fix(query): run provider tool calls through hooks

[BunsDev]

Motivation

Non-Anthropic provider responses containing reconstructed ToolUse blocks were being executed directly, bypassing PreToolUse/plugin policy checks and PostToolUse hooks. This created a security bypass for attacker-controlled model output.

Description

• When provider streams contain ToolUse blocks, execution is now routed through a shared, hook-aware executor instead of calling execute_tool directly.
• Added execute_tool_blocks_with_hooks (and a small PreparedTool helper), which runs PreToolUse hooks and plugin pre-hooks, executes non-blocked tools concurrently, runs PostToolUse hooks and plugin post-hooks, and emits ToolStart/ToolEnd events.
• Replaced the direct-execution path in the non-Anthropic provider dispatch with calls to the new helper, so the provider and Anthropic paths share the same policy enforcement and event semantics.

Testing

• cargo check --package claurst-query — succeeded.
• cargo test --package claurst-query — succeeded (unit tests for the claurst-query crate passed).
• cargo check --workspace — failed due to a missing system dependency (alsa.pc / ALSA pkg-config) unrelated to this change.
• cargo fmt --all -- --check and cargo clippy --package claurst-query --all-targets -- -D warnings did not pass cleanly due to pre-existing workspace formatting and clippy warnings outside this patch.

[Copilot]

Pull request overview

This PR closes a security gap in claurst-query where non-Anthropic provider responses that included reconstructed ToolUse blocks could trigger tool execution without going through PreToolUse policy checks (core hooks + plugin hooks) and PostToolUse hooks/events. It centralizes tool execution into a shared, hook-aware executor so Anthropic and non-Anthropic provider paths enforce the same policy and emit consistent ToolStart/ToolEnd events.

Changes:

• Routes non-Anthropic provider ToolUse block execution through a shared hook-aware executor instead of calling execute_tool directly.
• Replaces the inline streaming tool executor logic with a reusable execute_tool_blocks_with_hooks helper (sequential pre-hooks, concurrent execution, sequential post-hooks + events).
• Ensures both provider and Anthropic tool execution paths share consistent policy enforcement and event semantics.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.