From ad79246376ef01554cb2319bfa230b88a25fc59c Mon Sep 17 00:00:00 2001
From: MoerAI <friendnt@g.skku.edu>
Date: Fri, 20 Feb 2026 10:47:10 +0900
Subject: [PATCH] fix(config): respect user's external_directory permission
 setting

applyToolConfig() forcibly overrode the user's external_directory
permission to 'allow' by placing OMO defaults after the user config
spread. Reorder so defaults come first and user config spreads on
top, allowing users to set 'ask' or 'deny'. The task permission
remains forced to 'deny' after the spread for security.

Closes #1973
---
 src/plugin-handlers/tool-config-handler.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/plugin-handlers/tool-config-handler.ts b/src/plugin-handlers/tool-config-handler.ts
index e488d2da..381dbb55 100644
--- a/src/plugin-handlers/tool-config-handler.ts
+++ b/src/plugin-handlers/tool-config-handler.ts
@@ -99,9 +99,9 @@ export function applyToolConfig(params: {
   }
 
   params.config.permission = {
-    ...(params.config.permission as Record<string, unknown>),
     webfetch: "allow",
     external_directory: "allow",
+    ...(params.config.permission as Record<string, unknown>),
     task: "deny",
   };
 }