From 078b599f7c455b0f0b3b1eac9070790cdf345747 Mon Sep 17 00:00:00 2001
From: ZxlDragonDoctor <152901610+ZxlDragonDoctor@users.noreply.github.com>
Date: Thu, 10 Sep 2026 19:18:02 +0800
Subject: [PATCH] fix(hooks): map Copilot task/web_search in COPILOT_TOOL_MAP

Without these entries a policy matching toolName === Task or
WebSearch silently never fires on Copilot sessions. ask_user is
left unmapped (no filesystem or shell reach).

Fixes #690
---
 __tests__/hooks/handler.test.ts | 2 ++
 src/hooks/types.ts              | 6 ++++++
 2 files changed, 8 insertions(+)

diff --git a/__tests__/hooks/handler.test.ts b/__tests__/hooks/handler.test.ts
index b9f80f64..53fa5403 100644
--- a/__tests__/hooks/handler.test.ts
+++ b/__tests__/hooks/handler.test.ts
@@ -443,6 +443,8 @@ describe("hooks/handler", () => {
         ["rg", "Grep"],
         ["ls", "LS"],
         ["web_fetch", "WebFetch"],
+        ["task", "Task"],
+        ["web_search", "WebSearch"],
       ];
       for (const [raw, canonical] of cases) {
         vi.mocked(evaluatePolicies).mockResolvedValueOnce({
diff --git a/src/hooks/types.ts b/src/hooks/types.ts
index fd2ff7f3..8e3bf63c 100644
--- a/src/hooks/types.ts
+++ b/src/hooks/types.ts
@@ -275,6 +275,12 @@ export const COPILOT_TOOL_MAP: Record<string, string> = {
   rg: "Grep",
   ls: "LS",
   web_fetch: "WebFetch",
+  // Documented Copilot tools that launch subagents / web search. Without these
+  // entries a policy matching `toolName === "Task"` (or `"WebSearch"`)
+  // silently never fires on Copilot — the worst failure mode for a guardrail.
+  // `ask_user` is intentionally unmapped: it has no filesystem or shell reach.
+  task: "Task",
+  web_search: "WebSearch",
 };
 
 /**