Protect your Mac
Quarantine and restore
Where Cloak Watch moves files when it fixes something, what its quarantine manifest records, how to put anything back, and which folders Watch never touches.
Cloak Watch never deletes. When Fix it removes something, Watch moves it into its Quarantine folder, or keeps the original of a file it edits, and writes a manifest so it can put everything back exactly where it was.
Where files go
Section titled “Where files go”Quarantine lives in your Library:
~/Library/Application Support/Cloak Watch/QuarantineEach thing Watch moves or edits gets its own folder, named after the date and time plus a short random ID, with only you able to open it:
DirectoryQuarantine/
Directory20261023-091512-4f2a9c1e/
- manifest.json
- item-com.user.gh-token-monitor.plist the moved file
Directory20261023-091513-b7d0e2a4/
- manifest.json
- original-settings.json the original of an edited file
- A moved item (
item-…) is the file or folder itself. Watch clears the executable bit on a moved file so nothing in Quarantine can run by accident. - A backup (
original-…) is a copy of a file taken before Watch removed one entry from it: a Claude Code hook, an editor task, a shell profile line or an MCP server. The edited file stays where it was.
The manifest
Section titled “The manifest”Every folder has a manifest.json that records:
| Field | Meaning |
|---|---|
id |
The folder name |
originalPath |
Where the file was |
storedPath |
Where it is now, inside Quarantine |
kind |
moved or backup |
sha256 |
The file’s SHA-256, for a single file |
size, mode |
Its size and permissions, so Watch can restore them |
date |
When Watch moved it |
findingID |
The incident it belongs to |
reason |
Why, for example Launch item com.user.gh-token-monitor or Before removing a hook |
restored |
Whether it has been put back |
Put something back
Section titled “Put something back”-
Open Settings › Quarantine. It lists everything Watch moved or changed, newest first: the original path, whether it was moved or edited, when, and why.
-
Click Put Back next to the item. Its row then says Put back.
Watch then checks that place again, so if you put back something malicious, the incident comes back too.
You can also undo from where you fixed it: every step in the Fix it sheet, and every item under Fixed on … on a fixed incident, has Undo and Show in Finder.
| What was quarantined | What Put Back does |
|---|---|
| A moved file or folder | Moves it back to its original path and restores its permissions. If something already exists there, Watch refuses: Can’t restore: something already exists at …. Move that aside first. |
| The original of an edited file | Writes the original contents back over the edited file. Anything you changed in that file since is replaced. |
From Terminal, watchctl quarantine lists the same records and restores one by ID.
What’s never touched
Section titled “What’s never touched”Fix it can only change paths in these places, and refuses anything else, whatever an incident pack or a check asks:
- your home folder;
/Library/LaunchAgents,/Library/LaunchDaemonsand/Library/Caches;/tmp,/private/tmpand/private/var/folders;/Users/Shared,/opt/homebrew/liband/usr/local/lib.
Within those, Watch never moves:
- any of those folders as a whole;
- your
~/.sshor~/.gnupgfolders, your Keychains folder, or your Documents or Desktop folders; - its own folder,
~/Library/Application Support/Cloak Watch; - a path written with
...
It also leaves pnpm’s store alone, because projects link into it.
Clean out Quarantine
Section titled “Clean out Quarantine”Watch doesn’t empty Quarantine by itself. Click Show in Finder in Settings › Quarantine to open the folder. When you’re sure you don’t need something, you can delete its folder yourself; once deleted, Watch can’t put it back.