diff --git a/.planning/REQUIREMENTS.md b/.planning/REQUIREMENTS.md
index 495d5f4f..ccaf285b 100644
--- a/.planning/REQUIREMENTS.md
+++ b/.planning/REQUIREMENTS.md
@@ -20,7 +20,7 @@
 - [x] **CLOUD-01**: User gets working AI via Puter.js with zero API keys and no sign-up required
 - [x] **CLOUD-02**: Puter.js integrated as server-proxied adapter (not browser-direct) with full cost tracking
 - [x] **CLOUD-03**: User can sign in via Google OAuth to access Gemini free tier
-- [ ] **CLOUD-04**: System auto-detects installed tools (Hermes, Claude Code, OpenClaw) and pre-fills configuration
+- [x] **CLOUD-04**: System auto-detects installed tools (Hermes, Claude Code, OpenClaw) and pre-fills configuration
 - [x] **CLOUD-05**: User can enter API keys for subscription providers during onboarding
 
 ### Voice
@@ -76,7 +76,7 @@
 | CLOUD-01 | Phase 31 | Complete |
 | CLOUD-02 | Phase 31 | Complete |
 | CLOUD-03 | Phase 31 | Complete |
-| CLOUD-04 | Phase 31 | Pending |
+| CLOUD-04 | Phase 31 | Complete |
 | CLOUD-05 | Phase 31 | Complete |
 | ONBD-04 | Phase 32 | Pending |
 | ONBD-05 | Phase 32 | Pending |
diff --git a/.planning/ROADMAP.md b/.planning/ROADMAP.md
index 2fb03352..525f4e12 100644
--- a/.planning/ROADMAP.md
+++ b/.planning/ROADMAP.md
@@ -129,7 +129,7 @@ Plans:
 Plans:
 - [x] 31-01-PLAN.md — Puter proxy service, routes, unit tests, and app.ts wiring
 - [x] 31-02-PLAN.md — Google OAuth PKCE service, routes, API key storage route
-- [ ] 31-03-PLAN.md — Provider Selection UI step, PuterAuthButton, GoogleOAuthButton, ApiKeyEntryForm, 4-step wizard wiring
+- [x] 31-03-PLAN.md — Provider Selection UI step, PuterAuthButton, GoogleOAuthButton, ApiKeyEntryForm, 4-step wizard wiring
 - [ ] 31-04-PLAN.md — Google OAuth claim endpoint, human verification of full onboarding flow
 **UI hint**: yes
 
@@ -222,7 +222,7 @@ All 21 v1.5 requirements are mapped to exactly one phase. No orphans.
 | 28. Ollama Integration & Agent Surface | v1.4 | 3/3 | Complete | 2026-04-02 |
 | 29. Default Provider & End-to-End | v1.4 | 2/2 | Complete | 2026-04-02 |
 | 30. Hardware Detection + Mode Selection | v1.5 | 2/2 | Complete    | 2026-04-03 |
-| 31. Puter.js Zero-Config Cloud | v1.5 | 2/4 | In Progress|  |
+| 31. Puter.js Zero-Config Cloud | v1.5 | 3/4 | In Progress|  |
 | 32. Multi-Step Onboarding Wizard | v1.5 | 0/TBD | Not started | - |
 | 33. Persistent Memory + Personal Assistant Mode | v1.5 | 0/TBD | Not started | - |
 | 34. Voice | v1.5 | 0/TBD | Not started | - |
diff --git a/.planning/STATE.md b/.planning/STATE.md
index 71cb2782..30020f22 100644
--- a/.planning/STATE.md
+++ b/.planning/STATE.md
@@ -3,14 +3,14 @@ gsd_state_version: 1.0
 milestone: v1.5
 milestone_name: Smart Onboarding + Personal AI Assistant
 status: executing
-stopped_at: Completed 31-puter.js-zero-config-cloud/31-02 (all 3 tasks, 11 tests pass)
-last_updated: "2026-04-03T00:37:50.371Z"
+stopped_at: Completed 31-puter.js-zero-config-cloud/31-03 (2 tasks, 6 files, provider selection UI complete)
+last_updated: "2026-04-03T00:44:22.867Z"
 last_activity: 2026-04-03
 progress:
   total_phases: 6
   completed_phases: 1
   total_plans: 6
-  completed_plans: 4
+  completed_plans: 5
   percent: 0
 ---
 
@@ -26,7 +26,7 @@ See: .planning/PROJECT.md (updated 2026-04-02)
 ## Current Position
 
 Phase: 31 (puter.js-zero-config-cloud) — EXECUTING
-Plan: 3 of 4
+Plan: 4 of 4
 Status: Ready to execute
 Last activity: 2026-04-03
 
