From 1d20cac5820cdbd2a104a74e5b0d492f921cc73e Mon Sep 17 00:00:00 2001
From: MoerAI <friendnt@g.skku.edu>
Date: Fri, 20 Feb 2026 10:47:10 +0900
Subject: [PATCH] fix(config): respect user's external_directory permission
 setting

applyToolConfig() forcibly overrode the user's external_directory
permission to 'allow' by placing OMO defaults after the user config
spread. Reorder so defaults come first and user config spreads on
top, allowing users to set 'ask' or 'deny'. The task permission
remains forced to 'deny' after the spread for security.

Closes #1973
---
 src/plugin-handlers/tool-config-handler.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/plugin-handlers/tool-config-handler.ts b/src/plugin-handlers/tool-config-handler.ts
index e488d2da9..381dbb55c 100644
--- a/src/plugin-handlers/tool-config-handler.ts
+++ b/src/plugin-handlers/tool-config-handler.ts
@@ -99,9 +99,9 @@ export function applyToolConfig(params: {
   }
 
   params.config.permission = {
-    ...(params.config.permission as Record<string, unknown>),
     webfetch: "allow",
     external_directory: "allow",
+    ...(params.config.permission as Record<string, unknown>),
     task: "deny",
   };
 }