Bug: Bash tool doesn't decode XML entities in command parameters

Bug: Bash tool doesn't decode XML entities in command parameters

Summary

The Bash tool receives literal && instead of && in commands, causing syntax errors. XML entities are not decoded when Claude Code converts tool invocations to MCP JSON-RPC format.

Reproducible Test Case

Command that fails:

cd /c/Users/logicma/projects && pwd

Error received:

/usr/bin/bash: eval: line 3: syntax error near unexpected token `;&'
/usr/bin/bash: eval: line 3: `cd /c/Users/logicma/projects && pwd'

Expected: Bash should receive && (decoded), not && (XML entity)

Root Cause

When Claude Code harness converts AI tool invocations (internal XML format) to MCP JSON-RPC for tool servers, HTML entities are not decoded:

1. AI generates: <parameter name="command">cd path && cmd</parameter>
2. XML encoding: && becomes &&
3. Harness → MCP: Should decode entities here ❌ (not happening)
4. Bash receives: literal string &&

Impact

Affected patterns:

• Command chaining: cd path && command
• Conditional execution: test -f file && rm file
• Logical OR: cmd1 || cmd2

Workaround available:
Use semicolons instead: cd path; command (runs sequentially, no short-circuit)

Suggested Fix

Add HTML entity decoding to XML→JSON conversion pipeline:

import html
decoded_command = html.unescape(xml_parameter_value)

Decode: & → &, < → <, > → >, " → ", ' → '

Environment

• Platform: Windows 11 Enterprise
• Shell: Git Bash (via Bash tool)
• Date: 2026-04-26

Testing After Fix

# Should work after fix:
cd /tmp && pwd
false || echo "fallback"
cd /tmp && ls -la && pwd