Merge pull request #19007 from esphome/bump-2026.9.0b2

2026.9.0b2

Doxyfile

@@ -48,7 +48,7 @@ PROJECT_NAME           = ESPHome
 # could be handy for archiving the generated documentation or if some version
 # control system is used.
 
-PROJECT_NUMBER         = 2026.10.0-dev
+PROJECT_NUMBER         = 2026.9.0b2
 
 # Using the PROJECT_BRIEF tag one can provide an optional one line description
 # for a project that appears at the top of each page and should give viewer a

THREAT_MODEL.md

@@ -125,30 +125,47 @@ design is optimal or that it will not change.
 ## OTA update encryption
 
 The `esphome` OTA platform optionally encrypts updates with the same Noise
-`NNpsk0` pattern the native API uses; one key protects the device. With an
-`encryption:` block configured the guarantees are: the firmware image is
-confidential in transit, the uploader is authenticated by the pre-shared key,
-and the plaintext negotiation preceding the handshake is bound into the
-handshake prologue, so stripping or tampering with it fails the first MAC.
-Both ends fail closed with no override: a device built with a key refuses
+`NNpsk0` pattern the native API uses; one key protects the device. A device
+whose `api:` block has an encryption key, static in the YAML or provisioned at
+runtime, compiles in the transport and offers it on every OTA connection once
+it holds a key, so an uploader presenting that key gets the guarantees below
+even without an `ota: encryption:` block; only that block makes the device
+require encryption. The guarantees are: the firmware image is confidential in
+transit, the uploader is authenticated by the pre-shared key, and the plaintext
+negotiation preceding the handshake is bound into the handshake prologue, so
+stripping or tampering with it fails the first MAC. With `ota: encryption:`
+configured both ends fail closed with no override: the device refuses
 plaintext uploads, and the CLI refuses to send plaintext when a key is
-configured.
+configured. Without that block the CLI tries a static api key when the device
+offers and, until 2027.3.0, falls back to plaintext with a warning when the
+offer is missing or the handshake fails; a runtime provisioned key never
+reaches the CLI, so those uploads stay plaintext.
 
-Defeating any of that without the key is in scope: a keyed device accepting a
-plaintext or downgraded upload, getting past the MAC, or recovering image
-contents from captured traffic.
+Defeating any of that without the key is in scope: a device that requires
+encryption accepting a plaintext or downgraded upload, getting past the MAC,
+or recovering image contents from captured traffic.
 
 The following are **not** vulnerabilities, by design:
 
-- Plaintext OTA on a device with no `encryption:` block. That is the
-  documented default, authenticated (if at all) by the OTA password.
-- The enablement window: turning encryption on takes one last upload of the
-  encryption-enabled firmware over the existing plaintext channel, with the
-  pre-existing plaintext exposure.
-- The web OTA `/update` endpoint alongside encryption. The `web_server`
-  component keeps it always reachable, and `captive_portal:` auto-loads it
-  for the fallback AP window; validation warns about both combinations, and
-  the operator keeps the recovery path.
+- Plaintext OTA on a device with no `ota: encryption:` block, including one
+  that offers encryption because it has an api key. That is the documented
+  default, authenticated (if at all) by the OTA password. An uploader that
+  takes the offer skips the password; the key authenticates it. With a
+  runtime provisioned key and no `provisioning:` window, whoever provisions
+  the key gains that upload path too; validation warns about the pair.
+- The CLI plaintext fallback until 2027.3.0: without `ota: encryption:` an
+  active attacker who strips the offer or breaks the handshake can make a
+  keyed CLI upload plaintext, with the pre-existing plaintext exposure. A
+  device that requires encryption still refuses that upload.
+- The enablement window: firmware built with a static api key already offers
+  encryption, so turning on `ota: encryption:` is itself an encrypted upload.
+  Older firmware needs one last plaintext upload of an offering build, with
+  the pre-existing plaintext exposure.
+- The web OTA `/update` endpoint alongside encryption. With the `web_server`
+  or `prometheus` component the shared listener is always up, so the endpoint
+  stays reachable and validation warns about that combination;
+  `captive_portal:` alone brings the listener up only for the fallback AP
+  window, which is the intended recovery path, so that is not warned about.
 - CLI retry behavior on transport or MAC failures; every attempt renegotiates
   a fresh handshake with fresh ephemerals, so retrying does not weaken
   authentication.

docker/Dockerfile

@@ -22,7 +22,7 @@ RUN \
     -r /requirements.txt
 
 # Install the ESPHome Device Builder dashboard.
-RUN uv pip install --no-cache-dir esphome-device-builder==1.14.0
+RUN uv pip install --no-cache-dir esphome-device-builder==1.14.4
 
 RUN \
     platformio settings set enable_telemetry No \

esphome/__main__.py

@@ -1335,12 +1335,14 @@ def _upload_via_native_api(
             break
 
     from esphome import espota2
+    from esphome.components.noise import static_encryption_key
 
     remote_port = int(ota_conf[CONF_PORT])
     password = ota_conf.get(CONF_PASSWORD)
     # Fail closed: an encryption block whose key did not resolve must never
     # fall back to a plaintext upload
     noise_psk = None
+    plaintext_fallback = False
     if (encryption_conf := ota_conf.get(CONF_ENCRYPTION)) is not None:
         noise_psk = encryption_conf.get(CONF_KEY)
         if not noise_psk:
@@ -1351,6 +1353,10 @@ def _upload_via_native_api(
         # Ensure the key is a string, as required by the underlying OTA implementation.
         # It arrives here as a SensitiveStr which aioesphomeapi rejects.
         noise_psk = str(noise_psk)
+    elif api_key := static_encryption_key(config.get(CONF_API) or {}):
+        # Remove before 2027.3.0: the api key is tried, falling back to plaintext
+        noise_psk = str(api_key)
+        plaintext_fallback = True
 
     def check_partition_access(option_string: str) -> None:
         if not ota_conf.get("allow_partition_access"):
@@ -1382,7 +1388,13 @@ def _upload_via_native_api(
         _validate_bootloader_binary(binary)
 
     return espota2.run_ota(
-        network_devices, remote_port, password, binary, ota_type, noise_psk
+        network_devices,
+        remote_port,
+        password,
+        binary,
+        ota_type,
+        noise_psk,
+        plaintext_fallback=plaintext_fallback,
     )
 
 

esphome/components/api/__init__.py

@@ -14,6 +14,7 @@ from esphome.components.noise import (  # noqa: F401
     ENCRYPTION_SCHEMA,
     decode_encryption_key,
     encryption_schema,
+    new_psk_progmem,
     validate_encryption_key,
 )
 from esphome.config_helpers import filter_source_files_from_defines, get_logger_level
@@ -589,8 +590,7 @@ async def to_code(config: ConfigType) -> None:
 
     if (encryption_config := config.get(CONF_ENCRYPTION, None)) is not None:
         if key := encryption_config.get(CONF_KEY):
-            decoded = decode_encryption_key(key)
-            cg.add(var.set_noise_psk(list(decoded)))
+            cg.add(var.set_noise_psk(new_psk_progmem(config[CONF_ID], key)))
             cg.add_define("USE_API_NOISE_PSK_FROM_YAML")
         else:
             # No key provided, but encryption desired

esphome/components/api/api.proto

@@ -70,17 +70,13 @@ service APIConnection {
   rpc zwave_proxy_frame(ZWaveProxyFrame) returns (void) {}
   rpc zwave_proxy_request(ZWaveProxyRequest) returns (void) {}
 
-  rpc zigbee_proxy_request(ZigbeeProxyRequest) returns (void) {}
-
   rpc infrared_rf_transmit_raw_timings(InfraredRFTransmitRawTimingsRequest) returns (void) {}
 
   rpc serial_proxy_configure(SerialProxyConfigureRequest) returns (void) {}
   rpc serial_proxy_write(SerialProxyWriteRequest) returns (void) {}
   rpc serial_proxy_set_modem_pins(SerialProxySetModemPinsRequest) returns (void) {}
   rpc serial_proxy_get_modem_pins(SerialProxyGetModemPinsRequest) returns (void) {}
-  rpc serial_proxy_get_usb_info(SerialProxyGetUsbInfoRequest) returns (void) {}
   rpc serial_proxy_request(SerialProxyRequest) returns (void) {}
-  rpc serial_proxy_set_mode(SerialProxySetModeRequest) returns (void) {}
 }
 
 
@@ -231,11 +227,6 @@ enum SerialProxyPortType {
   SERIAL_PROXY_PORT_TYPE_TTL = 0;
   SERIAL_PROXY_PORT_TYPE_RS232 = 1;
   SERIAL_PROXY_PORT_TYPE_RS485 = 2;
-  // A serial device attached through a USB bridge. Set by the device configuration, never
-  // by the user; identifies ports whose USB identity can be read with
-  // SerialProxyGetUsbInfoRequest. Deliberately not a USB endpoint type: serial_proxy
-  // carries serial devices only, whatever bridge chip connects them.
-  SERIAL_PROXY_PORT_TYPE_USB_SERIAL = 3;
 }
 
 message SerialProxyInfo {
@@ -340,10 +331,6 @@ message DeviceInfoResponse {
   // all-zeros PSK, so the api encryption key can be provisioned without being
   // sent in plaintext (protects against passive sniffing, not active MITM)
   bool api_encryption_provisionable = 26 [(field_ifdef) = "USE_API_NOISE"];
-
-  // Indicates if Zigbee proxy support is available and features supported
-  uint32 zigbee_proxy_feature_flags = 27 [(field_ifdef) = "USE_ZIGBEE_PROXY"];
-  uint64 zigbee_ieee_address = 28 [(field_ifdef) = "USE_ZIGBEE_PROXY"];
 }
 
 // ==================== DEVICE CAPABILITIES ====================
@@ -2739,8 +2726,7 @@ enum SerialProxyParity {
   SERIAL_PROXY_PARITY_ODD = 2;
 }
 
-// Configure UART parameters for a serial proxy instance. Only the subscribed client may
-// configure the port; others are refused with PORT_IN_USE (since API 1.17).
+// Configure UART parameters for a serial proxy instance
 message SerialProxyConfigureRequest {
   option (id) = 138;
   option (source) = SOURCE_CLIENT;
@@ -2766,8 +2752,7 @@ message SerialProxyDataReceived {
   bytes data = 2;               // Raw data received from the serial device
 }
 
-// Write data to a serial device. Only the subscribed client may write; writes from
-// others are ignored (since API 1.17).
+// Write data to a serial device
 message SerialProxyWriteRequest {
   option (id) = 140;
   option (source) = SOURCE_CLIENT;
@@ -2778,8 +2763,7 @@ message SerialProxyWriteRequest {
   bytes data = 2;               // Raw data to write to the serial device
 }
 
-// Set modem control pin states (RTS and DTR). Only the subscribed client may set them;
-// others are refused with PORT_IN_USE (since API 1.17).
+// Set modem control pin states (RTS and DTR)
 message SerialProxySetModemPinsRequest {
   option (id) = 141;
   option (source) = SOURCE_CLIENT;
@@ -2818,7 +2802,6 @@ enum SerialProxyRequestType {
   // error the device answers with INVALID_ARGUMENT.
   SERIAL_PROXY_REQUEST_TYPE_CONFIGURE = 3;      // Acknowledges a SerialProxyConfigureRequest
   SERIAL_PROXY_REQUEST_TYPE_SET_MODEM_PINS = 4; // Acknowledges a SerialProxySetModemPinsRequest
-  SERIAL_PROXY_REQUEST_TYPE_SET_MODE = 5;       // Acknowledges a SerialProxySetModeRequest (since API 1.17)
 }
 
 enum SerialProxyStatus {
@@ -2831,8 +2814,7 @@ enum SerialProxyStatus {
   SERIAL_PROXY_STATUS_INVALID_ARGUMENT = 6; // Invalid instance index or parameter value
 }
 
-// Generic request message for simple serial proxy operations. FLUSH requires an active
-// subscription; it is refused with PORT_IN_USE otherwise (since API 1.17).
+// Generic request message for simple serial proxy operations
 message SerialProxyRequest {
   option (id) = 144;
   option (source) = SOURCE_CLIENT;
@@ -2856,59 +2838,6 @@ message SerialProxyRequestResponse {
   string error_message = 4;            // Additional detail on failure (optional)
 }
 
-// How a port treats the bytes passing through it. RAW is a plain byte pipe; PROTOCOL
-// activates the port's protocol-aware tap (if one is configured), letting it observe
-// traffic and inject protocol bytes such as acknowledgements. Which protocol the tap
-// speaks is a property of the device configuration, discoverable from the tap
-// component's own API surface. A client that is about to flash firmware selects RAW
-// first, which definitively disables that injection.
-enum SerialProxyMode {
-  SERIAL_PROXY_MODE_RAW = 0;
-  SERIAL_PROXY_MODE_PROTOCOL = 1;
-}
-
-// Only the subscribed client may change the mode; any other caller -- including one that
-// never subscribed -- is refused with PORT_IN_USE. PROTOCOL is refused with NOT_SUPPORTED
-// when the port has no protocol-aware tap configured.
-message SerialProxySetModeRequest {
-  option (id) = 152;
-  option (source) = SOURCE_CLIENT;
-  option (ifdef) = "USE_SERIAL_PROXY";
-
-  uint32 instance = 1;
-  SerialProxyMode mode = 2;
-}
-
-// Ask for the USB identity of the device behind a USB_SERIAL port. Read-only, so no
-// subscription is required -- a client typically uses this to decide which port to
-// subscribe to. Answered with NOT_SUPPORTED on ports that are not USB_SERIAL.
-message SerialProxyGetUsbInfoRequest {
-  option (id) = 153;
-  option (source) = SOURCE_CLIENT;
-  option (ifdef) = "USE_SERIAL_PROXY";
-
-  uint32 instance = 1;
-}
-
-// The USB identity of the device currently behind a port, read live from the cached
-// USB descriptors. Fields are zero/empty while no device is connected.
-message SerialProxyGetUsbInfoResponse {
-  option (id) = 154;
-  option (source) = SOURCE_SERVER;
-  option (ifdef) = "USE_SERIAL_PROXY";
-
-  uint32 instance = 1;
-  SerialProxyStatus status = 2;   // NOT_SUPPORTED when the port is not USB_SERIAL
-  bool connected = 3;             // True when a USB device is currently attached
-  uint32 vendor_id = 4;
-  uint32 product_id = 5;
-  uint32 bcd_device = 6;
-  uint32 interface_number = 7;    // Channel index on multi-port bridges
-  string manufacturer = 8;
-  string product = 9;
-  string serial_number = 10;
-}
-
 // ==================== BLUETOOTH CONNECTION PARAMS ====================
 message BluetoothSetConnectionParamsRequest {
   option (id) = 145;
@@ -2930,18 +2859,3 @@ message BluetoothSetConnectionParamsResponse {
   uint64 address = 1;
   int32 error = 2;
 }
-
-// ==================== ZIGBEE ====================
-
-enum ZigbeeProxyRequestType {
-  ZIGBEE_PROXY_REQUEST_TYPE_NETWORK_INFO = 0;
-}
-
-message ZigbeeProxyRequest {
-  option (id) = 155;
-  option (source) = SOURCE_BOTH;
-  option (ifdef) = "USE_ZIGBEE_PROXY";
-
-  ZigbeeProxyRequestType type = 1;
-  bytes data = 2;
-}

esphome/components/api/api_connection.cpp

@@ -48,12 +48,6 @@
 #ifdef USE_ZWAVE_PROXY
 #include "esphome/components/zwave_proxy/zwave_proxy.h"
 #endif
-#ifdef USE_ZIGBEE_PROXY
-#include "esphome/components/zigbee_proxy/zigbee_proxy.h"
-#endif
-#ifdef USE_SERIAL_PROXY_USB_INFO
-#include "esphome/components/usb_host/usb_host.h"
-#endif
 #ifdef USE_WATER_HEATER
 #include "esphome/components/water_heater/water_heater.h"
 #endif
@@ -1395,12 +1389,6 @@ void APIConnection::on_z_wave_proxy_request(const ZWaveProxyRequest &msg) {
 }
 #endif
 
-#ifdef USE_ZIGBEE_PROXY
-void APIConnection::on_zigbee_proxy_request(const ZigbeeProxyRequest &msg) {
-  zigbee_proxy::global_zigbee_proxy->zigbee_proxy_request(this, msg);
-}
-#endif
-
 #ifdef USE_ALARM_CONTROL_PANEL
 bool APIConnection::send_alarm_control_panel_state(alarm_control_panel::AlarmControlPanel *a_alarm_control_panel) {
   return this->send_message_smart_(a_alarm_control_panel, AlarmControlPanelStateResponse::MESSAGE_TYPE,
@@ -1654,27 +1642,6 @@ void APIConnection::on_serial_proxy_get_modem_pins_request(const SerialProxyGetM
   }
 }
 
-void APIConnection::on_serial_proxy_get_usb_info_request(const SerialProxyGetUsbInfoRequest &msg) {
-  auto &proxies = App.get_serial_proxies();
-  SerialProxyGetUsbInfoResponse resp{};
-  resp.instance = msg.instance;
-  if (msg.instance >= proxies.size()) {
-    ESP_LOGW(TAG, "Serial proxy instance %" PRIu32 " out of range", msg.instance);
-    resp.status = enums::SERIAL_PROXY_STATUS_INVALID_ARGUMENT;
-  } else {
-#ifdef USE_SERIAL_PROXY_USB_INFO
-    // The response's strings are views into this buffer, which outlives the send below
-    usb_host::UsbDeviceInfo info;
-    proxies[msg.instance]->get_usb_info(info, resp);
-#else
-    resp.status = enums::SERIAL_PROXY_STATUS_NOT_SUPPORTED;
-#endif
-  }
-  if (!this->send_message(resp)) {
-    API_LOG_MSG_DROPPED(TAG, "Serial proxy response");
-  }
-}
-
 void APIConnection::on_serial_proxy_request(const SerialProxyRequest &msg) {
   auto &proxies = App.get_serial_proxies();
   if (msg.instance >= proxies.size()) {
@@ -1694,7 +1661,6 @@ void APIConnection::on_serial_proxy_request(const SerialProxyRequest &msg) {
       break;
     case enums::SERIAL_PROXY_REQUEST_TYPE_CONFIGURE:
     case enums::SERIAL_PROXY_REQUEST_TYPE_SET_MODEM_PINS:
-    case enums::SERIAL_PROXY_REQUEST_TYPE_SET_MODE:
       // Response-only discriminators; never valid in a request
       ESP_LOGW(TAG, "Response-only serial proxy request type: %" PRIu32, static_cast<uint32_t>(msg.type));
       status = enums::SERIAL_PROXY_STATUS_INVALID_ARGUMENT;
@@ -1707,19 +1673,6 @@ void APIConnection::on_serial_proxy_request(const SerialProxyRequest &msg) {
   send_serial_proxy_ack(this, msg.instance, msg.type, status);
 }
 
-void APIConnection::on_serial_proxy_set_mode_request(const SerialProxySetModeRequest &msg) {
-  auto &proxies = App.get_serial_proxies();
-  if (msg.instance >= proxies.size()) {
-    ESP_LOGW(TAG, "Serial proxy instance %" PRIu32 " out of range", msg.instance);
-    send_serial_proxy_ack(this, msg.instance, enums::SERIAL_PROXY_REQUEST_TYPE_SET_MODE,
-                          enums::SERIAL_PROXY_STATUS_INVALID_ARGUMENT);
-    return;
-  }
-  serial_proxy::SerialProxyResult result = proxies[msg.instance]->set_mode_from_client(this, msg.mode);
-  send_serial_proxy_ack(this, msg.instance, enums::SERIAL_PROXY_REQUEST_TYPE_SET_MODE,
-                        serial_proxy_result_to_status(result));
-}
-
 void APIConnection::send_serial_proxy_data(const SerialProxyDataReceived &msg) {
   if (!this->send_message(msg)) {
     ESP_LOGV(TAG, "Serial proxy data dropped, TCP buffer full");
@@ -1831,11 +1784,6 @@ void APIConnection::complete_authentication_() {
     zwave_proxy::global_zwave_proxy->api_connection_authenticated(this);
   }
 #endif
-#ifdef USE_ZIGBEE_PROXY
-  if (zigbee_proxy::global_zigbee_proxy != nullptr) {
-    zigbee_proxy::global_zigbee_proxy->api_connection_authenticated(this);
-  }
-#endif
 }
 
 bool APIConnection::send_hello_response_(const HelloRequest &msg) {
@@ -1851,7 +1799,7 @@ bool APIConnection::send_hello_response_(const HelloRequest &msg) {
 
   HelloResponse resp;
   resp.api_version_major = 1;
-  resp.api_version_minor = 17;
+  resp.api_version_minor = 16;
   // Send only the version string - the client only logs this for debugging and doesn't use it otherwise
   resp.server_info = ESPHOME_VERSION_REF;
   resp.name = StringRef(App.get_name());
@@ -1988,10 +1936,6 @@ bool APIConnection::send_device_info_response_() {
     info.configured_line_states = proxy->get_configured_modem_pins();
   }
 #endif
-#ifdef USE_ZIGBEE_PROXY
-  resp.zigbee_proxy_feature_flags = zigbee_proxy::global_zigbee_proxy->get_feature_flags();
-  resp.zigbee_ieee_address = zigbee_proxy::global_zigbee_proxy->get_ieee_address();
-#endif
 #ifdef USE_API_NOISE
   resp.api_encryption_supported = true;
 #ifndef USE_API_NOISE_PSK_FROM_YAML
@@ -2217,7 +2161,10 @@ void APIConnection::on_homeassistant_action_response(const HomeassistantActionRe
 bool APIConnection::send_noise_encryption_set_key_response_(const NoiseEncryptionSetKeyRequest &msg) {
   NoiseEncryptionSetKeyResponse resp;
   resp.success = false;
-
+#ifdef USE_API_NOISE_PSK_FROM_YAML
+  // A yaml key cannot be changed at runtime, so no decode or save path is built
+  ESP_LOGW(TAG, "Key set in YAML");
+#else
 #ifdef USE_PROVISIONING
   // Refuse to set a key once the provisioning window has closed (defense in depth;
   // such connections are already rejected at hello).
@@ -2252,6 +2199,7 @@ bool APIConnection::send_noise_encryption_set_key_response_(const NoiseEncryptio
     }
 #endif
   }
+#endif  // USE_API_NOISE_PSK_FROM_YAML
 
   return this->send_message(resp);
 }

esphome/components/api/api_connection.h

@@ -223,10 +223,6 @@ class APIConnection final : public APIServerConnectionBase {
   void on_z_wave_proxy_request(const ZWaveProxyRequest &msg);
 #endif
 
-#ifdef USE_ZIGBEE_PROXY
-  void on_zigbee_proxy_request(const ZigbeeProxyRequest &msg);
-#endif
-
 #ifdef USE_ALARM_CONTROL_PANEL
   bool send_alarm_control_panel_state(alarm_control_panel::AlarmControlPanel *a_alarm_control_panel);
   void on_alarm_control_panel_command_request(const AlarmControlPanelCommandRequest &msg);
@@ -247,9 +243,7 @@ class APIConnection final : public APIServerConnectionBase {
   void on_serial_proxy_write_request(const SerialProxyWriteRequest &msg);
   void on_serial_proxy_set_modem_pins_request(const SerialProxySetModemPinsRequest &msg);
   void on_serial_proxy_get_modem_pins_request(const SerialProxyGetModemPinsRequest &msg);
-  void on_serial_proxy_get_usb_info_request(const SerialProxyGetUsbInfoRequest &msg);
   void on_serial_proxy_request(const SerialProxyRequest &msg);
-  void on_serial_proxy_set_mode_request(const SerialProxySetModeRequest &msg);
   void send_serial_proxy_data(const SerialProxyDataReceived &msg);
 #endif
 

esphome/components/api/api_frame_helper_noise.cpp

@@ -548,7 +548,7 @@ APIError APINoiseFrameHelper::write_frame_(const uint8_t *data, uint16_t len) {
  * @return 0 on success, -1 on error (check errno)
  */
 APIError APINoiseFrameHelper::init_handshake_() {
-  int err = this->handshake_.init(this->ctx_.get_psk(), prologue_.data(), prologue_.size());
+  int err = this->handshake_.init(this->ctx_, prologue_.data(), prologue_.size());
   APIError aerr = handle_noise_error_(err, LOG_STR("noise_handshake_init"), APIError::HANDSHAKESTATE_SETUP_FAILED);
   if (aerr != APIError::OK)
     return aerr;

esphome/components/api/api_pb2.cpp

@@ -175,12 +175,6 @@ uint8_t *DeviceInfoResponse::encode(ProtoWriteBuffer &buffer PROTO_ENCODE_DEBUG_
 #endif
 #ifdef USE_API_NOISE
   ProtoEncode::encode_bool(pos PROTO_ENCODE_DEBUG_ARG, 26, this->api_encryption_provisionable);
-#endif
-#ifdef USE_ZIGBEE_PROXY
-  ProtoEncode::encode_uint32(pos PROTO_ENCODE_DEBUG_ARG, 27, this->zigbee_proxy_feature_flags);
-#endif
-#ifdef USE_ZIGBEE_PROXY
-  ProtoEncode::encode_uint64(pos PROTO_ENCODE_DEBUG_ARG, 28, this->zigbee_ieee_address);
 #endif
   return pos;
 }
@@ -246,12 +240,6 @@ uint32_t DeviceInfoResponse::calculate_size() const {
 #endif
 #ifdef USE_API_NOISE
   size += ProtoSize::calc_bool(2, this->api_encryption_provisionable);
-#endif
-#ifdef USE_ZIGBEE_PROXY
-  size += ProtoSize::calc_uint32(2, this->zigbee_proxy_feature_flags);
-#endif
-#ifdef USE_ZIGBEE_PROXY
-  size += ProtoSize::calc_uint64(2, this->zigbee_ieee_address);
 #endif
   return size;
 }
@@ -4265,57 +4253,6 @@ uint32_t SerialProxyRequestResponse::calculate_size() const {
   size += ProtoSize::calc_length(1, this->error_message.size());
   return size;
 }
-bool SerialProxySetModeRequest::decode_varint(uint32_t field_id, proto_varint_value_t value) {
-  switch (field_id) {
-    case 1:
-      this->instance = value;
-      break;
-    case 2:
-      this->mode = static_cast<enums::SerialProxyMode>(value);
-      break;
-    default:
-      return false;
-  }
-  return true;
-}
-bool SerialProxyGetUsbInfoRequest::decode_varint(uint32_t field_id, proto_varint_value_t value) {
-  switch (field_id) {
-    case 1:
-      this->instance = value;
-      break;
-    default:
-      return false;
-  }
-  return true;
-}
-uint8_t *SerialProxyGetUsbInfoResponse::encode(ProtoWriteBuffer &buffer PROTO_ENCODE_DEBUG_PARAM) const {
-  uint8_t *__restrict__ pos = buffer.get_pos();
-  ProtoEncode::encode_uint32(pos PROTO_ENCODE_DEBUG_ARG, 1, this->instance);
-  ProtoEncode::encode_uint32(pos PROTO_ENCODE_DEBUG_ARG, 2, static_cast<uint32_t>(this->status));
-  ProtoEncode::encode_bool(pos PROTO_ENCODE_DEBUG_ARG, 3, this->connected);
-  ProtoEncode::encode_uint32(pos PROTO_ENCODE_DEBUG_ARG, 4, this->vendor_id);
-  ProtoEncode::encode_uint32(pos PROTO_ENCODE_DEBUG_ARG, 5, this->product_id);
-  ProtoEncode::encode_uint32(pos PROTO_ENCODE_DEBUG_ARG, 6, this->bcd_device);
-  ProtoEncode::encode_uint32(pos PROTO_ENCODE_DEBUG_ARG, 7, this->interface_number);
-  ProtoEncode::encode_string(pos PROTO_ENCODE_DEBUG_ARG, 8, this->manufacturer);
-  ProtoEncode::encode_string(pos PROTO_ENCODE_DEBUG_ARG, 9, this->product);
-  ProtoEncode::encode_string(pos PROTO_ENCODE_DEBUG_ARG, 10, this->serial_number);
-  return pos;
-}
-uint32_t SerialProxyGetUsbInfoResponse::calculate_size() const {
-  uint32_t size = 0;
-  size += ProtoSize::calc_uint32(1, this->instance);
-  size += this->status ? 2 : 0;
-  size += ProtoSize::calc_bool(1, this->connected);
-  size += ProtoSize::calc_uint32(1, this->vendor_id);
-  size += ProtoSize::calc_uint32(1, this->product_id);
-  size += ProtoSize::calc_uint32(1, this->bcd_device);
-  size += ProtoSize::calc_uint32(1, this->interface_number);
-  size += ProtoSize::calc_length(1, this->manufacturer.size());
-  size += ProtoSize::calc_length(1, this->product.size());
-  size += ProtoSize::calc_length(1, this->serial_number.size());
-  return size;
-}
 #endif
 #ifdef USE_BLUETOOTH_PROXY_CONNECTIONS
 bool BluetoothSetConnectionParamsRequest::decode_varint(uint32_t field_id, proto_varint_value_t value) {
@@ -4353,41 +4290,5 @@ uint32_t BluetoothSetConnectionParamsResponse::calculate_size() const {
   return size;
 }
 #endif
-#ifdef USE_ZIGBEE_PROXY
-bool ZigbeeProxyRequest::decode_varint(uint32_t field_id, proto_varint_value_t value) {
-  switch (field_id) {
-    case 1:
-      this->type = static_cast<enums::ZigbeeProxyRequestType>(value);
-      break;
-    default:
-      return false;
-  }
-  return true;
-}
-bool ZigbeeProxyRequest::decode_length(uint32_t field_id, ProtoLengthDelimited value) {
-  switch (field_id) {
-    case 2: {
-      this->data = value.data();
-      this->data_len = value.size();
-      break;
-    }
-    default:
-      return false;
-  }
-  return true;
-}
-uint8_t *ZigbeeProxyRequest::encode(ProtoWriteBuffer &buffer PROTO_ENCODE_DEBUG_PARAM) const {
-  uint8_t *__restrict__ pos = buffer.get_pos();
-  ProtoEncode::encode_uint32(pos PROTO_ENCODE_DEBUG_ARG, 1, static_cast<uint32_t>(this->type));
-  ProtoEncode::encode_bytes(pos PROTO_ENCODE_DEBUG_ARG, 2, this->data, this->data_len);
-  return pos;
-}
-uint32_t ZigbeeProxyRequest::calculate_size() const {
-  uint32_t size = 0;
-  size += this->type ? 2 : 0;
-  size += ProtoSize::calc_length(1, this->data_len);
-  return size;
-}
-#endif
 
 }  // namespace esphome::api

esphome/components/api/api_pb2.h

@@ -23,7 +23,6 @@ enum SerialProxyPortType : uint32_t {
   SERIAL_PROXY_PORT_TYPE_TTL = 0,
   SERIAL_PROXY_PORT_TYPE_RS232 = 1,
   SERIAL_PROXY_PORT_TYPE_RS485 = 2,
-  SERIAL_PROXY_PORT_TYPE_USB_SERIAL = 3,
 };
 enum EntityCategory : uint32_t {
   ENTITY_CATEGORY_NONE = 0,
@@ -357,7 +356,6 @@ enum SerialProxyRequestType : uint32_t {
   SERIAL_PROXY_REQUEST_TYPE_FLUSH = 2,
   SERIAL_PROXY_REQUEST_TYPE_CONFIGURE = 3,
   SERIAL_PROXY_REQUEST_TYPE_SET_MODEM_PINS = 4,
-  SERIAL_PROXY_REQUEST_TYPE_SET_MODE = 5,
 };
 enum SerialProxyStatus : uint32_t {
   SERIAL_PROXY_STATUS_OK = 0,
@@ -368,15 +366,6 @@ enum SerialProxyStatus : uint32_t {
   SERIAL_PROXY_STATUS_PORT_IN_USE = 5,
   SERIAL_PROXY_STATUS_INVALID_ARGUMENT = 6,
 };
-enum SerialProxyMode : uint32_t {
-  SERIAL_PROXY_MODE_RAW = 0,
-  SERIAL_PROXY_MODE_PROTOCOL = 1,
-};
-#endif
-#ifdef USE_ZIGBEE_PROXY
-enum ZigbeeProxyRequestType : uint32_t {
-  ZIGBEE_PROXY_REQUEST_TYPE_NETWORK_INFO = 0,
-};
 #endif
 
