feat(tools): user-defined right-column panels backed by a markdown-emitting script

[frenchie4111]

Summary

Adds user-defined tools to the right column. A tool is a directory in the worktree:

.harness/tools/<id>/
  tool.json     # { "title": "PR Comments", "script": "run.sh", "refresh": "auto" }
  run.sh        # executable; stdout is markdown and becomes the panel body

Discovery is worktree-local (not repoRoot, unlike .harness.json) so a branch can iterate on its own tooling and a PR that edits a tool exercises the new version.

Markdown is the entire contract. Rather than rendering document typography into a 280px column, SidebarMarkdown maps the markdown AST onto the vocabulary the built-in panels already use:

markdown	renders as
# / ##	section header (same styling as "Changed Files")
### / ####	lighter section header
- list item	a panel row
`code` / **bold**	inline chips / emphasis, compacted
[label](harness:send?text=...)	sends the text to the agent
[label](harness:file?path=...)	opens the file
[label](harness:refresh)	re-runs the tool
[label](https://...)	opens externally
images, raw HTML	dropped / inert

A tool physically cannot express anything outside the design system, so custom panels look native by construction.

Panel keys are namespaced tool:<id>, so they slot into the existing rightPanelOrder / hiddenRightPanels machinery in .harness.json for free — drag-to-reorder and hide both work with no new persistence. effectiveRightPanelOrder now takes the discovered keys, so a new tool appends without a config write and a deleted tool drops out of a saved order automatically.

Env exposed to the script: HARNESS_WORKTREE_PATH, HARNESS_BRANCH, HARNESS_REPO_ROOT, HARNESS_TOOL_DIR, HARNESS_TOOL_ID.

Two findings that changed the implementation

• Don't spawn through a login shell. The first version copied runWorktreeScript's zsh -ilc. That cost 1–2s per run (a test timed out at 5s; the suite took 10.6s) and — worse — would let rc-file chatter (nvm banners, starship init) leak into stdout, which here is the panel body. Now the script is spawned directly and its own shebang picks the interpreter. path-fix.ts already merged the login-shell PATH at boot, so there was nothing to gain. Suite went to 1.05s. EACCES is translated to "run chmod +x".
• useWatchedQuery refetches on every git change. A refresh: "manual" tool would still re-run constantly and hammer whatever API it talks to. Added revalidateOnFileChange and made fallbackPollMs: 0 mean "no polling", so manual tools run only on mount and on the refresh button.

Known gaps

Called out deliberately rather than half-implemented:

• The collapsed icon strip ignores custom tools.
• There's no trust prompt before running a checked-in script — cloning a repo with a .harness/tools/ directory and opening a worktree runs it.
• The 20s timeout kills the script but not its grandchildren.

Demo tool (not committed)

.harness/tools/ isn't gitignored, so shipping a demo would give every contributor a live panel invoking gh on mount. Left it out; paste this into a repo to try it:

.harness/tools/pages/tool.json

{ "title": "Pages", "script": "run.sh", "refresh": "auto" }

.harness/tools/pages/run.sh (chmod +x)

#!/usr/bin/env bash
set -uo pipefail
echo "## Top level"
for f in *.html; do
  [ -e "$f" ] || continue
  title=$(sed -n 's/.*<title>\(.*\)<\/title>.*/\1/p' "$f" | head -1)
  echo "- [${title:-(no title)}](harness:file?path=$f) \`$(du -h "$f" | cut -f1)\`"
done
echo
echo "## SEO"
missing=$(grep -Lri '<meta name="description"' --include="*.html" . | wc -l | tr -d ' ')
if [ "$missing" = "0" ]; then echo "- Every page has a **meta description**"
else echo "- **$missing** page(s) missing a meta description"; fi
echo
echo "[Ask Claude to audit SEO](harness:send?text=Audit+the+SEO+of+every+page)"

Test plan

• npm run typecheck
• npx electron-vite build
• npx vitest run — 11 new tests in src/main/tools.test.ts (discovery defaults, malformed manifest, script-path escape rejection, env exposure, non-zero exit, missing/non-executable script) + 3 in repo-configs.test.ts for tool-aware ordering
• Manual: drop the demo tool into a repo, confirm the panel renders, reorders, hides, and that the action links fire

🤖 Generated with Claude Code