Suppress screen lock during meetings (lock-guard)

[twistedmelonman]

Summary

• Adds bin/lock-guard, a new client-side script invoked over SSH by lock-fanout (replacing a bare pmset displaysleepnow) that skips the lock and logs why if the client looks like it's in a meeting: a known process running (Zoom/Teams/FaceTime, configurable via ~/.config/lock-sync/guard-processes), the microphone actively in use (pmset -g assertions), or an active Google Meet room tab open in Chrome (osascript, 3s timeout).
• Every check fails open on error (never blocks a legitimate lock indefinitely).
• Wires lock-guard into bin/install/bin/uninstall and documents the new config file and one-time Chrome Automation permission grant in CLAUDE.md/README.md.

Notable fixes from review

A local final whole-branch review caught two real bugs verified live on hardware before merge:

• SSH PATH: lock-fanout was invoking lock-guard by bare name, but non-interactive SSH sessions don't have ~/.local/bin on PATH — every remote call failed with ssh_exit=127. Fixed to invoke via an absolute, remotely-expanded path.
• Mic detection dead on Apple Silicon: the original ioreg -c IOAudioEngine approach returns zero output on Apple Silicon Macs (legacy Intel/kext-era IOKit class). Replaced with pmset -g assertions, verified against a real mic open/close on this hardware.

Also hardened: Meet-URL regex host anchoring (was matching unrelated hosts as a substring), config file trailing-whitespace/CRLF handling.

Known non-blocking follow-up (filed separately): docs/plans/2026-08-12-lock-guard-meeting-suppression-design.md's Task 1 code block still describes the abandoned ioreg approach rather than the shipped pmset one — the design doc's rationale section wasn't updated when the implementation pivoted. Code and tests are correct and consistent with each other.

Test plan

• bats tests/ — 53/53 passing
• shellcheck -S info bin/* — clean
• Verified live on asiago (the Synergy server/controller for this repo's author): ran bin/install, confirmed lock-guard symlinked, triggered a real screen lock, confirmed ssh_exit=0 for asiago itself in ~/Library/Logs/lock-sync.log
• Other Synergy clients (arich-mac, mimolette, tilsit) need bin/install re-run on each after this merges — documented in CLAUDE.md's new "Upgrade path" note

https://claude.ai/code/session_01Sasr2N9Rj9n8rv2sjwN2YJ

[claude]

The diff introduces bin/lock-guard (meeting-detection gate for pmset displaysleepnow), wires it into lock-fanout, and updates install/uninstall/tests accordingly.

No BLOCK-worthy issues found. A few things I traced to confirm they are safe:

• set -euo pipefail + functions that return 1: all three check_* calls in main are used as if conditions, which are excluded from set -e abort semantics — no silent exit.
• The mic-active check uses pmset -g assertions | grep -qi coreaudiod.*preventuseridlesleep (not ioreg as the design doc says); the code comment explains the intentional change, and the tests are consistent with the implementation.
• The Meet-tab regex requires the https:// prefix, so the evil.com-as-referer test case holds.
• Remote command "\$HOME/.local/bin/lock-guard" is correctly escaped so $HOME expands on the remote shell rather than locally.

VERDICT: PASS