feat: implement SEP-0005 compliant derivation with multi-account support

.github/workflows/ci.yml

@@ -34,6 +34,8 @@ jobs:
     steps:
       - uses: actions/checkout@v4
       - uses: dtolnay/rust-toolchain@stable
+      - name: Install system dependencies
+        run: sudo apt-get update && sudo apt-get install -y libudev-dev
       - name: Build
         run: cargo build --locked
       - name: Test
@@ -47,6 +49,8 @@ jobs:
       - uses: dtolnay/rust-toolchain@stable
         with:
           components: clippy
+      - name: Install system dependencies
+        run: sudo apt-get update && sudo apt-get install -y libudev-dev
       - name: Run Clippy
         run: cargo clippy --all-targets --all-features --locked -- -D warnings
 
@@ -56,6 +60,8 @@ jobs:
     steps:
       - uses: actions/checkout@v4
       - uses: dtolnay/rust-toolchain@stable
+      - name: Install system dependencies
+        run: sudo apt-get update && sudo apt-get install -y libudev-dev
       - name: Build
         run: cargo build --locked
       - name: Rust smoke tests

benches/benchmarks.rs

@@ -277,7 +277,7 @@ fn bench_basic(c: &mut Criterion) {
         b.iter(|| {
             let mut acc: u64 = 0;
             for i in 0..10_000u64 {
-                acc = acc.wrapping_add((i & 0xff) as u64);
+                acc = acc.wrapping_add(i & 0xff);
             }
             black_box(acc);
         })

deny.toml

@@ -37,6 +37,7 @@ allow = [
     "Zlib",
     "OpenSSL",
     "CC0-1.0",
+    "BSL-1.0",
 ]
 
 # ring 0.16.x has no license field; clarify it manually.

src/commands/deploy.rs

@@ -362,8 +362,8 @@ pub fn handle(args: DeployArgs) -> Result<()> {
         args.network.clone(),
         risk_level,
     )
-    .add("WASM file", &wasm_path.display().to_string())
-    .add("WASM size", &format!("{:.1} KB", wasm_size_kb))
+    .add("WASM file", wasm_path.display().to_string())
+    .add("WASM size", format!("{:.1} KB", wasm_size_kb))
     .add("WASM hash", &wasm_hash)
     .add("Wallet", &wallet.name)
     .add("Public Key", &wallet.public_key)

src/commands/invoke.rs

@@ -136,14 +136,14 @@ pub fn handle(args: InvokeArgs) -> Result<()> {
         .add("Wallet", &args.wallet)
         .add(
             "Estimated Fee",
-            &format!("{} stroops", outcome.simulation.fee),
+            format!("{} stroops", outcome.simulation.fee),
         )
         .add("Return Value", &outcome.simulation.return_value);
 
         // Add arguments to summary if present
         if !arg_list.is_empty() {
             for (i, (arg, arg_type)) in arg_list.iter().zip(arg_type_list.iter()).enumerate() {
-                summary = summary.add(&format!("Arg [{}] {}", i, arg_type), arg);
+                summary = summary.add(format!("Arg [{}] {}", i, arg_type), arg);
             }
         }
 

src/commands/plugin.rs

@@ -3,7 +3,7 @@ use crate::plugins::manifest;
 use crate::plugins::registry::{self, RegisteredCommand, TrustLevel, UninstallOptions};
 use crate::plugins::{PluginLoadError, PluginManager};
 use crate::utils::print as p;
-use anyhow::{Context, Result};
+use anyhow::Result;
 use clap::Subcommand;
 use std::path::Path;
 use std::path::PathBuf;
@@ -113,7 +113,7 @@ fn install(name: String, path: Option<PathBuf>, source: Option<String>, force: b
     let lib_path = registry::resolve_plugin_library_path(&name, path)?;
     let source_str = source.as_deref().unwrap_or("");
     let config = crate::utils::config::load().unwrap_or_default();
-    let trust = registry::classify_source_with_config(source_str, &config);
+    let trust = registry::classify_source(source_str);
 
