fix(python): fix `trezorctl get-session` for legacy
What the developer wrote
Authored by Roman Zeyde
fix(python): fix `trezorctl get-session` for legacy
`TrezorConnection._version` wasn't set, so the command was failing with:
```
Traceback (most recent call last):
File "./venv/bin/trezorctl", line 8, in <module>
sys.exit(cli())
^^^^^
File "./venv/lib/python3.12/site-packages/click/core.py", line 1161, in __call__
return self.main(*args, **kwargs)
^^^^^^^^^^^^^^^^^^^^^^^^^^
File "./venv/lib/python3.12/site-packages/click/core.py", line 1082, in main
rv = self.invoke(ctx)
^^^^^^^^^^^^^^^^
File "/home/rzeyde/src/trezor-firmware/python/src/trezorlib/cli/trezorctl.py", line 161, in invoke
return super().invoke(ctx)
^^^^^^^^^^^^^^^^^^^
File "./venv/lib/python3.12/site-packages/click/core.py", line 1697, in invoke
return _process_result(sub_ctx.command.invoke(sub_ctx))
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "./venv/lib/python3.12/site-packages/click/core.py", line 1443, in invoke
return ctx.invoke(self.callback, **ctx.params)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "./venv/lib/python3.12/site-packages/click/core.py", line 788, in invoke
return __callback(*args, **kwargs)
^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "./venv/lib/python3.12/site-packages/click/decorators.py", line 45, in new_func
return f(get_current_context().obj, *args, **kwargs)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/home/rzeyde/src/trezor-firmware/python/src/trezorlib/cli/trezorctl.py", line 361, in get_session
if obj.features.model == "1" and obj.version < (1, 9, 0):
^^^^^^^^^^^
File "/home/rzeyde/src/trezor-firmware/python/src/trezorlib/cli/__init__.py", line 280, in version
if self._version is None:
^^^^^^^^^^^^^
AttributeError: 'TrezorConnection' object has no attribute '_version'. Did you mean: 'version'?
```
[no changelog]
What changed, and why it matters
This is a straightforward bug fix in the Python command-line tool `trezorctl`. A missing internal variable (`_version`) caused the `get-session` subcommand to crash with an error when used with older (legacy) Trezor devices. The patch adds the missing variable declaration and resets it when the connection closes. There is no security vulnerability here—just a broken feature being repaired.
No security action required. Treat as a normal bug-fix release for the Python tools package.
Security signals we found
No security-relevant change: missing attribute initialization causing a crash, not a vulnerability
No input validation, parsing, or trust-boundary changes
No cryptographic, authentication, or session-management logic altered
Evidence from the diff
The commit fixes an AttributeError in TrezorConnection within trezorlib/cli/__init__.py. The version property checked self._version, but that attribute was never declared on the class, so accessing it on instances raised AttributeError. The fix declares _version: tuple[int, int, int] | None = None at class level and clears it in close(). This only affects the trezorctl get-session command path for legacy Model 1 devices and is purely a functional repair.
Changed components
python/src/trezorlib/cli/__init__.pytrezorctl get-session commandlegacy Trezor Model 1 compatibility pathInspect captured patch +2 / −0
diff --git a/python/src/trezorlib/cli/__init__.py b/python/src/trezorlib/cli/__init__.py
index 10fe87ef..21bf34f1 100644
--- a/python/src/trezorlib/cli/__init__.py
+++ b/python/src/trezorlib/cli/__init__.py
@@ -196,6 +196,7 @@ ENV_TREZOR_SESSION_ID = os.environ.get("TREZOR_SESSION_ID")
class TrezorConnection:
_client: TrezorClient | None = None
_features: messages.Features | None = None
+ _version: tuple[int, int, int] | None = None
_transport: Transport | None = None
_standard_session: Session | None = None
@@ -312,6 +313,7 @@ class TrezorConnection:
self._transport = None
self._client = None
self._features = None
+ self._version = None
self._standard_session = None
def _passphrase_source_resolved(self) -> PassphraseSource:
Why this scored 20/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.