Remove Crof provider after shutdown

[baanish]

Crof is shutting down (nahcrof.com/sorry.md). This removes the first-party Crof provider so CodexBar no longer offers a dead API-key integration.

Changes

• Drop the Crof UsageProvider case, descriptor, implementation, bundled plugin, icon, and settings strings
• Remove Crof-only menu/widget/quota special cases
• Update provider counts (69 → 68), docs, CLI goldens, plugin parity, and gatekeeper allowlists
• Refresh widget/burn-down color fingerprints after the registry change
• Keep historical changelog entries that mention Crof

docs/social.png still shows the previous provider count; that raster is unchanged.

Test plan

• Linux portable checks: provider manifests (68), plugin JS, docs/locale/link checks
• swift test --filter ProviderPluginParityTests and UserProviderPluginPortableTests (pass)
• CI: lint, Linux CLI/musl, and both macOS Swift test shards (pass)

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-15T05:06:57.516402Z	07ab98b	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[clawsweeper]

Codex review: blocked before merge. Reviewed September 15, 2026, 10:00 AM ET / 14:00 UTC (Revision 2).

ClawSweeper review

What this changes

Removes Crof’s built-in integration, settings, bundled scripts, presentation rules, and tests, updates provider documentation, and refreshes embedded CLI icons.

Merge readiness

⛔ Blocked before merge - 3 items remain

The new runtime transcript satisfies the previous proof request, and no blocking code defect was found. The retirement remains distinct work absent from main and the latest release; accepting the saved-configuration removal policy still requires maintainer judgment.

Priority: P2
Reviewed head: a72c94cae494595caca1a8a94923da2ea40fbf34
Owner decision: Required. See Decision needed.

Review scores

Measure	Result	What it means
Overall readiness	🐚 platinum hermit (4/6)	A coherent removal with useful real upgrade evidence and no blocking correctness finding; the remaining compatibility choice does not reduce patch quality.
Proof confidence	🐚 platinum hermit (4/6)	Sufficient (terminal): The isolated Linux CLI transcript exercises the production registry and shared configuration load/save path, showing fresh-install Crof absence, rejection of Crof selections, and preservation of 68 other providers during retirement; the relevant path is unchanged at the reviewed head.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Verified	Sufficient (terminal): The isolated Linux CLI transcript exercises the production registry and shared configuration load/save path, showing fresh-install Crof absence, rejection of Crof selections, and preservation of 68 other providers during retirement; the relevant path is unchanged at the reviewed head.
Evidence reviewed	7 items	Repository policy: Read the complete root AGENTS.md. No nested AGENTS.md or maintainer-notes directory was found. Applied the preference for CLI-verifiable configuration behavior and avoided builds, tests, and account probes during this read-only review. Introduced removal and upgrade consequence: The introduced diff removes Crof from the provider enum and both manifests. The unchanged configuration decoder skips unknown providers; loading does not write, while subsequent encoding and saving omit skipped entries. The app and CLI use this shared configuration implementation. Positive fresh-install and upgrade proof: The supplied contributor comment #3657 (comment) contains a complete Linux CLI transcript using isolated CODEXBAR_CONFIG and dummy credentials. It shows Crof rejection, read-only loading without disk changes, removal on a Venice enable/save round-trip, preservation of all 68 remaining entries, and fresh-install listings without Crof. This resolves the previous review’s runtime-proof request.
Findings	None	None.
Security	None	None.

How this fits together

CodexBar’s provider registry connects saved configuration and CLI selections to usage fetching and menu presentation. Removing Crof also makes its saved configuration unknown to the shared configuration loader.

flowchart TD
  A[Saved provider settings] --> B[Configuration loader]
  C[Provider registry without Crof] --> B
  C --> D[CLI and menu provider choices]
  B --> E[Recognized provider settings]
  B --> F[Skip Crof settings]
  E --> G[Next configuration save]
  G --> H[File without Crof entry]

Loading

Decision needed

Question	Recommendation
Should retiring Crof also discard its saved credentials and preferences on the next configuration save?	Accept discard-on-save: Approve the demonstrated retirement behavior and document the saved-settings consequence for upgrading users.

