From 10ba1ff044e222401367f9c865f0698829c15fcb Mon Sep 17 00:00:00 2001
From: Jheison Martinez Bolivar <jhemar@nequi.com>
Date: Fri, 10 Apr 2026 11:36:53 -0500
Subject: [PATCH 01/13] feat: add encrypted vault for secure local token
 storage

---
 Cargo.lock   |  34 ++++-
 Cargo.toml   |   2 +
 src/vault.rs | 354 +++++++++++++++++++++++++++++++++++++++++++++++++++
 3 files changed, 389 insertions(+), 1 deletion(-)
 create mode 100644 src/vault.rs

diff --git a/Cargo.lock b/Cargo.lock
index 820630e..df4fef9 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -561,7 +561,7 @@ dependencies = [
 
 [[package]]
 name = "ghscaff"
-version = "0.3.2"
+version = "0.4.0"
 dependencies = [
  "anyhow",
  "base64",
@@ -579,6 +579,8 @@ dependencies = [
  "toml",
  "urlencoding",
  "walkdir",
+ "whoami",
+ "xsalsa20poly1305",
 ]
 
 [[package]]
@@ -1924,6 +1926,12 @@ dependencies = [
  "wit-bindgen",
 ]
 
+[[package]]
+name = "wasite"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b8dad83b4f25e74f184f64c43b150b91efe7647395b42289f38e50566d82855b"
+
 [[package]]
 name = "wasm-bindgen"
 version = "0.2.117"
@@ -2042,6 +2050,17 @@ dependencies = [
  "rustls-pki-types",
 ]
 
+[[package]]
+name = "whoami"
+version = "1.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5d4a4db5077702ca3015d3d02d74974948aba2ad9e12ab7df718ee64ccd7e97d"
+dependencies = [
+ "libredox",
+ "wasite",
+ "web-sys",
+]
+
 [[package]]
 name = "winapi"
 version = "0.3.9"
@@ -2340,6 +2359,19 @@ dependencies = [
  "rustix",
 ]
 
+[[package]]
+name = "xsalsa20poly1305"
+version = "0.9.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "02a6dad357567f81cd78ee75f7c61f1b30bb2fe4390be8fb7c69e2ac8dffb6c7"
+dependencies = [
+ "aead",
+ "poly1305",
+ "salsa20",
+ "subtle",
+ "zeroize",
+]
+
 [[package]]
 name = "yoke"
 version = "0.8.2"
diff --git a/Cargo.toml b/Cargo.toml
index e7c67ea..e33c4c1 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -28,6 +28,8 @@ urlencoding = "2"
 toml = "0.8"
 crypto_box = "0.9"
 blake2 = "0.10"
+xsalsa20poly1305 = "0.9"
+whoami = "1"
 
