Skip to content

docs: note that Automation permission dialog appears on every client #31

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
twistedmelonman merged 1 commit into from
Aug 12, 2026
Merged

docs: note that Automation permission dialog appears on every client #31

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 4 additions & 1 deletion CLAUDE.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -47,7 +47,10 @@ All slices shipped. Install with `bin/install`; uninstall with `bin/uninstall`.

`lock-guard`'s Google Meet detection drives Chrome via `osascript`. The
first time this runs on a client, macOS prompts for Automation permission
(System Settings > Privacy & Security > Automation). Because `lock-guard`
(System Settings > Privacy & Security > Automation) — this dialog appears
on the client's own screen the moment its first lock cycle fires, even
though `lock-guard` itself is invoked non-interactively over SSH; expect it
on every client, not just the one set up manually. Because `lock-guard`
runs non-interactively over SSH from launchd, there is no interactive
session to click "Allow" in — grant this manually once per client, by
running `~/.local/bin/lock-guard` interactively at a local Terminal on that
Expand Down
15 changes: 12 additions & 3 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -75,9 +75,18 @@ Absent file uses the built-in default. Present file replaces it entirely
`lock-guard`'s Google Meet detection requires macOS Automation permission.
Clients don't need the repo cloned or `bin/install` run on them — `lock-fanout`
pushes `lock-guard` to each client automatically over SSH the first time it
locks that client (see "How clients get `lock-guard`" below). After that's
happened once, grant the Automation permission by running the provisioned
copy interactively at a Terminal on the client:
locks that client (see "How clients get `lock-guard`" below).

**Expect a permission dialog on the client's screen the first time it locks
after being provisioned.** macOS shows the Automation permission prompt on
the client machine itself — even though `lock-guard` is invoked
non-interactively over SSH — the first time it tries to talk to Chrome. This
happens automatically on every client, not just the one you set up manually.
Until someone is at that client to click Allow, Meet-tab detection silently
skips there (the process-list and microphone checks still work; see below).

After that's happened once, grant the Automation permission by running the
provisioned copy interactively at a Terminal on the client:

```sh
~/.local/bin/lock-guard
Expand Down
Loading