{ "tagline": "A safe, lovely desktop companion for two.", "nav": { "overview": "Home", "guide": "Guide", "security": "Security", "faq": "FAQ" }, "overview": { "title": "A little lobster, on someone's desktop.", "subtitle": "Crush Claw is a unique remote desktop companion. Control a cute lobster on their screen through AI. Draw hearts, send love notes, play mini-games. Your gentle entrance into their world.", "badge_sandbox": "Sandbox Isolated", "badge_perm": "Zero Permissions", "badge_cross": "Cross-Platform", "btn_start": "Get Started →", "btn_security": "Security Details", "security_title": "Security is our foundation", "security_subtitle": "Your safety on someone else's computer is not an afterthought. It is the architecture.", "sec_box_title": "Sandbox Isolation", "sec_box_desc": "Lua engine runs fully isolated. No I/O access. No OS exposure. Every dangerous operation blocked at C level.", "sec_key_title": "Memory Lockdown", "sec_key_desc": "Strict 10MB memory cap. Read-only storage anchored to a fixed path. No access to user files.", "sec_audit_title": "No Debug Mode", "sec_audit_desc": "Production builds disable all debug hooks. All scripts statically analyzed before execution. Zero trust by design.", "core_title": "Core Features", "feature1": "An Interactive Desktop Companion", "feature1_desc": "A dynamic desktop lobster powered by the Emote engine, always visible on top. Fold, move, or interact — like a real little presence quietly waiting in the corner of the screen for your call.", "feature2": "AI-Powered Remote Canvas", "feature2_desc": "Say \"draw a heart\" and AI draws in real time on their screen via Lua scripts. Even when the pet window is hidden, drawings pop up automatically — so every surprise is never missed.", "tech_title": "Technical Features", "feature3": "Bank-Grade Sandbox Isolation", "feature3_desc": "Fully isolated Lua engine · No I/O or OS access · 10MB hard memory cap · Read-only anchored storage · Zero debug in production · Static script analysis before execution. Security is not a feature — it is the baseline.", "feature4": "Natural Interaction", "feature4_desc": "Drawings and mini-games support full interactive input. Click, drag, and type — just like using a real little app.", "feature5": "Smart Window Switching", "feature5_desc": "Emote pet window stays on top for companionship. When minimized, drawing windows still pop up independently. After drawing ends, the pet quietly returns to its previous state — or stays hidden, if they prefer.", "feature6": "Windows & Linux", "feature6_desc": "One-click installer. Your partner launches it and is ready in under 3 minutes. No accounts. No complex setup. Just a config file.", "usecase_title": "How people use Crush Claw", "usecase_1": "Love Notes", "usecase_1_desc": "Surprise them with a heart drawn across their screen", "usecase_2": "Mini Games", "usecase_2_desc": "Play interactive games together, screen to screen", "usecase_3": "Silent Company", "usecase_3_desc": "Just a little lobster, quietly keeping them company", "sec_detail_1_title": "C-Level Hooks", "sec_detail_1_desc": "All dangerous OS calls blocked at C level by hooks", "sec_detail_2_title": "Metatable Interception", "sec_detail_2_desc": "Illegal global accesses intercepted by metatable wrapping", "sec_detail_3_title": "Hard Limit", "sec_detail_3_desc": "10MB hard memory cap, immediate termination on overflow", "trust_title": "Trust matters", "trust_desc": "Your LLM API key lives on your partner's computer. Both parties need mutual trust. Do not exploit Lua to attack their machine. They should not steal your key either." }, "guide": { "title": "Usage Guide", "intro": "First, convince your crush / partner to download and install Crush Claw on their computer.", "step0": "Download the latest installer from GitHub Releases.", "step1": "Get an API Key from https://platform.deepseek.com/ (model & pricing details at https://api-docs.deepseek.com/en/quick_start/pricing).", "step2": "Create a QQ bot at https://q.qq.com/qqbot/openclaw/index.html and save the AppID and AppSecret.", "step3": "Create a config.json file using the template below, fill in your API Key, AppID and AppSecret.", "step4": "Send config.json to your partner / crush.", "client_intro": "After receiving the file, your partner / crush:", "client_step1": "Copies config.json into the ~/.crush-claw directory, replacing the existing file (Windows: C:\\Users\\user\\.crush-claw).", "client_step2": "Runs crush-claw restart in the terminal to restart.", "trust_title": "Trust & Security Reminder", "trust_desc": "Your LLM API Key will be stored on your partner's computer. Both parties need mutual trust: you should not exploit Lua scripts to attack their computer, and they should not steal your key. If concerned about security, you