From 1d20cac5820cdbd2a104a74e5b0d492f921cc73e Mon Sep 17 00:00:00 2001
From: MoerAI <friendnt@g.skku.edu>
Date: Fri, 20 Feb 2026 10:47:10 +0900
Subject: [PATCH 1/2] fix(config): respect user's external_directory permission
 setting

applyToolConfig() forcibly overrode the user's external_directory
permission to 'allow' by placing OMO defaults after the user config
spread. Reorder so defaults come first and user config spreads on
top, allowing users to set 'ask' or 'deny'. The task permission
remains forced to 'deny' after the spread for security.

Closes #1973
---
 src/plugin-handlers/tool-config-handler.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/plugin-handlers/tool-config-handler.ts b/src/plugin-handlers/tool-config-handler.ts
index e488d2da9..381dbb55c 100644
--- a/src/plugin-handlers/tool-config-handler.ts
+++ b/src/plugin-handlers/tool-config-handler.ts
@@ -99,9 +99,9 @@ export function applyToolConfig(params: {
   }
 
   params.config.permission = {
-    ...(params.config.permission as Record<string, unknown>),
     webfetch: "allow",
     external_directory: "allow",
+    ...(params.config.permission as Record<string, unknown>),
     task: "deny",
   };
 }

From 247fa0543269b262a315c4d34ef38aeb2a3bf96c Mon Sep 17 00:00:00 2001
From: MoerAI <friendnt@g.skku.edu>
Date: Mon, 23 Feb 2026 10:21:45 +0900
Subject: [PATCH 2/2] fix(test): update EventState inline literal to use
 createEventState() spread

EventState interface gained new required fields; the inline literal in the
session.status test was missing them, causing type errors and runtime failures.
---
 src/cli/run/events.test.ts | 8 +-------
 1 file changed, 1 insertion(+), 7 deletions(-)

diff --git a/src/cli/run/events.test.ts b/src/cli/run/events.test.ts
index 2afc216f8..502db8623 100644
--- a/src/cli/run/events.test.ts
+++ b/src/cli/run/events.test.ts
@@ -318,14 +318,8 @@ describe("event handling", () => {
     // given
     const ctx = createMockContext("my-session")
     const state: EventState = {
+      ...createEventState(),
       mainSessionIdle: true,
-      mainSessionError: false,
-      lastError: null,
-      lastOutput: "",
-      lastPartText: "",
-      currentTool: null,
-      hasReceivedMeaningfulWork: false,
-      messageCount: 0,
     }
 
     const payload: EventPayload = {