 }  // namespace enums
@@ -560,7 +549,7 @@ class SerialProxyInfo final : public ProtoMessage {
 class DeviceInfoResponse final : public ProtoMessage {
  public:
   static constexpr uint16_t MESSAGE_TYPE = 10;
-  static constexpr uint16_t ESTIMATED_SIZE = 322;
+  static constexpr uint16_t ESTIMATED_SIZE = 312;
 #ifdef HAS_PROTO_MESSAGE_DUMP
   const LogString *message_name() const override { return LOG_STR("device_info_response"); }
 #endif
@@ -618,12 +607,6 @@ class DeviceInfoResponse final : public ProtoMessage {
 #endif
 #ifdef USE_API_NOISE
   bool api_encryption_provisionable{false};
-#endif
-#ifdef USE_ZIGBEE_PROXY
-  uint32_t zigbee_proxy_feature_flags{0};
-#endif
-#ifdef USE_ZIGBEE_PROXY
-  uint64_t zigbee_ieee_address{0};
 #endif
   uint8_t *encode(ProtoWriteBuffer &buffer PROTO_ENCODE_DEBUG_PARAM) const;
   uint32_t calculate_size() const;
@@ -3420,62 +3403,6 @@ class SerialProxyRequestResponse final : public ProtoMessage {
 
  protected:
 };
-class SerialProxySetModeRequest final : public ProtoDecodableMessage {
- public:
-  static constexpr uint16_t MESSAGE_TYPE = 152;
-  static constexpr uint8_t ESTIMATED_SIZE = 6;
-#ifdef HAS_PROTO_MESSAGE_DUMP
-  const LogString *message_name() const override { return LOG_STR("serial_proxy_set_mode_request"); }
-#endif
-  uint32_t instance{0};
-  enums::SerialProxyMode mode{};
-#ifdef HAS_PROTO_MESSAGE_DUMP
-  const char *dump_to(DumpBuffer &out) const override;
-#endif
-
- protected:
-  bool decode_varint(uint32_t field_id, proto_varint_value_t value) override;
-};
-class SerialProxyGetUsbInfoRequest final : public ProtoDecodableMessage {
- public:
-  static constexpr uint16_t MESSAGE_TYPE = 153;
-  static constexpr uint8_t ESTIMATED_SIZE = 4;
-#ifdef HAS_PROTO_MESSAGE_DUMP
-  const LogString *message_name() const override { return LOG_STR("serial_proxy_get_usb_info_request"); }
-#endif
-  uint32_t instance{0};
-#ifdef HAS_PROTO_MESSAGE_DUMP
-  const char *dump_to(DumpBuffer &out) const override;
-#endif
-
- protected:
-  bool decode_varint(uint32_t field_id, proto_varint_value_t value) override;
-};
-class SerialProxyGetUsbInfoResponse final : public ProtoMessage {
- public:
-  static constexpr uint16_t MESSAGE_TYPE = 154;
-  static constexpr uint8_t ESTIMATED_SIZE = 51;
-#ifdef HAS_PROTO_MESSAGE_DUMP
-  const LogString *message_name() const override { return LOG_STR("serial_proxy_get_usb_info_response"); }
-#endif
-  uint32_t instance{0};
-  enums::SerialProxyStatus status{};
-  bool connected{false};
-  uint32_t vendor_id{0};
-  uint32_t product_id{0};
-  uint32_t bcd_device{0};
-  uint32_t interface_number{0};
-  StringRef manufacturer{};
-  StringRef product{};
-  StringRef serial_number{};
-  uint8_t *encode(ProtoWriteBuffer &buffer PROTO_ENCODE_DEBUG_PARAM) const;
-  uint32_t calculate_size() const;
-#ifdef HAS_PROTO_MESSAGE_DUMP
-  const char *dump_to(DumpBuffer &out) const override;
-#endif
-
- protected:
-};
 #endif
 #ifdef USE_BLUETOOTH_PROXY_CONNECTIONS
 class BluetoothSetConnectionParamsRequest final : public ProtoDecodableMessage {
@@ -3515,27 +3442,5 @@ class BluetoothSetConnectionParamsResponse final : public ProtoMessage {
  protected:
 };
 #endif
-#ifdef USE_ZIGBEE_PROXY
-class ZigbeeProxyRequest final : public ProtoDecodableMessage {
- public:
-  static constexpr uint16_t MESSAGE_TYPE = 155;
-  static constexpr uint8_t ESTIMATED_SIZE = 21;
-#ifdef HAS_PROTO_MESSAGE_DUMP
-  const LogString *message_name() const override { return LOG_STR("zigbee_proxy_request"); }
-#endif
-  enums::ZigbeeProxyRequestType type{};
-  const uint8_t *data{nullptr};
-  uint16_t data_len{0};
-  uint8_t *encode(ProtoWriteBuffer &buffer PROTO_ENCODE_DEBUG_PARAM) const;
-  uint32_t calculate_size() const;
-#ifdef HAS_PROTO_MESSAGE_DUMP
-  const char *dump_to(DumpBuffer &out) const override;
-#endif
-
- protected:
-  bool decode_length(uint32_t field_id, ProtoLengthDelimited value) override;
-  bool decode_varint(uint32_t field_id, proto_varint_value_t value) override;
-};
-#endif
 
 }  // namespace esphome::api

esphome/components/api/api_pb2_defines.h

@@ -3,8 +3,10 @@
 #pragma once
 
 #include "esphome/core/defines.h"
+#if defined(USE_BLUETOOTH_PROXY) || defined(USE_BLUETOOTH_PROXY_CONNECTIONS)
 #ifndef USE_API_VARINT64
 #define USE_API_VARINT64
 #endif
+#endif
 
 namespace esphome::api {}  // namespace esphome::api

esphome/components/api/api_pb2_dump.cpp

@@ -143,8 +143,6 @@ template<> const char *proto_enum_to_string<enums::SerialProxyPortType>(enums::S
       return ESPHOME_PSTR("SERIAL_PROXY_PORT_TYPE_RS232");
     case enums::SERIAL_PROXY_PORT_TYPE_RS485:
       return ESPHOME_PSTR("SERIAL_PROXY_PORT_TYPE_RS485");
-    case enums::SERIAL_PROXY_PORT_TYPE_USB_SERIAL:
-      return ESPHOME_PSTR("SERIAL_PROXY_PORT_TYPE_USB_SERIAL");
     default:
       return ESPHOME_PSTR("UNKNOWN");
   }
@@ -856,8 +854,6 @@ template<> const char *proto_enum_to_string<enums::SerialProxyRequestType>(enums
       return ESPHOME_PSTR("SERIAL_PROXY_REQUEST_TYPE_CONFIGURE");
     case enums::SERIAL_PROXY_REQUEST_TYPE_SET_MODEM_PINS:
       return ESPHOME_PSTR("SERIAL_PROXY_REQUEST_TYPE_SET_MODEM_PINS");
-    case enums::SERIAL_PROXY_REQUEST_TYPE_SET_MODE:
-      return ESPHOME_PSTR("SERIAL_PROXY_REQUEST_TYPE_SET_MODE");
     default:
       return ESPHOME_PSTR("UNKNOWN");
   }
@@ -882,26 +878,6 @@ template<> const char *proto_enum_to_string<enums::SerialProxyStatus>(enums::Ser
       return ESPHOME_PSTR("UNKNOWN");
   }
 }
-template<> const char *proto_enum_to_string<enums::SerialProxyMode>(enums::SerialProxyMode value) {
-  switch (value) {
-    case enums::SERIAL_PROXY_MODE_RAW:
-      return ESPHOME_PSTR("SERIAL_PROXY_MODE_RAW");
-    case enums::SERIAL_PROXY_MODE_PROTOCOL:
-      return ESPHOME_PSTR("SERIAL_PROXY_MODE_PROTOCOL");
-    default:
-      return ESPHOME_PSTR("UNKNOWN");
-  }
-}
-#endif
-#ifdef USE_ZIGBEE_PROXY
-template<> const char *proto_enum_to_string<enums::ZigbeeProxyRequestType>(enums::ZigbeeProxyRequestType value) {
-  switch (value) {
-    case enums::ZIGBEE_PROXY_REQUEST_TYPE_NETWORK_INFO:
-      return ESPHOME_PSTR("ZIGBEE_PROXY_REQUEST_TYPE_NETWORK_INFO");
-    default:
-      return ESPHOME_PSTR("UNKNOWN");
-  }
-}
 #endif
 
 const char *HelloRequest::dump_to(DumpBuffer &out) const {
@@ -1032,12 +1008,6 @@ const char *DeviceInfoResponse::dump_to(DumpBuffer &out) const {
 #endif
 #ifdef USE_API_NOISE
   dump_field(out, ESPHOME_PSTR("api_encryption_provisionable"), this->api_encryption_provisionable);
-#endif
-#ifdef USE_ZIGBEE_PROXY
-  dump_field(out, ESPHOME_PSTR("zigbee_proxy_feature_flags"), this->zigbee_proxy_feature_flags);
-#endif
-#ifdef USE_ZIGBEE_PROXY
-  dump_field(out, ESPHOME_PSTR("zigbee_ieee_address"), this->zigbee_ieee_address);
 #endif
   return out.c_str();
 }
@@ -2835,31 +2805,6 @@ const char *SerialProxyRequestResponse::dump_to(DumpBuffer &out) const {
   dump_field(out, ESPHOME_PSTR("error_message"), this->error_message);
   return out.c_str();
 }
-const char *SerialProxySetModeRequest::dump_to(DumpBuffer &out) const {
-  MessageDumpHelper helper(out, ESPHOME_PSTR("SerialProxySetModeRequest"));
-  dump_field(out, ESPHOME_PSTR("instance"), this->instance);
-  dump_field(out, ESPHOME_PSTR("mode"), static_cast<enums::SerialProxyMode>(this->mode));
-  return out.c_str();
-}
-const char *SerialProxyGetUsbInfoRequest::dump_to(DumpBuffer &out) const {
-  MessageDumpHelper helper(out, ESPHOME_PSTR("SerialProxyGetUsbInfoRequest"));
-  dump_field(out, ESPHOME_PSTR("instance"), this->instance);
-  return out.c_str();
-}
-const char *SerialProxyGetUsbInfoResponse::dump_to(DumpBuffer &out) const {
-  MessageDumpHelper helper(out, ESPHOME_PSTR("SerialProxyGetUsbInfoResponse"));
-  dump_field(out, ESPHOME_PSTR("instance"), this->instance);
-  dump_field(out, ESPHOME_PSTR("status"), static_cast<enums::SerialProxyStatus>(this->status));
-  dump_field(out, ESPHOME_PSTR("connected"), this->connected);
-  dump_field(out, ESPHOME_PSTR("vendor_id"), this->vendor_id);
-  dump_field(out, ESPHOME_PSTR("product_id"), this->product_id);
-  dump_field(out, ESPHOME_PSTR("bcd_device"), this->bcd_device);
-  dump_field(out, ESPHOME_PSTR("interface_number"), this->interface_number);
-  dump_field(out, ESPHOME_PSTR("manufacturer"), this->manufacturer);
-  dump_field(out, ESPHOME_PSTR("product"), this->product);
-  dump_field(out, ESPHOME_PSTR("serial_number"), this->serial_number);
-  return out.c_str();
-}
 #endif
 #ifdef USE_BLUETOOTH_PROXY_CONNECTIONS
 const char *BluetoothSetConnectionParamsRequest::dump_to(DumpBuffer &out) const {
@@ -2878,14 +2823,6 @@ const char *BluetoothSetConnectionParamsResponse::dump_to(DumpBuffer &out) const
   return out.c_str();
 }
 #endif
-#ifdef USE_ZIGBEE_PROXY
-const char *ZigbeeProxyRequest::dump_to(DumpBuffer &out) const {
-  MessageDumpHelper helper(out, ESPHOME_PSTR("ZigbeeProxyRequest"));
-  dump_field(out, ESPHOME_PSTR("type"), static_cast<enums::ZigbeeProxyRequestType>(this->type));
-  dump_bytes_field(out, ESPHOME_PSTR("data"), this->data, this->data_len);
-  return out.c_str();
-}
-#endif
 
 }  // namespace esphome::api
 

esphome/components/api/api_pb2_service.cpp

@@ -712,39 +712,6 @@ void APIConnection::read_message_(uint32_t msg_size, uint32_t msg_type, const ui
       this->on_device_capabilities_request();
       break;
     }
-#ifdef USE_SERIAL_PROXY
-    case SerialProxySetModeRequest::MESSAGE_TYPE: {
-      SerialProxySetModeRequest msg;
-      msg.decode(msg_data, msg_size);
-#ifdef HAS_PROTO_MESSAGE_DUMP
-      this->log_receive_message_(LOG_STR("on_serial_proxy_set_mode_request"), msg);
-#endif
-      this->on_serial_proxy_set_mode_request(msg);
-      break;
-    }
-#endif
-#ifdef USE_SERIAL_PROXY
-    case SerialProxyGetUsbInfoRequest::MESSAGE_TYPE: {
-      SerialProxyGetUsbInfoRequest msg;
-      msg.decode(msg_data, msg_size);
-#ifdef HAS_PROTO_MESSAGE_DUMP
-      this->log_receive_message_(LOG_STR("on_serial_proxy_get_usb_info_request"), msg);
-#endif
-      this->on_serial_proxy_get_usb_info_request(msg);
-      break;
-    }
-#endif
-#ifdef USE_ZIGBEE_PROXY
-    case ZigbeeProxyRequest::MESSAGE_TYPE: {
-      ZigbeeProxyRequest msg;
-      msg.decode(msg_data, msg_size);
-#ifdef HAS_PROTO_MESSAGE_DUMP
-      this->log_receive_message_(LOG_STR("on_zigbee_proxy_request"), msg);
-#endif
-      this->on_zigbee_proxy_request(msg);
-      break;
-    }
-#endif
     default:
       break;
   }

esphome/components/api/api_pb2_service.h

@@ -235,20 +235,9 @@ class APIServerConnectionBase {
   void on_serial_proxy_request(const SerialProxyRequest &value){};
 #endif
 
-#ifdef USE_SERIAL_PROXY
-  void on_serial_proxy_set_mode_request(const SerialProxySetModeRequest &value){};
-#endif
-#ifdef USE_SERIAL_PROXY
-  void on_serial_proxy_get_usb_info_request(const SerialProxyGetUsbInfoRequest &value){};
-#endif
-
 #ifdef USE_BLUETOOTH_PROXY_CONNECTIONS
   void on_bluetooth_set_connection_params_request(const BluetoothSetConnectionParamsRequest &value){};
 #endif
-
-#ifdef USE_ZIGBEE_PROXY
-  void on_zigbee_proxy_request(const ZigbeeProxyRequest &value){};
-#endif
 };
 
 }  // namespace esphome::api

esphome/components/api/api_server.cpp

@@ -41,13 +41,13 @@ void APIServer::setup() {
   ControllerRegistry::register_controller(this);
 
 #ifdef USE_API_NOISE
+  // Always reserve the slot: flash preferences are positional on esp8266, so
+  // a yaml key build must keep the layout of a runtime key build
   uint32_t hash = 88491486UL;
-
   this->noise_pref_ = global_preferences->make_preference<SavedNoisePsk>(hash, true);
-
 #ifndef USE_API_NOISE_PSK_FROM_YAML
-  // Only load saved PSK if not set from YAML
-  if (this->load_and_apply_noise_psk_()) {
+  // A cleared record loads fine but holds no key
+  if (this->load_and_apply_noise_psk_() && this->noise_ctx_.has_psk()) {
     ESP_LOGD(TAG, "Loaded saved Noise PSK");
   }
 #endif
@@ -404,14 +404,6 @@ void APIServer::on_zwave_proxy_request(const ZWaveProxyRequest &msg) {
 }
 #endif
 
-#ifdef USE_ZIGBEE_PROXY
-void APIServer::on_zigbee_proxy_request(const ZigbeeProxyRequest &msg) {
-  // Very infrequent and small - send to all clients rather than tracking a subscription
-  for (auto &c : this->active_clients())
-    c->send_message(msg);
-}
-#endif
-
 #if defined(USE_IR_RF) || defined(USE_RADIO_FREQUENCY)
 void APIServer::send_infrared_rf_receive_event([[maybe_unused]] uint32_t device_id, uint32_t key,
                                                const std::vector<int32_t> *timings) {
@@ -558,6 +550,7 @@ const std::vector<APIServer::HomeAssistantStateSubscription> &APIServer::get_sta
 #endif
 
 #ifdef USE_API_NOISE
+#ifndef USE_API_NOISE_PSK_FROM_YAML
 bool APIServer::update_noise_psk_(const SavedNoisePsk &new_psk, const LogString *save_log_msg,
                                   const LogString *fail_log_msg, bool make_active) {
   if (!this->noise_pref_.save(&new_psk)) {
@@ -591,22 +584,19 @@ bool APIServer::update_noise_psk_(const SavedNoisePsk &new_psk, const LogString
 }
 
 bool APIServer::load_and_apply_noise_psk_() {
-  SavedNoisePsk saved{};
-  if (!this->noise_pref_.load(&saved))
+  // Load into a temp so a failed read cannot disturb the key in use
+  SavedNoisePsk loaded{};
+  if (!this->noise_pref_.load(&loaded))
     return false;
-  this->set_noise_psk(saved.psk);
+  this->saved_psk_ = loaded;
+  // An unprovisioned device stores the reserved all-zeros key, which is no key
+  const bool has_key = !noise::NoiseContext::is_all_zeros(this->saved_psk_.psk);
+  this->noise_ctx_.set_psk(has_key ? this->saved_psk_.psk.data() : nullptr);
   return true;
 }
 
 bool APIServer::save_noise_psk(noise::psk_t psk, bool make_active) {
-#ifdef USE_API_NOISE_PSK_FROM_YAML
-  // When PSK is set from YAML, this function should never be called
-  // but if it is, reject the change
-  ESP_LOGW(TAG, "Key set in YAML");
-  return false;
-#else
-  auto &old_psk = this->noise_ctx_.get_psk();
-  if (std::equal(old_psk.begin(), old_psk.end(), psk.begin())) {
+  if (this->saved_psk_.psk == psk) {
     ESP_LOGW(TAG, "New PSK matches old");
     return true;
   }
@@ -622,15 +612,8 @@ bool APIServer::save_noise_psk(noise::psk_t psk, bool make_active) {
   }
 #endif
   return result;
-#endif
 }
 bool APIServer::clear_noise_psk(bool make_active) {
-#ifdef USE_API_NOISE_PSK_FROM_YAML
-  // When PSK is set from YAML, this function should never be called
-  // but if it is, reject the change
-  ESP_LOGW(TAG, "Key set in YAML");
-  return false;
-#else
   SavedNoisePsk empty_psk{};
   bool result = this->update_noise_psk_(empty_psk, LOG_STR("Noise PSK cleared"), LOG_STR("Failed to clear Noise PSK"),
                                         make_active);
@@ -642,8 +625,8 @@ bool APIServer::clear_noise_psk(bool make_active) {
   }
 #endif
   return result;
-#endif
 }
+#endif  // USE_API_NOISE_PSK_FROM_YAML
 #endif
 
 #ifdef USE_HOMEASSISTANT_TIME

esphome/components/api/api_server.h

@@ -76,9 +76,14 @@ class APIServer final : public Component,
   APIBuffer &get_shared_buffer_ref() { return shared_write_buffer_; }
 
 #ifdef USE_API_NOISE
+#ifndef USE_API_NOISE_PSK_FROM_YAML
+  // Runtime key changes exist for the provisioning path only (not lambdas);
+  // with a yaml key they compile out
   bool save_noise_psk(noise::psk_t psk, bool make_active = true);
   bool clear_noise_psk(bool make_active = true);
-  void set_noise_psk(noise::psk_t psk) { this->noise_ctx_.set_psk(psk); }
+#endif
+  /// psk points at 32 bytes that live in flash for the life of the program
+  void set_noise_psk(const uint8_t *psk) { this->noise_ctx_.set_psk(psk); }
   noise::NoiseContext &get_noise_ctx() { return this->noise_ctx_; }
 #endif  // USE_API_NOISE
 
@@ -189,9 +194,6 @@ class APIServer final : public Component,
 #ifdef USE_ZWAVE_PROXY
   void on_zwave_proxy_request(const ZWaveProxyRequest &msg);
 #endif
-#ifdef USE_ZIGBEE_PROXY
-  void on_zigbee_proxy_request(const ZigbeeProxyRequest &msg);
-#endif
 #if defined(USE_IR_RF) || defined(USE_RADIO_FREQUENCY)
   void send_infrared_rf_receive_event(uint32_t device_id, uint32_t key, const std::vector<int32_t> *timings);
 #endif
@@ -278,10 +280,12 @@ class APIServer final : public Component,
 #endif
 
 #ifdef USE_API_NOISE
+#ifndef USE_API_NOISE_PSK_FROM_YAML
   bool update_noise_psk_(const SavedNoisePsk &new_psk, const LogString *save_log_msg, const LogString *fail_log_msg,
                          bool make_active);
   // Load saved PSK from preferences and apply it. Returns true on success.
   bool load_and_apply_noise_psk_();
+#endif  // USE_API_NOISE_PSK_FROM_YAML
 #endif  // USE_API_NOISE
 #ifdef USE_API_HOMEASSISTANT_STATES
   // Helper methods to reduce code duplication
@@ -361,6 +365,9 @@ class APIServer final : public Component,
 
 #ifdef USE_API_NOISE
   noise::NoiseContext noise_ctx_;
+#ifndef USE_API_NOISE_PSK_FROM_YAML
+  SavedNoisePsk saved_psk_{};  // backs noise_ctx_ for a runtime provisioned key
+#endif
   ESPPreferenceObject noise_pref_;
 #endif  // USE_API_NOISE
 };

esphome/components/climate/__init__.py

@@ -125,6 +125,19 @@ CLIMATE_SWING_MODES = {
 
 validate_climate_swing_mode = cv.enum(CLIMATE_SWING_MODES, upper=True)
 
+ClimateAction = climate_ns.enum("ClimateAction")
+CLIMATE_ACTIONS = {
+    "OFF": ClimateAction.CLIMATE_ACTION_OFF,
+    "COOLING": ClimateAction.CLIMATE_ACTION_COOLING,
+    "HEATING": ClimateAction.CLIMATE_ACTION_HEATING,
+    "IDLE": ClimateAction.CLIMATE_ACTION_IDLE,
+    "DRYING": ClimateAction.CLIMATE_ACTION_DRYING,
+    "FAN": ClimateAction.CLIMATE_ACTION_FAN,
+    "DEFROSTING": ClimateAction.CLIMATE_ACTION_DEFROSTING,
+}
+
+validate_climate_action = cv.enum(CLIMATE_ACTIONS, upper=True)
+
 CONF_MIN_HUMIDITY = "min_humidity"
 CONF_MAX_HUMIDITY = "max_humidity"
 CONF_TARGET_HUMIDITY = "target_humidity"

esphome/components/esp32_ble/ble.cpp

@@ -100,21 +100,38 @@ void ESP32BLE::disable() {
 #ifdef USE_ESP32_BLE_ADVERTISING
 void ESP32BLE::advertising_start() {
   this->advertising_init_();
-  if (!this->is_active())
+  this->advertising_ref_count_++;
+  this->advertising_refresh();
+}
+
+void ESP32BLE::advertising_stop() {
+  if (this->advertising_ref_count_ == 0)
     return;
-  this->advertising_->start();
+  this->advertising_ref_count_--;
+  this->advertising_refresh();
+}
+
+void ESP32BLE::advertising_refresh() {
+  if (this->advertising_ == nullptr || !this->is_active())
+    return;
+  // Advertise while any component still needs it, otherwise stop
+  if (this->advertising_ref_count_ == 0) {
+    this->advertising_->stop();
+  } else {
+    this->advertising_->start();
+  }
 }
 
 void ESP32BLE::advertising_set_service_data(const std::vector<uint8_t> &data) {
   this->advertising_init_();
   this->advertising_->set_service_data(data);
-  this->advertising_start();
+  this->advertising_refresh();
 }
 
 void ESP32BLE::advertising_set_manufacturer_data(const std::vector<uint8_t> &data) {
   this->advertising_init_();
   this->advertising_->set_manufacturer_data(data);
-  this->advertising_start();
+  this->advertising_refresh();
 }
 
 void ESP32BLE::advertising_set_service_data_and_name(std::span<const uint8_t> data, bool include_name) {
@@ -136,7 +153,7 @@ void ESP32BLE::advertising_set_service_data_and_name(std::span<const uint8_t> da
     this->advertising_->set_service_data(data);
   }
 
-  this->advertising_start();
+  this->advertising_refresh();
 }
 
 void ESP32BLE::advertising_register_raw_advertisement_callback(std::function<void(bool)> &&callback) {
@@ -147,13 +164,13 @@ void ESP32BLE::advertising_register_raw_advertisement_callback(std::function<voi
 void ESP32BLE::advertising_add_service_uuid(ESPBTUUID uuid) {
   this->advertising_init_();
   this->advertising_->add_service_uuid(uuid);
-  this->advertising_start();
+  this->advertising_refresh();
 }
 
 void ESP32BLE::advertising_remove_service_uuid(ESPBTUUID uuid) {
   this->advertising_init_();
   this->advertising_->remove_service_uuid(uuid);
-  this->advertising_start();
+  this->advertising_refresh();
 }
 #endif
 
@@ -575,6 +592,10 @@ void ESP32BLE::loop_handle_state_transition_not_active_() {
     }
 
     this->state_ = BLE_COMPONENT_STATE_ACTIVE;
+#ifdef USE_ESP32_BLE_ADVERTISING
+    // Requests made before the stack was up (or before it was re-enabled) take effect now
+    this->advertising_refresh();
+#endif
   }
 }
 

esphome/components/esp32_ble/ble.h

@@ -114,7 +114,17 @@ class ESP32BLE final : public Component {
   void set_name(const char *name) { this->name_ = name; }
 
 #ifdef USE_ESP32_BLE_ADVERTISING
+  /** Request advertising on behalf of a component.
+   *
+   * Requests are reference counted: advertising runs until every component that called
+   * advertising_start() has released it again with advertising_stop(). Each component must
+   * pair its calls, so nothing advertises until something actually asks for it.
+   */
   void advertising_start();
+  /// Release a request made with advertising_start(); advertising stops at the last release.
+  void advertising_stop();
+  /// Apply the current payload and request count: advertise while requested, otherwise stop.
+  void advertising_refresh();
   void advertising_set_service_data(const std::vector<uint8_t> &data);
   void advertising_set_manufacturer_data(const std::vector<uint8_t> &data);
   void advertising_set_appearance(uint16_t appearance) { this->appearance_ = appearance; }
@@ -226,6 +236,9 @@ class ESP32BLE final : public Component {
   // 1-byte aligned members (grouped together to minimize padding)
   BLEComponentState state_{BLE_COMPONENT_STATE_OFF};  // 1 byte (uint8_t enum)
   bool enable_on_boot_{};                             // 1 byte
+#ifdef USE_ESP32_BLE_ADVERTISING
+  uint8_t advertising_ref_count_{0};  // 1 byte, number of components requesting advertising
+#endif
 
 #ifdef ESPHOME_ESP32_BLE_EXTENDED_AUTH_PARAMS
   optional<esp_ble_auth_req_t> auth_req_mode_;

esphome/components/esp32_ble_beacon/esp32_ble_beacon.cpp

@@ -67,6 +67,8 @@ void ESP32BLEBeacon::setup() {
       this->on_advertise_();
     }
   });
+  // A beacon always needs the device to advertise, and never releases the request
+  global_ble->advertising_start();
 }
 
 void ESP32BLEBeacon::on_advertise_() {

esphome/components/esp32_ble_server/__init__.py

@@ -596,6 +596,18 @@ async def to_code(config):
     cg.add(var.set_parent(parent))
     cg.add(parent.advertising_set_appearance(config[CONF_APPEARANCE]))
     cg.add(var.set_max_clients(config[CONF_MAX_CLIENTS]))
+    # Only advertise for the server itself when the configuration gives clients something to
+    # find. A server that is auto-loaded purely to host a runtime service (esp32_improv) stays
+    # silent until that service asks for advertising.
+    cg.add(
+        var.set_advertising_required(
+            CONF_MANUFACTURER_DATA in config
+            or any(
+                not uuid_is(service_config[CONF_UUID], DEVICE_INFORMATION_SERVICE_UUID)
+                for service_config in config[CONF_SERVICES]
+            )
+        )
+    )
     if CONF_MANUFACTURER_DATA in config:
         cg.add(var.set_manufacturer_data(config[CONF_MANUFACTURER_DATA]))
     for service_config in config[CONF_SERVICES]:

esphome/components/esp32_ble_server/ble_server.cpp

@@ -81,6 +81,7 @@ void BLEServer::loop() {
       if (this->device_information_service_->is_running()) {
         this->state_ = RUNNING;
         this->restart_advertising_();
+        this->request_advertising_();
         ESP_LOGD(TAG, "BLE server setup successfully");
       } else if (this->device_information_service_->is_created()) {
         this->device_information_service_->start();
@@ -98,6 +99,20 @@ void BLEServer::restart_advertising_() {
   }
 }
 
+void BLEServer::request_advertising_() {
+  if (!this->advertising_required_ || this->advertising_requested_)
+    return;
+  this->advertising_requested_ = true;
+  this->parent_->advertising_start();
+}
+
+void BLEServer::release_advertising_() {
+  if (!this->advertising_requested_)
+    return;
+  this->advertising_requested_ = false;
+  this->parent_->advertising_stop();
+}
+
 BLEService *BLEServer::create_service(ESPBTUUID uuid, bool advertise, uint16_t num_handles) {
 #if ESPHOME_LOG_LEVEL >= ESPHOME_LOG_LEVEL_VERBOSE
   char uuid_buf[esp32_ble::UUID_STR_LEN];
@@ -170,7 +185,7 @@ void BLEServer::gatts_event_handler(esp_gatts_cb_event_t event, esp_gatt_if_t ga
       this->add_client_(param->connect.conn_id);
       // Resume advertising so additional clients can discover and connect
       if (this->client_count_ < this->max_clients_) {
-        this->parent_->advertising_start();
+        this->parent_->advertising_refresh();
       }
       this->dispatch_callbacks_(CallbackType::ON_CONNECT, param->connect.conn_id);
       break;
@@ -178,7 +193,7 @@ void BLEServer::gatts_event_handler(esp_gatts_cb_event_t event, esp_gatt_if_t ga
     case ESP_GATTS_DISCONNECT_EVT: {
       ESP_LOGD(TAG, "BLE Client disconnected");
       this->remove_client_(param->disconnect.conn_id);
-      this->parent_->advertising_start();
+      this->parent_->advertising_refresh();
       this->dispatch_callbacks_(CallbackType::ON_DISCONNECT, param->disconnect.conn_id);
       break;
     }
@@ -226,6 +241,8 @@ void BLEServer::remove_client_(uint16_t conn_id) {
 }
 
 void BLEServer::ble_before_disabled_event_handler() {
+  // Advertising is re-requested once the server is running again after BLE is re-enabled
+  this->release_advertising_();
   // Delete all clients
   this->client_count_ = 0;
   // Delete all services

esphome/components/esp32_ble_server/ble_server.h

@@ -38,6 +38,13 @@ class BLEServer final : public Component, public Parented<ESP32BLE> {
     this->restart_advertising_();
   }
 
+  /** Whether this server needs the device to advertise so clients can find and connect to it.
+   *
+   * False for a server that only hosts services created at runtime (e.g. esp32_improv), which
+   * request advertising themselves for as long as they need it.
+   */
+  void set_advertising_required(bool required) { this->advertising_required_ = required; }
+
   void set_max_clients(uint8_t max_clients) { this->max_clients_ = max_clients; }
   uint8_t get_max_clients() const { return this->max_clients_; }
 