 [dev-dependencies]
 tempfile = "3"
diff --git a/src/vault.rs b/src/vault.rs
new file mode 100644
index 0000000..a628027
--- /dev/null
+++ b/src/vault.rs
@@ -0,0 +1,354 @@
+use anyhow::{Context, Result};
+use blake2::digest::{Update, VariableOutput};
+use blake2::Blake2bVar;
+use serde::{Deserialize, Serialize};
+use std::collections::HashMap;
+use std::path::{Path, PathBuf};
+use xsalsa20poly1305::KeyInit;
+
+const NONCE_LEN: usize = 24;
+const KEY_LEN: usize = 32;
+const DOMAIN_SEPARATOR: &[u8] = b"|ghscaff-vault-v1";
+
+#[derive(Serialize, Deserialize, Default, Debug, PartialEq)]
+pub struct VaultData {
+    #[serde(default)]
+    pub github_token: Option<String>,
+    #[serde(default)]
+    pub has_passphrase: bool,
+    #[serde(default)]
+    pub secrets: HashMap<String, String>,
+}
+
+/// Blake2b-256(username ‖ hostname ‖ binary_path ‖ passphrase ‖ domain)
+fn derive_key(passphrase: &str) -> Result<[u8; KEY_LEN]> {
+    let mut hasher = Blake2bVar::new(KEY_LEN).expect("valid output size");
+    Update::update(&mut hasher, whoami::username().as_bytes());
+    Update::update(&mut hasher, b"|");
+    Update::update(
+        &mut hasher,
+        whoami::fallible::hostname().unwrap_or_default().as_bytes(),
+    );
+    Update::update(&mut hasher, b"|");
+    Update::update(
+        &mut hasher,
+        std::env::current_exe()
+            .unwrap_or_default()
+            .to_string_lossy()
+            .as_bytes(),
+    );
+    Update::update(&mut hasher, b"|");
+    Update::update(&mut hasher, passphrase.as_bytes());
+    Update::update(&mut hasher, DOMAIN_SEPARATOR);
+
+    let mut key = [0u8; KEY_LEN];
+    hasher
+        .finalize_variable(&mut key)
+        .expect("buffer matches output size");
+    Ok(key)
+}
+
+fn vault_path() -> Result<PathBuf> {
+    let home = dirs::home_dir().context("Cannot resolve home directory")?;
+    Ok(home.join(".ghscaff").join("vault.enc"))
+}
+
+/// File format: [nonce:24][ciphertext+poly1305_tag]
+fn save_to_path(data: &VaultData, passphrase: &str, path: &Path) -> Result<()> {
+    use crypto_box::aead::{generic_array::GenericArray, rand_core::RngCore, Aead, OsRng};
+
+    let key_bytes = derive_key(passphrase)?;
+    let key = GenericArray::from_slice(&key_bytes);
+    let cipher = xsalsa20poly1305::XSalsa20Poly1305::new(key);
+
+    let mut nonce_bytes = [0u8; NONCE_LEN];
+    OsRng.fill_bytes(&mut nonce_bytes);
+    let nonce = GenericArray::from_slice(&nonce_bytes);
+
+    let plaintext = serde_json::to_vec(data).context("Failed to serialize vault")?;
+    let ciphertext = cipher
+        .encrypt(nonce, plaintext.as_ref())
+        .map_err(|_| anyhow::anyhow!("Encryption failed"))?;
+
+    if let Some(parent) = path.parent() {
+        std::fs::create_dir_all(parent)?;
+    }
+
+    let mut blob = Vec::with_capacity(NONCE_LEN + ciphertext.len());
+    blob.extend_from_slice(&nonce_bytes);
+    blob.extend_from_slice(&ciphertext);
+    std::fs::write(path, &blob)?;
+
+    #[cfg(unix)]
+    {
+        use std::os::unix::fs::PermissionsExt;
+        std::fs::set_permissions(path, std::fs::Permissions::from_mode(0o600))?;
+    }
+
+    Ok(())
+}
+
+fn load_from_path(passphrase: &str, path: &Path) -> Result<Option<VaultData>> {
+    use crypto_box::aead::{generic_array::GenericArray, Aead};
+
+    if !path.exists() {
+        return Ok(None);
+    }
+
+    let blob = std::fs::read(path).context("Failed to read vault file")?;
+    if blob.len() < NONCE_LEN {
+        anyhow::bail!("Corrupt vault file");
+    }
+
+    let (nonce_bytes, ciphertext) = blob.split_at(NONCE_LEN);
+    let key_bytes = derive_key(passphrase)?;
+    let key = GenericArray::from_slice(&key_bytes);
+    let cipher = xsalsa20poly1305::XSalsa20Poly1305::new(key);
+    let nonce = GenericArray::from_slice(nonce_bytes);
+
+    let plaintext = cipher
+        .decrypt(nonce, ciphertext)
+        .map_err(|_| anyhow::anyhow!("Decryption failed — wrong passphrase or corrupt vault"))?;
+
+    serde_json::from_slice(&plaintext)
+        .map(Some)
+        .context("Failed to parse vault contents")
+}
+
+pub fn save(data: &VaultData, passphrase: &str) -> Result<()> {
+    save_to_path(data, passphrase, &vault_path()?)
+}
+
+pub fn load(passphrase: &str) -> Result<Option<VaultData>> {
+    load_from_path(passphrase, &vault_path()?)
+}
+
+pub fn destroy() -> Result<bool> {
+    let path = vault_path()?;
+    if !path.exists() {
+        return Ok(false);
+    }
+    std::fs::remove_file(&path)?;
+    Ok(true)
+}
+
+pub fn exists() -> bool {
+    vault_path().map(|p| p.exists()).unwrap_or(false)
+}
+
+/// Try without passphrase first; prompt if vault has one.
+pub fn load_interactive() -> Result<Option<(VaultData, String)>> {
+    if !exists() {
+        return Ok(None);
+    }
+
+    if let Ok(Some(data)) = load("") {
+        if !data.has_passphrase {
+            return Ok(Some((data, String::new())));
+        }
+    }
+
+    let passphrase = inquire::Password::new("Vault passphrase:")
+        .without_confirmation()
+        .prompt()
+        .context("Failed to read passphrase")?;
+
+    let data = load(&passphrase)?
+        .ok_or_else(|| anyhow::anyhow!("Failed to decrypt vault — wrong passphrase"))?;
+    Ok(Some((data, passphrase)))
+}
+
+pub fn resolve_github_token() -> Result<Option<(String, String)>> {
+    if let Ok(token) = std::env::var("GITHUB_TOKEN") {
+        return Ok(Some((token, String::new())));
+    }
+
+    if let Some((data, passphrase)) = load_interactive()? {
+        if let Some(token) = data.github_token {
+            return Ok(Some((token, passphrase)));
+        }
+    }
+
+    Ok(None)
+}
+
+pub fn resolve_secret(name: &str, passphrase: &str) -> Result<Option<String>> {
+    if let Ok(val) = std::env::var(name) {
+        return Ok(Some(val));
+    }
+
+    if let Some(data) = load(passphrase)? {
+        if let Some(val) = data.secrets.get(name) {
+            return Ok(Some(val.clone()));
+        }
+    }
+
+    Ok(None)
+}
+
+pub fn prompt_and_save_github_token() -> Result<(String, String)> {
+    let token = inquire::Password::new("GitHub token (ghp_...):")
+        .with_help_message("Required scopes: repo, workflow — https://github.com/settings/tokens")
+        .without_confirmation()
+        .prompt()
+        .context("Failed to read token")?;
+
+    if token.is_empty() {
+        anyhow::bail!("Token cannot be empty");
+    }
+
+    let passphrase = if exists() {
+        load_interactive()?
+            .ok_or_else(|| anyhow::anyhow!("Cannot read existing vault"))?
+            .1
+    } else {
+        ask_optional_passphrase()?
+    };
+
+    let mut data = load(&passphrase)?.unwrap_or_default();
+    data.github_token = Some(token.clone());
+    data.has_passphrase = !passphrase.is_empty();
+    save(&data, &passphrase)?;
+
+    println!("  \x1b[32m✓\x1b[0m Token saved to encrypted vault (~/.ghscaff/vault.enc)");
+    Ok((token, passphrase))
+}
+
+fn ask_optional_passphrase() -> Result<String> {
+    let want = inquire::Confirm::new("Add an optional passphrase to protect the vault?")
+        .with_default(false)
+        .with_help_message("If set, you'll need to enter it each time ghscaff runs")
+        .prompt()?;
+
+    if !want {
+        return Ok(String::new());
+    }
+
+    Ok(inquire::Password::new("Passphrase:")
+        .prompt()
+        .unwrap_or_default())
+}
+
+pub fn save_secret(name: &str, value: &str, passphrase: &str) -> Result<()> {
+    let mut data = load(passphrase)?.unwrap_or_default();
+    data.secrets.insert(name.to_string(), value.to_string());
+    data.has_passphrase = !passphrase.is_empty();
+    save(&data, passphrase)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn test_vault_data() -> VaultData {
+        let mut secrets = HashMap::new();
+        secrets.insert("CARGO_REGISTRY_TOKEN".into(), "crates_token_123".into());
+        VaultData {
+            github_token: Some("ghp_test_token_abc".into()),
+            has_passphrase: false,
+            secrets,
+        }
+    }
+
+    #[test]
+    fn save_load_roundtrip_no_passphrase() {
+        let dir = tempfile::tempdir().unwrap();
+        let path = dir.path().join("vault.enc");
+        let data = test_vault_data();
+
+        save_to_path(&data, "", &path).unwrap();
+        let loaded = load_from_path("", &path).unwrap().unwrap();
+
+        assert_eq!(loaded.github_token, data.github_token);
+        assert_eq!(loaded.secrets, data.secrets);
+        assert!(!loaded.has_passphrase);
+    }
+
+    #[test]
+    fn save_load_roundtrip_with_passphrase() {
+        let dir = tempfile::tempdir().unwrap();
+        let path = dir.path().join("vault.enc");
+        let mut data = test_vault_data();
+        data.has_passphrase = true;
+
+        save_to_path(&data, "my-secret-pass", &path).unwrap();
+        let loaded = load_from_path("my-secret-pass", &path).unwrap().unwrap();
+
+        assert_eq!(loaded.github_token, data.github_token);
+        assert_eq!(loaded.secrets, data.secrets);
+        assert!(loaded.has_passphrase);
+    }
+
+    #[test]
+    fn wrong_passphrase_fails() {
+        let dir = tempfile::tempdir().unwrap();
+        let path = dir.path().join("vault.enc");
+
+        save_to_path(&test_vault_data(), "correct", &path).unwrap();
+        let result = load_from_path("wrong", &path);
+
+        assert!(result.is_err());
+        assert!(result
+            .unwrap_err()
+            .to_string()
+            .contains("Decryption failed"));
+    }
+
+    #[test]
+    fn load_nonexistent_returns_none() {
+        let dir = tempfile::tempdir().unwrap();
+        let path = dir.path().join("nonexistent.enc");
+
+        let result = load_from_path("", &path).unwrap();
+        assert!(result.is_none());
+    }
+
+    #[test]
+    fn corrupt_file_fails() {
+        let dir = tempfile::tempdir().unwrap();
+        let path = dir.path().join("vault.enc");
+        std::fs::write(&path, b"short").unwrap();
+
+        let result = load_from_path("", &path);
+        assert!(result.is_err());
+    }
+
+    #[test]
+    fn derive_key_differs_with_passphrase() {
+        let key_empty = derive_key("").unwrap();
+        let key_pass = derive_key("secret").unwrap();
+        assert_ne!(key_empty, key_pass);
+    }
+
+    #[test]
+    fn derive_key_deterministic() {
+        let key1 = derive_key("test").unwrap();
+        let key2 = derive_key("test").unwrap();
+        assert_eq!(key1, key2);
+    }
+
+    #[test]
+    fn vault_data_default() {
+        let data = VaultData::default();
+        assert!(data.github_token.is_none());
+        assert!(!data.has_passphrase);
+        assert!(data.secrets.is_empty());
+    }
+
+    #[test]
+    fn save_overwrites_existing() {
+        let dir = tempfile::tempdir().unwrap();
+        let path = dir.path().join("vault.enc");
+
+        let mut data1 = VaultData::default();
+        data1.github_token = Some("token_v1".into());
+        save_to_path(&data1, "", &path).unwrap();
+
+        let mut data2 = VaultData::default();
+        data2.github_token = Some("token_v2".into());
+        save_to_path(&data2, "", &path).unwrap();
+
+        let loaded = load_from_path("", &path).unwrap().unwrap();
+        assert_eq!(loaded.github_token.unwrap(), "token_v2");
+    }
+}

From 67ad69b75a0f660358ff8b77a107dd6b3157166a Mon Sep 17 00:00:00 2001
From: Jheison Martinez Bolivar <jhemar@nequi.com>
Date: Fri, 10 Apr 2026 11:37:02 -0500
Subject: [PATCH 02/13] feat: integrate vault into wizard, apply and add config
 subcommand

---
 src/apply.rs         | 61 ++++++++++++++++++++++++++++++++++----------
 src/github/client.rs | 31 ++++++++++++++++++----
 src/main.rs          | 44 ++++++++++++++++++++++++++++++++
 src/wizard.rs        | 54 +++++++++++++++++++++++++++------------
 4 files changed, 155 insertions(+), 35 deletions(-)

diff --git a/src/apply.rs b/src/apply.rs
index d8d23c9..fb9feab 100644
--- a/src/apply.rs
+++ b/src/apply.rs
@@ -149,31 +149,40 @@ pub fn sync_labels(
     let mut created = 0;
     let mut updated = 0;
     let mut up_to_date = 0;
+    let mut deleted = 0;
 
-    for std_label in standard {
+    for std_label in &standard {
         if let Some(existing) = current.iter().find(|l| l.name == std_label.name) {
-            // Check if needs update
             if existing.color != std_label.color || existing.description != std_label.description {
                 if !dry_run {
-                    labels::update_label(client, owner, repo_name, &std_label.name, &std_label)?;
+                    labels::update_label(client, owner, repo_name, &std_label.name, std_label)?;
                 }
                 updated += 1;
             } else {
                 up_to_date += 1;
             }
         } else {
-            // Create new label
             if !dry_run {
-                labels::create_label(client, owner, repo_name, &std_label)?;
+                labels::create_label(client, owner, repo_name, std_label)?;
             }
             created += 1;
         }
     }
 
