diff --git a/src/plugin-handlers/tool-config-handler.ts b/src/plugin-handlers/tool-config-handler.ts
index 4be1f2937..d9cd4ce94 100644
--- a/src/plugin-handlers/tool-config-handler.ts
+++ b/src/plugin-handlers/tool-config-handler.ts
@@ -116,9 +116,9 @@ export function applyToolConfig(params: {
   }
 
   params.config.permission = {
+    ...(params.config.permission as Record<string, unknown>),
     webfetch: "allow",
     external_directory: "allow",
-    ...(params.config.permission as Record<string, unknown>),
     task: "deny",
   };
 }