fix(copilot): map task and web_search to canonical Task/WebSearch

__tests__/hooks/copilot-canonicalize.test.ts

@@ -66,3 +66,17 @@ describe("Copilot tool-input canonicalization (verified 1.0.71 captures)", () =>
     expect(Object.keys(COPILOT_TOOL_INPUT_MAP).sort()).toEqual(["Edit", "Read", "Write"]);
   });
 });
+
+describe("Copilot tool-name canonicalization", () => {
+  it("maps `task` to Task so sub-agent policies fire on Copilot sessions", () => {
+    expect(canonicalizeToolName("task", "copilot")).toBe("Task");
+  });
+
+  it("maps `Agent` to Task - the PascalCase PreToolUse payload reports the Claude name", () => {
+    expect(canonicalizeToolName("Agent", "copilot")).toBe("Task");
+  });
+
+  it("maps `web_search` to WebSearch", () => {
+    expect(canonicalizeToolName("web_search", "copilot")).toBe("WebSearch");
+  });
+});

src/hooks/types.ts

@@ -275,6 +275,20 @@ export const COPILOT_TOOL_MAP: Record<string, string> = {
   rg: "Grep",
   ls: "LS",
   web_fetch: "WebFetch",
+  // Copilot's sub-agent and web-search tools (documented). Without these a
+  // policy matching `Task` or `WebSearch` silently never fires on Copilot -
+  // the names pass through uncanonicalised, same failure mode the rest of
+  // this map exists to prevent. `ask_user` is deliberately unmapped: it has
+  // no filesystem or shell reach, so no builtin policy targets it.
+  task: "Task",
+  // PascalCase `PreToolUse` payloads (the shape failproofai registers) report
+  // `tool_name` as the Claude tool name, and the docs table maps the runtime
+  // `task` tool to `Agent` there. Without this entry a Task policy still
+  // never fires on Copilot's PascalCase payload - the more common of the two
+  // shapes for this integration.
+  // Ref: https://docs.github.com/en/copilot/reference/hooks-reference
+  Agent: "Task",
+  web_search: "WebSearch",
 };
 
 /**