Surface ask_user as approval="ask" to preToolCall hooks

ask_user always blocks waiting for the user regardless of trust mode,
so existing notification hooks matching .approval == "ask" should also
fire for it. The hook input is forced to :ask only when the resolved
approval is :allow; the actual decision stays :allow so the tool
executes normally, and explicit :deny rules are preserved.

🤖 Generated with [eca](https://eca.dev)

Co-Authored-By: eca-agent <git@eca.dev>

Author: ericdallo

CHANGELOG.md

@@ -2,6 +2,8 @@
 
 ## Unreleased
 
+- `preToolCall` hooks now receive `approval: "ask"` for the native `ask_user` tool so notification hooks (e.g. matching `.approval == "ask"`) also fire when the chat is blocked waiting for a user answer, regardless of trust mode.
+
 ## 0.129.2
 
 - Add support for gpt-5.5 variants

docs/config/hooks.md

@@ -102,6 +102,12 @@ To reject a tool call, either output `{"approval": "deny"}` or exit with code `2
     }
     ```
 
+    The same hook also fires for the native `ask_user` tool: it always blocks
+    waiting for a user answer (regardless of trust mode), so `preToolCall`
+    receives `approval: "ask"` for it. This means a single `'.approval == "ask"'`
+    hook covers both "tool call needs approval" and "assistant is waiting on a
+    user question".
+
 === "Inject context on chat start"
 
     ```javascript title="~/.config/eca/config.json"

src/eca/features/chat/tool_calls.clj

@@ -546,6 +546,16 @@
         trusted? (= :trust/allow approval)
         effective-approval (if trusted? :allow approval)
 
+        ;; ask_user always blocks waiting for the user regardless of trust/auto-allow.
+        ;; Surface that as :ask to preToolCall hooks so notification hooks
+        ;; (e.g. matching .approval == "ask") also fire when the chat is blocked on
+        ;; a user question. Only override when allowed; explicit deny is preserved.
+        hook-approval (if (and (= "eca" server-name)
+                               (= "ask_user" name)
+                               (= :allow effective-approval))
+                        :ask
+                        effective-approval)
+
         ;; 2. Run hooks to collect modifications and approval overrides
         hook-state* (atom {:hook-results []
                            :approval-override nil
@@ -560,7 +570,7 @@
                   {:tool-name name
                    :server server-name
                    :tool-input arguments
-                   :approval effective-approval})
+                   :approval hook-approval})
            {:on-before-action on-before-hook-action
             :on-after-action (fn [result]
                                (on-after-hook-action result)

test/eca/features/chat/tool_calls_test.clj

@@ -276,7 +276,78 @@
                        :approval-override nil
                        :hook-rejected? false
                        :arguments-modified? true}
-                      plan)))))))
+                      plan))))))
+
+  (testing "ask_user with allowed config sends :ask to preToolCall hook"
+    (h/reset-components!)
+    (let [tool-call {:id "call-1"
+                     :full-name "eca__ask_user"
+                     :arguments {"question" "Why?"}}
+          all-tools [{:name "ask_user"
+                      :full-name "eca__ask_user"
+                      :origin :eca
+                      :server {:name "eca"}}]
+          db (h/db)
+          config (h/config)
+          agent-name :default
+          chat-id "test-chat"
+          hook-data* (atom nil)]
+      (with-redefs [f.tools/approval (constantly :allow)
+                    f.hooks/trigger-if-matches! (fn [event data _ _ _]
+                                                  (when (= event :preToolCall)
+                                                    (reset! hook-data* data)))]
+        (let [plan (#'tc/decide-tool-call-action tool-call all-tools db config agent-name chat-id)]
+          (is (= :ask (:approval @hook-data*))
+              "preToolCall hook receives :ask so notification hooks fire while waiting on user")
+          (is (match? {:decision :allow
+                       :hook-rejected? false}
+                      plan)
+              "tool actually executes (:allow) so the question still reaches the user")))))
+
+  (testing "ask_user with denied config keeps :deny in preToolCall hook"
+    (h/reset-components!)
+    (let [tool-call {:id "call-1"
+                     :full-name "eca__ask_user"
+                     :arguments {"question" "Why?"}}
+          all-tools [{:name "ask_user"
+                      :full-name "eca__ask_user"
+                      :origin :eca
+                      :server {:name "eca"}}]
+          db (h/db)
+          config (h/config)
+          agent-name :default
+          chat-id "test-chat"
+          hook-data* (atom nil)]
+      (with-redefs [f.tools/approval (constantly :deny)
+                    f.hooks/trigger-if-matches! (fn [event data _ _ _]
+                                                  (when (= event :preToolCall)
+                                                    (reset! hook-data* data)))]
+        (let [plan (#'tc/decide-tool-call-action tool-call all-tools db config agent-name chat-id)]
+          (is (= :deny (:approval @hook-data*))
+              "explicit :deny is preserved, not overridden to :ask")
+          (is (= :deny (:decision plan)))))))
+
+  (testing "non ask_user tool keeps :allow in preToolCall hook (regression)"
+    (h/reset-components!)
+    (let [tool-call {:id "call-1"
+                     :full-name "eca__test_tool"
+                     :arguments {:foo "bar"}}
+          all-tools [{:name "test_tool"
+                      :full-name "eca__test_tool"
+                      :origin :eca
+                      :server {:name "eca"}}]
+          db (h/db)
+          config (h/config)
+          agent-name :default
+          chat-id "test-chat"
+          hook-data* (atom nil)]
+      (with-redefs [f.tools/approval (constantly :allow)
+                    f.hooks/trigger-if-matches! (fn [event data _ _ _]
+                                                  (when (= event :preToolCall)
+                                                    (reset! hook-data* data)))]
+        (#'tc/decide-tool-call-action tool-call all-tools db config agent-name chat-id)
+        (is (= :allow (:approval @hook-data*))
+            "ask_user override does not leak to other tools")))))
 
 (deftest on-tools-called!-returns-provider-auth-test
   (testing "returns refreshed provider auth in result after token is renewed during tool execution"