Proto commits in trezor/trezor-common

These commits are when the Protocol Buffers files have changed: (only the last 100 relevant commits are shown)

2026-07-28

feat(clear_signing): Add enum formatter - scaffolding [no changelog]

The documentation is generated from this commit.

feat(clear_signing): support for calldata formatter. - scaffolding [no changelog]

feat(common,core,python,tests): support signing Stellar Soroban authorization entries. Fixes: https://github.com/trezor/trezor-firmware/issues/7312

feat(common,core,python,tests): migrate Soroban authorization to SOROBAN_CREDENTIALS_ADDRESS_V2. [no changelog]

2026-07-27

feat(clear_signing): support sliced paths. - This should enable deleting 1inch builtin addresses. (QA) [no changelog]

feat(clear_signing): adding some more simple types. mostly bytesN type. [no changelog]

feat(clear_signing): externalise provider names [no changelog]

feat(common): add network definition support for `EthereumSignAuth7702` [no changelog]

2026-07-24

feat(solana): migrate to off-chain message signing v1 This commit completely removes support for Solana Off-Chain Message Signing (OCMS) v0. This change follows the decision by Solana Foundation (SF) to drop support for v0 and focus on v1 [1]. The motivation was that v0 is flawed and its adoption is close to zero. However, note that not all parties followed this decision fully: while Wallet Standard supports v1 only (see [2]), Anza Docs [0] still list v0 as supported for backwards compatibility. Support for OCMS v1 is added instead. The protobuf interface is changed: instead of accepting a serialized message in OCMS format, the device now expects a structured protobuf message which it then serializes itself. This again follows a decision by SF to shift the serialization responsibility from dApps to wallets, see [1]. Moreover, the CLI is simplified as well. The "raw mode" of solana sign-message (verify-message) commands which allowed the user to pass a serialized OCMS message (envelope) is removed. This reflets the protobuf interface change and makes the commands easier to use. Fixes: https://github.com/trezor/trezor-firmware/issues/7053 [0] https://docs.anza.xyz/proposals/off-chain-message-signing [1] https://app.notion.com/p/solanafoundation/OCMS-Meeting-June-3-2026-Notes-374d36dad52d80e3a517e5d2a8b29a2c [2] https://github.com/anza-xyz/wallet-standard/pull/92

2026-07-23

fix(clear_signing): parse arrays of static structs per the ABI spec. Unify head handling in ABIValue.parse(): a static value is encoded in place (head_size bytes), a dynamic value's head is one word holding its body offset, relative to the enclosing block. Subclasses now implement only parse_body(). This replaces the four-branch isinstance dispatch in Array and the two-mode Tuple.parse. Previously the Array unconditionally dereferenced element heads, assuming every struct element is a dynamic type, and from_proto compensated by mislabeling array-nested tuples as is_dynamic=False ("don't dereference again"). That pair is correct for dynamic structs (e.g. LiFi's, with bytes callData) but misparses arrays of fully static structs, whose elements are canonically encoded in place at a stride of the struct size, with no offsets at all. is_dynamic is now the truthful, type-level ABI property everywhere: the four LiFi array-nested tuples become is_dynamic=True, and from_proto derives the flag for array-nested tuples from their fields (the wire flag stays ignored in that position, as it always was). The two hand-crafted vectors for the debug paths descriptor encoded the old non-canonical layout (offset heads for a static struct array) and are re-encoded canonically; the JSON fixture's signature is recomputed accordingly. Note the signature assertions cannot catch encoding regressions (blind-signing fallback signs the same bytes); the new array-of-static-structs unit test and the token-request assertions in test_definitions_request.py are the real guards. [no changelog] Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

feat(common,core,python,tests): add support for StellarInvokeHostFunctionOp.