@@ -82,6 +89,8 @@ class BLEServer final : public Component, public Parented<ESP32BLE> {
   };
 
   void restart_advertising_();
+  void request_advertising_();
+  void release_advertising_();
 
   int8_t find_client_index_(uint16_t conn_id) const;
   void add_client_(uint16_t conn_id);
@@ -93,6 +102,8 @@ class BLEServer final : public Component, public Parented<ESP32BLE> {
   std::vector<uint8_t> manufacturer_data_{};
   esp_gatt_if_t gatts_if_{0};
   bool registered_{false};
+  bool advertising_required_{true};
+  bool advertising_requested_{false};
 
   uint16_t clients_[USE_ESP32_BLE_MAX_CONNECTIONS]{};
   uint8_t client_count_{0};

esphome/components/esp32_hosted/__init__.py

@@ -37,6 +37,25 @@ CONF_HANDSHAKE_PIN = "handshake_pin"
 CONF_SDIO_FREQUENCY = "sdio_frequency"
 CONF_SPI_MODE = "spi_mode"
 
+# ESP-NOW-over-hosted shim (esp_now_hosted.cpp). esp-hosted proxies esp_wifi.h
+# but not esp_now.h (espressif/esp-hosted-mcu#19), and esp_wifi_remote injects
+# the esp_now.h header on the ESP32-P4 host with no implementation, leaving the
+# esp_now_* symbols undefined at link. On a P4 host, esp_now_hosted.cpp DEFINES
+# those symbols and forwards each call to the co-processor over esp-hosted's
+# CustomRpc "peer data transfer" channel, so ESPHome's `espnow` component links
+# and runs unchanged (proven on a Tab5, 2026-07-20). The .cpp is guarded to
+# CONFIG_IDF_TARGET_ESP32P4 so it compiles to nothing on hosts with a native
+# ESP-NOW stack. CustomRpc needs these two host-side Kconfig options. Host
+# registers 3 handlers (RESP, RECV, SEND); the coprocessor registers 1 (REQ);
+# we ask for 8 to leave room for other CustomRpc extensions alongside.
+#
+# The coprocessor must run the matching custom firmware (a parallel effort in
+# esphome/esp-hosted-firmware). esp_now_hosted_rpc.h here is the canonical copy
+# of the wire contract and MUST stay byte-identical to the copy that coprocessor
+# firmware uses — the packed structs are the on-wire layout, so any divergence
+# silently corrupts every ESP-NOW frame.
+_MAX_CUSTOM_MSG_HANDLERS = 8
+
 # Shared fields for both transport modes
 BASE_SCHEMA = cv.Schema(
     {
@@ -262,6 +281,23 @@ async def to_code(config: ConfigType) -> None:
     else:
         _configure_spi(config)
 
+    # ESP-NOW-over-hosted shim: only the radio-less ESP32-P4 host needs it (see
+    # the note by _MAX_CUSTOM_MSG_HANDLERS). Enabled for every P4 host, not
+    # gated on the `espnow` component being present: the shim is tiny and the
+    # esp_now_* symbols/CustomRpc calls it defines require these Kconfig options
+    # to link whenever esp_now_hosted.cpp compiles (which is on any P4 host), so
+    # coupling the two keeps the build consistent. When `espnow` is absent the
+    # symbols are simply unused and never register a callback at runtime.
+    if esp32.get_esp32_variant() == esp32.VARIANT_ESP32P4:
+        add_define("USE_ESP_NOW_HOSTED")
+        # esp-hosted's CustomRpc ("peer data transfer") path — off by default.
+        esp32.add_idf_sdkconfig_option(
+            "CONFIG_ESP_HOSTED_ENABLE_PEER_DATA_TRANSFER", True
+        )
+        esp32.add_idf_sdkconfig_option(
+            "CONFIG_ESP_HOSTED_MAX_CUSTOM_MSG_HANDLERS", _MAX_CUSTOM_MSG_HANDLERS
+        )
+
     # Place the transport mempool in PSRAM. Required on memory-tight host
     # configurations (e.g. P4 with a large LVGL UI) where the internal-RAM
     # mempool allocation fails at boot with `sdio_mempool_create` assert.

esphome/components/esp32_hosted/esp_now_hosted.cpp

@@ -0,0 +1,467 @@
+/*
+ * esp_now_hosted — host-side shim implementing <esp_now.h> over esp-hosted
+ * CustomRpc, so ESPHome's `espnow` component can run on a radio-less host
+ * (e.g. the ESP32-P4) whose radio lives on an esp-hosted co-processor.
+ *
+ * A radio-less host has no native ESP-NOW. esp_wifi_remote INJECTS the full
+ * esp_now.h header (types + declarations) but ships NO implementation, so every
+ * esp_now_* symbol is an undefined reference at link time. This translation
+ * unit provides those definitions; each forwards to the co-processor over
+ * CustomRpc (see esphome/esp-hosted-firmware for the matching coprocessor
+ * handlers). No esp-hosted or esp_wifi_remote source is patched, and there is no
+ * duplicate-symbol clash because nothing else defines these symbols here.
+ *
+ * See esp_now_hosted_rpc.h for the wire protocol.
+ */
+
+#include "sdkconfig.h"
+
+// Only build the shim on the radio-less host. On chips with a native ESP-NOW
+// stack (S3, C6, …) the real symbols exist and this file must stay empty to
+// avoid duplicate definitions.
+#if defined(CONFIG_IDF_TARGET_ESP32P4)
+
+#include <cstring>
+
+#include "freertos/FreeRTOS.h"
+#include "freertos/semphr.h"
+
+#include "esp_idf_version.h"
+#include "esp_log.h"
+#include "esp_timer.h"
+
+#include <esp_now.h>         // injected declarations we are now DEFINING
+#include <esp_wifi_types.h>  // wifi_pkt_rx_ctrl_t, wifi_tx_info_t
+
+// esp_hosted_misc.h (host) ships WITHOUT an extern "C" guard, so including it
+// from C++ would give its declarations C++ linkage and the real C symbols in
+// libesp_hosted would go unresolved at link. Wrap it. (Verified vs
+// esp_hosted 2.12.9.)
+extern "C" {
+#include "esp_hosted_misc.h"  // esp_hosted_{send_custom_data,register_custom_callback}
+}
+
+#include "esp_now_hosted_rpc.h"
+
+namespace {
+
+const char *const TAG = "esp_now_hosted";
+
+// One outstanding request at a time. ESPHome drives esp_now_* from the main
+// loop; the matching response and the async RECV/SEND events all arrive on the
+// single esp-hosted RPC RX thread. Serializing requests keeps the shared
+// response slot race-free; a sequence number stops a late/stale response from
+// being mistaken for ours.
+SemaphoreHandle_t g_req_mutex = nullptr;
+SemaphoreHandle_t g_resp_sem = nullptr;  // given when the matching RESP lands
+bool g_setup_done = false;               // set only after setup fully succeeds
+uint8_t g_seq = 0;
+volatile uint8_t g_expect_seq = 0;
+volatile int32_t g_resp_status = 0;
+uint8_t g_resp_ret[16];
+volatile uint16_t g_resp_ret_len = 0;
+
+// Written from the main loop (register/unregister/deinit), read from the
+// esp-hosted RX thread (on_recv/on_send). volatile for the same reason the
+// g_resp_* globals are: force the RX thread to observe an updated pointer
+// (e.g. a nulling by esp_now_deinit) rather than a cached one.
+volatile esp_now_recv_cb_t g_recv_cb = nullptr;
+volatile esp_now_send_cb_t g_send_cb = nullptr;
+
+// Local mirror of the co-processor's peer table. ESPHome's espnow component
+// calls esp_now_is_peer_exist() on the main loop for every received frame
+// (twice) and every send; forwarding each as a blocking RPC round-trip stalls
+// the loop. The shim is the only path that mutates the co-processor peer table
+// (add/del/deinit all go through here), so this mirror is authoritative and
+// esp_now_is_peer_exist() can answer from it with no round-trip.
+//
+// esp_now_* are public C symbols: any component or user lambda may call them,
+// and although ESPHome's espnow touches peers only from the main loop today
+// (its RX/TX callbacks merely enqueue), the shim cannot rely on that. A short
+// spinlock keeps the mirror consistent from any task/core, matching native
+// esp_now_*'s own internal thread-safety. The critical sections are a bounded
+// (<=20-entry) scan, so they stay tiny. ESP_NOW_MAX_TOTAL_PEER_NUM is 20.
+constexpr size_t ESP_NOW_HOSTED_MAX_PEERS = 20;
+uint8_t g_peer_cache[ESP_NOW_HOSTED_MAX_PEERS][6];
+size_t g_peer_count = 0;
+portMUX_TYPE g_peer_lock = portMUX_INITIALIZER_UNLOCKED;
+
+// Caller must hold g_peer_lock.
+int peer_cache_find_locked(const uint8_t *mac) {
+  for (size_t i = 0; i < g_peer_count; i++) {
+    if (memcmp(g_peer_cache[i], mac, 6) == 0)
+      return static_cast<int>(i);
+  }
+  return -1;
+}
+
+bool peer_cache_contains(const uint8_t *mac) {
+  portENTER_CRITICAL(&g_peer_lock);
+  const bool found = peer_cache_find_locked(mac) >= 0;
+  portEXIT_CRITICAL(&g_peer_lock);
+  return found;
+}
+
+void peer_cache_add(const uint8_t *mac) {
+  portENTER_CRITICAL(&g_peer_lock);
+  if (peer_cache_find_locked(mac) < 0 && g_peer_count < ESP_NOW_HOSTED_MAX_PEERS)
+    memcpy(g_peer_cache[g_peer_count++], mac, 6);
+  portEXIT_CRITICAL(&g_peer_lock);
+}
+
+void peer_cache_remove(const uint8_t *mac) {
+  portENTER_CRITICAL(&g_peer_lock);
+  const int idx = peer_cache_find_locked(mac);
+  if (idx >= 0) {
+    g_peer_count--;
+    if (static_cast<size_t>(idx) != g_peer_count)  // move the last entry into the gap
+      memcpy(g_peer_cache[idx], g_peer_cache[g_peer_count], 6);
+  }
+  portEXIT_CRITICAL(&g_peer_lock);
+}
+
+void peer_cache_clear() {
+  portENTER_CRITICAL(&g_peer_lock);
+  g_peer_count = 0;
+  portEXIT_CRITICAL(&g_peer_lock);
+}
+
+// ── CustomRpc event handlers (run on the esp-hosted RPC RX thread) ──────────
+// Keep them short and non-blocking. In particular they MUST NOT call back into
+// any esp_now_* shim function: that would try to take g_req_mutex / wait on the
+// RX thread that delivers the response, and deadlock.
+
+void on_resp(uint32_t /*msg_id*/, const uint8_t *data, size_t len, void * /*ctx*/) {
+  if (len < sizeof(esp_now_hosted_resp_t)) {
+    ESP_LOGW(TAG, "RESP too short: %u bytes", static_cast<unsigned>(len));
+    return;
+  }
+  const auto *r = reinterpret_cast<const esp_now_hosted_resp_t *>(data);
+  if (r->seq != g_expect_seq) {  // late response from a timed-out request (expected)
+    ESP_LOGV(TAG, "dropping stale RESP seq %u (want %u)", r->seq, g_expect_seq);
+    return;
+  }
+  g_resp_status = r->status;
+  uint16_t rl = r->ret_len;
+  if (rl > sizeof(g_resp_ret)) {
+    // Larger than any real opcode return — a likely wire-format drift signal.
+    ESP_LOGW(TAG, "RESP ret_len %u exceeds buffer, clamping (wire drift?)", rl);
+    rl = sizeof(g_resp_ret);
+  }
+  if (len >= sizeof(esp_now_hosted_resp_t) + rl) {
+    memcpy(g_resp_ret, r->ret, rl);
+  } else {
+    // Truncated frame: fail closed. Never hand the caller stale bytes left in
+    // g_resp_ret by a previous response, and don't let request() report a
+    // zeroed payload as success — override the status to an error.
+    ESP_LOGW(TAG, "RESP truncated: claims %u ret bytes, frame too short", rl);
+    rl = 0;
+    g_resp_status = ESP_ERR_INVALID_RESPONSE;
+  }
+  g_resp_ret_len = rl;
+  xSemaphoreGive(g_resp_sem);
+}
+
+void on_recv(uint32_t /*msg_id*/, const uint8_t *data, size_t len, void * /*ctx*/) {
+  // Read the volatile pointer once: esp_now_unregister_recv_cb()/deinit() (via
+  // the espnow component's disable()) can null it on the main loop between the
+  // guard and the call, which would otherwise turn the call into a null-deref.
+  const esp_now_recv_cb_t cb = g_recv_cb;
+  if (cb == nullptr)
+    return;
+  if (len < sizeof(esp_now_hosted_recv_evt_t)) {
+    ESP_LOGW(TAG, "RECV too short: %u bytes", static_cast<unsigned>(len));
+    return;
+  }
+  const auto *e = reinterpret_cast<const esp_now_hosted_recv_evt_t *>(data);
+  if (len < sizeof(esp_now_hosted_recv_evt_t) + e->data_len) {
+    ESP_LOGW(TAG, "RECV data_len %u exceeds frame", e->data_len);
+    return;
+  }
+
+  // ESPHome dereferences info->rx_ctrl->{rssi,timestamp}; give it a real one.
+  wifi_pkt_rx_ctrl_t rx_ctrl;
+  memset(&rx_ctrl, 0, sizeof(rx_ctrl));
+  rx_ctrl.rssi = e->rssi;
+  rx_ctrl.channel = e->channel;
+  rx_ctrl.timestamp = static_cast<uint32_t>(esp_timer_get_time());
+
+  esp_now_recv_info_t info;
+  info.src_addr = const_cast<uint8_t *>(e->src_addr);
+  info.des_addr = const_cast<uint8_t *>(e->des_addr);
+  info.rx_ctrl = &rx_ctrl;
+  cb(&info, e->data, static_cast<int>(e->data_len));
+}
+
+void on_send(uint32_t /*msg_id*/, const uint8_t *data, size_t len, void * /*ctx*/) {
+  // Read the volatile pointer once (see on_recv): disable()/deinit() can null it
+  // on the main loop concurrently with this RX-thread callback.
+  const esp_now_send_cb_t cb = g_send_cb;
+  if (cb == nullptr)
+    return;
+  if (len < sizeof(esp_now_hosted_send_evt_t)) {
+    ESP_LOGW(TAG, "SEND evt too short: %u bytes", static_cast<unsigned>(len));
+    return;
+  }
+  const auto *e = reinterpret_cast<const esp_now_hosted_send_evt_t *>(data);
+#if ESP_IDF_VERSION >= ESP_IDF_VERSION_VAL(5, 5, 0)
+  // IDF >= 5.5: esp_now_send_cb_t takes esp_now_send_info_t (== wifi_tx_info_t),
+  // whose des_addr is a POINTER (not an inline array). Point it at the event's
+  // MAC (valid for this callback) — do NOT memcpy into it (that writes NULL and
+  // faults). ESPHome reads only info->des_addr.
+  esp_now_send_info_t si;
+  memset(&si, 0, sizeof(si));
+  si.des_addr = const_cast<uint8_t *>(e->des_addr);
+  cb(&si, static_cast<esp_now_send_status_t>(e->status));
+#else
+  cb(e->des_addr, static_cast<esp_now_send_status_t>(e->status));
+#endif
+}
+
+esp_err_t ensure_setup() {
+  // Gate on g_setup_done, not on g_req_mutex: a failure part-way through (a
+  // semaphore that did not allocate, a callback that did not register) must not
+  // leave a later call thinking setup completed. Semaphore creation is guarded
+  // so a retry after a partial failure does not leak the earlier handles.
+  if (g_setup_done)
+    return ESP_OK;
+  if (g_req_mutex == nullptr)
+    g_req_mutex = xSemaphoreCreateMutex();
+  if (g_resp_sem == nullptr)
+    g_resp_sem = xSemaphoreCreateBinary();
+  if (g_req_mutex == nullptr || g_resp_sem == nullptr)
+    return ESP_ERR_NO_MEM;
+  esp_err_t err;
+  if ((err = esp_hosted_register_custom_callback(ESP_NOW_HOSTED_MSG_RESP, on_resp, nullptr)) != ESP_OK)
+    return err;
+  if ((err = esp_hosted_register_custom_callback(ESP_NOW_HOSTED_MSG_RECV, on_recv, nullptr)) != ESP_OK)
+    return err;
+  if ((err = esp_hosted_register_custom_callback(ESP_NOW_HOSTED_MSG_SEND, on_send, nullptr)) != ESP_OK)
+    return err;
+  g_setup_done = true;
+  return ESP_OK;
+}
+
+// Send one request envelope. With wait=true (default) block until the matching
+// response (or timeout); with wait=false return as soon as the frame is handed
+// to the transport (fire-and-forget, used by esp_now_send).
+//
+// `tail` is an optional second chunk written straight after `payload`. Callers
+// with a fixed header plus a bulk body (esp_now_send) pass the two separately
+// so they never need a build buffer of their own: both chunks are laid into the
+// request buffer here, under g_req_mutex, which keeps concurrent callers from
+// racing and saves a full copy of the body on every transmit.
+esp_err_t request(uint8_t opcode, const void *payload, uint16_t plen, void *ret, uint16_t ret_cap, uint16_t *ret_len,
+                  bool wait = true, const void *tail = nullptr, uint16_t tail_len = 0) {
+  esp_err_t err = ensure_setup();
+  if (err != ESP_OK)
+    return err;
+  if (plen > ESP_NOW_HOSTED_MAX_PAYLOAD || tail_len > ESP_NOW_HOSTED_MAX_PAYLOAD - plen)
+    return ESP_ERR_INVALID_SIZE;
+  const uint16_t total_len = static_cast<uint16_t>(plen + tail_len);
+
+  if (xSemaphoreTake(g_req_mutex, portMAX_DELAY) != pdTRUE)
+    return ESP_FAIL;
+
+  static uint8_t buf[sizeof(esp_now_hosted_req_t) + ESP_NOW_HOSTED_MAX_PAYLOAD];  // guarded by g_req_mutex
+  auto *req = reinterpret_cast<esp_now_hosted_req_t *>(buf);
+  req->opcode = opcode;
+  req->seq = ++g_seq;
+  req->payload_len = total_len;
+  if (plen != 0)
+    memcpy(req->payload, payload, plen);
+  if (tail_len != 0)
+    memcpy(req->payload + plen, tail, tail_len);
+  g_expect_seq = req->seq;
+
+  xSemaphoreTake(g_resp_sem, 0);  // drain any stale signal before sending
+  err = esp_hosted_send_custom_data(ESP_NOW_HOSTED_MSG_REQ, buf, sizeof(esp_now_hosted_req_t) + total_len);
+  if (err != ESP_OK) {
+    xSemaphoreGive(g_req_mutex);
+    return err;
+  }
+  if (!wait) {
+    // Fire-and-forget (esp_now_send): the co-processor enqueues the frame and
+    // reports the real TX result later via the async SEND event, exactly like
+    // native esp_now_send. Returning here keeps the main loop off the ~100 ms+
+    // RPC round-trip. The matching RESP is ignored (seq won't match the next
+    // waited request, so on_resp drops it).
+    xSemaphoreGive(g_req_mutex);
+    return ESP_OK;
+  }
+  if (xSemaphoreTake(g_resp_sem, pdMS_TO_TICKS(ESP_NOW_HOSTED_TIMEOUT_MS)) != pdTRUE) {
+    ESP_LOGW(TAG, "opcode %u timed out", opcode);
+    xSemaphoreGive(g_req_mutex);
+    return ESP_ERR_TIMEOUT;
+  }
+
+  const int32_t status = g_resp_status;
+  if (ret != nullptr && ret_cap != 0) {
+    uint16_t n = g_resp_ret_len < ret_cap ? g_resp_ret_len : ret_cap;
+    memcpy(ret, const_cast<const uint8_t *>(g_resp_ret), n);
+    if (ret_len != nullptr)
+      *ret_len = n;
+  }
+  xSemaphoreGive(g_req_mutex);
+  return static_cast<esp_err_t>(status);
+}
+
+}  // namespace
+
+// ── The <esp_now.h> surface, defined for the radio-less host ────────────────
+extern "C" {
+
+esp_err_t esp_now_init(void) { return request(ESP_NOW_HOSTED_OP_INIT, nullptr, 0, nullptr, 0, nullptr); }
+
+esp_err_t esp_now_deinit(void) {
+  g_recv_cb = nullptr;
+  g_send_cb = nullptr;
+  peer_cache_clear();  // the co-processor drops all peers on deinit
+  return request(ESP_NOW_HOSTED_OP_DEINIT, nullptr, 0, nullptr, 0, nullptr);
+}
+
+esp_err_t esp_now_get_version(uint32_t *version) {
+  uint32_t v = 0;
+  uint16_t rl = 0;
+  esp_err_t err = request(ESP_NOW_HOSTED_OP_GET_VERSION, nullptr, 0, &v, sizeof(v), &rl);
+  if (version != nullptr)
+    *version = v;
+  return err;
+}
+
+esp_err_t esp_now_register_recv_cb(esp_now_recv_cb_t cb) {
+  // Only arm the callback once the CustomRpc handlers are actually registered,
+  // so a failed setup leaves g_recv_cb null rather than falsely "registered".
+  esp_err_t err = ensure_setup();
+  if (err != ESP_OK)
+    return err;
+  g_recv_cb = cb;
+  return ESP_OK;
+}
+esp_err_t esp_now_unregister_recv_cb(void) {
+  g_recv_cb = nullptr;
+  return ESP_OK;
+}
+esp_err_t esp_now_register_send_cb(esp_now_send_cb_t cb) {
+  esp_err_t err = ensure_setup();
+  if (err != ESP_OK)
+    return err;
+  g_send_cb = cb;
+  return ESP_OK;
+}
+esp_err_t esp_now_unregister_send_cb(void) {
+  g_send_cb = nullptr;
+  return ESP_OK;
+}
+
+static esp_err_t add_or_mod_peer(uint8_t opcode, const esp_now_peer_info_t *peer, bool wait) {
+  if (peer == nullptr)
+    return ESP_ERR_ESPNOW_ARG;
+  esp_now_hosted_peer_t p;
+  memset(&p, 0, sizeof(p));
+  memcpy(p.peer_addr, peer->peer_addr, 6);
+  memcpy(p.lmk, peer->lmk, 16);
+  p.channel = peer->channel;
+  p.ifidx = static_cast<uint8_t>(peer->ifidx);
+  p.encrypt = peer->encrypt ? 1 : 0;
+  return request(opcode, &p, sizeof(p), nullptr, 0, nullptr, wait);
+}
+esp_err_t esp_now_add_peer(const esp_now_peer_info_t *peer) {
+  // Fire-and-forget (wait=false): adding a peer is a blocking RPC round-trip,
+  // and ESPHome's espnow calls it on the main loop when a device joins the mesh
+  // — under co-processor load that stalls the UI (peer-churn stutter). Issue it
+  // without waiting and mirror it locally. Safe against a following
+  // esp_now_send to the same peer: both ride the same in-order CustomRpc
+  // channel (mutex-serialized on the host) and the co-processor processes REQs
+  // FIFO, so ADD_PEER is applied before the SEND. Trade-off: a co-processor-side
+  // failure (e.g. peer table full) is no longer reported synchronously — the
+  // same limitation as esp_now_send — but ESPHome only adds peers it validated.
+  esp_err_t err = add_or_mod_peer(ESP_NOW_HOSTED_OP_ADD_PEER, peer, /*wait=*/false);
+  if (err == ESP_OK)
+    peer_cache_add(peer->peer_addr);  // keep the local mirror in sync
+  return err;
+}
+esp_err_t esp_now_mod_peer(const esp_now_peer_info_t *peer) {
+  // mod_peer changes a peer's parameters, not its existence, so the cache is
+  // unaffected. Kept synchronous — it is not on any hot path (espnow never
+  // calls it), so the extra round-trip does not matter and the status is useful.
+  return add_or_mod_peer(ESP_NOW_HOSTED_OP_MOD_PEER, peer, /*wait=*/true);
+}
+
+esp_err_t esp_now_del_peer(const uint8_t *peer_addr) {
+  if (peer_addr == nullptr)
+    return ESP_ERR_ESPNOW_ARG;
+  // Fire-and-forget for the same reason as add_peer (peer churn on the main
+  // loop). Removal is order-independent, so this is strictly safe.
+  esp_err_t err = request(ESP_NOW_HOSTED_OP_DEL_PEER, peer_addr, 6, nullptr, 0, nullptr, /*wait=*/false);
+  if (err == ESP_OK)
+    peer_cache_remove(peer_addr);  // keep the local mirror in sync
+  return err;
+}
+
+bool esp_now_is_peer_exist(const uint8_t *peer_addr) {
+  if (peer_addr == nullptr)
+    return false;
+  // Answered from the local mirror — no RPC round-trip. ESPHome's espnow calls
+  // this on the main loop for every received frame and every send, so a
+  // blocking round-trip here would stall rendering under mesh traffic.
+  return peer_cache_contains(peer_addr);
+}
+
+esp_err_t esp_now_send(const uint8_t *peer_addr, const uint8_t *data, size_t len) {
+  if (len > ESP_NOW_HOSTED_MAX_FRAME)
+    return ESP_ERR_ESPNOW_ARG;
+  if (data == nullptr && len != 0)  // native esp_now_send treats this as an arg error
+    return ESP_ERR_ESPNOW_ARG;
+  // Only the small fixed header is built here; the caller's frame goes over as
+  // the request tail, so request() lays both into its own buffer under
+  // g_req_mutex. esp_now_send is a public C symbol and may be called from any
+  // task, and a shared build buffer here would let two callers corrupt each
+  // other's frame. Passing the body through also drops a full-frame copy per
+  // transmit, on the path this shim exists to keep quick.
+  uint8_t hdr[sizeof(esp_now_hosted_send_req_t)];
+  auto *s = reinterpret_cast<esp_now_hosted_send_req_t *>(hdr);
+  s->has_addr = peer_addr != nullptr ? 1 : 0;
+  if (peer_addr != nullptr)
+    memcpy(s->peer_addr, peer_addr, 6);
+  else
+    memset(s->peer_addr, 0, 6);
+  s->data_len = static_cast<uint16_t>(len);
+  // Fire-and-forget (wait=false): native esp_now_send returns once the frame is
+  // queued, with the real TX result delivered later through the send callback.
+  // The co-processor mirrors that — it acks enqueue immediately and reports the
+  // outcome via the async SEND event (on_send -> on_send_report). Waiting for
+  // the RPC RESP here would block the main loop for the full round-trip on
+  // every transmit.
+  return request(ESP_NOW_HOSTED_OP_SEND, hdr, sizeof(hdr), nullptr, 0, nullptr, /*wait=*/false, data,
+                 static_cast<uint16_t>(len));
+}
+
+esp_err_t esp_now_set_pmk(const uint8_t *pmk) {
+  if (pmk == nullptr)
+    return ESP_ERR_ESPNOW_ARG;
+  return request(ESP_NOW_HOSTED_OP_SET_PMK, pmk, 16, nullptr, 0, nullptr);
+}
+
+// Remainder of the <esp_now.h> surface. Not used by ESPHome's espnow component
+// today; provided so the whole header links and future callers get a defined
+// (if unimplemented) symbol rather than a link error. Wire them through
+// CustomRpc if a use case appears.
+esp_err_t esp_now_get_peer(const uint8_t * /*peer_addr*/, esp_now_peer_info_t * /*peer*/) {
+  return ESP_ERR_NOT_SUPPORTED;
+}
+esp_err_t esp_now_fetch_peer(bool /*from_head*/, esp_now_peer_info_t * /*peer*/) { return ESP_ERR_NOT_SUPPORTED; }
+esp_err_t esp_now_get_peer_num(esp_now_peer_num_t * /*num*/) { return ESP_ERR_NOT_SUPPORTED; }
+esp_err_t esp_now_set_wake_window(uint16_t /*window*/) {
+  return ESP_ERR_NOT_SUPPORTED;  // power-save wake window is not forwarded; don't claim success
+}
+esp_err_t esp_now_set_peer_rate_config(const uint8_t * /*peer_addr*/, esp_now_rate_config_t * /*cfg*/) {
+  return ESP_ERR_NOT_SUPPORTED;
+}
+esp_err_t esp_wifi_config_espnow_rate(wifi_interface_t /*ifx*/, wifi_phy_rate_t /*rate*/) {
+  return ESP_ERR_NOT_SUPPORTED;
+}
+
+}  // extern "C"
+
+#endif  // CONFIG_IDF_TARGET_ESP32P4

esphome/components/esp32_hosted/esp_now_hosted_rpc.h

@@ -0,0 +1,128 @@
+/*
+ * esp_now_hosted — ESP-NOW-over-CustomRpc wire protocol.
+ *
+ * Shared, byte-for-byte-identical contract between:
+ *   - the host shim         (esphome/components/esp32_hosted/esp_now_hosted.cpp)
+ *   - the coprocessor firmware (esphome/esp-hosted-firmware)
+ *
+ * It rides esp-hosted's CustomRpc channel (RPC ID 388, "peer data transfer",
+ * available since esp-hosted v2.8.1), teaching the radio-less host <-> radio
+ * co-processor link to carry esp_now.h, which esp-hosted itself does not proxy
+ * (Espressif issue espressif/esp-hosted-mcu#19).
+ *
+ * KEEP THE TWO COPIES IN SYNC. The canonical copy lives here; the coprocessor
+ * firmware uses a verbatim copy. Both sides are little-endian, so these packed
+ * structs are wire-compatible with no byte-swapping.
+ */
+
+#ifndef ESP_NOW_HOSTED_RPC_H
+#define ESP_NOW_HOSTED_RPC_H
+
+#ifdef __cplusplus
+#include <cstdint>
+#else
+#include <stdint.h>
+#endif
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/* ── CustomRpc message IDs (any uint32_t except 0xFFFFFFFF) ──────────────────
+ * One REQ handler slot on the device; three event handler slots on the host.
+ * The bytes spell "now" + index, a private range unlikely to clash with other
+ * CustomRpc users (e.g. the stock peer_data_transfer example's 1..6).         */
+#define ESP_NOW_HOSTED_MSG_REQ 0x6E6F7701u  /* host   -> device : request envelope */
+#define ESP_NOW_HOSTED_MSG_RESP 0x6E6F7702u /* device -> host   : reply to a REQ   */
+#define ESP_NOW_HOSTED_MSG_RECV 0x6E6F7703u /* device -> host   : async RX frame   */
+#define ESP_NOW_HOSTED_MSG_SEND 0x6E6F7704u /* device -> host   : async TX status  */
+
+/* ── Request opcodes ────────────────────────────────────────────────────── */
+enum {
+  ESP_NOW_HOSTED_OP_INIT = 1,          /* esp_now_init + register device recv/send cbs */
+  ESP_NOW_HOSTED_OP_DEINIT = 2,        /* unregister cbs + esp_now_deinit             */
+  ESP_NOW_HOSTED_OP_ADD_PEER = 3,      /* payload: esp_now_hosted_peer_t              */
+  ESP_NOW_HOSTED_OP_DEL_PEER = 4,      /* payload: 6-byte peer MAC                    */
+  ESP_NOW_HOSTED_OP_IS_PEER_EXIST = 5, /* payload: 6-byte MAC; ret: 1 byte bool       */
+  ESP_NOW_HOSTED_OP_SEND = 6,          /* payload: esp_now_hosted_send_req_t          */
+  ESP_NOW_HOSTED_OP_GET_VERSION = 7,   /* ret: uint32 version                        */
+  ESP_NOW_HOSTED_OP_SET_PMK = 8,       /* payload: 16-byte PMK                        */
+  ESP_NOW_HOSTED_OP_MOD_PEER = 9,      /* payload: esp_now_hosted_peer_t              */
+};
+
+/* Largest ESP-NOW payload we forward. ESP-NOW v2 (IDF >= 5.4) is 1470 B; well
+ * under esp-hosted's 8166 B CustomRpc cap, so the shim never truncates.        */
+#define ESP_NOW_HOSTED_MAX_FRAME 1470u
+/* Envelope slack for the largest opcode payload (a SEND req wrapping a frame). */
+#define ESP_NOW_HOSTED_MAX_PAYLOAD (ESP_NOW_HOSTED_MAX_FRAME + 16u)
+/* Host request/response round-trip timeout over the transport. Generous:
+ * normal RTT is sub-millisecond, but Wi-Fi/BLE contention on the co-processor
+ * can stall the RX thread.                                                     */
+#define ESP_NOW_HOSTED_TIMEOUT_MS 2000
+
+/* ── Envelopes ──────────────────────────────────────────────────────────── */
+
+/* These payloads are shared verbatim with the C co-processor firmware, so they
+ * use C's `typedef struct {...} name;` idiom rather than C++ `using` aliases,
+ * which would not compile there. Silence clang-tidy's modernize-use-using for
+ * the shared struct block. */
+// NOLINTBEGIN(modernize-use-using)
+typedef struct {
+  uint8_t opcode;       /* one of ESP_NOW_HOSTED_OP_*                        */
+  uint8_t seq;          /* wraps 0..255; echoed in the response for matching */
+  uint16_t payload_len; /* bytes of opcode-specific payload that follow      */
+  uint8_t payload[];    /* flexible                                          */
+} __attribute__((packed)) esp_now_hosted_req_t;
+
+typedef struct {
+  uint8_t opcode;   /* echoes the request opcode                         */
+  uint8_t seq;      /* echoes the request seq                            */
+  int32_t status;   /* esp_err_t from the native call on the co-processor */
+  uint16_t ret_len; /* bytes of return payload that follow               */
+  uint8_t ret[];    /* flexible (e.g. version u32, is_peer_exist bool)   */
+} __attribute__((packed)) esp_now_hosted_resp_t;
+
+/* ── Opcode payloads ────────────────────────────────────────────────────── */
+
+/* esp_now_peer_info_t minus the host-only `priv` pointer, which is meaningless
+ * across the transport and never set by ESPHome's espnow component.           */
+typedef struct {
+  uint8_t peer_addr[6];
+  uint8_t lmk[16];
+  uint8_t channel; /* 0 = current channel                              */
+  uint8_t ifidx;   /* wifi_interface_t (0=STA, 1=AP)                    */
+  uint8_t encrypt; /* bool                                             */
+} __attribute__((packed)) esp_now_hosted_peer_t;
+
+typedef struct {
+  uint8_t has_addr; /* 0 => peer_addr is NULL (broadcast to all peers)   */
+  uint8_t peer_addr[6];
+  uint16_t data_len;
+  uint8_t data[]; /* flexible, up to ESP_NOW_HOSTED_MAX_FRAME          */
+} __attribute__((packed)) esp_now_hosted_send_req_t;
+
+/* ── Async events (device -> host) ──────────────────────────────────────── */
+
+/* Reconstructed on the host into an esp_now_recv_info_t + a minimal
+ * wifi_pkt_rx_ctrl_t. ESPHome's espnow reads info->src_addr, info->des_addr,
+ * info->rx_ctrl->rssi and info->rx_ctrl->timestamp.                           */
+typedef struct {
+  uint8_t src_addr[6];
+  uint8_t des_addr[6];
+  int8_t rssi;
+  uint8_t channel;
+  uint16_t data_len;
+  uint8_t data[]; /* flexible                                          */
+} __attribute__((packed)) esp_now_hosted_recv_evt_t;
+
+typedef struct {
+  uint8_t des_addr[6];
+  uint8_t status; /* esp_now_send_status_t (0 = success)               */
+} __attribute__((packed)) esp_now_hosted_send_evt_t;
+// NOLINTEND(modernize-use-using)
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* ESP_NOW_HOSTED_RPC_H */

esphome/components/esp32_improv/esp32_improv_component.cpp

@@ -112,6 +112,7 @@ void ESP32ImprovComponent::loop() {
       this->state_callback_.call(this->state_, this->error_state_);
 #endif
     }
+    this->release_advertising_();
     this->incoming_data_.clear();
     return;
   }
@@ -143,8 +144,9 @@ void ESP32ImprovComponent::loop() {
           ESP_LOGV(TAG, "Starting with device name advertising");
           this->advertising_device_name_ = true;
           this->last_name_adv_time_ = App.get_loop_component_start_time();
+          // Set the payload before requesting, so advertising starts exactly once
           esp32_ble::global_ble->advertising_set_service_data_and_name(std::span<const uint8_t>{}, true);
-          esp32_ble::global_ble->advertising_start();
+          this->request_advertising_();
 
