update-playbooklisted

# update-playbook Update an existing Ansible playbook with a specific change. Always shows a diff and waits for confirmation before writing. --- ## Required Inputs 1. **path + filename** — Path to the playbook to modify (resolved from discovery if not provided) 2. **change_description** — What to change (e.g., "add a post_task to validate nginx", "replace the service module calls with FQCN", "add tags to all tasks") --- ## Behavior ### Step 1 — Discovery Run discovery per `references/discovery.md` to locate the target file if only a filename is given. ### Step 2 — Load Existing File Read the full content of the target playbook. ### Step 2a — Secret Scan (before any output) Before displaying any content or diff, scan the loaded file for credential-like values: - Match lines or YAML values where the key contains `password`, `secret`, `token`, `api_key`, `private_key`, `pass`, or `credential` - **Skip** lines where the value is already a vault reference (`{{ vault_* }}`), a task option (`no_log`, `register`, `when`), empty, or `None` - For any remaining matches, **redact the value** in all output: `password: "***REDACTED***"` - Emit a warning at the top of the diff block: ``` ⚠ Warning: N line(s) with credential-like values were redacted from this display. Review the file directly before applying changes. ``` - Never output actual credential values in diffs, summaries, or confirmations. ### Step 3 — Apply Change Apply the requested change following all global