2026-07-21

feat(core): add chunkify param to TronSignTx

2026-07-15

feat(common): add EIP-7702 authorization signing protobuf definitions Mark them as experimental for now. [no changelog] Co-authored-by: PrisionMike <su.sh2396@gmail.com> Co-authored-by: Roman Zeyde <roman.zeyde@satoshilabs.com>

2026-07-14

feat(clear_signing): ERC-7730 constant (const_value) display fields - constant path (resolved by offline parser) - renamed `hint` to `is_mono` in clear signing [no changelog] Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

2026-07-07

fix(core): make rotation_index optional fix compatibility issue by making the new rotation_index field in Evolu's EvoluRegistrationRequest optional [no changelog]

2026-07-01

feat(core): add chunkify support for Solana SignTx

feat(core): sign rotation index into Evolu sign registration This enables the Quota Manager to distinguish the indices and store the current index. [no changelog]

2026-06-30

feat(clear_signing): identify a tokenAmount token by a constant address Adds an additive proto field (EthereumERC7730FieldInfo.const_token_address) and lets TokenAmountFormatter resolve its token from that literal address instead of a token_path - for descriptors whose token is a `$.metadata.constants.*` reference rather than a calldata parameter. [no changelog] Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

feat(clear_signing): add date and raw formatters. - core tests added. - proto updated. [no changelog]

2026-06-29

chore(tron): scaffolding for `WithdrawBalanceContract` [no changelog]

2026-06-19

fix(common): correct wire direction for Monero *Request messages The 11 stateful Monero *Request messages (transaction signing and key-image sync) were tagged (wire_out) even though the host sends them device-bound; they should be (wire_in). The firmware reads each one as input (workflow entry points in workflow_handlers.py, subsequent steps via ctx.read()/call() in apps/monero/sign_tx.py and key_image_sync.py) and answers with the matching *Ack, which correctly stays (wire_out). The Monero live-refresh requests (552/554/556), MoneroGetTxKeyRequest and DebugMoneroDiagRequest were already correct; only the tx-signing (501-517) and key-image-sync (530-534) request branches were wrong. Regenerated both checked-in host descriptors that embed the wire direction: rust/trezor-client/src/protos/generated/messages.rs (via rust/trezor-client/scripts/build_protos) and rust/trezor-thp/examples/host-cli/pb/messages.rs (via `cargo run --example gen-protobuf examples/host-cli/pb/`). Each flips the same 11 EnumValueOptions tags from field 50003 (wire_out) to 50002 (wire_in); no message IDs, *Ack values, or unrelated entries change. No functional firmware change: the on-device protobuf blobs (proto_*.data, consumed by core/embed/rust/src/protobuf/defs.rs) are generated by common/protob/pb2py from the integer wire_type only -- wire_in/wire_out are never read -- and runtime dispatch is keyed on the integer message type, so core behavior is byte-identical. The generated Python does not encode wire direction either. Legacy (T1) is unaffected (Monero is in SKIPPED_MESSAGES). Upstream fix for the wire-direction inconsistency worked around in trezor/trezor-suite#28859. [no changelog] Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

chore(common): remove deprecated passphrase-related protobuf messages [no changelog]

chore(common): remove deprecated fields from passphrase-related messages [no changelog]

2026-06-01

chore: negative indices and more bytes types [no changelog]

2026-05-26

feat(solana): add off-chain message signing Implements the Solana off-chain message signing standard v0 as specified here: https://docs.anza.xyz/proposals/off-chain-message-signing The implementation deviates from the spec in the supported message formats --- the spec says that HW wallets should clear- sign format 0 (ascii), blind-sign format 1 (short utf-8), and not support format 2 (long utf-8) messages. We try to clear-sign messages irrespective of the format. The rationale is that we __can__ display even longer messages incl. some non-ascii chars and thus the limitation is arbitrary. Moreover, this restriction is removed in the newer v1 spec, see: https://github.com/solana-foundation/SRFCs/discussions/3 Closes: https://github.com/trezor/trezor-firmware/issues/6759

2026-05-25

chore(common): reserve capability field [no changelog]

feat(common): allow streaming authenticity proofs [no changelog]

