

2.0.55

Platform

Anthropic API

Operating System

Ubuntu/Debian Linux

Terminal/Shell

VS Code integrated terminal

Additional Information

[github-actions]

Found 3 possible duplicate issues:

1. [BUG] Permissions hierarchy issue #10185
2. [BUG] Claude continually asks for permission,even add permissin in .claude/settings.local.json #11471
3. Claude Code ignores deny rules in .claude/settings.local.json - security vulnerability #8961

This issue will be automatically closed as a duplicate in 3 days.

• If your issue is a duplicate, please close it and 👍 the existing issue instead
• To prevent auto-closure, add a comment or 👎 this comment

🤖 Generated with Claude Code

[github-actions]

This issue has been automatically locked since it was closed and has not had any activity for 7 days. If you're experiencing a similar issue, please file a new issue and reference this one if it's relevant.