chore: 发布 v0.1.11 并更新文档

feat(config): 在加密导出/导入中包含个人访问令牌
refactor: 移除未使用的代码和注释掉的辅助函数
2026-03-23 18:07:11 +08:00 · 2026-03-23 17:59:23 +08:00 · 2026-03-20 18:05:33 +08:00 · 2026-03-19 16:34:45 +08:00 · 2026-03-12 18:05:38 +08:00 · 2026-03-12 17:45:05 +08:00
22 changed files with 2413 additions and 1206 deletions
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -5,6 +5,41 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).

+## [Unreleased]
+
+暂无。
+
+## [0.1.11] - 2026-03-23
+
+### ✨ 新功能
+- 新增配置导出导入功能，支持加密保护
+- Profile 支持 Token 管理（PAT 等）
+- 自动生成和维护 Keep a Changelog 格式的变更日志
+- 交互式命令行界面，支持预览和确认
+
+### 🔐 安全特性
+- 敏感数据加密存储（API 密钥等）
+- 使用系统密钥环安全保存凭证
+
+### 🔧 其他变更
+- 优化 diff 截断逻辑，使用字符边界确保多字节字符安全
+- 改进配置管理器，支持修改追踪
+
+## [0.1.9] - 2026-03-06
+
+### 🐞 错误修复
+- 修复diff截断时的字符边界问题
+
+## [0.1.7] - 2026-02-14
+
+### 🐞 错误修复
+- 修复 `changelog` 命令默认覆盖文件的问题，现改为智能追加新版本条目到头部之后
+
+### 🔧 其他变更
+- 清理 `formatter.rs` 中未使用的函数（`format_commit_date`、`format_changelog_date`、`format_tag_name`、`truncate`、`format_markdown_list`、`format_changelog_section`、`format_git_config_key`）
+- 清理 `validators.rs` 中未使用的函数（`validate_ssh_key`）
+- 移除 `changelog` 命令的 `--prepend` 参数（默认行为已改为追加）
+
 ## [0.1.4] - 2026-02-01

 ### ✨ 新功能
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "quicommit"
-version = "0.1.7"
+version = "0.1.11"
 edition = "2024"
 authors = ["Sidney Zhang <zly@lyzhang.me>"]
 description = "A powerful Git assistant tool with AI-powered commit/tag/changelog generation(alpha version)"
@@ -66,6 +66,9 @@ argon2 = "0.5"
 rand = "0.8"
 base64 = "0.22"

+# System keyring for secure API key storage
+keyring = { version = "3.6.3", features = ["apple-native", "windows-native", "sync-secret-service"] }
+
 # Interactive editor
 edit = "0.1"

--- a/README.md
+++ b/README.md
@@ -6,8 +6,12 @@ A powerful AI-powered Git assistant for generating conventional commits, tags, a

 [Still in early development, some features may not be complete. Feedback and contributions are welcome.]

+> ⚠️ **Important Notice**: QuiCommit now uses system keyring to store API keys securely. This change may cause breaking changes to your existing configuration. If you encounter issues after updating, please run `quicommit config reset --force` to reset your configuration, then reconfigure your settings.
+
 ![Rust](https://img.shields.io/badge/rust-%23000000.svg?style=for-the-badge&logo=rust&logoColor=white)
 ![License](https://img.shields.io/badge/license-MIT-blue.svg)
+![Crates.io Version](https://img.shields.io/crates/v/quicommit)
+

 ## Features

@@ -16,8 +20,10 @@ A powerful AI-powered Git assistant for generating conventional commits, tags, a
 - **Profile Management**: Manage multiple Git identities with SSH keys and GPG signing support
 - **Smart Tagging**: Semantic version bumping with AI-generated release notes
 - **Changelog Generation**: Automatic changelog generation in Keep a Changelog format
- **Security**: Encrypt sensitive data
+- **Security**: Use system keyring to store API keys securely
 - **Interactive UI**: Beautiful CLI with previews and confirmations
+- **Multi-language Support**: Output in 7 languages (English, Chinese, Japanese, Korean, Spanish, French, German)
+- **Config Export/Import**: Backup and restore configuration with optional encryption

 ## Installation

@@ -159,30 +165,30 @@ quicommit profile token
 ```bash
 # Configure Ollama (local)
 quicommit config set-llm ollama
-quicommit config set-ollama --url http://localhost:11434 --model llama2
+quicommit config set-llm ollama --url http://localhost:11434 --model llama2

 # Configure OpenAI
 quicommit config set-llm openai
-quicommit config set-openai-key YOUR_API_KEY
+quicommit config set-api-key YOUR_API_KEY

 # Configure Anthropic Claude
 quicommit config set-llm anthropic
-quicommit config set-anthropic-key YOUR_API_KEY
+quicommit config set-api-key YOUR_API_KEY

 # Configure Kimi (Moonshot AI)
 quicommit config set-llm kimi
-quicommit config set-kimi-key YOUR_API_KEY
-quicommit config set-kimi --base-url https://api.moonshot.cn/v1 --model moonshot-v1-8k
+quicommit config set-api-key YOUR_API_KEY
+quicommit config set-llm kimi --base-url https://api.moonshot.cn/v1 --model moonshot-v1-8k

 # Configure DeepSeek
 quicommit config set-llm deepseek
-quicommit config set-deepseek-key YOUR_API_KEY
-quicommit config set-deepseek --base-url https://api.deepseek.com/v1 --model deepseek-chat
+quicommit config set-api-key YOUR_API_KEY
+quicommit config set-llm deepseek --base-url https://api.deepseek.com/v1 --model deepseek-chat

 # Configure OpenRouter
 quicommit config set-llm openrouter
-quicommit config set-openrouter-key YOUR_API_KEY
-quicommit config set-openrouter --base-url https://openrouter.ai/api/v1 --model openai/gpt-4
+quicommit config set-api-key YOUR_API_KEY
+quicommit config set-llm openrouter --base-url https://openrouter.ai/api/v1 --model openai/gpt-4

 # Set commit format
 quicommit config set-commit-format conventional
@@ -193,7 +199,7 @@ quicommit config set-version-prefix v
 # Set changelog path
 quicommit config set-changelog-path CHANGELOG.md

-# Set output language
+# Set output language (en, zh, ja, ko, es, fr, de)
 quicommit config set-language en

 # Set keep commit types in English
@@ -205,8 +211,22 @@ quicommit config set-keep-changelog-types-english true
 # Test LLM connection
 quicommit config test-llm

+# Check keyring availability
+quicommit config check-keyring
+
+# Show config file path
+quicommit config path
+
+# Export configuration (with optional encryption)
+quicommit config export -o config-backup.toml
+quicommit config export -o config-backup.enc --password
+
+# Import configuration
+quicommit config import -i config-backup.toml
+quicommit config import -i config-backup.enc --password
+
 # Reset configuration to defaults
-quicommit config reset
+quicommit config reset --force
 ```

 ## Command Reference
@@ -396,17 +416,31 @@ quicommit config set llm.provider ollama
 # Get configuration value
 quicommit config get llm.provider

+# Set API key (stored in system keyring)
+quicommit config set-api-key YOUR_API_KEY
+
+# Delete API key from keyring
+quicommit config delete-api-key
+
 # Test LLM connection
 quicommit config test-llm

 # List available models
 quicommit config list-models

-# Export configuration
+# Check keyring availability
+quicommit config check-keyring
+
+# Show config file path
+quicommit config path
+
+# Export configuration (with optional encryption)
 quicommit config export -o config-backup.toml
+quicommit config export -o config-backup.enc --password

 # Import configuration
 quicommit config import -i config-backup.toml
+quicommit config import -i config-backup.enc --password

 # Reset configuration
 quicommit config reset --force
--- a/examples/config.example.toml
+++ b/examples/config.example.toml
@@ -4,6 +4,13 @@
 # - macOS: ~/Library/Application Support/quicommit/config.toml
 # - Windows: %APPDATA%\quicommit\config.toml

+# ⚠️ IMPORTANT: Keyring Feature Update
+# QuiCommit now uses system keyring to store API keys securely.
+# This change may cause breaking changes to your existing configuration.
+# If you encounter issues after updating, please reset your configuration:
+#   quicommit config reset --force
+# Then reconfigure your settings using the CLI commands.
+
 # Configuration version (for migration)
 version = "1"

--- a/readme_zh.md
+++ b/readme_zh.md
@@ -6,8 +6,11 @@

 【目前还处在早期开发阶段，依然有一些功能未完善，欢迎反馈和贡献。】

+> ⚠️ **重要提示**：QuiCommit 现在使用系统密钥环（keyring）来安全存储 API 密钥。此更改可能会对现有配置造成破坏性变更。如果在更新后遇到问题，请运行 `quicommit config reset --force` 重置配置，然后重新配置您的设置。
+
 ![Rust](https://img.shields.io/badge/rust-%23000000.svg?style=for-the-badge&logo=rust&logoColor=white)
 ![License](https://img.shields.io/badge/license-MIT-blue.svg)
+![Crates.io Version](https://img.shields.io/crates/v/quicommit)

 ## 主要功能

@@ -16,8 +19,10 @@
 - **多配置管理**：为不同场景管理多个Git身份，支持SSH密钥和GPG签名配置
 - **智能标签管理**：基于语义版本自动检测升级，AI生成标签信息
 - **变更日志生成**：自动生成Keep a Changelog格式的变更日志
- **安全保护**：加密存储敏感数据
+- **安全保护**：使用系统密钥环进行安全存储
 - **交互式界面**：美观的CLI界面，支持预览和确认
+- **多语言支持**：支持7种语言输出（中文、英语、日语、韩语、西班牙语、法语、德语）
+- **配置导出导入**：备份和恢复配置，支持加密保护

 ## 安装

@@ -159,30 +164,30 @@ quicommit profile token
 ```bash
 # 配置Ollama（本地）
 quicommit config set-llm ollama
-quicommit config set-ollama --url http://localhost:11434 --model llama2
+quicommit config set-llm ollama --url http://localhost:11434 --model llama2

 # 配置OpenAI
 quicommit config set-llm openai
-quicommit config set-openai-key YOUR_API_KEY
+quicommit config set-api-key YOUR_API_KEY

 # 配置Anthropic Claude
 quicommit config set-llm anthropic
-quicommit config set-anthropic-key YOUR_API_KEY
+quicommit config set-api-key YOUR_API_KEY

 # 配置Kimi
 quicommit config set-llm kimi
-quicommit config set-kimi-key YOUR_API_KEY
-quicommit config set-kimi --base-url https://api.moonshot.cn/v1 --model moonshot-v1-8k
+quicommit config set-api-key YOUR_API_KEY
+quicommit config set-llm kimi --base-url https://api.moonshot.cn/v1 --model moonshot-v1-8k

 # 配置DeepSeek
 quicommit config set-llm deepseek
-quicommit config set-deepseek-key YOUR_API_KEY
-quicommit config set-deepseek --base-url https://api.deepseek.com/v1 --model deepseek-chat
+quicommit config set-api-key YOUR_API_KEY
+quicommit config set-llm deepseek --base-url https://api.deepseek.com/v1 --model deepseek-chat

 # 配置OpenRouter
 quicommit config set-llm openrouter
-quicommit config set-openrouter-key YOUR_API_KEY
-quicommit config set-openrouter --base-url https://openrouter.ai/api/v1 --model openai/gpt-4
+quicommit config set-api-key YOUR_API_KEY
+quicommit config set-llm openrouter --base-url https://openrouter.ai/api/v1 --model openai/gpt-4

 # 设置提交格式
 quicommit config set-commit-format conventional
@@ -193,7 +198,7 @@ quicommit config set-version-prefix v
 # 设置变更日志路径
 quicommit config set-changelog-path CHANGELOG.md

-# 设置输出语言
+# 设置输出语言（zh, en, ja, ko, es, fr, de）
 quicommit config set-language zh

 # 设置保持提交类型为英文
@@ -205,8 +210,22 @@ quicommit config set-keep-changelog-types-english true
 # 测试LLM连接
 quicommit config test-llm

+# 检查密钥环可用性
+quicommit config check-keyring
+
+# 显示配置文件路径
+quicommit config path
+
+# 导出配置（支持加密）
+quicommit config export -o config-backup.toml
+quicommit config export -o config-backup.enc --password
+
+# 导入配置
+quicommit config import -i config-backup.toml
+quicommit config import -i config-backup.enc --password
+
 # 重置配置为默认值
-quicommit config reset
+quicommit config reset --force
 ```

 ## 命令参考
@@ -396,17 +415,31 @@ quicommit config set llm.provider ollama
 # 获取配置值
 quicommit config get llm.provider

+# 设置API密钥（存储在系统密钥环中）
+quicommit config set-api-key YOUR_API_KEY
+
+# 从密钥环删除API密钥
+quicommit config delete-api-key
+
 # 测试LLM连接
 quicommit config test-llm

 # 列出可用模型
 quicommit config list-models

-# 导出配置
+# 检查密钥环可用性
+quicommit config check-keyring
+
+# 显示配置文件路径
+quicommit config path
+
+# 导出配置（支持加密）
 quicommit config export -o config-backup.toml
+quicommit config export -o config-backup.enc --password

 # 导入配置
 quicommit config import -i config-backup.toml
+quicommit config import -i config-backup.enc --password

 # 重置配置
 quicommit config reset --force
--- a/src/commands/changelog.rs
+++ b/src/commands/changelog.rs
@@ -162,8 +162,10 @@ impl ChangelogCommand {
        if output_path.exists() {
            let existing = std::fs::read_to_string(&output_path)?;
            let new_content = if existing.is_empty() {
-                format!("# Changelog\n\n{}", changelog)
-            } else {
+                format!("{}{}", CHANGELOG_HEADER, changelog)
+            } else if existing.starts_with(CHANGELOG_HEADER) {
+                format!("{}{}", CHANGELOG_HEADER, changelog)
+            } else if existing.starts_with("# Changelog") {
                let lines: Vec<&str> = existing.lines().collect();
                let mut header_end = 0;
                
@@ -181,10 +183,12 @@ impl ChangelogCommand {
                let rest = lines[header_end..].join("\n");
                
                format!("{}\n{}\n{}", header, changelog, rest)
+            } else {
+                format!("{}{}", CHANGELOG_HEADER, changelog)
            };
            std::fs::write(&output_path, new_content)?;
        } else {
-            let content = format!("# Changelog\n\n{}", changelog);
+            let content = format!("{}{}", CHANGELOG_HEADER, changelog);
            std::fs::write(&output_path, content)?;
        }

@@ -200,12 +204,11 @@ impl ChangelogCommand {
        messages: &Messages,
    ) -> Result<String> {
        let manager = ConfigManager::new()?;
-        let config = manager.config();
        let language = manager.get_language().unwrap_or(Language::English);

        println!("{}", messages.ai_generating_changelog());

-        let generator = ContentGenerator::new(&config.llm).await?;
+        let generator = ContentGenerator::new(&manager).await?;
        generator.generate_changelog_entry(version, commits, language).await
    }

--- a/src/commands/commit.rs
+++ b/src/commands/commit.rs
@@ -257,22 +257,17 @@ impl CommitCommand {

    async fn generate_commit(&self, repo: &GitRepo, format: CommitFormat, messages: &Messages) -> Result<String> {
        let manager = ConfigManager::new()?;
-        let config = manager.config();