@@ -56,6 +56,7 @@ Progress: [__________] 0%
 | Phase 30-hardware-detection-mode-selection P02 | 15 | 2 tasks | 6 files |
 | Phase 31-puter.js-zero-config-cloud P01 | 4 | 2 tasks | 4 files |
 | Phase 31-puter.js-zero-config-cloud P02 | 202 | 3 tasks | 4 files |
+| Phase 31-puter.js-zero-config-cloud P03 | 5 | 2 tasks | 6 files |
 
 ## Accumulated Context
 
@@ -78,6 +79,7 @@ Key constraints for v1.5 (established at roadmap):
 - [Phase 31-puter.js-zero-config-cloud]: agentId is optional in puterProxyService.chatStream — cost recording skipped when null/undefined to avoid FK violation in cost_events
 - [Phase 31-puter.js-zero-config-cloud]: pendingPkce stores only verifier (no companyId) — company does not exist at authorize time during onboarding
 - [Phase 31-puter.js-zero-config-cloud]: pendingTokens pattern: callback parks tokens by stateId, claim endpoint links to real companyId post-company-creation
+- [Phase 31-puter.js-zero-config-cloud]: Provider heading in wizard wrapper (not ProviderSelectionStep) for consistency with ModeSelector pattern; credentials captured in React state and posted after company creation
 
 ### Pending Todos
 
@@ -92,6 +94,6 @@ None yet.
 
