Task tool should respect `ask` permission rules

Summary

The Task tool has "Permission Required: No" in Claude Code, which means ask rules in permissions are silently ignored. deny works (documented for disabling sub-agents), but there is no way to require user approval before a sub-agent spawns.

Use case

I maintain Lockbox, a Claude Code plugin that quarantines sessions after they ingest untrusted data. When a locked session needs to take external actions, it delegates to a clean sub-agent. The user must review and approve the delegation before it executes — this is the single security checkpoint preventing a compromised session from silently exfiltrating data.

With Task(lockbox:delegate) in permissions.ask, the expectation was that Claude Code would prompt the user before spawning the delegate. Instead, the Task spawns silently because ask is ignored.

Current workaround

The delegate's first action is now a Bash echo showing its task summary. A Bash(echo "🔓 LOCKBOX DELEGATE:*") entry in ask triggers a real permission prompt (since Bash does respect ask rules, and ask is evaluated before allow). This works but is a workaround — the approval happens after the sub-agent spawns rather than before.

What I'd like

Make Task respect ask rules the same way Bash and other tools do. When Task(lockbox:delegate) is in permissions.ask, Claude Code should prompt the user with the Task description before spawning the sub-agent. The user approves or denies, and the sub-agent only runs if approved.

Details

• The permissions docs mention Task(AgentName) pattern syntax but only in the context of deny
• deny correctly blocks Task calls matching the pattern
• ask is silently ignored — no prompt appears, the Task proceeds as if it were in allow
• This affects any plugin that needs user approval for sub-agent actions, not just security plugins

Proposed behaviour

{
  "permissions": {
    "ask": ["Task(lockbox:delegate)"]
  }
}

When an agent calls Task(subagent_type="lockbox:delegate"), Claude Code should show a permission prompt displaying the Task description and wait for user approval before spawning the sub-agent.