Work out which chip you have first

Apple menu, About This Mac, first line. Apple M-series means the asset with aarch64 or arm64 in the name; Intel means x64 or amd64. Wrong architecture usually shows up as an icon that bounces once and disappears, no error at all.

  • Both architectures often hang under the same release, and that short string in the filename is the only difference. Do not guess from the icon.
  • Apple silicon can run the x64 build through Rosetta, but there is no reason to: the native build uses less power and skips a translation layer.
  • A damaged-and-cannot-be-opened dialog instead is not architecture. That is the Gatekeeper quarantine flag, covered separately.
SponsoredWhere does the subscription link come from?Our partner provider gives you 1 GB of high-speed Hong Kong data at signup — import it in one click.Get high-speed nodes

Do not run it from inside the dmg

  1. Double-click the dmg to mount it. The window usually holds the app icon and a shortcut to Applications.
  2. Drag the icon onto that shortcut and wait for the copy to finish.
  3. Eject the dmg from the Finder sidebar.
  4. Open it from Launchpad or Applications, not from the dmg window again.

A mounted dmg is a read-only volume. The client wants to write config, install a helper and fetch a core, and on a read-only volume that either fails or lands in a temporary mount point that vanishes on reboot. Hence the "it was there yesterday" reports.

What it asks permission for on first launch

  1. The privileged helper. The first time you switch on system proxy or TUN, a window asks for your admin password; what installs is a background helper with elevated rights. Cancel it and the toggle flips itself back off.
  2. The network extension. On top of the helper, TUN needs a virtual interface allowed through. macOS may prompt again, or expect you to enable it by hand under System Settings, General, Login Items and Extensions.
  3. Notifications. Optional, and irrelevant to the proxy — only to whether update and error messages surface.

Dismissed the password box? Quit the app, reopen it and hit the toggle again. If nothing prompts at all, check that your account is an admin: a standard user cannot install the helper, and the symptom is a toggle that does nothing.

Running in the background, and that proxy switch

  • Closing the window is not quitting. While the menu bar icon is there, the core is running. To actually stop it, quit from that icon.
  • Launch at login lives in two places: a switch inside the client, and System Settings, General, Login Items and Extensions. Trust it when both agree.
  • The system proxy is written into System Settings, Network, your active interface, Details, Proxies. HTTP, HTTPS and SOCKS point at 127.0.0.1 and a port.
  • If the client crashes or is force-quit it never cleans up, the checkboxes stay ticked and the whole machine loses internet. Untick them in that panel and you are back.

Two Clash clients open at once keep overwriting each other's proxy settings — last writer wins, and in between nobody can say where traffic goes. Fully quit the old one from the menu bar before you switch.

On a company-issued Mac an MDM profile often locks network extensions and proxy settings. The symptom is a toggle that will not move, or flips back seconds after you set it. Reinstalling will not touch that.