chore(release): bump version to 0.5.0 and update changelog

- fix(get_tags): 使用 find_object+peel_to_commit 支持 annotated tag
- fix(changelog): insert_changelog_entry 替换覆盖逻辑，保留已有章节
- feat: parse_changelog_versions 按 semver 降序提取版本
- feat: sort_tags_by_semver 取代纯时间排序
- feat(tag --auto): 优先读 Cargo.toml/pyproject.toml，回退 commit 分析
- feat(changelog): 无 --from 时自动检测 changelog 最高已有版本
- refactor: TagInfo::version_name(), GitRepo::find_tag_by_version()

.gitignore

@@ -6,6 +6,7 @@ Cargo.lock
 
 # IDE
 .idea/
+.trae/
 .vscode/
 *.swp
 *.swo
@@ -23,3 +24,6 @@ test_output/
 config.toml
 .claude/
 CLAUDE.md
+**/agents/
+.scratch/
+CONTEXT.md

AGENTS.md

@@ -0,0 +1,81 @@
+# AGENTS.md
+
+Behavioral guidelines to reduce common LLM coding mistakes. Merge with project-specific instructions as needed.
+
+**Tradeoff:** These guidelines bias toward caution over speed. For trivial tasks, use judgment.
+
+**Important:** Use Chinese for information responses and thinking; use English for searching and querying.
+
+## 1. Think Before Coding
+
+**Don't assume. Don't hide confusion. Surface tradeoffs.**
+
+Before implementing:
+- State your assumptions explicitly. If uncertain, ask.
+- If multiple interpretations exist, present them - don't pick silently.
+- If a simpler approach exists, say so. Push back when warranted.
+- If something is unclear, stop. Name what's confusing. Ask.
+
+## 2. Simplicity First
+
+**Minimum code that solves the problem. Nothing speculative.**
+
+- No features beyond what was asked.
+- No abstractions for single-use code.
+- No "flexibility" or "configurability" that wasn't requested.
+- No error handling for impossible scenarios.
+- If you write 200 lines and it could be 50, rewrite it.
+
+Ask yourself: "Would a senior engineer say this is overcomplicated?" If yes, simplify.
+
+## 3. Surgical Changes
+
+**Touch only what you must. Clean up only your own mess.**
+
+When editing existing code:
+- Don't "improve" adjacent code, comments, or formatting.
+- Don't refactor things that aren't broken.
+- Match existing style, even if you'd do it differently.
+- If you notice unrelated dead code, mention it - don't delete it.
+
+When your changes create orphans:
+- Remove imports/variables/functions that YOUR changes made unused.
+- Don't remove pre-existing dead code unless asked.
+
+The test: Every changed line should trace directly to the user's request.
+
+## 4. Goal-Driven Execution
+
+**Define success criteria. Loop until verified.**
+
+Transform tasks into verifiable goals:
+- "Add validation" → "Write tests for invalid inputs, then make them pass"
+- "Fix the bug" → "Write a test that reproduces it, then make it pass"
+- "Refactor X" → "Ensure tests pass before and after"
+
+For multi-step tasks, state a brief plan:
+```
+1. [Step] → verify: [check]
+2. [Step] → verify: [check]
+3. [Step] → verify: [check]
+```
+
+Strong success criteria let you loop independently. Weak criteria ("make it work") require constant clarification.
+
+---
+
+**These guidelines are working if:** fewer unnecessary changes in diffs, fewer rewrites due to overcomplication, and clarifying questions come before implementation rather than after mistakes.
+
+## Agent skills
+
+### Issue tracker
+
+Issues and specs live as local markdown files under `.scratch/`. See `docs/agents/issue-tracker.md`.
+
+### Triage labels
+
+The five canonical triage roles use their default label strings. See `docs/agents/triage-labels.md`.
+
+### Domain docs
+
+Single-context repo with `CONTEXT.md` and `docs/adr/` at the root. See `docs/agents/domain.md`.

CHANGELOG.md

@@ -9,6 +9,46 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 暂无。
 
+## [0.5.0] - 2026-07-24
+
+### ✨ 新功能
+- `commit` 命令新增 `.gitignore` 文件过滤：自动暂存与 `--all` 模式下自动跳过被 `.gitignore` 规则匹配的文件，并清理索引中已被忽略的已跟踪文件，暂存完成后列出被移除的文件
+- `tag` 命令新增 `-A, --auto` 模式：优先从 `Cargo.toml`/`pyproject.toml` 读取项目版本，回退到基于 commit 的语义化升级分析（与 `--bump` 互斥）
+- `changelog` 命令在未指定 `--from` 时，自动检测现有 changelog 中最高版本对应的 tag 作为起始点
+- 新增 `parse_changelog_versions()`，按 semver 降序提取 changelog 中已有的版本
+- 新增 `sort_tags_by_semver()`，取代纯时间排序，按语义版本正确排序标签
+
+### 🐞 错误修复
+- 修复 `get_tags()` 对 annotated tag 的解析：改用 `find_object`+`peel_to_commit` 正确取得标签指向的 commit
+- 修复 `changelog` 写入时 `insert_changelog_entry` 覆盖已有章节的问题，现保留现有内容并按版本插入新条目
+
+### 📚 文档
+- 同步更新 README（中/英文）：补充 `--think`、`tag --auto` 选项说明，移除已废弃的 `--prepend` 参数，修正 `set-llm` 的 `--base-url` 选项名
+
+### 🔧 其他变更
+- 新增 `TagInfo::version_name()` 与 `GitRepo::find_tag_by_version()` 辅助方法
+- 新增 `tests/gitignore_tests.rs`，包含 7 个测试覆盖 `.gitignore` 过滤逻辑
+
+## [0.4.0] - 2026-07-16
+
+### ✨ 新功能
+- 新增 `quicommit credential get|store|erase` 子命令，实现标准 Git credential helper 协议（[gitcredentials](https://git-scm.com/docs/gitcredentials)），可与原生 `git` 命令无缝集成
+- 新增 `host_to_service()` 主机名映射，将 github.com、gitlab.com、bitbucket.org 等常见托管平台映射为规范化服务名
+- 新增 `get_pat_for_host()` 公共 API，支持从已保存的凭据中提取 PAT 用于登录验证
+- 凭据存储复用现有基于系统密钥环的 PAT 与用户绑定逻辑，按 profile 维度管理
+
+### 🐞 错误修复
+- 移除 `keyring.rs` 中的调试 `eprintln!` 输出，避免污染 credential helper 的 stderr
+
+### 📚 文档
+- README（中/英文）新增 credential 命令使用说明
+
+### 🔧 其他变更
+- 新增 `src/lib.rs` 库目标，支持从 `tests/` 目录导入内部模块进行测试
+- `src/main.rs` 重构为使用 `quicommit::` 库导入
+- credential 命令及其子命令均使用 `#[command(hide = true)]` 隐藏，不在 `--help` 中显示
+- 新增 `tests/credential_tests.rs`，包含 52 个测试用例覆盖协议解析、帮助可见性、完整存取周期及边界场景
+
 ## [0.3.1] - 2026-06-01
 
 ### ✨ 新功能

Cargo.toml

@@ -1,9 +1,9 @@
 [package]
 name = "quicommit"
-version = "0.3.1"
+version = "0.5.0"
 edition = "2024"
 authors = ["Sidney Zhang <zly@lyzhang.me>"]
-description = "A powerful Git assistant tool with AI-powered commit/tag/changelog generation(alpha version)"
+description = "A powerful Git assistant tool with AI-powered commit/tag/changelog generation"
 license = "MIT"
 repository = "https://git.lyz.one/SidneyZhang/QuiCommit"
 keywords = ["git", "commit", "ai", "cli", "automation"]

RAODMAP.md

@@ -29,23 +29,17 @@
 
 将 Git 凭证管理集成到 QuiCommit 中，统一管理 HTTPS 仓库的身份认证。
 
-- [ ] **Git Credential Helper 集成**
+- [x] **Git Credential Helper 集成**
   - 实现 `git credential-store` / `git-credential-libsecret` 等标准的 credential helper 协议
   - 支持 `quicommit credential get|store|erase` 子命令
   - 与系统密钥环无缝对接，复用已有的 `KeyringManager`
 
-- [ ] **凭证管理 CLI**
-  - `quicommit credential list` — 列出所有已存储的凭证
-  - `quicommit credential add` — 手动添加凭证（用户名 + 密码/Token）
-  - `quicommit credential remove` — 删除指定凭证
-  - `quicommit credential status` — 查看凭证管理状态
-
-- [ ] **跨平台支持**
+- [x] **跨平台支持**
   - Windows：集成 Windows Credential Manager
   - macOS：集成 Keychain
   - Linux：通过 Secret Service / D-Bus 对接 GNOME Keyring / KWallet
 
-- [ ] **安全增强**
+- [x] **安全增强**
   - 支持 PAT（Personal Access Token）按 scope / 有效期管理
   - 支持凭证过期检查和自动提醒
 
@@ -88,10 +82,10 @@
 
 提升 AI 生成提交信息、标签说明和变更日志时的用户体验。
 
-- [x] **流式输出与实时反馈**
-  - 支持 SSE（Server-Sent Events）流式生成
-  - 终端打字机效果实时显示生成内容
-  - 流式生成过程中支持 `Ctrl+C` 中断
+- [ ] **流式输出与实时反馈**
+  - [x] 支持 SSE（Server-Sent Events）流式生成
+  - [ ]终端打字机效果实时显示生成内容
+  - [ ]流式生成过程中支持 `Ctrl+C` 中断
 
 - [ ] **生成质量提升**
   - 基于 commitlint 规则的后校验与自动修正

README.md

@@ -63,7 +63,7 @@ quicommit commit
 # Manual commit
 quicommit commit --manual -t feat -m "add new feature"
 
-# Stage all and commit
+# Stage all and commit (skips .gitignore-matched files automatically)
 quicommit commit -a
 
 # Skip confirmation
@@ -72,16 +72,24 @@ quicommit commit --yes
 # Use date-based commit message
 quicommit commit --date
 
+# Enable LLM thinking/reasoning mode for this commit
+quicommit commit --think
+
 # Push after committing
 quicommit commit --push
 ```
 
+When staging changes (auto-stage or `--all`), files matched by `.gitignore` rules are skipped and any ignored files already in the index are removed; the skipped list is printed for review.
+
 ### Create Tag
 
 ```bash
 # Auto-detect version bump
 quicommit tag
 
+# Auto-detect version from Cargo.toml/pyproject.toml, fall back to commit analysis
+quicommit tag --auto
+
 # Specify bump type
 quicommit tag --bump minor
 
@@ -98,11 +106,14 @@ quicommit tag --push
 ### Generate Changelog
 
 ```bash
-# Generate for unreleased changes
+# Generate for unreleased changes (auto-detects --from from the highest version in the existing changelog)
 quicommit changelog
 
 # Generate for specific version
-quicommit changelog -v 1.0.0
+quicommit changelog --version 1.0.0
+
+# Generate from a specific tag
+quicommit changelog --from v0.9.0
 
 # AI-generate changelog
 quicommit changelog --generate
@@ -160,12 +171,69 @@ quicommit profile stats
 quicommit profile token
 ```
 
+### Git Credential Helper
+
+QuiCommit can act as a Git credential helper to securely store and retrieve
+Personal Access Tokens (PATs) via the system keyring. The `credential` command
+is hidden from `--help` because it is invoked automatically by Git, not by end
+users.
+
+#### Setup
+
+Register QuiCommit as a credential helper for Git:
+
+```bash
+# Use the default QuiCommit config
+git config --global credential.helper quicommit
+
+# Or specify a custom config file
+git config --global credential.helper "quicommit --config /path/to/config.toml"
+```
+
+You can also limit the helper to a specific host:
+
+```bash
+git config --global credential.https://github.com.helper quicommit
+```
+
+#### How It Works
+
+When Git needs credentials (e.g. pushing to a remote), it calls the helper
+following the [gitcredentials protocol](https://git-scm.com/docs/gitcredentials):
+
+1. **`get`** — Git asks QuiCommit for a stored PAT matching the requested host.
+   QuiCommit searches all configured profiles in the keyring and returns the
+   PAT (plus username) if found.
+2. **`store`** — After a successful authentication (e.g. you entered a PAT in
+   the Git prompt), Git asks QuiCommit to save it. The PAT is stored in the
+   system keyring, bound to the matching profile.
+3. **`erase`** — Git asks QuiCommit to delete a stored PAT for the given host.
+
+Host names are mapped to canonical service names (`github.com` → `github`,
+`gitlab.com` → `gitlab`, `bitbucket.org` → `bitbucket`, etc.). Unknown hosts
+are used as-is.
+
+#### Removing Stored Credentials
+
+To remove a stored PAT, you can either use Git's built-in mechanism:
+
+```bash
+echo "protocol=https
+host=github.com" | git credential reject
+```
+
+Or remove it via the profile token management command:
+
+```bash
+quicommit profile token
+```
+
 ### Configure LLM
 
 ```bash
 # Configure Ollama (local)
 quicommit config set-llm ollama
-quicommit config set-llm ollama --url http://localhost:11434 --model llama2
+quicommit config set-llm ollama --base-url http://localhost:11434 --model llama2
 
 # Configure OpenAI
 quicommit config set-llm openai
@@ -239,6 +307,7 @@ quicommit config reset --force
 | `quicommit changelog` | `cl` | Generate changelog |
 | `quicommit profile` | `p` | Manage Git profiles |
 | `quicommit config` | `cfg` | Manage settings |
+| `quicommit credential` | — | Git credential helper (hidden, invoked by Git) |
 
 ### Commit Options
 
@@ -251,13 +320,14 @@ quicommit config reset --force
 | `-b, --breaking` | Mark as breaking change |
 | `-d, --date` | Use date-based commit message |
 | `--manual` | Manual input, skip AI |
-| `-a, --all` | Stage all changes |
+| `-a, --all` | Stage all changes (skips `.gitignore`-matched files) |
 | `-S, --sign` | GPG sign commit |
 | `--amend` | Amend previous commit |
 | `--dry-run` | Show without committing |
 | `--conventional` | Use Conventional Commits format |
 | `--commitlint` | Use commitlint format |
 | `--no-verify` | Skip commit message verification |
+| `-t, --think` | Enable LLM thinking/reasoning mode (overrides config) |
 | `-y, --yes` | Skip confirmation |
 | `--push` | Push after committing |
 | `--remote` | Specify remote repository (default: origin) |
@@ -268,6 +338,7 @@ quicommit config reset --force
 |--------|-------------|
 | `-n, --name` | Tag name |
 | `-b, --bump` | Version bump (major/minor/patch) |
+| `-A, --auto` | Auto-detect version from Cargo.toml/pyproject.toml, fall back to commit analysis (conflicts with `--bump`) |
 | `-m, --message` | Tag message |
 | `-g, --generate` | AI-generate message |
 | `-S, --sign` | GPG sign tag |
@@ -276,6 +347,7 @@ quicommit config reset --force
 | `-p, --push` | Push to remote |
 | `-r, --remote` | Specify remote repository (default: origin) |
 | `--dry-run` | Dry run |
+| `-t, --think` | Enable LLM thinking/reasoning mode (overrides config) |
 | `-y, --yes` | Skip confirmation |
 
 ### Changelog Options
@@ -283,16 +355,16 @@ quicommit config reset --force
 | Option | Description |
 |--------|-------------|
 | `-o, --output` | Output file path |
-| `-v, --version` | Generate for specific version |
-| `-f, --from` | Generate from specific tag |
+| `--version` | Generate for specific version |
+| `-f, --from` | Generate from specific tag (auto-detected from existing changelog if omitted) |
 | `-t, --to` | Generate to specific ref (default: HEAD) |
 | `-i, --init` | Initialize new changelog file |
 | `-g, --generate` | AI-generate changelog |
-| `--prepend` | Prepend to existing changelog |
 | `--include-hashes` | Include commit hashes |
 | `--include-authors` | Include authors |
 | `--format` | Format (keep-a-changelog, github-releases) |
 | `--dry-run` | Dry run (output to stdout) |
+| `--think` | Enable LLM thinking/reasoning mode (overrides config) |
 | `-y, --yes` | Skip confirmation |
 
 ## Configuration File
@@ -332,58 +404,25 @@ use_agent = true
 
 [llm]
 provider = "ollama"
+model = "llama2"
+# base_url = "http://localhost:11434"
 max_tokens = 500
 temperature = 0.7
 timeout = 30
-
-[llm.ollama]
-url = "http://localhost:11434"
-model = "llama2"
-
-[llm.openai]
-model = "gpt-4"
-base_url = "https://api.openai.com/v1"
-
-[llm.anthropic]
-model = "claude-3-sonnet-20240229"
-
-[llm.kimi]
-model = "moonshot-v1-8k"
-
-[llm.deepseek]
-model = "deepseek-chat"
-
-[llm.openrouter]
-model = "openai/gpt-4"
+api_key_storage = "keyring"
+thinking_enabled = false
 
 [commit]
 format = "conventional"
 auto_generate = true
-allow_empty = false
-gpg_sign = false
-max_subject_length = 100
-require_scope = false
-require_body = false
-body_required_types = ["feat", "fix"]
 
 [tag]
 version_prefix = "v"
 auto_generate = true
-gpg_sign = false
-include_changelog = true
 
 [changelog]
 path = "CHANGELOG.md"
 auto_generate = true
-format = "keep-a-changelog"
-include_hashes = false
-include_authors = false
-group_by_type = true
-
-[theme]
-colors = true
-icons = true
-date_format = "%Y-%m-%d"
 
 [repo_profiles]
 "/path/to/work/project" = "work"
@@ -402,9 +441,6 @@ date_format = "%Y-%m-%d"
 