+    for existing in &current {
+        if !standard.iter().any(|s| s.name == existing.name) {
+            if !dry_run {
+                let _ = labels::delete_label(client, owner, repo_name, &existing.name);
+            }
+            deleted += 1;
+        }
+    }
+
     Ok(SyncResult {
         created,
         updated,
         up_to_date,
+        deleted,
     })
 }
 
@@ -208,12 +217,13 @@ pub struct SyncResult {
     pub created: usize,
     pub updated: usize,
     pub up_to_date: usize,
+    pub deleted: usize,
 }
 
 /// Main apply mode orchestrator
 pub fn run_apply(repo_arg: Option<&str>, dry_run: bool) -> Result<()> {
     // Get token
-    let token = crate::github::client::token_from_env()?;
+    let (token, passphrase) = crate::github::client::resolve_token()?;
     let client = crate::github::client::GithubClient::new(&token);
 
     // Determine repo
@@ -231,10 +241,13 @@ pub fn run_apply(repo_arg: Option<&str>, dry_run: bool) -> Result<()> {
     println!("  Summary of changes:");
     println!("  ◆ Labels: checking...");
     let label_result = sync_labels(&client, &owner, &repo_name, true)?; // dry check
-    if label_result.created > 0 || label_result.updated > 0 {
+    if label_result.created > 0 || label_result.updated > 0 || label_result.deleted > 0 {
         println!(
-            "    • {} to create, {} to update, {} up to date",
-            label_result.created, label_result.updated, label_result.up_to_date
+            "    • {} to create, {} to update, {} to delete, {} up to date",
+            label_result.created,
+            label_result.updated,
+            label_result.deleted,
+            label_result.up_to_date
         );
     } else {
         println!("    • all up to date");
@@ -412,10 +425,13 @@ pub fn run_apply(repo_arg: Option<&str>, dry_run: bool) -> Result<()> {
             }
             println!();
             for spec in missing {
-                if let Ok(env_val) = std::env::var(&spec.name) {
-                    match secrets::set_secret(&client, &owner, &repo_name, &spec.name, &env_val) {
+                if let Some(val) = crate::vault::resolve_secret(&spec.name, &passphrase)? {
+                    match secrets::set_secret(&client, &owner, &repo_name, &spec.name, &val) {
                         Ok(()) => {
-                            println!("  ✓ Secret {} configured (from environment)", spec.name)
+                            println!(
+                                "  ✓ Secret {} configured (from vault/environment)",
+                                spec.name
+                            )
                         }
                         Err(e) => println!("  ⚠ Failed to set {}: {e:#}", spec.name),
                     }
@@ -427,14 +443,29 @@ pub fn run_apply(repo_arg: Option<&str>, dry_run: bool) -> Result<()> {
                             .prompt_skippable()?;
                     match ans.as_deref() {
                         Some(v) if !v.is_empty() => {
+                            let save_it = inquire::Confirm::new(
+                                "  Save this secret in the vault for future use?",
+                            )
+                            .with_default(true)
+                            .prompt()
+                            .unwrap_or(false);
+                            if save_it {
+                                if let Err(e) =
+                                    crate::vault::save_secret(&spec.name, v, &passphrase)
+                                {
+                                    println!("  ⚠ Could not save to vault: {e}");
+                                } else {
+                                    println!("  \x1b[32m✓\x1b[0m Secret saved to vault");
+                                }
+                            }
                             match secrets::set_secret(&client, &owner, &repo_name, &spec.name, v) {
                                 Ok(()) => println!("  ✓ Secret {} configured", spec.name),
                                 Err(e) => println!("  ⚠ Failed to set {}: {e:#}", spec.name),
                             }
                         }
                         _ => println!(
-                            "  ⚠ Secret {} skipped — set ${} and re-run `ghscaff apply`",
-                            spec.name, spec.name
+                            "  ⚠ Secret {} skipped — re-run `ghscaff apply` to set it later",
+                            spec.name
                         ),
                     }
                 }
@@ -544,9 +575,11 @@ mod tests {
             created: 2,
             updated: 1,
             up_to_date: 9,
+            deleted: 3,
         };
         assert_eq!(result.created, 2);
         assert_eq!(result.updated, 1);
         assert_eq!(result.up_to_date, 9);
+        assert_eq!(result.deleted, 3);
     }
 }
diff --git a/src/github/client.rs b/src/github/client.rs
index 9d1fa7e..f9bb64c 100644
--- a/src/github/client.rs
+++ b/src/github/client.rs
@@ -100,11 +100,32 @@ impl GithubClient {
             .json()
             .context("Failed to parse response")
     }
+
+    pub fn delete(&self, path: &str) -> Result<()> {
+        let url = format!("https://api.github.com{path}");
+        self.client
+            .delete(&url)
+            .header("Authorization", format!("token {}", self.token))
+            .header("User-Agent", "ghscaff")
+            .header("Accept", "application/vnd.github+json")
+            .send()
+            .context("HTTP DELETE failed")?
+            .error_for_status()
+            .context("GitHub API error")?;
+        Ok(())
+    }
 }
 
-/// Read GITHUB_TOKEN from env. Fail fast with a clear message.
-pub fn token_from_env() -> Result<String> {
-    std::env::var("GITHUB_TOKEN").context(
-        "GITHUB_TOKEN not set. Export your token:\n  export GITHUB_TOKEN=ghp_xxxxxxxxxxxx\n\nRequired scopes (classic PAT):  repo, workflow\nRequired permissions (fine-grained PAT): Contents=write, Workflows=write, Administration=write, Metadata=read"
-    )
+/// Env var → vault → inline prompt. Returns (token, vault_passphrase).
+pub fn resolve_token() -> Result<(String, String)> {
+    if let Ok(token) = std::env::var("GITHUB_TOKEN") {
+        return Ok((token, String::new()));
+    }
+
+    if let Some(pair) = crate::vault::resolve_github_token()? {
+        return Ok(pair);
+    }
+
+    println!("  No GitHub token found.\n");
+    crate::vault::prompt_and_save_github_token()
 }
diff --git a/src/main.rs b/src/main.rs
index b680b87..03be4fb 100644
--- a/src/main.rs
+++ b/src/main.rs
@@ -4,6 +4,7 @@ use clap::{Parser, Subcommand};
 mod apply;
 mod github;
 mod templates;
+mod vault;
 mod wizard;
 
 #[derive(Parser)]
@@ -35,6 +36,8 @@ enum Command {
         #[arg(long)]
         dry_run: bool,
     },
+    /// Reconfigure ghscaff credentials (wipes vault and starts fresh)
+    Config,
 }
 
 fn main() -> Result<()> {
@@ -43,9 +46,50 @@ fn main() -> Result<()> {
     match cli.command {
         None | Some(Command::New { .. }) => wizard::run(cli.dry_run),
         Some(Command::Apply { repo, dry_run }) => apply::run_apply(repo.as_deref(), dry_run),
+        Some(Command::Config) => run_config(),
     }
 }
 
+fn run_config() -> Result<()> {
+    println!();
+    println!(
+        "  \x1b[33m⚠  This will delete ALL stored credentials and secrets from the vault.\x1b[0m"
+    );
+    println!("  \x1b[33m   This action cannot be undone.\x1b[0m");
+    println!();
+
+    let confirmed = inquire::Confirm::new("Continue with reconfiguration?")
+        .with_default(false)
+        .prompt()?;
+
+    if !confirmed {
+        println!("  Aborted.");
+        return Ok(());
+    }
+
+    if vault::destroy()? {
+        println!("  \x1b[32m✓\x1b[0m Vault deleted");
+    } else {
+        println!("  ℹ  No vault found");
+    }
+
+    println!();
+    let (token, _) = vault::prompt_and_save_github_token()?;
+
+    // Validate
+    let client = github::client::GithubClient::new(&token);
+    print!("  Validating token... ");
+    let user = github::repo::get_user(&client)?;
+    println!("ok  ({})", user.login);
+
+    println!();
+    println!(
+        "  \x1b[32m✓\x1b[0m ghscaff reconfigured. Template secrets will be requested on next run."
+    );
+    println!();
+    Ok(())
+}
+
 fn check_for_update() {
     if std::env::var("GHSCAFF_NO_UPDATE_CHECK").is_ok() {
         return;
diff --git a/src/wizard.rs b/src/wizard.rs
index e4644bf..d16734d 100644
--- a/src/wizard.rs
+++ b/src/wizard.rs
@@ -3,7 +3,7 @@ use inquire::{Confirm, MultiSelect, Password, Select, Text};
 
 use crate::github::{
     branches,
-    client::{token_from_env, GithubClient},
+    client::{resolve_token, GithubClient},
     contents, labels, repo, secrets, teams,
 };
 use crate::templates;
@@ -43,7 +43,7 @@ pub fn run(dry_run: bool) -> Result<()> {
     println!("  Create a new GitHub repository\n");
 