2026-05-22

feat(Ripple): Support AccountDelete Transaction - Makes Payment and Account Delete mutually exclusive but mandatory fields in RippleSignTx message. - Tests for regular deletion and cancellation - Removed passing `description` in menu items in Caesar - New TR strings added to `en.json`

feat(core): expose tap_to_wake in Features protobuf message Add optional bool tap_to_wake (field 63) and Capability_TouchWakeup = 26 to the Features protobuf message. Populate both in GetFeatures when USE_TOUCH_WAKEUP is enabled, consistent with how haptic_feedback and Capability.Haptic are handled. Update device_content() in click tests to use features.tap_to_wake is not None instead of checking internal_model, and update UI test fixtures accordingly. [no changelog]

2026-05-21

fix(common): correct wire direction for authenticity-related messages [no changelog]

2026-05-14

feat(ethereum): clear signing support for nested array and byte32 [no changelog]

2026-05-05

feat(tests,ethereum): definition request [no changelog]

feat(ethereum): definition request mechanism [no changelog]

feat(ethereum): support ContainerPath.To [no changelog]

2026-04-29

chore(ethereum): cleanup ERC-7730 type names [no changelog]

2026-04-28

chore(ethereum): revert to single token up-front Go back to having a single `token` passed with the definitions up-front like we had before e059db59bac0a834d9607379228d81902479e829. [no changelog]

chore(ethereum): remove unused container paths [no changelog]

feat(ethereum): display format definitions [no changelog]

chore(core): return N4W1 in `Features.capabilities` [no changelog]

2026-04-24

feat(core): Add MCU signature to AuthenticityProof [no changelog]

2026-04-23

feat(proto): debuglink set battery state [no changelog]

2026-04-09

chore(common): remove `RecoveryDevice.backup_method` protobuf default The user will be prompted to choose the method if it's unset on T3W1. [no changelog]

2026-04-08

chore: add description to protobuf messages [no changelog]

style(common): fix typo in protobuf comments [no changelog]

2026-04-02

chore(common): add options to THP messages - Added `wire_in` and `wire_out` options to THP messages. [no changelog]

2026-03-24

feat(core): Evolu key rotation Add an index to the generation of Evolu keys and Delegated identity key. [no changelog]

chore(common): rename BackupMethod field Following https://satoshilabs.slack.com/archives/C02V2PSDNA2/p1774310387497969. [no changelog]

2026-03-23

feat(common): introduce `BackupMethod` protobuf enum [no changelog]

2026-03-21

feat(common): allow `WebAuthnListResidentCredentials` pagination [no changelog]

2026-03-19

fix(legacy): Enforce matrix recovery for mnemonics under 24 words. (cherry picked from commit 203090ae53d763c5777813fbf5c05b8ddf8a2813)

2026-03-18

feat(common): introduce DebugLink-based N4W1 emulator messages [no changelog]

2026-03-10

feat(tron): Add support for `VoteWitnessContract` - scaffolding Tron Voting. Gen code.

2026-03-02

chore(common): add protobuf style check - Adjusted `.clang-format` for use with Proto files. - Added `protostyle` and `protostyle_check` to `Makefile`, included them in `style` and `style_check` respectively. - Formatted all `.proto` files, adjusted comments. - Added a few echo statements to `Makefile` rules. [no changelog]

fix(common): add java-handling to solana protobuf [no changelog]

fix(common): minor protobuf fixes - Set `RippleSignedTx` as `wire_out` instead of `wire_in`. - Fixed a typo in a `RippleSignTx` message definition comment. - Fixed two typos in `messages-monero.proto` docstrings. [no changelog]

2026-02-20

test: allow setting `unfinished_backup` flag in storage [no changelog]

feat(tron): Unfreeze and claiming TRX - scaffolding - Generated code [no changelog]

2026-02-17

feat(tron): adding FreezeBalanceV2 message support - Updated message definitions. Introduced new strings. - Mostly generated code. Main changes in subsequent commit. [no changelog]

