config_replace
Replace a device's full configuration with a configurable revert timer to prevent lockouts. Includes dry-run preview and credential-redacted diff.
Instructions
[WRITE] Replace the full config and commit under a revert timer. HIGH RISK.
Same commit-confirm contract as config_merge: the device reverts after
revert_in seconds unless confirm_commit follows. Verify reachability
first, then confirm. Check commit.safetyNet — when no timer could be
armed the change is permanent on landing.
Returns diff and a backup digest; the raw pre-change config is kept
in undo.db (0600) for the recorded rollback, not echoed back here. The
diff is credential-redacted with no opt-out (see the redaction
block); use config_diff(include_secrets=True) first if you must verify a
literal key.
dry_run=True previews the diff and runs the same refusal the real commit would, so the preview can never disagree with the commit.
Args: config_text: The full replacement configuration. revert_in: Device-side revert timer in seconds (default 300). 0 disables it, leaving the recorded undo as the only rollback path. dry_run: If True, preview the diff + safety assessment without committing. target: Device name from config.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| target | No | ||
| dry_run | No | ||
| revert_in | No | ||
| config_text | Yes |