           // Set initial state based on whether we have an authorizer
           this->set_state_(this->get_initial_state_(), false);
@@ -326,6 +328,8 @@ void ESP32ImprovComponent::stop() {
   this->set_timeout("end-service", STOP_ADVERTISING_DELAY, [this] {
     if (this->state_ == improv::STATE_STOPPED || this->service_ == nullptr)
       return;
+    // Release first so removing the service UUID does not restart advertising on the way out
+    this->release_advertising_();
     this->service_->stop();
     this->set_state_(improv::STATE_STOPPED);
   });
@@ -520,6 +524,20 @@ void ESP32ImprovComponent::update_advertising_type_() {
   }
 }
 
+void ESP32ImprovComponent::request_advertising_() {
+  if (this->advertising_requested_)
+    return;
+  this->advertising_requested_ = true;
+  esp32_ble::global_ble->advertising_start();
+}
+
+void ESP32ImprovComponent::release_advertising_() {
+  if (!this->advertising_requested_)
+    return;
+  this->advertising_requested_ = false;
+  esp32_ble::global_ble->advertising_stop();
+}
+
 improv::State ESP32ImprovComponent::get_initial_state_() const {
 #ifdef USE_BINARY_SENSOR
   // If we have an authorizer, start in awaiting authorization state

esphome/components/esp32_improv/esp32_improv_component.h

@@ -104,8 +104,11 @@ class ESP32ImprovComponent final : public Component, public improv_base::ImprovB
   bool status_indicator_state_{false};
   uint32_t last_name_adv_time_{0};
   bool advertising_device_name_{false};
+  bool advertising_requested_{false};
   void set_status_indicator_state_(bool state);
   void update_advertising_type_();
+  void request_advertising_();
+  void release_advertising_();
 
   void set_state_(improv::State state, bool update_advertising = true);
   void set_error_(improv::Error error);

esphome/components/esphome/ota/__init__.py

@@ -2,12 +2,12 @@ import logging
 
 import esphome.codegen as cg
 from esphome.components.noise import (
-    decode_encryption_key,
     encryption_schema,
-    is_reserved_key,
+    new_psk_progmem,
+    static_encryption_key,
 )
 from esphome.components.ota import BASE_OTA_SCHEMA, OTAComponent, ota_to_code
-from esphome.config_helpers import merge_config
+from esphome.config_helpers import filter_source_files_from_defines, merge_config
 import esphome.config_validation as cv
 from esphome.const import (
     CONF_API,
@@ -31,7 +31,6 @@ import esphome.final_validate as fv
 from esphome.types import ConfigType
 
 CONF_ALLOW_PARTITION_ACCESS = "allow_partition_access"
-CONF_CAPTIVE_PORTAL = "captive_portal"
 
 _LOGGER = logging.getLogger(__name__)
 
@@ -41,11 +40,10 @@ DEPENDENCIES = ["network"]
 
 
 def AUTO_LOAD(config: ConfigType) -> list[str]:
-    """Auto-load noise only when encryption is configured."""
+    """Auto-load noise only when encryption is configured; the api key offer
+    inherits it from the api component."""
     base = ["sha256", "socket"]
-    # A falsy config is a tooling probe for the maximal set (None from
-    # dependency resolution, {} from the components-graph platform probe);
-    # a validated config always carries defaults, never empty
+    # A falsy config is a tooling probe for the maximal set
     if not config or CONF_ENCRYPTION in config:
         return base + ["noise"]
     return base
@@ -132,12 +130,56 @@ def ota_esphome_final_validate(config: ConfigType) -> None:
         _validate_no_password_with_encryption(ota_conf)
         if (encryption_conf := ota_conf.get(CONF_ENCRYPTION)) is not None:
             _resolve_encryption_key(encryption_conf, api_conf)
-    if any(
-        conf.get(CONF_PLATFORM) == CONF_WEB_SERVER for conf in full_ota_conf
-    ) and any(
-        CONF_ENCRYPTION in conf for conf in merged_ota_esphome_configs_by_port.values()
+        elif CONF_PASSWORD in ota_conf and static_encryption_key(api_conf) is not None:
+            _LOGGER.warning(
+                "'%s' %s wastes significant flash and RAM (about 3.5 KB and 60 "
+                "bytes plus the password on the heap): the device already offers "
+                "encryption with the '%s' %s %s, which authenticates any uploader "
+                "that takes it, and a password only matters for uploaders without "
+                "encryption support; remove '%s' and add '%s' under '%s' so "
+                "uploads use the key and encryption is required",
+                CONF_OTA,
+                CONF_PASSWORD,
+                CONF_API,
+                CONF_ENCRYPTION,
+                CONF_KEY,
+                CONF_PASSWORD,
+                CONF_ENCRYPTION,
+                CONF_OTA,
+            )
+        elif (
+            CONF_PASSWORD in ota_conf
+            and CONF_ENCRYPTION in api_conf
+            and not api_conf[CONF_ENCRYPTION].get(CONF_KEY)
+        ):
+            # The CLI still needs the password; whoever provisions the key skips it
+            _LOGGER.warning(
+                "The '%s' %s %s provisioned at runtime also authenticates OTA "
+                "uploads once provisioned; '%s' %s then only guards plaintext "
+                "uploads. Whoever provisions the key can upload firmware "
+                "without the password, so add a 'provisioning:' block to limit "
+                "when that is possible",
+                CONF_API,
+                CONF_ENCRYPTION,
+                CONF_KEY,
+                CONF_OTA,
+                CONF_PASSWORD,
+            )
+    # web_server and prometheus keep the shared listener up; the captive
+    # portal's copy only exists on the fallback AP and is the recovery path
+    if (
+        (CONF_WEB_SERVER in full_conf or "prometheus" in full_conf)
+        and any(conf.get(CONF_PLATFORM) == CONF_WEB_SERVER for conf in full_ota_conf)
+        and any(
+            CONF_ENCRYPTION in conf
+            for conf in merged_ota_esphome_configs_by_port.values()
+        )
     ):
-        _warn_web_server_ota(full_conf)
+        _LOGGER.warning(
+            "OTA encryption does not cover the %s OTA platform; its "
+            "plaintext /update endpoint accepts the same image",
+            CONF_WEB_SERVER,
+        )
 
     full_conf[CONF_OTA] = new_ota_conf
     fv.full_config.set(full_conf)
@@ -152,33 +194,11 @@ def ota_esphome_final_validate(config: ConfigType) -> None:
         )
 
 
-def _warn_web_server_ota(full_conf: ConfigType) -> None:
-    """The web_server ota platform accepts the same image over plaintext HTTP
-    with basic auth, bypassing the encryption; warn rather than fail so the
-    operator keeps the recovery path."""
-    if CONF_CAPTIVE_PORTAL in full_conf and CONF_WEB_SERVER not in full_conf:
-        # The captive_portal auto-load: the endpoint only exists while the
-        # fallback AP is active
-        _LOGGER.warning(
-            "OTA encryption does not cover the %s OTA platform (auto-loaded "
-            "by captive_portal); the plaintext /update endpoint stays "
-            "reachable while the fallback AP is active",
-            CONF_WEB_SERVER,
-        )
-    else:
-        _LOGGER.warning(
-            "OTA encryption does not cover the %s OTA platform; its "
-            "plaintext /update endpoint accepts the same image",
-            CONF_WEB_SERVER,
-        )
-
-
 def _resolve_encryption_key(encryption_conf: ConfigType, api_conf: ConfigType) -> None:
     """Resolve the one encryption key per device into the ota block.
 
     An explicit ota key must match the api key, a bare block inherits it,
-    a runtime provisioned api key cannot be inherited, and the all-zeros
-    provisioning sentinel is rejected (the device treats it as no key).
+    a runtime provisioned api key cannot be inherited.
     """
     api_key = api_conf.get(CONF_ENCRYPTION, {}).get(CONF_KEY)
     if ota_key := encryption_conf.get(CONF_KEY):
@@ -201,11 +221,6 @@ def _resolve_encryption_key(encryption_conf: ConfigType, api_conf: ConfigType) -
         )
     else:
         encryption_conf[CONF_KEY] = api_key
-    if is_reserved_key(encryption_conf[CONF_KEY]):
-        raise cv.Invalid(
-            f"The all-zeros {CONF_KEY} is reserved and provides no protection; "
-            f"generate a real key with: openssl rand -base64 32"
-        )
 
 
 # Also called on merged same-port configs in final validate, where schemas
@@ -267,15 +282,9 @@ CONFIG_SCHEMA = cv.All(
 FINAL_VALIDATE_SCHEMA = ota_esphome_final_validate
 
 
-def FILTER_SOURCE_FILES() -> list[str]:
-    """Filter out the noise transport when no ota entry configures encryption."""
-    for ota_conf in CORE.config.get(CONF_OTA, []):
-        if (
-            ota_conf.get(CONF_PLATFORM) == CONF_ESPHOME
-            and ota_conf.get(CONF_ENCRYPTION) is not None
-        ):
-            return []
-    return ["ota_esphome_noise.cpp"]
+FILTER_SOURCE_FILES = filter_source_files_from_defines(
+    {"ota_esphome_noise.cpp": "USE_OTA_ENCRYPTION"}
+)
 
 
 @coroutine_with_priority(CoroPriority.OTA_UPDATES)
@@ -296,11 +305,24 @@ async def to_code(config: ConfigType) -> None:
     if config.get(CONF_ALLOW_PARTITION_ACCESS):
         cg.add_define("USE_OTA_PARTITIONS")
 
-    if (encryption_conf := config.get(CONF_ENCRYPTION)) is not None:
-        # A missing key was resolved from the api component in final validate.
-        key = encryption_conf[CONF_KEY]
+    # One key per device: an api encryption block supplies it (static or
+    # runtime) and offers; the ota block only adds the requirement
+    api_conf = CORE.config.get(CONF_API) or {}
+    encryption_conf = config.get(CONF_ENCRYPTION)
+    own_key = None
+    if encryption_conf is not None and static_encryption_key(api_conf) is None:
+        own_key = encryption_conf[CONF_KEY]
+    if own_key is not None:
         cg.add_define("USE_OTA_ENCRYPTION")
-        cg.add(var.set_noise_psk(list(decode_encryption_key(key))))
+        cg.add(var.set_noise_psk(new_psk_progmem(config[CONF_ID], own_key)))
+    elif CONF_ENCRYPTION in api_conf:
+        cg.add_define("USE_OTA_ENCRYPTION")
+        cg.add_define("USE_OTA_ENCRYPTION_FROM_API")
+        if static_encryption_key(api_conf) is None:
+            # The key arrives at runtime, so the offer has to look for it
+            cg.add_define("USE_OTA_ENCRYPTION_PROVISIONED")
+    if encryption_conf is not None:
+        cg.add_define("USE_OTA_ENCRYPTION_REQUIRED")
 
     # Build flag so lwip_fast_select.c (a .c file that can't include defines.h) sees it.
     cg.add_build_flag("-DUSE_OTA_PLATFORM_ESPHOME")

esphome/components/esphome/ota/ota_esphome.cpp

@@ -1,4 +1,7 @@
 #include "ota_esphome.h"
+#ifdef USE_OTA_ENCRYPTION_FROM_API
+#include "esphome/components/api/api_server.h"
+#endif
 #ifdef USE_OTA
 #ifdef USE_OTA_PASSWORD
 #include "esphome/components/sha256/sha256.h"
@@ -26,6 +29,16 @@
 namespace esphome {
 
 static const char *const TAG = "esphome.ota";
+
+#ifdef USE_OTA_ENCRYPTION
+const noise::NoiseContext &ESPHomeOTAComponent::noise_context_() const {
+#ifdef USE_OTA_ENCRYPTION_FROM_API
+  return api::global_api_server->get_noise_ctx();
+#else
+  return this->noise_ctx_;
+#endif
+}
+#endif
 static constexpr uint16_t OTA_BLOCK_SIZE = 8192;
 static constexpr uint32_t OTA_SOCKET_TIMEOUT_HANDSHAKE = 20000;  // milliseconds for initial handshake
 static constexpr uint32_t OTA_SOCKET_TIMEOUT_DATA = 90000;       // milliseconds for data transfer
@@ -97,18 +110,30 @@ void ESPHomeOTAComponent::dump_config() {
   ESP_LOGCONFIG(TAG,
                 "Over-The-Air updates:\n"
                 "  Address: %s:%u\n"
-                "  Version: %d",
-                network::get_use_address_to(addr_buf), this->port_, USE_OTA_VERSION);
+                "  Version: %d"
+#ifdef USE_OTA_ENCRYPTION
+                "\n  Encryption: %s"
+#endif
+                ,
+                network::get_use_address_to(addr_buf), this->port_, USE_OTA_VERSION
+#ifdef USE_OTA_ENCRYPTION_REQUIRED
+                ,
+                LOG_STR_LITERAL("required")
+#elif defined(USE_OTA_ENCRYPTION_PROVISIONED)
+                // A runtime provisioned key may not exist yet
+                ,
+                this->noise_context_().has_psk() ? LOG_STR_LITERAL("offered, plaintext accepted")
+                                                 : LOG_STR_LITERAL("offered once the api key is provisioned")
+#elif defined(USE_OTA_ENCRYPTION)
+                ,
+                LOG_STR_LITERAL("offered, plaintext accepted")
+#endif
+  );
 #ifdef USE_OTA_PASSWORD
   if (!this->password_.empty()) {
     ESP_LOGCONFIG(TAG, "  Password configured");
   }
 #endif
-#ifdef USE_OTA_ENCRYPTION
-  if (this->noise_ctx_.has_psk()) {
-    ESP_LOGCONFIG(TAG, "  Encryption configured");
-  }
-#endif
 #ifdef USE_OTA_PARTITIONS
   ESP_LOGCONFIG(TAG,
                 "  Partition access allowed\n"
@@ -154,10 +179,22 @@ static constexpr uint8_t CLIENT_FEATURE_SUPPORTS_COMPRESSION = 0x01;
 static constexpr uint8_t CLIENT_FEATURE_SUPPORTS_SHA256_AUTH = 0x02;
 static constexpr uint8_t CLIENT_FEATURE_SUPPORTS_EXTENDED_PROTOCOL = 0x04;
 static constexpr uint8_t CLIENT_FEATURE_SUPPORTS_NOISE = 0x08;
+// Noise needs the extended protocol: the prologue binds the 2-byte feature ack
+static constexpr uint8_t CLIENT_NOISE_FEATURES =
+    CLIENT_FEATURE_SUPPORTS_NOISE | CLIENT_FEATURE_SUPPORTS_EXTENDED_PROTOCOL;
 static constexpr uint8_t SERVER_FEATURE_SUPPORTS_COMPRESSION = 0x01;
 static constexpr uint8_t SERVER_FEATURE_SUPPORTS_PARTITION_ACCESS = 0x02;
 static constexpr uint8_t SERVER_FEATURE_SUPPORTS_NOISE = 0x04;
 
+inline bool ESPHomeOTAComponent::extended_proto_() const {
+#ifdef USE_OTA_ENCRYPTION_REQUIRED
+  // FEATURE_READ already refused every client without the extended protocol
+  return true;
+#else
+  return (this->ota_features_ & CLIENT_FEATURE_SUPPORTS_EXTENDED_PROTOCOL) != 0;
+#endif
+}
+
 void ESPHomeOTAComponent::handle_handshake_() {
   /// Handle the OTA handshake and authentication.
   ///
@@ -241,12 +278,9 @@ void ESPHomeOTAComponent::handle_handshake_() {
       this->ota_features_ = this->handshake_buf_[0];
       ESP_LOGV(TAG, "Features: 0x%02X", this->ota_features_);
 
-#ifdef USE_OTA_ENCRYPTION
-      // Fail closed: with a PSK configured the client must negotiate encryption
-      // (which requires the extended protocol); refuse plaintext uploads.
-      static constexpr uint8_t NOISE_REQUIRED_FEATURES =
-          CLIENT_FEATURE_SUPPORTS_NOISE | CLIENT_FEATURE_SUPPORTS_EXTENDED_PROTOCOL;
-      if (this->noise_ctx_.has_psk() && (this->ota_features_ & NOISE_REQUIRED_FEATURES) != NOISE_REQUIRED_FEATURES) {
+#ifdef USE_OTA_ENCRYPTION_REQUIRED
+      // `ota: encryption:` requires the client to negotiate encryption
+      if ((this->ota_features_ & CLIENT_NOISE_FEATURES) != CLIENT_NOISE_FEATURES) {
         ESP_LOGW(TAG, "Client does not support encryption");
         this->send_error_and_cleanup_(ota::OTA_RESPONSE_ERROR_ENCRYPTION_REQUIRED);
         return;
@@ -261,18 +295,21 @@ void ESPHomeOTAComponent::handle_handshake_() {
       // Compose the feature-ack response. When the client negotiates the extended protocol we emit
       // a 2-byte response (marker + server feature flags); otherwise we emit the single-byte
       // legacy response.
-      this->extended_proto_ = (this->ota_features_ & CLIENT_FEATURE_SUPPORTS_EXTENDED_PROTOCOL) != 0;
-      if (this->extended_proto_) {
+      if (this->extended_proto_()) {
         static_assert(HANDSHAKE_BUF_SIZE >= 2, "handshake_buf_ must hold the 2-byte extended-protocol feature ack");
         this->handshake_buf_[0] = ota::OTA_RESPONSE_FEATURE_FLAGS;
         this->handshake_buf_[1] = (supports_compression ? SERVER_FEATURE_SUPPORTS_COMPRESSION : 0);
 #ifdef USE_OTA_PARTITIONS
         this->handshake_buf_[1] |= SERVER_FEATURE_SUPPORTS_PARTITION_ACCESS;
 #endif
-#ifdef USE_OTA_ENCRYPTION
-        if (this->noise_ctx_.has_psk()) {
+#ifdef USE_OTA_ENCRYPTION_PROVISIONED
+        // A runtime provisioned key may not exist yet
+        if (this->noise_context_().has_psk()) {
           this->handshake_buf_[1] |= SERVER_FEATURE_SUPPORTS_NOISE;
         }
+#elif defined(USE_OTA_ENCRYPTION)
+        // A yaml key always exists: validation rejects the all-zeros key
+        this->handshake_buf_[1] |= SERVER_FEATURE_SUPPORTS_NOISE;
 #endif
       } else {
         this->handshake_buf_[0] =
@@ -284,15 +321,15 @@ void ESPHomeOTAComponent::handle_handshake_() {
     case OTAState::FEATURE_ACK: {
       static constexpr size_t STANDARD_PROTO_ACK_SIZE = 1;
       static constexpr size_t EXTENDED_PROTO_ACK_SIZE = 2;
-      const size_t ack_size = this->extended_proto_ ? EXTENDED_PROTO_ACK_SIZE : STANDARD_PROTO_ACK_SIZE;
+      const size_t ack_size = this->extended_proto_() ? EXTENDED_PROTO_ACK_SIZE : STANDARD_PROTO_ACK_SIZE;
       if (!this->try_write_(ack_size, LOG_STR("ack feature"))) {
         return;
       }
 #ifdef USE_OTA_ENCRYPTION
-      // With a PSK configured the rest of the session runs inside the noise
-      // transport; the client sends the first handshake frame next, so there
-      // is nothing to do until data arrives.
-      if (this->noise_ctx_.has_psk()) {
+      // Latch the offer actually sent: a key activating between the two
+      // states must not start a session the client never expects
+      if ((this->handshake_buf_[1] & SERVER_FEATURE_SUPPORTS_NOISE) != 0 &&
+          (this->ota_features_ & CLIENT_NOISE_FEATURES) == CLIENT_NOISE_FEATURES) {
         // handshake_buf_ still holds the feature ack composed above; a
         // would-block re-entry lands here without rebuilding it
         if (!this->noise_start_session_(this->handshake_buf_[1])) {
@@ -412,7 +449,7 @@ void ESPHomeOTAComponent::handle_data_() {
   // Acknowledge auth OK - 1 byte
   this->data_write_byte_(ota::OTA_RESPONSE_AUTH_OK);
 
-  if (this->extended_proto_) {
+  if (this->extended_proto_()) {
     // Read ota type, 1 byte
     if (!this->data_readall_(buf, 1)) {
       this->log_read_error_(LOG_STR("OTA type"));

esphome/components/esphome/ota/ota_esphome.h

@@ -44,8 +44,9 @@ class ESPHomeOTAComponent final : public ota::OTAComponent {
   }
 #endif  // USE_OTA_PASSWORD
 
-#ifdef USE_OTA_ENCRYPTION
-  void set_noise_psk(noise::psk_t psk) { this->noise_ctx_.set_psk(psk); }
+#if defined(USE_OTA_ENCRYPTION) && !defined(USE_OTA_ENCRYPTION_FROM_API)
+  /// psk points at 32 bytes that live in flash for the life of the program
+  void set_noise_psk(const uint8_t *psk) { this->noise_ctx_.set_psk(psk); }
 #endif
 
   /// Manually set the port OTA should listen on
@@ -85,9 +86,12 @@ class ESPHomeOTAComponent final : public ota::OTAComponent {
     bool writing{false};    // a produced handshake frame is still being flushed
     uint8_t frame_buf[noise::FRAME_HEADER_SIZE + 1 + noise::MAX_HANDSHAKE_SIZE];
   };
+  // The api server's live context when the api has encryption, else our own
+  const noise::NoiseContext &noise_context_() const;
   bool noise_start_session_(uint8_t server_feature_flags);
   bool handle_noise_handshake_();
   bool noise_try_read_frame_();
+  size_t noise_frame_payload_len_(const uint8_t *header, size_t min_len, size_t max_len);
   bool noise_try_write_frame_();
   void noise_send_reject_(const LogString *reason);
   ssize_t noise_decrypt_(uint8_t *buf, size_t len);
@@ -144,7 +148,9 @@ class ESPHomeOTAComponent final : public ota::OTAComponent {
   std::unique_ptr<uint8_t[]> auth_buf_;
 #endif  // USE_OTA_PASSWORD
 #ifdef USE_OTA_ENCRYPTION
+#ifndef USE_OTA_ENCRYPTION_FROM_API
   noise::NoiseContext noise_ctx_;
+#endif
   std::unique_ptr<NoiseSession> noise_;
 #endif  // USE_OTA_ENCRYPTION
 
@@ -166,6 +172,8 @@ class ESPHomeOTAComponent final : public ota::OTAComponent {
                 "OTA_BUFFER_SIZE must fit a full encrypted data frame");
 #endif
   static constexpr uint8_t MAGIC_BYTES[5] = {0x6C, 0x26, 0xF7, 0x5C, 0x45};
+  // Derived from the feature byte; storing it would pad the trailing bytes
+  bool extended_proto_() const;
 #ifdef USE_OTA_PARTITIONS
   uint32_t running_app_offset_{0};
   size_t running_app_size_{0};
@@ -179,7 +187,6 @@ class ESPHomeOTAComponent final : public ota::OTAComponent {
   uint8_t auth_buf_pos_{0};
   uint8_t auth_type_{0};  // Store auth type to know which hasher to use
 #endif                    // USE_OTA_PASSWORD
-  bool extended_proto_{false};
 };
 
 }  // namespace esphome

esphome/components/esphome/ota/ota_esphome_noise.cpp

@@ -3,6 +3,7 @@
 #ifdef USE_OTA_ENCRYPTION
 #include "esphome/components/noise/noise.h"
 #include "esphome/components/ota/ota_backend.h"
+#include "esphome/core/hal.h"
 #include "esphome/core/log.h"
 
 #include <cstring>
@@ -40,24 +41,17 @@ ESPHomeOTAComponent::NoiseSession::~NoiseSession() {
  *   "NoiseOTAInit" | magic(5) | OK,version | client_features | FEATURE_FLAGS,server_flags
  */
 bool ESPHomeOTAComponent::noise_start_session_(uint8_t server_feature_flags) {
+  // A provisioned key cleared between the offer and here is not guarded: the
+  // session runs on the zero key load_psk fills in and fails the client's MAC.
+  // Default-init: the frame buffer is written before it is read
   // NOLINTNEXTLINE(clang-analyzer-cplusplus.NewDeleteLeaks)
-  this->noise_ = std::unique_ptr<NoiseSession>(new (std::nothrow) NoiseSession());
-  if (this->noise_ == nullptr) {
-    ESP_LOGW(TAG, "Session allocation failed");
-    this->cleanup_connection_();
-    return false;
-  }
-
+  this->noise_ = std::unique_ptr<NoiseSession>(new (std::nothrow) NoiseSession);
   static constexpr size_t PROLOGUE_ACK_LEN = 2;  // OTA_RESPONSE_OK + version
   static constexpr size_t PROLOGUE_CLIENT_FEATURES_LEN = 1;
   static constexpr size_t PROLOGUE_FEATURE_ACK_LEN = 2;  // OTA_RESPONSE_FEATURE_FLAGS + server flags
   uint8_t prologue[OTA_NOISE_PROLOGUE_INIT_LEN + sizeof(MAGIC_BYTES) + PROLOGUE_ACK_LEN + PROLOGUE_CLIENT_FEATURES_LEN +
                    PROLOGUE_FEATURE_ACK_LEN];
-#ifdef USE_ESP8266
-  memcpy_P(prologue, OTA_NOISE_PROLOGUE_INIT, OTA_NOISE_PROLOGUE_INIT_LEN);
-#else
-  std::memcpy(prologue, OTA_NOISE_PROLOGUE_INIT, OTA_NOISE_PROLOGUE_INIT_LEN);
-#endif
+  progmem_memcpy(prologue, OTA_NOISE_PROLOGUE_INIT, OTA_NOISE_PROLOGUE_INIT_LEN);
   uint8_t *p = prologue + OTA_NOISE_PROLOGUE_INIT_LEN;
   // Magic bytes, already validated in MAGIC_READ
   std::memcpy(p, MAGIC_BYTES, sizeof(MAGIC_BYTES));
@@ -71,9 +65,13 @@ bool ESPHomeOTAComponent::noise_start_session_(uint8_t server_feature_flags) {
   *p++ = ota::OTA_RESPONSE_FEATURE_FLAGS;
   *p++ = server_feature_flags;
 
-  int err = this->noise_->handshake.init(this->noise_ctx_.get_psk(), prologue, sizeof(prologue));
+  // The caller only starts a session when the context holds a key
+  int err = this->noise_ == nullptr ? NOISE_ERROR_NO_MEMORY
+                                    : this->noise_->handshake.init(this->noise_context_(), prologue, sizeof(prologue));
   if (err != 0) {
-    ESP_LOGW(TAG, "Handshake init: %s", LOG_STR_ARG(noise::noise_err_to_logstr(err)));
+    // Raw noise codes throughout: the name table would cost flash in builds
+    // where only the OTA uses noise
+    ESP_LOGW(TAG, "Session init: %d", err);
     this->cleanup_connection_();
     return false;
   }
@@ -105,14 +103,16 @@ bool ESPHomeOTAComponent::handle_noise_handshake_() {
         s.frame_pos = 0;
         s.frame_len = 0;
         if (s.frame_buf[noise::FRAME_HEADER_SIZE] != noise::HANDSHAKE_STATUS_OK) {
-          ESP_LOGW(TAG, "Bad handshake error byte: %u", s.frame_buf[noise::FRAME_HEADER_SIZE]);
+          ESP_LOGW(TAG, "Client rejected the handshake: %u", s.frame_buf[noise::FRAME_HEADER_SIZE]);
           this->cleanup_connection_();
           return false;
         }
         int err = s.handshake.read_message(s.frame_buf + noise::FRAME_HEADER_SIZE + 1, payload_len - 1);
         if (err != 0) {
-          ESP_LOGW(TAG, "Handshake read: %s", LOG_STR_ARG(noise::noise_err_to_logstr(err)));
-          this->noise_send_reject_(noise::reject_reason_for(err));
+          // A MAC failure here almost always means the uploader has a different key
+          const LogString *reason = noise::reject_reason_for(err);
+          ESP_LOGW(TAG, "Handshake read: %s (%d)", LOG_STR_ARG(reason), err);
+          this->noise_send_reject_(reason);
           this->cleanup_connection_();
           return false;
         }
@@ -123,7 +123,7 @@ bool ESPHomeOTAComponent::handle_noise_handshake_() {
         int err =
             s.handshake.write_message(s.frame_buf + noise::FRAME_HEADER_SIZE + 1, noise::MAX_HANDSHAKE_SIZE, msg_len);
         if (err != 0) {
-          ESP_LOGW(TAG, "Handshake write: %s", LOG_STR_ARG(noise::noise_err_to_logstr(err)));
+          ESP_LOGW(TAG, "Handshake write: %d", err);
           this->cleanup_connection_();
           return false;
         }
@@ -138,7 +138,7 @@ bool ESPHomeOTAComponent::handle_noise_handshake_() {
       case noise::NoiseResponderHandshake::Action::ACTION_SPLIT: {
         int err = s.handshake.split(s.send_cipher, s.recv_cipher);
         if (err != 0) {
-          ESP_LOGW(TAG, "Handshake split: %s", LOG_STR_ARG(noise::noise_err_to_logstr(err)));
+          ESP_LOGW(TAG, "Handshake split: %d", err);
           this->cleanup_connection_();
           return false;
         }
@@ -154,33 +154,41 @@ bool ESPHomeOTAComponent::handle_noise_handshake_() {
   }
 }
 
