Skip to main content
Use this page when decommissioning AI Watch from a fleet or rolling back a test deployment. If you are only migrating from the old script-based macOS Detect rollout to the package, use Legacy macOS Detect Cleanup. The platform uninstallers remove Runlayer hook entries at uninstall time — you do not need to change deployment settings or wait for hook reconciliation first. The macOS uninstall package and the AI Watch 0.30.9+ Windows MSI both sweep Runlayer hook entries from user and enterprise client configurations while preserving third-party hooks, then remove the package itself. For a staged decommission where hooks should stop fleet-wide before packages are removed over time, see Disable hooks before uninstalling.
1

Prepare the deployment

In Settings → Client Updates, pin the currently deployed AI Watch version so hourly update checks are no-ops during removal. Unscope the device from the regular AI Watch installer assignment so your MDM cannot reinstall AI Watch.
2

Run the uninstall package

Deploy the signed and notarized aiwatch-uninstall-<version>.pkg from the AI Watch release as a one-time root/system package.The uninstall package is standalone and payload-free: it does not depend on the installed aiwatch binary, and its version is independent of the installed package version. The latest uninstall package removes any previously installed AI Watch version, including devices that are already broken or partially removed. It removes Runlayer hook entries across local users and enterprise locations while preserving third-party hooks, unloads the AI Watch launchd jobs, removes package-owned files and browser native-messaging hosts, resets the AI Watch TCC entry, and forgets both the AI Watch receipt and its own disposable receipt. Running pkgutil --forget by hand is not a substitute — it only forgets the installer receipt and removes nothing.
The uninstall package deliberately leaves no receipt. Use a one-time MDM assignment or your MDM’s command result as the success signal, then remove the assignment; a recurring receipt-based policy can offer the package again.
3

Restart AI clients and browsers

Restart running AI clients and supported browsers on the device so they stop reading cached hook and extension policy. The uninstaller restarts the macOS preferences daemon first to evict stale policy from its cache. In particular, restart Firefox so it reloads its system preferences policy.
4

Unscope profiles

Keep the deployment profile assigned until the uninstall package reports success, then unscope it yourself:
  • Merged deployment profile: com.runlayer.aiwatch
Fleets deployed before the profile consolidation ran three separate profiles instead — unscope all three:
  • Tenant configuration profile: com.runlayer.aiwatch.config
  • PPPC / Full Disk Access profile: com.runlayer.aiwatch.pppc
  • Login Items profile: com.runlayer.aiwatch.loginitems
The uninstaller removes Runlayer-owned Chrome extension metadata and per-extension policy files. It also strips only Runlayer entries from the runtime-written shared Chrome force-install plist and the current and legacy Firefox policy plists, including the copied tenant credential. It does not remove configuration profiles. If a separate MDM browser policy also deploys the extension, remove that assignment through your MDM. Finally, restore your preferred Client Updates policy.
5

Verify removal

Spot-check that the package is gone:
Grok CLI and Devin CLI cleanup is best effort: the uninstaller sweeps their standard hook paths, but custom or legacy layouts can remain. Check those clients manually.

​
macOS retained state and exceptions

The standalone macOS uninstaller removes current Runlayer hook entries; it is not a snapshot restore of every setting that existed before installation. It deliberately retains:
  • ~/.runlayer logs, scan cache and state, device identity, enrollment markers, and the scan lock because this directory can be shared with the full Runlayer CLI
  • runlayer-aiwatch items in each user’s login keychain because a root installer cannot purge another user’s login keychain
  • /Library/Logs/Runlayer/aiwatch-uninstall.log, which records the result of each cleanup phase
  • empty shared client settings files and parent directories, including ~/.claude/settings.json, ~/.qwen/settings.json, and ~/.config/devin/config.json
To remove an AI Watch credential too, run the following as each affected user. Repeat it if the user has credentials for more than one Runlayer host:
The cleanup also has these retained-state exceptions:
  • VS Code Claude hook-location values set to false are removed rather than restored to an earlier value.
  • Codex features.hooks and Gemini hooksConfig.enabled remain at their current values because other hooks may depend on them.
  • Rewritten JSONC files preserve configuration semantics, but lose comments and original formatting.
  • Managed GrokHome locations are swept. Per-user shell overrides such as GROK_HOME, QWEN_HOME, and COPILOT_HOME are not discoverable by the root uninstaller and must be checked manually.
Hook entries do not record whether AI Watch or the separately installed Runlayer CLI created them. The uninstaller therefore removes both aiwatch hook and runlayer hook forms. If the full CLI should keep its hooks, run runlayer setup hooks --install again after removing AI Watch.
The macOS uninstall package always exits successfully so it is safe to run as an MDM package postinstall. Check /Library/Logs/Runlayer/aiwatch-uninstall.log for any phase marked failed; the package result alone does not prove that every user home was reachable.

​
Disable hooks before uninstalling (optional)

For a staged decommission — hooks off across the fleet now, packages removed over the following days — or for Windows fleets stuck on MSIs older than 0.30.9, switch the deployment to Detect-only while AI Watch is still installed. Its own reconciler then removes Runlayer hook entries on its normal hourly schedule while preserving third-party hooks. Under Settings → AI Watch → Manage settings, set Mode to Monitor, Sessions off, and Track MCP tool usage without content off. For older or offline clients, also push the same fallback values through your MDM:
Keep the AI Watch package and configuration profile assigned while devices reconcile. To force reconciliation on a device immediately, run aiwatch setup hooks install --mdm as root (macOS, /usr/local/bin/aiwatch) or SYSTEM (Windows, C:\Program Files\Runlayer\AIWatch\aiwatch.exe), then confirm with aiwatch setup hooks check --mdm — exit 0 means the device is compliant with the Detect-only hook state.
Devices pick up the new Mode and Sessions settings on their next settings sync. A device that is offline, asleep, or unenrolled keeps its old hooks until it next reaches your Runlayer instance — do not assume the fleet has reconciled just because you changed the settings. Verify per device with aiwatch setup hooks check --mdm (exit 0).

​
Legacy script-based installs

For macOS fleets that used the original script-based Detect rollout, follow Legacy macOS Detect Cleanup. That page removes the old runlayer-scan wrapper, per-user LaunchAgent, old PPPC profile, and script logs while preserving unrelated user CLI state. For custom Windows script or hand-rolled Scheduled Task deployments, remove the MDM script or task assignment, then remove any custom task, script, or log paths your deployment created. The packaged MSI registers its own tasks under the \Runlayer Task Scheduler folder and removes them on uninstall, so this section only applies to bespoke deployments you built yourself.