[tensorlink-dev]

Signing in once to Ephemeris now connects Gnomon too. ephemeris auth login (ephemeris-cli), ephemeris-mcp login and savetokens all save one key file, ~/.config/ephemeris/credentials, as a single EPHEMERIS_API_KEY=pc_live_... line. They get the key from the browser sign-in Ephemeris shipped (device flow), so nobody copies it. Gnomon now falls back to that file.

Behaviour

• Gnomon's own key wins. ~/.config/gnomon/ephemeris.token is used whenever it exists, and gnomon connect ephemeris still writes only that file.
• The shared file follows the same privacy rules: a regular file you own, mode 600, in a mode-700 directory, no symlinks.
  • A shared file that fails them is ignored, not fatal: startup carries on with local models only.
  • Reason: many existing ~/.config/ephemeris directories are 755, and refusing to start would be worse than skipping the file.
• connect ephemeris --status and the MCP onboarding info report credential_source: gnomon, shared, shared_ignored_not_private, or null.
• --disconnect removes Gnomon's own key only. If the shared file still connects Gnomon, the output says so and points to ephemeris auth logout.
• read_token accepts both formats: a bare token, or the shared EPHEMERIS_API_KEY= line.
• EPHEMERIS_CREDENTIALS_FILE overrides the shared path and must be absolute, like the existing XDG_CONFIG_HOME rule.

Tests

Six new tests in tests/test_onboarding.py:

• the shared key connects Gnomon (check, provider registration) and Gnomon's own file isn't written;
• Gnomon's own key wins;
• a non-private directory or file is ignored, and the session still starts;
• disconnect guidance;
• a relative override is rejected.

Results:

• tests/test_onboarding.py: 40 pass.
• tests/ overall: 1158 pass. One failure, test_portable_schemas.py, is only because jsonschema isn't installed in my test environment; it's unrelated to this change.

🤖 Generated with Claude Code