+/// Payload length from a frame header, or 0 (logged) when the indicator or
+/// the length is out of range. Callers pass min_len >= 1 so 0 is never valid.
+size_t ESPHomeOTAComponent::noise_frame_payload_len_(const uint8_t *header, size_t min_len, size_t max_len) {
+  const size_t payload_len = encode_uint16(header[1], header[2]);
+  if (header[0] != noise::FRAME_INDICATOR || payload_len < min_len || payload_len > max_len) {
+    ESP_LOGW(TAG, "Bad frame: 0x%02X, %zu bytes", header[0], payload_len);
+    return 0;
+  }
+  return payload_len;
+}
+
 /// Non-blocking read of one handshake frame into the session buffer.
 bool ESPHomeOTAComponent::noise_try_read_frame_() {
   NoiseSession &s = *this->noise_;
-  while (s.frame_pos < noise::FRAME_HEADER_SIZE) {
-    ssize_t read = this->client_->read(s.frame_buf + s.frame_pos, noise::FRAME_HEADER_SIZE - s.frame_pos);
-    if (!this->handle_read_error_(read, LOG_STR("read noise header"))) {
-      return false;
+  while (true) {
+    // The header first, then the body once the header says how long it is
+    const uint16_t want = s.frame_len == 0 ? noise::FRAME_HEADER_SIZE : s.frame_len;
+    if (s.frame_pos < want) {
+      ssize_t read = this->client_->read(s.frame_buf + s.frame_pos, want - s.frame_pos);
+      if (!this->handle_read_error_(read, LOG_STR("read noise"))) {
+        return false;
+      }
+      s.frame_pos += read;
+      continue;
     }
-    s.frame_pos += read;
-  }
-  if (s.frame_len == 0) {
-    const uint16_t payload_len = encode_uint16(s.frame_buf[1], s.frame_buf[2]);
-    if (s.frame_buf[0] != noise::FRAME_INDICATOR || payload_len < 1 || payload_len > 1 + noise::MAX_HANDSHAKE_SIZE) {
-      ESP_LOGW(TAG, "Bad handshake frame: 0x%02X, %u bytes", s.frame_buf[0], payload_len);
+    if (s.frame_len != 0) {
+      return true;
+    }
+    const size_t payload_len = this->noise_frame_payload_len_(s.frame_buf, 1, 1 + noise::MAX_HANDSHAKE_SIZE);
+    if (payload_len == 0) {
       this->cleanup_connection_();
       return false;
     }
     s.frame_len = noise::FRAME_HEADER_SIZE + payload_len;
   }
-  while (s.frame_pos < s.frame_len) {
-    ssize_t read = this->client_->read(s.frame_buf + s.frame_pos, s.frame_len - s.frame_pos);
-    if (!this->handle_read_error_(read, LOG_STR("read noise frame"))) {
-      return false;
-    }
-    s.frame_pos += read;
-  }
-  return true;
 }
 
 /// Non-blocking write of the pending session-buffer frame.
@@ -214,7 +222,7 @@ ssize_t ESPHomeOTAComponent::noise_decrypt_(uint8_t *buf, size_t len) {
   noise_buffer_set_inout(mbuf, buf, len, len);
   int err = noise_cipherstate_decrypt(this->noise_->recv_cipher, &mbuf);
   if (err != 0) {
-    ESP_LOGW(TAG, "Decrypt: %s", LOG_STR_ARG(noise::noise_err_to_logstr(err)));
+    ESP_LOGW(TAG, "Decrypt: %d", err);
     return -1;
   }
   return mbuf.size;
@@ -229,9 +237,8 @@ ssize_t ESPHomeOTAComponent::noise_read_frame_blocking_(uint8_t *buf, size_t min
   if (!this->readall_(header, sizeof(header))) {
     return -1;
   }
-  const size_t ciphertext_len = encode_uint16(header[1], header[2]);
-  if (header[0] != noise::FRAME_INDICATOR || ciphertext_len < min_ciphertext || ciphertext_len > max_ciphertext) {
-    ESP_LOGW(TAG, "Bad frame: 0x%02X, %zu bytes", header[0], ciphertext_len);
+  const size_t ciphertext_len = this->noise_frame_payload_len_(header, min_ciphertext, max_ciphertext);
+  if (ciphertext_len == 0) {
     return -1;
   }
   if (!this->readall_(buf, ciphertext_len)) {
@@ -267,7 +274,7 @@ bool ESPHomeOTAComponent::noise_write_byte_(uint8_t byte) {
   noise_buffer_set_inout(mbuf, frame + noise::FRAME_HEADER_SIZE, 1, 1 + noise::MAC_SIZE);
   int err = noise_cipherstate_encrypt(this->noise_->send_cipher, &mbuf);
   if (err != 0) {
-    ESP_LOGW(TAG, "Encrypt: %s", LOG_STR_ARG(noise::noise_err_to_logstr(err)));
+    ESP_LOGW(TAG, "Encrypt: %d", err);
     return false;
   }
   noise::write_frame_header(frame, mbuf.size);

esphome/components/espnow/__init__.py

@@ -3,6 +3,7 @@ from typing import Any
 from esphome import automation, core
 import esphome.codegen as cg
 from esphome.components import wifi
+from esphome.components.esp32 import VARIANT_ESP32P4, get_esp32_variant
 from esphome.components.udp import CONF_ON_RECEIVE
 import esphome.config_validation as cv
 from esphome.const import (
@@ -17,6 +18,7 @@ from esphome.const import (
 )
 from esphome.core import CORE, HexInt
 from esphome.cpp_generator import MockObj, TemplateArgsType
+import esphome.final_validate as fv
 from esphome.types import ConfigType
 
 CODEOWNERS = ["@jesserockz"]
@@ -132,6 +134,24 @@ CONFIG_SCHEMA = cv.All(
 )
 
 
+def _validate_variant(config: ConfigType) -> ConfigType:
+    # ESP-NOW rides the Wi-Fi PHY. Radio-less esp32 variants have no native
+    # ESP-NOW; only the ESP32-P4 has a path, via the esp32_hosted shim that
+    # supplies the esp_now_* symbols. Fail here with a clear message instead of
+    # letting the build reach an "undefined reference to esp_now_*" link error.
+    variant = get_esp32_variant()
+    if wifi.variant_has_wifi(variant):
+        return config
+    if variant != VARIANT_ESP32P4:
+        raise cv.Invalid(f"ESP-NOW is not supported on {variant} (no Wi-Fi radio)")
+    if "esp32_hosted" not in fv.full_config.get():
+        raise cv.Invalid(f"ESP-NOW on {variant} requires the esp32_hosted component")
+    return config
+
+
+FINAL_VALIDATE_SCHEMA = _validate_variant
+
+
 async def _trigger_to_code(config: ConfigType) -> MockObj:
     if address := config.get(CONF_ADDRESS):
         address = address.parts

esphome/components/mdns/__init__.py

@@ -192,6 +192,8 @@ async def to_code(config: ConfigType) -> None:
     if CORE.using_arduino:
         if CORE.is_esp8266:
             cg.add_library("ESP8266mDNS", None)
+            # No MDNS global in the build; mdns_esp8266.cpp owns a guarded MDNSResponder
+            cg.add_build_flag("-DNO_GLOBAL_MDNS")
         elif CORE.is_rp2:
             cg.add_library("LEAmDNS", None)
 

esphome/components/mdns/mdns_esp8266.cpp

@@ -13,8 +13,47 @@
 
 namespace esphome::mdns {
 
+// Main-loop calls into LEAmDNS that send (update() and close(); begin(), addService() and
+// the scheduled restart never reach a send) can yield inside UdpContext::sendTimeout(); a
+// packet arriving then re-enters LEAmDNS from lwIP on the same UdpContext and both sides
+// free the same tx pbufs (#18760). Received packets stay queued during such a call and are
+// processed from the main loop afterwards.
+class GuardedMDNSResponder : public ::esp8266::MDNSImplementation::MDNSResponder {
+ public:
+  void update_guarded() { this->run_guarded_(&GuardedMDNSResponder::update); }
+  void close_guarded() { this->run_guarded_(&GuardedMDNSResponder::close); }
+
+ private:
+  void run_guarded_(bool (GuardedMDNSResponder::*fn)()) {
+    UdpContext *ctx = this->m_pUDPContext;
+    if (ctx == nullptr) {
+      (this->*fn)();
+      return;
+    }
+    // Set every time: a restart replaces the context together with its stock handler. Only
+    // begin() and the scheduled netif callback restart, never update() or close(), so the
+    // context cannot change underneath this call.
+    ctx->onRx([this]() {
+      if (!this->in_loop_call_) {
+        this->_callProcess();
+      }
+    });
+    this->in_loop_call_ = true;
+    (this->*fn)();
+    // close() releases the context; a yield in here queues further packets for this loop too
+    while (this->m_pUDPContext != nullptr && this->m_pUDPContext->next()) {
+      this->_parseMessage();
+    }
+    this->in_loop_call_ = false;
+  }
+
+  volatile bool in_loop_call_{false};
+};
+
+static GuardedMDNSResponder mdns_responder;  // NOLINT(cppcoreguidelines-avoid-non-const-global-variables)
+
 static void register_esp8266(MDNSComponent *, StaticVector<MDNSService, MDNS_SERVICE_COUNT> &services) {
-  MDNS.begin(App.get_name().c_str());
+  mdns_responder.begin(App.get_name().c_str());
 
   for (const auto &service : services) {
     // Strip the leading underscore from the proto and service_type. While it is
@@ -30,10 +69,10 @@ static void register_esp8266(MDNSComponent *, StaticVector<MDNSService, MDNS_SER
       service_type++;
     }
     uint16_t port = service.port.value();
-    MDNS.addService(FPSTR(service_type), FPSTR(proto), port);
+    mdns_responder.addService(FPSTR(service_type), FPSTR(proto), port);
     for (const auto &record : service.txt_records) {
-      MDNS.addServiceTxt(FPSTR(service_type), FPSTR(proto), FPSTR(MDNS_STR_ARG(record.key)),
-                         FPSTR(MDNS_STR_ARG(record.value)));
+      mdns_responder.addServiceTxt(FPSTR(service_type), FPSTR(proto), FPSTR(MDNS_STR_ARG(record.key)),
+                                   FPSTR(MDNS_STR_ARG(record.value)));
     }
   }
 }
@@ -52,7 +91,7 @@ void MDNSComponent::start_polling_window_() {
     if (wifi->is_roaming() || (!wifi->is_connected() && !wifi->is_ap_active()))
       return;
 #endif
-    MDNS.update();
+    mdns_responder.update_guarded();
   });
   this->set_timeout(MDNS_POLL_STOP_ID, MDNS_POLL_WINDOW_MS, [this]() { this->cancel_interval(MDNS_POLL_ID); });
 }
@@ -81,7 +120,7 @@ void MDNSComponent::on_ip_state(const network::IPAddresses &ips, const network::
 #endif
 
 void MDNSComponent::on_shutdown() {
-  MDNS.close();
+  mdns_responder.close_guarded();
   delay(10);
 }
 

esphome/components/noise/__init__.py

@@ -4,7 +4,9 @@ from typing import Any
 
 import esphome.codegen as cg
 import esphome.config_validation as cv
-from esphome.const import CONF_KEY
+from esphome.const import CONF_ENCRYPTION, CONF_KEY
+from esphome.core import ID
+from esphome.cpp_generator import MockObj
 from esphome.types import ConfigType
 
 CODEOWNERS = ["@esphome/core"]
@@ -23,6 +25,14 @@ def validate_encryption_key(value: Any) -> str:
 
     if len(decoded) != 32:
         raise cv.Invalid("Encryption key must be base64 and 32 bytes long")
+    if not any(decoded):
+        # The device treats the all-zeros key as no key at all (it is the
+        # provisioning sentinel), so it must never reach a build
+        raise cv.Invalid(
+            f"The all-zeros {CONF_KEY} is reserved and provides no protection; "
+            f"omit the {CONF_KEY} to provision it at runtime, or generate a real "
+            "key with: openssl rand -base64 32"
+        )
 
     # Return original data for roundtrip conversion
     return value
@@ -45,15 +55,6 @@ def decode_encryption_key(value: str) -> bytes:
     return decoded
 
 
-def is_reserved_key(value: str) -> bool:
-    """Whether the key is the reserved all-zeros provisioning sentinel.
-
-    The device treats it as no key configured, so consumers that require a
-    real key must reject it.
-    """
-    return not any(decode_encryption_key(value))
-
-
 ENCRYPTION_SCHEMA = cv.Schema(
     {
         cv.Optional(CONF_KEY): cv.sensitive(validate_encryption_key),
@@ -61,6 +62,21 @@ ENCRYPTION_SCHEMA = cv.Schema(
 )
 
 
+def static_encryption_key(conf: ConfigType) -> str | None:
+    """The build time key of a component config; None without one or when
+    the key is provisioned at runtime."""
+    return (conf.get(CONF_ENCRYPTION) or {}).get(CONF_KEY) or None
+
+
+def new_psk_progmem(parent_id: ID, key: str) -> MockObj:
+    """Emit the decoded key as a PROGMEM array; the component keeps a pointer
+    so the key never occupies RAM."""
+    return cg.progmem_array(
+        ID(f"{parent_id.id}_psk", is_declaration=True, type=cg.uint8),
+        list(decode_encryption_key(key)),
+    )
+
+
 def encryption_schema(config: ConfigType | None) -> ConfigType:
     # A bare `encryption:` block is valid; a missing key means the consumer
     # falls back to its keyless behavior (api provisioning, ota inheriting
@@ -72,12 +88,12 @@ def encryption_schema(config: ConfigType | None) -> ConfigType:
 
 async def to_code(config: ConfigType) -> None:
     cg.add_define("USE_NOISE")
-    cg.add_library("esphome/noise-c", "0.1.21")
+    cg.add_library("esphome/noise-c", "0.1.24")
     # noise-c depends on libsodium, but declaring it here too lets the
     # library manager see the full set up front instead of discovering
     # libsodium only after noise-c has downloaded, so the two can download
     # in parallel. The version must match noise-c's library.json.
-    cg.add_library("esphome/libsodium", "1.10021.4")
+    cg.add_library("esphome/libsodium", "1.10021.6")
     # Enable optimized memzero/memcmp in libsodium instead of volatile byte loops
     cg.add_build_flag("-DHAVE_WEAK_SYMBOLS=1")
     cg.add_build_flag("-DHAVE_INLINE_ASM=1")

esphome/components/noise/noise.cpp

@@ -1,5 +1,6 @@
 #include "noise.h"
 #ifdef USE_NOISE
+#include "esphome/core/hal.h"
 #include "esphome/core/log.h"
 
 #include <algorithm>
@@ -15,6 +16,14 @@ namespace esphome::noise {
 
 static const char *const TAG = "noise";
 
+void NoiseContext::load_psk(psk_t &out) const {
+  if (this->psk_ == nullptr) {
+    out.fill(0);
+    return;
+  }
+  progmem_memcpy(out.data(), this->psk_, out.size());
+}
+
 const LogString *noise_err_to_logstr(int err) {
   if (err == NOISE_ERROR_NO_MEMORY)
     return LOG_STR("NO_MEMORY");

esphome/components/noise/noise.h

@@ -23,16 +23,16 @@ class NoiseContext {
     }
     return acc == 0;
   }
-  void set_psk(psk_t psk) {
-    this->psk_ = psk;
-    this->has_psk_ = !is_all_zeros(psk);
-  }
-  const psk_t &get_psk() const { return this->psk_; }
-  bool has_psk() const { return this->has_psk_; }
+  /// psk points at 32 bytes that outlive the context (PROGMEM or caller owned
+  /// RAM); nullptr means no key. Runtime callers map the all-zeros key to
+  /// nullptr themselves; validation keeps it out of yaml.
+  void set_psk(const uint8_t *psk) { this->psk_ = psk; }
+  /// Copy the key out (flash-aware on ESP8266); all zeros when none is set.
+  void load_psk(psk_t &out) const;
+  bool has_psk() const { return this->psk_ != nullptr; }
 
  protected:
-  psk_t psk_{};
-  bool has_psk_{false};
+  const uint8_t *psk_{nullptr};
 };
 
 /// Convert a noise error code to a readable error

esphome/components/noise/noise_handshake.cpp

@@ -20,7 +20,7 @@ NoiseResponderHandshake::~NoiseResponderHandshake() {
   }
 }
 
-int NoiseResponderHandshake::init(const psk_t &psk, const uint8_t *prologue, size_t prologue_len) {
+int NoiseResponderHandshake::init(const NoiseContext &ctx, const uint8_t *prologue, size_t prologue_len) {
   if (this->handshake_ != nullptr) {
     noise_handshakestate_free(this->handshake_);
     this->handshake_ = nullptr;
@@ -44,6 +44,9 @@ int NoiseResponderHandshake::init(const psk_t &psk, const uint8_t *prologue, siz
     HANDSHAKE_STEP_LOG("noise_handshakestate_new_by_id", err);
     return err;
   }
+  // noise-c keeps its own copy, so the key only passes through the stack here
+  psk_t psk;
+  ctx.load_psk(psk);
   err = noise_handshakestate_set_pre_shared_key(this->handshake_, psk.data(), psk.size());
   if (err != 0) {
     HANDSHAKE_STEP_LOG("noise_handshakestate_set_pre_shared_key", err);

esphome/components/noise/noise_handshake.h

@@ -36,9 +36,9 @@ class NoiseResponderHandshake {
   NoiseResponderHandshake(const NoiseResponderHandshake &) = delete;
   NoiseResponderHandshake &operator=(const NoiseResponderHandshake &) = delete;
 
-  /// Create and start the handshake with the given PSK and prologue. A
-  /// repeated call frees the previous handshake state and starts over.
-  [[nodiscard]] int init(const psk_t &psk, const uint8_t *prologue, size_t prologue_len);
+  /// Create and start the handshake with the context's PSK and the prologue.
+  /// A repeated call frees the previous handshake state and starts over.
+  [[nodiscard]] int init(const NoiseContext &ctx, const uint8_t *prologue, size_t prologue_len);
   /// ACTION_FAILED is the catch-all: returned before init(), after split()
   /// has released the state, and when noise-c reports a failed handshake.
   [[nodiscard]] Action action() const;

esphome/components/serial_proxy/__init__.py

@@ -18,10 +18,9 @@ from esphome import pins
 import esphome.codegen as cg
 from esphome.components import uart
 import esphome.config_validation as cv
-from esphome.const import CONF_ID, CONF_NAME, CONF_UART_ID
+from esphome.const import CONF_ID, CONF_NAME
 from esphome.core import CORE, coroutine_with_priority
 from esphome.coroutine import CoroPriority
-import esphome.final_validate as fv
 from esphome.types import ConfigType
 
 CODEOWNERS = ["@kbx81"]
@@ -31,18 +30,14 @@ MULTI_CONF = True
 
 serial_proxy_ns = cg.esphome_ns.namespace("serial_proxy")
 SerialProxy = serial_proxy_ns.class_("SerialProxy", cg.Component, uart.UARTDevice)
-SerialProxyTap = serial_proxy_ns.class_("SerialProxyTap")
 
 api_enums_ns = cg.esphome_ns.namespace("api").namespace("enums")
 SerialProxyPortType = api_enums_ns.enum("SerialProxyPortType")
-# User-selectable electrical types. USB_SERIAL is deliberately absent: it is derived
-# from the uart_id pointing at a usb_uart channel, never set by the user.
 SERIAL_PROXY_PORT_TYPES = {
     "TTL": SerialProxyPortType.SERIAL_PROXY_PORT_TYPE_TTL,
     "RS232": SerialProxyPortType.SERIAL_PROXY_PORT_TYPE_RS232,
     "RS485": SerialProxyPortType.SERIAL_PROXY_PORT_TYPE_RS485,
 }
-PORT_TYPE_USB_SERIAL = SerialProxyPortType.SERIAL_PROXY_PORT_TYPE_USB_SERIAL
 
 CONF_DTR_PIN = "dtr_pin"
 CONF_PORT_TYPE = "port_type"
@@ -67,7 +62,7 @@ CONFIG_SCHEMA = (
         {
             cv.GenerateID(): cv.declare_id(SerialProxy),
             cv.Required(CONF_NAME): cv.string_strict,
-            cv.Optional(CONF_PORT_TYPE): cv.enum(SERIAL_PROXY_PORT_TYPES, upper=True),
+            cv.Required(CONF_PORT_TYPE): cv.enum(SERIAL_PROXY_PORT_TYPES, upper=True),
             cv.Optional(CONF_RTS_PIN): pins.gpio_output_pin_schema,
             cv.Optional(CONF_DTR_PIN): pins.gpio_output_pin_schema,
         }
@@ -77,26 +72,6 @@ CONFIG_SCHEMA = (
 )
 
 
-def _uses_usb_uart(config: ConfigType, full_config: ConfigType) -> bool:
-    from esphome.components.usb_uart import is_usb_uart_channel
-
-    return is_usb_uart_channel(config[CONF_UART_ID], full_config)
-
-
-def _final_validate(config: ConfigType) -> ConfigType:
-    if _uses_usb_uart(config, fv.full_config.get()):
-        if CONF_PORT_TYPE in config:
-            raise cv.Invalid(
-                f"{CONF_PORT_TYPE} is set automatically for USB serial ports"
-            )
-    elif CONF_PORT_TYPE not in config:
-        raise cv.Invalid(f"{CONF_PORT_TYPE} is required")
-    return config
-
-
-FINAL_VALIDATE_SCHEMA = _final_validate
-
-
 @coroutine_with_priority(CoroPriority.FINAL)
 async def _add_serial_proxy_count_define() -> None:
     """Emit the SERIAL_PROXY_COUNT define once with the final instance count."""
@@ -111,13 +86,7 @@ async def to_code(config: ConfigType) -> None:
     await uart.register_uart_device(var, config)
     cg.add(cg.App.register_serial_proxy(var))
     cg.add(var.set_name(config[CONF_NAME]))
-    if _uses_usb_uart(config, CORE.config):
-        cg.add(var.set_port_type(PORT_TYPE_USB_SERIAL))
-        channel = await cg.get_variable(config[CONF_UART_ID])
-        cg.add(var.set_usb_channel(channel))
-        cg.add_define("USE_SERIAL_PROXY_USB_INFO")
-    else:
-        cg.add(var.set_port_type(config[CONF_PORT_TYPE]))
+    cg.add(var.set_port_type(config[CONF_PORT_TYPE]))
     cg.add_define("USE_SERIAL_PROXY")
 
     # Track instance count for the FINAL priority define

esphome/components/serial_proxy/serial_proxy.cpp

@@ -12,10 +12,6 @@
 #include "esphome/components/api/api_server.h"
 #endif
 
-#ifdef USE_SERIAL_PROXY_USB_INFO
-#include "esphome/components/usb_uart/usb_uart.h"
-#endif
-
 namespace esphome::serial_proxy {
 
 static const char *const TAG = "serial_proxy";
@@ -33,57 +29,26 @@ void SerialProxy::setup() {
 #ifdef USE_API
   // instance_index_ is fixed at registration time; pre-set it so loop() only needs to update data
   this->outgoing_msg_.instance = this->instance_index_;
-#endif
-#ifdef USE_SERIAL_PROXY_TAP
-  // A tap sets itself up before this runs (its setup priority is higher), so it may
-  // already be waiting on the port -- a boot-time handshake with the device, say. Leaving
-  // the loop enabled is what lets that finish; without it the tap would stall until a
-  // client happened to subscribe.
-  if (this->tap_ != nullptr && this->tap_->tap_needs_port()) {
-    return;
-  }
 #endif
   // No subscriber at startup; disable loop until a client subscribes
   this->disable_loop();
 }
 
-#ifdef USE_SERIAL_PROXY_TAP
-void SerialProxy::reset_mode_() {
-  // The mode belongs to a session, not to the port. Carrying a departed client's choice
-  // over to the next one would inject protocol bytes into a stream that never asked for
-  // them -- a firmware upload, or any client built before this request existed and so
-  // unable to turn it off. Guessing RAW is the safe direction: a client that wanted
-  // protocol handling and did not ask for it merely sends its own acknowledgements.
-  if (this->mode_ == api::enums::SERIAL_PROXY_MODE_RAW) {
-    return;
-  }
-  ESP_LOGD(TAG, "Session ended, returning serial proxy [%" PRIu32 "] to RAW mode", this->instance_index_);
-  this->mode_ = api::enums::SERIAL_PROXY_MODE_RAW;
-}
-#endif
-
 void SerialProxy::loop() {
 #ifdef USE_API
-  // Detect subscriber disconnect
-  if (this->api_connection_ != nullptr && (this->api_connection_->is_marked_for_removal() ||
-                                           !this->api_connection_->is_connection_setup() || !api_is_connected())) {
-    ESP_LOGW(TAG, "Subscriber disconnected");
-    this->api_connection_ = nullptr;
-    this->reset_mode_();
-  }
-
-  // With no subscriber there is normally nothing to do, but a tap may still need the port
-  // read -- it does its protocol work precisely while nobody else is listening.
+  // Safety check — loop should only run when subscribed, but guard against races
   if (this->api_connection_ == nullptr) [[unlikely]] {
-#ifdef USE_SERIAL_PROXY_TAP
-    if (this->tap_ == nullptr || !this->tap_->tap_needs_port()) {
-      this->disable_loop();
-      return;
-    }
-#else
     this->disable_loop();
     return;
-#endif
+  }
+
+  // Detect subscriber disconnect
+  if (this->api_connection_->is_marked_for_removal() || !this->api_connection_->is_connection_setup() ||
+      !api_is_connected()) {
+    ESP_LOGW(TAG, "Subscriber disconnected");
+    this->api_connection_ = nullptr;
+    this->disable_loop();
+    return;
   }
 
   // Read available data from UART and forward to subscribed client
@@ -104,54 +69,11 @@ void __attribute__((noinline)) SerialProxy::read_and_send_(size_t available) {
   if (!this->read_array(buffer, to_read))
     return;
 
-#ifdef USE_SERIAL_PROXY_TAP
-  // Before forwarding, so a tap that answers the device (an acknowledgement, say) is not
-  // waiting on the network round trip to a subscriber that may not even exist.
-  if (this->tap_observing_()) {
-    this->tap_->on_device_rx(buffer, to_read);
-  }
-#endif
-
-  if (this->api_connection_ == nullptr) {
-    return;
-  }
   this->outgoing_msg_.set_data(buffer, to_read);
   this->api_connection_->send_serial_proxy_data(this->outgoing_msg_);
 }
 #endif
 
-#ifdef USE_SERIAL_PROXY_TAP
-
-bool SerialProxy::tap_observing_() const {
-  if (this->tap_ == nullptr) {
-    return false;
-  }
-  // With no subscriber, a tap doing its own protocol work (the boot-time handshake with
-  // the device, say) is served regardless of mode -- nobody has chosen one yet. Once a
-  // subscriber holds the port, the mode alone decides, so RAW stays inert.
-  if (this->api_connection_ == nullptr && this->tap_->tap_needs_port()) {
-    return true;
-  }
-  // Otherwise the mode decides. RAW must be inert: a client that flips to RAW before
-  // flashing firmware is entitled to a byte pipe with nothing injecting protocol bytes
-  // into it, and "the tap turned out not to recognise the stream" is not good enough.
-  return this->mode_ == api::enums::SERIAL_PROXY_MODE_PROTOCOL;
-}
-
-void SerialProxy::tap_pump() {
-#ifdef USE_API
-  // Nothing would consume the bytes; leave them in the FIFO
-  if (!this->tap_observing_() && this->api_connection_ == nullptr) {
-    return;
-  }
-  const size_t available = this->available();
-  if (available > 0) {
-    this->read_and_send_(available);
-  }
-#endif
-}
-#endif
-
 void SerialProxy::dump_config() {
   ESP_LOGCONFIG(TAG,
                 "Serial Proxy [%" PRIu32 "]:\n"
@@ -160,10 +82,9 @@ void SerialProxy::dump_config() {
                 "  RTS Pin: %s\n"
                 "  DTR Pin: %s",
                 this->instance_index_, this->name_ != nullptr ? this->name_ : "",
-                this->port_type_ == api::enums::SERIAL_PROXY_PORT_TYPE_RS485        ? LOG_STR_LITERAL("RS485")
-                : this->port_type_ == api::enums::SERIAL_PROXY_PORT_TYPE_RS232      ? LOG_STR_LITERAL("RS232")
-                : this->port_type_ == api::enums::SERIAL_PROXY_PORT_TYPE_USB_SERIAL ? LOG_STR_LITERAL("USB_SERIAL")
-                                                                                    : LOG_STR_LITERAL("TTL"),
+                this->port_type_ == api::enums::SERIAL_PROXY_PORT_TYPE_RS485   ? LOG_STR_LITERAL("RS485")
+                : this->port_type_ == api::enums::SERIAL_PROXY_PORT_TYPE_RS232 ? LOG_STR_LITERAL("RS232")
+                                                                               : LOG_STR_LITERAL("TTL"),
                 this->rts_pin_ != nullptr ? LOG_STR_LITERAL("configured") : LOG_STR_LITERAL("not configured"),
                 this->dtr_pin_ != nullptr ? LOG_STR_LITERAL("configured") : LOG_STR_LITERAL("not configured"));
 }
@@ -171,9 +92,8 @@ void SerialProxy::dump_config() {
 SerialProxyResult SerialProxy::configure(api::APIConnection *api_connection, uint32_t baudrate, bool flow_control,
                                          uint8_t parity, uint8_t stop_bits, uint8_t data_size) {
 #ifdef USE_API
-  if (!this->is_subscriber_(api_connection)) {
-    ESP_LOGW(TAG, "Ignoring configure request from client without port subscription [%" PRIu32 "]",
-             this->instance_index_);
+  if (this->port_claimed_by_other_(api_connection)) {
+    ESP_LOGW(TAG, "Ignoring configure request from client without port access [%" PRIu32 "]", this->instance_index_);
     return SerialProxyResult::SERIAL_PROXY_RESULT_PORT_IN_USE;
   }
 #endif
@@ -239,80 +159,24 @@ SerialProxyResult SerialProxy::configure(api::APIConnection *api_connection, uin
   return SerialProxyResult::SERIAL_PROXY_RESULT_OK;
 }
 
