feat(ui): enable Grok in Cloud agent setup

[devinfoley]

Thinking Path

• Paperclip manages AI agents and their execution settings.
• The new-agent flow selects an adapter before configuring credentials and a model.
• Cloud uses one adapter policy for the picker and direct setup links.
• That policy excludes Grok despite its existing adapter and xAI connection support.
• This change adds Grok to the Cloud policy.
• Cloud users can configure Grok with the existing subscription or API-key flow.

Linked Issues or Issue Description

What existing behavior does this improve?

Agent creation on Cloud.

Current behavior

The Cloud picker offers Claude, Codex, and OpenCode. Direct Grok setup links also fail the shared adapter check.

Proposed behavior

Offer Grok alongside the existing choices. Use the existing xAI connection and managed sandbox setup.

Reason and benefit

Users can select an already-supported adapter through the Cloud creation flow.

Breaking changes

None. Loaded and enabled checks still apply. Other excluded adapters remain excluded.

What Changed

• Add grok_local to the shared Cloud creation policy.
• Display four adapter choices in a 2×2 grid on desktop and mobile, and reuse the theme-aware provider mark on the connection step so Grok is visible in dark mode.
• Verify picker navigation and both Grok authentication methods through sandbox setup, model testing, and agent creation.
• Verify that probe and hire payloads carry the xAI connection binding without the entered API key.
• Update the agent configuration specification.

Verification

• cd ui && pnpm exec vitest run src/components/NewAgentDialog.test.tsx src/pages/NewAgent.test.tsx src/components/new-agent/AgentProviderConnection.test.tsx — 69 tests passed.
• Chromium checks against the production components and built stylesheet — four cards occupy two rows and two columns at 1280px and 390px; the connection step loads and displays the white Grok logo in dark mode and the black logo in light mode.
• pnpm --filter @paperclipai/ui typecheck — passed.
• pnpm --filter @paperclipai/ui build — passed.
• pnpm check:token-gates — passed.
• git diff origin/master...HEAD | gitleaks stdin --redact --no-banner — no leaks found; manual diff review found no private identifiers or user data.
• pnpm -r typecheck and pnpm build — blocked at the existing runner package because cargo is not installed locally.
• pnpm test:run — started locally, then stopped after the equivalent CI suites passed.
• Initial PR CI passed, including full typecheck/build, general and serialized tests, Rust checks, and all eight browser-test shards. One unchanged Cursor test timed out on the first attempt; its five-test file passed locally and the failed CI shard passed on retry.
• The latest CI run passed build, typecheck, all general and serialized tests, Rust checks, and all eight browser-test shards. One unchanged local-service-supervisor test failed its HTTP readiness check on the first attempt; its six-test file passed locally, and the failed server shard passed on retry.
• Live xAI login and model execution were not run; the setup tests mock provider calls.

Risks

Small UI policy change. The existing Grok adapter, authentication, and secret storage paths remain in use. No schema or control-plane change is required. Cloud must deploy a tenant-app release containing this change. Revert the policy entry to hide Grok from new-agent setup again.

Model Used

• OpenAI GPT-6 (Codex), with repository inspection, code editing, and shell-based verification.

Checklist

• I have included a thinking path that traces from project context to this change
• I have specified the model used (with version and capability details)
• I have checked ROADMAP.md and confirmed this PR does not duplicate planned core work
• I have searched GitHub for duplicate or related PRs and linked them above
• I have either (a) linked existing issues with Fixes: # / Closes # / Refs # OR (b) described the issue in-PR following the relevant issue template
• I have not referenced internal/instance-local Paperclip issues or links (only public GitHub #NNN / github.com/paperclipai/paperclip URLs)
• My branch name describes the change (e.g. docs/..., fix/...) and contains no internal Paperclip ticket id or instance-derived details
• I have run tests locally and they pass
• I have added or updated tests where applicable
• I have updated relevant documentation to reflect my changes
• I have considered and documented any risks above
• All Paperclip CI gates are green
• Greptile is 5/5 with no open P2s, recommendations, or follow-ups
• I will address all Greptile and reviewer comments before requesting merge

[greptile-apps]

Confidence Score: 5/5

The PR appears safe to merge with no outstanding correctness, security, or repository-rule issues identified.

Summary

This PR enables the existing Grok adapter in the Cloud new-agent flow and refines the picker and connection-step presentation.

• Adds grok_local to the shared Cloud creation policy used by the picker and direct setup links.
• Adds coverage for picker navigation and Grok subscription/API-key setup, including credential isolation in probe and hire payloads.
• Balances four adapter choices in a 2×2 grid and reuses theme-aware provider marks on the connection step.
• Updates the agent configuration specification to document the expanded Cloud flow.

_{Reviews (2) · Last reviewed commit: "fix(ui): balance Cloud adapter tiles and..."}