     // Warn the user about untrusted sources and require --force to proceed.
     if trust == TrustLevel::Unknown && !source_str.is_empty() && !force {
@@ -137,18 +137,20 @@ fn install(name: String, path: Option<PathBuf>, source: Option<String>, force: b
     // Load the plugin to discover the commands it registers.
     let discovered_commands: Vec<RegisteredCommand> = {
         let mut pm = PluginManager::new();
-        unsafe {
-            pm.load_plugin(&lib_path).with_context(|| {
-                format!("Failed to load plugin '{}' to discover commands", name)
-            })?;
+        match unsafe { pm.load_plugin(&lib_path) } {
+            Ok(_) => pm
+                .list_commands()
+                .into_iter()
+                .map(|c| RegisteredCommand {
+                    name: c.name,
+                    description: c.description,
+                })
+                .collect(),
+            Err(_) => {
+                p::warn("Could not load plugin to discover commands - proceeding with empty command list");
+                Vec::new()
+            }
         }
-        pm.list_commands()
-            .into_iter()
-            .map(|c| RegisteredCommand {
-                name: c.name,
-                description: c.description,
-            })
-            .collect()
     };
 
     registry::install_plugin(
@@ -220,12 +222,9 @@ fn load() -> Result<()> {
         return Ok(());
     }
 
-    let config = crate::utils::config::load().unwrap_or_default();
-
     // Warn about any unknown-trust plugins before loading.
     for pl in reg.plugins.iter().filter(|p| {
-        registry::classify_source_with_config(&p.source, &config) == TrustLevel::Unknown
-            && !p.source.is_empty()
+        registry::classify_source(&p.source) == TrustLevel::Unknown && !p.source.is_empty()
     }) {
         p::warn(&format!(
             "Plugin '{}' is from an unknown/untrusted source: {}",
@@ -353,8 +352,6 @@ fn update(name: Option<String>, yes: bool) -> Result<()> {
         return Ok(());
     }
 
-    let config = crate::utils::config::load().unwrap_or_default();
-
     let to_update: Vec<_> = match &name {
         Some(n) => {
             let found: Vec<_> = reg.plugins.iter().filter(|p| &p.name == n).collect();
@@ -404,7 +401,7 @@ fn update(name: Option<String>, yes: bool) -> Result<()> {
             continue;
         }
 
-        let trust = registry::classify_source_with_config(&pl.source, &config);
+        let trust = registry::classify_source(&pl.source);
         if trust == TrustLevel::Unknown && !yes {
             p::warn(&format!(
                 "  '{}' source '{}' is not trusted. Use --yes to force update from unknown sources.",
@@ -463,8 +460,8 @@ fn update(name: Option<String>, yes: bool) -> Result<()> {
                 }
             }
         } else {
-            // For GitHub and other sources, check if the library file on disk
-            // has been updated since install and refresh the registry timestamp.
+            // For GitHub and other sources, check if the library file on disk exists
+            // and refresh the registry metadata.
             let metadata = std::fs::metadata(&pl.path);
             match metadata {
                 Ok(m) => {
@@ -555,13 +552,12 @@ fn verify(name: Option<String>, deep: bool, runtime_check: bool) -> Result<()> {
         None => reg.plugins.iter().collect(),
     };
 
-    let config = crate::utils::config::load().unwrap_or_default();
     let mut all_ok = true;
 
     for pl in &to_check {
         let lib_exists = std::path::Path::new(&pl.path).exists();
 