Why: The transcript proves the proposed behavior, but contributor intent cannot authorize an irreversible compatibility policy for existing users.

Before merge

• Resolve merge risk (P1) - Existing Crof CLI selections stop working, and the next configuration save discards saved Crof credentials and preferences; maintainer acceptance of this intentional retirement policy remains unrecorded.
• Complete next step (P2) - Obtain maintainer acceptance of discarding saved Crof settings on the next save, and document that upgrade consequence.
• Resolve maintainer decision - Resolve the maintainer decision shown above before merge.

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
Upgrade preservation	68 surviving provider entries preserved	The contributor’s real CLI save transcript verifies that retirement does not alter the remaining provider entries.

Merge-risk options

Maintainer options:

1. Approve the demonstrated retirement policy (recommended)
   Accept Crof becoming unavailable and its saved entry being discarded on the next save, with that consequence documented for users.
2. Preserve retired configuration
   Keep Crof settings inert across saves if maintainers want rollback-friendly retirement.

Technical review

Best possible solution:

Retire the unavailable integration with an explicitly approved, user-documented saved-settings policy while preserving every remaining provider’s configuration.

Do we have a high-confidence way to reproduce the issue?

Not applicable as a defect reproduction: this PR retires an integration; its fresh-install and saved-config effects are demonstrated by the contributor’s real CLI transcript.

Is this the best way to solve the issue?

Yes, removing the registrations and provider-owned implementation is a coherent retirement approach; whether saved settings should be discarded remains a compatibility-policy choice.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against 62e71bb60ab1.

Labels

Label changes:

• add proof: sufficient: Contributor real behavior proof is sufficient. The isolated Linux CLI transcript exercises the production registry and shared configuration load/save path, showing fresh-install Crof absence, rejection of Crof selections, and preservation of 68 other providers during retirement; the relevant path is unchanged at the reviewed head.
• add rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🐚 platinum hermit and patch quality is 🐚 platinum hermit.
• add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (terminal): The isolated Linux CLI transcript exercises the production registry and shared configuration load/save path, showing fresh-install Crof absence, rejection of Crof selections, and preservation of 68 other providers during retirement; the relevant path is unchanged at the reviewed head.
• remove status: 📣 needs proof: Current PR status label is status: 👀 ready for maintainer look.
• remove rating: 🦪 silver shellfish: Current PR rating is rating: 🐚 platinum hermit, so this older rating label is no longer current.

Label justifications:

• P2: This is bounded retirement work for one provider, with no demonstrated urgent failure in the remaining integrations.
• merge-risk: 🚨 compatibility: Removing the recognized provider makes existing Crof selections invalid and drops its saved configuration on a subsequent save.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🐚 platinum hermit and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (terminal): The isolated Linux CLI transcript exercises the production registry and shared configuration load/save path, showing fresh-install Crof absence, rejection of Crof selections, and preservation of 68 other providers during retirement; the relevant path is unchanged at the reviewed head.
• proof: sufficient: Contributor real behavior proof is sufficient. The isolated Linux CLI transcript exercises the production registry and shared configuration load/save path, showing fresh-install Crof absence, rejection of Crof selections, and preservation of 68 other providers during retirement; the relevant path is unchanged at the reviewed head.

Evidence

What I checked:

• Repository policy: Read the complete root AGENTS.md. No nested AGENTS.md or maintainer-notes directory was found. Applied the preference for CLI-verifiable configuration behavior and avoided builds, tests, and account probes during this read-only review. (AGENTS.md:1, a72c94cae494)
• Introduced removal and upgrade consequence: The introduced diff removes Crof from the provider enum and both manifests. The unchanged configuration decoder skips unknown providers; loading does not write, while subsequent encoding and saving omit skipped entries. The app and CLI use this shared configuration implementation. (Sources/CodexBarCore/Config/CodexBarConfig.swift:43, a72c94cae494)
• Positive fresh-install and upgrade proof: The supplied contributor comment Remove Crof provider after shutdown #3657 (comment) contains a complete Linux CLI transcript using isolated CODEXBAR_CONFIG and dummy credentials. It shows Crof rejection, read-only loading without disk changes, removal on a Venice enable/save round-trip, preservation of all 68 remaining entries, and fresh-install listings without Crof. This resolves the previous review’s runtime-proof request. (f7cd30857c2d)
• Proof remains relevant to the reviewed head: GitHub’s comparison from the demonstrated revision to the reviewed head lists subsequent Cursor, web UI, release, and gatekeeper changes, with no changes to provider identity, manifests, configuration decoding/storage, or CLI configuration commands. A local whole-tree comparison encountered an unavailable historical blob; the GitHub comparison supplied the missing comparison evidence. (a72c94cae494)
• Still necessary on main and release: The pinned main-to-head diff removes an existing Crof registration, and v0.60.3 still contains the Crof enum case. GitHub search found prior Crof implementation and refactor work, but no separate retirement replacement. (Sources/CodexBarCore/Providers/Providers.swift:67, 9db44805dc1e)
• Feature-history routing: Main history shows repeated Crof descriptor and configuration work by Peter Steinberger. GitHub verifies refactor: make JS plugins the macOS implementation for Crof and Venice #2677 as a merged Crof/Venice conversion authored by steipete and [codex] Add Crof provider #872 as a merged Crof addition authored by baanish. Deeper local follow-history and blame encountered unavailable historical blobs, so no source-line introduction attribution is asserted. (Sources/CodexBarCore/Providers/Crof/CrofProviderDescriptor.swift, a1fd8c5a9582)

Likely related people:

• steipete: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)
• baanish: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)

Rank-up moves

Optional improvements that raise the rating; they are not merge blockers.

• Record maintainer acceptance of the saved-Crof policy and document its upgrade consequence.

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

History

Review history (1 earlier review cycle)

• reviewed 2026-09-15T05:11:29.146Z sha f7cd308 :: needs real behavior proof before merge. :: none

[baanish]

Runtime proof for Crof retirement / upgrade behavior (isolated CODEXBAR_CONFIG, dummy values only). This used the PR-head CLI at f7cd30857c2dae6bf1e485964ee7b9e283fcf480 (baanish/CodexBar:main).

This validates the intended retirement policy: saved Crof configuration becomes inert and is discarded on the next config save, while remaining provider configuration is preserved.

Assertions from the run:

• crof is no longer a recognized/available provider (config enable / diagnose both reject it).
• config dump skips the unknown Crof entry in memory (Ignoring unknown provider in config) but does not rewrite the on-disk file.
• A harmless config enable --provider venice round-trip (already enabled) exercises the same CodexBarConfigStore.load() + save() path the app uses; afterward Crof is gone from disk.
• All 68 remaining provider entries were byte-identical to the pre-upgrade file (Venice dummy API key / accent / workspace and Grok dummy cookie fields unchanged; no other top-level keys changed).
• Fresh-install config providers / config dump against a missing config file lists 68 providers and contains no Crof.

=== CodexBar Crof-removal upgrade proof ===
date: 2026-09-15T07:04:16Z
PR: steipete/CodexBar#3657
head SHA: f7cd30857c2dae6bf1e485964ee7b9e283fcf480
binary: /workspace/.build/x86_64-unknown-linux-gnu/debug/CodexBarCLI
binary SHA256: 642d454ba48066ef9492608921b6a649ad0905488ad08337fa911c277163157e
CODEXBAR_CONFIG=/tmp/codexbar-crof-upgrade-0jg9om/config.json

=== A. seed realistic pre-upgrade config (dummy values only) ===
wrote /tmp/codexbar-crof-upgrade-0jg9om/config.json
version=1 providerCount=69
includes crof: True
includes venice: True
includes grok: True