-        // Check if LLM is configured
-        let generator = ContentGenerator::new(&config.llm).await
+        let generator = ContentGenerator::new(&manager).await
            .context("Failed to initialize LLM. Use --manual for manual commit.")?;

        println!("{}", messages.ai_analyzing());

-        let language_str = &config.language.output_language;
-        let language = Language::from_str(language_str).unwrap_or(Language::English);
+        let language = manager.get_language().unwrap_or(Language::English);

        let generated = if self.yes {
-            // Non-interactive mode: generate directly
            generator.generate_commit_from_repo(repo, format, language).await?
        } else {
-            // Interactive mode: allow user to review and regenerate
            generator.generate_commit_interactive(repo, format, language).await?
        };

@@ -378,26 +373,26 @@ impl CommitCommand {
    }
 }

-// Helper trait for optional builder methods
-trait CommitBuilderExt {
-    fn scope_opt(self, scope: Option<String>) -> Self;
-    fn body_opt(self, body: Option<String>) -> Self;
-}
+// // Helper trait for optional builder methods
+// trait CommitBuilderExt {
+//     fn scope_opt(self, scope: Option<String>) -> Self;
+//     fn body_opt(self, body: Option<String>) -> Self;
+// }

-impl CommitBuilderExt for CommitBuilder {
-    fn scope_opt(self, scope: Option<String>) -> Self {
-        if let Some(s) = scope {
-            self.scope(s)
-        } else {
-            self
-        }
-    }
+// impl CommitBuilderExt for CommitBuilder {
+//     fn scope_opt(self, scope: Option<String>) -> Self {
+//         if let Some(s) = scope {
+//             self.scope(s)
+//         } else {
+//             self
+//         }
+//     }

-    fn body_opt(self, body: Option<String>) -> Self {
-        if let Some(b) = body {
-            self.body(b)
-        } else {
-            self
-        }
-    }
-}
+//     fn body_opt(self, body: Option<String>) -> Self {
+//         if let Some(b) = body {
+//             self.body(b)
+//         } else {
+//             self
+//         }
+//     }
+// }
--- a/src/commands/config.rs
+++ b/src/commands/config.rs
--- a/src/commands/init.rs
+++ b/src/commands/init.rs
@@ -8,6 +8,7 @@ use crate::config::{GitProfile, Language};
 use crate::config::manager::ConfigManager;
 use crate::config::profile::{GpgConfig, SshConfig};
 use crate::i18n::Messages;
+use crate::utils::keyring::{get_supported_providers, get_default_model, provider_needs_api_key};
 use crate::utils::validators::validate_email;

 /// Initialize quicommit configuration
@@ -31,7 +32,6 @@ impl InitCommand {
            crate::config::AppConfig::default_path().unwrap()
        });
        
-        // Check if config already exists
        if config_path.exists() && !self.reset {
            if !self.yes {
                let overwrite = Confirm::new()
@@ -49,13 +49,11 @@ impl InitCommand {
            }
        }

-        // Create parent directory if needed
        if let Some(parent) = config_path.parent() {
            std::fs::create_dir_all(parent)
                .map_err(|e| anyhow::anyhow!("Failed to create config directory: {}", e))?;
        }

-        // Create new config manager with fresh config
        let mut manager = ConfigManager::with_path_fresh(&config_path)?;

        if self.yes {
@@ -66,7 +64,6 @@ impl InitCommand {

        manager.save()?;
        
-        // Get configured language for final messages
        let language = manager.get_language().unwrap_or(Language::English);
        let messages = Messages::new(language);
        
@@ -81,7 +78,6 @@ impl InitCommand {
    }

    async fn quick_setup(&self, manager: &mut ConfigManager) -> Result<()> {
-        // Try to get git user info
        let git_config = git2::Config::open_default()?;
        
        let user_name = git_config.get_string("user.name").unwrap_or_else(|_| "User".to_string());
@@ -96,7 +92,6 @@ impl InitCommand {
        manager.add_profile("default".to_string(), profile)?;
        manager.set_default_profile(Some("default".to_string()))?;

-        // Set default LLM to Ollama
        manager.set_llm_provider("ollama".to_string());

        Ok(())
@@ -106,7 +101,6 @@ impl InitCommand {
        let messages = Messages::new(Language::English);
        println!("\n{}", messages.setup_profile().bold());

-        // Language selection
        println!("\n{}", messages.select_output_language().bold());
        let languages = vec![
            Language::English,
@@ -126,16 +120,13 @@ impl InitCommand {
        let selected_language = languages[language_idx];
        manager.set_output_language(selected_language.to_code().to_string());

-        // Update messages to selected language
        let messages = Messages::new(selected_language);

-        // Profile name
        let profile_name: String = Input::new()
            .with_prompt(messages.profile_name())
            .default("personal".to_string())
            .interact_text()?;

-        // User info
        let git_config = git2::Config::open_default().ok();
        
        let default_name = git_config.as_ref()
@@ -177,7 +168,6 @@ impl InitCommand {
            None
        };

-        // SSH configuration
        let setup_ssh = Confirm::new()
            .with_prompt(messages.configure_ssh())
            .default(false)
@@ -189,7 +179,6 @@ impl InitCommand {
            None
        };

-        // GPG configuration
        let setup_gpg = Confirm::new()
            .with_prompt(messages.configure_gpg())
            .default(false)
@@ -201,7 +190,6 @@ impl InitCommand {
            None
        };

-        // Create profile
        let mut profile = GitProfile::new(
            profile_name.clone(),
            user_name,
@@ -220,9 +208,9 @@ impl InitCommand {
        manager.add_profile(profile_name.clone(), profile)?;
        manager.set_default_profile(Some(profile_name))?;

-        // LLM provider selection
        println!("\n{}", messages.select_llm_provider().bold());
-        let providers = vec![
+        
+        let provider_display_names = vec![
            "Ollama (local)",
            "OpenAI",
            "Anthropic Claude",
@@ -230,49 +218,90 @@ impl InitCommand {
            "DeepSeek",
            "OpenRouter"
        ];
+        
        let provider_idx = Select::new()
-            .items(&providers)
+            .items(&provider_display_names)
            .default(0)
            .interact()?;

-        let provider = match provider_idx {
-            0 => "ollama",
-            1 => "openai",
-            2 => "anthropic",
-            3 => "kimi",
-            4 => "deepseek",
-            5 => "openrouter",
-            _ => "ollama",
+        let providers = get_supported_providers();
+        let provider = providers[provider_idx].to_string();
+
+        let keyring = manager.keyring();
+        let keyring_available = keyring.is_available();
+        
+        if !keyring_available {
+            println!("\n{}", "⚠ Keyring is not available on this system.".yellow());
+            println!("{}", keyring.get_status_message().yellow());
+        }
+
+        let api_key = if provider_needs_api_key(&provider) {
+            let env_key = std::env::var("QUICOMMIT_API_KEY")
+                .or_else(|_| std::env::var(format!("QUICOMMIT_{}_API_KEY", provider.to_uppercase())))
+                .ok();
+            
+            if let Some(_key) = env_key {
+                println!("\n{} {}", "✓".green(), "Found API key in environment variable.".green());
+                None
+            } else if keyring_available {
+                let prompt = match provider.as_str() {
+                    "openai" => messages.openai_api_key(),
+                    "anthropic" => messages.anthropic_api_key(),
+                    "kimi" => messages.kimi_api_key(),
+                    "deepseek" => messages.deepseek_api_key(),
+                    "openrouter" => messages.openrouter_api_key(),
+                    _ => "API Key",
+                };
+                
+                let key: String = Input::new()
+                    .with_prompt(prompt)
+                    .interact_text()?;
+                Some(key)
+            } else {
+                println!("\n{}", "Please set the QUICOMMIT_API_KEY environment variable.".yellow());
+                None
+            }
+        } else {
+            None
        };

-        manager.set_llm_provider(provider.to_string());
+        let default_model = get_default_model(&provider);
+        let model: String = Input::new()
+            .with_prompt("Model name")
+            .default(default_model.to_string())
+            .interact_text()?;

-        // Configure API key if needed
-        if provider == "openai" {
-            let api_key: String = Input::new()
-                .with_prompt(messages.openai_api_key())
+        let base_url: Option<String> = if provider == "ollama" {
+            let url: String = Input::new()
+                .with_prompt("Ollama server URL")
+                .default("http://localhost:11434".to_string())
                .interact_text()?;
-            manager.set_openai_api_key(api_key);
-        } else if provider == "anthropic" {
-            let api_key: String = Input::new()
-                .with_prompt(messages.anthropic_api_key())
-                .interact_text()?;
-            manager.set_anthropic_api_key(api_key);
-        } else if provider == "kimi" {
-            let api_key: String = Input::new()
-                .with_prompt(messages.kimi_api_key())
-                .interact_text()?;
-            manager.set_kimi_api_key(api_key);
-        } else if provider == "deepseek" {
-            let api_key: String = Input::new()
-                .with_prompt(messages.deepseek_api_key())
-                .interact_text()?;
-            manager.set_deepseek_api_key(api_key);
-        } else if provider == "openrouter" {
-            let api_key: String = Input::new()
-                .with_prompt(messages.openrouter_api_key())
-                .interact_text()?;
-            manager.set_openrouter_api_key(api_key);
+            Some(url)
+        } else {
+            let use_custom_url = Confirm::new()
+                .with_prompt("Use custom API base URL?")
+                .default(false)
+                .interact()?;
+            
+            if use_custom_url {
+                let url: String = Input::new()
+                    .with_prompt("Base URL")
+                    .interact_text()?;
+                Some(url)
+            } else {
+                None
+            }
+        };
+
+        manager.set_llm_provider(provider.clone());
+        manager.set_llm_model(model);
+        manager.set_llm_base_url(base_url);
+
+        if let Some(key) = api_key {
+            if provider_needs_api_key(&provider) {
+                manager.set_api_key(&key)?;
+                println!("\n{} {}", "✓".green(), "API key stored securely in system keyring.".green());
+            }
        }

        Ok(())
--- a/src/commands/profile.rs
+++ b/src/commands/profile.rs
@@ -228,7 +228,7 @@ impl ProfileCommand {
            .interact()?;

        if setup_token {
-            self.setup_token_interactive(&mut profile).await?;
+            self.setup_token_interactive(&mut profile, &manager).await?;
        }

        manager.add_profile(name.clone(), profile)?;
@@ -269,10 +269,12 @@ impl ProfileCommand {
            return Ok(());
        }

+        manager.delete_all_pats_for_profile(name)?;
+        
        manager.remove_profile(name)?;
        manager.save()?;

-        println!("{} Profile '{}' removed", "✓".green(), name);
+        println!("{} Profile '{}' removed (including all stored tokens)", "✓".green(), name);

        Ok(())
    }
@@ -330,16 +332,171 @@ impl ProfileCommand {
    async fn show_profile(&self, name: Option<&str>, config_path: &Option<PathBuf>) -> Result<()> {
        let manager = self.get_manager(config_path)?;

-        let profile = if let Some(n) = name {
-            manager.get_profile(n)
-                .ok_or_else(|| anyhow::anyhow!("Profile '{}' not found", n))?
+        match find_repo(std::env::current_dir()?.as_path()) {
+            Ok(repo) => {
+                self.show_repo_status(&repo, &manager, name).await
+            }
+            Err(_) => {
+                self.show_global_status(&manager, name).await
+            }
+        }
+    }
+
+    async fn show_repo_status(&self, repo: &crate::git::GitRepo, manager: &ConfigManager, name: Option<&str>) -> Result<()> {
+        use crate::git::MergedUserConfig;
+
+        let merged_config = MergedUserConfig::from_repo(repo.inner())?;
+        let repo_path = repo.path().to_string_lossy().to_string();
+
+        println!("{}", "\n📁 Current Repository Status".bold());
+        println!("{}", "─".repeat(60));
+        println!("Repository: {}", repo_path.cyan());
+
+        println!("\n{}", "Git User Configuration (merged local/global):".bold());
+        println!("{}", "─".repeat(60));
+
+        self.print_config_entry("User name", &merged_config.name);
+        self.print_config_entry("User email", &merged_config.email);
+        self.print_config_entry("Signing key", &merged_config.signing_key);
+        self.print_config_entry("SSH command", &merged_config.ssh_command);
+        self.print_config_entry("Commit GPG sign", &merged_config.commit_gpgsign);
+        self.print_config_entry("Tag GPG sign", &merged_config.tag_gpgsign);
+
+        let user_name = merged_config.name.value.clone().unwrap_or_default();
+        let user_email = merged_config.email.value.clone().unwrap_or_default();
+        let signing_key = merged_config.signing_key.value.as_deref();
+
+        let matching_profile = manager.find_matching_profile(&user_name, &user_email, signing_key);
+        let repo_profile_name = manager.get_repo_profile_name(&repo_path);
+
+        println!("\n{}", "QuiCommit Profile Status:".bold());
+        println!("{}", "─".repeat(60));
+
+        match (&matching_profile, repo_profile_name) {
+            (Some(profile), Some(mapped_name)) => {
+                if profile.name == *mapped_name {
+                    println!("{} Profile '{}' is mapped to this repository", "✓".green(), profile.name.cyan());
+                    println!("  This repository's git config matches the saved profile.");
+                } else {
+                    println!("{} Profile '{}' matches current config", "✓".green(), profile.name.cyan());
+                    println!("  But repository is mapped to different profile: {}", mapped_name.yellow());
+                }
+            }
+            (Some(profile), None) => {
+                println!("{} Profile '{}' matches current config", "✓".green(), profile.name.cyan());
+                println!("  {} This repository is not mapped to any profile.", "ℹ".yellow());
+            }
+            (None, Some(mapped_name)) => {
+                println!("{} Repository is mapped to profile '{}'", "⚠".yellow(), mapped_name.cyan());
+                println!("  But current git config does not match this profile!");
+                
+                if let Some(mapped_profile) = manager.get_profile(mapped_name) {
+                    println!("\n  Mapped profile config:");
+                    println!("    user.name:  {}", mapped_profile.user_name);
+                    println!("    user.email: {}", mapped_profile.user_email);
+                }
+            }
+            (None, None) => {
+                println!("{} No matching profile found in QuiCommit", "✗".red());
+                println!("  Current git identity is not saved as a QuiCommit profile.");
+                
+                let partial_matches = manager.find_partial_matches(&user_name, &user_email);
+                if !partial_matches.is_empty() {
+                    println!("\n  {} Similar profiles exist:", "ℹ".yellow());
+                    for p in partial_matches {
+                        let same_name = p.user_name == user_name;
+                        let same_email = p.user_email == user_email;
+                        let reason = match (same_name, same_email) {
+                            (true, true) => "same name & email",
+                            (true, false) => "same name",
+                            (false, true) => "same email",
+                            (false, false) => "partial match",
+                        };
+                        println!("    - {} ({})", p.name.cyan(), reason.dimmed());
+                    }
+                }
+
+                if merged_config.is_complete() {
+                    println!("\n  {} Would you like to save this identity as a new profile?", "💡".yellow());
+                    let save = Confirm::new()
+                        .with_prompt("Save current git identity as new profile?")
+                        .default(true)
+                        .interact()?;
+
+                    if save {
+                        self.save_current_identity_as_profile(&merged_config, manager).await?;
+                    }
+                }
+            }
+        }
+
+        if let Some(profile_name) = name {
+            if let Some(profile) = manager.get_profile(profile_name) {
+                println!("\n{}", format!("Requested Profile: {}", profile_name).bold());
+                println!("{}", "─".repeat(60));
+                self.print_profile_details(profile);
+            } else {
+                println!("\n{} Profile '{}' not found", "✗".red(), profile_name);
+            }
+        } else if let Some(profile) = manager.default_profile() {
+            println!("\n{}", format!("Default Profile: {}", profile.name).bold());
+            println!("{}", "─".repeat(60));
+            self.print_profile_details(profile);
+        }
+
+        Ok(())
+    }
+
+    async fn show_global_status(&self, manager: &ConfigManager, name: Option<&str>) -> Result<()> {
+        println!("{}", "\n⚠ Not in a Git Repository".bold().yellow());
+        println!("{}", "─".repeat(60));
+        println!("Run this command inside a git repository to see local config status.");
+        println!();
+
+        if let Some(profile_name) = name {
+            if let Some(profile) = manager.get_profile(profile_name) {
+                println!("{}", format!("Profile: {}", profile_name).bold());
+                println!("{}", "─".repeat(40));
+                self.print_profile_details(profile);
+            } else {
+                bail!("Profile '{}' not found", profile_name);
+            }
+        } else if let Some(profile) = manager.default_profile() {
+            println!("{}", format!("Default Profile: {}", profile.name).bold());
+            println!("{}", "─".repeat(40));
+            self.print_profile_details(profile);
        } else {
-            manager.default_profile()
-                .ok_or_else(|| anyhow::anyhow!("No default profile set"))?
+            println!("{}", "No default profile set.".yellow());
+            println!("Run {} to create one.", "quicommit profile add".cyan());
+        }
+
+        Ok(())
+    }
+
+    fn print_config_entry(&self, label: &str, entry: &crate::git::ConfigEntry) {
+        use crate::git::ConfigSource;
+
+        let source_indicator = match entry.source {
+            ConfigSource::Local => format!("[{}]", "local".green()),
+            ConfigSource::Global => format!("[{}]", "global".blue()),
+            ConfigSource::NotSet => format!("[{}]", "not set".dimmed()),
        };

