[BUG] Model repeatedly ignores saved memory rule about not using cd in composed Bash commands

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

Area:
memory compliance
Failure mode: instruction following
Task: review
Details:
│ - What happened: Despite a feedback memory explicitly saying "Never compose Bash commands with cd", the model repeatedly used cd ~/monorepo/main && git show ... and cd ~/monorepo/main && grep ... patterns across multiple turns in this session. This triggered permission prompts each time, which the user had to deny. The memory was saved 6+ days ago and has been violated in multiple sessions.
│ - What the user said: "why do you keep on doing compose actions that require new permissions asked, when we EXPLICITLY and MULTIPLE TIMES, have said not to do this? how can we fix this so it doesn't keep on happening? changing directory is a thing that has kept on happening so many times even though you have orders not to do that."
│ - Repro: Have a feedback memory saying not to use cd in composed Bash commands. Ask the model to review a PR in a different directory. The model composes cd <dir> && git show ... despite the memory.

What Should Happen?

Claude Code should consistently follow behavioral rules saved in its auto-memory system across sessions. When a feedback memory says "never compose Bash commands with cd", the model should use git -C <path> or absolute paths instead of cd <dir> && <command>, without the user having to re-correct every session.

Error Messages/Logs

command changes directory before running a version-control command, which can pick up untrusted hooks or repository configuration from the target directory. Approve only if you trust it.

Steps to Reproduce

1. Save a feedback memory telling Claude Code to never use cd in composed Bash commands, with explicit alternatives (git -C, Read tool, absolute paths)

▎ 2. Start a new session where work targets a repo in a different directory (e.g. ~/monorepo/main/ while workspace is ~/monorepo/agentic/)
▎ 3. Ask Claude to review a PR or do any task requiring git commands in that repo
▎ 4. Claude composes cd ~/monorepo/main && git show ..., cd ~/monorepo/main && grep ..., etc. — ignoring the memory
▎ 5. Each composed command triggers a security permission prompt, requiring manual denial
▎ 6. User has to re-correct the behavior, which was already corrected and saved in prior sessions

Claude Model

Opus

Is this a regression?

I don't know

Last Working Version

_No response_

Claude Code Version

2.1.278 (Claude Code)

Platform

Other

Operating System

macOS

Terminal/Shell

Other

Additional Information

Platform: Claude Code CLI (professional/enterprise)

Operating System: macOS (Darwin 25.6.0)

Terminal/Shell: Bash