Summary

src/plugin-config.ts treats disabled_tools as a partially valid string-array section, but mergeConfigs() does not union it the way it already unions:

• disabled_agents
• disabled_mcps
• disabled_hooks
• disabled_commands
• disabled_skills

That means project-level disabled_tools can replace or shadow user-level disabled_tools instead of preserving both.

Evidence

• PARTIAL_STRING_ARRAY_KEYS includes disabled_tools near the top of src/plugin-config.ts
• mergeConfigs() unions five disabled arrays but omits disabled_tools
• src/plugin-config.test.ts has merge coverage for disabled_hooks but no equivalent test for disabled_tools

Impact

• user-level disabled tools can silently reappear when project config is merged
• config semantics are inconsistent across the disabled_* family
• debugging config precedence is harder than necessary

Proposed fix

• union disabled_tools in mergeConfigs() exactly like the other disabled arrays
• add regression tests proving user + project disabled tools are preserved and deduplicated

Acceptance criteria

• merging config preserves both base and override disabled_tools
• duplicates are removed
• regression test covers the omission