From ad79246376ef01554cb2319bfa230b88a25fc59c Mon Sep 17 00:00:00 2001
From: MoerAI <friendnt@g.skku.edu>
Date: Fri, 20 Feb 2026 10:47:10 +0900
Subject: [PATCH 1/2] fix(config): respect user's external_directory permission
 setting

applyToolConfig() forcibly overrode the user's external_directory
permission to 'allow' by placing OMO defaults after the user config
spread. Reorder so defaults come first and user config spreads on
top, allowing users to set 'ask' or 'deny'. The task permission
remains forced to 'deny' after the spread for security.

Closes #1973
---
 src/plugin-handlers/tool-config-handler.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/plugin-handlers/tool-config-handler.ts b/src/plugin-handlers/tool-config-handler.ts
index e488d2da9..381dbb55c 100644
--- a/src/plugin-handlers/tool-config-handler.ts
+++ b/src/plugin-handlers/tool-config-handler.ts
@@ -99,9 +99,9 @@ export function applyToolConfig(params: {
   }
 
   params.config.permission = {
-    ...(params.config.permission as Record<string, unknown>),
     webfetch: "allow",
     external_directory: "allow",
+    ...(params.config.permission as Record<string, unknown>),
     task: "deny",
   };
 }

From 8d66ab742bab6ed4bac977eaa0c99c4544da4eab Mon Sep 17 00:00:00 2001
From: MoerAI <friendnt@g.skku.edu>
Date: Mon, 23 Feb 2026 10:21:45 +0900
Subject: [PATCH 2/2] fix(test): update EventState inline literal to use
 createEventState() spread

EventState interface gained new required fields; the inline literal in the
session.status test was missing them, causing type errors and runtime failures.
---
 src/cli/run/events.test.ts | 8 +-------
 1 file changed, 1 insertion(+), 7 deletions(-)

diff --git a/src/cli/run/events.test.ts b/src/cli/run/events.test.ts
index 2afc216f8..502db8623 100644
--- a/src/cli/run/events.test.ts
+++ b/src/cli/run/events.test.ts
@@ -318,14 +318,8 @@ describe("event handling", () => {
     // given
     const ctx = createMockContext("my-session")
     const state: EventState = {
+      ...createEventState(),
       mainSessionIdle: true,
-      mainSessionError: false,
-      lastError: null,
-      lastOutput: "",
-      lastPartText: "",
-      currentTool: null,
-      hasReceivedMeaningfulWork: false,
-      messageCount: 0,
     }
 
     const payload: EventPayload = {