Settings and fixes
Fewer false alarms, every setting, and what to do when something’s wrong.
Fewer false alarms: your own exceptions
Cloakroom already leaves documented examples alone (published test cards and keys, example.com, fictional 555 numbers, loopback addresses, UUIDs and hashes). To add your own, list them under allow in ~/.cloakroom/config.json, either as exact values or as re: regular expressions matched against the whole value:
{
"mode": "full",
"allow": ["Ada Lovelace", "support@mycompany.com", "re:ACME-[0-9]{6}"]
}cloakroom explain FILE shows “on your allowlist” next to anything an entry let through.
From the dashboard. Mark an alert as a false alarm and Cloakroom suggests a “never mask” rule for the values you tick; type what it missed and it suggests an “always mask” rule (a value with digits covers its shape). In Suggest mode nothing changes until you click Approve. After 10 decisions (labels, approvals, dismissals) you can switch to Learn quietly: each new rule is first replayed against your past labels and a built-in set of sample secrets, and applies by itself only if it unmasks nothing you wanted hidden and masks nothing you called safe. Rules for keys, passwords, cards and ID numbers always wait for your Approve, and every rule has Undo.
Settings reference
| Setting | Where | Default | Values |
|---|---|---|---|
| mode | config.json mode, CLOAKROOM_MODE, --mode | full | full, rules |
| allow | config.json allow | none | exact values, re:<regex> |
| mask_all_dates | config.json | false | true masks every date, not only birth dates and dates in someone’s record |
| mask_own_username | config.json | false | true masks your own login name in home-folder paths too |
| allow_images | config.json | false | true lets pictures from Read through unchecked, with a warning (by default they are held back) |
| port | config.json port, CLOAKROOM_PORT | 37787 | any free local port |
| backend | CLOAKROOM_BACKEND | auto | auto, torch, onnx |
| ONNX variant | CLOAKROOM_ONNX | fp32 | fp32, int8 |
| ONNX folder | CLOAKROOM_ONNX_DIR | ~/.cloakroom/onnx/<model version> | a path |
| home | CLOAKROOM_HOME | ~/.cloakroom | a path |
| vault key | CLOAKROOM_VAULT_KEY | OS secure store | 256-bit key, base64 or hex |
| dry run | CLOAKROOM_DRY_RUN | off | any value turns it on |
More settings (allow_secret_paths, log_months, scrub_transcript, the money hold) are under Ways to run.
When something’s wrong
“NOT protecting this session” and every tool call is denied
The plugin is on but the cloakroom program isn’t installed, or isn’t on the PATH Claude Code sees. Install it (uv tool install "cloakroom[model,torch]") and restart Claude Code; on Windows also run uv tool update-shell (or pipx ensurepath) and open a new terminal. Or turn the plugin off with /plugin disable cloakroom@cloakroom. Your prompts still go through meanwhile, so you can ask Claude for help.
“port ... is used by another program, not Cloakroom”
Another local tool owns Cloakroom’s port (for example a proxy). Pick a free one in ~/.cloakroom/config.json, e.g. {"port": 37788}, and restart Claude Code. cloakroom doctor shows the port in use.
model: FAIL
Install the extra it names, or switch to rules mode.
Windows, PyTorch won’t load
Install the Microsoft Visual C++ Redistributable.
Too much gets masked
Mark it a false alarm on the dashboard, or run cloakroom explain on the file to see which rule fired and add an allow entry.
A prompt keeps getting blocked
Start it with cr!, or type cr: pause 10m; cr: resume ends the pause.
Dashboard says “signed out”
The service restarted; run cloakroom dashboard again.
Something got through
Please open an issue with the kind of value (not the value itself) and where it appeared.