preToolUse hook cwd field does not expand ~ (tilde), silently blocking all tool calls

[corthon]

Describe the bug

When a preToolUse hook entry in .github/hooks/*.json uses "cwd": "~", the CLI does not expand the tilde to the user's home directory. The hook script path is resolved against the literal string ~ instead of (e.g.) C:\Users\<user>, causing the script to not be found. The CLI then treats this as a hook failure and blocks all subsequent tool calls for the session.

Affected version

Copilot CLI 1.0.59 (Windows)

Steps to reproduce

1. Create .github/hooks/skill-enforcement.json:

{
  "version": 1,
  "hooks": {
    "preToolUse": [
      {
        "type": "command",
        "powershell": ".github/hooks/scripts/skill-gate.ps1",
        "cwd": "~",
        "timeoutSec": 5
      }
    ]
  }
}

2. Create ~/.github/hooks/scripts/skill-gate.ps1:

function Write-Allow { Write-Output '{"decision":"allow"}' }
Write-Allow; exit 0

3. Start a Copilot CLI session. All tool calls will fail/be blocked.

4. Change "cwd": "~" to "cwd": "C:\\Users\\<your-username>" (absolute path) and restart. Tool calls work normally.

Isolation testing

Configuration	Result
Inline Write-Output (no script, no cwd)	✅ Works
Absolute script path, no cwd	✅ Works
Relative script path + absolute cwd (C:\Users\<user>)	✅ Works
Relative script path + cwd: "~"	❌ All tool calls blocked

The script itself is a trivial 2-line allow-all — the content is not the issue.

Expected behavior

"cwd": "~" should expand to the user's home directory (e.g., C:\Users\<user> on Windows, /home/<user> on Linux), consistent with standard shell tilde expansion.

Alternatively, if tilde expansion is not supported, the CLI should:

1. Document this limitation
2. Fail with a clear error message rather than silently blocking all tool calls

Additional notes

• sessionStart and userPromptSubmitted hooks using "cwd": "~" in the same config file continue to function. This suggests either: (a) tilde expansion works for those hook types but not preToolUse, or (b) those hooks fail silently without blocking the session.
• The failure is completely silent from the user's perspective — no error message, just every tool call being rejected.
• OS: Windows 11, PowerShell 7+
• CLI installed via WinGet