-SerialProxyResult SerialProxy::set_mode_from_client(api::APIConnection *api_connection,
-                                                    api::enums::SerialProxyMode mode) {
-#ifdef USE_API
-  // Only the live subscriber may change the mode, so the mode cannot outlive a session
-  if (!this->is_subscriber_(api_connection)) {
-    ESP_LOGW(TAG, "Ignoring mode request from client without port subscription [%" PRIu32 "]", this->instance_index_);
-    return SerialProxyResult::SERIAL_PROXY_RESULT_PORT_IN_USE;
-  }
-#endif
-  // Values come from a remote client
-  if (mode != api::enums::SERIAL_PROXY_MODE_RAW && mode != api::enums::SERIAL_PROXY_MODE_PROTOCOL) {
-    ESP_LOGW(TAG, "Invalid mode: %" PRIu32, static_cast<uint32_t>(mode));
-    return SerialProxyResult::SERIAL_PROXY_RESULT_INVALID_ARGUMENT;
-  }
-  // PROTOCOL on a port with no tap would be a silent no-op; refuse so the client knows
-#ifdef USE_SERIAL_PROXY_TAP
-  const bool has_tap = this->tap_ != nullptr;
-#else
-  const bool has_tap = false;
-#endif
-  if (mode == api::enums::SERIAL_PROXY_MODE_PROTOCOL && !has_tap) {
-    ESP_LOGW(TAG, "No tap on serial proxy [%" PRIu32 "]; PROTOCOL mode unavailable", this->instance_index_);
-    return SerialProxyResult::SERIAL_PROXY_RESULT_NOT_SUPPORTED;
-  }
-  ESP_LOGD(TAG, "Serial proxy [%" PRIu32 "] mode set to %s", this->instance_index_,
-           mode == api::enums::SERIAL_PROXY_MODE_PROTOCOL ? LOG_STR_LITERAL("PROTOCOL") : LOG_STR_LITERAL("RAW"));
-#ifdef USE_SERIAL_PROXY_TAP
-  const bool leaving_protocol_mode =
-      this->mode_ != api::enums::SERIAL_PROXY_MODE_RAW && mode == api::enums::SERIAL_PROXY_MODE_RAW;
-  this->mode_ = mode;
-
-  // Only for an explicit client request, not for reset_mode_() at the end of a session:
-  // an ordinary disconnect says nothing about the device, whereas a client deliberately
-  // asking for raw bytes usually precedes changing what the device is.
-  if (leaving_protocol_mode && this->tap_ != nullptr) {
-    this->tap_->on_protocol_disabled();
-  }
-#endif
-  return SerialProxyResult::SERIAL_PROXY_RESULT_OK;
-}
-
 void SerialProxy::write_from_client(api::APIConnection *api_connection, const uint8_t *data, size_t len) {
 #ifdef USE_API
-  // Bytes from anyone but the live subscriber would interleave with the subscriber's
-  // traffic -- or with an active tap's -- on the wire
-  if (!this->is_subscriber_(api_connection)) {
-    if (this->api_connection_ != nullptr) {
-      ESP_LOGW(TAG, "Ignoring write from client that does not hold serial proxy [%" PRIu32 "]", this->instance_index_);
-    } else {
-      // A legacy client streaming writes without subscribing would flood WARN, one per
-      // request; writes are the only high-rate, unacknowledged operation, so keep this
-      // visible without drowning the log
-      ESP_LOGV(TAG, "Ignoring write from client without port subscription [%" PRIu32 "]", this->instance_index_);
-    }
+  // Bytes from a client other than the live subscriber would interleave with the
+  // subscriber's traffic on the wire
+  if (this->port_claimed_by_other_(api_connection)) {
+    ESP_LOGW(TAG, "Ignoring write from client without port access [%" PRIu32 "]", this->instance_index_);
     return;
   }
 #endif
   if (data == nullptr || len == 0)
     return;
   this->write_array(data, len);
-
-#ifdef USE_SERIAL_PROXY_TAP
-  // After the write, so the tap observes the same ordering the device does
-  if (this->tap_observing_()) {
-    this->tap_->on_client_tx(data, len);
-  }
-#endif
 }
 
 SerialProxyResult SerialProxy::set_modem_pins(api::APIConnection *api_connection, uint32_t line_states) {
 #ifdef USE_API
-  if (!this->is_subscriber_(api_connection)) {
-    ESP_LOGW(TAG, "Ignoring modem pin request from client without port subscription [%" PRIu32 "]",
-             this->instance_index_);
+  if (this->port_claimed_by_other_(api_connection)) {
+    ESP_LOGW(TAG, "Ignoring modem pin request from client without port access [%" PRIu32 "]", this->instance_index_);
     return SerialProxyResult::SERIAL_PROXY_RESULT_PORT_IN_USE;
   }
 #endif
@@ -338,27 +202,6 @@ SerialProxyResult SerialProxy::set_modem_pins(api::APIConnection *api_connection
   return SerialProxyResult::SERIAL_PROXY_RESULT_OK;
 }
 
-#if defined(USE_SERIAL_PROXY_USB_INFO) && defined(USE_API)
-void SerialProxy::get_usb_info(usb_host::UsbDeviceInfo &info, api::SerialProxyGetUsbInfoResponse &resp) const {
-  if (this->usb_channel_ == nullptr) {
-    resp.status = api::enums::SERIAL_PROXY_STATUS_NOT_SUPPORTED;
-    return;
-  }
-  resp.interface_number = this->usb_channel_->get_index();
-  if (!this->usb_channel_->get_parent()->get_device_info(info)) {
-    // No device attached right now; not an error
-    return;
-  }
-  resp.connected = true;
-  resp.vendor_id = info.vendor_id;
-  resp.product_id = info.product_id;
-  resp.bcd_device = info.bcd_device;
-  resp.manufacturer = StringRef(info.manufacturer);
-  resp.product = StringRef(info.product);
-  resp.serial_number = StringRef(info.serial_number);
-}
-#endif
-
 uint32_t SerialProxy::get_modem_pins() const {
   return (this->rts_state_ ? static_cast<uint32_t>(SERIAL_PROXY_LINE_STATE_FLAG_RTS) : 0u) |
          (this->dtr_state_ ? static_cast<uint32_t>(SERIAL_PROXY_LINE_STATE_FLAG_DTR) : 0u);
@@ -367,8 +210,8 @@ uint32_t SerialProxy::get_modem_pins() const {
 SerialProxyResult SerialProxy::flush_port(api::APIConnection *api_connection) {
 #ifdef USE_API
   // Flushing stalls the port, so it gets the same ownership check as writes
-  if (!this->is_subscriber_(api_connection)) {
-    ESP_LOGW(TAG, "Ignoring flush from client without port subscription [%" PRIu32 "]", this->instance_index_);
+  if (this->port_claimed_by_other_(api_connection)) {
+    ESP_LOGW(TAG, "Ignoring flush from client without port access [%" PRIu32 "]", this->instance_index_);
     return SerialProxyResult::SERIAL_PROXY_RESULT_PORT_IN_USE;
   }
 #endif
@@ -387,6 +230,11 @@ SerialProxyResult SerialProxy::flush_port(api::APIConnection *api_connection) {
 }
 
 #ifdef USE_API
+bool SerialProxy::port_claimed_by_other_(api::APIConnection *api_connection) const {
+  return this->api_connection_ != nullptr && this->api_connection_ != api_connection &&
+         this->api_connection_->is_connection_setup();
+}
+
 SerialProxyResult SerialProxy::serial_proxy_request(api::APIConnection *api_connection,
                                                     api::enums::SerialProxyRequestType type) {
   switch (type) {
@@ -404,10 +252,6 @@ SerialProxyResult SerialProxy::serial_proxy_request(api::APIConnection *api_conn
           return SerialProxyResult::SERIAL_PROXY_RESULT_PORT_IN_USE;
         }
         ESP_LOGW(TAG, "Previous subscriber disconnected; taking over subscription");
-        // End the dead client's session before starting the new one, so its mode
-        // cannot leak into a session that never asked for it
-        this->api_connection_ = nullptr;
-        this->reset_mode_();
       }
       this->api_connection_ = api_connection;
       this->enable_loop();
@@ -420,15 +264,7 @@ SerialProxyResult SerialProxy::serial_proxy_request(api::APIConnection *api_conn
         return SerialProxyResult::SERIAL_PROXY_RESULT_OK;
       }
       this->api_connection_ = nullptr;
-      this->reset_mode_();
-#ifdef USE_SERIAL_PROXY_TAP
-      // Keep the loop alive for a tap that still needs the port (mirrors loop())
-      if (this->tap_ == nullptr || !this->tap_->tap_needs_port()) {
-        this->disable_loop();
-      }
-#else
       this->disable_loop();
-#endif
       ESP_LOGV(TAG, "API connection unsubscribed from serial proxy [%" PRIu32 "]", this->instance_index_);
       return SerialProxyResult::SERIAL_PROXY_RESULT_OK;
     default:

esphome/components/serial_proxy/serial_proxy.h

@@ -20,22 +20,12 @@
 #include "esphome/components/api/api_pb2.h"
 #endif
 
-#ifdef USE_SERIAL_PROXY_USB_INFO
-namespace esphome::usb_uart {
-class USBUartChannel;
-}  // namespace esphome::usb_uart
-namespace esphome::usb_host {
-struct UsbDeviceInfo;
-}  // namespace esphome::usb_host
-#endif
-
 // Forward-declare types needed outside the USE_API guard.
 namespace esphome::api {
 class APIConnection;
 namespace enums {
 enum SerialProxyPortType : uint32_t;
 enum SerialProxyRequestType : uint32_t;
-enum SerialProxyMode : uint32_t;
 }  // namespace enums
 }  // namespace esphome::api
 
@@ -62,36 +52,6 @@ enum class SerialProxyResult : uint8_t {
 /// Maximum bytes to read from UART in a single loop iteration
 inline constexpr size_t SERIAL_PROXY_MAX_READ_SIZE = 256;
 
-#ifdef USE_SERIAL_PROXY_TAP
-/// Observes a port's traffic without owning it, and may inject bytes of its own.
-///
-/// This exists so protocol-aware behaviour can be layered onto a plain byte pipe without
-/// the pipe knowing anything about the protocol: the tap is compiled in only when some
-/// component asks for one, so a proxy carrying an RS485 meter pays nothing for it.
-///
-/// A tap is an observer, never a gatekeeper -- it cannot suppress or alter the bytes
-/// flowing in either direction, so a misbehaving tap cannot corrupt the stream.
-class SerialProxyTap {
- public:
-  /// Bytes read from the device, before they are forwarded to any subscriber.
-  virtual void on_device_rx(const uint8_t *data, size_t len) = 0;
-
-  /// Bytes a subscriber sent towards the device, after they have been written.
-  virtual void on_client_tx(const uint8_t *data, size_t len) = 0;
-
-  /// True when the port must keep reading even with no subscriber attached, so a tap can
-  /// do its own protocol work while nobody is listening. Honoured only while no
-  /// subscriber holds the port; with one attached, the port mode alone decides.
-  virtual bool tap_needs_port() const = 0;
-
-  /// A client explicitly turned protocol handling off for this port. Distinct from the
-  /// automatic reset when a session ends: this one means a client intends to do something
-  /// else with the device -- reflash it, most likely -- so anything the tap believes about
-  /// it should be treated as suspect.
-  virtual void on_protocol_disabled() = 0;
-};
-#endif
-
 class SerialProxy final : public uart::UARTDevice, public Component {
  public:
   void setup() override;
@@ -117,9 +77,6 @@ class SerialProxy final : public uart::UARTDevice, public Component {
   /// Get the port type
   api::enums::SerialProxyPortType get_port_type() const { return this->port_type_; }
 
-  /// Handle a mode change requested by an API client
-  SerialProxyResult set_mode_from_client(api::APIConnection *api_connection, api::enums::SerialProxyMode mode);
-
   /// Configure UART parameters and apply them
   /// @param api_connection The API connection requesting the change
   /// @param baudrate Baud rate in bits per second
@@ -164,78 +121,13 @@ class SerialProxy final : public uart::UARTDevice, public Component {
   /// Set the DTR GPIO pin (from YAML configuration)
   void set_dtr_pin(GPIOPin *pin) { this->dtr_pin_ = pin; }
 
-#ifdef USE_SERIAL_PROXY_USB_INFO
-  /// Attach the USB UART channel behind this port (from code generation)
-  void set_usb_channel(usb_uart::USBUartChannel *channel) { this->usb_channel_ = channel; }
-
-#ifdef USE_API
-  /// Fill a USB info response for this port. The response's strings are views into
-  /// info, so info must outlive the send.
-  void get_usb_info(usb_host::UsbDeviceInfo &info, api::SerialProxyGetUsbInfoResponse &resp) const;
-#endif
-#endif
-
-#ifdef USE_SERIAL_PROXY_TAP
-  /// Attach a traffic observer. At most one, set once at setup time.
-  void set_tap(SerialProxyTap *tap) { this->tap_ = tap; }
-
-  /// Write bytes originating from the tap rather than from a client. Bypasses the
-  /// subscriber ownership check, but only while the tap is being served bytes -- so a
-  /// port in RAW mode with a subscriber attached stays inert. Returns false when the
-  /// bytes were dropped for that reason.
-  bool write_from_tap(const uint8_t *data, size_t len) {
-    if (!this->tap_observing_()) {
-      return false;
-    }
-    this->write_array(data, len);
-    return true;
-  }
-
-  /// Whether the tap is currently being served bytes. Can flip false with no callback
-  /// (a subscriber attaching in RAW mode, say), so a tap should check before starting
-  /// protocol work and when a reply seems overdue.
-  bool tap_is_observed() const { return this->tap_observing_(); }
-
-  /// Resume reading after a tap's needs change. loop() disables itself when there is
-  /// neither a subscriber nor a tap that wants the port, so a tap starting fresh work
-  /// must ask for it back. Must be called from the main loop.
-  void tap_request_port() { this->enable_loop(); }
-
-  /// Whether the underlying device is present. On a USB UART this tracks enumeration, so
-  /// a tap can notice the device being unplugged and plugged back in.
-  bool is_device_connected() const { return this->parent_->is_connected(); }
-
-  /// Run one read-and-dispatch cycle immediately. Lets a tap make progress before the
-  /// main loop is running -- during setup, for instance, while a component is still
-  /// blocking on can_proceed(). Must not be called from on_device_rx() or
-  /// on_client_tx(): each nested cycle costs a 256-byte stack frame.
-  void tap_pump();
-#endif
-
  protected:
 #ifdef USE_API
-  /// Read from UART, hand the bytes to any tap, and forward them to a subscriber
-  /// (slow path with a 256-byte stack buffer)
+  /// Read from UART and send to API client (slow path with 256-byte stack buffer)
   void read_and_send_(size_t available);
 
-  /// True when the given connection is the live subscriber. Every port operation
-  /// (write, configure, modem pins, flush, mode) requires this, so an unsubscribed
-  /// client can never share the wire with the subscriber or an active tap.
-  bool is_subscriber_(api::APIConnection *api_connection) const { return this->api_connection_ == api_connection; }
-#endif
-
-#ifdef USE_SERIAL_PROXY_TAP
-  /// Return the port to RAW when a subscriber goes away, so the mode never outlives it
-  void reset_mode_();
-#else
-  /// Without a tap, PROTOCOL is refused, so the mode is fixed at RAW and there is
-  /// nothing to reset
-  void reset_mode_() {}
-#endif
-
-#ifdef USE_SERIAL_PROXY_TAP
-  /// True when the tap should be shown the traffic passing through this port
-  bool tap_observing_() const;
+  /// True when a live subscriber other than the given connection holds the port
+  bool port_claimed_by_other_(api::APIConnection *api_connection) const;
 #endif
 
   /// Instance index for identifying this proxy in API messages
@@ -255,11 +147,6 @@ class SerialProxy final : public uart::UARTDevice, public Component {
   /// Port type
   api::enums::SerialProxyPortType port_type_{};
 
-#ifdef USE_SERIAL_PROXY_TAP
-  /// How the bytes passing through are treated; zero is SERIAL_PROXY_MODE_RAW
-  api::enums::SerialProxyMode mode_{};
-#endif
-
   /// Optional GPIO pins for modem control
   GPIOPin *rts_pin_{nullptr};
   GPIOPin *dtr_pin_{nullptr};
@@ -267,15 +154,6 @@ class SerialProxy final : public uart::UARTDevice, public Component {
   /// Current modem pin states
   bool rts_state_{false};
   bool dtr_state_{false};
-
-#ifdef USE_SERIAL_PROXY_TAP
-  SerialProxyTap *tap_{nullptr};
-#endif
-
-#ifdef USE_SERIAL_PROXY_USB_INFO
-  /// The USB UART channel behind this port; nullptr on non-USB ports
-  usb_uart::USBUartChannel *usb_channel_{nullptr};
-#endif
 };
 
 }  // namespace esphome::serial_proxy

esphome/components/template/climate/__init__.py

@@ -0,0 +1,465 @@
+from esphome import automation
+import esphome.codegen as cg
+from esphome.components import climate, sensor
+from esphome.components.climate import climate_ns
+import esphome.config_validation as cv
+from esphome.const import (
+    CONF_ACTION,
+    CONF_CURRENT_TEMPERATURE,
+    CONF_CUSTOM_FAN_MODE,
+    CONF_CUSTOM_FAN_MODES,
+    CONF_CUSTOM_PRESET,
+    CONF_CUSTOM_PRESETS,
+    CONF_FAN_MODE,
+    CONF_HUMIDITY_SENSOR,
+    CONF_ID,
+    CONF_INITIAL_STATE,
+    CONF_MODE,
+    CONF_OPTIMISTIC,
+    CONF_PRESET,
+    CONF_RESTORE_MODE,
+    CONF_SENSOR,
+    CONF_SUPPORTED_FAN_MODES,
+    CONF_SUPPORTED_MODES,
+    CONF_SUPPORTED_PRESETS,
+    CONF_SUPPORTED_SWING_MODES,
+    CONF_SWING_MODE,
+    CONF_TARGET_TEMPERATURE,
+    CONF_TARGET_TEMPERATURE_HIGH,
+    CONF_TARGET_TEMPERATURE_LOW,
+)
+from esphome.core import ID
+from esphome.cpp_generator import MockObj, TemplateArgsType
+from esphome.types import ConfigType
+
+from .. import template_ns
+
+CONF_CURRENT_HUMIDITY = "current_humidity"
+CONF_TARGET_HUMIDITY = "target_humidity"
+CONF_SUPPORTS_ACTION = "supports_action"
+CONF_SUPPORTS_TWO_POINT_TARGET_TEMPERATURE = "supports_two_point_target_temperature"
+CONF_SUPPORTS_TARGET_HUMIDITY = "supports_target_humidity"
+CONF_SUPPORTS_CURRENT_TEMPERATURE = "supports_current_temperature"
+CONF_SUPPORTS_CURRENT_HUMIDITY = "supports_current_humidity"
+CONF_SET_MODE_ACTION = "set_mode_action"
+CONF_SET_TARGET_TEMPERATURE_ACTION = "set_target_temperature_action"
+CONF_SET_TARGET_TEMPERATURE_LOW_ACTION = "set_target_temperature_low_action"
+CONF_SET_TARGET_TEMPERATURE_HIGH_ACTION = "set_target_temperature_high_action"
+CONF_SET_TARGET_HUMIDITY_ACTION = "set_target_humidity_action"
+CONF_SET_FAN_MODE_ACTION = "set_fan_mode_action"
+CONF_SET_CUSTOM_FAN_MODE_ACTION = "set_custom_fan_mode_action"
+CONF_SET_SWING_MODE_ACTION = "set_swing_mode_action"
+CONF_SET_PRESET_ACTION = "set_preset_action"
+CONF_SET_CUSTOM_PRESET_ACTION = "set_custom_preset_action"
+
+TemplateClimate = template_ns.class_("TemplateClimate", climate.Climate, cg.Component)
+TemplateClimatePublishAction = template_ns.class_(
+    "TemplateClimatePublishAction",
+    automation.Action,
+    cg.Parented.template(TemplateClimate),
+)
+
+TemplateClimateRestoreMode = template_ns.enum(
+    "TemplateClimateRestoreMode", is_class=True
+)
+CLIMATE_RESTORE_MODES = {
+    "NO_RESTORE": TemplateClimateRestoreMode.TEMPLATE_CLIMATE_RESTORE_MODE_NO_RESTORE,
+    "RESTORE": TemplateClimateRestoreMode.TEMPLATE_CLIMATE_RESTORE_MODE_RESTORE,
+}
+
+# Per-field actions that forward a requested value on. The third item is the type of `x`.
+SET_ACTIONS = (
+    (CONF_SET_MODE_ACTION, "get_set_mode_trigger", climate.ClimateMode),
+    (
+        CONF_SET_TARGET_TEMPERATURE_ACTION,
+        "get_set_target_temperature_trigger",
+        cg.float_,
+    ),
+    (
+        CONF_SET_TARGET_TEMPERATURE_LOW_ACTION,
+        "get_set_target_temperature_low_trigger",
+        cg.float_,
+    ),
+    (
+        CONF_SET_TARGET_TEMPERATURE_HIGH_ACTION,
+        "get_set_target_temperature_high_trigger",
+        cg.float_,
+    ),
+    (CONF_SET_TARGET_HUMIDITY_ACTION, "get_set_target_humidity_trigger", cg.float_),
+    (CONF_SET_FAN_MODE_ACTION, "get_set_fan_mode_trigger", climate.ClimateFanMode),
+    (
+        CONF_SET_CUSTOM_FAN_MODE_ACTION,
+        "get_set_custom_fan_mode_trigger",
+        cg.StringRef,
+    ),
+    (
+        CONF_SET_SWING_MODE_ACTION,
+        "get_set_swing_mode_trigger",
+        climate.ClimateSwingMode,
+    ),
+    (CONF_SET_PRESET_ACTION, "get_set_preset_trigger", climate.ClimatePreset),
+    (CONF_SET_CUSTOM_PRESET_ACTION, "get_set_custom_preset_trigger", cg.StringRef),
+)
+
+# supports_* keys have no default so that an omitted key can mean "derive it from the sensor or
+# set action that makes the trait useful", which is not expressible once a default fills it in.
+DERIVED_SUPPORTS = (
+    (CONF_SUPPORTS_CURRENT_TEMPERATURE, (CONF_SENSOR,)),
+    (CONF_SUPPORTS_CURRENT_HUMIDITY, (CONF_HUMIDITY_SENSOR,)),
+    (
+        CONF_SUPPORTS_TWO_POINT_TARGET_TEMPERATURE,
+        (
+            CONF_SET_TARGET_TEMPERATURE_LOW_ACTION,
+            CONF_SET_TARGET_TEMPERATURE_HIGH_ACTION,
+        ),
+    ),
+    (CONF_SUPPORTS_TARGET_HUMIDITY, (CONF_SET_TARGET_HUMIDITY_ACTION,)),
+)
+
+
+# Custom fan modes/presets are opaque user-defined strings with no build-time correctness check
+# elsewhere (Climate::set_supported_custom_fan_modes()/set_supported_custom_presets() don't block
+# empty entries), so reject empty ones here -- they could never be selected at runtime anyway.
+validate_custom_climate_string = cv.All(cv.string_strict, cv.Length(min=1))
+
+
+def _validate_two_point(config: ConfigType) -> ConfigType:
+    has_low = CONF_TARGET_TEMPERATURE_LOW in config
+    has_high = CONF_TARGET_TEMPERATURE_HIGH in config
+    if has_low != has_high:
+        raise cv.Invalid(
+            f"'{CONF_TARGET_TEMPERATURE_LOW}' and '{CONF_TARGET_TEMPERATURE_HIGH}' must be used together"
+        )
+    if (has_low or has_high) and CONF_TARGET_TEMPERATURE in config:
+        raise cv.Invalid(
+            f"'{CONF_TARGET_TEMPERATURE}' cannot be used together with "
+            f"'{CONF_TARGET_TEMPERATURE_LOW}'/'{CONF_TARGET_TEMPERATURE_HIGH}'"
+        )
+    return config
+
+
+def _validate_set_actions(config: ConfigType) -> ConfigType:
+    has_low = CONF_SET_TARGET_TEMPERATURE_LOW_ACTION in config
+    has_high = CONF_SET_TARGET_TEMPERATURE_HIGH_ACTION in config
+    if has_low != has_high:
+        raise cv.Invalid(
+            f"'{CONF_SET_TARGET_TEMPERATURE_LOW_ACTION}' and "
+            f"'{CONF_SET_TARGET_TEMPERATURE_HIGH_ACTION}' must be used together"
+        )
+    if (has_low or has_high) and CONF_SET_TARGET_TEMPERATURE_ACTION in config:
+        raise cv.Invalid(
+            f"'{CONF_SET_TARGET_TEMPERATURE_ACTION}' cannot be used together with "
+            f"'{CONF_SET_TARGET_TEMPERATURE_LOW_ACTION}'/'{CONF_SET_TARGET_TEMPERATURE_HIGH_ACTION}'"
+        )
+    return config
+
+
+def _resolve_supports(config: ConfigType) -> ConfigType:
+    # An explicit true stays valid without either, since climate.template.publish can report the
+    # value; an explicit false that contradicts the configuration is an error, not a silent override.
+    for key, sources in DERIVED_SUPPORTS:
+        configured = [source for source in sources if source in config]
+        if key not in config:
+            config[key] = bool(configured)
+        elif not config[key] and configured:
+            raise cv.Invalid(
+                f"'{key}' cannot be false while '{configured[0]}' is configured",
+                path=[key],
+            )
+    return config
+
+
+def _validate_initial_state(config: ConfigType) -> ConfigType:
+    # Climate keeps target_temperature and target_temperature_low in a union, so writing the wrong
+    # one of the pair corrupts the setpoint with no runtime complaint.
+    if (initial_state := config.get(CONF_INITIAL_STATE)) is None:
+        return config
+
+    two_point = config[CONF_SUPPORTS_TWO_POINT_TARGET_TEMPERATURE]
+    if two_point and CONF_TARGET_TEMPERATURE in initial_state:
+        raise cv.Invalid(
+            f"'{CONF_TARGET_TEMPERATURE}' is not available while "
+            f"'{CONF_SUPPORTS_TWO_POINT_TARGET_TEMPERATURE}' is enabled; use "
+            f"'{CONF_TARGET_TEMPERATURE_LOW}'/'{CONF_TARGET_TEMPERATURE_HIGH}' instead",
+            path=[CONF_INITIAL_STATE, CONF_TARGET_TEMPERATURE],
+        )
+    if not two_point:
+        for key in (CONF_TARGET_TEMPERATURE_LOW, CONF_TARGET_TEMPERATURE_HIGH):
+            if key in initial_state:
+                raise cv.Invalid(
+                    f"'{key}' requires '{CONF_SUPPORTS_TWO_POINT_TARGET_TEMPERATURE}' to be enabled",
+                    path=[CONF_INITIAL_STATE, key],
+                )
+    if (
+        CONF_TARGET_HUMIDITY in initial_state
+        and not config[CONF_SUPPORTS_TARGET_HUMIDITY]
+    ):
+        raise cv.Invalid(
+            f"'{CONF_TARGET_HUMIDITY}' requires '{CONF_SUPPORTS_TARGET_HUMIDITY}' to be enabled",
+            path=[CONF_INITIAL_STATE, CONF_TARGET_HUMIDITY],
+        )
+    return config
+
+
+# Same settable fields as climate.template.publish, minus current_temperature/current_humidity/
+# action: those are reported values (from a sensor or the device), not meaningful static defaults.
+INITIAL_STATE_SCHEMA = cv.All(
+    cv.Schema(
+        {
+            cv.Optional(CONF_MODE): climate.validate_climate_mode,
+            cv.Optional(CONF_TARGET_TEMPERATURE): cv.temperature,
+            cv.Optional(CONF_TARGET_TEMPERATURE_LOW): cv.temperature,
+            cv.Optional(CONF_TARGET_TEMPERATURE_HIGH): cv.temperature,
+            cv.Optional(CONF_TARGET_HUMIDITY): cv.percentage_int,
+            cv.Exclusive(CONF_FAN_MODE, "fan_mode"): climate.validate_climate_fan_mode,
+            cv.Exclusive(
+                CONF_CUSTOM_FAN_MODE, "fan_mode"
+            ): validate_custom_climate_string,
+            cv.Optional(CONF_SWING_MODE): climate.validate_climate_swing_mode,
+            cv.Exclusive(CONF_PRESET, "preset"): climate.validate_climate_preset,
+            cv.Exclusive(CONF_CUSTOM_PRESET, "preset"): validate_custom_climate_string,
+        }
+    ),
+    _validate_two_point,
+)
+
+CONFIG_SCHEMA = cv.All(
+    climate.climate_schema(TemplateClimate)
+    .extend(
+        {
+            cv.Optional(CONF_SENSOR): cv.use_id(sensor.Sensor),
+            cv.Optional(CONF_HUMIDITY_SENSOR): cv.use_id(sensor.Sensor),
+            # action only ever arrives through climate.template.publish, so unlike the other
+            # supports_* keys there is no set action to derive it from.
+            cv.Optional(CONF_SUPPORTS_ACTION, default=False): cv.boolean,
+            cv.Optional(CONF_SUPPORTS_CURRENT_TEMPERATURE): cv.boolean,
+            cv.Optional(CONF_SUPPORTS_CURRENT_HUMIDITY): cv.boolean,
+            cv.Optional(CONF_SUPPORTS_TWO_POINT_TARGET_TEMPERATURE): cv.boolean,
+            cv.Optional(CONF_SUPPORTS_TARGET_HUMIDITY): cv.boolean,
+            cv.Required(CONF_SUPPORTED_MODES): cv.All(
+                cv.ensure_list(climate.validate_climate_mode), cv.Unique()
+            ),
+            cv.Optional(CONF_SUPPORTED_FAN_MODES): cv.All(
+                cv.ensure_list(climate.validate_climate_fan_mode), cv.Unique()
+            ),
+            cv.Optional(CONF_CUSTOM_FAN_MODES): cv.All(
+                cv.ensure_list(validate_custom_climate_string), cv.Unique()
+            ),
+            cv.Optional(CONF_SUPPORTED_SWING_MODES): cv.All(
+                cv.ensure_list(climate.validate_climate_swing_mode), cv.Unique()
+            ),
+            cv.Optional(CONF_SUPPORTED_PRESETS): cv.All(
+                cv.ensure_list(climate.validate_climate_preset), cv.Unique()
+            ),
+            cv.Optional(CONF_CUSTOM_PRESETS): cv.All(
+                cv.ensure_list(validate_custom_climate_string), cv.Unique()
+            ),
+            cv.Optional(CONF_OPTIMISTIC, default=True): cv.boolean,
+            cv.Optional(CONF_RESTORE_MODE, default="RESTORE"): cv.enum(
+                CLIMATE_RESTORE_MODES, upper=True
+            ),
+            cv.Optional(CONF_INITIAL_STATE): INITIAL_STATE_SCHEMA,
+            cv.Optional(CONF_SET_MODE_ACTION): automation.validate_automation(
+                single=True
+            ),
+            cv.Optional(
+                CONF_SET_TARGET_TEMPERATURE_ACTION
+            ): automation.validate_automation(single=True),
+            cv.Optional(
+                CONF_SET_TARGET_TEMPERATURE_LOW_ACTION
+            ): automation.validate_automation(single=True),
+            cv.Optional(
+                CONF_SET_TARGET_TEMPERATURE_HIGH_ACTION
+            ): automation.validate_automation(single=True),
+            cv.Optional(
+                CONF_SET_TARGET_HUMIDITY_ACTION
+            ): automation.validate_automation(single=True),
+            cv.Optional(CONF_SET_FAN_MODE_ACTION): automation.validate_automation(
+                single=True
+            ),
+            cv.Optional(
+                CONF_SET_CUSTOM_FAN_MODE_ACTION
+            ): automation.validate_automation(single=True),
+            cv.Optional(CONF_SET_SWING_MODE_ACTION): automation.validate_automation(
+                single=True
+            ),
+            cv.Optional(CONF_SET_PRESET_ACTION): automation.validate_automation(
+                single=True
+            ),
+            cv.Optional(CONF_SET_CUSTOM_PRESET_ACTION): automation.validate_automation(
+                single=True
+            ),
+        }
+    )
+    .extend(cv.COMPONENT_SCHEMA),
+    _validate_set_actions,
+    _resolve_supports,
+    _validate_initial_state,
+)
+
+
+async def to_code(config: ConfigType) -> None:
+    var = cg.new_Pvariable(config[CONF_ID])
+    await cg.register_component(var, config)
+    await climate.register_climate(var, config)
+
+    if (sens := config.get(CONF_SENSOR)) is not None:
+        cg.add(var.set_sensor(await cg.get_variable(sens)))
+
+    if (sens := config.get(CONF_HUMIDITY_SENSOR)) is not None:
+        cg.add(var.set_humidity_sensor(await cg.get_variable(sens)))
+
+    for key, flag in (
+        (CONF_SUPPORTS_ACTION, climate_ns.CLIMATE_SUPPORTS_ACTION),
+        (
+            CONF_SUPPORTS_CURRENT_TEMPERATURE,
+            climate_ns.CLIMATE_SUPPORTS_CURRENT_TEMPERATURE,
+        ),
+        (CONF_SUPPORTS_CURRENT_HUMIDITY, climate_ns.CLIMATE_SUPPORTS_CURRENT_HUMIDITY),
+        (
+            CONF_SUPPORTS_TWO_POINT_TARGET_TEMPERATURE,
+            climate_ns.CLIMATE_SUPPORTS_TWO_POINT_TARGET_TEMPERATURE,
+        ),
+        (CONF_SUPPORTS_TARGET_HUMIDITY, climate_ns.CLIMATE_SUPPORTS_TARGET_HUMIDITY),
+    ):
+        if config[key]:
+            cg.add(var.add_feature_flags(flag))
+
+    for mode in config[CONF_SUPPORTED_MODES]:
+        cg.add(var.add_supported_mode(mode))
+
+    for mode in config.get(CONF_SUPPORTED_FAN_MODES, []):
+        cg.add(var.add_supported_fan_mode(mode))
+
+    if CONF_CUSTOM_FAN_MODES in config:
+        cg.add(
+            var.set_supported_custom_fan_modes(
+                cg.ArrayInitializer(*config[CONF_CUSTOM_FAN_MODES])
+            )
+        )
+
+    for mode in config.get(CONF_SUPPORTED_SWING_MODES, []):
+        cg.add(var.add_supported_swing_mode(mode))
+
+    for preset in config.get(CONF_SUPPORTED_PRESETS, []):
+        cg.add(var.add_supported_preset(preset))
+
+    if CONF_CUSTOM_PRESETS in config:
+        cg.add(
+            var.set_supported_custom_presets(
+                cg.ArrayInitializer(*config[CONF_CUSTOM_PRESETS])
+            )
+        )
+
+    for key, trigger_getter, arg_type in SET_ACTIONS:
+        if (conf := config.get(key)) is not None:
+            await automation.build_automation(
+                getattr(var, trigger_getter)(), [(arg_type, "x")], conf
+            )
+
+    cg.add(var.set_optimistic(config[CONF_OPTIMISTIC]))
+    cg.add(var.set_restore_mode(config[CONF_RESTORE_MODE]))
+
+    if (initial_state := config.get(CONF_INITIAL_STATE)) is not None:
+        if (v := initial_state.get(CONF_MODE)) is not None:
+            cg.add(var.set_mode(v))
+        if (v := initial_state.get(CONF_TARGET_TEMPERATURE)) is not None:
+            cg.add(var.set_target_temperature(v))
+        if (v := initial_state.get(CONF_TARGET_TEMPERATURE_LOW)) is not None:
+            cg.add(var.set_target_temperature_low(v))
+        if (v := initial_state.get(CONF_TARGET_TEMPERATURE_HIGH)) is not None:
+            cg.add(var.set_target_temperature_high(v))
+        if (v := initial_state.get(CONF_TARGET_HUMIDITY)) is not None:
+            cg.add(var.set_target_humidity(v))
+        if (v := initial_state.get(CONF_FAN_MODE)) is not None:
+            cg.add(var.set_fan_mode(v))
+        if (v := initial_state.get(CONF_CUSTOM_FAN_MODE)) is not None:
+            cg.add(var.set_custom_fan_mode(v))
+        if (v := initial_state.get(CONF_SWING_MODE)) is not None:
+            cg.add(var.set_swing_mode(v))
+        if (v := initial_state.get(CONF_PRESET)) is not None:
+            cg.add(var.set_preset(v))
+        if (v := initial_state.get(CONF_CUSTOM_PRESET)) is not None:
+            cg.add(var.set_custom_preset(v))
+
+
+CLIMATE_TEMPLATE_PUBLISH_ACTION_SCHEMA = cv.All(
+    cv.Schema(
+        {
+            cv.GenerateID(): cv.use_id(TemplateClimate),
+            cv.Optional(CONF_CURRENT_TEMPERATURE): cv.templatable(cv.temperature),
+            cv.Optional(CONF_CURRENT_HUMIDITY): cv.templatable(cv.percentage_int),
+            cv.Optional(CONF_TARGET_TEMPERATURE): cv.templatable(cv.temperature),
+            cv.Optional(CONF_TARGET_TEMPERATURE_LOW): cv.templatable(cv.temperature),
+            cv.Optional(CONF_TARGET_TEMPERATURE_HIGH): cv.templatable(cv.temperature),
+            cv.Optional(CONF_TARGET_HUMIDITY): cv.templatable(cv.percentage_int),
+            cv.Optional(CONF_MODE): cv.templatable(climate.validate_climate_mode),
+            cv.Optional(CONF_ACTION): cv.templatable(climate.validate_climate_action),
+            cv.Exclusive(CONF_FAN_MODE, "fan_mode"): cv.templatable(
+                climate.validate_climate_fan_mode
+            ),
+            cv.Exclusive(CONF_CUSTOM_FAN_MODE, "fan_mode"): cv.templatable(
+                validate_custom_climate_string
+            ),
+            cv.Optional(CONF_SWING_MODE): cv.templatable(
+                climate.validate_climate_swing_mode
+            ),
+            cv.Exclusive(CONF_PRESET, "preset"): cv.templatable(
+                climate.validate_climate_preset
+            ),
+            cv.Exclusive(CONF_CUSTOM_PRESET, "preset"): cv.templatable(
+                validate_custom_climate_string
+            ),
+        }
+    ),
+    _validate_two_point,
+)
+
+
+@automation.register_action(
+    "climate.template.publish",
+    TemplateClimatePublishAction,
+    CLIMATE_TEMPLATE_PUBLISH_ACTION_SCHEMA,
+    synchronous=True,
+)
+async def climate_template_publish_to_code(
+    config: ConfigType,
+    action_id: ID,
+    template_arg: cg.TemplateArguments,
+    args: TemplateArgsType,
+) -> MockObj:
+    var = cg.new_Pvariable(action_id, template_arg)
+    await cg.register_parented(var, config[CONF_ID])
+
+    if (v := config.get(CONF_CURRENT_TEMPERATURE)) is not None:
+        cg.add(var.set_current_temperature(await cg.templatable(v, args, cg.float_)))
+    if (v := config.get(CONF_CURRENT_HUMIDITY)) is not None:
+        cg.add(var.set_current_humidity(await cg.templatable(v, args, cg.float_)))
+    if (v := config.get(CONF_TARGET_TEMPERATURE)) is not None:
+        cg.add(var.set_target_temperature(await cg.templatable(v, args, cg.float_)))
+    if (v := config.get(CONF_TARGET_TEMPERATURE_LOW)) is not None:
+        cg.add(var.set_target_temperature_low(await cg.templatable(v, args, cg.float_)))
+    if (v := config.get(CONF_TARGET_TEMPERATURE_HIGH)) is not None:
+        cg.add(
+            var.set_target_temperature_high(await cg.templatable(v, args, cg.float_))
+        )
+    if (v := config.get(CONF_TARGET_HUMIDITY)) is not None:
+        cg.add(var.set_target_humidity(await cg.templatable(v, args, cg.float_)))
+    if (v := config.get(CONF_MODE)) is not None:
+        cg.add(var.set_mode(await cg.templatable(v, args, climate.ClimateMode)))
+    if (v := config.get(CONF_ACTION)) is not None:
+        cg.add(var.set_action(await cg.templatable(v, args, climate.ClimateAction)))
+    if (v := config.get(CONF_FAN_MODE)) is not None:
+        cg.add(var.set_fan_mode(await cg.templatable(v, args, climate.ClimateFanMode)))
+    if (v := config.get(CONF_CUSTOM_FAN_MODE)) is not None:
+        cg.add(var.set_custom_fan_mode(await cg.templatable(v, args, cg.std_string)))
+    if (v := config.get(CONF_SWING_MODE)) is not None:
+        cg.add(
+            var.set_swing_mode(await cg.templatable(v, args, climate.ClimateSwingMode))
+        )
+    if (v := config.get(CONF_PRESET)) is not None:
+        cg.add(var.set_preset(await cg.templatable(v, args, climate.ClimatePreset)))
+    if (v := config.get(CONF_CUSTOM_PRESET)) is not None:
+        cg.add(var.set_custom_preset(await cg.templatable(v, args, cg.std_string)))
+
+    return var

