style(plugins): use picocli output streams and address review findings

- Replace System.out/err with spec.commandLine().getOut()/getErr() in all
  keystore commands, consistent with existing db commands pattern
- Fix description from "witness account keys" to "account keys"
- Unify permission warning for UnsupportedOperationException and IOException
- Add Keystore section to plugins/README.md with migration guide
- Update tests to use cmd.setOut()/setErr() instead of System.setOut()

Author: Barbatos

plugins/README.md

@@ -143,3 +143,72 @@ NOTE: large db may GC overhead limit exceeded.
 - `<src>`: Source path for database. Default: output-directory/database
 - `--db`: db name.
 - `-h | --help`: provide the help info
+
+## Keystore
+
+Keystore provides commands for managing account keystore files (Web3 Secret Storage format).
+
+> **Migrating from `--keystore-factory`**: The legacy `FullNode.jar --keystore-factory` interactive mode is deprecated. Use the Toolkit keystore commands below instead. The mapping is:
+> - `GenKeystore` → `keystore new`
+> - `ImportPrivateKey` → `keystore import`
+> - (new) `keystore list` — list all keystores in a directory
+> - (new) `keystore update` — change the password of a keystore
+
+### Subcommands
+
+#### keystore new
+
+Generate a new keystore file with a random keypair.
+
+```shell script
+# full command
+  java -jar Toolkit.jar keystore new [-h] [--keystore-dir=<dir>] [--password-file=<file>] [--sm2] [--json]
+# examples
+  java -jar Toolkit.jar keystore new                                  # interactive prompt
+  java -jar Toolkit.jar keystore new --keystore-dir /data/keystores   # custom directory
+  java -jar Toolkit.jar keystore new --password-file pass.txt --json  # non-interactive with JSON output
+```
+
+#### keystore import
+
+Import a private key into a new keystore file.
+
+```shell script
+# full command
+  java -jar Toolkit.jar keystore import [-h] [--keystore-dir=<dir>] [--password-file=<file>] [--private-key-file=<file>] [--sm2] [--json]
+# examples
+  java -jar Toolkit.jar keystore import                                        # interactive prompt
+  java -jar Toolkit.jar keystore import --private-key-file key.txt --json      # from file with JSON output
+```
+
+#### keystore list
+
+List all keystore files in a directory.
+
+```shell script
+# full command
+  java -jar Toolkit.jar keystore list [-h] [--keystore-dir=<dir>] [--json]
+# examples
+  java -jar Toolkit.jar keystore list                                  # list default ./Wallet directory
+  java -jar Toolkit.jar keystore list --keystore-dir /data/keystores   # custom directory
+```
+
+#### keystore update
+
+Change the password of a keystore file.
+
+```shell script
+# full command
+  java -jar Toolkit.jar keystore update [-h] <address> [--keystore-dir=<dir>] [--password-file=<file>] [--new-password-file=<file>] [--json]
+# examples
+  java -jar Toolkit.jar keystore update TXyz...abc                          # interactive prompt
+  java -jar Toolkit.jar keystore update TXyz...abc --keystore-dir /data/ks  # custom directory
+```
+
+### Common Options
+
+- `--keystore-dir`: Keystore directory, default: `./Wallet`.
+- `--password-file`: Read password from a file instead of interactive prompt.
+- `--sm2`: Use SM2 algorithm instead of ECDSA (for `new` and `import`).
+- `--json`: Output in JSON format for scripting.
+- `-h | --help`: Provide the help info.

plugins/src/main/java/common/org/tron/plugins/Keystore.java

@@ -6,7 +6,7 @@
 @Command(name = "keystore",
     mixinStandardHelpOptions = true,
     version = "keystore command 1.0",
-    description = "Manage keystore files for witness account keys.",
+    description = "Manage keystore files for account keys.",
     subcommands = {CommandLine.HelpCommand.class,
         KeystoreNew.class,
         KeystoreImport.class,

plugins/src/main/java/common/org/tron/plugins/KeystoreCliUtils.java

@@ -4,6 +4,7 @@
 import java.io.Console;
 import java.io.File;
 import java.io.IOException;
+import java.io.PrintWriter;
 import java.nio.charset.StandardCharsets;
 import java.nio.file.Files;
 import java.nio.file.Path;
@@ -28,23 +29,23 @@ final class KeystoreCliUtils {
   private KeystoreCliUtils() {
   }
 