 ```bash
 # View current configuration
-quicommit config list
-
-# Show configuration details
 quicommit config show
 
 # Edit configuration file

examples/config.example.toml

@@ -46,61 +46,35 @@ use_agent = true
 
 # LLM Configuration
 [llm]
-# Provider: ollama, openai, or anthropic
+# Provider: ollama, openai, anthropic, kimi, deepseek, openrouter
 provider = "ollama"
+# Model name (provider-appropriate)
+model = "llama2"
+# API base URL (optional, provider default will be used if not set)
+# base_url = "http://localhost:11434"
 max_tokens = 500
 temperature = 0.7
 timeout = 30
-
-# Ollama settings (local LLM)
-[llm.ollama]
-url = "http://localhost:11434"
-model = "llama2"
-
-# OpenAI settings
-[llm.openai]
-# api_key = "sk-..."  # Set via: quicommit config set-openai-key
-model = "gpt-4"
-base_url = "https://api.openai.com/v1"
-
-# Anthropic settings
-[llm.anthropic]
-# api_key = "sk-ant-..."  # Set via: quicommit config set-anthropic-key
-model = "claude-3-sonnet-20240229"
+# API key storage: keyring, config, environment
+api_key_storage = "keyring"
+# Enable thinking/reasoning mode (deepseek, kimi, anthropic)
+thinking_enabled = false
 
 # Commit settings
 [commit]
 # Format: conventional or commitlint
 format = "conventional"
 auto_generate = true
-allow_empty = false
-gpg_sign = false
-max_subject_length = 100
-require_scope = false
-require_body = false
-body_required_types = ["feat", "fix"]
 
 # Tag settings
 [tag]
 version_prefix = "v"
 auto_generate = true
-gpg_sign = false
-include_changelog = true
 
 # Changelog settings
 [changelog]
 path = "CHANGELOG.md"
 auto_generate = true
-format = "keep-a-changelog"  # or "github-releases"
-include_hashes = false
-include_authors = false
-group_by_type = true
-
-# Theme settings
-[theme]
-colors = true
-icons = true
-date_format = "%Y-%m-%d"
 
 # Repository-specific profile mappings
 # [repo_profiles]

readme_zh.md

@@ -62,7 +62,7 @@ quicommit commit
 # 手动提交
 quicommit commit --manual -t feat -m "添加新功能"
 
-# 暂存所有文件并提交
+# 暂存所有文件并提交（自动跳过 .gitignore 匹配的文件）
 quicommit commit -a
 
 # 跳过确认直接提交
@@ -71,16 +71,24 @@ quicommit commit --yes
 # 使用日期格式的提交信息
 quicommit commit --date
 
+# 为本次提交启用 LLM 思考/推理模式
+quicommit commit --think
+
 # 提交后推送到远程
 quicommit commit --push
 ```
 
+在暂存更改时（自动暂存或 `--all` 模式），会自动跳过匹配 `.gitignore` 规则的文件，并清理索引中已被忽略的已跟踪文件，最后打印出被跳过的文件列表。
+
 ### 创建标签
 
 ```bash
 # 自动检测版本升级
 quicommit tag
 
+# 从 Cargo.toml/pyproject.toml 自动检测版本，回退到基于 commit 的分析
+quicommit tag --auto
+
 # 指定版本升级类型
 quicommit tag --bump minor
 
@@ -97,11 +105,14 @@ quicommit tag --push
 ### 生成变更日志
 
 ```bash
-# 生成未发布变更的变更日志
+# 生成未发布变更的变更日志（未指定 --from 时自动从现有 changelog 的最高版本检测）
 quicommit changelog
 
 # 为特定版本生成
-quicommit changelog -v 1.0.0
+quicommit changelog --version 1.0.0
+
+# 从指定标签生成
+quicommit changelog --from v0.9.0
 
 # AI生成变更日志
 quicommit changelog --generate
@@ -159,12 +170,64 @@ quicommit profile stats
 quicommit profile token
 ```
 
+### Git 凭据助手（Credential Helper）
+
+QuiCommit 可以作为 Git 凭据助手，通过系统密钥环安全地存储和读取个人访问令牌（PAT）。
+`credential` 命令在 `--help` 中是隐藏的，因为它由 Git 自动调用，无需用户手动执行。
+
+#### 配置方法
+
+将 QuiCommit 注册为 Git 凭据助手：
+
+```bash
+# 使用默认的 QuiCommit 配置
+git config --global credential.helper quicommit
+
+# 或指定自定义配置文件路径
+git config --global credential.helper "quicommit --config /path/to/config.toml"
+```
+
+也可以仅对特定主机启用：
+
+```bash
+git config --global credential.https://github.com.helper quicommit
+```
+
+#### 工作原理
+
+当 Git 需要凭据（例如推送到远程仓库）时，会按照
+[gitcredentials 协议](https://git-scm.com/docs/gitcredentials) 调用助手：
+
+1. **`get`** — Git 向 QuiCommit 请求与目标主机匹配的已存储 PAT。
+   QuiCommit 在所有已配置的 profile 中搜索密钥环，找到则返回 PAT（及用户名）。
+2. **`store`** — 认证成功后（例如你在 Git 提示中输入了 PAT），Git 要求
+   QuiCommit 保存该凭据。PAT 将存入系统密钥环，并与匹配的 profile 绑定。
+3. **`erase`** — Git 要求 QuiCommit 删除指定主机的已存储 PAT。
+
+主机名会被映射为规范化的服务名（`github.com` → `github`、`gitlab.com` →
+`gitlab`、`bitbucket.org` → `bitbucket` 等），未知主机则原样使用。
+
+#### 删除已存储的凭据
+
+可以通过 Git 内置机制删除已存储的 PAT：
+
+```bash
+echo "protocol=https
+host=github.com" | git credential reject
+```
+
+也可以通过 profile 令牌管理命令删除：
+
+```bash
+quicommit profile token
+```
+
 ### LLM配置
 
 ```bash
 # 配置Ollama（本地）
 quicommit config set-llm ollama
-quicommit config set-llm ollama --url http://localhost:11434 --model llama2
+quicommit config set-llm ollama --base-url http://localhost:11434 --model llama2
 
 # 配置OpenAI
 quicommit config set-llm openai
@@ -238,6 +301,7 @@ quicommit config reset --force
 | `quicommit changelog` | `cl` | 生成变更日志 |
 | `quicommit profile` | `p` | 管理Git配置 |
 | `quicommit config` | `cfg` | 管理应用配置 |
+| `quicommit credential` | — | Git凭据助手（隐藏，由Git调用） |
 
 ### commit命令选项
 
@@ -250,13 +314,14 @@ quicommit config reset --force
 | `-b, --breaking` | 标记为破坏性变更 |
 | `-d, --date` | 使用日期格式的提交信息 |
 | `--manual` | 手动输入，跳过AI生成 |
-| `-a, --all` | 暂存所有更改 |
+| `-a, --all` | 暂存所有更改（自动跳过 `.gitignore` 匹配的文件） |
 | `-S, --sign` | GPG签名提交 |
 | `--amend` | 修改上一次提交 |
 | `--dry-run` | 试运行，不实际提交 |
 | `--conventional` | 使用Conventional Commits格式 |
 | `--commitlint` | 使用commitlint格式 |
 | `--no-verify` | 不验证提交信息 |
+| `-t, --think` | 启用 LLM 思考/推理模式（覆盖配置） |
 | `-y, --yes` | 跳过确认提示 |
 | `--push` | 提交后推送到远程 |
 | `--remote` | 指定远程仓库（默认：origin） |
@@ -267,6 +332,7 @@ quicommit config reset --force
 |------|------|
 | `-n, --name` | 标签名称 |
 | `-b, --bump` | 版本升级类型（major/minor/patch） |
+| `-A, --auto` | 从 Cargo.toml/pyproject.toml 自动检测版本，回退到基于 commit 的分析（与 `--bump` 互斥） |
 | `-m, --message` | 标签信息 |
 | `-g, --generate` | AI生成标签信息 |
 | `-S, --sign` | GPG签名标签 |
@@ -275,6 +341,7 @@ quicommit config reset --force
 | `-p, --push` | 推送到远程 |
 | `-r, --remote` | 指定远程仓库（默认：origin） |
 | `--dry-run` | 试运行 |
+| `-t, --think` | 启用 LLM 思考/推理模式（覆盖配置） |
 | `-y, --yes` | 跳过确认提示 |
 
 ### changelog命令选项
@@ -282,16 +349,16 @@ quicommit config reset --force
 | 选项 | 说明 |
 |------|------|
 | `-o, --output` | 输出文件路径 |
-| `-v, --version` | 为特定版本生成 |
-| `-f, --from` | 从指定标签生成 |
+| `--version` | 为特定版本生成 |
+| `-f, --from` | 从指定标签生成（未指定时自动从现有 changelog 的最高版本检测） |
 | `-t, --to` | 生成到指定引用（默认：HEAD） |
 | `-i, --init` | 初始化新的变更日志文件 |
 | `-g, --generate` | AI生成变更日志 |
-| `--prepend` | 添加到现有变更日志开头 |
 | `--include-hashes` | 包含提交哈希 |
 | `--include-authors` | 包含作者信息 |
 | `--format` | 格式（keep-a-changelog、github-releases） |
 | `--dry-run` | 试运行（输出到stdout） |
+| `--think` | 启用 LLM 思考/推理模式（覆盖配置） |
 | `-y, --yes` | 跳过确认提示 |
 
 ## 配置文件
@@ -331,58 +398,25 @@ use_agent = true
 
 [llm]
 provider = "ollama"
+model = "llama2"
+# base_url = "http://localhost:11434"
 max_tokens = 500
 temperature = 0.7
 timeout = 30
-
-[llm.ollama]
-url = "http://localhost:11434"
-model = "llama2"
-
-[llm.openai]
-model = "gpt-4"
-base_url = "https://api.openai.com/v1"
-
-[llm.anthropic]
-model = "claude-3-sonnet-20240229"
-
-[llm.kimi]
-model = "moonshot-v1-8k"
-
-[llm.deepseek]
-model = "deepseek-chat"
-
-[llm.openrouter]
-model = "openai/gpt-4"
+api_key_storage = "keyring"
+thinking_enabled = false
 
 [commit]
 format = "conventional"
 auto_generate = true
-allow_empty = false
-gpg_sign = false
-max_subject_length = 100
-require_scope = false
-require_body = false
-body_required_types = ["feat", "fix"]
 
 [tag]
 version_prefix = "v"
 auto_generate = true
-gpg_sign = false
-include_changelog = true
 
 [changelog]
 path = "CHANGELOG.md"
 auto_generate = true
-format = "keep-a-changelog"
-include_hashes = false
-include_authors = false
-group_by_type = true
-
-[theme]
-colors = true
-icons = true
-date_format = "%Y-%m-%d"
 
 [repo_profiles]
 "/path/to/work/project" = "work"
@@ -401,9 +435,6 @@ date_format = "%Y-%m-%d"
 
 ```bash
 # 查看当前配置
-quicommit config list
-
-# 显示配置详情
 quicommit config show
 
 # 编辑配置文件

src/commands/changelog.rs

@@ -7,6 +7,7 @@ use std::path::PathBuf;
 
 use crate::config::{Language, manager::ConfigManager};
 use crate::generator::ContentGenerator;
+use crate::git::GitRepo;
 use crate::git::find_repo;
 use crate::git::{CommitInfo, changelog::*};
 use crate::i18n::{Messages, translate_changelog_category};
@@ -120,7 +121,10 @@ impl ChangelogCommand {
 
         // Get commits
         println!("{}", messages.fetching_commits());
-        let commits = generate_from_history(&repo, self.from.as_deref(), Some(&self.to))?;
+
+        // Determine from_tag: use explicit --from, or auto-detect from changelog
+        let from_tag = self.resolve_from_tag(&repo, &output_path, &messages);
+        let commits = generate_from_history(&repo, from_tag.as_deref(), Some(&self.to))?;
 
         if commits.is_empty() {
             bail!("{}", messages.no_commits_found());
@@ -167,33 +171,13 @@ impl ChangelogCommand {
             }
         }
 
-        // Write to file (always prepend to preserve history)
+        // Write to file (always prepend new entry before existing versions)
         if output_path.exists() {
             let existing = std::fs::read_to_string(&output_path)?;
             let new_content = if existing.is_empty() {
                 format!("{}{}", CHANGELOG_HEADER, changelog)
-            } else if existing.starts_with(CHANGELOG_HEADER) {
-                format!("{}{}", CHANGELOG_HEADER, changelog)
-            } else if existing.starts_with("# Changelog") {
-                let lines: Vec<&str> = existing.lines().collect();
-                let mut header_end = 0;
-
-                for (i, line) in lines.iter().enumerate() {
-                    if i == 0 && line.starts_with('#') {
-                        header_end = i + 1;
-                    } else if line.trim().is_empty() {
-                        header_end = i + 1;
             } else {
-                        break;
-                    }
-                }
-
-                let header = lines[..header_end].join("\n");
-                let rest = lines[header_end..].join("\n");
-
-                format!("{}\n{}\n{}", header, changelog, rest)
-            } else {
-                format!("{}{}", CHANGELOG_HEADER, changelog)
+                insert_changelog_entry(&existing, &changelog)
             };
             std::fs::write(&output_path, new_content)?;
         } else {
@@ -206,6 +190,28 @@ impl ChangelogCommand {
         Ok(())
     }
 
+    fn resolve_from_tag(
+        &self,
+        repo: &GitRepo,
+        output_path: &PathBuf,
+        messages: &Messages,
+    ) -> Option<String> {
+        // Explicit --from always wins
+        if self.from.is_some() {
+            return self.from.clone();
+        }
+
+        // Auto-detect: find highest version already in changelog
+        let existing = std::fs::read_to_string(output_path).ok()?;
+        let versions = parse_changelog_versions(&existing);
+        let highest = versions.first()?;
+
+        // Match highest version to a git tag
+        let tag = repo.find_tag_by_version(highest)?;
+        println!("  {}: {}", messages.version(), tag.name);
+        Some(tag.name)
+    }
+
     async fn generate_with_ai(
         &self,
         version: &str,
@@ -217,7 +223,7 @@ impl ChangelogCommand {
 
         println!("{}", messages.ai_generating_changelog());
 
-        let generator = ContentGenerator::new_with_think(&manager, self.think).await?;
+        let generator = ContentGenerator::new_with_think(&manager, self.think, None).await?;
         generator
             .generate_changelog_entry(version, commits, language)
             .await

src/commands/commit.rs

@@ -121,8 +121,17 @@ impl CommitCommand {
         // Auto-add if no files are staged and there are unstaged/untracked changes
         if status.staged == 0 && (status.unstaged > 0 || status.untracked > 0) && !self.all {
             println!("{}", messages.auto_stage_changes().yellow());
-            repo.stage_all()?;
+            let removed = repo.stage_all()?;
             println!("{}", messages.staged_all().green());
+            if !removed.is_empty() {
+                println!(
+                    "{}",
+                    format!("Removed {} ignored files from staging:", removed.len()).yellow()
+                );
+                for file in &removed {
+                    println!("  • {}", file);
+                }
+            }
 
             // Re-check status after staging to ensure changes are detected
             let new_status = repo.status_summary()?;
@@ -133,8 +142,17 @@ impl CommitCommand {
 
         // Stage all if requested
         if self.all {
-            repo.stage_all()?;
+            let removed = repo.stage_all()?;
             println!("{}", messages.staged_all().green());
+            if !removed.is_empty() {
+                println!(
+                    "{}",
+                    format!("Removed {} ignored files from staging:", removed.len()).yellow()
+                );
+                for file in &removed {
+                    println!("  • {}", file);
+                }
+            }
         }
 