-        println!("{}", format!("\nProfile: {}", profile.name).bold());
-        println!("{}", "─".repeat(40));
+        match &entry.value {
+            Some(value) => {
+                println!("{} {}: {}", source_indicator, label, value);
+                if entry.local_value.is_some() && entry.global_value.is_some() {
+                    println!("    {} local: {}", "├".dimmed(), entry.local_value.as_ref().unwrap());
+                    println!("    {} global: {}", "└".dimmed(), entry.global_value.as_ref().unwrap());
+                }
+            }
+            None => {
+                println!("{} {}: {}", source_indicator, label, "<not set>".dimmed());
+            }
+        }
+    }
+
+    fn print_profile_details(&self, profile: &GitProfile) {
        println!("User name:  {}", profile.user_name);
        println!("User email: {}", profile.user_email);
        
@@ -384,6 +541,112 @@ impl ProfileCommand {
                println!("  Last used: {}", last_used);
            }
        }
+    }
+
+    async fn save_current_identity_as_profile(&self, merged_config: &crate::git::MergedUserConfig, manager: &ConfigManager) -> Result<()> {
+        let config_path = manager.path().to_path_buf();
+        let mut manager = ConfigManager::with_path(&config_path)?;
+
+        let user_name = merged_config.name.value.clone().unwrap_or_default();
+        let user_email = merged_config.email.value.clone().unwrap_or_default();
+
+        println!("\n{}", "Save New Profile".bold());
+        println!("{}", "─".repeat(40));
+
+        let default_name = user_name.to_lowercase().replace(' ', "-");
+        let profile_name: String = Input::new()
+            .with_prompt("Profile name")
+            .default(default_name)
+            .validate_with(|input: &String| {
+                validate_profile_name(input).map_err(|e| e.to_string())
+            })
+            .interact_text()?;
+
+        if manager.has_profile(&profile_name) {
+            let overwrite = Confirm::new()
+                .with_prompt(&format!("Profile '{}' already exists. Overwrite?", profile_name))
+                .default(false)
+                .interact()?;
+            if !overwrite {
+                println!("{}", "Cancelled.".yellow());
+                return Ok(());
+            }
+        }
+
+        let description: String = Input::new()
+            .with_prompt("Description (optional)")
+            .default(format!("Imported from existing git config"))
+            .allow_empty(true)
+            .interact_text()?;
+
+        let is_work = Confirm::new()
+            .with_prompt("Is this a work profile?")
+            .default(false)
+            .interact()?;
+
+        let organization = if is_work {
+            Some(Input::new()
+                .with_prompt("Organization")
+                .interact_text()?)
+        } else {
+            None
+        };
+
+        let mut profile = GitProfile::new(profile_name.clone(), user_name, user_email);
+        if !description.is_empty() {
+            profile.description = Some(description);
+        }
+        profile.is_work = is_work;
+        profile.organization = organization;
+
+        if let Some(ref key) = merged_config.signing_key.value {
+            profile.signing_key = Some(key.clone());
+            
+            let setup_gpg = Confirm::new()
+                .with_prompt("Configure GPG signing details?")
+                .default(true)
+                .interact()?;
+            
+            if setup_gpg {
+                profile.gpg = Some(self.setup_gpg_interactive().await?);
+            }
+        }
+
+        if merged_config.ssh_command.is_set() {
+            let setup_ssh = Confirm::new()
+                .with_prompt("Configure SSH key details?")
+                .default(false)
+                .interact()?;
+            
+            if setup_ssh {
+                profile.ssh = Some(self.setup_ssh_interactive().await?);
+            }
+        }
+
+        let setup_token = Confirm::new()
+            .with_prompt("Add a Personal Access Token?")
+            .default(false)
+            .interact()?;
+
+        if setup_token {
+            self.setup_token_interactive(&mut profile, &manager).await?;
+        }
+
+        manager.add_profile(profile_name.clone(), profile)?;
+        manager.save()?;
+
+        println!("{} Profile '{}' saved successfully", "✓".green(), profile_name.cyan());
+
+        let set_default = Confirm::new()
+            .with_prompt("Set as default profile?")
+            .default(true)
+            .interact()?;
+
+        if set_default {
+            manager.set_default_profile(Some(profile_name.clone()))?;
+            manager.save()?;
+            println!("{} Set '{}' as default profile", "✓".green(), profile_name.cyan());
+        }

        Ok(())
    }
@@ -578,6 +841,10 @@ impl ProfileCommand {
            bail!("Profile '{}' not found", profile_name);
        }

+        if !manager.keyring().is_available() {
+            bail!("Keyring is not available. Cannot store PAT securely. Please ensure your system keyring is accessible.");
+        }
+
        println!("{}", format!("\nAdd token to profile '{}'", profile_name).bold());
        println!("{}", "─".repeat(40));

@@ -605,15 +872,17 @@ impl ProfileCommand {
            .allow_empty(true)
            .interact_text()?;

-        let mut token = TokenConfig::new(token_value, token_type);
+        let mut token = TokenConfig::new(token_type);
        if !description.is_empty() {
            token.description = Some(description);
        }

+        manager.store_pat_for_profile(profile_name, service, &token_value)?;
+        
        manager.add_token_to_profile(profile_name, service.to_string(), token)?;
        manager.save()?;

-        println!("{} Token for '{}' added to profile '{}'", "✓".green(), service.cyan(), profile_name);
+        println!("{} Token for '{}' added to profile '{}' (stored securely in keyring)", "✓".green(), service.cyan(), profile_name);

        Ok(())
    }
@@ -638,7 +907,7 @@ impl ProfileCommand {
        manager.remove_token_from_profile(profile_name, service)?;
        manager.save()?;

-        println!("{} Token '{}' removed from profile '{}'", "✓".green(), service, profile_name);
+        println!("{} Token '{}' removed from profile '{}' (deleted from keyring)", "✓".green(), service, profile_name);

        Ok(())
    }
@@ -658,7 +927,14 @@ impl ProfileCommand {
        println!("{}", "─".repeat(40));

        for (service, token) in &profile.tokens {
-            println!("{} ({})", service.cyan().bold(), token.token_type);
+            let has_token = manager.has_pat_for_profile(profile_name, service);
+            let status = if has_token {
+                format!("[{}]", "stored".green())
+            } else {
+                format!("[{}]", "not stored".yellow())
+            };
+            
+            println!("{} {} ({})", service.cyan().bold(), status, token.token_type);
            if let Some(ref desc) = token.description {
                println!("  {}", desc);
            }
@@ -785,7 +1061,18 @@ impl ProfileCommand {
        })
    }

-    async fn setup_token_interactive(&self, profile: &mut GitProfile) -> Result<()> {
+    async fn setup_token_interactive(&self, profile: &mut GitProfile, manager: &ConfigManager) -> Result<()> {
+        if !manager.keyring().is_available() {
+            println!("{} Keyring is not available. Cannot store PAT securely.", "⚠".yellow());
+            let continue_anyway = Confirm::new()
+                .with_prompt("Continue without secure token storage?")
+                .default(false)
+                .interact()?;
+            if !continue_anyway {
+                return Ok(());
+            }
+        }
+
        let service: String = Input::new()
            .with_prompt("Service name (e.g., github, gitlab)")
            .interact_text()?;
@@ -794,7 +1081,13 @@ impl ProfileCommand {
            .with_prompt("Token value")
            .interact_text()?;

-        let token = TokenConfig::new(token_value, TokenType::Personal);
+        let token = TokenConfig::new(TokenType::Personal);
+        
+        if manager.keyring().is_available() {
+            manager.store_pat_for_profile(&profile.name, &service, &token_value)?;
+            println!("{} Token stored securely in keyring", "✓".green());
+        }
+        
        profile.add_token(service, token);

        Ok(())
--- a/src/commands/tag.rs
+++ b/src/commands/tag.rs
@@ -270,10 +270,8 @@ impl TagCommand {

    async fn generate_tag_message(&self, repo: &GitRepo, version: &str, messages: &Messages) -> Result<String> {
        let manager = ConfigManager::new()?;
-        let config = manager.config();
        let language = manager.get_language().unwrap_or(Language::English);

-        // Get commits since last tag
        let tags = repo.get_tags()?;
        let commits = if let Some(latest_tag) = tags.first() {
            repo.get_commits_between(&latest_tag.name, "HEAD")?
@@ -287,7 +285,7 @@ impl TagCommand {

        println!("{}", messages.ai_generating_tag(commits.len()));

-        let generator = ContentGenerator::new(&config.llm).await?;
+        let generator = ContentGenerator::new(&manager).await?;
        generator.generate_tag_message(version, &commits, language).await
    }

--- a/src/config/manager.rs
+++ b/src/config/manager.rs
@@ -1,6 +1,7 @@
 use super::{AppConfig, GitProfile, TokenConfig};
+use crate::utils::keyring::{KeyringManager, get_default_base_url, get_default_model, provider_needs_api_key};
 use anyhow::{bail, Context, Result};
-use std::collections::HashMap;
+// use std::collections::HashMap;
 use std::path::{Path, PathBuf};

 /// Configuration manager
@@ -8,6 +9,7 @@ pub struct ConfigManager {
    config: AppConfig,
    config_path: PathBuf,
    modified: bool,
+    keyring: KeyringManager,
 }

 impl ConfigManager {
@@ -28,6 +30,7 @@ impl ConfigManager {
            config,
            config_path: path.to_path_buf(),
            modified: false,
+            keyring: KeyringManager::new(),
        })
    }

@@ -37,6 +40,7 @@ impl ConfigManager {
            config: AppConfig::default(),
            config_path: path.to_path_buf(),
            modified: true,
+            keyring: KeyringManager::new(),
        })
    }

@@ -60,10 +64,10 @@ impl ConfigManager {
        Ok(())
    }

-    /// Force save configuration
-    pub fn force_save(&self) -> Result<()> {
-        self.config.save(&self.config_path)
-    }
+    // /// Force save configuration
+    // pub fn force_save(&self) -> Result<()> {
+    //     self.config.save(&self.config_path)
+    // }

    /// Get configuration file path
    pub fn path(&self) -> &Path {
@@ -114,11 +118,11 @@ impl ConfigManager {
        self.config.profiles.get(name)
    }

-    /// Get mutable profile
-    pub fn get_profile_mut(&mut self, name: &str) -> Option<&mut GitProfile> {
-        self.modified = true;
-        self.config.profiles.get_mut(name)
-    }
+    // /// Get mutable profile
+    // pub fn get_profile_mut(&mut self, name: &str) -> Option<&mut GitProfile> {
+    //     self.modified = true;
+    //     self.config.profiles.get_mut(name)
+    // }

    /// List all profile names
    pub fn list_profiles(&self) -> Vec<&String> {
@@ -166,54 +170,105 @@ impl ConfigManager {
        }
    }

-    /// Get profile usage statistics
-    pub fn get_profile_usage(&self, name: &str) -> Option<&super::UsageStats> {
-        self.config.profiles.get(name).map(|p| &p.usage)
-    }
+    // /// Get profile usage statistics
+    // pub fn get_profile_usage(&self, name: &str) -> Option<&super::UsageStats> {
+    //     self.config.profiles.get(name).map(|p| &p.usage)
+    // }

    // Token management

-    /// Add a token to a profile
+    /// Add a token to a profile (stores token in keyring)
    pub fn add_token_to_profile(&mut self, profile_name: &str, service: String, token: TokenConfig) -> Result<()> {
+        if !self.config.profiles.contains_key(profile_name) {
+            bail!("Profile '{}' does not exist", profile_name);
+        }
+        
        if let Some(profile) = self.config.profiles.get_mut(profile_name) {
            profile.add_token(service, token);
            self.modified = true;
-            Ok(())
+        }
+        
+        Ok(())
+    }
+
+    /// Store a PAT token in keyring for a profile
+    pub fn store_pat_for_profile(&self, profile_name: &str, service: &str, token_value: &str) -> Result<()> {
+        let profile = self.get_profile(profile_name)
+            .ok_or_else(|| anyhow::anyhow!("Profile '{}' not found", profile_name))?;
+        
+        let user_email = &profile.user_email;
+        
+        self.keyring.store_pat(profile_name, user_email, service, token_value)
+    }
+
+    /// Get a PAT token from keyring for a profile
+    pub fn get_pat_for_profile(&self, profile_name: &str, service: &str) -> Result<Option<String>> {
+        let profile = self.get_profile(profile_name)
+            .ok_or_else(|| anyhow::anyhow!("Profile '{}' not found", profile_name))?;
+        
+        let user_email = &profile.user_email;
+        
+        self.keyring.get_pat(profile_name, user_email, service)
+    }
+
+    /// Check if a PAT token exists for a profile
+    pub fn has_pat_for_profile(&self, profile_name: &str, service: &str) -> bool {
+        if let Some(profile) = self.get_profile(profile_name) {
+            let user_email = &profile.user_email;
+            self.keyring.has_pat(profile_name, user_email, service)
        } else {
-            bail!("Profile '{}' does not exist", profile_name);
+            false
        }
    }

