Clinch FAQ
Before you install
Clinch is an unnotarized public preview. Here is what it changes, what it connects to, and what remains unfinished.
Is Clinch ready for general use?
It is ready for a cautious public preview, not a claim of independent certification. The release gate checks the source, dependencies, universal app, signed metadata, installer, integration removal, and DMG/ZIP contents. Clinch is still not Apple-notarized, has not had an independent security audit or a broad public beta, and session recovery after a crash or power loss is best effort. The dependency policy also lists several acknowledged unmaintained transitive crates in deny.toml. None of the current exceptions is a vulnerability advisory. Keep another terminal installed.
Which Macs are supported?
macOS 14 or later. The public artifact contains both Intel (x86_64) and Apple Silicon (arm64) executables.
Why isn't Clinch notarized?
Clinch is not distributed through the Apple Developer Program's Developer ID and notarization path. As a result, there is no Developer ID signature or notarization ticket. The site and installer keep that limitation visible instead of presenting the app as Apple-verified.
Is Clinch free, and do I need to sign in?
Clinch is free and open source. No Clinch or Warp sign-in is needed, and Clinch has no usage quota of its own. Claude Code, Codex, SSH, MCP servers, and other tools still use their own accounts, subscriptions, credentials, and limits.
Can Clinch run alongside Warp?
Yes. Stable Clinch uses the bundle ID sh.clinch.Clinch and keeps its UI configuration in ~/.clinch, so it does not inherit Warp's theme, zoom, keybindings, or other app settings. Its session-capture integration still uses marked provider settings and Clinch-owned helper and capture directories under ~/.warp; some Skills and MCP paths and the provider-owned configuration and plugin stores are shared too.
Do I need a Clinch iOS app or account for Remote Control?
Remote Control requires no Clinch account or native iOS app. The phone client runs in Safari and can be added to the Home Screen. The optional private transport does require Tailscale on the Mac and phone, signed into the same tailnet. Pair once with a five-minute QR invitation and approve the phone on the Mac; it can then reconnect until you revoke it or its authorization expires after 90 days of inactivity. See its setup and security details.
What does Clinch set up on first launch?
The shell installer authenticates, verifies, stages, and opens Clinch; it does not configure provider integrations directly. On the app's first launch, Clinch enables its local session-capture integration. You can turn it off or back on from Clinch Settings → Agents → Claude Code and Codex session capture.
While enabled, Clinch adds marked entries to ~/.claude/settings.json and ~/.codex/config.toml, installs helpers under ~/.warp/agent-resume-bin/, and stores local capture data under ~/.warp/agent-resume/. Turning capture off persists the opt-out and removes the managed hooks and helpers while preserving unrelated provider settings and captured data until you choose to purge it.
Notification plugins are separate. On launch, Clinch best-effort installs pinned local snapshots for Claude Code and Codex when those CLIs are present, without cloning a plugin repository or replacing other marketplaces. It also adds a bundled universal jq to each local pane's PATH. Missing CLIs or provider-policy failures do not block launch and are retried later.
Does Clinch keep agent processes alive?
No. When session capture is enabled, Clinch records a provider session ID and resume command. Reopening starts a new Claude Code or Codex process and asks it to resume. Provider transcript retention, deleted data, CLI changes, or an abrupt shutdown can prevent recovery.
Does Clinch send telemetry or contact Warp services?
The stable channel has no RudderStack destination, Sentry crash reporter, or configured Warp backend request. Its updater can make one quiet GitHub request per active calendar day for signed release metadata; automatic checks do not download the app. Unavailable telemetry is forced off without a flush timer, disk queue, or network send.
Clinch is still a terminal, not an offline sandbox. Claude Code, Codex, SSH, MCP servers, plugins, package tools, language servers, remote assets, and other programs use the network according to their own configuration. The optional Claude plan gauge contacts Anthropic only after you enable it. Clinch also invokes installed provider CLIs at startup to provision its bundled notification plugins; those CLIs and plugins remain subject to their providers' network and credential behavior.
What does the installer change?
It authenticates a signed manifest with the Clinch release key, resolves one exact tag, checks the archive size and SHA-256, bundle ID, version, macOS minimum, Intel and Apple Silicon slices, and structural signature, then stages Clinch in /Applications or ~/Applications and opens it. The shell script itself does not use sudo, clear quarantine, add hooks, or install provider plugins. On a fresh setup, opening the app then performs the first-launch setup described above.
The manually authenticated DMG is the primary auditable distribution path. The install command on the front page is a convenience that performs the same release authentication and verification before staging the app. Read the installer source before running it if you prefer, or verify a release by hand from the versioned release page.
Why might macOS block Clinch?
The app is ad-hoc signed with the hardened runtime, but it has no Apple-issued Developer ID and is not notarized. Apple has not verified the publisher or artifact. Browser downloads normally carry a quarantine flag, while curl normally does not add one. The terminal installer verifies the release itself and does not clear quarantine or change Gatekeeper settings, so its normal install path does not require Open Anyway.
If you instead download the DMG in a web browser, macOS may block the app. Authenticate the checksum list with its release-key signature as documented in the README, compare the DMG digest, then try to open Clinch once and use System Settings → Privacy & Security → Open Anyway. Do not disable Gatekeeper globally. The release also carries a signed manifest, CycloneDX SBOM, validation record, and release-key-signed local provenance.
How do updates work?
Updater-enabled builds check signed release metadata at most once per active calendar day. When a newer release is available, Clinch shows Update available in the header. Choose Clinch → Check for Updates… to check immediately. Automatic checks fetch metadata only and stay quiet when no update is available or a check fails.
Clinch shows the authenticated version and release notes before downloading anything. After you choose Download and Install, it verifies the archive, saves restorable state, quits, atomically replaces the app, relaunches, and rolls back if the new app does not start. The updater never requests administrator privileges. A non-writable app location opens the authenticated manual installation path instead.
Builds older than the updater bridge in v0.2026.07.20.1643 cannot discover it and need one final authenticated bootstrap install: curl -fsSL https://clinch.sh/install | sh. Once that version is installed, future releases are discovered automatically. App state and optional capture data remain in their existing directories.
How do I remove Clinch and its data?
The release includes a selective uninstall.sh. With no flags it removes only Clinch.app. --disable-integration removes managed provider hooks and helpers; --purge-capture also removes captured metadata; --purge-app-data removes Clinch's ~/.clinch configuration, preferences, caches, logs, and app state; and --remove-plugins asks the provider CLIs to remove the known notification plugins. It does not delete all of ~/.warp, provider transcripts, or Keychain credentials. Run bash uninstall.sh --help before choosing what to remove.
How is Clinch maintained?
Clinch is a small, solo-maintained independent fork. Upstream changes, pull requests, and releases are handled on a best-effort basis; there is no promised sync or release schedule. Only the newest public-preview release receives fixes, so watch the GitHub Releases page for new versions.
Is Clinch affiliated with Warp?
No. Clinch is an independent fork of warpdotdev/warp. Most code is AGPL-3.0; warpui and warpui_core remain MIT. Warp is a trademark of Denver Technologies, Inc.
Where should I report a problem?
Use GitHub Issues for ordinary bugs. Report vulnerabilities privately using the security policy.