         // Generate or build commit message
@@ -280,7 +298,11 @@ impl CommitCommand {
     ) -> Result<String> {
         let manager = ConfigManager::new()?;
 
-        let generator = ContentGenerator::new_with_think(&manager, self.think)
+        let template = manager
+            .default_profile()
+            .and_then(|p| p.commit_template().map(|t| t.to_string()));
+
+        let generator = ContentGenerator::new_with_think(&manager, self.think, template)
             .await
             .context("Failed to initialize LLM. Use --manual for manual commit.")?;
 

src/commands/config.rs

@@ -37,9 +37,6 @@ enum ConfigSubcommand {
     /// Show current configuration
     Show,
 
-    /// List all configuration information (with masked API keys)
-    List,
-
     /// Edit configuration file
     Edit,
 
@@ -167,7 +164,6 @@ impl ConfigCommand {
     pub async fn execute(&self, config_path: Option<PathBuf>) -> Result<()> {
         match &self.command {
             Some(ConfigSubcommand::Show) => self.show_config(&config_path).await,
-            Some(ConfigSubcommand::List) => self.list_config(&config_path).await,
             Some(ConfigSubcommand::Edit) => self.edit_config(&config_path).await,
             Some(ConfigSubcommand::Set { key, value }) => {
                 self.set_value(key, value, &config_path).await
@@ -311,15 +307,6 @@ impl ConfigCommand {
                 "no".red()
             }
         );
-        println!(
-            "  GPG sign: {}",
-            if config.commit.gpg_sign {
-                "yes".green()
-            } else {
-                "no".red()
-            }
-        );
-        println!("  Max subject length: {}", config.commit.max_subject_length);
 
         println!("\n{}", "Tag Configuration:".bold());
         println!("  Version prefix: '{}'", config.tag.version_prefix);
@@ -331,22 +318,6 @@ impl ConfigCommand {
                 "no".red()
             }
         );
-        println!(
-            "  GPG sign: {}",
-            if config.tag.gpg_sign {
-                "yes".green()
-            } else {
-                "no".red()
-            }
-        );
-        println!(
-            "  Include changelog: {}",
-            if config.tag.include_changelog {
-                "yes".green()
-            } else {
-                "no".red()
-            }
-        );
 
         println!("\n{}", "Language Configuration:".bold());
         let language = manager.get_language().unwrap_or(Language::English);
@@ -378,243 +349,17 @@ impl ConfigCommand {
                 "no".red()
             }
         );
-        println!(
-            "  Include hashes: {}",
-            if config.changelog.include_hashes {
-                "yes".green()
-            } else {
-                "no".red()
-            }
-        );
-        println!(
-            "  Include authors: {}",
-            if config.changelog.include_authors {
-                "yes".green()
-            } else {
-                "no".red()
-            }
-        );
-        println!(
-            "  Group by type: {}",
-            if config.changelog.group_by_type {
-                "yes".green()
-            } else {
-                "no".red()
-            }
-        );
 
-        Ok(())
-    }
-
-    async fn list_config(&self, config_path: &Option<PathBuf>) -> Result<()> {
-        let manager = self.get_manager(config_path)?;
-        let config = manager.config();
-
-        println!("{}", "\nQuiCommit Configuration".bold());
-        println!("{}", "═".repeat(80));
-
-        println!("\n{}", "📁 General Configuration:".bold().blue());
-        println!("  Config file: {}", manager.path().display());
+        println!("\n{}", "Security:".bold());
+        println!("  Repository mappings: {} mapping(s)", config.repo_profiles.len());
         println!(
-            "  Default profile: {}",
-            config.default_profile.as_deref().unwrap_or("(none)").cyan()
-        );
-        println!("  Profiles: {} profile(s)", config.profiles.len());
-        println!(
-            "  Repository mappings: {} mapping(s)",
-            config.repo_profiles.len()
-        );
-
-        println!("\n{}", "🤖 LLM Configuration:".bold().blue());
-        println!("  Provider: {}", config.llm.provider.cyan());
-        println!("  Model: {}", config.llm.model.cyan());
-        println!("  Base URL: {}", manager.llm_base_url());
-        println!(
-            "  API Key: {}",
-            mask_api_key(manager.get_api_key().as_deref())
-        );
-        println!("  Max tokens: {}", config.llm.max_tokens);
-        println!("  Temperature: {}", config.llm.temperature);
-        println!("  Timeout: {}s", config.llm.timeout);
-
-        println!("\n{}", "📝 Commit Configuration:".bold().blue());
-        println!("  Format: {}", config.commit.format.to_string().cyan());
-        println!(
-            "  Auto-generate: {}",
-            if config.commit.auto_generate {
-                "✓ yes".green()
+            "  Keyring: {}",
+            if manager.keyring().is_available() {
+                "available".green()
             } else {
-                "✗ no".red()
+                "unavailable".red()
             }
         );
-        println!(
-            "  Allow empty: {}",
-            if config.commit.allow_empty {
-                "✓ yes".green()
-            } else {
-                "✗ no".red()
-            }
-        );
-        println!(
-            "  GPG sign: {}",
-            if config.commit.gpg_sign {
-                "✓ yes".green()
-            } else {
-                "✗ no".red()
-            }
-        );
-        println!(
-            "  Default scope: {}",
-            config
-                .commit
-                .default_scope
-                .as_deref()
-                .unwrap_or("(none)")
-                .cyan()
-        );
-        println!("  Max subject length: {}", config.commit.max_subject_length);
-        println!(
-            "  Require scope: {}",
-            if config.commit.require_scope {
-                "✓ yes".green()
-            } else {
-                "✗ no".red()
-            }
-        );
-        println!(
-            "  Require body: {}",
-            if config.commit.require_body {
-                "✓ yes".green()
-            } else {
-                "✗ no".red()
-            }
-        );
-        if !config.commit.body_required_types.is_empty() {
-            println!(
-                "  Body required types: {}",
-                config.commit.body_required_types.join(", ").cyan()
-            );
-        }
-
-        println!("\n{}", "🏷️  Tag Configuration:".bold().blue());
-        println!("  Version prefix: '{}'", config.tag.version_prefix.cyan());
-        println!(
-            "  Auto-generate: {}",
-            if config.tag.auto_generate {
-                "✓ yes".green()
-            } else {
-                "✗ no".red()
-            }
-        );
-        println!(
-            "  GPG sign: {}",
-            if config.tag.gpg_sign {
-                "✓ yes".green()
-            } else {
-                "✗ no".red()
-            }
-        );
-        println!(
-            "  Include changelog: {}",
-            if config.tag.include_changelog {
-                "✓ yes".green()
-            } else {
-                "✗ no".red()
-            }
-        );
-        println!(
-            "  Annotation template: {}",
-            config
-                .tag
-                .annotation_template
-                .as_deref()
-                .unwrap_or("(none)")
-                .cyan()
-        );
-
-        println!("\n{}", "📋 Changelog Configuration:".bold().blue());
-        println!("  Path: {}", config.changelog.path);
-        println!(
-            "  Auto-generate: {}",
-            if config.changelog.auto_generate {
-                "✓ yes".green()
-            } else {
-                "✗ no".red()
-            }
-        );
-        println!(
-            "  Format: {}",
-            format!("{:?}", config.changelog.format).cyan()
-        );
-        println!(
-            "  Include hashes: {}",
-            if config.changelog.include_hashes {
-                "✓ yes".green()
-            } else {
-                "✗ no".red()
-            }
-        );
-        println!(
-            "  Include authors: {}",
-            if config.changelog.include_authors {
-                "✓ yes".green()
-            } else {
-                "✗ no".red()
-            }
-        );
-        println!(
-            "  Group by type: {}",
-            if config.changelog.group_by_type {
-                "✓ yes".green()
-            } else {
-                "✗ no".red()
-            }
-        );
-        if !config.changelog.custom_categories.is_empty() {
-            println!(
-                "  Custom categories: {} category(ies)",
-                config.changelog.custom_categories.len()
-            );
-        }
-
-        println!("\n{}", "🎨 Theme Configuration:".bold().blue());
-        println!(
-            "  Colors: {}",
-            if config.theme.colors {
-                "✓ enabled".green()
-            } else {
-                "✗ disabled".red()
-            }
-        );
-        println!(
-            "  Icons: {}",
-            if config.theme.icons {
-                "✓ enabled".green()
-            } else {
-                "✗ disabled".red()
-            }
-        );
-        println!("  Date format: {}", config.theme.date_format.cyan());
-
-        println!("\n{}", "🔒 Security:".bold().blue());
-        println!(
-            "  Encrypt sensitive: {}",
-            if config.encrypt_sensitive {
-                "✓ yes".green()
-            } else {
-                "✗ no".red()
-            }
-        );
-
-        println!("\n{}", "🔑 Keyring:".bold().blue());
-        let keyring = manager.keyring();
-        if keyring.is_available() {
-            println!("  Status: {}", "✓ available".green());
-            println!("  Backend: {}", keyring.get_status_message());
-        } else {
-            println!("  Status: {}", "✗ unavailable".red());
-            println!("  Note: {}", keyring.get_status_message());
-        }
 
         Ok(())
     }
@@ -671,7 +416,22 @@ impl ConfigCommand {
                 manager.set_auto_generate_commits(value == "true");
             }
             "tag.version_prefix" => manager.set_version_prefix(value.to_string()),
+            "tag.auto_generate" => {
+                manager.config_mut().tag.auto_generate = value == "true";
+            }
             "changelog.path" => manager.set_changelog_path(value.to_string()),
+            "changelog.auto_generate" => {
+                manager.config_mut().changelog.auto_generate = value == "true";
+            }
+            "language.output_language" => {
+                manager.set_output_language(value.to_string());
+            }
+            "language.keep_types_english" => {
+                manager.set_keep_types_english(value == "true");
+            }
+            "language.keep_changelog_types_english" => {
+                manager.set_keep_changelog_types_english(value == "true");
+            }
             _ => bail!("Unknown configuration key: {}", key),
         }
 
@@ -702,7 +462,14 @@ impl ConfigCommand {
             "commit.format" => config.commit.format.to_string(),
             "commit.auto_generate" => config.commit.auto_generate.to_string(),
             "tag.version_prefix" => config.tag.version_prefix.clone(),
+            "tag.auto_generate" => config.tag.auto_generate.to_string(),
             "changelog.path" => config.changelog.path.clone(),
+            "changelog.auto_generate" => config.changelog.auto_generate.to_string(),
+            "language.output_language" => config.language.output_language.clone(),
+            "language.keep_types_english" => config.language.keep_types_english.to_string(),
+            "language.keep_changelog_types_english" => {
+                config.language.keep_changelog_types_english.to_string()
+            }
             _ => bail!("Unknown configuration key: {}", key),
         };
 