-    /// Get a token from a profile
-    pub fn get_token_from_profile(&self, profile_name: &str, service: &str) -> Option<&TokenConfig> {
-        self.config.profiles.get(profile_name)?.get_token(service)
-    }
-
-    /// Remove a token from a profile
+    /// Remove a token from a profile (deletes from keyring)
    pub fn remove_token_from_profile(&mut self, profile_name: &str, service: &str) -> Result<()> {
+        if !self.config.profiles.contains_key(profile_name) {
+            bail!("Profile '{}' does not exist", profile_name);
+        }
+        
+        let user_email = self.config.profiles.get(profile_name).unwrap().user_email.clone();
+        let services: Vec<String> = self.config.profiles.get(profile_name).unwrap().tokens.keys().cloned().collect();
+        
+        if !services.contains(&service.to_string()) {
+            bail!("Token for service '{}' not found in profile '{}'", service, profile_name);
+        }
+        
+        self.keyring.delete_pat(profile_name, &user_email, service)?;
+        
        if let Some(profile) = self.config.profiles.get_mut(profile_name) {
            profile.remove_token(service);
            self.modified = true;
-            Ok(())
-        } else {
-            bail!("Profile '{}' does not exist", profile_name);
        }
+        
+        Ok(())
    }

-    /// List all tokens in a profile
-    pub fn list_profile_tokens(&self, profile_name: &str) -> Option<Vec<&String>> {
-        self.config.profiles.get(profile_name).map(|p| p.tokens.keys().collect())
+    /// Delete all PAT tokens for a profile (used when removing a profile)
+    pub fn delete_all_pats_for_profile(&self, profile_name: &str) -> Result<()> {
+        if let Some(profile) = self.get_profile(profile_name) {
+            let user_email = &profile.user_email;
+            let services: Vec<String> = profile.tokens.keys().cloned().collect();
+            
+            self.keyring.delete_all_pats_for_profile(profile_name, user_email, &services)?;
+        }
+        Ok(())
    }

+    // /// List all tokens in a profile
+    // pub fn list_profile_tokens(&self, profile_name: &str) -> Option<Vec<&String>> {
+    //     self.config.profiles.get(profile_name).map(|p| p.tokens.keys().collect())
+    // }
+
    // Repository profile management

-    /// Get profile for repository
-    pub fn get_repo_profile(&self, repo_path: &str) -> Option<&GitProfile> {
-        self.config
-            .repo_profiles
-            .get(repo_path)
-            .and_then(|name| self.config.profiles.get(name))
-    }
+    // /// Get profile for repository
+    // pub fn get_repo_profile(&self, repo_path: &str) -> Option<&GitProfile> {
+    //     self.config
+    //         .repo_profiles
+    //         .get(repo_path)
+    //         .and_then(|name| self.config.profiles.get(name))
+    // }

    /// Set profile for repository
    pub fn set_repo_profile(&mut self, repo_path: String, profile_name: String) -> Result<()> {
@@ -225,26 +280,26 @@ impl ConfigManager {
        Ok(())
    }

-    /// Remove repository profile mapping
-    pub fn remove_repo_profile(&mut self, repo_path: &str) {
-        self.config.repo_profiles.remove(repo_path);
-        self.modified = true;
-    }
+    // /// Remove repository profile mapping
+    // pub fn remove_repo_profile(&mut self, repo_path: &str) {
+    //     self.config.repo_profiles.remove(repo_path);
+    //     self.modified = true;
+    // }

-    /// List repository profile mappings
-    pub fn list_repo_profiles(&self) -> &HashMap<String, String> {
-        &self.config.repo_profiles
-    }
+    // /// List repository profile mappings
+    // pub fn list_repo_profiles(&self) -> &HashMap<String, String> {
+    //     &self.config.repo_profiles
+    // }

-    /// Get effective profile for a repository (repo-specific -> default)
-    pub fn get_effective_profile(&self, repo_path: Option<&str>) -> Option<&GitProfile> {
-        if let Some(path) = repo_path {
-            if let Some(profile) = self.get_repo_profile(path) {
-                return Some(profile);
-            }
-        }
-        self.default_profile()
-    }
+    // /// Get effective profile for a repository (repo-specific -> default)
+    // pub fn get_effective_profile(&self, repo_path: Option<&str>) -> Option<&GitProfile> {
+    //     if let Some(path) = repo_path {
+    //         if let Some(profile) = self.get_repo_profile(path) {
+    //             return Some(profile);
+    //         }
+    //     }
+    //     self.default_profile()
+    // }

    /// Check and compare profile with git configuration
    pub fn check_profile_config(&self, profile_name: &str, repo: &git2::Repository) -> Result<super::ProfileComparison> {
@@ -253,6 +308,37 @@ impl ConfigManager {
        profile.compare_with_git_config(repo)
    }

+    /// Find a profile that matches the given user config (name, email, signing_key)
+    pub fn find_matching_profile(&self, user_name: &str, user_email: &str, signing_key: Option<&str>) -> Option<&GitProfile> {
+        for profile in self.config.profiles.values() {
+            let name_match = profile.user_name == user_name;
+            let email_match = profile.user_email == user_email;
+            let key_match = match (signing_key, profile.signing_key()) {
+                (Some(git_key), Some(profile_key)) => git_key == profile_key,
+                (None, None) => true,
+                (Some(_), None) => false,
+                (None, Some(_)) => false,
+            };
+            
+            if name_match && email_match && key_match {
+                return Some(profile);
+            }
+        }
+        None
+    }
+
+    /// Find profiles that partially match (same name or same email)
+    pub fn find_partial_matches(&self, user_name: &str, user_email: &str) -> Vec<&GitProfile> {
+        self.config.profiles.values()
+            .filter(|p| p.user_name == user_name || p.user_email == user_email)
+            .collect()
+    }
+
+    /// Get repo profile mapping
+    pub fn get_repo_profile_name(&self, repo_path: &str) -> Option<&String> {
+        self.config.repo_profiles.get(repo_path)
+    }
+
    // LLM configuration

    /// Get LLM provider
@@ -262,104 +348,148 @@ impl ConfigManager {

    /// Set LLM provider
    pub fn set_llm_provider(&mut self, provider: String) {
-        self.config.llm.provider = provider;
+        let default_model = get_default_model(&provider);
+        self.config.llm.provider = provider.clone();
+        if self.config.llm.model.is_empty() || self.config.llm.model == "llama2" {
+            self.config.llm.model = default_model.to_string();
+        }
        self.modified = true;
    }

-    /// Get OpenAI API key
-    pub fn openai_api_key(&self) -> Option<&String> {
-        self.config.llm.openai.api_key.as_ref()
+    /// Get model
+    pub fn llm_model(&self) -> &str {
+        &self.config.llm.model
    }

-    /// Set OpenAI API key
-    pub fn set_openai_api_key(&mut self, key: String) {
-        self.config.llm.openai.api_key = Some(key);
+    /// Set model
+    pub fn set_llm_model(&mut self, model: String) {
+        self.config.llm.model = model;
        self.modified = true;
    }

-    /// Get Anthropic API key
-    pub fn anthropic_api_key(&self) -> Option<&String> {
-        self.config.llm.anthropic.api_key.as_ref()
+    /// Get base URL (returns provider default if not set)
+    pub fn llm_base_url(&self) -> String {
+        match &self.config.llm.base_url {
+            Some(url) => url.clone(),
+            None => get_default_base_url(&self.config.llm.provider).to_string(),
+        }
    }

-    /// Set Anthropic API key
-    pub fn set_anthropic_api_key(&mut self, key: String) {
-        self.config.llm.anthropic.api_key = Some(key);
+    /// Set base URL
+    pub fn set_llm_base_url(&mut self, url: Option<String>) {
+        self.config.llm.base_url = url;
        self.modified = true;
    }

-    /// Get Kimi API key
-    pub fn kimi_api_key(&self) -> Option<&String> {
-        self.config.llm.kimi.api_key.as_ref()
+    /// Get API key from configured storage method
+    pub fn get_api_key(&self) -> Option<String> {
+        // First try environment variables (always checked)
+        if let Some(key) = self.keyring.get_api_key(&self.config.llm.provider).unwrap_or(None) {
+            return Some(key);
+        }
+
+        // Then try config file if configured
+        if self.config.llm.api_key_storage == "config" {
+            return self.config.llm.api_key.clone();
+        }
+
+        None
    }

-    /// Set Kimi API key
-    pub fn set_kimi_api_key(&mut self, key: String) {
-        self.config.llm.kimi.api_key = Some(key);
-        self.modified = true;
+    /// Store API key in configured storage method
+    pub fn set_api_key(&self, api_key: &str) -> Result<()> {
+        match self.config.llm.api_key_storage.as_str() {
+            "keyring" => {
+                if !self.keyring.is_available() {
+                    bail!("Keyring is not available. Set QUICOMMIT_API_KEY environment variable instead or change api_key_storage to 'config'.");
+                }
+                self.keyring.store_api_key(&self.config.llm.provider, api_key)
+            },
+            "config" => {
+                // We can't modify self.config here since self is immutable
+                // This will be handled by the caller updating the config
+                Ok(())
+            },
+            "environment" => {
+                bail!("API key storage set to 'environment'. Please set QUICOMMIT_{}_API_KEY environment variable.", self.config.llm.provider.to_uppercase());
+            },
+            _ => {
+                bail!("Invalid API key storage method: {}", self.config.llm.api_key_storage);
+            }
+        }
    }

-    /// Get Kimi base URL
-    pub fn kimi_base_url(&self) -> &str {
-        &self.config.llm.kimi.base_url
+    /// Delete API key from configured storage method
+    pub fn delete_api_key(&self) -> Result<()> {
+        match self.config.llm.api_key_storage.as_str() {
+            "keyring" => {
+                if self.keyring.is_available() {
+                    self.keyring.delete_api_key(&self.config.llm.provider)?;
+                }
+            },
+            "config" => {
+                // We can't modify self.config here since self is immutable
+                // This will be handled by the caller updating the config
+            },
+            "environment" => {
+                // Environment variables are not managed by the app
+            },
+            _ => {
+                bail!("Invalid API key storage method: {}", self.config.llm.api_key_storage);
+            }
+        }
+        Ok(())
    }

-    /// Set Kimi base URL
-    pub fn set_kimi_base_url(&mut self, url: String) {
-        self.config.llm.kimi.base_url = url;
-        self.modified = true;
+    /// Check if API key is configured
+    pub fn has_api_key(&self) -> bool {
+        if !provider_needs_api_key(&self.config.llm.provider) {
+            return true;
+        }
+
+        // Check environment variables
+        if self.keyring.get_api_key(&self.config.llm.provider).unwrap_or(None).is_some() {
+            return true;
+        }
+
+        // Check config file if configured
+        if self.config.llm.api_key_storage == "config" {
+            return self.config.llm.api_key.is_some();
+        }
+
+        false
    }

-    /// Get DeepSeek API key
-    pub fn deepseek_api_key(&self) -> Option<&String> {
-        self.config.llm.deepseek.api_key.as_ref()
+    /// Get keyring manager reference
+    pub fn keyring(&self) -> &KeyringManager {
+        &self.keyring
    }

-    /// Set DeepSeek API key
-    pub fn set_deepseek_api_key(&mut self, key: String) {
-        self.config.llm.deepseek.api_key = Some(key);
-        self.modified = true;
-    }
+    // /// Configure LLM provider with all settings
+    // pub fn configure_llm(&mut self, provider: String, model: Option<String>, base_url: Option<String>, api_key: Option<&str>) -> Result<()> {
+    //     self.set_llm_provider(provider.clone());
        
-    /// Get DeepSeek base URL
-    pub fn deepseek_base_url(&self) -> &str {
-        &self.config.llm.deepseek.base_url
-    }
+    //     if let Some(m) = model {
+    //         self.set_llm_model(m);
+    //     }
        
-    /// Set DeepSeek base URL
-    pub fn set_deepseek_base_url(&mut self, url: String) {
-        self.config.llm.deepseek.base_url = url;
-        self.modified = true;
-    }
+    //     self.set_llm_base_url(base_url);
        
-    /// Get OpenRouter API key
-    pub fn openrouter_api_key(&self) -> Option<&String> {
-        self.config.llm.openrouter.api_key.as_ref()
-    }
+    //     if let Some(key) = api_key {
+    //         if provider_needs_api_key(&provider) {
+    //             self.set_api_key(key)?;
+    //         }
+    //     }
        
-    /// Set OpenRouter API key
-    pub fn set_openrouter_api_key(&mut self, key: String) {
-        self.config.llm.openrouter.api_key = Some(key);
-        self.modified = true;
-    }
-
-    /// Get OpenRouter base URL
-    pub fn openrouter_base_url(&self) -> &str {
-        &self.config.llm.openrouter.base_url
-    }
-
-    /// Set OpenRouter base URL
-    pub fn set_openrouter_base_url(&mut self, url: String) {
-        self.config.llm.openrouter.base_url = url;
-        self.modified = true;
-    }
+    //     Ok(())
+    // }

    // Commit configuration

-    /// Get commit format
-    pub fn commit_format(&self) -> super::CommitFormat {
-        self.config.commit.format
-    }
+    // /// Get commit format
+    // pub fn commit_format(&self) -> super::CommitFormat {
+    //     self.config.commit.format
+    // }

    /// Set commit format
    pub fn set_commit_format(&mut self, format: super::CommitFormat) {
@@ -367,10 +497,10 @@ impl ConfigManager {
        self.modified = true;
    }

-    /// Check if auto-generate is enabled
-    pub fn auto_generate_commits(&self) -> bool {
-        self.config.commit.auto_generate
-    }
+    // /// Check if auto-generate is enabled
+    // pub fn auto_generate_commits(&self) -> bool {
+    //     self.config.commit.auto_generate
+    // }

    /// Set auto-generate commits
    pub fn set_auto_generate_commits(&mut self, enabled: bool) {
@@ -380,10 +510,10 @@ impl ConfigManager {

    // Tag configuration

-    /// Get version prefix
-    pub fn version_prefix(&self) -> &str {
-        &self.config.tag.version_prefix
-    }
+    // /// Get version prefix
+    // pub fn version_prefix(&self) -> &str {
+    //     &self.config.tag.version_prefix
+    // }

    /// Set version prefix
    pub fn set_version_prefix(&mut self, prefix: String) {
@@ -393,10 +523,10 @@ impl ConfigManager {

    // Changelog configuration

-    /// Get changelog path
-    pub fn changelog_path(&self) -> &str {
-        &self.config.changelog.path
-    }
+    // /// Get changelog path
+    // pub fn changelog_path(&self) -> &str {
+    //     &self.config.changelog.path
+    // }

    /// Set changelog path
    pub fn set_changelog_path(&mut self, path: String) {
@@ -406,10 +536,10 @@ impl ConfigManager {

    // Language configuration

-    /// Get output language
-    pub fn output_language(&self) -> &str {
-        &self.config.language.output_language
-    }
+    // /// Get output language
+    // pub fn output_language(&self) -> &str {
+    //     &self.config.language.output_language
+    // }

    /// Set output language
    pub fn set_output_language(&mut self, language: String) {
@@ -471,6 +601,7 @@ impl Default for ConfigManager {
            config: AppConfig::default(),
            config_path: PathBuf::new(),
            modified: false,
+            keyring: KeyringManager::new(),
        }
    }
 }
--- a/src/config/mod.rs
+++ b/src/config/mod.rs
@@ -9,7 +9,7 @@ pub mod profile;

 pub use profile::{
    GitProfile, TokenConfig, TokenType,
-    UsageStats, ProfileComparison
+    ProfileComparison
 };

