update-conflisted

# update-conf Update an existing ansible.cfg with targeted changes. Always shows a diff and waits for confirmation before writing. --- ## Required Inputs 1. **path to ansible.cfg** — Resolved from discovery if not provided 2. **change_description** — What to change (e.g., "enable fact caching with redis", "set forks to 20", "add vault_identity_list for dev and prod") --- ## Behavior ### Step 1 — Discovery Locate the ansible.cfg via discovery (`references/discovery.md`). ### Step 2 — Load Existing Config Read the full ansible.cfg content. ### Step 2a — Secret Scan (before any output) Before displaying any content or diff, scan every line for credential-like values: - Match lines where the key contains `password`, `secret`, `token`, `key`, `pass`, `credential`, or `vault_password_file` - **Skip** lines where the value is already a vault reference (`{{ vault_* }}`), empty, or `None` - For any remaining matches, **redact the value** in all output: `password = ***REDACTED***` - Emit a warning at the top of the diff block: ``` ⚠ Warning: N line(s) with credential-like values were redacted from this display. Review the file directly before applying changes. ``` - Never output actual credential values in diffs, summaries, or confirmations. ### Step 3 — Apply Change Apply the requested change: - Preserve all existing sections, keys, and comments - Add inline justification comments for security-sensitive settings: - `host_key_checking = False` → must have a commen