     // Fail fast — validate token before asking anything
-    let token = token_from_env()?;
+    let (token, passphrase) = resolve_token()?;
     let client = GithubClient::new(&token);
 
     print!("  Validating token... ");
@@ -63,7 +63,7 @@ pub fn run(dry_run: bool) -> Result<()> {
         return Ok(());
     }
 
-    execute(&client, &config, dry_run, &token)
+    execute(&client, &config, dry_run, &token, &passphrase)
 }
 
 fn collect_team_access(client: &GithubClient, _org: &str) -> Result<Vec<teams::TeamAccess>> {
@@ -203,7 +203,13 @@ fn collect_config(client: &GithubClient, username: &str) -> Result<WizardConfig>
     })
 }
 
-fn execute(client: &GithubClient, c: &WizardConfig, dry_run: bool, token: &str) -> Result<()> {
+fn execute(
+    client: &GithubClient,
+    c: &WizardConfig,
+    dry_run: bool,
+    token: &str,
+    passphrase: &str,
+) -> Result<()> {
     println!();
 
     // Always download fresh template for `new` so cache is never stale
@@ -350,6 +356,11 @@ fn execute(client: &GithubClient, c: &WizardConfig, dry_run: bool, token: &str)
                     labels::create_label(client, owner, name, label)?;
                 }
             }
+            for existing_label in &existing {
+                if !standard.iter().any(|s| s.name == existing_label.name) {
+                    let _ = labels::delete_label(client, owner, name, &existing_label.name);
+                }
+            }
             Ok::<(), anyhow::Error>(())
         });
     }
@@ -376,24 +387,35 @@ fn execute(client: &GithubClient, c: &WizardConfig, dry_run: bool, token: &str)
         );
     }
 
-    // 9. Secrets from template — read from env first, prompt if missing, warn if skipped
+    // 9. Template secrets: env → vault → prompt
     for spec in &secret_specs {
-        let value = if let Ok(env_val) = std::env::var(&spec.name) {
-            println!("  ◆ Secret {}: using value from environment", spec.name);
-            Some(env_val)
+        let value = if let Some(val) = crate::vault::resolve_secret(&spec.name, passphrase)? {
+            println!("  ◆ Secret {}: found", spec.name);
+            Some(val)
         } else {
             let ans = Password::new(&format!("Secret {} (enter to skip):", spec.name))
                 .with_help_message(&spec.description)
                 .without_confirmation()
                 .prompt_skippable()?;
-            if ans.as_deref().map(str::is_empty).unwrap_or(true) {
-                println!(
-                    "  ⚠ Secret {} not configured — set ${} and re-run `ghscaff apply`",
-                    spec.name, spec.name
-                );
-                None
-            } else {
-                ans
+            match ans.as_deref() {
+                Some(v) if !v.is_empty() => {
+                    let save_it = Confirm::new("  Save this secret in the vault for future use?")
+                        .with_default(true)
+                        .prompt()
+                        .unwrap_or(false);
+                    if save_it {
+                        crate::vault::save_secret(&spec.name, v, passphrase)?;
+                        println!("  \x1b[32m✓\x1b[0m Secret saved to vault");
+                    }
+                    Some(v.to_string())
+                }
+                _ => {
+                    println!(
+                        "  ⚠ Secret {} not configured — re-run `ghscaff apply` to set it later",
+                        spec.name
+                    );
+                    None
+                }
             }
         };
         if let Some(val) = value {

From 6ce65dfecbdfe680fa71c6e4a4dd76ae60c7001b Mon Sep 17 00:00:00 2001
From: Jheison Martinez Bolivar <jhemar@nequi.com>
Date: Fri, 10 Apr 2026 11:37:09 -0500
Subject: [PATCH 03/13] feat: replace good-first-issue with target branch
 labels and enforce standard set

---
 src/github/labels.rs | 25 +++++++++++++++++++++----
 1 file changed, 21 insertions(+), 4 deletions(-)

diff --git a/src/github/labels.rs b/src/github/labels.rs
index 70c70a9..990ab6b 100644
--- a/src/github/labels.rs
+++ b/src/github/labels.rs
@@ -31,6 +31,11 @@ pub fn update_label(
     Ok(())
 }
 
+pub fn delete_label(client: &GithubClient, owner: &str, repo: &str, name: &str) -> Result<()> {
+    let encoded = urlencoding::encode(name);
+    client.delete(&format!("/repos/{owner}/{repo}/labels/{encoded}"))
+}
+
 pub fn standard_labels() -> Vec<Label> {
     vec![
         Label {
@@ -54,9 +59,14 @@ pub fn standard_labels() -> Vec<Label> {
             description: "Introduces breaking changes".into(),
         },
         Label {
-            name: "good first issue".into(),
-            color: "7057ff".into(),
-            description: "Good for newcomers".into(),
+            name: "target:main".into(),
+            color: "1d76db".into(),
+            description: "Targets the main branch".into(),
+        },
+        Label {
+            name: "target:develop".into(),
+            color: "0e8a16".into(),
+            description: "Targets the develop branch".into(),
         },
         Label {
             name: "help wanted".into(),
@@ -73,7 +83,7 @@ mod tests {
     #[test]
     fn test_standard_labels_count() {
         let labels = standard_labels();
-        assert_eq!(labels.len(), 6, "Should have exactly 6 standard labels");
+        assert_eq!(labels.len(), 7, "Should have exactly 7 standard labels");
     }
 
     #[test]
@@ -140,4 +150,11 @@ mod tests {
         assert_eq!(deserialized.color, label.color);
         assert_eq!(deserialized.description, label.description);
     }
+
+    #[test]
+    fn test_target_labels_exist() {
+        let labels = standard_labels();
+        assert!(labels.iter().any(|l| l.name == "target:main"));
+        assert!(labels.iter().any(|l| l.name == "target:develop"));
+    }
 }

From adee84bd8a457b7fd42116e7e87fd9dd579ced03 Mon Sep 17 00:00:00 2001
From: Jheison Martinez Bolivar <jhemar@nequi.com>
Date: Fri, 10 Apr 2026 11:37:26 -0500
Subject: [PATCH 04/13] chore: bump version to 0.4.0

---
 Cargo.toml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Cargo.toml b/Cargo.toml
index e33c4c1..32340c5 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "ghscaff"
-version = "0.3.2"
+version = "0.4.0"
 edition = "2021"
 description = "Interactive CLI wizard for creating and configuring GitHub repositories"
 license = "MIT"

From 78f12855b148b94156fd8d6fc4e618a9bafd41a5 Mon Sep 17 00:00:00 2001
From: Jheison Martinez Bolivar <jhemar@nequi.com>
Date: Fri, 10 Apr 2026 12:04:47 -0500
Subject: [PATCH 05/13] fix: show GitHub API error message instead of generic
 status code

---
 src/github/client.rs | 95 ++++++++++++++++++++------------------------
 1 file changed, 44 insertions(+), 51 deletions(-)

diff --git a/src/github/client.rs b/src/github/client.rs
index f9bb64c..7f98169 100644
--- a/src/github/client.rs
+++ b/src/github/client.rs
@@ -1,5 +1,5 @@
 use anyhow::{Context, Result};
-use reqwest::blocking::Client;
+use reqwest::blocking::{Client, Response};
 use serde::de::DeserializeOwned;
 
 pub struct GithubClient {
@@ -7,6 +7,20 @@ pub struct GithubClient {
     token: String,
 }
 
+fn check_status(resp: Response) -> Result<Response> {
+    let status = resp.status();
+    if status.is_success() {
+        return Ok(resp);
+    }
+    let url = resp.url().to_string();
+    let body = resp.text().unwrap_or_default();
+    let message = serde_json::from_str::<serde_json::Value>(&body)
+        .ok()
+        .and_then(|v| v["message"].as_str().map(String::from))
+        .unwrap_or(body);
+    anyhow::bail!("{status} — {message}\n  URL: {url}")
+}
+
 impl GithubClient {
     pub fn new(token: &str) -> Self {
         Self {
@@ -15,17 +29,21 @@ impl GithubClient {
         }
     }
 
