Bash tool PATH contains literal unexpanded ${PATH} string

Bug Description

The Bash tool initializes the shell with a PATH that contains a literal ${PATH} string instead of the expanded system PATH. This causes /usr/bin, /bin, /usr/sbin, /sbin, and /opt/homebrew/bin to be missing, so common commands like git, ssh, gh, ls, cat, wc, etc. are not found.

Reproduction

1. Open Claude Code
2. Run in the Bash tool: echo "PATH=$PATH"
3. Observe a literal ${PATH} in the output:

PATH=/Users/user/.local/bin:/Users/user/.local/share/fnm/aliases/default/bin:/Users/user/.bun/bin:${PATH}:/Users/user/.claude/plugins/cache/anthropic-agent-skills/document-skills/887114fd09f8/bin:/Users/user/.claude/plugins/cache/openai-codex/codex/1.0.2/bin

The ${PATH} between .bun/bin and the .claude/plugins entries is a literal string, not expanded. As a result, system directories are never included.

Expected Behavior

PATH should contain the fully expanded system PATH (including /usr/bin, /bin, /usr/sbin, /sbin, /opt/homebrew/bin, etc.) so that standard tools work without full path prefixes.

Impact

• Every command needs a full path prefix (e.g., /usr/bin/git instead of git)
• Tools like git push fail because they spawn ssh which also is not on PATH (requires GIT_SSH_COMMAND=/usr/bin/ssh)
• gh CLI cannot find git, causing gh repo create --push to fail

Environment

• macOS (Darwin 25.4.0, Apple Silicon)
• Shell: zsh
• Homebrew installed at /opt/homebrew
• Claude Code plugins installed (document-skills, codex) — these appear to be the source of the ${PATH} injection