tfctl — HCP Terraform CLI

Single binary, full v2 API coverage. Already authenticated.

Hard rules

1. Never pipe tfctl JSON to an external jq. Use the built-in --jq '<expr>' flag — it implies --json and runs gojq on the response envelope.

2. Never issue -X DELETE. All deletes need a human. If asked to delete, print the exact command and ask the user to run it.

3. Resolve names with -p, not separate lookup calls. Paths with {workspace}/{team}/{project}/{varset} accept -p workspace=NAME etc. — tfctl resolves name→ID for you. Don't fetch the ID first.

4. Trust the first answer. data: [], data: null, relationships.X.data: null, or stderr "no current run"/"not found" ARE the answer. Don't re-query in another format. Don't walk relationships "to verify".

5. When a named resource is not found, stop completely. Exit code 2 or absence from a listing IS the full answer. Never:

   • Try a different resource ID "to verify the endpoint works"
   • Pivot to another org/workspace that appeared in the available list
   • Explore related resources to find "similar" information
   • Use Rule 4 to justify switching to a different resource: if you listed orgs and 'platform' isn't there, the first answer is "platform doesn't exist" — stop, don't use whatever org IS listed instead.

   Examples: run-POLICY returns exit 2 → stop, don't query other run IDs. Listing orgs shows no 'platform' → stop, don't use the org that IS listed.

URL shape: per-workspace subpaths live at /workspaces/{workspace}/...