-    pub fn get<T: DeserializeOwned>(&self, path: &str) -> Result<T> {
+    fn request(&self, method: reqwest::Method, path: &str) -> reqwest::blocking::RequestBuilder {
         let url = format!("https://api.github.com{path}");
         self.client
-            .get(&url)
+            .request(method, &url)
             .header("Authorization", format!("token {}", self.token))
             .header("User-Agent", "ghscaff")
             .header("Accept", "application/vnd.github+json")
+    }
+
+    pub fn get<T: DeserializeOwned>(&self, path: &str) -> Result<T> {
+        let resp = self
+            .request(reqwest::Method::GET, path)
             .send()
-            .context("HTTP GET failed")?
-            .error_for_status()
-            .context("GitHub API error")?
+            .context("HTTP GET failed")?;
+        check_status(resp)?
             .json()
             .context("Failed to parse response")
     }
@@ -35,49 +53,34 @@ impl GithubClient {
         path: &str,
         body: &B,
     ) -> Result<T> {
-        let url = format!("https://api.github.com{path}");
-        self.client
-            .post(&url)
-            .header("Authorization", format!("token {}", self.token))
-            .header("User-Agent", "ghscaff")
-            .header("Accept", "application/vnd.github+json")
+        let resp = self
+            .request(reqwest::Method::POST, path)
             .json(body)
             .send()
-            .context("HTTP POST failed")?
-            .error_for_status()
-            .context("GitHub API error")?
+            .context("HTTP POST failed")?;
+        check_status(resp)?
             .json()
             .context("Failed to parse response")
     }
 
     pub fn put<B: serde::Serialize, T: DeserializeOwned>(&self, path: &str, body: &B) -> Result<T> {
-        let url = format!("https://api.github.com{path}");
-        self.client
-            .put(&url)
-            .header("Authorization", format!("token {}", self.token))
-            .header("User-Agent", "ghscaff")
-            .header("Accept", "application/vnd.github+json")
+        let resp = self
+            .request(reqwest::Method::PUT, path)
             .json(body)
             .send()
-            .context("HTTP PUT failed")?
-            .error_for_status()
-            .context("GitHub API error")?
+            .context("HTTP PUT failed")?;
+        check_status(resp)?
             .json()
             .context("Failed to parse response")
     }
 
     pub fn put_no_response<B: serde::Serialize>(&self, path: &str, body: &B) -> Result<()> {
-        let url = format!("https://api.github.com{path}");
-        self.client
-            .put(&url)
-            .header("Authorization", format!("token {}", self.token))
-            .header("User-Agent", "ghscaff")
-            .header("Accept", "application/vnd.github+json")
+        let resp = self
+            .request(reqwest::Method::PUT, path)
             .json(body)
             .send()
-            .context("HTTP PUT failed")?
-            .error_for_status()
-            .context("GitHub API error")?;
+            .context("HTTP PUT failed")?;
+        check_status(resp)?;
         Ok(())
     }
 
@@ -86,32 +89,22 @@ impl GithubClient {
         path: &str,
         body: &B,
     ) -> Result<T> {
-        let url = format!("https://api.github.com{path}");
-        self.client
-            .patch(&url)
-            .header("Authorization", format!("token {}", self.token))
-            .header("User-Agent", "ghscaff")
-            .header("Accept", "application/vnd.github+json")
+        let resp = self
+            .request(reqwest::Method::PATCH, path)
             .json(body)
             .send()
-            .context("HTTP PATCH failed")?
-            .error_for_status()
-            .context("GitHub API error")?
+            .context("HTTP PATCH failed")?;
+        check_status(resp)?
             .json()
             .context("Failed to parse response")
     }
 
     pub fn delete(&self, path: &str) -> Result<()> {
-        let url = format!("https://api.github.com{path}");
-        self.client
-            .delete(&url)
-            .header("Authorization", format!("token {}", self.token))
-            .header("User-Agent", "ghscaff")
-            .header("Accept", "application/vnd.github+json")
+        let resp = self
+            .request(reqwest::Method::DELETE, path)
             .send()
-            .context("HTTP DELETE failed")?
-            .error_for_status()
-            .context("GitHub API error")?;
+            .context("HTTP DELETE failed")?;
+        check_status(resp)?;
         Ok(())
     }
 }

From bcc6c7e37ce9b4885c62f360fcd1ba66020480ce Mon Sep 17 00:00:00 2001
From: Jheison Martinez Bolivar <jhemar@nequi.com>
Date: Fri, 10 Apr 2026 12:11:36 -0500
Subject: [PATCH 06/13] fix: wait for git database readiness and improve repo
 creation error messages

---
 src/github/contents.rs | 12 ++++++++++--
 src/github/repo.rs     | 13 ++++++++-----
 2 files changed, 18 insertions(+), 7 deletions(-)

diff --git a/src/github/contents.rs b/src/github/contents.rs
index 0bea784..3193a95 100644
--- a/src/github/contents.rs
+++ b/src/github/contents.rs
@@ -102,11 +102,19 @@ pub fn create_tree_commit(
     branch: &str,
 ) -> Result<String> {
     // GitHub initializes the git database asynchronously after repo creation.
-    // Wait until the default branch ref is reachable before proceeding.
+    // The ref may exist before the Git Database API is ready, so we verify
+    // by attempting a lightweight API call that requires the git DB.
     const READY_DELAYS_MS: &[u64] = &[1000, 2000, 3000, 5000, 8000];
     for &delay_ms in READY_DELAYS_MS {
         if get_branch_sha_opt(client, owner, repo, branch).is_some() {
-            break;
+            // Verify git DB is actually ready by checking the commit is fetchable
+            let sha = get_branch_sha_opt(client, owner, repo, branch).unwrap();
+            if client
+                .get::<serde_json::Value>(&format!("/repos/{owner}/{repo}/git/commits/{sha}"))
+                .is_ok()
+            {
+                break;
+            }
         }
         std::thread::sleep(std::time::Duration::from_millis(delay_ms));
     }
diff --git a/src/github/repo.rs b/src/github/repo.rs
index bff26e4..e4bb631 100644
--- a/src/github/repo.rs
+++ b/src/github/repo.rs
@@ -1,4 +1,4 @@
-use anyhow::Result;
+use anyhow::{Context, Result};
 use serde::{Deserialize, Serialize};
 
 use super::client::GithubClient;
@@ -52,11 +52,14 @@ pub fn create_repo(
         private,
         auto_init: true,
     };
-    if is_org {
-        client.post(&format!("/orgs/{owner}/repos"), &body)
+    let path = if is_org {
+        format!("/orgs/{owner}/repos")
     } else {
-        client.post("/user/repos", &body)
-    }
+        "/user/repos".to_string()
+    };
+    client
+        .post(&path, &body)
+        .with_context(|| format!("Failed to create repo '{owner}/{name}' — does it already exist?"))
 }
 
 pub fn get_gitignore_template(client: &GithubClient, name: &str) -> Result<String> {

From 710b99365aab29a2fefb8eca40d1ad0c41da7f4c Mon Sep 17 00:00:00 2001
From: Jheison Martinez Bolivar <jhemar@nequi.com>
Date: Fri, 10 Apr 2026 12:19:09 -0500
Subject: [PATCH 07/13] fix: atomic vault writes and restrict directory
 permissions to 700

---
 src/vault.rs | 14 ++++++++++++--
 1 file changed, 12 insertions(+), 2 deletions(-)

diff --git a/src/vault.rs b/src/vault.rs
index a628027..162bf5d 100644
--- a/src/vault.rs
+++ b/src/vault.rs
@@ -72,19 +72,29 @@ fn save_to_path(data: &VaultData, passphrase: &str, path: &Path) -> Result<()> {
 
     if let Some(parent) = path.parent() {
         std::fs::create_dir_all(parent)?;
+        #[cfg(unix)]
+        {
+            use std::os::unix::fs::PermissionsExt;
+            std::fs::set_permissions(parent, std::fs::Permissions::from_mode(0o700))?;
+        }
     }
 
     let mut blob = Vec::with_capacity(NONCE_LEN + ciphertext.len());
     blob.extend_from_slice(&nonce_bytes);
     blob.extend_from_slice(&ciphertext);
-    std::fs::write(path, &blob)?;
+
+    // Atomic write: write to temp file then rename
+    let tmp_path = path.with_extension("enc.tmp");
+    std::fs::write(&tmp_path, &blob)?;
 
     #[cfg(unix)]
     {
         use std::os::unix::fs::PermissionsExt;
-        std::fs::set_permissions(path, std::fs::Permissions::from_mode(0o600))?;
+        std::fs::set_permissions(&tmp_path, std::fs::Permissions::from_mode(0o600))?;
     }
 
