Troubleshooting

Most problems with Cloak Watch come down to a permission, a setting another app changed, or something Watch flagged that you know is fine. Find the symptom below.

The network extension stopped

The menu bar’s Network Extension switch or AI Activity’s status bar says The network extension stopped.

The extension stopped unexpectedly and Watch’s three automatic restarts (after 2, 10 and 60 seconds) didn’t bring it back. Your Mac’s connections already go direct, so nothing is broken.

1. Turn the Network Extension switch in the menu bar off and on again.

2. If it stops again, check that Cloak Watch is in your Applications folder and that another VPN, firewall or proxy app isn’t taking AI traffic first.

3. Restart your Mac if it still won’t stay on.

If it says Paused after errors; traffic goes direct, the extension couldn’t reach AI providers repeatedly and is passing everything through for 5 minutes. It resumes by itself.

The extension was turned off in System Settings

Watch says Turned off in System Settings. Someone turned Cloak Watch off under System Settings › General › Login Items & Extensions › Network Extensions, or removed its configuration. Watch never turns it back on by itself. To turn it on, use the Network Extension switch in the menu bar; macOS may ask you to allow it again.

If Watch says Allow it in System Settings, macOS is still waiting for you to allow the extension: see Turn it on. Move Cloak Watch to Applications means exactly that: the extension only works from the Applications folder.

A tool can’t reach its model

A tool you connected to the gateway sends its requests through Cloak Watch, so it can’t reach its model while Watch is closed. Open Cloak Watch. If Connections shows the gateway needs attention (The gateway isn’t running, so Claude Code can’t reach the model.), another app may be using port 47319: quit it, or Undo… the gateway connection.

A request Guard blocked returns an error starting Cloak Watch blocked this request:. See Allow something Guard stopped.

Scans are slow

A full scan reads every lockfile and installed package in your code folders, which is most of the work. It usually takes 5 to 30 seconds. Watch runs the daily full scan while the Mac is idle and on power, and between full scans it only rechecks what changed.

• In Settings › General, turn off folders you don’t need checked, such as an archive of old projects or your whole home folder.
• Large download caches add time. They’re checked because a malicious version can come back from one.
• Watch skips build output and other heavy folders such as DerivedData, dist, build, target and .next when it looks for projects.

Watch flagged something you know is fine

Built-in checks look for shapes attacks leave, so legitimate setups can match: a company package mirror (PKG-7), a company AI gateway (AGT-3), an MCP server you run from your own folder (MCP-1).

1. Open the incident and read What this means for you and the evidence, to be sure it’s what you think.

2. Click … and choose This Isn’t a Problem…, then why: I added this myself, It’s my company’s setup, It’s a false alarm or I don’t use this any more.

Watch won’t show it again. If a feed match (PKG-1 and other “on the feed” checks) looks wrong, tell Subcloak at hello@subcloak.com with the incident’s Reference from Details, so the feed can be corrected for everyone.

Watch didn’t find something it should have

• Check that the project’s folder is turned on in Settings › General.
• Check What Watch can’t see: container images while their runtime is stopped, the login items list, which Safari extensions are turned on without Full Disk Access, and binary Bun lockfiles aren’t read.
• Check that Watch for changes as they happen is on in Settings › General, and that Watch isn’t paused. Then click Scan Now to scan everything.

A restore fails

Put Back says Can’t restore: something already exists at …. Something now sits where the file was, often because a package manager reinstalled it. Move or rename that file, then click Put Back again.

If Watch can’t move a file during Fix it (macOS didn’t let Watch change it. It may belong to another user or need Full Disk Access.), grant Full Disk Access or fix the file’s owner, then click Retry.

The feed says Offline

Watch couldn’t download or verify the feed. It keeps using the last copy it verified, so your Mac is still checked against what it already knows. Click Try Again. If it keeps failing, check your internet connection, any firewall blocking feed.subcloak.com, and that your Mac’s clock is right: a clock more than 5 minutes wrong makes the signature check fail.

Notifications don’t arrive

If the menu bar or the toolbar says Paused, Watch is holding notifications until the pause ends; click Resume Watching. Otherwise, open Settings › Permissions. If Notifications is Off, click Turn On in System Settings…; macOS asks only once, so after that it has to be turned on there. Only things that need fixing notify you at once; things worth a look send at most one reminder a day.

Uninstall Cloak Watch completely

1. Put back anything you want to keep from Settings › Quarantine. The Quarantine folder is deleted in step 9.

2. Undo AI tool connections. In AI Activity › Connections, click Undo… for every hook, gateway and telemetry connection that’s on. Do the gateway first: a tool pointed at it can’t reach its model once Watch is gone. Remove Codex’s [otel] table from ~/.codex/config.toml by hand if you added Codex telemetry.

3. Turn off cooldowns you don’t want to keep in Install Guard (choose Off). They work without Watch, so you may want to keep them.

   If Install Guard shows Install blocking is still set up (left by a preview build), click Turn Off…, or run watchctl guard remove, before you delete the app.

4. Turn off the network extension with the menu bar switch, then follow Remove the extension.

5. Disconnect GitHub if you connected it: in GitHub, click Disconnect…, then Disconnect and Open GitHub, and revoke Cloak Watch in GitHub’s Applications settings.

6. Deactivate your license key if you have one: Settings › Plan › Deactivate This Mac frees this Mac’s place on the key.

7. Remove the command-line tool if you installed it: sudo rm /usr/local/bin/watchctl.

8. Quit Cloak Watch from the menu bar and drag it from Applications to the Trash. If you installed it with Homebrew, run brew uninstall --cask cloak-watch instead.

9. Delete its data and preferences in Terminal:

   Terminal

   rm -rf ~/Library/"Application Support/Cloak Watch"
   defaults delete com.subcloak.cloakwatch

10. Delete the backups Watch left next to files it changed, if you don’t need them: files ending in .cloak-watch-backup (AI tool settings, such as ~/.claude/settings.json.cloak-watch-backup) and .cloakwatch-backup (cooldown settings, such as ~/.npmrc.cloakwatch-backup).

Caution

The Quarantine folder may hold malware Watch removed. Deleting it is safe; don’t open or run anything in it.

Related

Network extensionStates, fail-open and removal.

SettingsFolders, permissions and data locations.

Security model and FAQCommon questions.