can also ask your partner to register their own LLM API key.", "config_title": "Configuration Template", "config_example": "{\n \"llm\": {\n \"api_key\": \"sk-d**********************c\",\n \"model\": \"deepseek-v4-flash\",\n \"profile\": \"anthropic\",\n \"base_url\": \"https://api.deepseek.com/anthropic\",\n \"auth_type\": \"\",\n \"timeout_ms\": \"120000\",\n \"max_tokens\": \"409600\"\n },\n \"channels\": {\n \"local_im\": {\n \"enabled\": true\n },\n \"qq\": {\n \"enabled\": true,\n \"app_id\": \"1*******4\",\n \"app_secret\": \"J4********************Pg\"\n },\n \"telegram\": {\n \"enabled\": false,\n \"bot_token\": \"\"\n },\n \"feishu\": {\n \"enabled\": false,\n \"app_id\": \"\",\n \"app_secret\": \"\"\n },\n \"wechat\": {\n \"enabled\": false,\n \"token\": \"\",\n \"base_url\": \"\",\n \"cdn_base_url\": \"\",\n \"account_id\": \"\"\n }\n },\n \"search\": {\n \"brave_key\": \"\",\n \"tavily_key\": \"\"\n },\n \"display\": {\n \"enabled\": true,\n \"lcd_width\": 480,\n \"lcd_height\": 480,\n \"emote_text\": \"Wi-Fi connected\"\n }\n}", "disclaimer_title": "Disclaimer", "disclaimer_body": "Crush Claw is a desktop tool designed to enhance intimate relationships. By using this software, you agree that you will not exploit the Lua sandbox or any other functionality to perform unauthorized access, damage, or attacks on others' computers. The developer shall not be held liable for any direct or indirect damages resulting from misuse of this software. Please respect others' privacy and device security, and use it only with trust and informed consent." }, "security": { "title": "Security", "intro": "Crush Claw takes sandbox security extremely seriously. Since the product runs on someone else's computer, all Lua scripts execute in a deeply isolated environment.", "sandbox_title": "Attack Vector Matrix", "vector": "Attack Vector", "status": "Status", "risk": "Risk", "blocked": "BLOCKED", "critical": "Critical", "high": "High", "medium": "Medium", "low": "Low", "arch_title": "Architecture", "arch_layer1": "Lua User Script", "arch_layer2": "_G Metatables (storage/cap wrap)", "arch_layer3": "Sanitized _G (io/os/debug removed)", "arch_layer4": "luaL_openlibs (raw load)", "arch_layer5": "C-level hook + 10MB allocator", "arch_layer6": "Operating System", "detail_link": "Read the full sandbox security whitepaper (SANDBOX_SECURITY.md)", "trust_title": "Trust consideration", "trust_desc": "This is a trust-based product. Your API key lives on someone else's machine. Do not use it with people you don't fully trust. Do not try to bypass the sandbox and attack their computer." }, "faq": { "title": "FAQ", "q1": "How do I start?", "a1": "Install the program on your partner's computer, create a config.json with your API key and IM token, send it to them, and they launch the app. Then send a message through the IM channel — the AI will control the lobster.", "q2": "Is it safe for my partner's computer?", "a2": "The Lua sandbox has been designed with security as the #1 priority. All dangerous operations are blocked at the C level (not just hidden from Lua). See the Security page for the full attack vector matrix.", "q3": "Can the lobster be hidden?", "a3": "Yes. Your partner can minimize the emote window at any time. It can also be permanently hidden via the taskbar context menu. Lua drawing windows will still pop up independently when the AI draws.", "q4": "How do I set up the IM channel?", "a4": "Create a Telegram bot (or QQ bot, WeChat bot, etc.), get the token, put it in config.json. The agent connects to the IM platform and listens for messages from you.", "q5": "How do I enable or disable auto-start on login?", "a5": "Right-click the taskbar icon and check/uncheck \"Auto-start on Login\".", "q6": "Why do no windows ever pop up?", "a6": "Check if “Always Hide Windows” is enabled in the taskbar right-click menu. When checked, neither the emote animation window nor Lua drawing windows will appear. Hopefully your crush / partner won’t feel the need to enable this — or close the software entirely — because you keep drawing things on their screen too often! 😅" }, "credits": { "ack_title": "Acknowledgments", "ack_esp_claw": "Crush Claw draws inspiration and core engine from Espressif's esp-claw embedded AI Agent framework. We built a complete desktop simulation layer (sim_hal) so developers can validate agent logic without ESP32 hardware. Thanks to the esp-claw team for their open-source contributions.", "contact_title": "Contact", "contact_github": "Issues and Pull Requests are welcome on GitHub.", "contact_email": "Or reach us at: zz6zz666@qq.com", "contact_vuln": "If you discover any sandbox escape, privilege bypass, or other security vulnerability, please report it privately via email first. We will respond and fix it promptly." } }