+    std::fs::rename(&tmp_path, path)?;
+
     Ok(())
 }
 

From ae678c94098eacc9e33cb94366f5c40254c1b687 Mon Sep 17 00:00:00 2001
From: Jheison Martinez Bolivar <jhemar@nequi.com>
Date: Fri, 10 Apr 2026 12:22:40 -0500
Subject: [PATCH 08/13] docs: update README with vault, enforced labels and
 config command

---
 README.md | 100 +++++++++++++++++++++++++++++++++---------------------
 1 file changed, 61 insertions(+), 39 deletions(-)

diff --git a/README.md b/README.md
index 3c0061f..4faa29a 100644
--- a/README.md
+++ b/README.md
@@ -31,13 +31,13 @@ Interactive CLI wizard for creating and configuring GitHub repositories. One bin
 
 - **🪄 Interactive wizard** — Create GitHub repos with a conversational guided flow
 - **⚡ Zero dependencies** — Single binary, no runtime requirements
+- **🔒 Encrypted vault** — Tokens stored locally with XSalsa20-Poly1305, never in env vars or plain text
 - **🔄 Idempotent apply mode** — Configure existing repos without recreation
 - **👥 Team access control** — Assign repositories to organization teams with custom permissions (read, triage, write, admin)
-- **🏷️ Smart labels** — Auto-create 6 core issue labels
+- **🏷️ Enforced labels** — 7 standard labels synced on every run (non-standard labels are removed)
 - **🛡️ Branch protection** — Enforce reviews, status checks, and workflow validation
 - **🚀 Language templates** — Rust (v1), Python/Node.js/Java coming soon
 - **📝 Boilerplate files** — README, Cargo.toml, CI/CD workflows, LICENSE
-- **🔐 Token validation** — Fail-fast authentication checks
 - **🔑 Template secrets** — Automatically configures required GitHub Actions secrets per template
 - **⬆️ Self-update** — Detects new releases on startup and offers one-command upgrade
 
@@ -96,7 +96,7 @@ Check the [Releases](https://github.com/UniverLab/ghscaff/releases) page for pre
 
 ```bash
 rm -f ~/.local/bin/ghscaff         # ghscaff binary
-rm -rf ~/.ghscaff/                 # boilerplate cache
+rm -rf ~/.ghscaff/                 # boilerplate cache + encrypted vault
 ```
 
 ---
@@ -104,10 +104,8 @@ rm -rf ~/.ghscaff/                 # boilerplate cache
 ## Quick Start
 
 ```bash
-# Set your GitHub token
-export GITHUB_TOKEN=ghp_xxxxxxxxxxxx
-
 # Interactive wizard — create a new repo
+# (token is requested on first run and stored in the encrypted vault)
 ghscaff
 
 # Or directly with a subcommand
@@ -118,10 +116,52 @@ ghscaff apply owner/repo
 
 # Preview changes without API calls
 ghscaff --dry-run
+
+# Reconfigure credentials
+ghscaff config
 ```
 
 ---
 
+## Authentication
+
+ghscaff resolves the GitHub token in this order:
+
+1. **`GITHUB_TOKEN` env var** — for CI/CD and backward compatibility
+2. **Encrypted vault** (`~/.ghscaff/vault.enc`) — for secure local usage
+3. **Interactive prompt** — on first run, asks for the token and saves it to the vault
+
+### Encrypted Vault
+
+Tokens are encrypted with **XSalsa20-Poly1305** and a key derived from:
+
+| Factor | Purpose |
+|--------|---------|
+| Username | Only your OS user can decrypt |
+| Hostname | Copying the vault to another machine won't work |
+| Binary path | Other programs can't derive the same key |
+| Passphrase (optional) | Extra protection if desired |
+
+The vault file (`~/.ghscaff/vault.enc`) has `0600` permissions and the directory has `0700`. Writes are atomic (temp file + rename) to prevent corruption.
+
+### Reconfiguring
+
+```bash
+ghscaff config
+```
+
+This wipes the vault (with confirmation) and starts fresh — new token, optional passphrase. Template secrets will be requested on the next run.
+
+### Required token scopes
+
+- `repo` — Repository access
+- `workflow` — GitHub Actions access
+- `read:org` — (Optional) Organization and team access
+
+**Note on team access:** If your token lacks the `read:org` scope, the wizard will skip the team selection step with a warning, but the rest of the repository setup will continue normally.
+
+---
+
 ## Wizard Flow
 
 The wizard guides you through **7 interactive steps**:
@@ -139,8 +179,8 @@ Then **automatically**:
 - Commits all boilerplate files in a single atomic commit (`chore: init repository`)
 - Applies branch protection to main (and develop if created)
 - Adds selected teams with their assigned permissions
-- Syncs labels, topics, and CI/CD workflows
-- Configures required GitHub Actions secrets from `secrets.toml`
+- Enforces standard labels (creates missing, updates changed, removes non-standard)
+- Configures required GitHub Actions secrets (from vault, env, or interactive prompt)
 
 ---
 
@@ -158,10 +198,10 @@ ghscaff apply
 
 Applies:
 - ✅ Atomic single commit with all boilerplate files (no individual file commits)
-- ✅ Labels (creates missing, updates existing)
+- ✅ Labels enforced (creates missing, updates changed, **removes non-standard**)
 - ✅ Branch protection on `main` and `develop` (if created)
 - ✅ Topics (merges with existing)
-- ✅ GitHub Actions secrets (from template's `secrets.toml`)
+- ✅ GitHub Actions secrets (from vault, env, or interactive prompt)
 - ✅ CI/CD workflows (included in boilerplate)
 - ✅ `develop` branch (creates if absent)
 
@@ -182,28 +222,6 @@ ghscaff apply owner/repo --dry-run
 
 ---
 
-## Authentication
-
-`ghscaff` reads the GitHub token exclusively from the `GITHUB_TOKEN` environment variable:
-
-```bash
-export GITHUB_TOKEN=ghp_xxxxxxxxxxxx
-ghscaff
-```
-
-**Required token scopes:**
-- `repo` — Repository access
-- `workflow` — GitHub Actions access
-- `read:org` — (Optional, for team access feature) Organization and team access
-
-If the token is missing or invalid, ghscaff fails immediately with a clear error message before prompting anything else.
-
-**Note on team access:** If your token lacks the `read:org` scope, the wizard will skip the team selection step with a warning, but the rest of the repository setup will continue normally.
-
-**Security note:** Never hardcode tokens. Use environment variables or secret managers.
-
----
-
 ## Boilerplate Templates
 
 Each language template includes:
@@ -221,7 +239,7 @@ All files are merged into a single atomic `chore: init repository` commit.
 
 ## Standard Label Set
 
-6 core labels are auto-created with every new repo:
+7 labels are enforced on every repo. Non-standard labels are removed.
 
 | Label | Color | Description |
 |-------|-------|-------------|
@@ -229,7 +247,8 @@ All files are merged into a single atomic `chore: init repository` commit.
 | `feature` | `#a2eeef` | New feature or request |
 | `documentation` | `#0075ca` | Improvements to docs |
 | `breaking-change` | `#e4e669` | Introduces breaking changes |
-| `good first issue` | `#7057ff` | Good for newcomers |
+| `target:main` | `#1d76db` | Targets the main branch |
+| `target:develop` | `#0e8a16` | Targets the develop branch |
 | `help wanted` | `#008672` | Extra attention needed |
 
 ---
@@ -242,15 +261,18 @@ When enabled, applies to the default branch:
 - ✅ Dismiss stale reviews
 - ✅ Disallow force-push
 
---
+---
 
 ### Secrets Configuration
 
-If you're extending `ghscaff` with new templates or modifying the release workflow, you may need to set up GitHub Actions secrets for your development fork:
+Templates can declare required secrets in `secrets.toml`. ghscaff resolves them in order:
+
+1. **Encrypted vault** — previously saved secrets
+2. **Environment variable** — e.g. `CARGO_REGISTRY_TOKEN`
+3. **Interactive prompt** — with option to save to vault for future use
 
-- **`CARGO_REGISTRY_TOKEN`** — Required for publishing Rust crates to crates.io
-  - Get your token from [crates.io/me](https://crates.io/me)
-  - Add it as a repository secret in GitHub (`Settings > Secrets and variables > Actions`)
+For the Rust template:
+- **`CARGO_REGISTRY_TOKEN`** — Required for publishing to crates.io ([get one here](https://crates.io/me))
 