-  static String readPassword(File passwordFile) throws IOException {
+  static String readPassword(File passwordFile, PrintWriter err) throws IOException {
     if (passwordFile != null) {
       if (!passwordFile.exists()) {
-        System.err.println("Password file not found: " + passwordFile.getPath()
+        err.println("Password file not found: " + passwordFile.getPath()
             + ". Omit --password-file for interactive input.");
         return null;
       }
       if (passwordFile.length() > MAX_FILE_SIZE) {
-        System.err.println("Password file too large (max 1KB).");
+        err.println("Password file too large (max 1KB).");
         return null;
       }
       byte[] bytes = Files.readAllBytes(passwordFile.toPath());
       try {
         String password = stripLineEndings(
             new String(bytes, StandardCharsets.UTF_8));
         if (!WalletUtils.passwordValid(password)) {
-          System.err.println("Invalid password: must be at least 6 characters.");
+          err.println("Invalid password: must be at least 6 characters.");
           return null;
         }
         return password;
@@ -55,30 +56,30 @@ static String readPassword(File passwordFile) throws IOException {
 
     Console console = System.console();
     if (console == null) {
-      System.err.println("No interactive terminal available. "
+      err.println("No interactive terminal available. "
           + "Use --password-file to provide password.");
       return null;
     }
 
     char[] pwd1 = console.readPassword("Enter password: ");
     if (pwd1 == null) {
-      System.err.println("Password input cancelled.");
+      err.println("Password input cancelled.");
       return null;
     }
     char[] pwd2 = console.readPassword("Confirm password: ");
     if (pwd2 == null) {
       Arrays.fill(pwd1, '\0');
-      System.err.println("Password input cancelled.");
+      err.println("Password input cancelled.");
       return null;
     }
     try {
       if (!Arrays.equals(pwd1, pwd2)) {
-        System.err.println("Passwords do not match.");
+        err.println("Passwords do not match.");
         return null;
       }
       String password = new String(pwd1);
       if (!WalletUtils.passwordValid(password)) {
-        System.err.println("Invalid password: must be at least 6 characters.");
+        err.println("Invalid password: must be at least 6 characters.");
         return null;
       }
       return password;
@@ -105,11 +106,11 @@ static ObjectMapper mapper() {
     return MAPPER;
   }
 
-  static void printJson(Map<String, String> fields) {
+  static void printJson(PrintWriter out, PrintWriter err, Map<String, String> fields) {
     try {
-      System.out.println(MAPPER.writeValueAsString(fields));
+      out.println(MAPPER.writeValueAsString(fields));
     } catch (Exception e) {
-      System.err.println("Error writing JSON output");
+      err.println("Error writing JSON output");
     }
   }
 
@@ -138,40 +139,39 @@ static String stripLineEndings(String s) {
     return s.substring(0, end);
   }
 
-  static boolean checkFileExists(File file, String label) {
+  static boolean checkFileExists(File file, String label, PrintWriter err) {
     if (file != null && !file.exists()) {
-      System.err.println(label + " not found: " + file.getPath());
+      err.println(label + " not found: " + file.getPath());
       return false;
     }
     return true;
   }
 
-  static void printSecurityTips(String address, String fileName) {
-    System.out.println();
-    System.out.println("Public address of the key:   " + address);
-    System.out.println("Path of the secret key file: " + fileName);
-    System.out.println();
-    System.out.println(
+  static void printSecurityTips(PrintWriter out, String address, String fileName) {
+    out.println();
+    out.println("Public address of the key:   " + address);
+    out.println("Path of the secret key file: " + fileName);
+    out.println();
+    out.println(
         "- You can share your public address with anyone."
             + " Others need it to interact with you.");
-    System.out.println(
+    out.println(
         "- You must NEVER share the secret key with anyone!"
             + " The key controls access to your funds!");
-    System.out.println(
+    out.println(
         "- You must BACKUP your key file!"
             + " Without the key, it's impossible to access account funds!");
-    System.out.println(
+    out.println(
         "- You must REMEMBER your password!"
             + " Without the password, it's impossible to decrypt the key!");
   }
 
-  static void setOwnerOnly(File file) {
+  static void setOwnerOnly(File file, PrintWriter err) {
     try {
       Files.setPosixFilePermissions(file.toPath(), OWNER_ONLY);
-    } catch (UnsupportedOperationException e) {
-      // Windows — skip
-    } catch (IOException e) {
-      System.err.println("Warning: could not set file permissions on " + file.getName());
+    } catch (UnsupportedOperationException | IOException e) {
+      err.println("Warning: could not set file permissions on " + file.getName()
+          + ". Please manually restrict access (e.g. chmod 600).");
     }
   }
 }

plugins/src/main/java/common/org/tron/plugins/KeystoreImport.java

@@ -3,6 +3,7 @@
 import java.io.Console;
 import java.io.File;
 import java.io.IOException;
+import java.io.PrintWriter;
 import java.nio.charset.StandardCharsets;
 import java.nio.file.Files;
 import java.util.Arrays;
@@ -15,13 +16,18 @@
 import org.tron.keystore.Credentials;
 import org.tron.keystore.WalletUtils;
 import picocli.CommandLine.Command;
+import picocli.CommandLine.Model.CommandSpec;
 import picocli.CommandLine.Option;
+import picocli.CommandLine.Spec;
 
