elementary OS's Contractor service uses standard Linux .desktop files (spec) with a .contract extension to provide context (secondary-click) menu entries for specific MIME types. System-wide apps put these in /usr/share/contractor, whatever the Flatpak version of that is, and you can create your own in ~/.local/share/contractor. Below are some examples.
If you want a specific Contractor action to apply to all filetypes, including device special files, directories, whatever, you can exploit the ! (exclusion) operator in the MimeType key, like this:
MimeType=!nothing;This does not appear to be mentioned anywhere in the spec), so it's probably an unofficial extension that might not work in other contexts or desktop environments. See this Unix & Linux SE post for possible alternatives.
Simply rename them:
mv tesseract-text.contract{,.disabled}The Contractor daemon picks up on the changes (usually) and there is (usually) no need to quit and reopen Files.
The discussion about quoting the Exec key in the spec is bonkers.
Arguments may be quoted in whole. If an argument contains a reserved character the argument must be quoted. The rules for quoting of arguments is also applicable to the executable name or path of the executable program as provided.
Quoting must be done by enclosing the argument between double quotes and escaping the double quote character, backtick character ("`"), dollar sign ("$") and backslash character ("\") by preceding it with an additional backslash character. Implementations must undo quoting before expanding field codes and before passing the argument to the executable program. Reserved characters are space (" "), tab, newline, double quote, single quote ("'"), backslash character ("\"), greater-than sign (">"), less-than sign ("<"), tilde ("~"), vertical bar ("|"), ampersand ("&"), semicolon (";"), dollar sign ("$"), asterisk ("*"), question mark ("?"), hash mark ("#"), parenthesis ("(") and (")") and backtick character ("`").
Note that the general escape rule for values of type string states that the backslash character can be escaped as ("\\") as well and that this escape rule is applied before the quoting rule. As such, to unambiguously represent a literal backslash character in a quoted argument in a desktop entry file requires the use of four successive backslash characters ("\\\\"). Likewise, a literal dollar sign in a quoted argument in a desktop entry file is unambiguously represented with ("\\$").
I think it's basically shell quoting rules, except I had to escape the backslash in convert-to-pnm.contract, below.
Just wrap everything in sh -c 'echo …', which, for anything sufficiently complex, you're already wrapping it in sh -c anyway, probably. Escape any semicolons or redirections by prefixing them with doubled-up backslashes, e.g.
⋮
Exec=sh -c'some command \\> outfile \\; notify-send …'`…so that they print instead of doing the actual thing. It appears that both stdout and stderr go to the syslog (journald), so there's no need to add >&2 here.