=== B. on-disk config BEFORE load/save (Crof excerpt + surviving providers) ===
on-disk providerCount=69
--- crof ---
{
  "accentColor": "#2EAB94",
  "apiKey": "dummy-crof-key-SHOULD-BE-DROPPED",
  "enabled": true,
  "id": "crof",
  "source": "api"
}
--- venice (must survive) ---
{
  "accentColor": "#12AB34",
  "apiKey": "dummy-venice-key-KEEP-ME",
  "enabled": true,
  "id": "venice",
  "workspaceID": "venice-fixture-workspace"
}
--- grok (must survive) ---
{
  "cookieHeader": "session=dummy-grok-cookie-KEEP",
  "cookieSource": "manual",
  "enabled": false,
  "id": "grok"
}

=== C. Crof is not a recognized provider ===
$ /workspace/.build/x86_64-unknown-linux-gnu/debug/CodexBarCLI config enable --provider crof --log-level error
Unknown or missing provider. Use --provider <name>.
exit=1

$ /workspace/.build/x86_64-unknown-linux-gnu/debug/CodexBarCLI diagnose --provider crof --format json --log-level error
[{"provider":"cli","source":"cli","error":{"code":1,"message":"Error: unknown provider 'crof'","kind":"args"}}]
exit=1

=== D. config dump loads+normalizes in memory and does NOT write ===
$ /workspace/.build/x86_64-unknown-linux-gnu/debug/CodexBarCLI config dump --pretty --show-secrets --log-level warning
--- stderr ---
2026-09-15T07:04:16+0000 warning com.steipete.codexbar.config-store: provider=crof [CodexBarCore] Ignoring unknown provider in config
--- dump vs on-disk ---
in-memory dump providerCount=68 hasCrof=False
on-disk after dump providerCount=69 hasCrof=True

=== E. harmless write round-trip: config enable --provider venice (already enabled) ===
$ /workspace/.build/x86_64-unknown-linux-gnu/debug/CodexBarCLI config enable --provider venice --log-level warning
2026-09-15T07:04:16+0000 warning com.steipete.codexbar.config-store: provider=crof [CodexBarCore] Ignoring unknown provider in config
Config: enabled Venice

=== F. on-disk config AFTER save ===
after providerCount=68 hasCrof=False
--- venice after ---
{
  "accentColor": "#12AB34",
  "apiKey": "dummy-venice-key-KEEP-ME",
  "enabled": true,
  "id": "venice",
  "workspaceID": "venice-fixture-workspace"
}
--- grok after ---
{
  "cookieHeader": "session=dummy-grok-cookie-KEEP",
  "cookieSource": "manual",
  "enabled": false,
  "id": "grok"
}

ASSERT crof dropped: True
ASSERT remaining ids == before minus crof: True
ASSERT remaining entries byte-identical: PASS
venice intact: True
grok intact: True
other top-level keys equal: True
top-level before {'version': 1}
top-level after {'version': 1}

=== G. providers listing (no Crof) ===
$ /workspace/.build/x86_64-unknown-linux-gnu/debug/CodexBarCLI config providers --format json --log-level error
listedCount=68 hasCrof=False
enabled: ['codex', 'venice']

=== H. fresh-install listing ===
CODEXBAR_CONFIG=/tmp/codexbar-crof-fresh-U8sNGU/config.json (missing on disk)
$ /workspace/.build/x86_64-unknown-linux-gnu/debug/CodexBarCLI config providers --format json --log-level error
fresh listedCount=68 hasCrof=False
on-disk after listing? False
$ /workspace/.build/x86_64-unknown-linux-gnu/debug/CodexBarCLI config dump --pretty --log-level error
fresh dump providerCount=68 hasCrof=False
on-disk after dump? False

---

[steipete]

Thanks @baanish! Your Crof shutdown removal was adopted in #3828 with your co-author credit and landed on main via #3830 (registry now 75 providers, generated files and widget fingerprints refreshed). An isolated built-CLI check confirms saved crof entries are ignored with a warning, the file is not rewritten on read, and the next save drops the entry while preserving every other provider byte-for-byte. Closing this PR as landed.