src/commands/credential.rs

@@ -0,0 +1,458 @@
+use anyhow::{Context, Result};
+use clap::{Parser, Subcommand};
+use std::io::{self, BufRead, Write};
+use std::path::PathBuf;
+
+use crate::config::manager::ConfigManager;
+use crate::config::{TokenConfig, TokenType};
+
+/// Git credential helper command.
+///
+/// Implements the git credential helper protocol
+/// (https://git-scm.com/docs/gitcredentials). Intended to be invoked by git
+/// via `credential.helper` configuration, not by end users. Hidden from the
+/// main help output.
+#[derive(Parser)]
+#[command(hide = true)]
+pub struct CredentialCommand {
+    #[command(subcommand)]
+    command: CredentialSubcommand,
+}
+
+#[derive(Subcommand)]
+enum CredentialSubcommand {
+    /// Read attributes on stdin and output credentials on stdout.
+    #[command(hide = true)]
+    Get,
+    /// Read attributes (including password) on stdin and store them.
+    #[command(hide = true)]
+    Store,
+    /// Read attributes on stdin and erase any matching stored credentials.
+    #[command(hide = true)]
+    Erase,
+}
+
+impl CredentialCommand {
+    pub async fn execute(&self, config_path: Option<PathBuf>) -> Result<()> {
+        match &self.command {
+            CredentialSubcommand::Get => Self::get(config_path),
+            CredentialSubcommand::Store => Self::store(config_path),
+            CredentialSubcommand::Erase => Self::erase(config_path),
+        }
+    }
+
+    fn get_manager(config_path: &Option<PathBuf>) -> Result<ConfigManager> {
+        match config_path {
+            Some(path) => ConfigManager::with_path(path),
+            None => ConfigManager::new(),
+        }
+    }
+
+    /// `git credential get`: look up a PAT for the requested host and emit it
+    /// on stdout following the git credential helper protocol.
+    fn get(config_path: Option<PathBuf>) -> Result<()> {
+        let attrs = CredentialAttributes::from_stdin()?;
+
+        let host = match attrs.host.as_deref() {
+            Some(h) if !h.is_empty() => h,
+            _ => return Ok(()),
+        };
+        let service = host_to_service(host);
+
+        let manager = match Self::get_manager(&config_path) {
+            Ok(m) => m,
+            Err(_) => return Ok(()),
+        };
+
+        let (profile_name, pat) = match find_pat_for_service(&manager, &service) {
+            Some(tuple) => tuple,
+            None => return Ok(()),
+        };
+
+        // Prefer a git-supplied username; fall back to the profile's user_name.
+        let username = attrs.username.clone().or_else(|| {
+            manager
+                .get_profile(&profile_name)
+                .map(|p| p.user_name.clone())
+        });
+
+        let output = CredentialAttributes {
+            protocol: attrs.protocol.clone(),
+            host: attrs.host.clone(),
+            path: attrs.path.clone(),
+            username,
+            password: Some(pat),
+        };
+        output.to_stdout()?;
+        Ok(())
+    }
+
+    /// `git credential store`: persist the PAT provided by git using the
+    /// existing keyring-backed storage, associated with a matching profile.
+    fn store(config_path: Option<PathBuf>) -> Result<()> {
+        let attrs = CredentialAttributes::from_stdin()?;
+
+        let host = match attrs.host.as_deref() {
+            Some(h) if !h.is_empty() => h,
+            _ => return Ok(()),
+        };
+        let service = host_to_service(host);
+
+        let password = match attrs.password.as_deref() {
+            Some(p) if !p.is_empty() => p,
+            _ => return Ok(()),
+        };
+
+        let mut manager = Self::get_manager(&config_path)?;
+
+        let profile_name = match find_profile_for_store(&manager, attrs.username.as_deref()) {
+            Some(name) => name,
+            None => return Ok(()),
+        };
+
+        // Store PAT in keyring using the existing profile-bound logic.
+        if let Err(e) = manager.store_pat_for_profile(&profile_name, &service, password) {
+            eprintln!("[quicommit credential] failed to store PAT: {}", e);
+            return Ok(());
+        }
+
+        // Register the token in the profile config if not already present.
+        let already_has = manager
+            .get_profile(&profile_name)
+            .map(|p| p.tokens.contains_key(&service))
+            .unwrap_or(false);
+        if !already_has {
+            let _ = manager.add_token_to_profile(
+                &profile_name,
+                service.clone(),
+                TokenConfig::new(TokenType::Personal),
+            );
+        }
+
+        manager.save()?;
+        Ok(())
+    }
+
+    /// `git credential erase`: remove any PAT stored for the requested host
+    /// from the keyring and the associated profile config entries.
+    fn erase(config_path: Option<PathBuf>) -> Result<()> {
+        let attrs = CredentialAttributes::from_stdin()?;
+
+        let host = match attrs.host.as_deref() {
+            Some(h) if !h.is_empty() => h,
+            _ => return Ok(()),
+        };
+        let service = host_to_service(host);
+
+        let mut manager = Self::get_manager(&config_path)?;
+
+        let profile_names: Vec<String> = manager
+            .list_profiles()
+            .into_iter()
+            .filter(|name| {
+                manager
+                    .get_profile(name)
+                    .map(|p| p.tokens.contains_key(&service))
+                    .unwrap_or(false)
+            })
+            .cloned()
+            .collect();
+
+        for name in &profile_names {
+            if let Err(e) = manager.remove_token_from_profile(name, &service) {
+                eprintln!(
+                    "[quicommit credential] failed to erase PAT for '{}': {}",
+                    name, e
+                );
+            }
+        }
+
+        manager.save()?;
+        Ok(())
+    }
+}
+
+/// Credential attributes exchanged with git via stdin/stdout following the
+/// git credential helper protocol (`key=value`, one per line, blank line ends).
+#[derive(Debug, Default, Clone, PartialEq, Eq)]
+pub struct CredentialAttributes {
+    pub protocol: Option<String>,
+    pub host: Option<String>,
+    pub path: Option<String>,
+    pub username: Option<String>,
+    pub password: Option<String>,
+}
+
+impl CredentialAttributes {
+    /// Read attributes from stdin following the git credential helper protocol.
+    pub fn from_stdin() -> Result<Self> {
+        let stdin = io::stdin();
+        let mut attrs = Self::default();
+        for line in stdin.lock().lines() {
+            let line =
+                line.context("Failed to read credential attributes from stdin")?;
+            if line.is_empty() {
+                break;
+            }
+            if let Some((key, value)) = line.split_once('=') {
+                match key {
+                    "protocol" => attrs.protocol = Some(value.to_string()),
+                    "host" => attrs.host = Some(value.to_string()),
+                    "path" => attrs.path = Some(value.to_string()),
+                    "username" => attrs.username = Some(value.to_string()),
+                    "password" => attrs.password = Some(value.to_string()),
+                    _ => {} // ignore unknown keys
+                }
+            }
+        }
+        Ok(attrs)
+    }
+
+    /// Write attributes to stdout following the git credential helper protocol.
+    pub fn to_stdout(&self) -> Result<()> {
+        let stdout = io::stdout();
+        let mut handle = stdout.lock();
+        if let Some(ref v) = self.protocol {
+            writeln!(handle, "protocol={}", v)?;
+        }
+        if let Some(ref v) = self.host {
+            writeln!(handle, "host={}", v)?;
+        }
+        if let Some(ref v) = self.path {
+            writeln!(handle, "path={}", v)?;
+        }
+        if let Some(ref v) = self.username {
+            writeln!(handle, "username={}", v)?;
+        }
+        if let Some(ref v) = self.password {
+            writeln!(handle, "password={}", v)?;
+        }
+        writeln!(handle)?; // blank line terminates the attribute list
+        handle.flush()?;
+        Ok(())
+    }
+
+    /// Parse attributes from a text block following the git credential helper
+    /// protocol. Intended for testing and non-stdin input handling.
+    pub fn parse_str(input: &str) -> Self {
+        let mut attrs = Self::default();
+        for line in input.lines() {
+            if line.is_empty() {
+                break;
+            }
+            if let Some((key, value)) = line.split_once('=') {
+                match key {
+                    "protocol" => attrs.protocol = Some(value.to_string()),
+                    "host" => attrs.host = Some(value.to_string()),
+                    "path" => attrs.path = Some(value.to_string()),
+                    "username" => attrs.username = Some(value.to_string()),
+                    "password" => attrs.password = Some(value.to_string()),
+                    _ => {}
+                }
+            }
+        }
+        attrs
+    }
+
+    /// Serialize attributes to a string following the git credential helper
+    /// protocol. Intended for testing and non-stdout output handling.
+    pub fn serialize(&self) -> String {
+        let mut out = String::new();
+        if let Some(ref v) = self.protocol {
+            out.push_str(&format!("protocol={}\n", v));
+        }
+        if let Some(ref v) = self.host {
+            out.push_str(&format!("host={}\n", v));
+        }
+        if let Some(ref v) = self.path {
+            out.push_str(&format!("path={}\n", v));
+        }
+        if let Some(ref v) = self.username {
+            out.push_str(&format!("username={}\n", v));
+        }
+        if let Some(ref v) = self.password {
+            out.push_str(&format!("password={}\n", v));
+        }
+        out.push('\n');
+        out
+    }
+}
+
+/// Map a git host to a service name used by the keyring-backed PAT storage.
+///
+/// Common git hosting services are mapped to short canonical names. Unknown
+/// hosts are used as-is (lowercased, trailing slash trimmed).
+pub fn host_to_service(host: &str) -> String {
+    let host = host.to_lowercase();
+    let host = host.trim_end_matches('/');
+    match host {
+        "github.com" | "www.github.com" => "github".to_string(),
+        "gitlab.com" | "www.gitlab.com" => "gitlab".to_string(),
+        "bitbucket.org" | "www.bitbucket.org" => "bitbucket".to_string(),
+        "codeberg.org" | "www.codeberg.org" => "codeberg".to_string(),
+        "gitea.com" | "www.gitea.com" => "gitea".to_string(),
+        "gitee.com" | "www.gitee.com" => "gitee".to_string(),
+        other => other.to_string(),
+    }
+}
+
+/// Search all profiles for one that has a PAT stored for the given service.
+/// Returns the profile name and the PAT value.
+fn find_pat_for_service(manager: &ConfigManager, service: &str) -> Option<(String, String)> {
+    for profile_name in manager.list_profiles() {
+        if manager.has_pat_for_profile(profile_name, service) {
+            if let Ok(Some(pat)) = manager.get_pat_for_profile(profile_name, service) {
+                return Some((profile_name.clone(), pat));
+            }
+        }
+    }
+    None
+}
+
+/// Determine which profile to use when storing a credential.
+///
+/// Prefers a profile whose `user_name` or `user_email` matches the
+/// git-supplied username; otherwise falls back to the default profile.
+fn find_profile_for_store(
+    manager: &ConfigManager,
+    username: Option<&str>,
+) -> Option<String> {
+    if let Some(username) = username {
+        for name in manager.list_profiles() {
+            if let Some(profile) = manager.get_profile(name) {
+                if profile.user_name == username || profile.user_email == username {
+                    return Some(name.clone());
+                }
+            }
+        }
+    }
+    manager.default_profile_name().cloned()
+}
+
+/// Extract a PAT for the given host from saved credentials across all profiles.
+///
+/// This is intended for use by other parts of the application (e.g. when
+/// verifying access to a git hosting service) and searches every configured
+/// profile for a stored PAT matching the host.
+pub fn get_pat_for_host(host: &str) -> Result<Option<String>> {
+    let manager = ConfigManager::new()?;
+    let service = host_to_service(host);
+    Ok(find_pat_for_service(&manager, &service).map(|(_, pat)| pat))
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn test_host_to_service_known_hosts() {
+        assert_eq!(host_to_service("github.com"), "github");
+        assert_eq!(host_to_service("www.github.com"), "github");
+        assert_eq!(host_to_service("gitlab.com"), "gitlab");
+        assert_eq!(host_to_service("bitbucket.org"), "bitbucket");
+        assert_eq!(host_to_service("codeberg.org"), "codeberg");
+        assert_eq!(host_to_service("gitea.com"), "gitea");
+        assert_eq!(host_to_service("gitee.com"), "gitee");
+    }
+
+    #[test]
+    fn test_host_to_service_case_insensitive() {
+        assert_eq!(host_to_service("GitHub.Com"), "github");
+        assert_eq!(host_to_service("GITLAB.COM"), "gitlab");
+    }
+
+    #[test]
+    fn test_host_to_service_trailing_slash() {
+        assert_eq!(host_to_service("github.com/"), "github");
+        assert_eq!(host_to_service("gitlab.com//"), "gitlab");
+    }
+
+    #[test]
+    fn test_host_to_service_unknown_host() {
+        assert_eq!(host_to_service("example.com"), "example.com");
+        assert_eq!(host_to_service("git.internal.corp"), "git.internal.corp");
+    }
+
+    #[test]
+    fn test_credential_attributes_parse_basic() {
+        let input = "protocol=https\nhost=github.com\nusername=octocat\npassword=ghp_token123\n\n";
+        let attrs = CredentialAttributes::parse_str(input);
+        assert_eq!(attrs.protocol.as_deref(), Some("https"));
+        assert_eq!(attrs.host.as_deref(), Some("github.com"));
+        assert_eq!(attrs.username.as_deref(), Some("octocat"));
+        assert_eq!(attrs.password.as_deref(), Some("ghp_token123"));
+        assert!(attrs.path.is_none());
+    }
+
+    #[test]
+    fn test_credential_attributes_parse_with_path() {
+        let input = "protocol=https\nhost=github.com\npath=owner/repo.git\n\n";
+        let attrs = CredentialAttributes::parse_str(input);
+        assert_eq!(attrs.path.as_deref(), Some("owner/repo.git"));
+    }
+
+    #[test]
+    fn test_credential_attributes_parse_empty() {
+        let attrs = CredentialAttributes::parse_str("");
+        assert!(attrs.protocol.is_none());
+        assert!(attrs.host.is_none());
+        assert!(attrs.username.is_none());
+        assert!(attrs.password.is_none());
+    }
+
+    #[test]
+    fn test_credential_attributes_parse_ignores_unknown_keys() {
+        let input = "protocol=https\nhost=github.com\nunknown=value\nfoo=bar\n\n";
+        let attrs = CredentialAttributes::parse_str(input);
+        assert_eq!(attrs.protocol.as_deref(), Some("https"));
+        assert_eq!(attrs.host.as_deref(), Some("github.com"));
+    }
+
+    #[test]
+    fn test_credential_attributes_parse_stops_at_blank_line() {
+        let input = "protocol=https\nhost=github.com\n\npassword=should_be_ignored\n";
+        let attrs = CredentialAttributes::parse_str(input);
+        assert_eq!(attrs.protocol.as_deref(), Some("https"));
+        assert_eq!(attrs.host.as_deref(), Some("github.com"));
+        assert!(attrs.password.is_none());
+    }
+
+    #[test]
+    fn test_credential_attributes_serialize_roundtrip() {
+        let attrs = CredentialAttributes {
+            protocol: Some("https".to_string()),
+            host: Some("github.com".to_string()),
+            path: None,
+            username: Some("octocat".to_string()),
+            password: Some("ghp_token".to_string()),
+        };
+        let serialized = attrs.serialize();
+        let reparsed = CredentialAttributes::parse_str(&serialized);
+        assert_eq!(attrs, reparsed);
+    }
+
+    #[test]
+    fn test_credential_attributes_serialize_includes_blank_line() {
+        let attrs = CredentialAttributes {
+            protocol: Some("https".to_string()),
+            host: Some("github.com".to_string()),
+            path: None,
+            username: None,
+            password: None,
+        };
+        let serialized = attrs.serialize();
+        assert!(serialized.ends_with("\n\n"));
+        assert!(serialized.contains("protocol=https\n"));
+        assert!(serialized.contains("host=github.com\n"));
+    }
+
+    #[test]
+    fn test_credential_attributes_default() {
+        let attrs = CredentialAttributes::default();
+        assert!(attrs.protocol.is_none());
+        assert!(attrs.host.is_none());
+        assert!(attrs.path.is_none());
+        assert!(attrs.username.is_none());
+        assert!(attrs.password.is_none());
+    }
+}

src/commands/init.rs

@@ -331,6 +331,17 @@ impl InitCommand {
             .default(ssh_dir.join("id_rsa").display().to_string())
             .interact_text()?;
 
+        let pub_key_path: String = Input::new()
+            .with_prompt("SSH public key path (optional, leave empty to auto-detect)")
+            .default(ssh_dir.join("id_rsa.pub").display().to_string())
+            .allow_empty(true)
+            .interact_text()?;
+        let public_key_path = if pub_key_path.is_empty() {
+            None
+        } else {
+            Some(PathBuf::from(pub_key_path))
+        };
+
         let has_passphrase = Confirm::new()
             .with_prompt(messages.has_passphrase())
             .default(false)
@@ -342,13 +353,38 @@ impl InitCommand {
             None
         };
 
+        let agent_forwarding = Confirm::new()
+            .with_prompt("Enable SSH agent forwarding (-A)?")
+            .default(false)
+            .interact()?;
+
+        let known_hosts: String = Input::new()
+            .with_prompt("Custom known_hosts file path (optional)")
+            .allow_empty(true)
+            .interact_text()?;
+        let known_hosts_file = if known_hosts.is_empty() {
+            None
+        } else {
+            Some(PathBuf::from(known_hosts))
+        };
+
+        let custom_cmd: String = Input::new()
+            .with_prompt("Custom SSH command (optional, overrides all other SSH settings)")
+            .allow_empty(true)
+            .interact_text()?;
+        let ssh_command = if custom_cmd.is_empty() {
+            None
+        } else {
+            Some(custom_cmd)
+        };
+
         Ok(SshConfig {
             private_key_path: Some(PathBuf::from(key_path)),
-            public_key_path: None,
+            public_key_path,
             passphrase,
-            agent_forwarding: false,
-            ssh_command: None,
-            known_hosts_file: None,
+            agent_forwarding,
+            ssh_command,
+            known_hosts_file,
         })
     }
 

src/commands/mod.rs

@@ -1,6 +1,7 @@
 pub mod changelog;
 pub mod commit;
 pub mod config;
+pub mod credential;
 pub mod init;
 pub mod profile;
 pub mod tag;

src/commands/profile.rs

@@ -345,6 +345,13 @@ impl ProfileCommand {
             if profile.has_gpg() {
                 println!("   {} GPG configured", "🔒".to_string().dimmed());
             }
+            if profile.signing_key().is_some() {
+                println!(
+                    "   {} Signing key: {}",
+                    "🔏".to_string().dimmed(),
+                    profile.signing_key().unwrap().dimmed()
+                );
+            }
             if profile.has_tokens() {
                 println!(
                     "   {} {} token(s)",
@@ -596,11 +603,64 @@ impl ProfileCommand {
             println!("Organization: {}", org);
         }
 
+        if let Some(ref key) = profile.signing_key {
+            println!("Signing key: {}", key);
+        }
+
+        // Profile settings
+        println!("\n{}", "Settings:".bold());
+        println!(
+            "  Auto-sign commits: {}",
+            if profile.settings.auto_sign_commits {
+                "yes"
+            } else {
+                "no"
+            }
+        );
+        println!(
+            "  Auto-sign tags: {}",
+            if profile.settings.auto_sign_tags {
+                "yes"
+            } else {
+                "no"
+            }
+        );
+        if let Some(ref fmt) = profile.settings.default_commit_format {
+            println!("  Default commit format: {}", fmt.to_string());
+        }
+        if !profile.settings.repo_patterns.is_empty() {
+            println!("  Repo patterns: {:?}", profile.settings.repo_patterns);
+        }
+        if let Some(ref provider) = profile.settings.llm_provider {
+            println!("  Preferred LLM: {}", provider);
+        }
+        if let Some(ref template) = profile.settings.commit_template {
+            println!("  Commit template: {}", template);
+        }
+
         if let Some(ref ssh) = profile.ssh {
             println!("\n{}", "SSH Configuration:".bold());
             if let Some(ref path) = ssh.private_key_path {
                 println!("  Private key: {:?}", path);
             }
+            if let Some(ref path) = ssh.public_key_path {
+                println!("  Public key: {:?}", path);
+            } else if let Some(ref path) = ssh.effective_public_key_path() {
+                println!("  Public key: {:?} (auto-detected)", path);
+            }
+            println!(
+                "  Agent forwarding: {}",
+                if ssh.agent_forwarding { "yes" } else { "no" }
+            );
+            if let Some(ref cmd) = ssh.ssh_command {
+                println!("  Custom command: {}", cmd);
+            }
+            if let Some(ref kh) = ssh.known_hosts_file {
+                println!("  Known hosts file: {:?}", kh);
+            }
+            if ssh.passphrase.is_some() {
+                println!("  Passphrase: [set]");
+            }
         }
 
         if let Some(ref gpg) = profile.gpg {
@@ -749,9 +809,9 @@ impl ProfileCommand {
     }
 
     async fn edit_profile(&self, name: &str, config_path: &Option<PathBuf>) -> Result<()> {
-        let mut manager = self.get_manager(config_path)?;
+        let manager = self.get_manager(config_path)?;
 
-        let profile = manager
+        let mut profile = manager
             .get_profile(name)
             .ok_or_else(|| anyhow::anyhow!("Profile '{}' not found", name))?
             .clone();
@@ -772,16 +832,54 @@ impl ProfileCommand {
             })
             .interact_text()?;
 
-        let mut new_profile = GitProfile::new(name.to_string(), user_name, user_email);
-        new_profile.description = profile.description;
-        new_profile.is_work = profile.is_work;
-        new_profile.organization = profile.organization;
-        new_profile.ssh = profile.ssh;
-        new_profile.gpg = profile.gpg;
-        new_profile.tokens = profile.tokens;
-        new_profile.usage = profile.usage;
+        profile.user_name = user_name;
+        profile.user_email = user_email;
 