 /// Application configuration
@@ -80,37 +80,16 @@ impl Default for AppConfig {
 /// LLM configuration
 #[derive(Debug, Clone, Serialize, Deserialize)]
 pub struct LlmConfig {
-    /// Default LLM provider
+    /// Current LLM provider (ollama, openai, anthropic, kimi, deepseek, openrouter)
    #[serde(default = "default_llm_provider")]
    pub provider: String,

-    /// OpenAI configuration
-    #[serde(default)]
-    pub openai: OpenAiConfig,
+    /// Model to use (stored in config, not in keyring)
+    #[serde(default = "default_model")]
+    pub model: String,

-    /// Ollama configuration
-    #[serde(default)]
-    pub ollama: OllamaConfig,
-
-    /// Anthropic Claude configuration
-    #[serde(default)]
-    pub anthropic: AnthropicConfig,
-
-    /// Kimi (Moonshot AI) configuration
-    #[serde(default)]
-    pub kimi: KimiConfig,
-
-    /// DeepSeek configuration
-    #[serde(default)]
-    pub deepseek: DeepSeekConfig,
-
-    /// OpenRouter configuration
-    #[serde(default)]
-    pub openrouter: OpenRouterConfig,
-
-    /// Custom API configuration
-    #[serde(default)]
-    pub custom: Option<CustomLlmConfig>,
+    /// API base URL (optional, will use provider default if not set)
+    pub base_url: Option<String>,

    /// Maximum tokens for generation
    #[serde(default = "default_max_tokens")]
@@ -123,186 +102,35 @@ pub struct LlmConfig {
    /// Timeout in seconds
    #[serde(default = "default_timeout")]
    pub timeout: u64,
+
+    /// API key storage method (keyring, config, environment)
+    #[serde(default = "default_api_key_storage")]
+    pub api_key_storage: String,
+
+    /// API key (stored in config for fallback, encrypted if encrypt_sensitive is true)
+    #[serde(default)]
+    pub api_key: Option<String>,
+}
+
+fn default_api_key_storage() -> String {
+    "keyring".to_string()
 }

 impl Default for LlmConfig {
    fn default() -> Self {
        Self {
            provider: default_llm_provider(),
-            openai: OpenAiConfig::default(),
-            ollama: OllamaConfig::default(),
-            anthropic: AnthropicConfig::default(),
-            kimi: KimiConfig::default(),
-            deepseek: DeepSeekConfig::default(),
-            openrouter: OpenRouterConfig::default(),
-            custom: None,
+            model: default_model(),
+            base_url: None,
            max_tokens: default_max_tokens(),
            temperature: default_temperature(),
            timeout: default_timeout(),
-        }
-    }
-}
-
-/// OpenAI API configuration
-#[derive(Debug, Clone, Serialize, Deserialize)]
-pub struct OpenAiConfig {
-    /// API key
-    pub api_key: Option<String>,
-
-    /// Model to use
-    #[serde(default = "default_openai_model")]
-    pub model: String,
-
-    /// API base URL (for custom endpoints)
-    #[serde(default = "default_openai_base_url")]
-    pub base_url: String,
-}
-
-impl Default for OpenAiConfig {
-    fn default() -> Self {
-        Self {
+            api_key_storage: default_api_key_storage(),
            api_key: None,
-            model: default_openai_model(),
-            base_url: default_openai_base_url(),
        }
    }
 }

-/// Ollama configuration
-#[derive(Debug, Clone, Serialize, Deserialize)]
-pub struct OllamaConfig {
-    /// Ollama server URL
-    #[serde(default = "default_ollama_url")]
-    pub url: String,
-
-    /// Model to use
-    #[serde(default = "default_ollama_model")]
-    pub model: String,
-}
-
-impl Default for OllamaConfig {
-    fn default() -> Self {
-        Self {
-            url: default_ollama_url(),
-            model: default_ollama_model(),
-        }
-    }
-}
-
-/// Anthropic Claude configuration
-#[derive(Debug, Clone, Serialize, Deserialize)]
-pub struct AnthropicConfig {
-    /// API key
-    pub api_key: Option<String>,
-
-    /// Model to use
-    #[serde(default = "default_anthropic_model")]
-    pub model: String,
-}
-
-impl Default for AnthropicConfig {
-    fn default() -> Self {
-        Self {
-            api_key: None,
-            model: default_anthropic_model(),
-        }
-    }
-}
-
-/// Kimi (Moonshot AI) configuration
-#[derive(Debug, Clone, Serialize, Deserialize)]
-pub struct KimiConfig {
-    /// API key
-    pub api_key: Option<String>,
-
-    /// Model to use
-    #[serde(default = "default_kimi_model")]
-    pub model: String,
-
-    /// API base URL (for custom endpoints)
-    #[serde(default = "default_kimi_base_url")]
-    pub base_url: String,
-}
-
-impl Default for KimiConfig {
-    fn default() -> Self {
-        Self {
-            api_key: None,
-            model: default_kimi_model(),
-            base_url: default_kimi_base_url(),
-        }
-    }
-}
-
-/// DeepSeek configuration
-#[derive(Debug, Clone, Serialize, Deserialize)]
-pub struct DeepSeekConfig {
-    /// API key
-    pub api_key: Option<String>,
-
-    /// Model to use
-    #[serde(default = "default_deepseek_model")]
-    pub model: String,
-
-    /// API base URL (for custom endpoints)
-    #[serde(default = "default_deepseek_base_url")]
-    pub base_url: String,
-}
-
-impl Default for DeepSeekConfig {
-    fn default() -> Self {
-        Self {
-            api_key: None,
-            model: default_deepseek_model(),
-            base_url: default_deepseek_base_url(),
-        }
-    }
-}
-
-/// OpenRouter configuration
-#[derive(Debug, Clone, Serialize, Deserialize)]
-pub struct OpenRouterConfig {
-    /// API key
-    pub api_key: Option<String>,
-
-    /// Model to use
-    #[serde(default = "default_openrouter_model")]
-    pub model: String,
-
-    /// API base URL (for custom endpoints)
-    #[serde(default = "default_openrouter_base_url")]
-    pub base_url: String,
-}
-
-impl Default for OpenRouterConfig {
-    fn default() -> Self {
-        Self {
-            api_key: None,
-            model: default_openrouter_model(),
-            base_url: default_openrouter_base_url(),
-        }
-    }
-}
-
-/// Custom LLM API configuration
-#[derive(Debug, Clone, Serialize, Deserialize)]
-pub struct CustomLlmConfig {
-    /// API endpoint URL
-    pub url: String,
-
-    /// API key (optional)
-    pub api_key: Option<String>,
-
-    /// Model name
-    pub model: String,
-
-    /// Request format template (JSON)
-    pub request_template: String,
-
-    /// Response path to extract content (e.g., "choices.0.message.content")
-    pub response_path: String,
-}
-
 /// Commit configuration
 #[derive(Debug, Clone, Serialize, Deserialize)]
 pub struct CommitConfig {
@@ -592,6 +420,10 @@ fn default_llm_provider() -> String {
    "ollama".to_string()
 }

+fn default_model() -> String {
+    "llama2".to_string()
+}
+
 fn default_max_tokens() -> u32 {
    500
 }
@@ -604,50 +436,6 @@ fn default_timeout() -> u64 {
    30
 }

-fn default_openai_model() -> String {
-    "gpt-4".to_string()
-}
-
-fn default_openai_base_url() -> String {
-    "https://api.openai.com/v1".to_string()
-}
-
-fn default_ollama_url() -> String {
-    "http://localhost:11434".to_string()
-}
-
-fn default_ollama_model() -> String {
-    "llama2".to_string()
-}
-
-fn default_anthropic_model() -> String {
-    "claude-3-sonnet-20240229".to_string()
-}
-
-fn default_kimi_model() -> String {
-    "moonshot-v1-8k".to_string()
-}
-
-fn default_kimi_base_url() -> String {
-    "https://api.moonshot.cn/v1".to_string()
-}
-
-fn default_deepseek_model() -> String {
-    "deepseek-chat".to_string()
-}
-
-fn default_deepseek_base_url() -> String {
-    "https://api.deepseek.com/v1".to_string()
-}
-
-fn default_openrouter_model() -> String {
-    "openai/gpt-3.5-turbo".to_string()
-}
-
-fn default_openrouter_base_url() -> String {
-    "https://openrouter.ai/api/v1".to_string()
-}
-
 fn default_commit_format() -> CommitFormat {
    CommitFormat::Conventional
 }
@@ -717,18 +505,70 @@ impl AppConfig {
        Ok(config_dir.join("quicommit").join("config.toml"))
    }

-    /// Get profile for a repository
-    pub fn get_profile_for_repo(&self, repo_path: &str) -> Option<&GitProfile> {
-        let profile_name = self.repo_profiles.get(repo_path)?;
-        self.profiles.get(profile_name)
+    // /// Get profile for a repository
+    // pub fn get_profile_for_repo(&self, repo_path: &str) -> Option<&GitProfile> {
+    //     let profile_name = self.repo_profiles.get(repo_path)?;
+    //     self.profiles.get(profile_name)
+    // }
+
+    // /// Set profile for a repository
+    // pub fn set_profile_for_repo(&mut self, repo_path: String, profile_name: String) -> Result<()> {
+    //     if !self.profiles.contains_key(&profile_name) {
+    //         anyhow::bail!("Profile '{}' does not exist", profile_name);
+    //     }
+    //     self.repo_profiles.insert(repo_path, profile_name);
+    //     Ok(())
+    // }
+}
+
+/// Encrypted PAT data for export
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct EncryptedPat {
+    /// Profile name
+    pub profile_name: String,
+    /// Service name (e.g., github, gitlab)
+    pub service: String,
+    /// User email (for keyring lookup)
+    pub user_email: String,
+    /// Encrypted token value
+    pub encrypted_token: String,
+}
+
+/// Export data container with optional encrypted PATs
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct ExportData {
+    /// Configuration content (TOML string)
+    pub config: String,
+    /// Encrypted PATs (only present when exporting with encryption)
+    #[serde(default, skip_serializing_if = "Vec::is_empty")]
+    pub encrypted_pats: Vec<EncryptedPat>,
+    /// Export version for future compatibility
+    #[serde(default = "default_export_version")]
+    pub export_version: String,
+}
+
+fn default_export_version() -> String {
+    "1".to_string()
+}
+
+impl ExportData {
+    pub fn new(config: String) -> Self {
+        Self {
+            config,
+            encrypted_pats: Vec::new(),
+            export_version: default_export_version(),
+        }
    }

-    /// Set profile for a repository
-    pub fn set_profile_for_repo(&mut self, repo_path: String, profile_name: String) -> Result<()> {
-        if !self.profiles.contains_key(&profile_name) {
-            anyhow::bail!("Profile '{}' does not exist", profile_name);
+    pub fn with_encrypted_pats(config: String, pats: Vec<EncryptedPat>) -> Self {
+        Self {
+            config,
+            encrypted_pats: pats,
+            export_version: default_export_version(),
        }
-        self.repo_profiles.insert(repo_path, profile_name);
-        Ok(())
+    }
+
+    pub fn has_encrypted_pats(&self) -> bool {
+        !self.encrypted_pats.is_empty()
    }
 }
--- a/src/config/profile.rs
+++ b/src/config/profile.rs
@@ -423,10 +423,6 @@ impl GpgConfig {
 /// Token configuration for services (GitHub, GitLab, etc.)
 #[derive(Debug, Clone, Serialize, Deserialize)]
 pub struct TokenConfig {
-    /// Token value (encrypted)
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub token: Option<String>,
-
    /// Token type (personal, oauth, etc.)
    #[serde(default)]
    pub token_type: TokenType,
@@ -446,25 +442,41 @@ pub struct TokenConfig {
    /// Description
    #[serde(default)]
    pub description: Option<String>,
+
+    /// Indicates if a token is stored in keyring
+    #[serde(default)]
+    pub has_token: bool,
 }

 impl TokenConfig {
-    /// Create a new token config
-    pub fn new(token: String, token_type: TokenType) -> Self {
+    /// Create a new token config (token stored separately in keyring)
+    pub fn new(token_type: TokenType) -> Self {
        Self {
-            token: Some(token),
            token_type,
            scopes: vec![],
            expires_at: None,
            last_used: None,
            description: None,
+            has_token: true,
+        }
+    }
+
+    /// Create a new token config without token
+    pub fn without_token(token_type: TokenType) -> Self {
+        Self {
+            token_type,
+            scopes: vec![],
+            expires_at: None,
+            last_used: None,
+            description: None,
+            has_token: false,
        }
    }

    /// Validate token configuration
    pub fn validate(&self) -> Result<()> {
-        if self.token.is_none() && self.token_type != TokenType::None {
-            bail!("Token value is required for {:?}", self.token_type);
+        if !self.has_token && self.token_type != TokenType::None {
+            bail!("Token is required for {:?}", self.token_type);
        }
        Ok(())
    }
@@ -473,6 +485,11 @@ impl TokenConfig {
    pub fn record_usage(&mut self) {
        self.last_used = Some(chrono::Utc::now().to_rfc3339());
    }
+
+    /// Mark that a token is stored
+    pub fn set_has_token(&mut self, has_token: bool) {
+        self.has_token = has_token;
+    }
 }

 /// Token type
@@ -675,7 +692,7 @@ mod tests {

    #[test]
    fn test_token_config() {
-        let token = TokenConfig::new("test-token".to_string(), TokenType::Personal);
+        let token = TokenConfig::new(TokenType::Personal);
        assert!(token.validate().is_ok());
    }
 }
--- a/src/generator/mod.rs
+++ b/src/generator/mod.rs
@@ -1,4 +1,5 @@
-use crate::config::{CommitFormat, LlmConfig, Language};
+use crate::config::{CommitFormat, Language};
+use crate::config::manager::ConfigManager;
 use crate::git::{CommitInfo, GitRepo};
 use crate::llm::{GeneratedCommit, LlmClient};
 use anyhow::{Context, Result};
@@ -10,12 +11,11 @@ pub struct ContentGenerator {

 impl ContentGenerator {
    /// Create new content generator
-    pub async fn new(config: &LlmConfig) -> Result<Self> {
-        let llm_client = LlmClient::from_config(config).await?;
+    pub async fn new(manager: &ConfigManager) -> Result<Self> {
+        let llm_client = LlmClient::from_config(manager).await?;
        
-        // Check if provider is available
        if !llm_client.is_available().await {
-            anyhow::bail!("LLM provider '{}' is not available", config.provider);
+            anyhow::bail!("LLM provider '{}' is not available", manager.llm_provider());
        }
        
        Ok(Self { llm_client })
@@ -31,7 +31,8 @@ impl ContentGenerator {
        // Truncate diff if too long
        let max_diff_len = 4000;
        let truncated_diff = if diff.len() > max_diff_len {
-            format!("{}\n... (truncated)", &diff[..max_diff_len])
+            let boundary = diff.floor_char_boundary(max_diff_len);
+            format!("{}\n... (truncated)", &diff[..boundary])
        } else {
            diff.to_string()
        };
--- a/src/git/changelog.rs
+++ b/src/git/changelog.rs
@@ -5,6 +5,15 @@ use std::collections::HashMap;
 use std::fs;
 use std::path::Path;

