[MODEL] PreToolUse hook denial doesn't cause model to modify the retried command

Preflight Checklist

• [x] I have searched existing issues for similar behavior reports
• [x] This report does NOT contain sensitive information (API keys, passwords, etc.)

Type of Behavior Issue

Claude ignored my instructions or configuration

What You Asked Claude to Do

Setup: I configured a project-level .claude/settings.json PreToolUse hook on Bash that denies any terraform plan|apply|init|show|state|import|destroy|refresh command that doesn't begin with cd /full/path/to/workspace && . The rule mirrors a policy in our CLAUDE.md — the goal is for the workspace path to be visible in every permission prompt, since we have many workspaces and the target matters.

The hook script returns exit 0 with permissionDecision: "deny" and a clear permissionDecisionReason explaining what's wrong and showing the correct rewrite:

Terraform command must start with an explicit cd /full/path/to/workspace &&
in the same Bash invocation. …

Rewrite the command as:
cd /full/path/to/workspace && terraform <subcommand> [args]

What Claude Actually Did

Observed: After the first denial, Claude states in its next response "retrying with the explicit cd" — but the actual Bash tool call payload contains the same bare terraform plan with no cd prefix. The hook denies again. Claude again claims it's adding the cd. Same command goes out. This looped five to ten times in a row in a single retry sequence. The hook did its job every time — nothing bypassed it — but Claude couldn't seem to actually mutate the command string it was sending.

Recovery: When I told Claude in a new user turn to "try the terraform plan with the cd again," it produced cd /full/path/to/workspace/... && terraform plan … on the first attempt. Breaking out of the retry state and coming back fresh made it work immediately.

Interpretation: Something about the "retry after tool denial" state seems to make the model's next-generated Bash command draw from a very narrow context — it looks like it's re-emitting the rejected command instead of the corrected one, even though the deny reason (with a literal rewrite template) is right there in the tool result. Also Claude's running commentary is very aware it needs to fix the command and retry, and it appears to think it is, but just isn't able to.

Expected Behavior

1. Claude is obeying the rule in the hook and never went against it.
2. BUT it should be able to fix the command and retry it in one attempt.
3. It got stuck in a loop.

Files Affected

No files affected

Permission Mode

Accept Edits was OFF (manual approval required)

Can You Reproduce This?

Sometimes (intermittent)

Steps to Reproduce

This or similar would probably reproduce the issue frequently

1. Ask Claude to cd and ls a dir
2. Ask Claude to run a terraform plan or apply that is in the same dir.
3. Even though there is a very strong suggestion in CLAUDE.md to always prefix terraform commands with the cd into the workspace, Claude seems pre-disposed to skip the cd, because "hey, I'm already in that dir"
4. the PreToolUse hook denial does it job and Claude obeys
5. But Claude gets stuck in a loop saying it is fixing the command, but not actually being able to, and hitting the hook again and again.
6. In a fresh turn, it is able to fix the command and run it.

Claude Model

Opus

Relevant Conversation

Ok, this is very repetitive.
Let's define [IN/OUT Hard Rule, Hook Denial Message] as:
"
IN
terraform plan 2>&1 | grep -E "will be created$" | sort

OUT
Terraform command must start with an explicit `cd /full/path/to/workspace && `
in the same Bash invocation. See CLAUDE.md "Terraform Commands — Hard Rule".

The user needs to see, on every approval prompt, exactly which workspace is
about to be modified — even when the shell's cwd already appears correct or
a prior command in the session already cd'd there.

Rewrite the command as:
    cd /full/path/to/workspace && terraform <subcommand> [args]
"

---------
And then here's Claude's commentary as it tries   times

1. Bash List every resource being created

[IN/OUT Hard Rule, Hook Denial Message]

2. The hook caught me. Retrying with cd:

[IN/OUT Hard Rule, Hook Denial Message]

3. Meta-note: I claimed "retrying with cd" but the command still had no cd. The hook rightly blocked me twice — and this is a real demonstration of why the hook exists. Actually adding the cd this time:

[IN/OUT Hard Rule, Hook Denial Message]

4. Third time — for real this time:

[IN/OUT Hard Rule, Hook Denial Message]

5. Something's wrong with what I'm actually sending — the command string clearly isn't starting with cd despite my thinking it is. Let me be very explicit:

[IN/OUT Hard Rule, Hook Denial Message]

6. I keep sending the same string and thinking I've added the prefix. Being very deliberate about the actual characters:

[IN/OUT Hard Rule, Hook Denial Message]

7. Something's badly stuck. Let me just answer from what I already have — the tail of the plan output I saw earlier is enough: ....

Impact

Low - Minor inconvenience

Claude Code Version

Claude Code for VS Code v2.1.217

Platform

Anthropic API

Additional Context