-        manager.update_profile(name, new_profile)?;
+        // Sub-menu loop for optional configuration
+        loop {
+            println!();
+            let options = vec![
+                "Done / Save changes",
+                "Edit SSH configuration",
+                "Edit GPG configuration",
+                "Edit signing preferences",
+                "Manage tokens",
+            ];
+            let selection = Select::new()
+                .with_prompt("What would you like to edit?")
+                .items(&options)
+                .default(0)
+                .interact()?;
+
+            match selection {
+                0 => break,
+                1 => {
+                    profile.ssh = Some(self.setup_ssh_interactive().await?);
+                }
+                2 => {
+                    profile.gpg = Some(self.setup_gpg_interactive().await?);
+                }
+                3 => {
+                    profile.settings.auto_sign_commits = Confirm::new()
+                        .with_prompt("Auto-sign commits?")
+                        .default(profile.settings.auto_sign_commits)
+                        .interact()?;
+                    profile.settings.auto_sign_tags = Confirm::new()
+                        .with_prompt("Auto-sign tags?")
+                        .default(profile.settings.auto_sign_tags)
+                        .interact()?;
+                }
+                4 => {
+                    self.edit_tokens_interactive(&mut profile, &manager).await?;
+                }
+                _ => unreachable!(),
+            }
+        }
+
+        // Reload manager as mut to save
+        let config_path = manager.path().to_path_buf();
+        let mut manager = ConfigManager::with_path(&config_path)?;
+        manager.update_profile(name, profile)?;
         manager.save()?;
 
         println!("{} Profile '{}' updated", "✓".green(), name);
@@ -789,6 +887,50 @@ impl ProfileCommand {
         Ok(())
     }
 
+    async fn edit_tokens_interactive(
+        &self,
+        profile: &mut GitProfile,
+        manager: &ConfigManager,
+    ) -> Result<()> {
+        loop {
+            println!();
+            let mut options: Vec<String> = profile
+                .tokens
+                .keys()
+                .map(|s| format!("Remove token: {}", s))
+                .collect();
+            options.push("Add new token".to_string());
+            options.push("Back".to_string());
+
+            let selection = Select::new()
+                .with_prompt(format!("Manage tokens for '{}'", profile.name))
+                .items(&options)
+                .default(options.len() - 1)
+                .interact()?;
+
+            if selection == options.len() - 1 {
+                break;
+            }
+            if selection < profile.tokens.len() {
+                let service: String = profile
+                    .tokens
+                    .keys()
+                    .nth(selection)
+                    .unwrap()
+                    .clone();
+                profile.remove_token(&service);
+                println!(
+                    "{} Token '{}' removed",
+                    "✓".green(),
+                    service.cyan()
+                );
+            } else {
+                self.setup_token_interactive(profile, manager).await?;
+            }
+        }
+        Ok(())
+    }
+
     async fn set_default(&self, name: &str, config_path: &Option<PathBuf>) -> Result<()> {
         let mut manager = self.get_manager(config_path)?;
 
@@ -1231,18 +1373,56 @@ impl ProfileCommand {
             .map(|h| h.join(".ssh"))
             .unwrap_or_else(|| PathBuf::from("~/.ssh"));
 
+        println!("\n{}", "SSH Configuration".bold());
+
         let key_path: String = Input::new()
             .with_prompt("SSH private key path")
             .default(ssh_dir.join("id_rsa").display().to_string())
             .interact_text()?;
 
+        let pub_key_path: String = Input::new()
+            .with_prompt("SSH public key path (optional, leave empty to auto-detect)")
+            .default(ssh_dir.join("id_rsa.pub").display().to_string())
+            .allow_empty(true)
+            .interact_text()?;
+        let public_key_path = if pub_key_path.is_empty() {
+            None
+        } else {
+            Some(PathBuf::from(pub_key_path))
+        };
+
+        let agent_forwarding = Confirm::new()
+            .with_prompt("Enable SSH agent forwarding (-A)?")
+            .default(false)
+            .interact()?;
+
+        let known_hosts: String = Input::new()
+            .with_prompt("Custom known_hosts file path (optional)")
+            .allow_empty(true)
+            .interact_text()?;
+        let known_hosts_file = if known_hosts.is_empty() {
+            None
+        } else {
+            Some(PathBuf::from(known_hosts))
+        };
+
+        let custom_cmd: String = Input::new()
+            .with_prompt("Custom SSH command (optional, overrides all other SSH settings)")
+            .allow_empty(true)
+            .interact_text()?;
+        let ssh_command = if custom_cmd.is_empty() {
+            None
+        } else {
+            Some(custom_cmd)
+        };
+
         Ok(SshConfig {
             private_key_path: Some(PathBuf::from(key_path)),
-            public_key_path: None,
+            public_key_path,
             passphrase: None,
-            agent_forwarding: false,
-            ssh_command: None,
-            known_hosts_file: None,
+            agent_forwarding,
+            ssh_command,
+            known_hosts_file,
         })
     }
 

src/commands/tag.rs

@@ -8,7 +8,8 @@ use std::path::PathBuf;
 use crate::config::{Language, manager::ConfigManager};
 use crate::generator::ContentGenerator;
 use crate::git::tag::{
-    TagBuilder, VersionBump, bump_version, get_latest_version, suggest_version_bump,
+    TagBuilder, VersionBump, bump_version, get_latest_version, read_project_version,
+    suggest_version_bump,
 };
 use crate::git::{GitRepo, find_repo};
 use crate::i18n::Messages;
@@ -63,6 +64,11 @@ pub struct TagCommand {
     /// Skip interactive prompts
     #[arg(short = 'y', long)]
     yes: bool,
+
+    /// Auto-detect version from project config (Cargo.toml/pyproject.toml),
+    /// falling back to commit analysis with confirmation. Mutually exclusive with --bump.
+    #[arg(short = 'A', long, conflicts_with = "bump")]
+    auto: bool,
 }
 
 impl TagCommand {
@@ -80,6 +86,9 @@ impl TagCommand {
         // Determine tag name
         let tag_name = if let Some(name) = &self.name {
             name.clone()
+        } else if self.auto {
+            self.auto_detect_version(&repo, &config.tag.version_prefix, &messages)
+                .await?
         } else if let Some(bump_str) = &self.bump {
             // Calculate bumped version
             let prefix = &config.tag.version_prefix;
@@ -319,12 +328,63 @@ impl TagCommand {
 
         println!("{}", messages.ai_generating_tag(commits.len()));
 
-        let generator = ContentGenerator::new_with_think(&manager, self.think).await?;
+        let generator = ContentGenerator::new_with_think(&manager, self.think, None).await?;
         generator
             .generate_tag_message(version, &commits, language)
             .await
     }
 
+    async fn auto_detect_version(
+        &self,
+        repo: &GitRepo,
+        prefix: &str,
+        messages: &Messages,
+    ) -> Result<String> {
+        let project_dir = std::env::current_dir()?;
+
+        // 1. Try reading from project config files
+        if let Some(version) = read_project_version(&project_dir) {
+            let tag_name = format!("{}{}", prefix, version);
+            println!(
+                "{} {}",
+                messages.latest_version(),
+                tag_name.cyan()
+            );
+            return Ok(tag_name);
+        }
+
+        // 2. Fall back to commit analysis
+        println!("{}", messages.auto_detect_bump());
+        let commits = repo.get_commits(50)?;
+        let bump = suggest_version_bump(&commits);
+        let latest = get_latest_version(repo, prefix)?.unwrap_or_else(|| Version::new(0, 0, 0));
+        let version = bump_version(&latest, bump, None);
+        let tag_name = format!("{}{}", prefix, version);
+
+        println!(
+            "{} {:?} → {}",
+            messages.suggested_bump(),
+            bump,
+            tag_name.cyan()
+        );
+
+        if !self.yes {
+            let confirm = Confirm::new()
+                .with_prompt(messages.use_this_version())
+                .default(true)
+                .interact()?;
+
+            if !confirm {
+                // Fall through to interactive version selection
+                return self
+                    .select_version_interactive(repo, prefix, messages)
+                    .await;
+            }
+        }
+
+        Ok(tag_name)
+    }
+
     fn input_message_interactive(&self, version: &str, messages: &Messages) -> Result<String> {
         let default_msg = format!("Release {}", version);
 

src/config/manager.rs

@@ -386,6 +386,22 @@ impl ConfigManager {
         self.config.repo_profiles.get(repo_path)
     }
 
+    /// Find profiles whose repo_patterns match the given repo path
+    pub fn match_profiles_by_repo_pattern(&self, repo_path: &str) -> Vec<&GitProfile> {
+        self.config
+            .profiles
+            .values()
+            .filter(|p| {
+                p.settings.repo_patterns.iter().any(|pattern| {
+                    let trimmed = pattern.trim_matches('*');
+                    repo_path.ends_with(trimmed)
+                        || repo_path.starts_with(trimmed)
+                        || repo_path == trimmed
+                })
+            })
+            .collect()
+    }
+
     // LLM configuration
 
     /// Get LLM provider

src/config/mod.rs

@@ -17,10 +17,11 @@ pub struct AppConfig {
     pub version: String,
 
     /// Default profile name
+    #[serde(skip_serializing_if = "Option::is_none")]
     pub default_profile: Option<String>,
 
     /// All configured profiles
-    #[serde(default)]
+    #[serde(default, skip_serializing_if = "HashMap::is_empty")]
     pub profiles: HashMap<String, GitProfile>,
 
     /// LLM configuration
@@ -40,17 +41,9 @@ pub struct AppConfig {
     pub changelog: ChangelogConfig,
 
     /// Repository-specific profile mappings
-    #[serde(default)]
+    #[serde(default, skip_serializing_if = "HashMap::is_empty")]
     pub repo_profiles: HashMap<String, String>,
 
-    /// Whether to encrypt sensitive data
-    #[serde(default = "default_true")]
-    pub encrypt_sensitive: bool,
-
-    /// Theme settings
-    #[serde(default)]
-    pub theme: ThemeConfig,
-
     /// Language settings
     #[serde(default)]
     pub language: LanguageConfig,
@@ -67,8 +60,6 @@ impl Default for AppConfig {
             tag: TagConfig::default(),
             changelog: ChangelogConfig::default(),
             repo_profiles: HashMap::new(),
-            encrypt_sensitive: true,
-            theme: ThemeConfig::default(),
             language: LanguageConfig::default(),
         }
     }
@@ -81,11 +72,12 @@ pub struct LlmConfig {
     #[serde(default = "default_llm_provider")]
     pub provider: String,
 
-    /// Model to use (stored in config, not in keyring)
+    /// Model to use
     #[serde(default = "default_model")]
     pub model: String,
 
     /// API base URL (optional, will use provider default if not set)
+    #[serde(skip_serializing_if = "Option::is_none")]
     pub base_url: Option<String>,
 
     /// Maximum tokens for generation
@@ -104,8 +96,8 @@ pub struct LlmConfig {
     #[serde(default = "default_api_key_storage")]
     pub api_key_storage: String,
 
-    /// API key (stored in config for fallback, encrypted if encrypt_sensitive is true)
-    #[serde(default)]
+    /// API key (stored in config for fallback)
+    #[serde(default, skip_serializing_if = "Option::is_none")]
     pub api_key: Option<String>,
 
     /// Enable thinking/reasoning mode (deepseek, kimi, anthropic)
@@ -113,7 +105,7 @@ pub struct LlmConfig {
     pub thinking_enabled: bool,
 
     /// Budget tokens for thinking mode (Anthropic Claude 4)
-    #[serde(default)]
+    #[serde(default, skip_serializing_if = "Option::is_none")]
     pub thinking_budget_tokens: Option<u32>,
 }
 
@@ -148,33 +140,6 @@ pub struct CommitConfig {
     /// Enable AI generation by default
     #[serde(default = "default_true")]
     pub auto_generate: bool,
-
-    /// Allow empty commits
-    #[serde(default)]
-    pub allow_empty: bool,
-
-    /// Sign commits with GPG
-    #[serde(default)]
-    pub gpg_sign: bool,
-
-    /// Default scope (optional)
-    pub default_scope: Option<String>,
-
-    /// Maximum subject length
-    #[serde(default = "default_max_subject_length")]
-    pub max_subject_length: usize,
-
-    /// Require scope
-    #[serde(default)]
-    pub require_scope: bool,
-
-    /// Require body for certain types
-    #[serde(default)]
-    pub require_body: bool,
-
-    /// Types that require body
-    #[serde(default = "default_body_required_types")]
-    pub body_required_types: Vec<String>,
 }
 
 impl Default for CommitConfig {
@@ -182,13 +147,6 @@ impl Default for CommitConfig {
         Self {
             format: default_commit_format(),
             auto_generate: true,
-            allow_empty: false,
-            gpg_sign: false,
-            default_scope: None,
-            max_subject_length: default_max_subject_length(),
-            require_scope: false,
-            require_body: false,
-            body_required_types: default_body_required_types(),
         }
     }
 }
@@ -220,18 +178,6 @@ pub struct TagConfig {
     /// Enable AI generation for tag messages
     #[serde(default = "default_true")]
     pub auto_generate: bool,
-
-    /// Sign tags with GPG
-    #[serde(default)]
-    pub gpg_sign: bool,
-
-    /// Include changelog in annotated tags
-    #[serde(default = "default_true")]
-    pub include_changelog: bool,
-
-    /// Default annotation template
-    #[serde(default)]
-    pub annotation_template: Option<String>,
 }
 
 impl Default for TagConfig {
@@ -239,9 +185,6 @@ impl Default for TagConfig {
         Self {
             version_prefix: default_version_prefix(),
             auto_generate: true,
-            gpg_sign: false,
-            include_changelog: true,
-            annotation_template: None,
         }
     }
 }
@@ -256,26 +199,6 @@ pub struct ChangelogConfig {
     /// Enable AI generation for changelog entries
     #[serde(default = "default_true")]
     pub auto_generate: bool,
-
-    /// Changelog format
-    #[serde(default = "default_changelog_format")]
-    pub format: ChangelogFormat,
-
-    /// Include commit hashes
-    #[serde(default)]
-    pub include_hashes: bool,
-
-    /// Include authors
-    #[serde(default)]
-    pub include_authors: bool,
-
-    /// Group by type
-    #[serde(default = "default_true")]
-    pub group_by_type: bool,
-
-    /// Custom categories
-    #[serde(default)]
-    pub custom_categories: Vec<ChangelogCategory>,
 }
 
 impl Default for ChangelogConfig {
@@ -283,56 +206,6 @@ impl Default for ChangelogConfig {
         Self {
             path: default_changelog_path(),
             auto_generate: true,
-            format: default_changelog_format(),
-            include_hashes: false,
-            include_authors: false,
-            group_by_type: true,
-            custom_categories: vec![],
-        }
-    }
-}
-
-/// Changelog format
-#[derive(Debug, Clone, Copy, Serialize, Deserialize, PartialEq, Eq)]
-#[serde(rename_all = "kebab-case")]
-pub enum ChangelogFormat {
-    KeepAChangelog,
-    GitHubReleases,
-    Custom,
-}
-
-/// Changelog category mapping
-#[derive(Debug, Clone, Serialize, Deserialize)]
-pub struct ChangelogCategory {
-    /// Category title
-    pub title: String,
-
-    /// Commit types included in this category
-    pub types: Vec<String>,
-}
-
-/// Theme configuration
-#[derive(Debug, Clone, Serialize, Deserialize)]
-pub struct ThemeConfig {
-    /// Enable colors
-    #[serde(default = "default_true")]
-    pub colors: bool,
-
-    /// Enable icons
-    #[serde(default = "default_true")]
-    pub icons: bool,
-
-    /// Preferred date format
-    #[serde(default = "default_date_format")]
-    pub date_format: String,
-}
-
-impl Default for ThemeConfig {
-    fn default() -> Self {
-        Self {
-            colors: true,
-            icons: true,
-            date_format: default_date_format(),
         }
     }
 }
@@ -415,6 +288,7 @@ impl Language {
 }
 
 // Default value functions
+
 fn default_version() -> String {
     "1".to_string()
 }
@@ -447,14 +321,6 @@ fn default_commit_format() -> CommitFormat {
     CommitFormat::Conventional
 }
 
-fn default_max_subject_length() -> usize {
-    100
-}
-
-fn default_body_required_types() -> Vec<String> {
-    vec!["feat".to_string(), "fix".to_string()]
-}
-
 fn default_version_prefix() -> String {
     "v".to_string()
 }
@@ -463,14 +329,6 @@ fn default_changelog_path() -> String {
     "CHANGELOG.md".to_string()
 }
 