+pub const CHANGELOG_HEADER: &str = r#"# Changelog
+
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+"#;
+
 /// Changelog generator
 pub struct ChangelogGenerator {
    format: ChangelogFormat,
@@ -109,9 +118,10 @@ impl ChangelogGenerator {
        };
        
        let new_content = if existing.is_empty() {
-            format!("# Changelog\n\n{}", entry)
-        } else {
-            // Find position after header
+            format!("{}{}", CHANGELOG_HEADER, entry)
+        } else if existing.starts_with(CHANGELOG_HEADER) {
+            format!("{}{}", CHANGELOG_HEADER, entry)
+        } else if existing.starts_with("# Changelog") {
            let lines: Vec<&str> = existing.lines().collect();
            let mut header_end = 0;
            
@@ -129,6 +139,8 @@ impl ChangelogGenerator {
            let rest = lines[header_end..].join("\n");
            
            format!("{}\n{}\n{}", header, entry, rest)
+        } else {
+            format!("{}{}", CHANGELOG_HEADER, entry)
        };
        
        fs::write(changelog_path, new_content)
@@ -378,16 +390,7 @@ pub fn init_changelog(path: &Path) -> Result<()> {
        anyhow::bail!("Changelog already exists at {:?}", path);
    }
    
-    let content = r#"# Changelog
-
-All notable changes to this project will be documented in this file.
-
-The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
-and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
-
-"#;
-    
-    fs::write(path, content)
+    fs::write(path, CHANGELOG_HEADER)
        .with_context(|| format!("Failed to create changelog: {:?}", path))?;
    
    Ok(())
--- a/src/git/mod.rs
+++ b/src/git/mod.rs
@@ -642,12 +642,16 @@ impl GitRepo {
                    name: name.to_string(),
                    target: oid.to_string(),
                    message: commit.message().unwrap_or("").to_string(),
+                    time: commit.time().seconds(),
                });
            }

            true
        })?;

+        // Sort tags by time (newest first)
+        tags.sort_by(|a, b| b.time.cmp(&a.time));
+
        Ok(tags)
    }

@@ -832,6 +836,7 @@ pub struct TagInfo {
    pub name: String,
    pub target: String,
    pub message: String,
+    pub time: i64,
 }

 /// Repository status summary
@@ -1037,6 +1042,102 @@ impl<'a> GitConfigHelper<'a> {
    }
 }

+/// Configuration source indicator
+#[derive(Debug, Clone, PartialEq)]
+pub enum ConfigSource {
+    Local,
+    Global,
+    NotSet,
+}
+
+impl std::fmt::Display for ConfigSource {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        match self {
+            ConfigSource::Local => write!(f, "local"),
+            ConfigSource::Global => write!(f, "global"),
+            ConfigSource::NotSet => write!(f, "not set"),
+        }
+    }
+}
+
+/// Single configuration entry with source information
+#[derive(Debug, Clone)]
+pub struct ConfigEntry {
+    pub value: Option<String>,
+    pub source: ConfigSource,
+    pub local_value: Option<String>,
+    pub global_value: Option<String>,
+}
+
+impl ConfigEntry {
+    pub fn new(local: Option<String>, global: Option<String>) -> Self {
+        let (value, source) = match (&local, &global) {
+            (Some(_), _) => (local.clone(), ConfigSource::Local),
+            (None, Some(_)) => (global.clone(), ConfigSource::Global),
+            (None, None) => (None, ConfigSource::NotSet),
+        };
+        Self {
+            value,
+            source,
+            local_value: local,
+            global_value: global,
+        }
+    }
+
+    pub fn is_set(&self) -> bool {
+        self.value.is_some()
+    }
+
+    pub fn is_local(&self) -> bool {
+        self.source == ConfigSource::Local
+    }
+
+    pub fn is_global(&self) -> bool {
+        self.source == ConfigSource::Global
+    }
+}
+
+/// Merged user configuration with local/global source tracking
+#[derive(Debug, Clone)]
+pub struct MergedUserConfig {
+    pub name: ConfigEntry,
+    pub email: ConfigEntry,
+    pub signing_key: ConfigEntry,
+    pub ssh_command: ConfigEntry,
+    pub commit_gpgsign: ConfigEntry,
+    pub tag_gpgsign: ConfigEntry,
+}
+
+impl MergedUserConfig {
+    pub fn from_repo(repo: &Repository) -> Result<Self> {
+        let local_config = repo.config().ok();
+        let global_config = git2::Config::open_default().ok();
+
+        let get_entry = |key: &str| -> ConfigEntry {
+            let local = local_config.as_ref().and_then(|c| c.get_string(key).ok());
+            let global = global_config.as_ref().and_then(|c| c.get_string(key).ok());
+            ConfigEntry::new(local, global)
+        };
+
+        Ok(Self {
+            name: get_entry("user.name"),
+            email: get_entry("user.email"),
+            signing_key: get_entry("user.signingkey"),
+            ssh_command: get_entry("core.sshCommand"),
+            commit_gpgsign: get_entry("commit.gpgsign"),
+            tag_gpgsign: get_entry("tag.gpgsign"),
+        })
+    }
+
+    pub fn is_complete(&self) -> bool {
+        self.name.is_set() && self.email.is_set()
+    }
+
+    pub fn has_local_overrides(&self) -> bool {
+        self.name.is_local() || self.email.is_local() || self.signing_key.is_local() || self.ssh_command.is_local()
+    }
+}
+
 /// User configuration for git
 #[derive(Debug, Clone)]
 pub struct UserConfig {
--- a/src/llm/mod.rs
+++ b/src/llm/mod.rs
@@ -57,48 +57,50 @@ impl Default for LlmClientConfig {
 }

 impl LlmClient {
-    /// Create LLM client from configuration
-    pub async fn from_config(config: &crate::config::LlmConfig) -> Result<Self> {
+    /// Create LLM client from configuration manager
+    pub async fn from_config(manager: &crate::config::manager::ConfigManager) -> Result<Self> {
+        let config = manager.config();
        let client_config = LlmClientConfig {
-            max_tokens: config.max_tokens,
-            temperature: config.temperature,
-            timeout: Duration::from_secs(config.timeout),
+            max_tokens: config.llm.max_tokens,
+            temperature: config.llm.temperature,
+            timeout: Duration::from_secs(config.llm.timeout),
        };

-        let provider: Box<dyn LlmProvider> = match config.provider.as_str() {
+        let provider = config.llm.provider.as_str();
+        let model = config.llm.model.as_str();
+        let base_url = manager.llm_base_url();
+        let api_key = manager.get_api_key();
+
+        let provider: Box<dyn LlmProvider> = match provider {
            "ollama" => {
-                Box::new(OllamaClient::new(&config.ollama.url, &config.ollama.model))
+                Box::new(OllamaClient::new(&base_url, model))
            }
            "openai" => {
-                let api_key = config.openai.api_key.as_ref()
+                let key = api_key.as_ref()
                    .ok_or_else(|| anyhow::anyhow!("OpenAI API key not configured"))?;
-                Box::new(OpenAiClient::new(
-                    &config.openai.base_url,
-                    api_key,
-                    &config.openai.model,
-                )?)
+                Box::new(OpenAiClient::new(&base_url, key, model)?)
            }
            "anthropic" => {
-                let api_key = config.anthropic.api_key.as_ref()
+                let key = api_key.as_ref()
                    .ok_or_else(|| anyhow::anyhow!("Anthropic API key not configured"))?;
-                Box::new(AnthropicClient::new(api_key, &config.anthropic.model)?)
+                Box::new(AnthropicClient::new(key, model)?)
            }
            "kimi" => {
-                let api_key = config.kimi.api_key.as_ref()
+                let key = api_key.as_ref()
                    .ok_or_else(|| anyhow::anyhow!("Kimi API key not configured"))?;
-                Box::new(KimiClient::with_base_url(api_key, &config.kimi.model, &config.kimi.base_url)?)
+                Box::new(KimiClient::with_base_url(key, model, &base_url)?)
            }
            "deepseek" => {
-                let api_key = config.deepseek.api_key.as_ref()
+                let key = api_key.as_ref()
                    .ok_or_else(|| anyhow::anyhow!("DeepSeek API key not configured"))?;
-                Box::new(DeepSeekClient::with_base_url(api_key, &config.deepseek.model, &config.deepseek.base_url)?)
+                Box::new(DeepSeekClient::with_base_url(key, model, &base_url)?)
            }
            "openrouter" => {
-                let api_key = config.openrouter.api_key.as_ref()
+                let key = api_key.as_ref()
                    .ok_or_else(|| anyhow::anyhow!("OpenRouter API key not configured"))?;
-                Box::new(OpenRouterClient::with_base_url(api_key, &config.openrouter.model, &config.openrouter.base_url)?)
+                Box::new(OpenRouterClient::with_base_url(key, model, &base_url)?)
            }
-            _ => bail!("Unknown LLM provider: {}", config.provider),
+            _ => bail!("Unknown LLM provider: {}", provider),
        };

        Ok(Self {
@@ -1012,3 +1014,10 @@ Gruppieren Sie Commits nach:

 Formatieren Sie in Markdown mit geeigneten Überschriften und Aufzählungspunkten.
 "#;
+
+/// Test LLM connection
+pub async fn test_connection(manager: &crate::config::manager::ConfigManager) -> Result<String> {
+    let client = LlmClient::from_config(manager).await?;
+    let response = client.provider.generate("Say 'Hello, World!'").await?;
+    Ok(response)
+}
--- a/src/utils/keyring.rs
+++ b/src/utils/keyring.rs
@@ -0,0 +1,297 @@
+use anyhow::{bail, Context, Result};
+use std::env;
+
+const SERVICE_NAME: &str = "quicommit";
+const ENV_API_KEY: &str = "QUICOMMIT_API_KEY";
+
+const PAT_SERVICE_PREFIX: &str = "quicommit/pat";
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum KeyringStatus {
+    Available,
+    Unavailable,
+}
+
+pub struct KeyringManager {
+    status: KeyringStatus,
+}
+
+impl KeyringManager {
+    pub fn new() -> Self {
+        let status = Self::check_keyring_availability();
+        Self { status }
+    }
+
+    pub fn check_keyring_availability() -> KeyringStatus {
+        #[cfg(target_os = "windows")]
+        {
+            KeyringStatus::Available
+        }
+        #[cfg(target_os = "macos")]
+        {
+            KeyringStatus::Available
+        }
+        #[cfg(target_os = "linux")]
+        {
+            Self::check_linux_keyring()
+        }
+        #[cfg(not(any(target_os = "windows", target_os = "macos", target_os = "linux")))]
+        {
+            KeyringStatus::Unavailable
+        }
+    }
+
+    #[cfg(target_os = "linux")]
+    fn check_linux_keyring() -> KeyringStatus {
+        use std::path::Path;
+
+        let has_dbus = Path::new("/usr/bin/dbus-daemon").exists()
+            || Path::new("/bin/dbus-daemon").exists()
+            || env::var("DBUS_SESSION_BUS_ADDRESS").is_ok();
+
+        let has_keyring = Path::new("/usr/bin/gnome-keyring-daemon").exists()
+            || Path::new("/usr/bin/gnome-keyring").exists()
+            || Path::new("/usr/bin/kwalletd5").exists()
+            || Path::new("/usr/bin/kwalletd6").exists()
+            || env::var("SECRET_SERVICE").is_ok();
+
+        if has_dbus && has_keyring {
+            KeyringStatus::Available
+        } else {
+            KeyringStatus::Unavailable
+        }
+    }
+
+    pub fn status(&self) -> KeyringStatus {
+        self.status
+    }
+
+    pub fn is_available(&self) -> bool {
+        self.status == KeyringStatus::Available
+    }
+
+    pub fn store_api_key(&self, provider: &str, api_key: &str) -> Result<()> {
+        if !self.is_available() {
+            bail!("Keyring is not available on this system");
+        }
+
+        let entry = keyring::Entry::new(SERVICE_NAME, provider)
+            .context("Failed to create keyring entry")?;
+
+        entry.set_password(api_key)
+            .context("Failed to store API key")?;
+
+        Ok(())
+    }
+
+    pub fn get_api_key(&self, provider: &str) -> Result<Option<String>> {
+        if let Ok(key) = env::var(ENV_API_KEY) {
+            if !key.is_empty() {
+                return Ok(Some(key));
+            }
+        }
+
+        if !self.is_available() {
+            return Ok(None);
+        }
+
+        let entry = keyring::Entry::new(SERVICE_NAME, provider)
+            .context("Failed to create keyring entry")?;
+
+        match entry.get_password() {
+            Ok(key) => Ok(Some(key)),
+            Err(keyring::Error::NoEntry) => Ok(None),
+            Err(e) => Err(e.into()),
+        }
+    }
+
+    pub fn delete_api_key(&self, provider: &str) -> Result<()> {
+        if !self.is_available() {
+            bail!("Keyring is not available on this system");
+        }
+
+        let entry = keyring::Entry::new(SERVICE_NAME, provider)
+            .context("Failed to create keyring entry")?;
+
+        entry.delete_credential()
+            .context("Failed to delete API key")?;
+
+        Ok(())
+    }
+
+    pub fn has_api_key(&self, provider: &str) -> bool {
+        self.get_api_key(provider).unwrap_or(None).is_some()
+    }
+
+    fn make_pat_service_name(profile_name: &str) -> String {
+        format!("{}/{}", PAT_SERVICE_PREFIX, profile_name)
+    }
+
+    pub fn store_pat(&self, profile_name: &str, user_email: &str, service: &str, token: &str) -> Result<()> {
+        if !self.is_available() {
+            bail!("Keyring is not available on this system");
+        }
+
+        let keyring_service = Self::make_pat_service_name(profile_name);
+        let keyring_user = format!("{}:{}", user_email, service);
+
+        let entry = keyring::Entry::new(&keyring_service, &keyring_user)
+            .context("Failed to create keyring entry for PAT")?;
+
+        entry.set_password(token)
+            .context("Failed to store PAT in keyring")?;
+
+        eprintln!("[DEBUG] PAT stored in keyring: service={}, user={}", keyring_service, keyring_user);
+
+        Ok(())
+    }
+
+    pub fn get_pat(&self, profile_name: &str, user_email: &str, service: &str) -> Result<Option<String>> {
+        if !self.is_available() {
+            return Ok(None);
+        }
+
+        let keyring_service = Self::make_pat_service_name(profile_name);
+        let keyring_user = format!("{}:{}", user_email, service);
+
+        let entry = keyring::Entry::new(&keyring_service, &keyring_user)
+            .context("Failed to create keyring entry for PAT")?;
+
+        match entry.get_password() {
+            Ok(token) => {
+                eprintln!("[DEBUG] PAT retrieved from keyring: service={}, user={}", keyring_service, keyring_user);
+                Ok(Some(token))
+            }
+            Err(keyring::Error::NoEntry) => {
+                eprintln!("[DEBUG] PAT not found in keyring: service={}, user={}", keyring_service, keyring_user);
+                Ok(None)
+            }
+            Err(e) => Err(e.into()),
+        }
+    }
+
+    pub fn delete_pat(&self, profile_name: &str, user_email: &str, service: &str) -> Result<()> {
+        if !self.is_available() {
+            bail!("Keyring is not available on this system");
+        }
+
+        let keyring_service = Self::make_pat_service_name(profile_name);
+        let keyring_user = format!("{}:{}", user_email, service);
+
+        let entry = keyring::Entry::new(&keyring_service, &keyring_user)
+            .context("Failed to create keyring entry for PAT")?;
+
+        entry.delete_credential()
+            .context("Failed to delete PAT from keyring")?;
+
+        eprintln!("[DEBUG] PAT deleted from keyring: service={}, user={}", keyring_service, keyring_user);
+
+        Ok(())
+    }
+
+    pub fn has_pat(&self, profile_name: &str, user_email: &str, service: &str) -> bool {
+        self.get_pat(profile_name, user_email, service).unwrap_or(None).is_some()
+    }
+
+    pub fn delete_all_pats_for_profile(&self, profile_name: &str, user_email: &str, services: &[String]) -> Result<()> {
+        for service in services {
+            if let Err(e) = self.delete_pat(profile_name, user_email, service) {
+                eprintln!("[DEBUG] Failed to delete PAT for service '{}': {}", service, e);
+            }
+        }
+        Ok(())
+    }
+
+    pub fn get_status_message(&self) -> String {
+        match self.status {
+            KeyringStatus::Available => {
+                #[cfg(target_os = "windows")]
+                {
+                    "Windows Credential Manager is available".to_string()
+                }
+                #[cfg(target_os = "macos")]
+                {
+                    "macOS Keychain is available".to_string()
+                }
+                #[cfg(target_os = "linux")]
+                {
+                    "Linux secret service is available".to_string()
+                }
+                #[cfg(not(any(target_os = "windows", target_os = "macos", target_os = "linux")))]
+                {
+                    "Keyring is available".to_string()
+                }
+            }
+            KeyringStatus::Unavailable => {
+                "Keyring is not available. Set QUICOMMIT_API_KEY environment variable.".to_string()
+            }
+        }
+    }
+}
+
+impl Default for KeyringManager {
+    fn default() -> Self {
+        Self::new()
+    }
+}
+
+pub fn get_default_base_url(provider: &str) -> &'static str {
+    match provider {
+        "openai" => "https://api.openai.com/v1",
+        "anthropic" => "https://api.anthropic.com/v1",
+        "kimi" => "https://api.moonshot.cn/v1",
+        "deepseek" => "https://api.deepseek.com/v1",
+        "openrouter" => "https://openrouter.ai/api/v1",
+        "ollama" => "http://localhost:11434",
+        _ => "",
+    }
+}
+
+pub fn get_default_model(provider: &str) -> &'static str {
+    match provider {
+        "openai" => "gpt-4",
+        "anthropic" => "claude-3-sonnet-20240229",
+        "kimi" => "moonshot-v1-8k",
+        "deepseek" => "deepseek-chat",
+        "openrouter" => "openai/gpt-3.5-turbo",
+        "ollama" => "llama2",
+        _ => "",
+    }
+}
+
+pub fn get_supported_providers() -> &'static [&'static str] {
+    &["ollama", "openai", "anthropic", "kimi", "deepseek", "openrouter"]
+}
+
+pub fn provider_needs_api_key(provider: &str) -> bool {
+    provider != "ollama"
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn test_get_default_base_url() {
+        assert_eq!(get_default_base_url("openai"), "https://api.openai.com/v1");
+        assert_eq!(get_default_base_url("anthropic"), "https://api.anthropic.com/v1");
+        assert_eq!(get_default_base_url("kimi"), "https://api.moonshot.cn/v1");
+        assert_eq!(get_default_base_url("deepseek"), "https://api.deepseek.com/v1");
+        assert_eq!(get_default_base_url("openrouter"), "https://openrouter.ai/api/v1");
+        assert_eq!(get_default_base_url("ollama"), "http://localhost:11434");
+    }
+
+    #[test]
+    fn test_get_default_model() {
+        assert_eq!(get_default_model("openai"), "gpt-4");
+        assert_eq!(get_default_model("anthropic"), "claude-3-sonnet-20240229");
+        assert_eq!(get_default_model("ollama"), "llama2");
+    }
+
+    #[test]
+    fn test_provider_needs_api_key() {
+        assert!(provider_needs_api_key("openai"));
+        assert!(provider_needs_api_key("anthropic"));
+        assert!(!provider_needs_api_key("ollama"));
+    }
+}
--- a/src/utils/mod.rs
+++ b/src/utils/mod.rs
@@ -1,6 +1,7 @@
 pub mod crypto;
 pub mod editor;
 pub mod formatter;
+pub mod keyring;
 pub mod validators;

