Self-Healing

cfgdrift can repair drift by itself: key-level precise rollback that rewrites only the drifted key's text span, preserving every other byte of the file.

How it works

Strategy: rules in <home>/remediate.yaml match on baseline / file regex / severity / change_type and carry a key_rollback action.
Precision: only the drifted key's text span is rewritten — comments, indentation, key order, and all sibling keys stay byte-identical.
Safety: backup <file>.cfgdrift.bak + temp-file atomic write + post-write parse verification; on failure the backup is kept and the notify_script fallback fires.
Audit: every action lands in the remediation_log table (Web "Self-Healing Audit" view, pruned at 30 days / 5000 rows).

Manual remediation (CLI)

cfgdrift remediate --baseline prod --file /path/to/conf    # dry-run preview
cfgdrift remediate --baseline prod --file /path/to/conf --apply   # actually write
cfgdrift remediate --baseline prod --path conf/app.toml --rule my_rule
cfgdrift remediate list        # show effective rules (empty state exit 0)
cfgdrift remediate validate    # exit 0 = legal / 2 = illegal remediate.yaml

Default is dry-run (preview only); pass --apply to write files. Exit codes: 0 = no drift / all success, 1 = drift with dry-run or failure, 2 = error.

Automatic remediation (daemon)

cfgdrift daemon start --target /etc/nginx --baseline prod --interval 300 --remediate

The daemon applies the same strategy rules automatically each cycle.

Remediation hints (v0.13.0)

Every CRITICAL/WARN drift item gets a three-part hint: ① expected value (baseline old_value); ② fix action (rollback / restore / delete, with the rollback command cfgdrift remediate --baseline NAME --apply and a manual-edit fallback); ③ provenance (with a .git repo, a read-only git log -1 of the file; otherwise silently degrades to baseline name + version + created_at). Hints are a pure read-only layer — never stored, values always masked, INFO items never produce one, and --no-hint restores byte-identical v0.12.0 output.

cfgdrift diff --baseline prod /path/to/conf
# [CRITICAL] server.port ... (modified, line 12)
#   [hint] 期望值 8080（基线 prod v3）
#   [hint] 修复   cfgdrift remediate --baseline prod --apply
#   [hint] 溯源   commit a3f2c9e "adjust prod port"

Full rule grammar and examples: README.en.md — v0.12.0 G1 / v0.13.0 G4 sections, and run the nginx gallery demo end to end.