[BUG] `normalizeToolInput` strips `cd <cwd> &&` from Bash commands before PreToolUse hooks can inspect them

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

The normalizeToolInput function for the Bash tool contains this logic:

// from the compiled binary (deobfuscated variable names)
let parsedInput = BashTool.inputSchema.parse(rawInput);
let { command, timeout, description } = parsedInput;
let cwd = getCwd();
let normalizedCommand = command.replace(`cd ${cwd} && `, "");

This strips cd <current_working_directory> && from the command before PreToolUse hooks receive tool_input.command and before the command is logged to the session JSONL.

Some tools are directory-sensitive — they perform different, potentially destructive actions depending on which directory they run in (e.g., IaC tools that apply infrastructure changes, package managers that modify different projects, database migration tools). A monorepo or multi-module layout might have dozens of these directories side by side.

A PreToolUse hook that requires cd <dir> && <command> serves as an intent declaration: the model must name the exact directory it wants to operate in, and the human reviewing the permission prompt can verify that directory is correct before approving. Without the explicit cd, a bare <command> runs in whatever the cwd happens to be — which may be a different module than the model (or the user) intended, with no signal in the approval prompt that anything is wrong.

The cd prefix is not about ensuring the shell is in the right directory (the cwd may already be correct). It's about making the model's intent visible and auditable at approval time.

The normalizer defeats this by silently removing the declaration before it reaches the hook or the user.

What Should Happen?

PreToolUse hooks should receive the original, un-normalized command so they can inspect the model's full intent. The normalization can still be applied for actual shell execution, but hooks need the raw input to make informed decisions.

Alternatively, normalizeToolInput should not modify tool_input.command at all — the cd is semantically meaningful even when redundant for execution, and stripping it has observable side effects (breaking hooks, misleading transcripts).

Error Messages/Logs

The model enters an unrecoverable retry loop. Example from a real session (the only replaced part is the command, where I've put `dangerous_command`):


● Bash(dangerous_command -auto-approve 2>&1)
  ⎿ Error: PreToolUse:Bash hook error: Blocked: must be preceded by 'cd <dir> &&'

● Bash(dangerous_command -auto-approve 2>&1)
  ⎿ Error: PreToolUse:Bash hook error: Blocked: must be preceded by 'cd <dir> &&'

● Bash(dangerous_command -auto-approve 2>&1)
  ⎿ Error: PreToolUse:Bash hook error: Blocked: must be preceded by 'cd <dir> &&'

● I keep hitting the same hook — it requires the command to start with cd.
  Let me try with the explicit cd && prefix.

● Bash(dangerous_command -auto-approve 2>&1)
  ⎿ Error: PreToolUse:Bash hook error: Blocked: must be preceded by 'cd <dir> &&'

● I'm stuck in a loop where the cd prefix keeps getting stripped from my command
  before it reaches the tool. I genuinely can't get past this hook.


The model is correct — it IS generating the `cd` prefix, but `normalizeToolInput` removes it. The session JSONL also records the post-normalized command, so debugging the transcript makes it look like the model never included `cd` when it did.

Steps to Reproduce

1. Start Claude Code in any directory (e.g., /tmp/testdir)
2. Add a PreToolUse hook that requires cd for a specific command:

``json
{
"hooks": {
"PreToolUse": [{
"matcher": "Bash",
"hooks": [{
"type": "command",
"command": "CMD=$(jq -r '.tool_input.command'); if echo \"$CMD\" | grep -qE 'echo hello'; then if ! echo \"$CMD\" | grep -qE '^cd '; then echo 'Blocked: must use cd prefix' >&2; exit 2; fi; fi"
}]
}]
}
}
``

1. Ask Claude: "Run this exact command: cd /tmp/testdir && echo hello"
2. The hook rejects it because it receives echo hello (the cd /tmp/testdir && was stripped)
3. Claude retries in a loop, never able to satisfy the hook

Claude Model

Opus

Is this a regression?

I don't know

Last Working Version

_No response_

Claude Code Version

2.1.150 (Claude Code)

Platform

Anthropic API

Operating System

Ubuntu/Debian Linux

Terminal/Shell

Other

Additional Information

Related issues:

• #43189 — Same symptom (model loops on cd hook), closed without root cause identified. The reporter and the model both suspected "conflicting instructions" but the actual cause is normalizeToolInput.
• #13150 — Same class of bug (normalizeToolInput stripping -- from commands)