-fn default_changelog_format() -> ChangelogFormat {
-    ChangelogFormat::KeepAChangelog
-}
-
-fn default_date_format() -> String {
-    "%Y-%m-%d".to_string()
-}
-
 fn default_output_language() -> String {
     "en".to_string()
 }
@@ -509,21 +367,6 @@ impl AppConfig {
         let config_dir = dirs::config_dir().context("Could not find config directory")?;
         Ok(config_dir.join("quicommit").join("config.toml"))
     }
-
-    // /// Get profile for a repository
-    // pub fn get_profile_for_repo(&self, repo_path: &str) -> Option<&GitProfile> {
-    //     let profile_name = self.repo_profiles.get(repo_path)?;
-    //     self.profiles.get(profile_name)
-    // }
-
-    // /// Set profile for a repository
-    // pub fn set_profile_for_repo(&mut self, repo_path: String, profile_name: String) -> Result<()> {
-    //     if !self.profiles.contains_key(&profile_name) {
-    //         anyhow::bail!("Profile '{}' does not exist", profile_name);
-    //     }
-    //     self.repo_profiles.insert(repo_path, profile_name);
-    //     Ok(())
-    // }
 }
 
 /// Encrypted PAT data for export

src/config/profile.rs

@@ -124,6 +124,11 @@ impl GitProfile {
             .or_else(|| self.gpg.as_ref().map(|g| g.key_id.as_str()))
     }
 
+    /// Get the commit template if set
+    pub fn commit_template(&self) -> Option<&str> {
+        self.settings.commit_template.as_deref()
+    }
+
     /// Add a token to the profile
     pub fn add_token(&mut self, service: String, token: TokenConfig) {
         self.tokens.insert(service, token);
@@ -159,78 +164,120 @@ impl GitProfile {
     pub fn apply_to_repo(&self, repo: &git2::Repository) -> Result<()> {
         let mut config = repo.config()?;
 
+        // Clean up old managed keys that the new profile won't set
+        if self.ssh.as_ref().and_then(|s| s.git_ssh_command()).is_none() {
+            let _ = config.remove("core.sshCommand");
+        }
+        if self.signing_key().is_none() {
+            let _ = config.remove("user.signingkey");
+            let _ = config.remove("commit.gpgsign");
+            let _ = config.remove("tag.gpgsign");
+        }
+        if self.gpg.is_none() {
+            let _ = config.remove("gpg.program");
+        }
+
+        // Apply new values; track whether we've written past name/email for rollback
+        let mut wrote_optional = false;
+        let result = (|| -> Result<()> {
             config.set_str("user.name", &self.user_name)?;
             config.set_str("user.email", &self.user_email)?;
 
+            if let Some(ref gpg) = self.gpg {
+                config.set_str("gpg.program", &gpg.program)?;
+                wrote_optional = true;
+            }
+
             if let Some(key) = self.signing_key() {
                 config.set_str("user.signingkey", key)?;
-
                 if self.settings.auto_sign_commits {
                     config.set_bool("commit.gpgsign", true)?;
                 }
-
                 if self.settings.auto_sign_tags {
                     config.set_bool("tag.gpgsign", true)?;
                 }
+                wrote_optional = true;
             }
 
-        if let Some(ref ssh) = self.ssh
-            && let Some(ref key_path) = ssh.private_key_path
-        {
-            let path_str = key_path.display().to_string();
-            #[cfg(target_os = "windows")]
-            {
-                config.set_str(
-                    "core.sshCommand",
-                    &format!("ssh -i \"{}\"", path_str.replace('\\', "/")),
-                )?;
-            }
-            #[cfg(not(target_os = "windows"))]
-            {
-                config.set_str("core.sshCommand", &format!("ssh -i '{}'", path_str))?;
+            if let Some(ref ssh) = self.ssh {
+                if let Some(ssh_cmd) = ssh.git_ssh_command() {
+                    config.set_str("core.sshCommand", &ssh_cmd)?;
+                    wrote_optional = true;
                 }
             }
 
             Ok(())
+        })();
+
+        if result.is_err() && wrote_optional {
+            let _ = config.remove("core.sshCommand");
+            let _ = config.remove("user.signingkey");
+            let _ = config.remove("commit.gpgsign");
+            let _ = config.remove("tag.gpgsign");
+            let _ = config.remove("gpg.program");
+        }
+
+        result
     }
 
     /// Apply this profile globally
     pub fn apply_global(&self) -> Result<()> {
         let mut config = git2::Config::open_default()?;
 
+        // Clean up old managed keys that the new profile won't set
+        if self.ssh.as_ref().and_then(|s| s.git_ssh_command()).is_none() {
+            let _ = config.remove("core.sshCommand");
+        }
+        if self.signing_key().is_none() {
+            let _ = config.remove("user.signingkey");
+            let _ = config.remove("commit.gpgsign");
+            let _ = config.remove("tag.gpgsign");
+        }
+        if self.gpg.is_none() {
+            let _ = config.remove("gpg.program");
+        }
+
+        // Apply new values; track whether we've written past name/email for rollback
+        let mut wrote_optional = false;
+        let result = (|| -> Result<()> {
             config.set_str("user.name", &self.user_name)?;
             config.set_str("user.email", &self.user_email)?;
 
+            if let Some(ref gpg) = self.gpg {
+                config.set_str("gpg.program", &gpg.program)?;
+                wrote_optional = true;
+            }
+
             if let Some(key) = self.signing_key() {
                 config.set_str("user.signingkey", key)?;
-
                 if self.settings.auto_sign_commits {
                     config.set_bool("commit.gpgsign", true)?;
                 }
-
                 if self.settings.auto_sign_tags {
                     config.set_bool("tag.gpgsign", true)?;
                 }
+                wrote_optional = true;
             }
 
-        if let Some(ref ssh) = self.ssh
-            && let Some(ref key_path) = ssh.private_key_path
-        {
-            let path_str = key_path.display().to_string();
-            #[cfg(target_os = "windows")]
-            {
-                config.set_str(
-                    "core.sshCommand",
-                    &format!("ssh -i \"{}\"", path_str.replace('\\', "/")),
-                )?;
-            }
-            #[cfg(not(target_os = "windows"))]
-            {
-                config.set_str("core.sshCommand", &format!("ssh -i '{}'", path_str))?;
+            if let Some(ref ssh) = self.ssh {
+                if let Some(ssh_cmd) = ssh.git_ssh_command() {
+                    config.set_str("core.sshCommand", &ssh_cmd)?;
+                    wrote_optional = true;
                 }
             }
 
             Ok(())
+        })();
+
+        if result.is_err() && wrote_optional {
+            let _ = config.remove("core.sshCommand");
+            let _ = config.remove("user.signingkey");
+            let _ = config.remove("commit.gpgsign");
+            let _ = config.remove("tag.gpgsign");
+            let _ = config.remove("gpg.program");
+        }
+
+        result
     }
 
     /// Compare with current git configuration
@@ -349,25 +396,72 @@ impl SshConfig {
             bail!("SSH public key does not exist: {:?}", path);
         }
 
+        if let Some(ref path) = self.known_hosts_file
+            && !path.exists()
+        {
+            bail!("SSH known_hosts file does not exist: {:?}", path);
+        }
+
         Ok(())
     }
 
-    /// Get SSH command for git
+    /// Get the effective public key path, deriving from private key if not explicitly set
+    pub fn effective_public_key_path(&self) -> Option<std::path::PathBuf> {
+        self.public_key_path.clone().or_else(|| {
+            self.private_key_path.as_ref().map(|pk| {
+                let mut pub_path = pk.clone();
+                let ext = pk
+                    .extension()
+                    .map(|e| format!("{}.pub", e.to_string_lossy()))
+                    .unwrap_or_else(|| "pub".to_string());
+                pub_path.set_extension(&ext);
+                pub_path
+            })
+        })
+    }
+
+    /// Get the effective SSH command for git config
+    ///
+    /// Priority: custom `ssh_command` > constructed from key/agent/known_hosts
     pub fn git_ssh_command(&self) -> Option<String> {
         if let Some(ref cmd) = self.ssh_command {
-            Some(cmd.clone())
-        } else if let Some(ref key_path) = self.private_key_path {
+            return Some(cmd.clone());
+        }
+
+        let mut parts: Vec<String> = vec!["ssh".to_string()];
+
+        if self.agent_forwarding {
+            parts.push("-A".to_string());
+        }
+
+        if let Some(ref key_path) = self.private_key_path {
             let path_str = key_path.display().to_string();
             #[cfg(target_os = "windows")]
             {
-                Some(format!("ssh -i \"{}\"", path_str.replace('\\', "/")))
+                parts.push(format!("-i \"{}\"", path_str.replace('\\', "/")));
             }
             #[cfg(not(target_os = "windows"))]
             {
-                Some(format!("ssh -i '{}'", path_str))
+                parts.push(format!("-i '{}'", path_str));
             }
-        } else {
+        }
+
+        if let Some(ref known_hosts) = self.known_hosts_file {
+            let kh_str = known_hosts.display().to_string();
+            #[cfg(target_os = "windows")]
+            {
+                parts.push(format!("-o UserKnownHostsFile=\"{}\"", kh_str.replace('\\', "/")));
+            }
+            #[cfg(not(target_os = "windows"))]
+            {
+                parts.push(format!("-o UserKnownHostsFile='{}'", kh_str));
+            }
+        }
+
+        if parts.len() == 1 {
             None
+        } else {
+            Some(parts.join(" "))
         }
     }
 }

src/generator/mod.rs

@@ -7,16 +7,21 @@ use anyhow::{Context, Result};
 /// Content generator using LLM
 pub struct ContentGenerator {
     llm_client: LlmClient,
+    template: Option<String>,
 }
 
 impl ContentGenerator {
     /// Create new content generator
     pub async fn new(manager: &ConfigManager) -> Result<Self> {
-        Self::new_with_think(manager, false).await
+        Self::new_with_think(manager, false, None).await
     }
 
-    /// Create new content generator with thinking override
-    pub async fn new_with_think(manager: &ConfigManager, think_override: bool) -> Result<Self> {
+    /// Create new content generator with thinking override and optional commit template
+    pub async fn new_with_think(
+        manager: &ConfigManager,
+        think_override: bool,
+        template: Option<String>,
+    ) -> Result<Self> {
         let mut thinking_enabled = if think_override {
             true
         } else {
@@ -42,7 +47,10 @@ impl ContentGenerator {
             anyhow::bail!("LLM provider '{}' is not available", manager.llm_provider());
         }
 
-        Ok(Self { llm_client })
+        Ok(Self {
+            llm_client,
+            template,
+        })
     }
 
     fn supports_thinking(provider: &str) -> bool {
@@ -66,7 +74,7 @@ impl ContentGenerator {
         };
 
         self.llm_client
-            .generate_commit_message(&truncated_diff, format, language)
+            .generate_commit_message(&truncated_diff, format, language, self.template.as_deref())
             .await
     }
 

src/git/changelog.rs

@@ -409,8 +409,8 @@ pub fn generate_from_history(
     if let Some(from) = from_tag {
         repo.get_commits_between(from, to_ref)
     } else {
-        // Get last 50 commits if no tag specified
-        repo.get_commits(50)
+        // Get all commits from the beginning (no from_tag = initial changelog)
+        repo.get_commits(usize::MAX)
     }
 }
 
@@ -476,3 +476,137 @@ impl ChangelogEntry {
         self
     }
 }
+
+/// Extract version strings from Keep a Changelog content.
+/// Returns versions sorted by semver descending (highest first).
+/// Excludes "Unreleased".
+pub fn parse_changelog_versions(content: &str) -> Vec<String> {
+    use semver::Version;
+
+    let mut versions: Vec<String> = vec![];
+    for line in content.lines() {
+        let trimmed = line.trim();
+        if trimmed.starts_with("## [") {
+            if let Some(end) = trimmed.find(']') {
+                let version = &trimmed[4..end];
+                if version != "Unreleased" && !version.is_empty() {
+                    versions.push(version.to_string());
+                }
+            }
+        }
+    }
+    // Sort by semver descending so highest version is first
+    versions.sort_by(|a, b| {
+        match (Version::parse(a), Version::parse(b)) {
+            (Ok(va), Ok(vb)) => vb.cmp(&va),
+            (Ok(_), Err(_)) => std::cmp::Ordering::Less,
+            (Err(_), Ok(_)) => std::cmp::Ordering::Greater,
+            (Err(_), Err(_)) => std::cmp::Ordering::Equal,
+        }
+    });
+    versions
+}
+
+/// Insert a new changelog entry into existing changelog content.
+/// The new entry is placed after the header and before the first existing version section.
+/// If no existing version sections are found, the new entry is appended after the header.
+pub fn insert_changelog_entry(existing: &str, new_entry: &str) -> String {
+    // Find the first version section (## [x.y.z])
+    if let Some(first_ver_pos) = existing.find("\n## [") {
+        let (header, rest) = existing.split_at(first_ver_pos);
+        // Ensure new_entry ends with a blank line before the next section
+        let entry = new_entry.trim_end();
+        format!("{}\n{}\n{}", header.trim_end(), entry, rest)
+    } else {
+        // No existing version sections — append after header
+        format!("{}\n{}", existing.trim_end(), new_entry.trim_end())
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn test_parse_changelog_versions_extracts_versions() {
+        let content = "# Changelog\n\n## [0.2.0] - 2024-03-01\n### Added\n- feature B\n\n## [0.1.0] - 2024-02-01\n### Added\n- feature A\n";
+        let versions = parse_changelog_versions(content);
+        assert_eq!(versions, vec!["0.2.0", "0.1.0"]);
+    }
+
+    #[test]
+    fn test_parse_changelog_versions_sorts_highest_first() {
+        // Versions in reversed order — should still return highest first
+        let content = "# Changelog\n\n## [0.1.0] - 2024-02-01\n### Added\n- feature A\n\n## [0.3.0] - 2024-04-01\n### Added\n- feature C\n\n## [0.2.0] - 2024-03-01\n### Added\n- feature B\n";
+        let versions = parse_changelog_versions(content);
+        assert_eq!(versions, vec!["0.3.0", "0.2.0", "0.1.0"]);
+    }
+
+    #[test]
+    fn test_parse_changelog_versions_excludes_unreleased() {
+        let content = "# Changelog\n\n## [Unreleased]\n### Added\n- wip\n\n## [0.1.0] - 2024-02-01\n### Added\n- feature A\n";
+        let versions = parse_changelog_versions(content);
+        assert_eq!(versions, vec!["0.1.0"]);
+    }
+
+    #[test]
+    fn test_parse_changelog_versions_empty_content() {
+        let versions = parse_changelog_versions("");
+        assert!(versions.is_empty());
+    }
+
+    #[test]
+    fn test_parse_changelog_versions_no_versions() {
+        let content = "# Changelog\n\nSome description text.\n";
+        let versions = parse_changelog_versions(content);
+        assert!(versions.is_empty());
+    }
+
+    #[test]
+    fn test_insert_changelog_entry_between_header_and_existing() {
+        let existing = "# Changelog\n\nAll notable changes...\n\n## [0.1.0] - 2024-02-01\n### Added\n- feature A\n";
+        let new_entry = "## [0.2.0] - 2024-03-01\n### Added\n- feature B\n";
+        let result = insert_changelog_entry(existing, new_entry);
+
+        // New entry should appear after header, before 0.1.0
+        assert!(result.contains("## [0.2.0]"));
+        assert!(result.contains("## [0.1.0]"));
+        let pos_new = result.find("## [0.2.0]").unwrap();
+        let pos_old = result.find("## [0.1.0]").unwrap();
+        assert!(pos_new < pos_old, "new version should be before old version");
+    }
+
+    #[test]
+    fn test_insert_changelog_entry_preserves_all_existing_content() {
+        let existing = "# Changelog\n\nAll notable changes...\n\n## [0.2.0] - 2024-03-01\n### Added\n- feature B\n\n## [0.1.0] - 2024-02-01\n### Added\n- feature A\n";
+        let new_entry = "## [0.3.0] - 2024-04-01\n### Added\n- feature C\n";
+        let result = insert_changelog_entry(existing, new_entry);
+
+        assert!(result.contains("## [0.3.0]"));
+        assert!(result.contains("## [0.2.0]"));
+        assert!(result.contains("## [0.1.0]"));
+        assert!(result.contains("feature A"), "oldest content preserved");
+        assert!(result.contains("feature B"), "middle content preserved");
+        assert!(result.contains("feature C"), "new content present");
+    }
+
+    #[test]
+    fn test_insert_changelog_entry_empty_existing() {
+        let existing = "# Changelog\n\nAll notable changes...\n\n";
+        let new_entry = "## [0.1.0] - 2024-02-01\n### Added\n- feature A\n";
+        let result = insert_changelog_entry(existing, new_entry);
+        assert!(result.contains("## [0.1.0]"));
+        assert!(result.contains("# Changelog"));
+    }
+
+    #[test]
+    fn test_insert_changelog_entry_extra_blank_lines_in_header() {
+        let existing = "# Changelog\n\n\n\n## [0.1.0] - 2024-02-01\n### Added\n- feature A\n";
+        let new_entry = "## [0.2.0] - 2024-03-01\n### Added\n- feature B\n";
+        let result = insert_changelog_entry(existing, new_entry);
+
+        let pos_new = result.find("## [0.2.0]").unwrap();
+        let pos_old = result.find("## [0.1.0]").unwrap();
+        assert!(pos_new < pos_old, "new version should be before old version");
+    }
+}

