diff --git a/diagnostic/index.html b/diagnostic/index.html
index d6a0268..a40ba44 100644
--- a/diagnostic/index.html
+++ b/diagnostic/index.html
@@ -582,10 +582,12 @@
           const s = document.getElementById('perms-status');
           s.style.display = 'block';
           if (msg.ok) {
-            s.style.color = '#34C759';
-            s.innerHTML = (msg.info || 'Berechtigungen gespeichert!')
+            // Nachricht merken und nach Reload wieder anzeigen
+            permsSavedMsg = (msg.info || 'Berechtigungen gespeichert!')
               + '<br><span style="color:#FFD60A;font-size:10px;">Aenderungen werden erst bei einer neuen Session wirksam.</span>'
               + ' <button class="btn secondary" onclick="restartAriaSession()" style="padding:2px 8px;font-size:10px;margin-left:4px;">Session neu starten</button>';
+            s.style.color = '#34C759';
+            s.innerHTML = permsSavedMsg;
             loadPermissions();
           } else {
             s.style.color = '#FF6B6B';
@@ -1207,6 +1209,7 @@
 
     let permState = {}; // { toolId: true/false }
     let permsDirty = false;
+    let permsSavedMsg = ''; // Gespeicherte Erfolgsmeldung (ueberlebt renderPermissions)
 
     function loadPermissions() {
       const grid = document.getElementById('perms-grid');
@@ -1249,6 +1252,14 @@
         status.style.color = '#FFD60A';
         status.textContent = (data.info || '') + ' — Kein Tool-Filter gesetzt: alle Tools sind erlaubt. Speichern um explizit zu setzen.';
       }
+      // Debug-Info anzeigen (Settings-Pfade)
+      if (data.debug) {
+        const dbg = document.createElement('div');
+        dbg.style.cssText = 'font-size:9px;color:#555570;margin-top:6px;font-family:monospace;white-space:pre-line;';
+        dbg.textContent = (data.debug.allPaths || '?') + '\nKeys: ' + (data.debug.rawKeys || 'keine');
+        if (hasExplicitList) dbg.textContent += '\nallowedTools: [' + data.allowedTools.join(', ') + ']';
+        status.appendChild(dbg);
+      }
 
       // Gruppieren nach Kategorie
       const cats = {};
@@ -1271,6 +1282,14 @@
       grid.innerHTML = html;
       permsDirty = false;
       document.getElementById('btn-save-perms').disabled = true;
+
+      // Gespeicherte Erfolgsmeldung nach Reload wieder anzeigen
+      if (permsSavedMsg) {
+        status.style.display = 'block';
+        status.style.color = '#34C759';
+        status.innerHTML = permsSavedMsg;
+        permsSavedMsg = ''; // Nur einmal anzeigen
+      }
     }
 
     function togglePerm(toolId, enabled) {
diff --git a/diagnostic/server.js b/diagnostic/server.js
index fd585c9..e447a36 100644
--- a/diagnostic/server.js
+++ b/diagnostic/server.js
@@ -1423,13 +1423,28 @@ async function handleListPermissions(clientWs) {
   try {
     log("info", "server", "Lade Tool-Berechtigungen...");
 
+    // Alle moeglichen Settings-Dateien pruefen (Debug-Info)
+    let allPaths = "";
+    try {
+      allPaths = await dockerExec("aria-core", `
+        for f in ${OPENCLAW_SETTINGS_PATHS.join(" ")}; do
+          if [ -f "$f" ]; then
+            echo "EXISTS: $f ($(wc -c < "$f") bytes)"
+          else
+            echo "MISSING: $f"
+          fi
+        done
+      `.trim());
+    } catch {}
+
     const settingsPath = await findSettingsFile();
     let settings = {};
+    let rawContent = "";
     let info = "";
 
