feat: first-class OpenTofu support in status

[posquit0]

Summary

OpenTofu discovers credentials helpers in the same ~/.terraform.d/plugins directory under the same terraform-credentials-<name> naming (verified against OpenTofu source: internal/plugin/discovery/find.go, cmd/tofu/plugins.go), so tfvault install already works for tofu — but status only read $TF_CLI_CONFIG_FILE / ~/.terraformrc and reported OpenTofu-only setups as broken.

status now inspects the CLI configs of both tools:

• $TF_CLI_CONFIG_FILE when set (honored by both tools — OpenTofu kept the TF_ name), as the sole candidate
• otherwise ~/.terraformrc (terraform), ~/.tofurc (opentofu), and $XDG_CONFIG_HOME/opentofu/tofurc (opentofu, when the env var is set)

Each found file gets the existing registration checks, labeled with the tool that reads it. Health semantics: at least one existing CLI config must register tfvault.

• An OpenTofu-only machine (just ~/.tofurc) now reports healthy — previously status failed on the missing ~/.terraformrc
• A ~/.tofurc that exists without a credentials_helper block gets a warning without failing terraform-side health. This case matters: once a tofurc exists, OpenTofu ignores ~/.terraformrc entirely, silently disabling the helper for tofu
• Profile resolution uses the first registering file's helper args, and the report names that file ("from .tofurc helper args")

README gains an ## OpenTofu section documenting the shared plugin dir, the tofurc/terraformrc fallback and the both-files caveat.

Test plan

• TestStatusTofurcOnly: tofu-only machine → healthy, tofurc ok line, profile from tofurc args
• TestStatusTofurcNotRegistered: terraform wired + stray tofurc → exit 0 with tofurc warning
• Existing status tests pass unchanged (TF_CLI_CONFIG_FILE single-candidate path, zero-config "missing" path)
• Manual run on a real machine (terraformrc-only): ok line labeled "read by terraform", exit 0
• go test ./..., go vet, gofmt clean

Sources

OpenTofu behavior verified against source and docs: credentials helpers, config file lookup, TF_CLI_CONFIG_FILE.

[gemini-code-assist]

Code Review

This pull request adds support for OpenTofu to tfvault by updating the status command to inspect OpenTofu configuration files (.tofurc and the XDG config path) alongside Terraform's .terraformrc. It also updates the documentation and adds corresponding unit tests. Feedback on the changes suggests handling the default fallback to ~/.config/opentofu/tofurc when the XDG_CONFIG_HOME environment variable is unset or empty.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

[gemini-code-assist]

According to the OpenTofu specification, if the XDG_CONFIG_HOME environment variable is not set or is empty, OpenTofu falls back to looking for the configuration file at ~/.config/opentofu/tofurc.

Currently, the code only checks the XDG path if XDG_CONFIG_HOME is explicitly set to a non-empty value. This means that on standard systems where XDG_CONFIG_HOME is not set, tfvault status will fail to inspect the default ~/.config/opentofu/tofurc location.

We should fall back to ~/.config when XDG_CONFIG_HOME is empty.

	xdgConfig := os.Getenv("XDG_CONFIG_HOME")
	if xdgConfig == "" {
		xdgConfig = filepath.Join(home, ".config")
	}
	cands = append(cands, rcCandidate{filepath.Join(xdgConfig, "opentofu", "tofurc"), "opentofu"})

[posquit0]

Checked this against OpenTofu's actual implementation before applying, and the claim doesn't hold: there is no fallback to ~/.config when XDG_CONFIG_HOME is unset. From internal/command/cliconfig/config_unix.go:

if xdgDir := os.Getenv("XDG_CONFIG_HOME"); xdgDir != "" && !cl.pathExists(legacyConfigFile) && !cl.pathExists(newConfigFile) {
    // a fresh install should not use terraform naming
    return filepath.Join(xdgDir, "opentofu", "tofurc"), nil
}

OpenTofu only consults the XDG path when XDG_CONFIG_HOME is explicitly non-empty (and neither ~/.tofurc nor ~/.terraformrc exists). With the variable unset, ~/.config/opentofu/tofurc is never read — so adding the suggested fallback would make status report a file the tool doesn't actually use. The current candidate logic intentionally mirrors the implementation, and cliConfigCandidates' doc comment describes exactly this. Keeping as is.