Context

Part of #415 Phase 1 (auth foundation). The onboarding wizard (src/wizard/onboarding.ts) needs adaptation after auth profiles are relocated and the per-agent auth config field is introduced.

Decision: Wizard stays "one key, one runtime" simple. Multi-key rotation is a post-wizard concern.

Concrete changes

Import path updates (follows #415 item 1)

• src/wizard/onboarding.ts imports from agents/auth-profiles/ → auth/
• src/commands/onboard-*.ts — any auth profile imports follow relocation

Storage path update

• upsertAuthProfile() calls write to new canonical location (follows resolveAuthStorePath() relocation)

Set auth field when key provided

• When user provides an API key during onboarding, write agents.defaults.auth: "{profile-id}" to config
  • Claude API key → agents.defaults.auth: "anthropic:default"
  • Claude OAuth → agents.defaults.auth: "claude:oauth-token"
  • Gemini → agents.defaults.auth: "google:default"
  • Codex → agents.defaults.auth: "codex:default"
  • OpenCode → agents.defaults.auth: "{provider}:default" or "opencode:{VAR_NAME}"

Explicit skip semantics

• When user skips credential setup, write agents.defaults.auth: false explicitly (CLI-native auth)
• Update skip guidance text to mention this means "CLI handles its own authentication"

Non-interactive mode

• --anthropic-api-key, --auth-token, --gemini-api-key, --codex-api-key, --openai-api-key flags: same behavior — store profile + set auth field
• No key flags provided: set auth: false

What does NOT change

• No multi-key prompt (single key only, both QuickStart and Advanced)
• No TTS/STT credential prompt (Phase 3/4 concern)
• No runtime capability notice (Phase 3, feat(middleware): communicate multimodal limitations to users when runtime can't handle media #400)
• No remoteclaw auth add subcommand (out of scope for feat: unified auth + multimodal AgentRuntime — implementation plan #415)

Dependencies

• Blocked by feat: unified auth + multimodal AgentRuntime — implementation plan #415 items 1-2 (auth relocation + auth config field)

Files likely touched

• src/wizard/onboarding.ts — promptRuntimeCredential(), config write logic
• src/commands/onboard-types.ts — no change expected (CLI flags stay the same)
• src/commands/onboard-config.ts — applyOnboardingLocalWorkspaceConfig() may need auth field
• src/commands/onboard-non-interactive.ts — mirror interactive auth field behavior