 use anyhow::{Context, Result};
--- a/tests/config_export_import_tests.rs
+++ b/tests/config_export_import_tests.rs
@@ -0,0 +1,359 @@
+use assert_cmd::Command;
+use predicates::prelude::*;
+use std::fs;
+use std::path::PathBuf;
+use tempfile::TempDir;
+
+fn create_git_repo(dir: &PathBuf) -> std::process::Output {
+    std::process::Command::new("git")
+        .args(&["init"])
+        .current_dir(dir)
+        .output()
+        .expect("Failed to init git repo")
+}
+
+fn configure_git_user(dir: &PathBuf) {
+    std::process::Command::new("git")
+        .args(&["config", "user.name", "Test User"])
+        .current_dir(dir)
+        .output()
+        .expect("Failed to configure git user name");
+
+    std::process::Command::new("git")
+        .args(&["config", "user.email", "test@example.com"])
+        .current_dir(dir)
+        .output()
+        .expect("Failed to configure git user email");
+}
+
+fn setup_git_repo(dir: &PathBuf) {
+    create_git_repo(dir);
+    configure_git_user(dir);
+}
+
+fn init_quicommit(config_path: &PathBuf) {
+    let mut cmd = Command::cargo_bin("quicommit").unwrap();
+    cmd.args(&["init", "--yes", "--config", config_path.to_str().unwrap()]);
+    cmd.assert().success();
+}
+
+mod config_export {
+    use super::*;
+
+    #[test]
+    fn test_export_to_stdout() {
+        let temp_dir = TempDir::new().unwrap();
+        let config_path = temp_dir.path().join("config.toml");
+        init_quicommit(&config_path);
+
+        let mut cmd = Command::cargo_bin("quicommit").unwrap();
+        cmd.args(&["config", "export", "--config", config_path.to_str().unwrap()]);
+
+        cmd.assert()
+            .success()
+            .stdout(predicate::str::contains("version"))
+            .stdout(predicate::str::contains("[llm]"));
+    }
+
+    #[test]
+    fn test_export_to_file() {
+        let temp_dir = TempDir::new().unwrap();
+        let config_path = temp_dir.path().join("config.toml");
+        let export_path = temp_dir.path().join("exported.toml");
+        init_quicommit(&config_path);
+
+        let mut cmd = Command::cargo_bin("quicommit").unwrap();
+        cmd.args(&[
+            "config", "export",
+            "--config", config_path.to_str().unwrap(),
+            "--output", export_path.to_str().unwrap(),
+            "--password", ""
+        ]);
+
+        cmd.assert()
+            .success()
+            .stdout(predicate::str::contains("Configuration exported"));
+
+        assert!(export_path.exists(), "Export file should be created");
+        
+        let content = fs::read_to_string(&export_path).unwrap();
+        assert!(content.contains("version"), "Export should contain version");
+        assert!(content.contains("[llm]"), "Export should contain LLM config");
+    }
+
+    #[test]
+    fn test_export_encrypted() {
+        let temp_dir = TempDir::new().unwrap();
+        let config_path = temp_dir.path().join("config.toml");
+        let export_path = temp_dir.path().join("encrypted.toml");
+        init_quicommit(&config_path);
+
+        let mut cmd = Command::cargo_bin("quicommit").unwrap();
+        cmd.args(&[
+            "config", "export",
+            "--config", config_path.to_str().unwrap(),
+            "--output", export_path.to_str().unwrap(),
+            "--password", "test_password_123"
+        ]);
+
+        cmd.assert()
+            .success()
+            .stdout(predicate::str::contains("encrypted and exported"));
+
+        assert!(export_path.exists(), "Export file should be created");
+        
+        let content = fs::read_to_string(&export_path).unwrap();
+        assert!(content.starts_with("ENCRYPTED:"), "Encrypted file should start with ENCRYPTED:");
+        assert!(!content.contains("[llm]"), "Encrypted content should not be readable");
+    }
+}
+
+mod config_import {
+    use super::*;
+
+    #[test]
+    fn test_import_plain_config() {
+        let temp_dir = TempDir::new().unwrap();
+        let config_path = temp_dir.path().join("config.toml");
+        let import_path = temp_dir.path().join("import.toml");
+        
+        let plain_config = r#"
+version = "1"
+
+[llm]
+provider = "openai"
+model = "gpt-4"
+max_tokens = 1000
+temperature = 0.7
+timeout = 60
+api_key_storage = "keyring"
+
+[commit]
+format = "conventional"
+auto_generate = true
+allow_empty = false
+gpg_sign = false
+max_subject_length = 100
+require_scope = false
+require_body = false
+body_required_types = ["feat", "fix"]
+
+[tag]
+version_prefix = "v"
+auto_generate = true
+gpg_sign = false
+include_changelog = true
+
+[changelog]
+path = "CHANGELOG.md"
+auto_generate = true
+format = "keep-a-changelog"
+include_hashes = false
+include_authors = false
+group_by_type = true
+
+[theme]
+colors = true
+icons = true
+date_format = "%Y-%m-%d"
+
+[language]
+output_language = "en"
+keep_types_english = true
+keep_changelog_types_english = true
+"#;
+        fs::write(&import_path, plain_config).unwrap();
+
+        let mut cmd = Command::cargo_bin("quicommit").unwrap();
+        cmd.args(&[
+            "config", "import",
+            "--config", config_path.to_str().unwrap(),
+            "--file", import_path.to_str().unwrap()
+        ]);
+
+        cmd.assert()
+            .success()
+            .stdout(predicate::str::contains("Configuration imported"));
+
+        let mut cmd = Command::cargo_bin("quicommit").unwrap();
+        cmd.args(&["config", "get", "llm.provider", "--config", config_path.to_str().unwrap()]);
+        cmd.assert()
+            .success()
+            .stdout(predicate::str::contains("openai"));
+    }
+
+    #[test]
+    fn test_import_encrypted_config() {
+        let temp_dir = TempDir::new().unwrap();
+        let config_path1 = temp_dir.path().join("config1.toml");
+        let config_path2 = temp_dir.path().join("config2.toml");
+        let export_path = temp_dir.path().join("encrypted.toml");
+        
+        init_quicommit(&config_path1);
+
+        let mut cmd = Command::cargo_bin("quicommit").unwrap();
+        cmd.args(&[
+            "config", "set", "llm.provider", "anthropic",
+            "--config", config_path1.to_str().unwrap()
+        ]);
+        cmd.assert().success();
+
+        let mut cmd = Command::cargo_bin("quicommit").unwrap();
+        cmd.args(&[
+            "config", "export",
+            "--config", config_path1.to_str().unwrap(),
+            "--output", export_path.to_str().unwrap(),
+            "--password", "secure_password"
+        ]);
+        cmd.assert().success();
+
+        let mut cmd = Command::cargo_bin("quicommit").unwrap();
+        cmd.args(&[
+            "config", "import",
+            "--config", config_path2.to_str().unwrap(),
+            "--file", export_path.to_str().unwrap(),
+            "--password", "secure_password"
+        ]);
+        cmd.assert()
+            .success()
+            .stdout(predicate::str::contains("Configuration imported"));
+
+        let mut cmd = Command::cargo_bin("quicommit").unwrap();
+        cmd.args(&["config", "get", "llm.provider", "--config", config_path2.to_str().unwrap()]);
+        cmd.assert()
+            .success()
+            .stdout(predicate::str::contains("anthropic"));
+    }
+
+    #[test]
+    fn test_import_encrypted_wrong_password() {
+        let temp_dir = TempDir::new().unwrap();
+        let config_path = temp_dir.path().join("config.toml");
+        let export_path = temp_dir.path().join("encrypted.toml");
+        
+        init_quicommit(&config_path);
+
+        let mut cmd = Command::cargo_bin("quicommit").unwrap();
+        cmd.args(&[
+            "config", "export",
+            "--config", config_path.to_str().unwrap(),
+            "--output", export_path.to_str().unwrap(),
+            "--password", "correct_password"
+        ]);
+        cmd.assert().success();
+
+        let mut cmd = Command::cargo_bin("quicommit").unwrap();
+        cmd.args(&[
+            "config", "import",
+            "--config", config_path.to_str().unwrap(),
+            "--file", export_path.to_str().unwrap(),
+            "--password", "wrong_password"
+        ]);
+        cmd.assert()
+            .failure()
+            .stderr(predicate::str::contains("Failed to decrypt"));
+    }
+}
+
+mod config_export_import_roundtrip {
+    use super::*;
+
+    #[test]
+    fn test_roundtrip_plain() {
+        let temp_dir = TempDir::new().unwrap();
+        let config_path1 = temp_dir.path().join("config1.toml");
+        let config_path2 = temp_dir.path().join("config2.toml");
+        let export_path = temp_dir.path().join("export.toml");
+        
+        init_quicommit(&config_path1);
+
+        let mut cmd = Command::cargo_bin("quicommit").unwrap();
+        cmd.args(&[
+            "config", "set", "llm.model", "gpt-4-turbo",
+            "--config", config_path1.to_str().unwrap()
+        ]);
+        cmd.assert().success();
+
+        let mut cmd = Command::cargo_bin("quicommit").unwrap();
+        cmd.args(&[
+            "config", "export",
+            "--config", config_path1.to_str().unwrap(),
+            "--output", export_path.to_str().unwrap(),
+            "--password", ""
+        ]);
+        cmd.assert().success();
+
+        let mut cmd = Command::cargo_bin("quicommit").unwrap();
+        cmd.args(&[
+            "config", "import",
+            "--config", config_path2.to_str().unwrap(),
+            "--file", export_path.to_str().unwrap()
+        ]);
+        cmd.assert().success();
+
+        let mut cmd = Command::cargo_bin("quicommit").unwrap();
+        cmd.args(&["config", "get", "llm.model", "--config", config_path2.to_str().unwrap()]);
+        cmd.assert()
+            .success()
+            .stdout(predicate::str::contains("gpt-4-turbo"));
+    }
+
+    #[test]
+    fn test_roundtrip_encrypted() {
+        let temp_dir = TempDir::new().unwrap();
+        let config_path1 = temp_dir.path().join("config1.toml");
+        let config_path2 = temp_dir.path().join("config2.toml");
+        let export_path = temp_dir.path().join("encrypted.toml");
+        let password = "my_secure_password_123";
+        
+        init_quicommit(&config_path1);
+
+        let mut cmd = Command::cargo_bin("quicommit").unwrap();
+        cmd.args(&[
+            "config", "set", "llm.provider", "deepseek",
+            "--config", config_path1.to_str().unwrap()
+        ]);
+        cmd.assert().success();
+
+        let mut cmd = Command::cargo_bin("quicommit").unwrap();
+        cmd.args(&[
+            "config", "set", "llm.model", "deepseek-chat",
+            "--config", config_path1.to_str().unwrap()
+        ]);
+        cmd.assert().success();
+
+        let mut cmd = Command::cargo_bin("quicommit").unwrap();
+        cmd.args(&[
+            "config", "export",
+            "--config", config_path1.to_str().unwrap(),
+            "--output", export_path.to_str().unwrap(),
+            "--password", password
+        ]);
+        cmd.assert().success();
+
+        let exported_content = fs::read_to_string(&export_path).unwrap();
+        assert!(exported_content.starts_with("ENCRYPTED:"));
+        assert!(!exported_content.contains("deepseek"));
+
+        let mut cmd = Command::cargo_bin("quicommit").unwrap();
+        cmd.args(&[
+            "config", "import",
+            "--config", config_path2.to_str().unwrap(),
+            "--file", export_path.to_str().unwrap(),
+            "--password", password
+        ]);
+        cmd.assert().success();
+
+        let mut cmd = Command::cargo_bin("quicommit").unwrap();
+        cmd.args(&["config", "get", "llm.provider", "--config", config_path2.to_str().unwrap()]);
+        cmd.assert()
+            .success()
+            .stdout(predicate::str::contains("deepseek"));
+
+        let mut cmd = Command::cargo_bin("quicommit").unwrap();
+        cmd.args(&["config", "get", "llm.model", "--config", config_path2.to_str().unwrap()]);
+        cmd.assert()
+            .success()
+            .stdout(predicate::str::contains("deepseek-chat"));
+    }
+}
--- a/tests/integration_tests.rs
+++ b/tests/integration_tests.rs
@@ -47,6 +47,24 @@ fn create_commit(dir: &PathBuf, message: &str) {
        .expect("Failed to create commit");
 }

