feat(waybar): snx-rs VPN status indicator + click toggle

New custom/snx-vpn module sits next to custom/vpn (the wireguard one):

- snx-vpn-status.sh shells out to `snxctl status` (timeout 2s) and maps
  the output to three states: down (grey strikethrough), connecting/MFA
  (amber), up (green). Tooltip shows the full status block when up.
- snx-vpn-toggle.sh disconnects when up, runs snxctl-chromium detached
  when down (so SAML lands in the flatpak ungoogled-chromium without
  blocking waybar). Both paths refresh the module via SIGRTMIN+9.

1 files changed, 20 insertions, 0 deletions

diff --git a/dot_config/waybar/executable_snx-vpn-status.sh b/dot_config/waybar/executable_snx-vpn-status.sh
new file mode 100644
index 0000000..9088630
--- /dev/null
+++ b/dot_config/waybar/executable_snx-vpn-status.sh
@@ -0,0 +1,20 @@
+#!/bin/sh
+# Waybar custom/snx-vpn module: report the snx-rs (Check Point) tunnel
+# state. `snxctl status` is fast (talks over a local UDS to the daemon)
+# but might briefly stall during connect; cap it with `timeout`.
+
+# Bail out if the daemon socket isn't even there (snx-rs.service stopped).
+out=$(timeout 2 snxctl status 2>/dev/null) || out=
+
+case "$out" in
+  '' | *"Disconnected"*)
+    printf '{"text":"<span color=\\"#928374\\"><s>󰌾 SNX</s></span>","class":"down","tooltip":"snx-rs disconnected — click to connect"}\n'
+    ;;
+  *"Connecting"* | *"MFA pending"*)
+    printf '{"text":"<span color=\\"#fabd2f\\">󰌾 SNX…</span>","class":"connecting","tooltip":"%s"}\n' "$(echo "$out" | head -1)"
+    ;;
+  *)
+    tooltip=$(echo "$out" | sed 's/"/\\"/g' | awk 'BEGIN{ORS="\\n"}{print}')
+    printf '{"text":"<span color=\\"#b8bb26\\">󰌾 SNX</span>","class":"up","tooltip":"%s"}\n' "$tooltip"
+    ;;
+esac