     try {
-      const raw = await dockerExec("aria-core", `cat '${settingsPath}' 2>/dev/null || echo '{}'`);
-      settings = JSON.parse(raw.trim() || "{}");
+      rawContent = await dockerExec("aria-core", `cat '${settingsPath}' 2>/dev/null || echo '{}'`);
+      settings = JSON.parse(rawContent.trim() || "{}");
       info = `Geladen aus: ${settingsPath}`;
     } catch (e) {
       info = `Settings-Datei nicht lesbar (${settingsPath}) — Default-Berechtigungen`;
@@ -1446,8 +1461,10 @@ async function handleListPermissions(clientWs) {
       permissions,
       settingsPath,
       info,
+      debug: { allPaths: allPaths.trim(), rawKeys: Object.keys(settings).join(", ") },
     }));
-    log("info", "server", `Berechtigungen geladen (${allowedTools.length} Tools explizit erlaubt)`);
+    log("info", "server", `Berechtigungen geladen (${allowedTools.length} Tools explizit erlaubt) aus ${settingsPath}`);
+    if (allPaths) log("info", "server", `Settings-Dateien:\n${allPaths}`);
   } catch (err) {
     log("error", "server", `Berechtigungen laden fehlgeschlagen: ${err.message}`);
     clientWs.send(JSON.stringify({ type: "permissions_list", error: err.message, allowedTools: [], permissions: {} }));
@@ -1460,21 +1477,23 @@ async function handleSavePermissions(clientWs, allowedTools) {
     return;
   }
   try {
-    const settingsPath = await findSettingsFile();
-    log("info", "server", `Speichere ${allowedTools.length} Tool-Berechtigungen in ${settingsPath}`);
+    log("info", "server", `Speichere ${allowedTools.length} Tool-Berechtigungen in alle Settings-Pfade`);
 
     // Bestehende Settings lesen und mergen
+    // Schreiben in ALLE moeglichen Pfade damit OpenClaw es sicher findet
     const script = [
-      'const fs=require("fs");',
-      `const f="${settingsPath}";`,
+      'const fs=require("fs");const path=require("path");',
+      `const paths=${JSON.stringify(OPENCLAW_SETTINGS_PATHS)};`,
       `const tools=${JSON.stringify(allowedTools)};`,
-      'let s={};try{s=JSON.parse(fs.readFileSync(f,"utf8"));}catch(e){}',
-      's.allowedTools=tools;',
-      `const dir=f.substring(0,f.lastIndexOf("/"));`,
-      'try{fs.mkdirSync(dir,{recursive:true});}catch(e){}',
-      'fs.writeFileSync(f,JSON.stringify(s,null,2));',
-      // Verify: zuruecklesen und pruefen
-      'const v=JSON.parse(fs.readFileSync(f,"utf8"));',
+      'for(const f of paths){',
+        'let s={};try{s=JSON.parse(fs.readFileSync(f,"utf8"));}catch(e){}',
+        's.allowedTools=tools;',
+        'const dir=path.dirname(f);',
+        'try{fs.mkdirSync(dir,{recursive:true});}catch(e){}',
+        'fs.writeFileSync(f,JSON.stringify(s,null,2));',
+      '}',
+      // Verify: ersten Pfad zuruecklesen
+      `const v=JSON.parse(fs.readFileSync(paths[0],"utf8"));`,
       'process.stdout.write(JSON.stringify(v.allowedTools||[]));',
     ].join("");
     const b64 = Buffer.from(script).toString("base64");
@@ -1501,7 +1520,7 @@ async function handleSavePermissions(clientWs, allowedTools) {
 
     clientWs.send(JSON.stringify({
       type: "permissions_saved", ok: true,
-      info: `${allowedTools.length} Tools gespeichert und verifiziert in ${settingsPath}`,
+      info: `${allowedTools.length} Tools gespeichert und verifiziert (alle ${OPENCLAW_SETTINGS_PATHS.length} Pfade)`,
       needsRestart: true,
     }));
     log("info", "server", `Berechtigungen gespeichert und verifiziert (${allowedTools.length} Tools)`);