src/git/mod.rs

@@ -533,27 +533,116 @@ impl GitRepo {
         Ok(files)
     }
 
-    /// Stage files
-    pub fn stage_files<P: AsRef<Path>>(&self, paths: &[P]) -> Result<()> {
+    /// Stage files, skipping paths matched by .gitignore rules
+    /// Returns the list of skipped paths (those matched by .gitignore)
+    pub fn stage_files<P: AsRef<Path>>(&self, paths: &[P]) -> Result<Vec<String>> {
         let mut index = self.repo.index()?;
+        let mut skipped = Vec::new();
 
         for path in paths {
             let path = path.as_ref();
-            if path.is_absolute() {
-                if let Ok(rel_path) = path.strip_prefix(&self.path) {
-                    index.add_path(rel_path)?;
+            let rel_path = if path.is_absolute() {
+                match path.strip_prefix(&self.path) {
+                    Ok(p) => p,
+                    Err(_) => {
+                        // Outside repo, skip
+                        skipped.push(path.to_string_lossy().to_string());
+                        continue;
+                    }
                 }
             } else {
-                index.add_path(path)?;
+                path
+            };
+
+            // Check if the path is ignored by .gitignore
+            if self.is_path_ignored(rel_path)? {
+                skipped.push(rel_path.to_string_lossy().to_string());
+                continue;
             }
+
+            index.add_path(rel_path)?;
         }
 
         index.write()?;
-        Ok(())
+        Ok(skipped)
     }
 
-    /// Stage all changes including subdirectories
-    pub fn stage_all(&self) -> Result<()> {
+    /// Check if a path is ignored by .gitignore rules
+    pub fn is_path_ignored<P: AsRef<Path>>(&self, path: P) -> Result<bool> {
+        let path = path.as_ref();
+
+        // Convert to relative path if absolute
+        let rel_path = if path.is_absolute() {
+            match path.strip_prefix(&self.path) {
+                Ok(p) => p,
+                Err(_) => return Ok(false), // Outside repo, not ignored
+            }
+        } else {
+            path
+        };
+
+        let path_str = match rel_path.to_str() {
+            Some(s) => s,
+            None => return Ok(false), // Non-UTF8 path, not ignored
+        };
+
+        let output = std::process::Command::new("git")
+            .args(["check-ignore", "--quiet", "--", path_str])
+            .current_dir(&self.path)
+            .output()?;
+
+        // Exit code 0: ignored, 1: not ignored, other: error
+        match output.status.code() {
+            Some(0) => Ok(true),
+            Some(1) => Ok(false),
+            _ => Ok(false), // Treat errors as not ignored
+        }
+    }
+
+    /// Remove files from index that are tracked but should be ignored by .gitignore
+    pub fn remove_ignored_from_index(&self) -> Result<Vec<String>> {
+        let output = std::process::Command::new("git")
+            .args(["ls-files", "--cached", "-i", "--exclude-standard"])
+            .current_dir(&self.path)
+            .output()?;
+
+        if !output.status.success() {
+            let stderr = String::from_utf8_lossy(&output.stderr);
+            bail!("Failed to list ignored tracked files: {}", stderr);
+        }
+
+        let stdout = String::from_utf8_lossy(&output.stdout);
+        let ignored_files: Vec<String> = stdout
+            .lines()
+            .map(|l| l.trim().to_string())
+            .filter(|l| !l.is_empty())
+            .collect();
+
+        if ignored_files.is_empty() {
+            return Ok(Vec::new());
+        }
+
+        // Remove these files from the index (keep working tree files)
+        let mut args = vec!["rm", "--cached", "--quiet", "--"];
+        for file in &ignored_files {
+            args.push(file);
+        }
+
+        let rm_output = std::process::Command::new("git")
+            .args(&args)
+            .current_dir(&self.path)
+            .output()?;
+
+        if !rm_output.status.success() {
+            let stderr = String::from_utf8_lossy(&rm_output.stderr);
+            bail!("Failed to remove ignored files from index: {}", stderr);
+        }
+
+        Ok(ignored_files)
+    }
+
+    /// Stage all changes including subdirectories, then remove ignored tracked files
+    pub fn stage_all(&self) -> Result<Vec<String>> {
         // Use git command for reliable staging (handles all edge cases)
         let output = std::process::Command::new("git")
             .args(["add", "-A"])
@@ -569,7 +658,14 @@ impl GitRepo {
         // Force refresh the git2 index to pick up changes from git CLI
         let _ = self.repo.index()?.write();
 
-        Ok(())
+        // Remove files that are tracked but should be ignored by .gitignore
+        match self.remove_ignored_from_index() {
+            Ok(removed) => Ok(removed),
+            Err(e) => {
+                eprintln!("Warning: failed to clean ignored files from index: {}", e);
+                Ok(Vec::new())
+            }
+        }
     }
 
     /// Unstage files
@@ -766,24 +862,34 @@ impl GitRepo {
             let name = String::from_utf8_lossy(name);
             let name = name.strip_prefix("refs/tags/").unwrap_or(&name);
 
-            if let Ok(commit) = self.repo.find_commit(oid) {
+            // Use find_object + peel_to_commit to handle both lightweight
+            // (oid is a commit) and annotated (oid is a tag object) tags.
+            if let Ok(obj) = self.repo.find_object(oid, None) {
+                if let Ok(commit) = obj.peel_to_commit() {
                     tags.push(TagInfo {
                         name: name.to_string(),
-                    target: oid.to_string(),
+                        target: commit.id().to_string(),
                         message: commit.message().unwrap_or("").to_string(),
                         time: commit.time().seconds(),
                     });
                 }
+            }
 
             true
         })?;
 
-        // Sort tags by time (newest first)
-        tags.sort_by(|a, b| b.time.cmp(&a.time));
+        // Sort tags by semver (descending), then by time
+        crate::git::tag::sort_tags_by_semver(&mut tags);
 
         Ok(tags)
     }
 
+    /// Find a tag whose version (stripping 'v' prefix) matches the given version string.
+    pub fn find_tag_by_version(&self, version: &str) -> Option<TagInfo> {
+        let tags = self.get_tags().ok()?;
+        tags.into_iter().find(|t| t.version_name() == version)
+    }
+
     /// Create a tag
     pub fn create_tag(&self, name: &str, message: Option<&str>, sign: bool) -> Result<()> {
         let head = self.repo.head()?;
@@ -975,6 +1081,13 @@ pub struct TagInfo {
     pub time: i64,
 }
 
+impl TagInfo {
+    /// Return the version portion of the tag name (stripping leading 'v' if present).
+    pub fn version_name(&self) -> &str {
+        self.name.strip_prefix('v').unwrap_or(&self.name)
+    }
+}
+
 /// Repository status summary
 #[derive(Debug, Clone)]
 pub struct StatusSummary {
@@ -1345,3 +1458,126 @@ pub struct ConfigDiff {
     pub left: String,
     pub right: String,
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use git2::Signature;
+    use tempfile::TempDir;
+
+    fn init_test_repo() -> (TempDir, GitRepo) {
+        let dir = TempDir::new().unwrap();
+        let repo = git2::Repository::init(dir.path()).unwrap();
+
+        // Configure git user
+        let mut config = repo.config().unwrap();
+        config.set_str("user.name", "Test User").unwrap();
+        config.set_str("user.email", "test@example.com").unwrap();
+
+        // Create an initial commit (needed for tags)
+        let sig = Signature::now("Test User", "test@example.com").unwrap();
+        let tree_id = {
+            let mut index = repo.index().unwrap();
+            index.write_tree().unwrap()
+        };
+        let tree = repo.find_tree(tree_id).unwrap();
+        repo.commit(Some("HEAD"), &sig, &sig, "initial commit", &tree, &[])
+            .unwrap();
+
+        let git_repo = GitRepo::open(dir.path()).unwrap();
+        (dir, git_repo)
+    }
+
+    #[test]
+    fn test_get_tags_returns_annotated_tags() {
+        let (_dir, repo) = init_test_repo();
+        let sig = Signature::now("Test User", "test@example.com").unwrap();
+        let head = repo.repo.head().unwrap().peel_to_commit().unwrap();
+
+        // Create an annotated tag (what QuiCommit creates by default)
+        repo.repo
+            .tag("v0.2.0", head.as_object(), &sig, "Release v0.2.0", false)
+            .unwrap();
+
+        let tags = repo.get_tags().unwrap();
+        let tag_names: Vec<&str> = tags.iter().map(|t| t.name.as_str()).collect();
+
+        assert!(
+            tag_names.contains(&"v0.2.0"),
+            "annotated tag v0.2.0 should appear in tags list, got: {:?}",
+            tag_names
+        );
+    }
+
+    #[test]
+    fn test_get_tags_returns_lightweight_tags() {
+        let (_dir, repo) = init_test_repo();
+        let head = repo.repo.head().unwrap().peel_to_commit().unwrap();
+
+        // Create a lightweight tag
+        repo.repo.tag("v0.1.0", head.as_object(), &repo.repo.signature().unwrap(), "", false)
+            .unwrap();
+
+        let tags = repo.get_tags().unwrap();
+        let tag_names: Vec<&str> = tags.iter().map(|t| t.name.as_str()).collect();
+
+        assert!(
+            tag_names.contains(&"v0.1.0"),
+            "lightweight tag v0.1.0 should appear in tags list, got: {:?}",
+            tag_names
+        );
+    }
+
+    #[test]
+    fn test_get_tags_returns_mixed_annotated_and_lightweight() {
+        let (_dir, repo) = init_test_repo();
+        let sig = Signature::now("Test User", "test@example.com").unwrap();
+        let head = repo.repo.head().unwrap().peel_to_commit().unwrap();
+
+        // Create annotated tag
+        repo.repo
+            .tag("v0.2.0", head.as_object(), &sig, "annotated", false)
+            .unwrap();
+
+        // Create lightweight tag
+        repo.repo
+            .tag("v0.1.0", head.as_object(), &repo.repo.signature().unwrap(), "", false)
+            .unwrap();
+
+        let tags = repo.get_tags().unwrap();
+        let tag_names: Vec<&str> = tags.iter().map(|t| t.name.as_str()).collect();
+
+        assert!(
+            tag_names.contains(&"v0.2.0"),
+            "annotated tag should be present, got: {:?}",
+            tag_names
+        );
+        assert!(
+            tag_names.contains(&"v0.1.0"),
+            "lightweight tag should be present, got: {:?}",
+            tag_names
+        );
+        assert_eq!(tags.len(), 2, "should have exactly 2 tags");
+    }
+
+    #[test]
+    fn test_get_tags_target_points_to_commit_not_tag_object() {
+        let (_dir, repo) = init_test_repo();
+        let sig = Signature::now("Test User", "test@example.com").unwrap();
+        let head = repo.repo.head().unwrap().peel_to_commit().unwrap();
+        let expected_commit_id = head.id().to_string();
+
+        // Create annotated tag
+        repo.repo
+            .tag("v0.2.0", head.as_object(), &sig, "annotated", false)
+            .unwrap();
+
+        let tags = repo.get_tags().unwrap();
+        let tag = tags.iter().find(|t| t.name == "v0.2.0").unwrap();
+
+        assert_eq!(
+            tag.target, expected_commit_id,
+            "tag.target should be the commit OID, not the tag object OID"
+        );
+    }
+}

src/git/tag.rs

@@ -1,6 +1,7 @@
 use super::GitRepo;
 use anyhow::{Result, bail};
 use semver::Version;
+use std::path::Path;
 
 /// Tag builder for creating tags
 pub struct TagBuilder {
@@ -327,3 +328,193 @@ pub fn list_tags(
         Ok(filtered)
     }
 }
+
+/// Sort tags by semver version descending, then by time descending.
+/// Non-semver tags are placed after semver tags, sorted by time descending.
+pub fn sort_tags_by_semver(tags: &mut [super::TagInfo]) {
+    use semver::Version;
+
+    tags.sort_by(|a, b| {
+        match (
+            Version::parse(a.version_name()),
+            Version::parse(b.version_name()),
+        ) {
+            (Ok(va), Ok(vb)) => {
+                // Both semver: version descending, then time descending as tiebreaker
+                vb.cmp(&va).then_with(|| b.time.cmp(&a.time))
+            }
+            (Ok(_), Err(_)) => std::cmp::Ordering::Less,   // semver tags first
+            (Err(_), Ok(_)) => std::cmp::Ordering::Greater, // semver tags first
+            (Err(_), Err(_)) => b.time.cmp(&a.time),        // both non-semver: time descending
+        }
+    });
+}
+
+/// Read the project version from Cargo.toml or pyproject.toml.
+/// Returns None if no project config file is found or version cannot be read.
+pub fn read_project_version(project_dir: &Path) -> Option<Version> {
+    // Try Cargo.toml first
+    let cargo_path = project_dir.join("Cargo.toml");
+    if cargo_path.exists() {
+        if let Ok(content) = std::fs::read_to_string(&cargo_path) {
+            if let Ok(value) = content.parse::<toml::Value>() {
+                if let Some(version) = value
+                    .get("package")
+                    .and_then(|p| p.get("version"))
+                    .and_then(|v| v.as_str())
+                {
+                    if let Ok(ver) = Version::parse(version) {
+                        return Some(ver);
+                    }
+                }
+            }
+        }
+    }
+
+    // Try pyproject.toml
+    let pyproject_path = project_dir.join("pyproject.toml");
+    if pyproject_path.exists() {
+        if let Ok(content) = std::fs::read_to_string(&pyproject_path) {
+            if let Ok(value) = content.parse::<toml::Value>() {
+                if let Some(version) = value
+                    .get("project")
+                    .and_then(|p| p.get("version"))
+                    .and_then(|v| v.as_str())
+                {
+                    if let Ok(ver) = Version::parse(version) {
+                        return Some(ver);
+                    }
+                }
+            }
+        }
+    }
+
+    None
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::git::TagInfo;
+
+    fn make_tag(name: &str, time: i64) -> TagInfo {
+        TagInfo {
+            name: name.to_string(),
+            target: "abc123".to_string(),
+            message: String::new(),
+            time,
+        }
+    }
+
+    #[test]
+    fn test_sort_by_semver_descending() {
+        let mut tags = vec![
+            make_tag("v1.0.0", 100),
+            make_tag("v2.0.0", 200),
+            make_tag("v1.5.0", 150),
+        ];
+        sort_tags_by_semver(&mut tags);
+        let names: Vec<&str> = tags.iter().map(|t| t.name.as_str()).collect();
+        assert_eq!(names, vec!["v2.0.0", "v1.5.0", "v1.0.0"]);
+    }
+
+    #[test]
+    fn test_sort_semver_ties_broken_by_time() {
+        let mut tags = vec![
+            make_tag("v1.0.0", 100),
+            make_tag("v1.0.0", 300),
+            make_tag("v1.0.0", 200),
+        ];
+        sort_tags_by_semver(&mut tags);
+        let times: Vec<i64> = tags.iter().map(|t| t.time).collect();
+        assert_eq!(times, vec![300, 200, 100]);
+    }
+
+    #[test]
+    fn test_sort_non_semver_tags_at_end() {
+        let mut tags = vec![
+            make_tag("release-2024", 400),
+            make_tag("v1.0.0", 100),
+            make_tag("staging", 300),
+            make_tag("v0.2.0", 200),
+        ];
+        sort_tags_by_semver(&mut tags);
+        let names: Vec<&str> = tags.iter().map(|t| t.name.as_str()).collect();
+        assert_eq!(names[0], "v1.0.0");
+        assert_eq!(names[1], "v0.2.0");
+        assert_eq!(names[2], "release-2024");
+        assert_eq!(names[3], "staging");
+    }
+
+    #[test]
+    fn test_sort_no_prefix_semver() {
+        let mut tags = vec![
+            make_tag("1.0.0", 100),
+            make_tag("2.0.0", 200),
+            make_tag("0.1.0", 50),
+        ];
+        sort_tags_by_semver(&mut tags);
+        let names: Vec<&str> = tags.iter().map(|t| t.name.as_str()).collect();
+        assert_eq!(names, vec!["2.0.0", "1.0.0", "0.1.0"]);
+    }
+
+    #[test]
+    fn test_sort_all_non_semver_by_time() {
+        let mut tags = vec![
+            make_tag("release-2024", 100),
+            make_tag("release-2023", 300),
+            make_tag("beta", 200),
+        ];
+        sort_tags_by_semver(&mut tags);
+        let times: Vec<i64> = tags.iter().map(|t| t.time).collect();
+        assert_eq!(times, vec![300, 200, 100]);
+    }
+
+    #[test]
+    fn test_read_project_version_from_cargo_toml() {
+        let dir = tempfile::TempDir::new().unwrap();
+        std::fs::write(
+            dir.path().join("Cargo.toml"),
+            "[package]\nname = \"test\"\nversion = \"0.3.0\"\n",
+        )
+        .unwrap();
+        let version = read_project_version(dir.path());
+        assert_eq!(version, Some(Version::new(0, 3, 0)));
+    }
+
+    #[test]
+    fn test_read_project_version_from_pyproject_toml() {
+        let dir = tempfile::TempDir::new().unwrap();
+        std::fs::write(
+            dir.path().join("pyproject.toml"),
+            "[project]\nname = \"test\"\nversion = \"0.2.1\"\n",
+        )
+        .unwrap();
+        let version = read_project_version(dir.path());
+        assert_eq!(version, Some(Version::new(0, 2, 1)));
+    }
+
+    #[test]
+    fn test_read_project_version_no_config_files() {
+        let dir = tempfile::TempDir::new().unwrap();
+        let version = read_project_version(dir.path());
+        assert_eq!(version, None);
+    }
+
+    #[test]
+    fn test_read_project_version_cargo_takes_priority() {
+        let dir = tempfile::TempDir::new().unwrap();
+        std::fs::write(
+            dir.path().join("Cargo.toml"),
+            "[package]\nname = \"test\"\nversion = \"0.3.0\"\n",
+        )
+        .unwrap();
+        std::fs::write(
+            dir.path().join("pyproject.toml"),
+            "[project]\nname = \"test\"\nversion = \"0.2.1\"\n",
+        )
+        .unwrap();
+        let version = read_project_version(dir.path());
+        assert_eq!(version, Some(Version::new(0, 3, 0)));
+    }
+}