 ## Session Continuity
 
-Last session: 2026-04-03T00:37:50.368Z
-Stopped at: Completed 31-puter.js-zero-config-cloud/31-02 (all 3 tasks, 11 tests pass)
+Last session: 2026-04-03T00:44:22.863Z
+Stopped at: Completed 31-puter.js-zero-config-cloud/31-03 (2 tasks, 6 files, provider selection UI complete)
 Resume file: None
diff --git a/.planning/phases/31-puter.js-zero-config-cloud/31-03-SUMMARY.md b/.planning/phases/31-puter.js-zero-config-cloud/31-03-SUMMARY.md
new file mode 100644
index 00000000..698c5615
--- /dev/null
+++ b/.planning/phases/31-puter.js-zero-config-cloud/31-03-SUMMARY.md
@@ -0,0 +1,127 @@
+---
+phase: 31-puter.js-zero-config-cloud
+plan: "03"
+subsystem: ui
+tags: [react, puter, google-oauth, api-key, onboarding, shadcn, lucide-react]
+
+# Dependency graph
+requires:
+  - phase: 31-puter.js-zero-config-cloud/31-01
+    provides: puterProxyService and routes (POST /api/puter-proxy/token, /api/puter-proxy/chat)
+  - phase: 31-puter.js-zero-config-cloud/31-02
+    provides: Google OAuth PKCE routes (authorize, callback, claim) and api-keys/store endpoint
+  - phase: 30-hardware-detection-mode-selection/30-02
+    provides: NexusOnboardingWizard 3-step structure and ModeSelector card pattern
+provides:
+  - ProviderSelectionStep component (Step 3 of 4) with Puter/Google/API key cards
+  - PuterAuthButton: loads Puter CDN, triggers signIn popup, captures token in React state
+  - GoogleOAuthButton: 3-second risk warning gate, opens OAuth popup, captures stateId
+  - ApiKeyEntryForm: provider dropdown (OpenAI/Anthropic/Groq) + password input
+  - puterProxyApi client: storeToken, getAuthUrl, claimGoogleTokens, storeApiKey
+  - NexusOnboardingWizard updated to 4-step flow with credential storage after company creation
+affects: [31-04, 33-personal-ai-assistant, future-onboarding-phases]
+
+# Tech tracking
+tech-stack:
+  added: []
+  patterns:
+    - "Provider card interaction: <button type=button> with border-primary bg-primary/5 on selection, matches ModeSelector"
+    - "Credential capture: React state stores token/stateId/apiKey during wizard; posted server-side after company creation"
+    - "CDN script injection: loadScript() helper creates <script> tag on demand (Puter SDK only loaded on click)"
+    - "Google risk gate: 3-second setTimeout before enabling Sign in button (anti-accidental-click UX pattern)"
+    - "Non-blocking credential storage: all provider API calls wrapped in .catch(() => {}) post company creation"
+
+key-files:
+  created:
+    - ui/src/api/puter-proxy.ts
+    - ui/src/components/onboarding/PuterAuthButton.tsx
+    - ui/src/components/onboarding/GoogleOAuthButton.tsx
+    - ui/src/components/onboarding/ApiKeyEntryForm.tsx
+    - ui/src/components/onboarding/ProviderSelectionStep.tsx
+  modified:
+    - ui/src/components/NexusOnboardingWizard.tsx
+
+key-decisions:
+  - "Heading 'Choose a provider' in wizard wrapper, not ProviderSelectionStep — matches existing pattern where step wrapper owns heading"
+  - "Adapter badges on Puter card only (hermes/claude/openclaw are local adapters, not Google/API key alternatives)"
+  - "Pre-existing AgentConfigForm.tsx TS error (detectModel) left as out-of-scope — pre-dated this plan"
+
+patterns-established:
+  - "Provider auth pattern: capture credentials in React state during wizard, POST to server only after company creation"
+  - "Risk warning timing gate: useEffect + setTimeout(fn, 3000) for anti-accidental-click on destructive/risky actions"
+
+requirements-completed: [CLOUD-01, CLOUD-03, CLOUD-04, CLOUD-05]
+
+# Metrics
+duration: 5min
+completed: 2026-04-03
+---
+
+# Phase 31 Plan 03: Provider Selection UI Summary
+
+**4-step onboarding wizard with Puter/Google/API-key provider cards, adapter auto-detection badges, and post-company-creation credential storage**
+
+## Performance
+
+- **Duration:** ~5 min
+- **Started:** 2026-04-03T00:38:48Z
+- **Completed:** 2026-04-03T00:43:18Z
+- **Tasks:** 2
+- **Files modified:** 6
+
+## Accomplishments
+
+- Created `puterProxyApi` client covering all 4 server endpoints (puter-proxy/token, oauth/google/authorize, oauth/google/claim, api-keys/store)
+- Built `PuterAuthButton` with dynamic Puter CDN loading, popup sign-in, and multi-path token extraction
+- Built `GoogleOAuthButton` with always-visible policy-risk callout and 3-second gate before enabling sign-in
+- Built `ApiKeyEntryForm` with OpenAI/Anthropic/Groq dropdown and password input
+- Built `ProviderSelectionStep` with three option cards matching ModeSelector visual pattern, adapter detection badges, and skip button
+- Extended `NexusOnboardingWizard` from 3 to 4 steps; parallel adapter probes for hermes/claude/openclaw; credentials stored after company creation
+
+## Task Commits
+
+1. **Task 1: API client + PuterAuthButton + GoogleOAuthButton + ApiKeyEntryForm** - `3796de84` (feat)
+2. **Task 2: ProviderSelectionStep + wire 4-step wizard** - `cdea714d` (feat)
+
+## Files Created/Modified
+
+- `ui/src/api/puter-proxy.ts` — API client: storeToken, getAuthUrl, claimGoogleTokens, storeApiKey
+- `ui/src/components/onboarding/PuterAuthButton.tsx` — Loads Puter CDN, triggers signIn popup, captures token
+- `ui/src/components/onboarding/GoogleOAuthButton.tsx` — 3-second risk warning gate, opens OAuth popup, captures stateId
+- `ui/src/components/onboarding/ApiKeyEntryForm.tsx` — Provider dropdown (OpenAI/Anthropic/Groq) + password input
+- `ui/src/components/onboarding/ProviderSelectionStep.tsx` — Three provider cards with adapter badges and skip button
+- `ui/src/components/NexusOnboardingWizard.tsx` — 4-step wizard: added Step 3 (provider selection), credential storage in handleSubmit
+
+## Decisions Made
+
+- Heading "Choose a provider" lives in wizard wrapper (step 3 block), not inside ProviderSelectionStep — consistent with how ModeSelector heading lives in the wizard wrapper
+- Adapter badges (Hermes/Claude Code/OpenClaw detected) shown on the Puter card since these are the pre-installed local adapters that are Puter-compatible; Google and API key cards don't show badges
+- Pre-existing TypeScript error in `AgentConfigForm.tsx` (`detectModel` missing from agentsApi) is out of scope — it existed before this plan. Logged to deferred items.
+
+## Deviations from Plan
+
+None - plan executed exactly as written.
+
+## Issues Encountered
+
+- Pre-existing TypeScript compilation error in `AgentConfigForm.tsx(351)`: `Property 'detectModel' does not exist on type...` — this error existed before this plan. My new files compile cleanly (only one TS error in the build, and it's in an unrelated file). Logged for deferred fix.
+
+## Known Stubs
+
+None. All provider auth components pass real tokens/stateIds to the wizard which stores them post-company-creation. No hardcoded empty values or placeholder data flows to UI rendering.
+
+## User Setup Required
+
+None - no external service configuration required for the UI components. Server-side OAuth/proxy routes were established in plans 31-01 and 31-02.
+
+## Next Phase Readiness
+
+- Provider Selection step UI is complete; Step 3 of 4 is fully functional
+- Puter token → stored via `POST /api/puter-proxy/token` after company creation
+- Google stateId → claimed via `POST /api/oauth/google/claim` after company creation
+- API keys → stored via `POST /api/api-keys/store` after company creation
+- Ready for plan 31-04 (final integration / summary screen)
+
+---
+*Phase: 31-puter.js-zero-config-cloud*
+*Completed: 2026-04-03*