Omahub
← All plugins
V

Thunderbird Mail Checker

by VillainRU

Unread Thunderbird Inbox mail in the Omarchy QuickShell bar.

GitHub

Security review

No obvious issues detected

Deterministic scan — not a security guarantee

None
Risk level
None
Analyzed commit
b45a4df
Scanned
2 weeks ago

No potentially dangerous behavior detected in the analyzed commit.

Automated analysis only — not a security guarantee.

AI advisory review

No obvious issues detected

Language-model assessment · ~deepseek/deepseek-v4-flash-latest — advisory only

Low
AI risk level
Low
Recommendation
install
Model
~deepseek/deepseek-v4-flash-latest
Analyzed commit
b45a4df
Reviewed
2 weeks ago

This plugin is a local, user-space bridge between an Omarchy bar widget and Thunderbird, using native messaging and a Unix socket. No obfuscated code, credential access, remote exfiltration, or destructive install behavior was found, and the deterministic scan reported no issues. The main risk is the intentionally broad mail-handling permissions in the companion Thunderbird extension, but those are explicit and required for the advertised features.

  • The bundled Thunderbird extension requests accountsRead, messagesRead, messagesMove, messagesDelete, messagesUpdate, compose, and nativeMessaging permissions; this is consistent with the plugin's stated features but grants significant control over email data and actions.
  • The native bridge and Unix socket handle email metadata and allow actions like delete and mark-as-spam; this is a normal local-attack design, but it relies on the user's XDG_RUNTIME_DIR and Thunderbird extension permissions being properly protected.
How this check works

This review combines the deterministic scan (the rule-based results above) with an independent look at the plugin's code by a language model. The model reads a trimmed sample of the repository's files, the manifest, and the README, then gives a plain-language risk level and a recommendation: install (no notable danger), review (look closer first), or avoid (clearly dangerous).

It runs on the same analyzed commit as the deterministic scan and is strictly advisory — it is not a security guarantee and never blocks a plugin by itself. A human moderator still reviews plugins before they are listed.

AI advisory only — automated analysis, not a security guarantee.

Install
$ omarchy plugin add https://github.com/VillainRU/omarchy-thunderbird-mail-checker --enable
Widgets #bar #quickshell #system

Thunderbird Mail Checker

Unread Thunderbird mail in the Omarchy bar — fast, private, and event-driven.

Omarchy Marketplace · English · Русский

Thunderbird Mail Checker panel

Versions: Omarchy plugin 0.1.24 · MailExtension 0.1.5 · Thunderbird 128+

English

Highlights

  • Unread totals and five recent messages per account.
  • Open, reply, delete, and mark-as-spam actions through Thunderbird APIs.
  • Full or privacy-friendly notifications that respect Omarchy's silence mode.
  • Automatic recovery when Thunderbird starts or its native bridge restarts.
  • No polling process, remote service, credentials, or message bodies.

Install

[!IMPORTANT] The Omarchy widget and Thunderbird MailExtension are installed separately.

omarchy plugin add https://github.com/VillainRU/omarchy-thunderbird-mail-checker.git --enable
~/.config/omarchy/plugins/io.github.villainru.thunderbird-mail-checker/bin/thunderbird-mail-checker setup

The setup command registers the native bridge and prints the bundled XPI path. In Thunderbird, open Add-ons and Themes → Extensions → gear menu → Install Add-on From File, select thunderbird/thunderbird-mail-checker.xpi, approve its permissions, and restart Thunderbird once.

Update and diagnose

omarchy plugin update io.github.villainru.thunderbird-mail-checker --yes
~/.config/omarchy/plugins/io.github.villainru.thunderbird-mail-checker/bin/thunderbird-mail-checker setup
~/.config/omarchy/plugins/io.github.villainru.thunderbird-mail-checker/bin/thunderbird-mail-checker status

The widget reconnects every two seconds while Thunderbird is unavailable. Reinstall the XPI only when CHANGELOG.md lists a newer MailExtension version.

Remove

Remove the MailExtension in Thunderbird, then remove the Omarchy plugin:

omarchy plugin remove io.github.villainru.thunderbird-mail-checker

Русский

Показывает непрочитанные письма Thunderbird прямо в панели Omarchy: общий счётчик, аккаунты и пять последних писем для каждого ящика.

Возможности

  • Открытие письма с переходом на рабочее пространство Thunderbird.
  • Ответ, удаление и пометка как спам через штатный API Thunderbird.
  • Обычные и приватные уведомления с учётом режима тишины Omarchy.
  • Автоматическое восстановление связи после запуска или перезапуска Thunderbird.
  • Без внешних серверов, доступа к паролям и чтения содержимого писем.

Установка

omarchy plugin add https://github.com/VillainRU/omarchy-thunderbird-mail-checker.git --enable
~/.config/omarchy/plugins/io.github.villainru.thunderbird-mail-checker/bin/thunderbird-mail-checker setup

Команда setup зарегистрирует локальный мост и покажет путь к XPI. В Thunderbird откройте Дополнения и темы → Расширения → меню с шестерёнкой → Установить дополнение из файла, выберите thunderbird/thunderbird-mail-checker.xpi, подтвердите разрешения и один раз перезапустите Thunderbird.

Обновление и диагностика

omarchy plugin update io.github.villainru.thunderbird-mail-checker --yes
~/.config/omarchy/plugins/io.github.villainru.thunderbird-mail-checker/bin/thunderbird-mail-checker setup
~/.config/omarchy/plugins/io.github.villainru.thunderbird-mail-checker/bin/thunderbird-mail-checker status

Красный индикатор означает, что мост недоступен. Проверьте, что Thunderbird запущен и MailExtension включено; виджет продолжит попытки подключения автоматически.

Удаление

Удалите MailExtension в Thunderbird, затем удалите плагин Omarchy:

omarchy plugin remove io.github.villainru.thunderbird-mail-checker

Architecture and privacy

The MailExtension reacts to mail events and sends metadata through a native-messaging host and a user-only Unix socket. Cached panel state is mode 0600. Actions are never queued while Thunderbird is offline.

Development

make check   # manifests, syntax, unit and protocol regressions
make xpi     # rebuild the companion MailExtension package

See AGENTS.md for contribution guidelines and CHANGELOG.md for release notes.