fix(herdr): plugin panes fail to spawn (relative program path)

[pgebheim]

Summary

The herdr plugin's box/agent/boxes panes never opened as shipped — every one failed with plugin_pane_open_failed: … No viable candidates found in PATH. Root cause: the pane commands used ["bin/lilbox-herdr", <sub>], but herdr's pane spawner resolves argv[0] against PATH — unlike its action runner, it does not honour the plugin dir as the program's lookup root. So the relative path was never found. The one-shot actions (status/expose/kill/…) worked because they take the action code path; only the panes — the plugin's headline feature — were broken.

Fix: launch the three panes via sh -c and reach the shim by absolute path through herdr's injected $HERDR_PLUGIN_ROOT:

# before — fails: relative program, PATH-searched
command = ["bin/lilbox-herdr", "agent"]
# after  — works: sh is on PATH, $HERDR_PLUGIN_ROOT is absolute
command = ["sh", "-c", "exec \"$HERDR_PLUGIN_ROOT/bin/lilbox-herdr\" agent"]

Actions keep the direct form (the action runner resolves it fine).

Verification (live, herdr 0.7.5)

• Before: herdr plugin pane open --entrypoint boxes → plugin_pane_open_failed.
• After: same call → plugin_pane_opened, and reading the pane terminal shows real shim output (lilbox ls via the watch entrypoint) — proving $HERDR_PLUGIN_ROOT expands and the shim executes, not just that sh spawned.

Tests

• New pane_programs_are_path_resolvable pins the invariant: no pane runs a relative-with-slash program — checking the effective program the launcher execs, not just argv[0].
• Taught the two contract tests (shim_commands_exist_and_are_executable, every_shim_subcommand_in_the_manifest_is_dispatched) both command forms via helpers shim_subcommand / plugin_relative_targets / effective_pane_program; extraction tolerates the ${VAR} brace form.
• cargo test --locked → 94 passed.

Docs (second commit)

• Removed a nonexistent "action menu" claim from contrib/herdr/README.md — herdr has no plugin-action palette; actions run via a keybinding or herdr plugin action invoke.
• Added a "Driving it over Herdr Mirror" section: a plugin_action keybinding resolves on the local herdr (where lilbox isn't), and Mirror forwards raw pane input but not prefix-mode commands — so a keybinding can't reach the remote box from either config. Documents the two paths that work (invoke from a mirrored remote pane; or herdr --remote <host> --remote-keybindings server) and notes the worktree.removed teardown hook is unaffected.

Architecture

No architectural change. No new dependency, abstraction, or Rust code touched — only the plugin manifest (contrib/herdr/), its README, and the manifest test harness. The manifest⇄shim contract's two halves move together.

🤖 Generated with Claude Code