src/lib.rs

@@ -0,0 +1,9 @@
+#![allow(dead_code)]
+
+pub mod commands;
+pub mod config;
+pub mod generator;
+pub mod git;
+pub mod i18n;
+pub mod llm;
+pub mod utils;

src/llm/mod.rs

@@ -201,8 +201,16 @@ impl LlmClient {
         diff: &str,
         format: crate::config::CommitFormat,
         language: Language,
+        template: Option<&str>,
     ) -> Result<GeneratedCommit> {
-        let system_prompt = get_commit_system_prompt(format, language);
+        let mut system_prompt = get_commit_system_prompt(format, language).to_string();
+
+        if let Some(tmpl) = template {
+            system_prompt.push_str(&format!(
+                "\n\n## Commit Message Template\nFollow this template structure:\n{}",
+                tmpl
+            ));
+        }
 
         // Add language instruction to the prompt
         let language_instruction = match language {
@@ -218,7 +226,7 @@ impl LlmClient {
         let prompt = format!("{}{}", diff, language_instruction);
         let response = self
             .provider
-            .generate_with_system(system_prompt, &prompt)
+            .generate_with_system(&system_prompt, &prompt)
             .await?;
 
         self.parse_commit_response(&response, format)

src/main.rs

@@ -5,17 +5,9 @@ use clap::{Parser, Subcommand};
 use std::path::PathBuf;
 use tracing::debug;
 
-mod commands;
-mod config;
-mod generator;
-mod git;
-mod i18n;
-mod llm;
-mod utils;
-
-use commands::{
-    changelog::ChangelogCommand, commit::CommitCommand, config::ConfigCommand, init::InitCommand,
-    profile::ProfileCommand, tag::TagCommand,
+use quicommit::commands::{
+    changelog::ChangelogCommand, commit::CommitCommand, config::ConfigCommand,
+    credential::CredentialCommand, init::InitCommand, profile::ProfileCommand, tag::TagCommand,
 };
 
 /// QuiCommit - AI-powered Git assistant
@@ -71,6 +63,10 @@ enum Commands {
     /// Manage configuration settings
     #[command(alias = "cfg")]
     Config(ConfigCommand),
+
+    /// Git credential helper (hidden, invoked by git)
+    #[command(hide = true)]
+    Credential(CredentialCommand),
 }
 
 #[tokio::main]
@@ -100,5 +96,6 @@ async fn main() -> Result<()> {
         Commands::Changelog(cmd) => cmd.execute(config_path).await,
         Commands::Profile(cmd) => cmd.execute(config_path).await,
         Commands::Config(cmd) => cmd.execute(config_path).await,
+        Commands::Credential(cmd) => cmd.execute(config_path).await,
     }
 }

src/utils/keyring.rs

@@ -150,11 +150,6 @@ impl KeyringManager {
             .set_password(token)
             .context("Failed to store PAT in keyring")?;
 
-        eprintln!(
-            "[DEBUG] PAT stored in keyring: service={}, user={}",
-            keyring_service, keyring_user
-        );
-
         Ok(())
     }
 
@@ -175,20 +170,8 @@ impl KeyringManager {
             .context("Failed to create keyring entry for PAT")?;
 
         match entry.get_password() {
-            Ok(token) => {
-                eprintln!(
-                    "[DEBUG] PAT retrieved from keyring: service={}, user={}",
-                    keyring_service, keyring_user
-                );
-                Ok(Some(token))
-            }
-            Err(keyring::Error::NoEntry) => {
-                eprintln!(
-                    "[DEBUG] PAT not found in keyring: service={}, user={}",
-                    keyring_service, keyring_user
-                );
-                Ok(None)
-            }
+            Ok(token) => Ok(Some(token)),
+            Err(keyring::Error::NoEntry) => Ok(None),
             Err(e) => Err(e.into()),
         }
     }
@@ -208,11 +191,6 @@ impl KeyringManager {
             .delete_credential()
             .context("Failed to delete PAT from keyring")?;
 
-        eprintln!(
-            "[DEBUG] PAT deleted from keyring: service={}, user={}",
-            keyring_service, keyring_user
-        );
-
         Ok(())
     }
 
@@ -229,12 +207,7 @@ impl KeyringManager {
         services: &[String],
     ) -> Result<()> {
         for service in services {
-            if let Err(e) = self.delete_pat(profile_name, user_email, service) {
-                eprintln!(
-                    "[DEBUG] Failed to delete PAT for service '{}': {}",
-                    service, e
-                );
-            }
+            let _ = self.delete_pat(profile_name, user_email, service);
         }
         Ok(())
     }

tests/config_export_import_tests.rs

@@ -126,31 +126,14 @@ api_key_storage = "keyring"
 [commit]
 format = "conventional"
 auto_generate = true
-allow_empty = false
-gpg_sign = false
-max_subject_length = 100
-require_scope = false
-require_body = false
-body_required_types = ["feat", "fix"]
 
 [tag]
 version_prefix = "v"
 auto_generate = true
-gpg_sign = false
-include_changelog = true
 
 [changelog]
 path = "CHANGELOG.md"
 auto_generate = true
-format = "keep-a-changelog"
-include_hashes = false
-include_authors = false
-group_by_type = true
-
-[theme]
-colors = true
-icons = true
-date_format = "%Y-%m-%d"
 
 [language]
 output_language = "en"

tests/gitignore_tests.rs

@@ -0,0 +1,266 @@
+use quicommit::git::GitRepo;
+use std::fs;
+use std::path::Path;
+use std::process::Command;
+use tempfile::TempDir;
+
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
+
+/// Run a git command in the given directory, returning stdout as a String.
+/// Panics if the command fails.
+fn git(dir: &Path, args: &[&str]) -> String {
+    let output = Command::new("git")
+        .args(args)
+        .current_dir(dir)
+        .output()
+        .expect("Failed to execute git command");
+    if !output.status.success() {
+        let stderr = String::from_utf8_lossy(&output.stderr);
+        panic!("git {:?} failed in {:?}: {}", args, dir, stderr);
+    }
+    String::from_utf8_lossy(&output.stdout).to_string()
+}
+
+/// Initialize a new git repo in the given directory and configure a local
+/// user identity so commits can be created.
+fn init_repo(dir: &Path) {
+    git(dir, &["init"]);
+    git(dir, &["config", "user.name", "Test User"]);
+    git(dir, &["config", "user.email", "test@example.com"]);
+    // Disable commit signing in case the global config enables it.
+    git(dir, &["config", "commit.gpgsign", "false"]);
+}
+
+/// Write a file with the given content, creating parent directories as needed.
+fn write_file(dir: &Path, rel_path: &str, content: &str) {
+    let file_path = dir.join(rel_path);
+    if let Some(parent) = file_path.parent() {
+        fs::create_dir_all(parent).expect("Failed to create parent directories");
+    }
+    fs::write(&file_path, content).expect("Failed to write file");
+}
+
+/// Get the list of files in the index as a String (one path per line).
+fn ls_files(dir: &Path) -> String {
+    git(dir, &["ls-files"])
+}
+
+// ---------------------------------------------------------------------------
+// Tests for is_path_ignored
+// ---------------------------------------------------------------------------
+
+#[test]
+fn test_is_path_ignored_with_ignored_path() {
+    let temp_dir = TempDir::new().unwrap();
+    let repo_path = temp_dir.path();
+    init_repo(repo_path);
+
+    write_file(repo_path, ".gitignore", "__pycache__/\n");
+    write_file(repo_path, "__pycache__/foo.pyc", "bytecode");
+    write_file(repo_path, "subdir/__pycache__/bar.pyc", "more bytecode");
+
+    let repo = GitRepo::open(repo_path).expect("Failed to open repo");
+
+    // Top-level ignored file
+    assert!(
+        repo.is_path_ignored("__pycache__/foo.pyc").unwrap(),
+        "__pycache__/foo.pyc should be ignored"
+    );
+
+    // Nested ignored file under a subdirectory
+    assert!(
+        repo.is_path_ignored("subdir/__pycache__/bar.pyc").unwrap(),
+        "subdir/__pycache__/bar.pyc should be ignored"
+    );
+}
+
+#[test]
+fn test_is_path_ignored_with_non_ignored_path() {
+    let temp_dir = TempDir::new().unwrap();
+    let repo_path = temp_dir.path();
+    init_repo(repo_path);
+
+    write_file(repo_path, ".gitignore", "__pycache__/\n");
+    write_file(repo_path, "src/main.rs", "fn main() {}");
+
+    let repo = GitRepo::open(repo_path).expect("Failed to open repo");
+
+    assert!(
+        !repo.is_path_ignored("src/main.rs").unwrap(),
+        "src/main.rs should not be ignored"
+    );
+}
+
+// ---------------------------------------------------------------------------
+// Tests for stage_all
+// ---------------------------------------------------------------------------
+
+#[test]
+fn test_stage_all_removes_ignored_tracked_files() {
+    let temp_dir = TempDir::new().unwrap();
+    let repo_path = temp_dir.path();
+    init_repo(repo_path);
+
+    // Create and commit __pycache__/foo.pyc so it becomes a tracked file.
+    write_file(repo_path, "__pycache__/foo.pyc", "original bytecode");
+    git(repo_path, &["add", "__pycache__/foo.pyc"]);
+    git(repo_path, &["commit", "-m", "initial commit"]);
+
+    // Add a .gitignore that now ignores __pycache__/.
+    write_file(repo_path, ".gitignore", "__pycache__/\n");
+
+    // Modify the tracked file so the working tree has unstaged changes.
+    write_file(repo_path, "__pycache__/foo.pyc", "modified bytecode");
+
+    let repo = GitRepo::open(repo_path).expect("Failed to open repo");
+    let removed = repo.stage_all().expect("stage_all should succeed");
+
+    assert!(
+        removed.iter().any(|f| f == "__pycache__/foo.pyc"),
+        "stage_all should return __pycache__/foo.pyc in removed list, got: {:?}",
+        removed
+    );
+
+    // Verify the file is no longer in the index.
+    let files = ls_files(repo_path);
+    assert!(
+        !files.lines().any(|l| l == "__pycache__/foo.pyc"),
+        "__pycache__/foo.pyc should no longer be in the index, got: {}",
+        files
+    );
+}
+
+#[test]
+fn test_stage_all_no_ignored_files_returns_empty() {
+    let temp_dir = TempDir::new().unwrap();
+    let repo_path = temp_dir.path();
+    init_repo(repo_path);
+
+    write_file(repo_path, ".gitignore", "*.log\n");
+    write_file(repo_path, "src/main.rs", "fn main() {}");
+
+    let repo = GitRepo::open(repo_path).expect("Failed to open repo");
+    let removed = repo.stage_all().expect("stage_all should succeed");
+
+    assert!(
+        removed.is_empty(),
+        "stage_all should return empty Vec when no ignored files are tracked, got: {:?}",
+        removed
+    );
+
+    // Verify src/main.rs was staged.
+    let files = ls_files(repo_path);
+    assert!(
+        files.lines().any(|l| l == "src/main.rs"),
+        "src/main.rs should be in the index, got: {}",
+        files
+    );
+}
+
+// ---------------------------------------------------------------------------
+// Tests for stage_files
+// ---------------------------------------------------------------------------
+
+#[test]
+fn test_stage_files_skips_ignored_paths() {
+    let temp_dir = TempDir::new().unwrap();
+    let repo_path = temp_dir.path();
+    init_repo(repo_path);
+
+    write_file(repo_path, ".gitignore", "__pycache__/\n");
+    write_file(repo_path, "__pycache__/foo.pyc", "bytecode");
+    write_file(repo_path, "src/main.rs", "fn main() {}");
+
+    let repo = GitRepo::open(repo_path).expect("Failed to open repo");
+    let skipped = repo
+        .stage_files(&["__pycache__/foo.pyc", "src/main.rs"])
+        .expect("stage_files should succeed");
+
+    assert!(
+        skipped.iter().any(|f| f == "__pycache__/foo.pyc"),
+        "skipped list should contain __pycache__/foo.pyc, got: {:?}",
+        skipped
+    );
+    assert!(
+        !skipped.iter().any(|f| f == "src/main.rs"),
+        "skipped list should not contain src/main.rs, got: {:?}",
+        skipped
+    );
+
+    let files = ls_files(repo_path);
+    assert!(
+        files.lines().any(|l| l == "src/main.rs"),
+        "src/main.rs should be staged, got: {}",
+        files
+    );
+    assert!(
+        !files.lines().any(|l| l == "__pycache__/foo.pyc"),
+        "__pycache__/foo.pyc should not be staged, got: {}",
+        files
+    );
+}
+
+#[test]
+fn test_stage_files_all_paths_ignored() {
+    let temp_dir = TempDir::new().unwrap();
+    let repo_path = temp_dir.path();
+    init_repo(repo_path);
+
+    write_file(repo_path, ".gitignore", "__pycache__/\n");
+    write_file(repo_path, "__pycache__/foo.pyc", "bytecode");
+
+    let repo = GitRepo::open(repo_path).expect("Failed to open repo");
+    let skipped = repo
+        .stage_files(&["__pycache__/foo.pyc"])
+        .expect("stage_files should succeed");
+
+    assert!(
+        skipped.iter().any(|f| f == "__pycache__/foo.pyc"),
+        "skipped list should contain __pycache__/foo.pyc, got: {:?}",
+        skipped
+    );
+
+    // Verify the index remains empty (the file was not staged).
+    let files = ls_files(repo_path);
+    assert!(
+        files.trim().is_empty(),
+        "index should be empty, got: {}",
+        files
+    );
+}
+
+#[test]
+fn test_stage_files_normal_paths_unchanged_behavior() {
+    let temp_dir = TempDir::new().unwrap();
+    let repo_path = temp_dir.path();
+    init_repo(repo_path);
+
+    // No .gitignore (or one that does not match these paths).
+    write_file(repo_path, "src/main.rs", "fn main() {}");
+    write_file(repo_path, "src/lib.rs", "pub fn lib() {}");
+
+    let repo = GitRepo::open(repo_path).expect("Failed to open repo");
+    let skipped = repo
+        .stage_files(&["src/main.rs", "src/lib.rs"])
+        .expect("stage_files should succeed");
+
+    assert!(
+        skipped.is_empty(),
+        "skipped list should be empty, got: {:?}",
+        skipped
+    );
+
+    let files = ls_files(repo_path);
+    assert!(
+        files.lines().any(|l| l == "src/main.rs"),
+        "src/main.rs should be staged, got: {}",
+        files
+    );
+    assert!(
+        files.lines().any(|l| l == "src/lib.rs"),
+        "src/lib.rs should be staged, got: {}",
+        files
+    );
+}