feat: support $XDG_CONFIG_HOME for user config directory

[theoephraim]

Closes #348

Adds support for the XDG Base Directory Specification for the user-level varlock config directory.

Resolution order

1. If $XDG_CONFIG_HOME is set → $XDG_CONFIG_HOME/varlock
2. If legacy ~/.varlock exists → ~/.varlock (backwards compatibility)
3. Otherwise → ~/.config/varlock (XDG default)

Changes

• New: packages/varlock/src/lib/user-config-dir.ts — shared utility for resolving the user config dir
• Updated: telemetry.ts, telemetry.command.ts, plugins.ts — use the new utility instead of hardcoded ~/.varlock
• Updated: install.sh — mirrors the same XDG resolution logic in shell
• Updated: docs and error messages to reference the new paths
• Updated: login.command.ts — updated TODO comments

[changeset-bot]

🦋 Changeset detected

Latest commit: 585ce62

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 11 packages

Name	Type
varlock	Patch
@varlock/astro-integration	Patch
@varlock/nextjs-integration	Patch
@varlock/vite-integration	Patch
@varlock/1password-plugin	Patch
@varlock/aws-secrets-plugin	Patch
@varlock/azure-key-vault-plugin	Patch
@varlock/bitwarden-plugin	Patch
@varlock/google-secret-manager-plugin	Patch
@varlock/infisical-plugin	Patch
@varlock/pass-plugin	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/varlock@352

commit: b06e670

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	varlock-website	585ce62	Commit Preview URL Branch Preview URL	Mar 12 2026, 01:57 AM

[philmillman]

it probably doesn't hurt to add a test case for the 3 possible cases here:

• XDG
• new file
• existing file

[theoephraim]

@copilot - lets check how the plugin cache interacts with this. Specifically in the case where the user has no home folder, like in docker. Its ok if the config isnt there because we can skip telemetry, but the plugin cache needs to be written somewhere. It could be in the current folder, or in /tmp - although within docker the user may need to copy those files to another layer. Figure out what makes the most sense for this docker-with-no-home-folder case

[Copilot]

@theoephraim I've opened a new pull request, #375, to work on those changes. Once the pull request is ready, I'll request review from you.