Context

The auth profiles system (auth-profiles.json, provider-auth.ts, onboarding credential collection) and media understanding subsystem were inherited from OpenClaw's model-provider architecture. RemoteClaw is middleware — it spawns CLI agents, it doesn't make model API calls itself.

With runtimeEnv (#375) handling CLI credential injection via config, and CLIs handling multimodal input natively, both systems are redundant.

Prerequisite spike

Before gutting media understanding, verify that CLI agents can receive media (images, audio, video) via their NDJSON/streaming-JSON interfaces:

• Claude CLI: Can images be passed via --print streaming JSON? Base64? File paths?
• Gemini CLI: Multimodal input via --prompt or stdin?
• Codex CLI: --image flag works with JSON output mode? Multiple images?
• Audio/video: Do any CLIs accept audio or video input? What happens when a user sends a voice message on WhatsApp?

The spike determines whether media passthrough is straightforward or needs a thin adapter layer (e.g., saving media to temp files and passing paths).

What to remove

Media understanding subsystem

• src/media-understanding/ — entire directory (runner, entries, providers, attachments, types, resolve, defaults, errors, output-extract)
• Media understanding config in schema (tools.mediaUnderstanding)
• Related test files

Auth profile infrastructure

• src/agents/auth-profiles/ — entire directory (store, types, constants, profiles, oauth, paths, display, doctor, session-override)
• src/agents/auth-profiles.ts — barrel re-export
• src/agents/auth-health.ts — auth health summary
• src/agents/provider-auth.ts — provider auth resolution (resolveApiKeyForProvider, resolveEnvApiKey, resolveModelAuthMode, resolveModelAuthLabel, etc.)
• src/agents/api-key-rotation.ts — API key rotation (only used by media understanding)

Onboarding credential collection

• src/commands/onboard-auth.credentials.ts — writeOAuthCredentials, setAnthropicApiKey, setGeminiApiKey, etc.
• src/wizard/onboarding.ts — promptRuntimeCredential() flow (API key / auth token prompts)
• src/commands/onboard-auth.config-*.ts — provider-specific config helpers
• src/commands/configure.gateway-auth.ts — gateway auth profile upserts

Auth profile consumers

• src/commands/doctor-auth.ts — deprecated profile detection + health display
• src/commands/agent.ts — ensureAuthProfileStore(), clearSessionAuthProfileOverride()
• src/auto-reply/reply/directive-handling.auth.ts — /auth directive handler
• src/auto-reply/reply/commands-status.ts — resolveModelAuthLabel() display
• src/auto-reply/status.ts — resolveModelAuthMode() status display
• src/auto-reply/reply/agent-runner.ts — auth mode checks
• src/auto-reply/reply/get-reply-run.ts — session auth profile override
• src/cron/isolated-agent/run.ts — session auth profile override
• src/infra/provider-usage.auth.ts — provider usage auth resolution
• src/commands/agents.commands.add.ts — upsertAuthProfile() during agent add
• src/commands/channels/list.ts — loadAuthProfileStore()
• src/plugins/types.ts — AuthProfileCredential type import

Config/schema fields

• auth.profiles in config schema
• Session entry fields: authProfileOverride, providerOverride, modelOverride

What replaces it

• CLI credential injection: runtimeEnv config (feat(runtime): add runtimeEnv config for CLI process environment variables #375)
• Media processing: CLIs handle multimodal input natively (pending spike confirmation)
• Onboarding: Simplified to: pick runtime → set runtimeEnv → done
• Status display: Show whether runtimeEnv has expected env var for configured runtime

Related

• feat(runtime): add runtimeEnv config for CLI process environment variables #375 — runtimeEnv config field (prerequisite)
• fix(middleware): CLIRuntimeBase silently discards stderr when CLI exits with error #374 — stderr swallowing (independent)
• 4452b2de02 — model management gut (precedent)