+fn setup_git_repo(dir: &PathBuf) {
+    create_git_repo(dir);
+    configure_git_user(dir);
+}
+
+fn setup_test_repo_with_file(dir: &PathBuf, file_name: &str, file_content: &str) {
+    setup_git_repo(dir);
+    create_test_file(dir, file_name, file_content);
+    stage_file(dir, file_name);
+}
+
+fn init_quicommit(dir: &PathBuf, config_path: &PathBuf) {
+    let mut cmd = Command::cargo_bin("quicommit").unwrap();
+    cmd.args(&["init", "--yes", "--config", config_path.to_str().unwrap()])
+        .current_dir(dir);
+    cmd.assert().success();
+}
+
 mod cli_basic {
    use super::*;

@@ -57,7 +75,10 @@ mod cli_basic {
        cmd.assert()
            .success()
            .stdout(predicate::str::contains("QuiCommit"))
-            .stdout(predicate::str::contains("AI-powered Git assistant"));
+            .stdout(predicate::str::contains("AI-powered Git assistant"))
+            .stdout(predicate::str::contains("Usage:"))
+            .stdout(predicate::str::contains("Commands:"))
+            .stdout(predicate::str::contains("Options:"));
    }

    #[test]
@@ -252,15 +273,10 @@ mod commit_command {
    fn test_commit_no_changes() {
        let temp_dir = TempDir::new().unwrap();
        let repo_path = temp_dir.path().to_path_buf();
-        create_git_repo(&repo_path);
-        configure_git_user(&repo_path);
+        setup_git_repo(&repo_path);

        let config_path = repo_path.join("config.toml");
-
-        let mut cmd = Command::cargo_bin("quicommit").unwrap();
-        cmd.args(&["init", "--yes", "--config", config_path.to_str().unwrap()])
-            .current_dir(&repo_path);
-        cmd.assert().success();
+        init_quicommit(&repo_path, &config_path);

        let mut cmd = Command::cargo_bin("quicommit").unwrap();
        cmd.args(&["commit", "--manual", "-m", "test: empty", "--dry-run", "--yes", "--config", config_path.to_str().unwrap()])
@@ -275,18 +291,10 @@ mod commit_command {
    fn test_commit_with_staged_changes() {
        let temp_dir = TempDir::new().unwrap();
        let repo_path = temp_dir.path().to_path_buf();
-        create_git_repo(&repo_path);
-        configure_git_user(&repo_path);
-
-        create_test_file(&repo_path, "test.txt", "Hello, World!");
-        stage_file(&repo_path, "test.txt");
+        setup_test_repo_with_file(&repo_path, "test.txt", "Hello, World!");

        let config_path = repo_path.join("config.toml");
-
-        let mut cmd = Command::cargo_bin("quicommit").unwrap();
-        cmd.args(&["init", "--yes", "--config", config_path.to_str().unwrap()])
-            .current_dir(&repo_path);
-        cmd.assert().success();
+        init_quicommit(&repo_path, &config_path);

        let mut cmd = Command::cargo_bin("quicommit").unwrap();
        cmd.args(&["commit", "--manual", "-m", "test: add test file", "--dry-run", "--yes", "--config", config_path.to_str().unwrap()])
@@ -301,18 +309,10 @@ mod commit_command {
    fn test_commit_date_mode() {
        let temp_dir = TempDir::new().unwrap();
        let repo_path = temp_dir.path().to_path_buf();
-        create_git_repo(&repo_path);
-        configure_git_user(&repo_path);
-
-        create_test_file(&repo_path, "daily.txt", "Daily update");
-        stage_file(&repo_path, "daily.txt");
+        setup_test_repo_with_file(&repo_path, "daily.txt", "Daily update");

        let config_path = repo_path.join("config.toml");
-
-        let mut cmd = Command::cargo_bin("quicommit").unwrap();
-        cmd.args(&["init", "--yes", "--config", config_path.to_str().unwrap()])
-            .current_dir(&repo_path);
-        cmd.assert().success();
+        init_quicommit(&repo_path, &config_path);

        let mut cmd = Command::cargo_bin("quicommit").unwrap();
        cmd.args(&["commit", "--date", "--dry-run", "--yes", "--config", config_path.to_str().unwrap()])
@@ -349,19 +349,14 @@ mod tag_command {
    fn test_tag_list_empty() {
        let temp_dir = TempDir::new().unwrap();
        let repo_path = temp_dir.path().to_path_buf();
-        create_git_repo(&repo_path);
-        configure_git_user(&repo_path);
+        setup_git_repo(&repo_path);

        create_test_file(&repo_path, "test.txt", "content");
        stage_file(&repo_path, "test.txt");
        create_commit(&repo_path, "feat: initial commit");

        let config_path = repo_path.join("config.toml");
-
-        let mut cmd = Command::cargo_bin("quicommit").unwrap();
-        cmd.args(&["init", "--yes", "--config", config_path.to_str().unwrap()])
-            .current_dir(&repo_path);
-        cmd.assert().success();
+        init_quicommit(&repo_path, &config_path);

        let mut cmd = Command::cargo_bin("quicommit").unwrap();
        cmd.args(&["tag", "--name", "v0.1.0", "--dry-run", "--yes", "--config", config_path.to_str().unwrap()])
@@ -380,16 +375,12 @@ mod changelog_command {
    fn test_changelog_init() {
        let temp_dir = TempDir::new().unwrap();
        let repo_path = temp_dir.path().to_path_buf();
-        create_git_repo(&repo_path);
-        configure_git_user(&repo_path);
+        setup_git_repo(&repo_path);

        let config_path = repo_path.join("config.toml");
        let changelog_path = repo_path.join("CHANGELOG.md");

-        let mut cmd = Command::cargo_bin("quicommit").unwrap();
-        cmd.args(&["init", "--yes", "--config", config_path.to_str().unwrap()])
-            .current_dir(&repo_path);
-        cmd.assert().success();
+        init_quicommit(&repo_path, &config_path);

        let mut cmd = Command::cargo_bin("quicommit").unwrap();
        cmd.args(&["changelog", "--init", "--output", changelog_path.to_str().unwrap(), "--config", config_path.to_str().unwrap()])
@@ -404,19 +395,14 @@ mod changelog_command {
    fn test_changelog_dry_run() {
        let temp_dir = TempDir::new().unwrap();
        let repo_path = temp_dir.path().to_path_buf();
-        create_git_repo(&repo_path);
-        configure_git_user(&repo_path);
+        setup_git_repo(&repo_path);

        create_test_file(&repo_path, "test.txt", "content");
        stage_file(&repo_path, "test.txt");
        create_commit(&repo_path, "feat: add feature");

        let config_path = repo_path.join("config.toml");
-
-        let mut cmd = Command::cargo_bin("quicommit").unwrap();
-        cmd.args(&["init", "--yes", "--config", config_path.to_str().unwrap()])
-            .current_dir(&repo_path);
-        cmd.assert().success();
+        init_quicommit(&repo_path, &config_path);

        let mut cmd = Command::cargo_bin("quicommit").unwrap();
        cmd.args(&["changelog", "--dry-run", "--yes", "--config", config_path.to_str().unwrap()])
@@ -532,18 +518,10 @@ mod validators {
    fn test_commit_message_validation() {
        let temp_dir = TempDir::new().unwrap();
        let repo_path = temp_dir.path().to_path_buf();
-        create_git_repo(&repo_path);
-        configure_git_user(&repo_path);
-
-        create_test_file(&repo_path, "test.txt", "content");
-        stage_file(&repo_path, "test.txt");
+        setup_test_repo_with_file(&repo_path, "test.txt", "content");

        let config_path = repo_path.join("config.toml");
-
-        let mut cmd = Command::cargo_bin("quicommit").unwrap();
-        cmd.args(&["init", "--yes", "--config", config_path.to_str().unwrap()])
-            .current_dir(&repo_path);
-        cmd.assert().success();
+        init_quicommit(&repo_path, &config_path);

        let mut cmd = Command::cargo_bin("quicommit").unwrap();
        cmd.args(&["commit", "--manual", "-m", "invalid commit message without type", "--dry-run", "--yes", "--config", config_path.to_str().unwrap()])
@@ -558,18 +536,10 @@ mod validators {
    fn test_valid_conventional_commit() {
        let temp_dir = TempDir::new().unwrap();
        let repo_path = temp_dir.path().to_path_buf();
-        create_git_repo(&repo_path);
-        configure_git_user(&repo_path);
-
-        create_test_file(&repo_path, "test.txt", "content");
-        stage_file(&repo_path, "test.txt");
+        setup_test_repo_with_file(&repo_path, "test.txt", "content");

        let config_path = repo_path.join("config.toml");
-
-        let mut cmd = Command::cargo_bin("quicommit").unwrap();
-        cmd.args(&["init", "--yes", "--config", config_path.to_str().unwrap()])
-            .current_dir(&repo_path);
-        cmd.assert().success();
+        init_quicommit(&repo_path, &config_path);

        let mut cmd = Command::cargo_bin("quicommit").unwrap();
        cmd.args(&["commit", "--manual", "-m", "feat: add new feature", "--dry-run", "--yes", "--config", config_path.to_str().unwrap()])
@@ -588,18 +558,10 @@ mod subcommands {
    fn test_commit_alias() {
        let temp_dir = TempDir::new().unwrap();
        let repo_path = temp_dir.path().to_path_buf();
-        create_git_repo(&repo_path);
-        configure_git_user(&repo_path);
-
-        create_test_file(&repo_path, "test.txt", "content");
-        stage_file(&repo_path, "test.txt");
+        setup_test_repo_with_file(&repo_path, "test.txt", "content");

        let config_path = repo_path.join("config.toml");
-
-        let mut cmd = Command::cargo_bin("quicommit").unwrap();
-        cmd.args(&["init", "--yes", "--config", config_path.to_str().unwrap()])
-            .current_dir(&repo_path);
-        cmd.assert().success();
+        init_quicommit(&repo_path, &config_path);

        let mut cmd = Command::cargo_bin("quicommit").unwrap();
        cmd.args(&["c", "--manual", "-m", "fix: test", "--dry-run", "--yes", "--config", config_path.to_str().unwrap()])
@@ -640,3 +602,59 @@ mod subcommands {
            .stdout(predicate::str::contains("default"));
    }
 }
+
+mod edge_cases {
+    use super::*;
+
+    #[test]
+    fn test_config_file_not_found() {
+        let temp_dir = TempDir::new().unwrap();
+        let non_existent_config = temp_dir.path().join("non_existent_config.toml");
+
+        let mut cmd = Command::cargo_bin("quicommit").unwrap();
+        cmd.args(&["config", "show", "--config", non_existent_config.to_str().unwrap()]);
+
+        cmd.assert()
+            .success()
+            .stdout(predicate::str::contains("QuiCommit Configuration"))
+            .stdout(predicate::str::contains("Default profile: (none)"))
+            .stdout(predicate::str::contains("Profiles: 0"));
+    }
+
+    #[test]
+    fn test_invalid_git_repo() {
+        let temp_dir = TempDir::new().unwrap();
+        let repo_path = temp_dir.path().to_path_buf();
+
+        let config_path = repo_path.join("config.toml");
+        let mut cmd = Command::cargo_bin("quicommit").unwrap();
+        cmd.args(&["init", "--yes", "--config", config_path.to_str().unwrap()]);
+        cmd.assert().success();
+
+        let mut cmd = Command::cargo_bin("quicommit").unwrap();
+        cmd.args(&["commit", "--dry-run", "--yes", "--config", config_path.to_str().unwrap()])
+            .current_dir(&repo_path);
+
+        cmd.assert()
+            .failure()
+            .stderr(predicate::str::contains("git").or(predicate::str::contains("repository")));
+    }
+
+    #[test]
+    fn test_empty_commit_message() {
+        let temp_dir = TempDir::new().unwrap();
+        let repo_path = temp_dir.path().to_path_buf();
+        setup_test_repo_with_file(&repo_path, "test.txt", "content");
+
+        let config_path = repo_path.join("config.toml");
+        init_quicommit(&repo_path, &config_path);
+
+        let mut cmd = Command::cargo_bin("quicommit").unwrap();
+        cmd.args(&["commit", "--manual", "-m", "", "--dry-run", "--yes", "--config", config_path.to_str().unwrap()])
+            .current_dir(&repo_path);
+
+        cmd.assert()
+            .failure()
+            .stderr(predicate::str::contains("Invalid conventional commit format"));
+    }
+}
Author	SHA1	Message	Date
SidneyZhang	68427c4a11	chore: 发布 v0.1.11 并更新文档	2026-03-23 18:07:11 +08:00
SidneyZhang	8dd9e85b77	feat(config): 在加密导出/导入中包含个人访问令牌	2026-03-23 17:59:23 +08:00
SidneyZhang	0c7d2ad518	refactor: 移除未使用的代码和注释掉的辅助函数	2026-03-20 18:05:33 +08:00
SidneyZhang	0289dd4684	chore: 升级版本至 0.1.10 并更新密钥环与加密相关描述	2026-03-19 16:34:45 +08:00
SidneyZhang	e2d43315e3	feat: 新增系统密钥环安全存储API密钥与自动生成变更日志功能	2026-03-12 18:05:38 +08:00
SidneyZhang	0e1c2c6350	chore: 移除测试 keyring 功能的临时文件	2026-03-12 17:45:05 +08:00
SidneyZhang	da85fc94b1	feat(keyring): 集成系统密钥环安全存储 API key	2026-03-12 17:42:41 +08:00
SidneyZhang	c66d782eab	chore: 更新版本号至 0.1.9 并补充 changelog	2026-03-06 16:31:46 +08:00
SidneyZhang	358b44ab81	fix(generator): 修复diff截断时的字符边界问题	2026-03-06 16:28:26 +08:00
SidneyZhang	5957d67bc3	feat(changelog): 使用统一的 CHANGELOG_HEADER 常量生成标准化头部	2026-02-28 15:29:07 +08:00
SidneyZhang	04410ea9e7	📝 docs(CHANGELOG.md)：更新变更日志以记录版本0.1.7的发布内容	2026-02-14 15:10:04 +08:00