[BUG] PreToolUse hook updatedInput replaces tool input instead of merging

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

A PreToolUse hook that returns updatedInput appears to replace the entire tool input rather than merging the fields. This causes the Bash confirmation UI to crash with a Zod validation error when command is missing from the replaced input.

I have a sandbox hook that detects Go binaries and disables the sandbox for TLS cert access. It returned:

{
  "hookSpecificOutput": {
    "hookEventName": "PreToolUse",
    "updatedInput": { "dangerouslyDisableSandbox": true }
  }
}

After this hook runs on a Bash tool call, the tool input becomes { dangerouslyDisableSandbox: true } — the original command and description fields are gone. The Bash confirmation component then crashes:

ERROR  [
  {
    "expected": "string",
    "code": "invalid_type",
    "path": ["command"],
    "message": "Invalid input: expected string, received undefined"
  }
]

What Should Happen?

updatedInput should be shallow-merged with the existing tool input, as the documentation describes ("Modifies the tool's input parameters"). The current behavior replaces the entire input, which means hooks must defensively spread the original input:

updatedInput: { ...toolInput, dangerouslyDisableSandbox: true }

This workaround is in place in my fix, but the underlying behavior should match the documented merge semantics.

Error Messages/Logs

ERROR  [
  {
    "expected": "string",
    "code": "invalid_type",
    "path": ["command"],
    "message": "Invalid input: expected string, received undefined"
  }
]

The crash never appears in .jsonl session transcripts because the session dies before the tool call is persisted.

Steps to Reproduce

1. Create a PreToolUse hook for Bash that returns updatedInput with a new field but without spreading the original tool_input
2. Trigger the hook (e.g., run a command that matches the hook's matcher)
3. The Bash confirmation UI crashes because command is undefined

Claude Model

Opus

Is this a regression?

Unknown — this is specific to updatedInput behavior in hooks

Claude Code Version

2.1.68

Platform

Anthropic API

Operating System

macOS

Terminal/Shell

Ghostty