 ---
 

From a1dcc9c70ee3f5c245cf490b555b180777205dce Mon Sep 17 00:00:00 2001
From: Jheison Martinez Bolivar <jhemar@nequi.com>
Date: Fri, 10 Apr 2026 14:22:22 -0500
Subject: [PATCH 09/13] feat: offer gitkit clone after successful repo creation

---
 src/wizard.rs | 64 ++++++++++++++++++++++++++++++++++++++++++++++++++-
 1 file changed, 63 insertions(+), 1 deletion(-)

diff --git a/src/wizard.rs b/src/wizard.rs
index d16734d..7f9fd40 100644
--- a/src/wizard.rs
+++ b/src/wizard.rs
@@ -429,15 +429,77 @@ fn execute(
     }
 
     println!();
-    if let Some(r) = created_repo {
+    if let Some(r) = &created_repo {
         println!("  Done  —  {}", r.html_url);
     } else {
         println!("  Done  (dry-run)");
     }
     println!();
+
+    if !dry_run {
+        if let Some(r) = &created_repo {
+            offer_gitkit_clone(&r.html_url);
+        }
+    }
+
     Ok(())
 }
 
+fn offer_gitkit_clone(repo_url: &str) {
+    let Ok(want_clone) = Confirm::new("Clone the repository with gitkit?")
+        .with_default(true)
+        .prompt()
+    else {
+        return;
+    };
+    if !want_clone {
+        return;
+    }
+
+    if !is_command_available("gitkit") {
+        println!("  gitkit not found. Installing...\n");
+        install_gitkit();
+        if !is_command_available("gitkit") {
+            println!("  ⚠ gitkit installation failed — clone manually with:");
+            println!("    gitkit clone {repo_url}");
+            return;
+        }
+    }
+
+    let _ = std::process::Command::new("gitkit")
+        .args(["clone", repo_url])
+        .status();
+}
+
+fn is_command_available(cmd: &str) -> bool {
+    std::process::Command::new("which")
+        .arg(cmd)
+        .output()
+        .map(|o| o.status.success())
+        .unwrap_or(false)
+}
+
+fn install_gitkit() {
+    #[cfg(not(target_os = "windows"))]
+    {
+        let _ = std::process::Command::new("sh")
+            .args([
+                "-c",
+                "curl -fsSL https://raw.githubusercontent.com/UniverLab/gitkit/main/scripts/install.sh | sh",
+            ])
+            .status();
+    }
+    #[cfg(target_os = "windows")]
+    {
+        let _ = std::process::Command::new("powershell")
+            .args([
+                "-Command",
+                "irm https://raw.githubusercontent.com/UniverLab/gitkit/main/scripts/install.ps1 | iex",
+            ])
+            .status();
+    }
+}
+
 fn count_steps(c: &WizardConfig, secrets: &[templates::SecretSpec]) -> usize {
     let mut n = 1; // create repo
     n += 1; // init commit (all boilerplate files in one shot)

From 2b78a807773dee308d488c574f1e47b5515169fe Mon Sep 17 00:00:00 2001
From: Jheison Martinez Bolivar <jhemar@nequi.com>
Date: Fri, 10 Apr 2026 14:49:52 -0500
Subject: [PATCH 10/13] feat: add 'none' template option for empty repos
 without boilerplate

---
 src/wizard.rs | 109 ++++++++++++++++++++++++++++++--------------------
 1 file changed, 66 insertions(+), 43 deletions(-)

diff --git a/src/wizard.rs b/src/wizard.rs
index 7f9fd40..6bcf3dc 100644
--- a/src/wizard.rs
+++ b/src/wizard.rs
@@ -30,7 +30,7 @@ pub struct WizardConfig {
     pub private: bool,
     pub owner: String,
     pub is_org: bool,
-    pub language: String,
+    pub language: Option<String>,
     pub default_branch: String,
     pub create_develop: bool,
     pub license: Option<String>,
@@ -157,10 +157,16 @@ fn collect_config(client: &GithubClient, username: &str) -> Result<WizardConfig>
     };
 
     // Step 3 — Language
-    let language = Select::new("Language:", templates::AVAILABLE.to_vec())
-        .with_help_message("Drives .gitignore, CI workflow, and boilerplate")
-        .prompt()?
-        .to_string();
+    let mut lang_options: Vec<&str> = templates::AVAILABLE.to_vec();
+    lang_options.push("none");
+    let lang_choice = Select::new("Template:", lang_options)
+        .with_help_message("Drives .gitignore, CI workflow, and boilerplate. 'none' = empty repo")
+        .prompt()?;
+    let language = if lang_choice == "none" {
+        None
+    } else {
+        Some(lang_choice.to_string())
+    };
 
     // Step 4 — Branches
     let default_branch = Text::new("Default branch:").with_default("main").prompt()?;
@@ -212,11 +218,20 @@ fn execute(
 ) -> Result<()> {
     println!();
 
-    // Always download fresh template for `new` so cache is never stale
-    print!("  Fetching boilerplate template... ");
-    let tmpl = templates::resolve(&c.language, token, true)?;
-    println!("ok");
-    let secret_specs = templates::load_secrets(&c.language);
+    // Fetch template if selected
+    let tmpl = if let Some(lang) = &c.language {
+        print!("  Fetching boilerplate template... ");
+        let t = templates::resolve(lang, token, true)?;
+        println!("ok");
+        Some(t)
+    } else {
+        None
+    };
+    let secret_specs = c
+        .language
+        .as_deref()
+        .map(templates::load_secrets)
+        .unwrap_or_default();
     let total = count_steps(c, &secret_specs);
     let mut step = 0usize;
 
@@ -267,21 +282,21 @@ fn execute(
     // 2. Collect all boilerplate files for a single init commit
     let mut init_files: Vec<contents::TreeFile> = vec![];
 
-    // Template files (boilerplate — all files including ci.yml, release.yml, etc.)
-    for f in tmpl.boilerplate_files(name, &c.description, owner) {
+    if let Some(tmpl) = &tmpl {
+        for f in tmpl.boilerplate_files(name, &c.description, owner) {
+            init_files.push(contents::TreeFile {
+                path: f.path,
+                content: f.content,
+            });
+        }
+
+        let gitignore = repo::get_gitignore_template(client, &tmpl.gitignore_name())?;
         init_files.push(contents::TreeFile {
-            path: f.path,
-            content: f.content,
+            path: ".gitignore".into(),
+            content: gitignore,
         });
     }
 
-    // .gitignore — fetched fresh from GitHub's gitignore API
-    let gitignore = repo::get_gitignore_template(client, &tmpl.gitignore_name())?;
-    init_files.push(contents::TreeFile {
-        path: ".gitignore".into(),
-        content: gitignore,
-    });
-
     // LICENSE (placeholder — user replaces it or CI generates it)
     if let Some(lic) = &c.license {
         let license_text = format!(
@@ -294,23 +309,28 @@ fn execute(
         });
     }
 
-    // 3. Single init commit with all files
+    // 3. Single init commit with all files (skip if empty repo with no LICENSE)
     let mut init_sha = String::new();
-    step!("init repository", {
-        let sha = contents::create_tree_commit(
-            client,
-            owner,
-            name,
-            &init_files,
-            "chore: init repository",
-            &c.default_branch,
-        )?;
-        init_sha = sha;
-        Ok::<(), anyhow::Error>(())
-    });
+    if !init_files.is_empty() {
+        step!("init repository", {
+            let sha = contents::create_tree_commit(
+                client,
+                owner,
+                name,
+                &init_files,
+                "chore: init repository",
+                &c.default_branch,
+            )?;
+            init_sha = sha;
+            Ok::<(), anyhow::Error>(())
+        });
+    }
 
