feat(waybar): add Thunderbird inbox-unread module

Polls the protonmail-bridge IMAP socket every 60s with STATUS INBOX
(UNSEEN), displays the count next to the tray, and clicking the badge
runs tb-toggle.sh to bring TB out of the scratchpad (or launch it).

Setup: store bridge credentials in pass at email/protonmail-bridge/{user,
pass}. The bridge surfaces them via 'protonmail-bridge --cli' -> 'info'.
With no entries (or with the bridge unreachable) the module shows
'MAIL ?' in red and is otherwise inert.

3 files changed, 74 insertions, 1 deletions

diff --git a/dot_config/waybar/config.jsonc b/dot_config/waybar/config.jsonc
index 6e314cb..51c9d08 100644
--- a/dot_config/waybar/config.jsonc
+++ b/dot_config/waybar/config.jsonc
@@ -17,6 +17,7 @@
     "idle_inhibitor",
     "privacy",
     "custom/notifications",
+    "custom/thunderbird",
     "tray",
     "clock",
   ],
@@ -163,4 +164,12 @@
     "on-click-middle": "makoctl restore",
     "tooltip": true,
   },
+
+  "custom/thunderbird": {
+    "exec": "~/.config/waybar/tb-unread.sh",
+    "return-type": "json",
+    "interval": 60,
+    "on-click": "~/.config/sway/tb-toggle.sh",
+    "tooltip": true,
+  },
 }
diff --git a/dot_config/waybar/executable_tb-unread.sh b/dot_config/waybar/executable_tb-unread.sh
new file mode 100644
index 0000000..ebf2fd4
--- /dev/null
+++ b/dot_config/waybar/executable_tb-unread.sh
@@ -0,0 +1,51 @@
+#!/bin/sh
+# Emit waybar JSON with the count of unread messages in the protonmail-bridge
+# IMAP Inbox. Requires bridge credentials in `pass` at the paths below; the
+# bridge prints them via `protonmail-bridge --cli` → `info`.
+#
+# The on-click handler in waybar config drives tb-toggle.sh, so a click on
+# the badge brings Thunderbird out of the scratchpad (or launches it if it
+# isn't running yet).
+set -eu
+
+PASS_USER=email/protonmail-bridge/user
+PASS_PW=email/protonmail-bridge/pass
+HOST=127.0.0.1
+PORT=1143
+
+emit() { printf '%s\n' "$1"; exit 0; }
+
+# Cheap reachability probe — avoids a 30s python TLS timeout when the bridge
+# is down (e.g. before it has finished unlocking on a fresh login).
+ncat -z -w 1 "$HOST" "$PORT" 2>/dev/null || \
+  emit '{"text":"MAIL ?","tooltip":"bridge unreachable","class":"error","alt":"error"}'
+
+user=$(pass show "$PASS_USER" 2>/dev/null) || \
+  emit '{"text":"MAIL ?","tooltip":"missing pass entry: '"$PASS_USER"'","class":"error","alt":"error"}'
+pw=$(pass show "$PASS_PW" 2>/dev/null) || \
+  emit '{"text":"MAIL ?","tooltip":"missing pass entry: '"$PASS_PW"'","class":"error","alt":"error"}'
+
+n=$(PROTONMAIL_BRIDGE_USER="$user" PROTONMAIL_BRIDGE_PASS="$pw" \
+  python3 - "$HOST" "$PORT" <<'PY' 2>/dev/null || true
+import imaplib, os, ssl, sys
+host, port = sys.argv[1], int(sys.argv[2])
+ctx = ssl.create_default_context()
+ctx.check_hostname = False
+ctx.verify_mode = ssl.CERT_NONE
+try:
+    m = imaplib.IMAP4(host, port)
+    m.starttls(ssl_context=ctx)
+    m.login(os.environ["PROTONMAIL_BRIDGE_USER"], os.environ["PROTONMAIL_BRIDGE_PASS"])
+    typ, data = m.status("INBOX", "(UNSEEN)")
+    m.logout()
+    print(int(data[0].split(b"UNSEEN ")[1].rstrip(b")")))
+except Exception:
+    pass
+PY
+)
+
+case "$n" in
+  '')   emit '{"text":"MAIL ?","tooltip":"IMAP query failed","class":"error","alt":"error"}' ;;
+  0)    emit '{"text":"MAIL 0","tooltip":"Inbox: no unread","class":"empty","alt":"empty"}' ;;
+  *)    emit "$(printf '{"text":"MAIL %s","tooltip":"Inbox: %s unread","class":"unread","alt":"unread"}' "$n" "$n")" ;;
+esac
diff --git a/dot_config/waybar/style.css b/dot_config/waybar/style.css
index f631736..037c0e3 100644
--- a/dot_config/waybar/style.css
+++ b/dot_config/waybar/style.css
@@ -47,7 +47,8 @@ window#waybar {
 #privacy,
 #custom-memory,
 #custom-wifi,
-#custom-notifications {
+#custom-notifications,
+#custom-thunderbird {
   padding: 0 6px;
 }
 
@@ -115,6 +116,18 @@ window#waybar {
   color: #fe8019; /* orange — unread */
 }
 
+#custom-thunderbird {
+  color: #928374; /* gray when inbox is empty */
+}
+
+#custom-thunderbird.unread {
+  color: #fe8019; /* orange — has unread mail */
+}
+
+#custom-thunderbird.error {
+  color: #fb4934; /* red — bridge down or creds missing */
+}
+
 #battery.warning {
   color: #fabd2f;
 }