Uninstalling RoamSwitch

1. What happens

The uninstall runs in the order below. Each step is independent: if one fails, the rest still run, and the results are listed at the end.

1. Undo the changes made to the network. Air-Gap isolation, firewall rules, VPN and Tailscale kill switches, automatic port-scan blocks, the gateway ARP lock and DNS overrides are put back. On the Mac, the services RoamSwitch stopped (SSH, file sharing, screen sharing) are restarted too.
2. Stop and unregister the services. On Linux, the systemd services and timers. On the Mac, the privileged helper and its two companion services, the login item and the system extension (link guard).
3. Remove the decoy files it placed. The hidden ransomware-detection files and the credential decoys (such as ~/.aws/credentials) are deleted. Only files that carry RoamSwitch's mark are removed; a real file at the same path, or a symbolic link, is left alone.
4. Remove what the setup added. On Linux, the apt hook and the Falco and logrotate configuration files. On the Mac, the npm and pnpm shell aliases (only those lines are removed).
5. Remove the program. On Linux, through the package manager (apt, dnf, zypper or pacman), or by deleting the files directly for a tarball install. On the Mac, the app is moved to the Trash (not deleted, so it can be recovered).

2. On the Mac

From the RoamSwitch icon in the menu bar, choose “🧰 Recovery and uninstall” → “🗑 Uninstall RoamSwitch…”.

The confirmation window shows the gateway's current MAC address and the trusted one. If they differ, or it cannot be confirmed that the cause of an isolation is gone, an attack may be under way, so the Uninstall button stays disabled until you tick “I understand the risk above and want to proceed”. If you can, move to another network, such as tethering, first.

“Also delete settings, history and license information” is off by default. Left off, ~/Library/Application Support/RoamSwitch (quarantined threats, history) and the license information stay, so a later reinstall picks them up. Turned on, those, the settings and everything the privileged helper stored are deleted as well.

If you used the system extension (link guard), System Settings may ask you to approve its removal. The removal completes once you approve. Even if no approval is requested, the removal is scheduled as soon as the app is deleted and completes at the next restart of your Mac.

Finally the app is moved to the Trash and RoamSwitch quits. Emptying the Trash removes the app itself. The results are shown as a list, with the reason for any step that failed.

3. On Linux

From the desktop (tray)

From the tray icon, choose “🧰 Recovery and uninstall” → “🗑 Uninstall RoamSwitch…”. The confirmation window works as on the Mac (an acknowledgement is required when there is a risk, and “Also delete settings, state and history” is off by default). After you press Uninstall, you are asked for an administrator password (polkit), and the app quits when it is done.

From the command line

sudo roamswitch uninstall
sudo roamswitch uninstall --purge
sudo roamswitch uninstall --yes

--purge also deletes settings, state and history. --yes skips the question when nothing is in doubt. With neither, settings and history are kept.

When the gateway does not match the trusted one, or it cannot be confirmed that an isolation's cause is gone, a warning is shown and nothing proceeds until you type UNINSTALL. Without a terminal (in a script, for example), it changes nothing and exits with code 2 unless you accept the risk and add --force.

With the package manager

sudo apt remove roamswitch
sudo apt purge roamswitch
sudo dnf remove roamswitch
sudo zypper remove roamswitch
sudo pacman -R roamswitch

apt purge also deletes settings, state and history (apt remove keeps them). With dnf, zypper and pacman, settings and history are kept.

Just before the package is removed, the same network recovery, service shutdown and decoy removal as above run automatically. This route does not ask for confirmation: once the package is gone nothing is left to manage the network, so avoiding a connection that stays cut off takes priority. For a tarball install, roamswitch uninstall deletes the files directly.

The apt repository entry (/etc/apt/sources.list.d/roamswitch.list) and its signing key are left in place. Delete them by hand if you do not need them.

4. What stays, and what is never touched

• Software you installed separately, such as ClamAV, nftables, Falco, Tailscale and the WireGuard tools, is not removed.
• A real file at a decoy's path that does not carry RoamSwitch's mark is not deleted.
• Settings, state and history stay unless you choose --purge on Linux (apt purge with apt), or tick the box in the confirmation window on the Mac.

5. If the connection does not work afterwards

Every change that can stop traffic is undone in the first step. If the connection still does not work, reconnect Wi-Fi or re-plug the cable to renew the DHCP lease. Before removing RoamSwitch, the same recovery can be run on its own: sudo roamswitch emergency-restore on Linux, or “🧰 Recovery and uninstall” → “🆘 Recover the network now…” in the Mac menu.