# Troubleshooting > Fix common Cloak Watch problems, from a stopped network extension, slow scans and false alarms to failed restores, and uninstall Cloak Watch completely. Source: https://docs.subcloak.com/cloak-watch/troubleshooting/ Most problems with Cloak Watch come down to a permission, a setting another app changed, or something Watch flagged that you know is fine. Find the symptom below. ## The network extension stopped The menu bar's **Network Extension** switch or AI Activity's status bar says **The network extension stopped**. The extension stopped unexpectedly and Watch's three automatic restarts (after 2, 10 and 60 seconds) didn't bring it back. Your Mac's connections already go direct, so nothing is broken. 1. Turn the **Network Extension** switch in the menu bar off and on again. 2. If it stops again, check that Cloak Watch is in your Applications folder and that another VPN, firewall or proxy app isn't taking AI traffic first. 3. Restart your Mac if it still won't stay on. If it says **Paused after errors; traffic goes direct**, the extension couldn't reach AI providers repeatedly and is passing everything through for 5 minutes. It resumes by itself. ## The extension was turned off in System Settings Watch says **Turned off in System Settings**. Someone turned Cloak Watch off under **System Settings › General › Login Items & Extensions › Network Extensions**, or removed its configuration. Watch never turns it back on by itself. To turn it on, use the **Network Extension** switch in the menu bar; macOS may ask you to allow it again. If Watch says **Allow it in System Settings**, macOS is still waiting for you to allow the extension: see [Turn it on](https://docs.subcloak.com/cloak-watch/ai-activity/network-extension/#turn-it-on). **Move Cloak Watch to Applications** means exactly that: the extension only works from the Applications folder. ## A tool can't reach its model A tool you connected to the [gateway](https://docs.subcloak.com/cloak-watch/ai-activity/connections/#the-local-gateway) sends its requests through Cloak Watch, so it can't reach its model while Watch is closed. Open Cloak Watch. If Connections shows the gateway needs attention (**The gateway isn't running, so Claude Code can't reach the model.**), another app may be using port 47319: quit it, or **Undo…** the gateway connection. A request Guard blocked returns an error starting `Cloak Watch blocked this request:`. See [Allow something Guard stopped](https://docs.subcloak.com/cloak-watch/ai-activity/guard/#allow-something-guard-stopped). ## Scans are slow A full scan reads every lockfile and installed package in your code folders, which is most of the work. It usually takes 5 to 30 seconds. Watch runs the daily full scan while the Mac is idle and on power, and between full scans it only rechecks what changed. - In [Settings › General](https://docs.subcloak.com/cloak-watch/settings/#general), turn off folders you don't need checked, such as an archive of old projects or your whole home folder. - Large download caches add time. They're checked because a malicious version can come back from one. - Watch skips build output and other heavy folders such as `DerivedData`, `dist`, `build`, `target` and `.next` when it looks for projects. ## Watch flagged something you know is fine Built-in checks look for shapes attacks leave, so legitimate setups can match: a company package mirror ([PKG-7](https://docs.subcloak.com/cloak-watch/detections/#pkg-7)), a company AI gateway ([AGT-3](https://docs.subcloak.com/cloak-watch/detections/#agt-3)), an MCP server you run from your own folder ([MCP-1](https://docs.subcloak.com/cloak-watch/detections/#mcp-1)). 1. Open the incident and read **What this means for you** and the evidence, to be sure it's what you think. 