Skip to main content

​
What this is for

The macOS .pkg installs the agent in managed mode: Claude Code’s enterprise managed-settings.json is pointed at a local tap, so every session on the machine is metered and policy is applied. Managed settings override user and project settings, which is what makes the policy enforceable — and it means the wiring outlives the agent. That matters when removing it. If the tap stops while the settings still point at it, every Claude Code session on the machine dials a port nothing answers.
Never delete gw-cli by hand. Unwire Claude Code first. The uninstaller does this in the right order automatically; deleting the binary first removes the tool that knows how to undo the wiring.

​
Claude Code stopped working — fix it first

If Claude Code hangs or fails to reach the API after an agent change, run this. It un-wires Claude Code and leaves the agent installed:
If gw-cli itself is gone or won’t run, the standalone uninstaller does the same thing and needs no Guardway tooling:
And if both are missing, deleting the managed settings file is enough on its own:
These three are the same fix at decreasing levels of tooling. The last one always works, because it depends on nothing but the file being there.

​
Full uninstall

Removes the agent completely: the tap daemon, the menu-bar app, both data directories, logs, the package receipt, and the binaries. Requires sudo.
​
Un-wire Claude Code and stop there. The agent stays installed and running. Use this when Claude Code is broken but you are not trying to remove the product.
​
Print every action and change nothing. Safe to run at any time.
​
Keep scan history, logs, and the data directories.
​
Leave org policy controls (skill lockdown, permissions, sandbox) in the harness settings. Note that this can leave Claude Code restricted to the organisation’s sanctioned skill list after the agent is gone — the command tells you when it does.
gw-cli uninstall is a thin wrapper — it runs /usr/local/bin/guardway-uninstall, which is installed by the .pkg. Both accept the same flags and behave identically. The script is deliberately standalone (plain bash, no Rust, no network) so it still works when the agent is already broken or removed.

​
Restart open Claude Code sessions

Claude Code reads these settings at launch. Sessions already running when you make the change keep the old configuration, and a stranded session hangs rather than reporting an error — so nothing on screen explains it. The uninstaller lists them for you:
Kill and relaunch anything listed. After --repair the behaviour differs: because the agent is left running, those sessions keep working for now and fail the next time the tap stops — a reboot, an upgrade, or a later uninstall. Restart them when convenient rather than urgently.

​
What the uninstaller guarantees

A failed uninstall must never take Claude Code down. The order is fixed and enforced:
1

Un-wire Claude Code — first, before anything is stopped

Removes the base URL, the telemetry export, the policy hooks, and org policy controls from every tier: managed settings, each user’s ~/.claude, VS Code, and Cursor. Values Guardway did not write are left alone; a file it empties is deleted.
2

Verify from disk

Re-reads the files and confirms nothing remains. If verification fails, the run stops here and removes nothing else — the tap is left running and Claude Code keeps working. Exit code 2.
3

Stop services

Boots out the tap daemon and the menu-bar app, then removes their launchd entries.
4

Remove the app, data, logs and package receipt

Timestamped backups of every settings file it edited are kept (the three most recent per file).
5

Remove the binaries — last

gw-cli and the uninstaller are the recovery tools right up until the moment they are provably no longer needed.

​
Recovery notes on the machine

A managed install leaves a plain-text file next to the settings it writes:
It names what is wired and carries the same three fixes as this page, including the one that needs no Guardway tooling. It is there for whoever is debugging a broken Claude Code without this documentation to hand.

​
Other platforms

gw-cli uninstall is macOS-only today.
Neither platform runs the managed in-path mode, so neither has the base-URL hazard this page is mostly about.