Context

Part of #415 Phase 1, item 1. Auth profiles are currently scoped under src/agents/auth-profiles/ as an agent-specific concern. With the unified auth architecture (#415), they become middleware-wide — used by CLI runtimes, TTS, STT, and media understanding.

Scope

Move

• src/agents/auth-profiles/ → src/auth/
• src/agents/auth-profiles.ts (barrel) → src/auth/index.ts or remove if barrel is unnecessary
• src/agents/provider-auth.ts → src/auth/provider-auth.ts
• src/agents/api-key-rotation.ts → src/auth/api-key-rotation.ts
• src/agents/auth-health.ts → src/auth/auth-health.ts

Update imports

All consumers need import path updates:

• src/wizard/onboarding.ts (onboarding wizard)
• src/commands/onboard-*.ts (onboarding helpers)
• src/commands/agent.ts (agent CLI command)
• src/commands/doctor-auth.ts (health check)
• src/commands/agents.commands.add.ts (agent add)
• src/commands/channels/list.ts (channel list)
• src/commands/configure.gateway-auth.ts (gateway auth)
• src/media-understanding/runner.ts and runner.entries.ts
• src/auto-reply/reply/directive-handling.auth.ts
• src/auto-reply/reply/commands-status.ts
• src/auto-reply/status.ts
• src/auto-reply/reply/agent-runner.ts
• src/auto-reply/reply/get-reply-run.ts
• src/cron/isolated-agent/run.ts
• src/infra/provider-usage.auth.ts
• src/plugins/types.ts
• Test files importing from the old paths

Storage path

The on-disk storage path (~/.remoteclaw/agents/auth-profiles.json) may also need consideration — does it stay under agents/ on disk, or move to ~/.remoteclaw/auth-profiles.json? If moved, needs migration logic for existing installations.

Tests

• All existing tests pass after relocation (import path updates only)
• No behavioral change

Related

• feat: unified auth + multimodal AgentRuntime — implementation plan #415 — implementation plan (parent)
• Unblocks: Adapt onboarding wizard for unified auth system #417 (onboarding), fix(tts): resolve TTS API keys through auth profile store #402 (TTS auth), Phase 1 items 2-4