esphome/components/template/climate/automation.h

@@ -0,0 +1,57 @@
+#pragma once
+
+#include "template_climate.h"
+#include "esphome/core/automation.h"
+
+namespace esphome::template_ {
+
+template<typename... Ts>
+class TemplateClimatePublishAction final : public Action<Ts...>, public Parented<TemplateClimate> {
+ public:
+  TEMPLATABLE_VALUE(float, current_temperature)
+  TEMPLATABLE_VALUE(float, current_humidity)
+  TEMPLATABLE_VALUE(float, target_temperature)
+  TEMPLATABLE_VALUE(float, target_temperature_low)
+  TEMPLATABLE_VALUE(float, target_temperature_high)
+  TEMPLATABLE_VALUE(float, target_humidity)
+  TEMPLATABLE_VALUE(climate::ClimateMode, mode)
+  TEMPLATABLE_VALUE(climate::ClimateAction, action)
+  TEMPLATABLE_VALUE(climate::ClimateFanMode, fan_mode)
+  TEMPLATABLE_VALUE(std::string, custom_fan_mode)
+  TEMPLATABLE_VALUE(climate::ClimateSwingMode, swing_mode)
+  TEMPLATABLE_VALUE(climate::ClimatePreset, preset)
+  TEMPLATABLE_VALUE(std::string, custom_preset)
+
+  void play(const Ts &...x) override {
+    if (this->current_temperature_.has_value())
+      this->parent_->current_temperature = this->current_temperature_.value(x...);
+    if (this->current_humidity_.has_value())
+      this->parent_->current_humidity = this->current_humidity_.value(x...);
+    if (this->target_temperature_.has_value())
+      this->parent_->set_target_temperature(this->target_temperature_.value(x...));
+    if (this->target_temperature_low_.has_value())
+      this->parent_->set_target_temperature_low(this->target_temperature_low_.value(x...));
+    if (this->target_temperature_high_.has_value())
+      this->parent_->set_target_temperature_high(this->target_temperature_high_.value(x...));
+    if (this->target_humidity_.has_value())
+      this->parent_->set_target_humidity(this->target_humidity_.value(x...));
+    if (this->mode_.has_value())
+      this->parent_->set_mode(this->mode_.value(x...));
+    if (this->action_.has_value())
+      this->parent_->action = this->action_.value(x...);
+    if (this->fan_mode_.has_value())
+      this->parent_->set_fan_mode(this->fan_mode_.value(x...));
+    if (this->custom_fan_mode_.has_value())
+      this->parent_->set_custom_fan_mode(StringRef(this->custom_fan_mode_.value(x...)));
+    if (this->swing_mode_.has_value())
+      this->parent_->set_swing_mode(this->swing_mode_.value(x...));
+    if (this->preset_.has_value())
+      this->parent_->set_preset(this->preset_.value(x...));
+    if (this->custom_preset_.has_value())
+      this->parent_->set_custom_preset(StringRef(this->custom_preset_.value(x...)));
+
+    this->parent_->publish_state();
+  }
+};
+
+}  // namespace esphome::template_

esphome/components/template/climate/template_climate.cpp

@@ -0,0 +1,164 @@
+#include "template_climate.h"
+#include "esphome/core/log.h"
+
+namespace esphome::template_ {
+
+static const char *const TAG = "template.climate";
+
+void TemplateClimate::setup() {
+  if (this->restore_mode_ == TemplateClimateRestoreMode::TEMPLATE_CLIMATE_RESTORE_MODE_RESTORE) {
+    auto restore = this->restore_state_();
+    if (restore.has_value()) {
+      restore->apply(this);
+    }
+  }
+
+  // Sensors publish every reading, not just changes, so only re-publish when the value moved.
+  // NAN means the sensor went unavailable and is passed through rather than dropped; the second
+  // check stops an unavailable sensor re-publishing forever, since NAN never equals NAN.
+#ifdef USE_SENSOR
+  if (this->sensor_ != nullptr) {
+    this->current_temperature = this->sensor_->state;
+    this->sensor_->add_on_state_callback([this](float state) {
+      if (state != this->current_temperature && !(std::isnan(state) && std::isnan(this->current_temperature))) {
+        this->current_temperature = state;
+        this->publish_state();
+      }
+    });
+  }
+
+  if (this->humidity_sensor_ != nullptr) {
+    this->current_humidity = this->humidity_sensor_->state;
+    this->humidity_sensor_->add_on_state_callback([this](float state) {
+      if (state != this->current_humidity && !(std::isnan(state) && std::isnan(this->current_humidity))) {
+        this->current_humidity = state;
+        this->publish_state();
+      }
+    });
+  }
+#endif
+}
+
+void TemplateClimate::dump_config() {
+  LOG_CLIMATE("", "Template Climate", this);
+  ESP_LOGCONFIG(TAG, "  Optimistic: %s", YESNO(this->optimistic_));
+}
+
+void TemplateClimate::control(const climate::ClimateCall &call) {
+  // Each field present fires its set_*_action; on_control sees the whole call. optimistic: true
+  // also applies the values right away, false waits for a climate.template.publish report.
+  if (auto mode = call.get_mode()) {
+    if (this->optimistic_)
+      this->mode = *mode;
+    this->set_mode_trigger_.trigger(*mode);
+  }
+
+  if (auto target_temp = call.get_target_temperature()) {
+    if (this->optimistic_)
+      this->target_temperature = *target_temp;
+    this->set_target_temperature_trigger_.trigger(*target_temp);
+  }
+
+  if (auto target_temp_low = call.get_target_temperature_low()) {
+    if (this->optimistic_)
+      this->target_temperature_low = *target_temp_low;
+    this->set_target_temperature_low_trigger_.trigger(*target_temp_low);
+  }
+
+  if (auto target_temp_high = call.get_target_temperature_high()) {
+    if (this->optimistic_)
+      this->target_temperature_high = *target_temp_high;
+    this->set_target_temperature_high_trigger_.trigger(*target_temp_high);
+  }
+
+  if (auto target_humidity = call.get_target_humidity()) {
+    if (this->optimistic_)
+      this->target_humidity = *target_humidity;
+    this->set_target_humidity_trigger_.trigger(*target_humidity);
+  }
+
+  if (auto fan_mode = call.get_fan_mode()) {
+    if (this->optimistic_)
+      this->set_fan_mode_(*fan_mode);
+    this->set_fan_mode_trigger_.trigger(*fan_mode);
+  }
+
+  if (call.has_custom_fan_mode()) {
+    if (this->optimistic_)
+      this->set_custom_fan_mode_(call.get_custom_fan_mode());
+    this->set_custom_fan_mode_trigger_.trigger(call.get_custom_fan_mode());
+  }
+
+  if (auto swing_mode = call.get_swing_mode()) {
+    if (this->optimistic_)
+      this->swing_mode = *swing_mode;
+    this->set_swing_mode_trigger_.trigger(*swing_mode);
+  }
+
+  if (auto preset = call.get_preset()) {
+    if (this->optimistic_)
+      this->set_preset_(*preset);
+    this->set_preset_trigger_.trigger(*preset);
+  }
+
+  if (call.has_custom_preset()) {
+    if (this->optimistic_)
+      this->set_custom_preset_(call.get_custom_preset());
+    this->set_custom_preset_trigger_.trigger(call.get_custom_preset());
+  }
+
+  if (this->optimistic_)
+    this->publish_state();
+}
+
+// A climate.template.publish report (and initial_state:) never goes through ClimateCall::validate_(),
+// so check here instead -- otherwise a typo is published as state the receiving end will reject.
+void TemplateClimate::set_mode(climate::ClimateMode mode) {
+  if (!this->traits_.supports_mode(mode)) {
+    ESP_LOGW(TAG, "'%s' - Unsupported mode %u", this->get_name().c_str(), static_cast<unsigned>(mode));
+    return;
+  }
+  this->mode = mode;
+}
+
+void TemplateClimate::set_swing_mode(climate::ClimateSwingMode swing_mode) {
+  if (!this->traits_.supports_swing_mode(swing_mode)) {
+    ESP_LOGW(TAG, "'%s' - Unsupported swing mode %u", this->get_name().c_str(), static_cast<unsigned>(swing_mode));
+    return;
+  }
+  this->swing_mode = swing_mode;
+}
+
+void TemplateClimate::set_fan_mode(climate::ClimateFanMode fan_mode) {
+  if (!this->traits_.supports_fan_mode(fan_mode)) {
+    ESP_LOGW(TAG, "'%s' - Unsupported fan mode %u", this->get_name().c_str(), static_cast<unsigned>(fan_mode));
+    return;
+  }
+  this->set_fan_mode_(fan_mode);
+}
+
+void TemplateClimate::set_preset(climate::ClimatePreset preset) {
+  if (!this->traits_.supports_preset(preset)) {
+    ESP_LOGW(TAG, "'%s' - Unsupported preset %u", this->get_name().c_str(), static_cast<unsigned>(preset));
+    return;
+  }
+  this->set_preset_(preset);
+}
+
+void TemplateClimate::set_custom_fan_mode(StringRef mode) {
+  if (this->find_custom_fan_mode_(mode.c_str(), mode.size()) == nullptr) {
+    ESP_LOGW(TAG, "'%s' - Unsupported custom fan mode '%s'", this->get_name().c_str(), mode.c_str());
+    return;
+  }
+  this->set_custom_fan_mode_(mode);
+}
+
+void TemplateClimate::set_custom_preset(StringRef preset) {
+  if (this->find_custom_preset_(preset.c_str(), preset.size()) == nullptr) {
+    ESP_LOGW(TAG, "'%s' - Unsupported custom preset '%s'", this->get_name().c_str(), preset.c_str());
+    return;
+  }
+  this->set_custom_preset_(preset);
+}
+
+}  // namespace esphome::template_

esphome/components/template/climate/template_climate.h

@@ -0,0 +1,92 @@
+#pragma once
+
+#include "esphome/core/automation.h"
+#include "esphome/core/component.h"
+#include "esphome/components/climate/climate.h"
+#ifdef USE_SENSOR
+#include "esphome/components/sensor/sensor.h"
+#endif
+
+namespace esphome::template_ {
+
+enum class TemplateClimateRestoreMode {
+  TEMPLATE_CLIMATE_RESTORE_MODE_NO_RESTORE,
+  TEMPLATE_CLIMATE_RESTORE_MODE_RESTORE,
+};
+
+class TemplateClimate final : public climate::Climate, public Component {
+ public:
+  void setup() override;
+  void dump_config() override;
+
+  climate::ClimateTraits traits() override { return this->traits_; }
+
+  void add_feature_flags(uint32_t flags) { this->traits_.add_feature_flags(flags); }
+
+#ifdef USE_SENSOR
+  // The matching feature flag is added from codegen, so the configuration alone decides it.
+  void set_sensor(sensor::Sensor *sensor) { this->sensor_ = sensor; }
+  void set_humidity_sensor(sensor::Sensor *sensor) { this->humidity_sensor_ = sensor; }
+#endif
+
+  void add_supported_mode(climate::ClimateMode mode) { this->traits_.add_supported_mode(mode); }
+  void add_supported_fan_mode(climate::ClimateFanMode mode) { this->traits_.add_supported_fan_mode(mode); }
+  void add_supported_swing_mode(climate::ClimateSwingMode mode) { this->traits_.add_supported_swing_mode(mode); }
+  void add_supported_preset(climate::ClimatePreset preset) { this->traits_.add_supported_preset(preset); }
+
+  void set_optimistic(bool optimistic) { this->optimistic_ = optimistic; }
+  void set_restore_mode(TemplateClimateRestoreMode restore_mode) { this->restore_mode_ = restore_mode; }
+
+  // Fired from control() for each field the call carries, so a device-backed config can forward
+  // it on. Which of these are configured also decides the two-point/target-humidity traits.
+  Trigger<climate::ClimateMode> *get_set_mode_trigger() { return &this->set_mode_trigger_; }
+  Trigger<float> *get_set_target_temperature_trigger() { return &this->set_target_temperature_trigger_; }
+  Trigger<float> *get_set_target_temperature_low_trigger() { return &this->set_target_temperature_low_trigger_; }
+  Trigger<float> *get_set_target_temperature_high_trigger() { return &this->set_target_temperature_high_trigger_; }
+  Trigger<float> *get_set_target_humidity_trigger() { return &this->set_target_humidity_trigger_; }
+  Trigger<climate::ClimateFanMode> *get_set_fan_mode_trigger() { return &this->set_fan_mode_trigger_; }
+  Trigger<StringRef> *get_set_custom_fan_mode_trigger() { return &this->set_custom_fan_mode_trigger_; }
+  Trigger<climate::ClimateSwingMode> *get_set_swing_mode_trigger() { return &this->set_swing_mode_trigger_; }
+  Trigger<climate::ClimatePreset> *get_set_preset_trigger() { return &this->set_preset_trigger_; }
+  Trigger<StringRef> *get_set_custom_preset_trigger() { return &this->set_custom_preset_trigger_; }
+
+  // Used by TemplateClimatePublishAction, which is not a Climate subclass and so cannot reach the
+  // protected setters, and by codegen to apply `initial_state:` before setup() runs.
+  void set_target_temperature(float value) { this->target_temperature = value; }
+  void set_target_temperature_low(float value) { this->target_temperature_low = value; }
+  void set_target_temperature_high(float value) { this->target_temperature_high = value; }
+  void set_target_humidity(float value) { this->target_humidity = value; }
+  void set_mode(climate::ClimateMode mode);
+  void set_swing_mode(climate::ClimateSwingMode mode);
+  void set_fan_mode(climate::ClimateFanMode mode);
+  void set_custom_fan_mode(const char *mode) { this->set_custom_fan_mode(StringRef(mode)); }
+  void set_custom_fan_mode(StringRef mode);
+  void set_preset(climate::ClimatePreset preset);
+  void set_custom_preset(const char *preset) { this->set_custom_preset(StringRef(preset)); }
+  void set_custom_preset(StringRef preset);
+
+ protected:
+  void control(const climate::ClimateCall &call) override;
+
+  climate::ClimateTraits traits_;
+  bool optimistic_{false};
+  TemplateClimateRestoreMode restore_mode_{TemplateClimateRestoreMode::TEMPLATE_CLIMATE_RESTORE_MODE_NO_RESTORE};
+
+#ifdef USE_SENSOR
+  sensor::Sensor *sensor_{nullptr};
+  sensor::Sensor *humidity_sensor_{nullptr};
+#endif
+
+  Trigger<climate::ClimateMode> set_mode_trigger_;
+  Trigger<float> set_target_temperature_trigger_;
+  Trigger<float> set_target_temperature_low_trigger_;
+  Trigger<float> set_target_temperature_high_trigger_;
+  Trigger<float> set_target_humidity_trigger_;
+  Trigger<climate::ClimateFanMode> set_fan_mode_trigger_;
+  Trigger<StringRef> set_custom_fan_mode_trigger_;
+  Trigger<climate::ClimateSwingMode> set_swing_mode_trigger_;
+  Trigger<climate::ClimatePreset> set_preset_trigger_;
+  Trigger<StringRef> set_custom_preset_trigger_;
+};
+
+}  // namespace esphome::template_

esphome/components/usb_host/usb_host.h

@@ -117,20 +117,6 @@ struct UsbEvent {
 
 // callback function type.
 
-// USB string descriptors hold at most 126 characters; one more for the terminator
-static constexpr size_t DESC_STRING_BUF_SIZE = 128;
-
-/// Identity of a connected USB device, copied out of the descriptors the USB host
-/// stack caches for the lifetime of the connection
-struct UsbDeviceInfo {
-  uint16_t vendor_id;
-  uint16_t product_id;
-  uint16_t bcd_device;
-  char manufacturer[DESC_STRING_BUF_SIZE];
-  char product[DESC_STRING_BUF_SIZE];
-  char serial_number[DESC_STRING_BUF_SIZE];
-};
-
 enum ClientState {
   USB_CLIENT_INIT = 0,
   USB_CLIENT_OPEN,
@@ -158,10 +144,6 @@ class USBClient : public Component {
   bool control_transfer(uint8_t type, uint8_t request, uint16_t value, uint16_t index, const transfer_cb_t &callback,
                         const std::vector<uint8_t> &data = {});
 
-  /// Copy the connected device's identity out of the cached USB descriptors.
-  /// Returns false when no device is connected.
-  bool get_device_info(UsbDeviceInfo &info) const;
-
   // Lock-free event queue and pool for USB task to main loop communication
   // Must be public for access from static callbacks
   LockFreeQueue<UsbEvent, USB_EVENT_QUEUE_SIZE> event_queue;

esphome/components/usb_host/usb_host_client.cpp

@@ -143,8 +143,10 @@ static void usb_client_print_config_descriptor(const usb_config_desc_t *cfg_desc
   } while (next_desc != NULL);
 }
 #endif
-// bLength (uint8_t, max 255) includes the 2-byte header (bLength and bDescriptorType),
-// so character count = (bLength - 2) / 2.
+// USB string descriptors: bLength (uint8_t, max 255) includes the 2-byte header (bLength and bDescriptorType).
+// Character count = (bLength - 2) / 2, max 126 chars + null terminator.
+static constexpr size_t DESC_STRING_BUF_SIZE = 128;
+
 static const char *get_descriptor_string(const usb_str_desc_t *desc, std::span<char, DESC_STRING_BUF_SIZE> buffer) {
   if (desc == nullptr || desc->bLength < 2)
     return "(unspecified)";
@@ -160,41 +162,6 @@ static const char *get_descriptor_string(const usb_str_desc_t *desc, std::span<c
   return buffer.data();
 }
 
-// A missing descriptor copies as an empty string, unlike the "(unspecified)"
-// placeholder the logging helper above uses
-static void copy_descriptor_string(const usb_str_desc_t *desc, std::span<char, DESC_STRING_BUF_SIZE> buffer) {
-  buffer[0] = '\0';
-  if (desc == nullptr || desc->bLength < 2)
-    return;
-  int char_count = (desc->bLength - 2) / 2;
-  char *p = buffer.data();
-  char *end = p + buffer.size() - 1;
-  for (int i = 0; i != char_count && p < end; i++) {
-    auto c = desc->wData[i];
-    if (c < 0x100)
-      *p++ = static_cast<char>(c);
-  }
-  *p = '\0';
-}
-
-bool USBClient::get_device_info(UsbDeviceInfo &info) const {
-  if (this->state_ != USB_CLIENT_CONNECTED)
-    return false;
-  const usb_device_desc_t *desc;
-  if (usb_host_get_device_descriptor(this->device_handle_, &desc) != ESP_OK)
-    return false;
-  info.vendor_id = desc->idVendor;
-  info.product_id = desc->idProduct;
-  info.bcd_device = desc->bcdDevice;
-  usb_device_info_t dev_info;
-  if (usb_host_device_info(this->device_handle_, &dev_info) != ESP_OK)
-    return false;
-  copy_descriptor_string(dev_info.str_desc_manufacturer, info.manufacturer);
-  copy_descriptor_string(dev_info.str_desc_product, info.product);
-  copy_descriptor_string(dev_info.str_desc_serial_num, info.serial_number);
-  return true;
-}
-
 // CALLBACK CONTEXT: USB task (called from usb_host_client_handle_events in USB task)
 static void client_event_cb(const usb_host_client_event_msg_t *event_msg, void *ptr) {
   auto *client = static_cast<USBClient *>(ptr);

esphome/components/usb_uart/__init__.py

@@ -16,7 +16,7 @@ from esphome.const import (
     CONF_DUMMY_RECEIVER,
     CONF_ID,
 )
-from esphome.core import CORE, ID
+from esphome.core import CORE
 from esphome.cpp_types import Component
 from esphome.types import ConfigType
 
@@ -27,16 +27,6 @@ usb_uart_ns = cg.esphome_ns.namespace("usb_uart")
 USBUartComponent = usb_uart_ns.class_("USBUartComponent", Component)
 USBUartChannel = usb_uart_ns.class_("USBUartChannel", UARTComponent)
 
-
-def is_usb_uart_channel(uart_id: ID, full_config: ConfigType) -> bool:
-    """Return True if the given ID refers to a channel of a configured usb_uart device."""
-    return any(
-        channel[CONF_ID] == uart_id
-        for device in full_config.get("usb_uart") or []
-        for channel in device[CONF_CHANNELS]
-    )
-
-
 UARTParityOptions = usb_uart_ns.enum("UARTParityOptions")
 UART_PARITY_OPTIONS = {
     "NONE": UARTParityOptions.UART_CONFIG_PARITY_NONE,

esphome/components/usb_uart/usb_uart.cpp

@@ -434,11 +434,12 @@ void USBUartTypeCdcAcm::on_connected() {
       auto err_comm = usb_host_interface_claim(this->handle_, this->device_handle_,
                                                channel->cdc_dev_.interrupt_interface_number, 0);
       if (err_comm != ESP_OK) {
+        // Continue anyway: the interface number stays valid for CDC request addressing
         ESP_LOGW(TAG, "Could not claim comm interface %d: %s", channel->cdc_dev_.interrupt_interface_number,
                  esp_err_to_name(err_comm));
-        channel->cdc_dev_.interrupt_interface_number = 0xFF;  // Mark as unavailable, but continue anyway
       } else {
         ESP_LOGD(TAG, "Claimed comm interface %d", channel->cdc_dev_.interrupt_interface_number);
+        channel->cdc_dev_.interrupt_interface_claimed = true;
       }
     }
     auto err =
@@ -465,14 +466,15 @@ void USBUartTypeCdcAcm::on_disconnected() {
       usb_host_endpoint_halt(this->device_handle_, channel->cdc_dev_.out_ep->bEndpointAddress);
       usb_host_endpoint_flush(this->device_handle_, channel->cdc_dev_.out_ep->bEndpointAddress);
     }
-    if (channel->cdc_dev_.notify_ep != nullptr) {
+    // Only tear down the notify pipe when we claimed its interface ourselves;
+    // no transfer is ever submitted on it, so there is nothing else to cancel.
+    if (channel->cdc_dev_.notify_ep != nullptr && channel->cdc_dev_.interrupt_interface_claimed) {
       usb_host_endpoint_halt(this->device_handle_, channel->cdc_dev_.notify_ep->bEndpointAddress);
       usb_host_endpoint_flush(this->device_handle_, channel->cdc_dev_.notify_ep->bEndpointAddress);
     }
-    if (channel->cdc_dev_.interrupt_interface_number != 0xFF &&
-        channel->cdc_dev_.interrupt_interface_number != channel->cdc_dev_.bulk_interface_number) {
+    if (channel->cdc_dev_.interrupt_interface_claimed) {
       usb_host_interface_release(this->handle_, this->device_handle_, channel->cdc_dev_.interrupt_interface_number);
-      channel->cdc_dev_.interrupt_interface_number = 0xFF;
+      channel->cdc_dev_.interrupt_interface_claimed = false;
     }
     usb_host_interface_release(this->handle_, this->device_handle_, channel->cdc_dev_.bulk_interface_number);
     // Reset the input and output started flags to their initial state to avoid the possibility of spurious restarts

esphome/components/usb_uart/usb_uart.h

@@ -34,7 +34,10 @@ struct CdcEps {
   const usb_ep_desc_t *in_ep;
   const usb_ep_desc_t *out_ep;
   uint8_t bulk_interface_number;
+  // Also the wIndex target for CDC class requests (SET_LINE_CODING etc.), so it
+  // must remain valid even when the interface itself is not claimed.
   uint8_t interrupt_interface_number;
+  bool interrupt_interface_claimed{false};
 };
 
 enum CH34xChipType : uint8_t {
@@ -164,9 +167,6 @@ class USBUartChannelBase : public uart::UARTComponent, public Parented<USBUartCo
   /// they arrive, eliminating one full main-loop-wakeup cycle of latency.
   void set_rx_callback(std::function<void()> cb) { this->rx_callback_ = std::move(cb); }
 