2026-02-04

feat(common): introduce `Failure_InProgress` code It will be used to indicate that an non-interruptible workflow is currently running on the device. [no changelog]

chore(common): remove unused `Failure_BufferError` code [no changelog]

2026-01-28

chore(common): correct `DebugLinkSetLogFilter` next message annotation [no changelog]

2026-01-27

fix(core): remove host static public key from protobuf message [no changelog]

2026-01-23

feat(python): Update trezorctl telemetry command with battery_cycle field. [no changelog]

feat(core): add battery_cycle field in the protobuf telemetry message. [no changelog]

2026-01-19

chore(core): add messages for reading out telemetry data [no changelog]

2026-01-12

feat(tron): add TriggerSmartContract support. - Blind signing TRON smart contracts. - Only contract address shown to user. - USDT,USDD transfer tested. - Fee layout imperfect. To be fixed later. [no changelog]

2026-01-06

chore(common): deprecate uploading language blob during firmware update Remove unused protobuf field from `RebootToBootloader`. [no changelog]

feat(tron): add TransferContract support Allows native TRX transfer [no changelog] Co-authored-by: PrisionMike <su.sh2396@gmail.com>

2025-12-12

feat(core): add trezorctl set-log-filter command [no changelog]

2025-12-09

feat(core): send build version in features

2025-11-20

Reapply "chore: remove `GetNonce` and `PaymentRequest` from experimental features" This reverts commit cc7843ad0fcfd4cd14ac20620227cefa3063ef74.

2025-11-19

feat: buy crypto with fiat [no changelog]

2025-11-12

fix(tron): update tron to use session - Minor code fixes to old PR by overcat - Only build Tron for debug builds - Updated message index - Updated text fixtures [no changelog]

feat(common,core,python,tests): add `tron.get_address` support. [no changelog]

2025-11-05

feat(core): functions for Evolu spam protection [no changelog]

2025-11-04

Revert "chore: remove `GetNonce` and `PaymentRequest` from experimental features" This reverts commit efb19af74bf8f54ce32a951a9cda9f54fb9da286.

2025-10-30

feat(core): notify host on power status change using internal notification system [no changelog]

2025-10-27

chore: remove `GetNonce` and `PaymentRequest` from experimental features

2025-10-16

feat: 32 bytes amount in ETH payment requests [no changelog]

fix(protob): remove wrong message annotation [no changelog]

2025-10-09

chore: reserve message type range [no changelog]

2025-10-03

feat(common): allow exporting unit serial number [no changelog]

feat(core/tests): device menu click tests - move keyboard shared code to common [no changelog]

chore(core): add auto_lock_delay_battery_ms to Feature messages [no changelog]

2025-09-25

feat(core/bootloader): signal firmware corrupted in features

chore(core): make `host_name` & `app_name` required also in `ThpCredentialMetadata` [no changelog]

2025-09-21

feat(core/eckhart): cache THP app/host name along with MAC [no changelog] Co-authored-by: Martin Milata <martin@martinmilata.cz>

2025-09-19

fix(core): make app_name required for THP pairing [no changelog]

2025-09-18

chore(core): Add Tropic fields to AuthenticityProof.

2025-09-17

fix(core): allow Evolu msgs in BTC only [no changelog]

2025-09-16

feat(protob): extend ApplySettings - add auto_lock_delay_battery_ms to set delay in ms after which the device locks when on battery or wireless charger [no changelog]

2025-09-11

chore: add protobuf definitions for THP hostname cache [no changelog]

2025-09-04

feat(core): SLIP-24 payment requests for Stellar [no changelog]

2025-09-03

fix(common): require fields on SLIP-24 Text Details memo

2025-09-02

chore(core/eckhart): implement BLE device unpairing [no changelog]

2025-08-27

feat(core/bootloader): add battery SoC to features messages [no changelog]

2025-08-26

feat(core): generate SLIP-21 node for Evolu

2025-08-25

feat(cardano): replace chunking with length+offset

feat(cardano): stop hashing in message signing

fix(cardano): Return pubkey This ends up being useful for software wallets.