 @Command(name = "import",
     mixinStandardHelpOptions = true,
     description = "Import a private key into a new keystore file.")
 public class KeystoreImport implements Callable<Integer> {
 
+  @Spec
+  private CommandSpec spec;
+
   @Option(names = {"--keystore-dir"},
       description = "Keystore directory (default: ./Wallet)",
       defaultValue = "Wallet")
@@ -49,13 +55,15 @@ public class KeystoreImport implements Callable<Integer> {
 
   @Override
   public Integer call() {
+    PrintWriter out = spec.commandLine().getOut();
+    PrintWriter err = spec.commandLine().getErr();
     try {
-      if (!KeystoreCliUtils.checkFileExists(keyFile, "Key file")) {
+      if (!KeystoreCliUtils.checkFileExists(keyFile, "Key file", err)) {
         return 1;
       }
       KeystoreCliUtils.ensureDirectory(keystoreDir);
 
-      String privateKey = readPrivateKey();
+      String privateKey = readPrivateKey(err);
       if (privateKey == null) {
         return 1;
       }
@@ -64,11 +72,11 @@ public Integer call() {
         privateKey = privateKey.substring(2);
       }
       if (!isValidPrivateKey(privateKey)) {
-        System.err.println("Invalid private key: must be 64 hex characters.");
+        err.println("Invalid private key: must be 64 hex characters.");
         return 1;
       }
 
-      String password = KeystoreCliUtils.readPassword(passwordFile);
+      String password = KeystoreCliUtils.readPassword(passwordFile, err);
       if (password == null) {
         return 1;
       }
@@ -79,42 +87,42 @@ public Integer call() {
         keyPair = SignUtils.fromPrivate(
             ByteArray.fromHexString(privateKey), ecKey);
       } catch (Exception e) {
-        System.err.println("Invalid private key: not a valid key"
+        err.println("Invalid private key: not a valid key"
             + " for the selected algorithm.");
         return 1;
       }
       String address = Credentials.create(keyPair).getAddress();
       String existingFile = findExistingKeystore(keystoreDir, address);
       if (existingFile != null && !force) {
-        System.err.println("Keystore for address " + address
+        err.println("Keystore for address " + address
             + " already exists: " + existingFile
             + ". Use --force to import anyway.");
         return 1;
       }
       String fileName = WalletUtils.generateWalletFile(password, keyPair, keystoreDir, true);
-      KeystoreCliUtils.setOwnerOnly(new File(keystoreDir, fileName));
+      KeystoreCliUtils.setOwnerOnly(new File(keystoreDir, fileName), err);
       if (json) {
-        KeystoreCliUtils.printJson(KeystoreCliUtils.jsonMap(
+        KeystoreCliUtils.printJson(out, err, KeystoreCliUtils.jsonMap(
             "address", address, "file", fileName));
       } else {
-        System.out.println("Imported keystore successfully");
-        KeystoreCliUtils.printSecurityTips(address,
+        out.println("Imported keystore successfully");
+        KeystoreCliUtils.printSecurityTips(out, address,
             new File(keystoreDir, fileName).getPath());
       }
       return 0;
     } catch (CipherException e) {
-      System.err.println("Encryption error: " + e.getMessage());
+      err.println("Encryption error: " + e.getMessage());
       return 1;
     } catch (Exception e) {
-      System.err.println("Error: " + e.getMessage());
+      err.println("Error: " + e.getMessage());
       return 1;
     }
   }
 
-  private String readPrivateKey() throws IOException {
+  private String readPrivateKey(PrintWriter err) throws IOException {
     if (keyFile != null) {
       if (keyFile.length() > 1024) {
-        System.err.println("Key file too large (max 1KB).");
+        err.println("Key file too large (max 1KB).");
         return null;
       }
       byte[] bytes = Files.readAllBytes(keyFile.toPath());
@@ -127,14 +135,14 @@ private String readPrivateKey() throws IOException {
 
     Console console = System.console();
     if (console == null) {
-      System.err.println("No interactive terminal available. "
+      err.println("No interactive terminal available. "
           + "Use --key-file to provide private key.");
       return null;
     }
 
     char[] key = console.readPassword("Enter private key (hex): ");
     if (key == null) {
-      System.err.println("Input cancelled.");
+      err.println("Input cancelled.");
       return null;
     }
     try {