     // 4. develop branch
     if c.create_develop {
+        if init_sha.is_empty() {
+            init_sha = branches::get_branch_sha(client, owner, name, &c.default_branch)?;
+        }
         step!("create develop branch", {
             branches::create_branch(client, owner, name, "develop", &init_sha)?;
             Ok::<(), anyhow::Error>(())
@@ -502,19 +522,22 @@ fn install_gitkit() {
 
 fn count_steps(c: &WizardConfig, secrets: &[templates::SecretSpec]) -> usize {
     let mut n = 1; // create repo
-    n += 1; // init commit (all boilerplate files in one shot)
+    let has_files = c.language.is_some() || c.license.is_some();
+    if has_files {
+        n += 1; // init commit
+    }
     if c.create_develop {
-        n += 1; // create develop
+        n += 1;
         n += 1; // protect develop
     }
-    n += 1; // protect main (always)
+    n += 1; // protect main
     if c.create_labels {
         n += 1;
     }
     if !c.topics.is_empty() {
         n += 1;
     }
-    n += c.team_access.len(); // one step per team
+    n += c.team_access.len();
     n += secrets.len();
     n
 }
@@ -543,7 +566,7 @@ mod tests {
             private: false,
             owner: "my-org".to_string(),
             is_org: true,
-            language: "rust".to_string(),
+            language: Some("rust".to_string()),
             default_branch: "main".to_string(),
             create_develop: true,
             license: Some("MIT".to_string()),
@@ -568,7 +591,7 @@ mod tests {
             private: true,
             owner: "my-user".to_string(),
             is_org: false,
-            language: "rust".to_string(),
+            language: Some("rust".to_string()),
             default_branch: "main".to_string(),
             create_develop: false,
             license: None,
@@ -600,7 +623,7 @@ mod tests {
             private: false,
             owner: "org".to_string(),
             is_org: true,
-            language: "rust".to_string(),
+            language: Some("rust".to_string()),
             default_branch: "main".to_string(),
             create_develop: true,
             license: Some("MIT".to_string()),
@@ -630,7 +653,7 @@ mod tests {
             private: false,
             owner: "user".to_string(),
             is_org: false,
-            language: "rust".to_string(),
+            language: Some("rust".to_string()),
             default_branch: "main".to_string(),
             create_develop: false,
             license: None,
@@ -660,7 +683,7 @@ mod tests {
             private: false,
             owner: "org".to_string(),
             is_org: true,
-            language: "rust".to_string(),
+            language: Some("rust".to_string()),
             default_branch: "main".to_string(),
             create_develop: true,
             license: Some("Apache-2.0".to_string()),

From 463117cfa5b94446a02af270420d7e09c5be37dc Mon Sep 17 00:00:00 2001
From: Jheison Martinez Bolivar <jhemar@nequi.com>
Date: Fri, 10 Apr 2026 15:27:04 -0500
Subject: [PATCH 11/13] feat: ask SSH or HTTPS protocol before gitkit clone

---
 src/wizard.rs | 19 ++++++++++++++-----
 1 file changed, 14 insertions(+), 5 deletions(-)

diff --git a/src/wizard.rs b/src/wizard.rs
index 6bcf3dc..2a4c352 100644
--- a/src/wizard.rs
+++ b/src/wizard.rs
@@ -457,15 +457,15 @@ fn execute(
     println!();
 
     if !dry_run {
-        if let Some(r) = &created_repo {
-            offer_gitkit_clone(&r.html_url);
+        if let Some(_r) = &created_repo {
+            offer_gitkit_clone(owner, name);
         }
     }
 
     Ok(())
 }
 
-fn offer_gitkit_clone(repo_url: &str) {
+fn offer_gitkit_clone(owner: &str, repo: &str) {
     let Ok(want_clone) = Confirm::new("Clone the repository with gitkit?")
         .with_default(true)
         .prompt()
@@ -476,18 +476,27 @@ fn offer_gitkit_clone(repo_url: &str) {
         return;
     }
 
+    let protocol = Select::new("Clone via:", vec!["SSH", "HTTPS"])
+        .prompt()
+        .unwrap_or("HTTPS");
+
+    let clone_url = match protocol {
+        "SSH" => format!("git@github.com:{owner}/{repo}.git"),
+        _ => format!("https://github.com/{owner}/{repo}.git"),
+    };
+
     if !is_command_available("gitkit") {
         println!("  gitkit not found. Installing...\n");
         install_gitkit();
         if !is_command_available("gitkit") {
             println!("  ⚠ gitkit installation failed — clone manually with:");
-            println!("    gitkit clone {repo_url}");
+            println!("    gitkit clone {clone_url}");
             return;
         }
     }
 
     let _ = std::process::Command::new("gitkit")
-        .args(["clone", repo_url])
+        .args(["clone", &clone_url])
         .status();
 }
 

From 11062c73bfc51432f6e42273fa013250402022ed Mon Sep 17 00:00:00 2001
From: Jheison Martinez Bolivar <jheison.mb@gmail.com>
Date: Fri, 10 Apr 2026 16:22:31 -0500
Subject: [PATCH 12/13] fix: skip CI status check in branch protection when no
 template selected

---
 src/apply.rs           |  2 +-
 src/github/branches.rs |  4 ++--
 src/wizard.rs          | 22 +++++++---------------
 3 files changed, 10 insertions(+), 18 deletions(-)

diff --git a/src/apply.rs b/src/apply.rs
index fb9feab..c0f3c83 100644
--- a/src/apply.rs
+++ b/src/apply.rs
@@ -345,7 +345,7 @@ pub fn run_apply(repo_arg: Option<&str>, dry_run: bool) -> Result<()> {
         &owner,
         &repo_name,
         "main",
-        "rust-ci / Format, Lint & Test",
+        Some("rust-ci / Format, Lint & Test"),
     ) {
         Ok(()) => println!("  ✓ Branch protection applied"),
         Err(e) => {
diff --git a/src/github/branches.rs b/src/github/branches.rs
index c02c256..8af1e3d 100644
--- a/src/github/branches.rs
+++ b/src/github/branches.rs
@@ -50,7 +50,7 @@ pub fn apply_branch_protection(
     owner: &str,
     repo: &str,
     branch: &str,
-    ci_check: &str,
+    ci_check: Option<&str>,
 ) -> Result<()> {
     #[derive(Serialize)]
     struct Body<'a> {
@@ -80,7 +80,7 @@ pub fn apply_branch_protection(
     let body = Body {
         required_status_checks: RequiredChecks {
             strict: true,
-            contexts: vec![ci_check],
+            contexts: ci_check.into_iter().collect(),
         },
         enforce_admins: false,
         required_pull_request_reviews: Reviews {
diff --git a/src/wizard.rs b/src/wizard.rs
index 2a4c352..cf6f2ac 100644
--- a/src/wizard.rs
+++ b/src/wizard.rs
@@ -337,29 +337,21 @@ fn execute(
         });
     }
 
-    // 5. Branch protection — always applied to main (and develop if created)
+    // 5. Branch protection
+    let ci_check = c
+        .language
+        .as_deref()
+        .map(|_| "rust-ci / Format, Lint & Test");
     step!(
         &format!("apply branch protection ({})", c.default_branch),
         {
-            branches::apply_branch_protection(
-                client,
-                owner,
-                name,
-                &c.default_branch,
-                "rust-ci / Format, Lint & Test",
-            )?;
+            branches::apply_branch_protection(client, owner, name, &c.default_branch, ci_check)?;
             Ok::<(), anyhow::Error>(())
         }
     );
     if c.create_develop {
         step!("apply branch protection (develop)", {
-            branches::apply_branch_protection(
-                client,
-                owner,
-                name,
-                "develop",
-                "rust-ci / Format, Lint & Test",
-            )?;
+            branches::apply_branch_protection(client, owner, name, "develop", ci_check)?;
             Ok::<(), anyhow::Error>(())
         });
     }

From 49348f44a36c3427f3879897873b694e9e4e902e Mon Sep 17 00:00:00 2001
From: Jheison Martinez Bolivar <jheison.mb@gmail.com>
Date: Sun, 12 Apr 2026 07:34:09 -0500
Subject: [PATCH 13/13] chore: replace assignment pattern to struct
 initialization with field values directly

---
 .github/workflows/ci.yml |  1 +
 src/vault.rs             | 12 ++++++++----
 2 files changed, 9 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index efa5cac..ec44e2d 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -2,6 +2,7 @@ name: CI
 
 on:
   pull_request:
+  workflow_dispatch:
 
 jobs:
   rust-ci:
diff --git a/src/vault.rs b/src/vault.rs
index 162bf5d..1965431 100644
--- a/src/vault.rs
+++ b/src/vault.rs
@@ -350,12 +350,16 @@ mod tests {
         let dir = tempfile::tempdir().unwrap();
         let path = dir.path().join("vault.enc");
 
-        let mut data1 = VaultData::default();
-        data1.github_token = Some("token_v1".into());
+        let data1 = VaultData {
+            github_token: Some("token_v1".into()),
+            ..Default::default()
+        };
         save_to_path(&data1, "", &path).unwrap();
 
-        let mut data2 = VaultData::default();
-        data2.github_token = Some("token_v2".into());
+        let data2 = VaultData {
+            github_token: Some("token_v2".into()),
+            ..Default::default()
+        };
         save_to_path(&data2, "", &path).unwrap();
 
         let loaded = load_from_path("", &path).unwrap().unwrap();