diff --git a/src/plugin-handlers/tool-config-handler.test.ts b/src/plugin-handlers/tool-config-handler.test.ts
new file mode 100644
index 000000000..4ba70497a
--- /dev/null
+++ b/src/plugin-handlers/tool-config-handler.test.ts
@@ -0,0 +1,83 @@
+import { describe, it, expect } from "bun:test"
+import { applyToolConfig } from "./tool-config-handler"
+import type { OhMyOpenCodeConfig } from "../config"
+
+function createParams(overrides: {
+  taskSystem?: boolean
+  agents?: string[]
+}) {
+  const agentResult: Record<string, { permission?: Record<string, unknown> }> = {}
+  for (const agent of overrides.agents ?? []) {
+    agentResult[agent] = { permission: {} }
+  }
+
+  return {
+    config: { tools: {}, permission: {} } as Record<string, unknown>,
+    pluginConfig: {
+      experimental: { task_system: overrides.taskSystem ?? false },
+    } as OhMyOpenCodeConfig,
+    agentResult: agentResult as Record<string, unknown>,
+  }
+}
+
+describe("applyToolConfig", () => {
+  describe("#given task_system is enabled", () => {
+    describe("#when applying tool config", () => {
+      it("#then should deny todowrite and todoread globally", () => {
+        const params = createParams({ taskSystem: true })
+
+        applyToolConfig(params)
+
+        const tools = params.config.tools as Record<string, unknown>
+        expect(tools.todowrite).toBe(false)
+        expect(tools.todoread).toBe(false)
+      })
+
+      it.each([
+        "atlas",
+        "sisyphus",
+        "hephaestus",
+        "prometheus",
+        "sisyphus-junior",
+      ])("#then should deny todo tools for %s agent", (agentName) => {
+        const params = createParams({
+          taskSystem: true,
+          agents: [agentName],
+        })
+
+        applyToolConfig(params)
+
+        const agent = params.agentResult[agentName] as {
+          permission: Record<string, unknown>
+        }
+        expect(agent.permission.todowrite).toBe("deny")
+        expect(agent.permission.todoread).toBe("deny")
+      })
+    })
+  })
+
+  describe("#given task_system is disabled", () => {
+    describe("#when applying tool config", () => {
+      it.each([
+        "atlas",
+        "sisyphus",
+        "hephaestus",
+        "prometheus",
+        "sisyphus-junior",
+      ])("#then should NOT deny todo tools for %s agent", (agentName) => {
+        const params = createParams({
+          taskSystem: false,
+          agents: [agentName],
+        })
+
+        applyToolConfig(params)
+
+        const agent = params.agentResult[agentName] as {
+          permission: Record<string, unknown>
+        }
+        expect(agent.permission.todowrite).toBeUndefined()
+        expect(agent.permission.todoread).toBeUndefined()
+      })
+    })
+  })
+})
diff --git a/src/plugin-handlers/tool-config-handler.ts b/src/plugin-handlers/tool-config-handler.ts
index 9f8435a37..e488d2da9 100644
--- a/src/plugin-handlers/tool-config-handler.ts
+++ b/src/plugin-handlers/tool-config-handler.ts
@@ -84,6 +84,7 @@ export function applyToolConfig(params: {
       question: questionPermission,
       "task_*": "allow",
       teammate: "allow",
+      ...denyTodoTools,
     };
   }
   const junior = agentByKey(params.agentResult, "sisyphus-junior");
@@ -93,6 +94,7 @@ export function applyToolConfig(params: {
       task: "allow",
       "task_*": "allow",
       teammate: "allow",
+      ...denyTodoTools,
     };
   }