PreToolUse hook permissionDecision "ask" and permissions.ask rules silently auto-resolve to allow in non-interactive sessions

Summary

In a non-interactive session (VSCode extension harness; the session
self-reports "This session is non-interactive"), a PreToolUse hook
returning permissionDecision: "ask" surfaces no prompt anywhere — the
gated tool call executes immediately. permissions.ask rules in
settings.json behave identically. Safety gates configured to force
per-command user approval therefore fail silently open.

Environment

• Claude Code 2.1.126, VSCode native extension, macOS (darwin 25.5.0)

Reproduction

1. Install a PreToolUse Bash hook whose script returns, for commands

matching e.g. \bgh\s+issue\s+create\b:
{"hookSpecificOutput":{"hookEventName":"PreToolUse",
"permissionDecision":"ask","permissionDecisionReason":"..."}}

1. Pipe-test the script directly: correct "ask" JSON on stdout, exit 0

(script verified healthy).

1. In a non-interactive session, have the model run

gh issue create --help.

1. Observed: the command executes immediately. No prompt is shown, no

decision is fed back to the model, nothing appears in the
transcript. Adding "Bash(gh issue create*)" to permissions.ask
changes nothing.

1. Changing the hook to permissionDecision: "deny" works as expected

(command blocked, reason shown).

Impact

Security-relevant. Ask-gates are typically installed precisely for
identity-sensitive actions (git push, gh issue/pr create/comment
posting under the user's GitHub account). In non-interactive sessions
the gate silently inverts to allow: in our case, agent-initiated GitHub
issues were posted under the user's identity with no approval prompt
ever surfacing, discovered only after the fact.

Expected

Fail closed: in a context with no prompt UI, "ask" should degrade to
deny (with the reason returned to the model), or be routed through an
available approval channel — never silently allow.

🤖