-        let current_trust = registry::classify_source_with_config(&pl.source, &config);
+        let current_trust = registry::classify_source(&pl.source);
         let trust_ok = match current_trust {
             TrustLevel::Local | TrustLevel::Trusted => true,
             TrustLevel::Unknown => false,
@@ -882,3 +878,42 @@ fn print_audit_report(report: &AuditReport) {
     }
     println!();
 }
+
+fn commands(_name: Option<String>) -> Result<()> {
+    p::header("Plugin Commands");
+    let reg = registry::load_registry().unwrap_or_default();
+    if reg.plugins.is_empty() {
+        p::info("No plugins installed. Use: starforge plugin install <name> --path <lib>");
+        return Ok(());
+    }
+
+    p::separator();
+    for plugin in &reg.plugins {
+        p::kv_accent("Plugin", &plugin.name);
+        if !plugin.commands.is_empty() {
+            for cmd in &plugin.commands {
+                p::info(&format!("  • {}  — {}", cmd.name, cmd.description));
+            }
+        } else {
+            p::info("  (no commands registered)");
+        }
+        println!();
+    }
+    p::separator();
+    Ok(())
+}
+
+fn discover_commands_from_library(path: &str) -> Result<Vec<RegisteredCommand>> {
+    let mut pm = PluginManager::new();
+    unsafe {
+        pm.load_plugin(path)?;
+    }
+    Ok(pm
+        .list_commands()
+        .into_iter()
+        .map(|c| RegisteredCommand {
+            name: c.name,
+            description: c.description,
+        })
+        .collect())
+}

src/commands/template.rs

@@ -545,11 +545,14 @@ fn print_quality_signals(template: &templates::TemplateEntry) {
 
 fn remove(name: String, purge: bool) -> Result<()> {
     templates::remove_template(&name, purge)?;
-    
+
     if purge {
         p::success(&format!("Template '{}' and all local assets removed", name));
     } else {
-        p::success(&format!("Template '{}' removed from registry (use --purge to also delete cached files)", name));
+        p::success(&format!(
+            "Template '{}' removed from registry (use --purge to also delete cached files)",
+            name
+        ));
     }
     Ok(())
 }

src/commands/tx.rs

@@ -204,11 +204,11 @@ fn handle_batch(args: BatchArgs) -> Result<()> {
     )
     .add("From Wallet", &wallet.name)
     .add("From Address", &wallet.public_key)
-    .add("Operations", &doc.operations.len().to_string())
-    .add("Batch File", &args.file.display().to_string())
+    .add("Operations", doc.operations.len().to_string())
+    .add("Batch File", args.file.display().to_string())
     .add(
         "Estimated Fee",
-        &format!("{:.7} XLM", tx_result.fee as f64 / 10_000_000.0),
+        format!("{:.7} XLM", tx_result.fee as f64 / 10_000_000.0),
     );
 
     // Add operation details to summary
@@ -219,8 +219,8 @@ fn handle_batch(args: BatchArgs) -> Result<()> {
             _ => "unknown".to_string(),
         };
         summary = summary.add(
-            &format!("Op {}", i + 1),
-            &format!("payment → {} {} {}", op.destination, op.amount, asset_label),
+            format!("Op {}", i + 1),
+            format!("payment → {} {} {}", op.destination, op.amount, asset_label),
         );
     }
 
@@ -428,10 +428,10 @@ fn handle_send(args: SendArgs) -> Result<()> {
     .add("From Wallet", &wallet.name)
     .add("From Address", &wallet.public_key)
     .add("To Address", &args.to)
-    .add("Amount", &format!("{} {}", args.amount, args.asset))
+    .add("Amount", format!("{} {}", args.amount, args.asset))
     .add(
         "Estimated Fee",
-        &format!("{:.7} XLM", tx_result.fee as f64 / 10_000_000.0),
+        format!("{:.7} XLM", tx_result.fee as f64 / 10_000_000.0),
     );
 
     let confirm_config = confirmation::ConfirmationConfig {

src/commands/upgrade.rs

@@ -573,7 +573,7 @@ fn handle_execute(args: ExecuteArgs) -> Result<()> {
     .add("Executor", &wallet.public_key)
     .add(
         "Approvals",
-        &format!("{}/{}", proposal.approvals.len(), proposal.threshold),
+        format!("{}/{}", proposal.approvals.len(), proposal.threshold),
     );
 
     let confirm_config = confirmation::ConfirmationConfig {