2. Click **…** and choose **This Isn't a Problem…**, then why: **I added this myself**, **It's my company's setup**, **It's a false alarm** or **I don't use this any more**. Watch won't show it again. If a feed match ([PKG-1](https://docs.subcloak.com/cloak-watch/detections/#pkg-1) and other "on the feed" checks) looks wrong, tell Subcloak at [hello@subcloak.com](mailto:hello@subcloak.com?subject=Cloak%20Watch%20false%20positive) with the incident's **Reference** from **Details**, so the feed can be corrected for everyone. ## Watch didn't find something it should have - Check that the project's folder is turned on in **Settings › General**. - Check [What Watch can't see](https://docs.subcloak.com/cloak-watch/inventory/#what-watch-cant-see): container images while their runtime is stopped, the login items list, which Safari extensions are turned on without Full Disk Access, and binary Bun lockfiles aren't read. - Check that **Watch for changes as they happen** is on in [Settings › General](https://docs.subcloak.com/cloak-watch/settings/#general), and that Watch isn't paused. Then click **Scan Now** to scan everything. ## A restore fails **Put Back** says **Can't restore: something already exists at …**. Something now sits where the file was, often because a package manager reinstalled it. Move or rename that file, then click **Put Back** again. If Watch can't move a file during **Fix it** (**macOS didn't let Watch change it. It may belong to another user or need Full Disk Access.**), grant [Full Disk Access](https://docs.subcloak.com/cloak-watch/settings/#permissions) or fix the file's owner, then click **Retry**. ## The feed says Offline Watch couldn't download or verify the feed. It keeps using the last copy it verified, so your Mac is still checked against what it already knows. Click **Try Again**. If it keeps failing, check your internet connection, any firewall blocking `feed.subcloak.com`, and that your Mac's clock is right: a clock more than 5 minutes wrong makes the signature check fail. ## Notifications don't arrive If the menu bar or the toolbar says **Paused**, Watch is holding notifications until the pause ends; click **Resume Watching**. Otherwise, open **Settings › Permissions**. If **Notifications** is **Off**, click **Turn On in System Settings…**; macOS asks only once, so after that it has to be turned on there. Only things that need fixing notify you at once; things worth a look send at most one reminder a day. ## Uninstall Cloak Watch completely 1. **Put back anything you want to keep** from **Settings › Quarantine**. The Quarantine folder is deleted in step 9. 2. **Undo AI tool connections.** In **AI Activity › Connections**, click **Undo…** for every hook, gateway and telemetry connection that's on. Do the gateway first: a tool pointed at it can't reach its model once Watch is gone. Remove Codex's `[otel]` table from `~/.codex/config.toml` by hand if you added Codex telemetry. 3. **Turn off cooldowns** you don't want to keep in **Install Guard** (choose **Off**). They work without Watch, so you may want to keep them. If **Install Guard** shows **Install blocking is still set up** (left by a preview build), click **Turn Off…**, or run `watchctl guard remove`, before you delete the app. 4. **Turn off the network extension** with the menu bar switch, then follow [Remove the extension](https://docs.subcloak.com/cloak-watch/ai-activity/network-extension/#remove-the-extension). 5. **Disconnect GitHub** if you connected it: in **GitHub**, click **Disconnect…**, then **Disconnect and Open GitHub**, and revoke Cloak Watch in GitHub's Applications settings. 6. **Deactivate your license key** if you have one: **Settings › Plan › Deactivate This Mac** frees this Mac's place on the key. 7. **Remove the command-line tool** if you installed it: `sudo rm /usr/local/bin/watchctl`. 8. **Quit Cloak Watch** from the menu bar and drag it from Applications to the Trash. If you installed it with Homebrew, run `brew uninstall --cask cloak-watch` instead. 9. **Delete its data and preferences** in Terminal: ```bash title="Terminal" rm -rf ~/Library/"Application Support/Cloak Watch" defaults delete com.subcloak.cloakwatch ``` 10. **Delete the backups** Watch left next to files it changed, if you don't need them: files ending in `.cloak-watch-backup` (AI tool settings, such as `~/.claude/settings.json.cloak-watch-backup`) and `.cloakwatch-backup` (cooldown settings, such as `~/.npmrc.cloakwatch-backup`). > **Caution:** > The Quarantine folder may hold malware Watch removed. Deleting it is safe; don't open or run anything in it. ## Related - [Network extension](https://docs.subcloak.com/cloak-watch/ai-activity/network-extension/): States, fail-open and removal. - [Settings](https://docs.subcloak.com/cloak-watch/settings/): Folders, permissions and data locations. - [Security model and FAQ](https://docs.subcloak.com/cloak-watch/security-and-faq/): Common questions.