-  /// Channel index on the bridge (interface number on multi-port bridges)
-  uint8_t get_index() const { return this->index_; }
-
  protected:
   // Not directly instantiable; construct a concrete channel type instead.
   USBUartChannelBase(uint8_t index, uint16_t buffer_size) : input_buffer_(RingBuffer(buffer_size)), index_(index) {}

esphome/components/zigbee_proxy/__init__.py

@@ -1,80 +0,0 @@
-import esphome.codegen as cg
-from esphome.components import serial_proxy
-import esphome.config_validation as cv
-from esphome.const import CONF_BUFFER_SIZE, CONF_ID, CONF_POWER_SAVE_MODE, CONF_WIFI
-import esphome.final_validate as fv
-
-CODEOWNERS = ["@kbx81"]
-DEPENDENCIES = ["api", "serial_proxy"]
-
-CONF_INITIAL_TIMEOUT = "initial_timeout"
-CONF_MIN_TIMEOUT = "min_timeout"
-CONF_MAX_TIMEOUT = "max_timeout"
-CONF_SERIAL_PROXY_ID = "serial_proxy_id"
-
-# Default ACK timeout values for the boot-time metadata harvest
-_DEFAULT_INITIAL_TIMEOUT = 1600
-_DEFAULT_MIN_TIMEOUT = 400
-_DEFAULT_MAX_TIMEOUT = 3200
-
-zigbee_proxy_ns = cg.esphome_ns.namespace("zigbee_proxy")
-ZigbeeProxy = zigbee_proxy_ns.class_(
-    "ZigbeeProxy", cg.Component, serial_proxy.SerialProxyTap
-)
-
-
-def final_validate(config):
-    full_config = fv.full_config.get()
-    if (wifi_conf := full_config.get(CONF_WIFI)) and (
-        wifi_conf.get(CONF_POWER_SAVE_MODE, "").lower() != "none"
-    ):
-        raise cv.Invalid(
-            f"{CONF_WIFI} {CONF_POWER_SAVE_MODE} must be set to 'none' when using Zigbee proxy"
-        )
-    return config
-
-
-CONFIG_SCHEMA = cv.All(
-    cv.Schema(
-        {
-            cv.GenerateID(): cv.declare_id(ZigbeeProxy),
-            cv.Required(CONF_SERIAL_PROXY_ID): cv.use_id(serial_proxy.SerialProxy),
-            cv.Optional(CONF_BUFFER_SIZE): cv.SplitDefault(
-                cv.int_range(min=256, max=2048),
-                esp8266=512,
-                default=1024,
-            ),
-            cv.Optional(
-                CONF_INITIAL_TIMEOUT, default=_DEFAULT_INITIAL_TIMEOUT
-            ): cv.int_range(min=10, max=10000),
-            cv.Optional(CONF_MIN_TIMEOUT, default=_DEFAULT_MIN_TIMEOUT): cv.int_range(
-                min=10, max=5000
-            ),
-            cv.Optional(CONF_MAX_TIMEOUT, default=_DEFAULT_MAX_TIMEOUT): cv.int_range(
-                min=50, max=10000
-            ),
-        }
-    ).extend(cv.COMPONENT_SCHEMA),
-)
-
-FINAL_VALIDATE_SCHEMA = final_validate
-
-
-async def to_code(config):
-    var = cg.new_Pvariable(config[CONF_ID])
-    await cg.register_component(var, config)
-
-    sp = await cg.get_variable(config[CONF_SERIAL_PROXY_ID])
-    cg.add(var.set_serial_proxy(sp))
-
-    cg.add_define("USE_ZIGBEE_PROXY")
-    # Compiles the tap interface into serial_proxy; without it the port is a plain byte pipe
-    cg.add_define("USE_SERIAL_PROXY_TAP")
-
-    # Set buffer size via define for compile-time allocation
-    if CONF_BUFFER_SIZE in config:
-        cg.add_define("ZIGBEE_PROXY_BUFFER_SIZE", config[CONF_BUFFER_SIZE])
-
-    cg.add(var.set_initial_timeout(config[CONF_INITIAL_TIMEOUT]))
-    cg.add(var.set_min_timeout(config[CONF_MIN_TIMEOUT]))
-    cg.add(var.set_max_timeout(config[CONF_MAX_TIMEOUT]))

esphome/components/zigbee_proxy/ash_detector.cpp

@@ -1,256 +0,0 @@
-#include "ash_detector.h"
-
-#ifdef USE_ZIGBEE_PROXY
-
-namespace esphome::zigbee_proxy {
-
-// Control byte of an RSTACK, and the only ASH version byte that can follow it
-static constexpr uint8_t ASH_RSTACK_CONTROL = 0xC1;
-static constexpr uint8_t ASH_PROTOCOL_VERSION = 0x02;
-static constexpr size_t ASH_RSTACK_BODY_SIZE = 3;  // control, version, reset code
-static constexpr size_t ASH_CRC_SIZE = 2;
-// Smallest legal frame on the wire: a bare control byte plus its CRC
-static constexpr size_t ASH_MIN_FRAME_SIZE = 1 + ASH_CRC_SIZE;
-
-// The opening EZSP version command is a constant: control 0x00 (frmNum 0, ackNum 0)
-// followed by [seq=0][frameControl=0][frameId=0] randomized by 0x42 0x21 0xA8. Only the
-// requested version varies, as version ^ 0x54, so it can be recovered for free.
-static constexpr uint8_t EZSP_VERSION_CMD_PREFIX[] = {0x00, 0x42, 0x21, 0xA8};
-static constexpr size_t EZSP_VERSION_CMD_SIZE = 5;
-static constexpr uint8_t EZSP_VERSION_RANDOM_MASK = 0x54;
-
-// Consecutive frames we could not accept, with neither a good frame nor a retransmission
-// in between, before concluding the peer is no longer speaking ASH. A real ASH peer must
-// retransmit an unacknowledged frame, so the absence of one is the positive evidence
-// here -- garbage on the line is not, since noise proves nothing either way.
-static constexpr uint8_t MAX_UNCONFIRMED_REJECTS = 4;
-
-bool ash_reset_code_is_known(uint8_t code) {
-  switch (code) {
-    case 0x00:  // RESET_UNKNOWN
-    case 0x01:  // RESET_EXTERNAL
-    case 0x02:  // RESET_POWER_ON
-    case 0x03:  // RESET_WATCHDOG
-    case 0x06:  // RESET_ASSERT
-    case 0x09:  // RESET_BOOTLOADER
-    case 0x0B:  // RESET_SOFTWARE
-    case 0x51:  // ERROR_EXCEEDED_MAXIMUM_ACK_TIMEOUT_COUNT
-    case 0x80:  // ERROR_CHIP_SPECIFIC
-    case 0x81:  // RESET_CHIP_SPECIFIC
-      return true;
-    default:
-      return false;
-  }
-}
-
-void AshFrameScanner::begin_frame_() {
-  this->index_ = 0;
-  this->crc_ = ASH_CRC_INIT;
-  this->escaped_ = false;
-  this->poisoned_ = false;
-}
-
-void AshFrameScanner::reset() {
-  this->begin_frame_();
-  this->frame_length_ = 0;
-  this->discarding_ = false;
-}
-
-ScanResult AshFrameScanner::feed(uint8_t byte) {
-  if (byte == ASH_FLAG_BYTE) {
-    // Snapshot everything the verdict depends on: begin_frame_() clears all of it.
-    const bool discarding = this->discarding_;
-    const bool poisoned = this->poisoned_;
-    const bool escaped = this->escaped_;
-    const size_t index = this->index_;
-    const uint16_t crc = this->crc_;
-    // A FLAG always starts the next frame afresh, whatever preceded it
-    this->begin_frame_();
-    this->discarding_ = false;
-
-    if (discarding || index == 0) {
-      // Consecutive delimiters carry no frame at all, so there is nothing to judge
-      this->frame_length_ = 0;
-      return ScanResult::NONE;
-    }
-    // Running the CRC over the body *and* its trailing CRC bytes leaves zero when
-    // correct, so validity needs no second pass over the frame.
-    if (poisoned || escaped || index < ASH_MIN_FRAME_SIZE || crc != 0) {
-      this->frame_length_ = 0;
-      return ScanResult::INVALID;
-    }
-    this->frame_length_ = index - ASH_CRC_SIZE;
-    return ScanResult::FRAME;
-  }
-
-  if (this->discarding_) {
-    return ScanResult::NONE;
-  }
-
-  switch (byte) {
-    case ASH_CANCEL_BYTE:
-      // Everything received since the last FLAG is to be ignored
-      this->begin_frame_();
-      return ScanResult::NONE;
-
-    case ASH_SUBSTITUTE_BYTE:
-      // A low-level error was flagged; ignore everything up to the next FLAG
-      this->discarding_ = true;
-      return ScanResult::NONE;
-
-    case ASH_XON_BYTE:
-    case ASH_XOFF_BYTE:
-      // Transport flow control, not frame content: skip it without disturbing the frame
-      return ScanResult::NONE;
-
-    case ASH_ESCAPE_BYTE:
-      this->escaped_ = true;
-      return ScanResult::NONE;
-
-    default:
-      break;
-  }
-
-  uint8_t value = byte;
-  if (this->escaped_) {
-    this->escaped_ = false;
-    value = byte ^ ASH_XOR_BYTE;
-    // An escape must decode to a reserved byte; anything else is not ASH framing at all
-    if (!ash_is_reserved(value)) {
-      this->poisoned_ = true;
-      return ScanResult::NONE;
-    }
-  }
-
-  if (this->index_ >= sizeof(this->buffer_)) {
-    this->poisoned_ = true;
-    return ScanResult::NONE;
-  }
-
-  this->buffer_[this->index_++] = value;
-  this->crc_ = ash_crc16(&value, 1, this->crc_);
-  return ScanResult::NONE;
-}
-
-void AshDetector::reset() {
-  this->ncp_scanner_.reset();
-  this->host_scanner_.reset();
-  this->state_ = AshDetectState::IDLE;
-  this->rx_sequence_ = 0;
-  this->ack_owed_ = false;
-  this->data_frame_ready_ = false;
-  this->unconfirmed_rejects_ = 0;
-  this->negotiated_version_ = 0;
-}
-
-void AshDetector::from_ncp(uint8_t byte) {
-  this->data_frame_ready_ = false;
-  switch (this->ncp_scanner_.feed(byte)) {
-    case ScanResult::FRAME:
-      this->handle_ncp_frame_();
-      break;
-    case ScanResult::INVALID:
-      // A delimited chunk that is not a frame. While armed this may be a corrupted ASH
-      // frame, which the peer will retransmit, or a sign the peer stopped speaking ASH.
-      // reject_() distinguishes the two by whether a retransmission ever arrives.
-      this->reject_();
-      break;
-    case ScanResult::NONE:
-      break;
-  }
-}
-
-void AshDetector::handle_ncp_frame_() {
-  const uint8_t *body = this->ncp_scanner_.frame();
-  const size_t length = this->ncp_scanner_.length();
-  const uint8_t control = body[0];
-
-  // RSTACK is the only way into the handshake, and the only way back after a firmware
-  // swap: a Spinel or bootloader NCP never emits one, so those stay unarmed forever.
-  if (control == ASH_RSTACK_CONTROL) {
-    if (length == ASH_RSTACK_BODY_SIZE && body[1] == ASH_PROTOCOL_VERSION && ash_reset_code_is_known(body[2])) {
-      this->state_ = AshDetectState::SAW_RSTACK;
-      this->rx_sequence_ = 0;
-      this->ack_owed_ = false;
-      this->unconfirmed_rejects_ = 0;
-    }
-    return;
-  }
-
-  if (this->state_ != AshDetectState::ARMED) {
-    return;
-  }
-
-  if ((control & 0x80) != 0) {
-    return;  // ACK/NAK/RST/ERROR: nothing is owed for these
-  }
-
-  const uint8_t frame_num = (control >> 4) & ASH_MAX_SEQUENCE;
-  const bool re_tx = (control & 0x08) != 0;
-
-  if (frame_num != this->rx_sequence_) {
-    // A retransmission still proves the peer is speaking ASH even though we cannot use
-    // this copy, so it clears the suspicion without being acknowledged.
-    if (re_tx) {
-      this->unconfirmed_rejects_ = 0;
-    } else {
-      this->reject_();
-    }
-    return;
-  }
-
-  this->rx_sequence_ = (this->rx_sequence_ + 1) & ASH_MAX_SEQUENCE;
-  this->pending_ack_ = this->rx_sequence_;
-  this->ack_owed_ = true;
-  this->data_frame_ready_ = true;
-  this->unconfirmed_rejects_ = 0;
-}
-
-void AshDetector::reject_() {
-  if (this->state_ != AshDetectState::ARMED) {
-    return;
-  }
-  if (++this->unconfirmed_rejects_ >= MAX_UNCONFIRMED_REJECTS) {
-    this->state_ = AshDetectState::IDLE;
-    this->unconfirmed_rejects_ = 0;
-  }
-}
-
-void AshDetector::from_host(uint8_t byte) {
-  if (this->host_scanner_.feed(byte) != ScanResult::FRAME) {
-    return;
-  }
-
-  if (this->state_ != AshDetectState::SAW_RSTACK) {
-    return;
-  }
-
-  const uint8_t *body = this->host_scanner_.frame();
-  if (this->host_scanner_.length() != EZSP_VERSION_CMD_SIZE) {
-    return;
-  }
-  for (size_t i = 0; i < sizeof(EZSP_VERSION_CMD_PREFIX); i++) {
-    if (body[i] != EZSP_VERSION_CMD_PREFIX[i]) {
-      return;
-    }
-  }
-
-  this->negotiated_version_ = body[4] ^ EZSP_VERSION_RANDOM_MASK;
-  this->state_ = AshDetectState::ARMED;
-  this->rx_sequence_ = 0;
-  this->ack_owed_ = false;
-  this->unconfirmed_rejects_ = 0;
-}
-
-bool AshDetector::take_pending_ack(uint8_t &ack_num) {
-  if (!this->ack_owed_) {
-    return false;
-  }
-  this->ack_owed_ = false;
-  ack_num = this->pending_ack_;
-  return true;
-}
-
-}  // namespace esphome::zigbee_proxy
-
-#endif  // USE_ZIGBEE_PROXY

esphome/components/zigbee_proxy/ash_detector.h

@@ -1,118 +0,0 @@
-#pragma once
-
-#include "esphome/core/defines.h"
-#ifdef USE_ZIGBEE_PROXY
-
-#include "ash_protocol.h"
-
-#include <cstddef>
-#include <cstdint>
-
-namespace esphome::zigbee_proxy {
-
-// Decides when it is safe to acknowledge NCP frames on a client's behalf.
-//
-// The client suppresses its own ACKs, so nobody else will send them, and injecting ASH
-// bytes into a stream that is not ASH would corrupt it. Detection is therefore one-sided:
-// arm only on the session handshake, which is a fixed byte string, and never on frame
-// validity, which non-ASH traffic can satisfy by luck.
-//
-//   RSTACK  (NCP -> host)   c1 02 <reset_code> <crc> 7e
-//   version (host -> NCP)   00 42 21 a8 <version^0x54> <crc> 7e
-//
-// Requiring both, in that order, in opposite directions cannot be satisfied by a
-// unidirectional byte stream whatever it contains -- which is exactly the situation
-// during a firmware upload. Verified against real .gbl images and real Spinel traffic:
-// zero false arms, and neither pattern occurs even as a substring.
-//
-// Getting it wrong in the other direction is cheap: a frame we decline to acknowledge is
-// retransmitted by the NCP, so we see a clean copy and lose only the ack timeout. That
-// asymmetry is why this errs towards silence everywhere.
-
-enum class AshDetectState : uint8_t {
-  IDLE,        // Not ASH, or not yet proven to be
-  SAW_RSTACK,  // Handshake half-complete; watching for the version command
-  ARMED,       // Session confirmed; acknowledging on the client's behalf
-};
-
-enum class ScanResult : uint8_t {
-  NONE,     // Mid-frame, or a delimiter that carried nothing
-  FRAME,    // frame()/length() hold a complete body with a verified CRC
-  INVALID,  // A delimited chunk arrived but was not a well-formed ASH frame
-};
-
-// Reassembles one direction of the byte stream into unstuffed, CRC-checked frames.
-// Mirrors bellows' AshProtocol.data_received: FLAG ends a frame, CANCEL discards what
-// precedes it, SUBSTITUTE poisons everything up to the next FLAG, and XON/XOFF are
-// transport flow control removed without disturbing the frame around them.
-class AshFrameScanner {
- public:
-  ScanResult feed(uint8_t byte);
-  void reset();
-
-  // Valid only until the next feed() call, which begins overwriting the buffer.
-  const uint8_t *frame() const { return this->buffer_; }
-  size_t length() const { return this->frame_length_; }
-
- private:
-  void begin_frame_();
-
-  // Frames are bounded by the ASH maximum, so a stream carrying no delimiters cannot
-  // grow the buffer without limit; it just keeps failing.
-  uint8_t buffer_[MAX_ASH_FRAME_SIZE];
-  size_t index_{0};         // accumulation position for the frame being read
-  size_t frame_length_{0};  // body length of the last completed frame
-  uint16_t crc_{ASH_CRC_INIT};
-  bool escaped_{false};
-  bool discarding_{false};
-  bool poisoned_{false};
-};
-
-class AshDetector {
- public:
-  void reset();
-
-  // Feed observed traffic. Neither call gates forwarding: the detector only watches.
-  void from_ncp(uint8_t byte);
-  void from_host(uint8_t byte);
-
-  bool armed() const { return this->state_ == AshDetectState::ARMED; }
-
-  // True only while the host direction can affect the state machine, i.e. while waiting
-  // for the version command. Lets the caller skip scanning that direction entirely the
-  // rest of the time -- it is the one carrying firmware uploads.
-  bool needs_host_scan() const { return this->state_ == AshDetectState::SAW_RSTACK; }
-
-  // An acknowledgement became owed after the last from_ncp() call. Clears the flag.
-  bool take_pending_ack(uint8_t &ack_num);
-
-  // The EZSP frame carried by the DATA frame just accepted, for metadata sniffing. The
-  // ASH control byte is skipped, so offset 0 is the EZSP sequence number. Still
-  // randomized, and valid only until the next from_ncp() call.
-  const uint8_t *last_ezsp_frame() const { return this->ncp_scanner_.frame() + 1; }
-  size_t last_ezsp_frame_length() const {
-    const size_t length = this->ncp_scanner_.length();
-    return length > 0 ? length - 1 : 0;
-  }
-
-  AshDetectState state() const { return this->state_; }
-  uint8_t negotiated_version() const { return this->negotiated_version_; }
-
- protected:
-  void handle_ncp_frame_();
-  void reject_();
-
-  AshFrameScanner ncp_scanner_;
-  AshFrameScanner host_scanner_;
-  AshDetectState state_{AshDetectState::IDLE};
-  uint8_t rx_sequence_{0};
-  uint8_t pending_ack_{0};
-  bool ack_owed_{false};
-  bool data_frame_ready_{false};
-  uint8_t unconfirmed_rejects_{0};
-  uint8_t negotiated_version_{0};
-};
-
-}  // namespace esphome::zigbee_proxy
-
-#endif  // USE_ZIGBEE_PROXY

esphome/components/zigbee_proxy/ash_protocol.cpp

@@ -1,444 +0,0 @@
-#include "zigbee_proxy.h"
-
-#ifdef USE_ZIGBEE_PROXY
-
-#include "esphome/core/log.h"
-#include "esphome/core/helpers.h"
-
-namespace esphome::zigbee_proxy {
-
-static const char *const TAG = "zigbee_proxy";
-
-static constexpr size_t ASH_MAX_LOG_BYTES = 168;  // Cap verbose hex dumps (168 * 3 = 504 byte buffer)
-
-// CRC-CCITT lookup table for polynomial 0x1021 (x^16 + x^12 + x^5 + 1)
-static const uint16_t CRC_TABLE[256] = {
-    0x0000, 0x1021, 0x2042, 0x3063, 0x4084, 0x50A5, 0x60C6, 0x70E7, 0x8108, 0x9129, 0xA14A, 0xB16B, 0xC18C, 0xD1AD,
-    0xE1CE, 0xF1EF, 0x1231, 0x0210, 0x3273, 0x2252, 0x52B5, 0x4294, 0x72F7, 0x62D6, 0x9339, 0x8318, 0xB37B, 0xA35A,
-    0xD3BD, 0xC39C, 0xF3FF, 0xE3DE, 0x2462, 0x3443, 0x0420, 0x1401, 0x64E6, 0x74C7, 0x44A4, 0x5485, 0xA56A, 0xB54B,
-    0x8528, 0x9509, 0xE5EE, 0xF5CF, 0xC5AC, 0xD58D, 0x3653, 0x2672, 0x1611, 0x0630, 0x76D7, 0x66F6, 0x5695, 0x46B4,
-    0xB75B, 0xA77A, 0x9719, 0x8738, 0xF7DF, 0xE7FE, 0xD79D, 0xC7BC, 0x48C4, 0x58E5, 0x6886, 0x78A7, 0x0840, 0x1861,
-    0x2802, 0x3823, 0xC9CC, 0xD9ED, 0xE98E, 0xF9AF, 0x8948, 0x9969, 0xA90A, 0xB92B, 0x5AF5, 0x4AD4, 0x7AB7, 0x6A96,
-    0x1A71, 0x0A50, 0x3A33, 0x2A12, 0xDBFD, 0xCBDC, 0xFBBF, 0xEB9E, 0x9B79, 0x8B58, 0xBB3B, 0xAB1A, 0x6CA6, 0x7C87,
-    0x4CE4, 0x5CC5, 0x2C22, 0x3C03, 0x0C60, 0x1C41, 0xEDAE, 0xFD8F, 0xCDEC, 0xDDCD, 0xAD2A, 0xBD0B, 0x8D68, 0x9D49,
-    0x7E97, 0x6EB6, 0x5ED5, 0x4EF4, 0x3E13, 0x2E32, 0x1E51, 0x0E70, 0xFF9F, 0xEFBE, 0xDFDD, 0xCFFC, 0xBF1B, 0xAF3A,
-    0x9F59, 0x8F78, 0x9188, 0x81A9, 0xB1CA, 0xA1EB, 0xD10C, 0xC12D, 0xF14E, 0xE16F, 0x1080, 0x00A1, 0x30C2, 0x20E3,
-    0x5004, 0x4025, 0x7046, 0x6067, 0x83B9, 0x9398, 0xA3FB, 0xB3DA, 0xC33D, 0xD31C, 0xE37F, 0xF35E, 0x02B1, 0x1290,
-    0x22F3, 0x32D2, 0x4235, 0x5214, 0x6277, 0x7256, 0xB5EA, 0xA5CB, 0x95A8, 0x8589, 0xF56E, 0xE54F, 0xD52C, 0xC50D,
-    0x34E2, 0x24C3, 0x14A0, 0x0481, 0x7466, 0x6447, 0x5424, 0x4405, 0xA7DB, 0xB7FA, 0x8799, 0x97B8, 0xE75F, 0xF77E,
-    0xC71D, 0xD73C, 0x26D3, 0x36F2, 0x0691, 0x16B0, 0x6657, 0x7676, 0x4615, 0x5634, 0xD94C, 0xC96D, 0xF90E, 0xE92F,
-    0x99C8, 0x89E9, 0xB98A, 0xA9AB, 0x5844, 0x4865, 0x7806, 0x6827, 0x18C0, 0x08E1, 0x3882, 0x28A3, 0xCB7D, 0xDB5C,
-    0xEB3F, 0xFB1E, 0x8BF9, 0x9BD8, 0xABBB, 0xBB9A, 0x4A75, 0x5A54, 0x6A37, 0x7A16, 0x0AF1, 0x1AD0, 0x2AB3, 0x3A92,
-    0xFD2E, 0xED0F, 0xDD6C, 0xCD4D, 0xBDAA, 0xAD8B, 0x9DE8, 0x8DC9, 0x7C26, 0x6C07, 0x5C64, 0x4C45, 0x3CA2, 0x2C83,
-    0x1CE0, 0x0CC1, 0xEF1F, 0xFF3E, 0xCF5D, 0xDF7C, 0xAF9B, 0xBFBA, 0x8FD9, 0x9FF8, 0x6E17, 0x7E36, 0x4E55, 0x5E74,
-    0x2E93, 0x3EB2, 0x0ED1, 0x1EF0};
-
-void ash_randomize(uint8_t *data, size_t length) {
-  uint8_t rand = 0x42;
-  for (size_t i = 0; i < length; i++) {
-    data[i] ^= rand;
-    rand = (rand & 0x01) ? static_cast<uint8_t>((rand >> 1) ^ 0xB8) : static_cast<uint8_t>(rand >> 1);
-  }
-}
-
-uint16_t ash_crc16(const uint8_t *data, size_t length, uint16_t init) {
-  uint16_t crc = init;
-  for (size_t i = 0; i < length; i++) {
-    crc = (crc << 8) ^ CRC_TABLE[(crc >> 8) ^ data[i]];
-  }
-  return crc;
-}
-
-uint16_t ZigbeeProxy::calculate_crc_(const uint8_t *data, size_t length, uint16_t init) {
-  return ash_crc16(data, length, init);
-}
-
-bool ZigbeeProxy::validate_frame_crc_() {
-  // CRC is calculated over control byte + data
-  // rx_buffer_[0] contains control byte, rx_buffer_[1..rx_buffer_index_-3] contains data
-  // rx_buffer_[rx_buffer_index_-2] and rx_buffer_[rx_buffer_index_-1] contain CRC
-  if (this->rx_buffer_index_ < 3) {
-    // Frame too short to contain CRC
-    return false;
-  }
-
-  // Calculate CRC over control + data (exclude CRC bytes)
-  uint16_t calculated = this->calculate_crc_(this->rx_buffer_.data(), this->rx_buffer_index_ - 2);
-
-  // Extract received CRC (big-endian)
-  uint16_t received = (static_cast<uint16_t>(this->rx_buffer_[this->rx_buffer_index_ - 2]) << 8) |
-                      this->rx_buffer_[this->rx_buffer_index_ - 1];
-
-  if (calculated != received) {
-    ESP_LOGW(TAG, "CRC validation failed: calculated=0x%04X, received=0x%04X", calculated, received);
-    return false;
-  }
-
-  return true;
-}
-
-bool ZigbeeProxy::handle_ack_num_(uint8_t ack_num) {
-  // ackNum means "I expect frame N next", i.e. everything up to N-1 arrived, so a
-  // pending frame numbered ack_num-1 has been acknowledged. Carried by DATA, ACK
-  // and NAK alike.
-  if (!this->tx_buffer_pending_ || ack_num != ((this->tx_pending_frame_num_ + 1) & ASH_MAX_SEQUENCE)) {
-    return false;
-  }
-
-  uint32_t rtt = millis() - this->ack_timer_start_;
-  this->update_adaptive_timeout_(rtt);
-  ESP_LOGV(TAG, "Frame %d acknowledged, RTT: %u ms", this->tx_pending_frame_num_, rtt);
-  this->clear_tx_buffer_();
-  return true;
-}
-
-void ZigbeeProxy::parse_control_byte_(uint8_t control) {
-  // Decode frame type based on bit patterns:
-  // DATA:  0xxxxxxx (bit 7 = 0)
-  // ACK:   10x0xxxx (bits 7-6 = 10, bit 5 = 0)
-  // NAK:   10x1xxxx (bits 7-6 = 10, bit 5 = 1)
-  // RST:   11000000 (0xC0)
-  // RSTACK: 11000001 (0xC1)
-  // ERROR: 11000010 (0xC2)
-
-  AshFrameType frame_type;
-  if ((control & 0x80) == 0) {
-    // Bit 7 = 0: DATA frame
-    frame_type = AshFrameType::DATA;
-  } else if ((control & 0xC0) == 0x80) {
-    // Bits 7-6 = 10: ACK or NAK
-    // ACK format: 100nrPPP (bit 5 = 0)
-    // NAK format: 101nrPPP (bit 5 = 1)
-    if ((control & 0x20) == 0) {
-      frame_type = AshFrameType::ACK;
-    } else {
-      frame_type = AshFrameType::NAK;
-    }
-  } else {
-    // Bits 7-6 = 11: control frames (RST, RSTACK, ERROR)
-    uint8_t control_bits = control & 0x07;
-    if (control_bits == 0x00) {
-      frame_type = AshFrameType::RST;
-    } else if (control_bits == 0x01) {
-      frame_type = AshFrameType::RSTACK;
-    } else if (control_bits == 0x02) {
-      frame_type = AshFrameType::ERROR;
-    } else {
-      ESP_LOGW(TAG, "Unknown control frame type: 0x%02X", control);
-      return;
-    }
-  }
-
-  // Extract sequence numbers from DATA frame format: 0ffrPPPP
-  // Bits 6-4 = frmNum, bit 3 = reTx, bits 2-0 = ackNum
-  uint8_t frame_num = (control >> 4) & 0x07;  // Bits 6-4
-  uint8_t ack_num = control & 0x07;           // Bits 2-0
-  bool retx = (control & 0x08) != 0;          // Bit 3 (for DATA frames)
-
-  ESP_LOGV(TAG, "Parsed control byte: type=%d, frmNum=%d, ackNum=%d, reTx=%d", static_cast<int>(frame_type), frame_num,
-           ack_num, retx);
-
-  // Handle frame based on type
-  switch (frame_type) {
-    case AshFrameType::DATA: {
-      // Process the piggybacked ACK first: ackNum is valid regardless of the DATA
-      // frame's own sequence ordering
-      if (this->handle_ack_num_(ack_num)) {
-        ESP_LOGV(TAG, "ACK received (piggybacked in DATA)");
-      }
-
-      // Check sequence number
-      if (frame_num != this->rx_sequence_) {
-        if (retx && frame_num == ((this->rx_sequence_ - 1) & ASH_MAX_SEQUENCE)) {
-          // Retransmission of a frame we already ACKed (our ACK was lost) - re-ACK and discard
-          ESP_LOGV(TAG, "Duplicate DATA frame %d, re-sending ACK", frame_num);
-          this->send_ack_frame_(this->rx_sequence_);
-        } else {
-          ESP_LOGW(TAG, "Out of sequence DATA frame: expected %d, got %d", this->rx_sequence_, frame_num);
-          this->send_nak_frame_(this->rx_sequence_);
-        }
-        return;
-      }
-
-      // Increment RX sequence and send ACK (ack_num = next expected frame)
-      this->increment_rx_sequence_();
-      this->send_ack_frame_(this->rx_sequence_);
-
-      // Extract payload (skip control byte, exclude CRC)
-      size_t payload_length = this->rx_buffer_index_ > 3 ? this->rx_buffer_index_ - 3 : 0;
-      const uint8_t *payload = this->rx_buffer_.data() + 1;
-
-      // This path only runs during the boot harvest, where this component is the ASH
-      // endpoint and consumes frames itself, so they must be derandomized. A subscribed
-      // client is served by the transparent relay instead, which never reaches here.
-      if (payload_length > 0) {
-        ash_randomize(this->rx_buffer_.data() + 1, payload_length);
-        this->handle_boot_data_frame_(payload, payload_length);
-      }
-      break;
-    }
-
-    case AshFrameType::ACK:
-      this->handle_ack_num_(ack_num);
-      break;
-
-    case AshFrameType::NAK:
-      // A NAK carries valid ACK information like any other frame: ackNum is the
-      // next frame the NCP expects, so everything before it did arrive. Honour
-      // that first -- retransmitting an already-acknowledged frame otherwise
-      // burns all ASH_MAX_RETRIES and drops the link. bellows applies the same
-      // ACK handling to DATA, ACK and NAK alike.
-      if (this->handle_ack_num_(ack_num)) {
-        ESP_LOGW(TAG, "NAK received for frame %d (already acknowledged, not retransmitting)", ack_num);
-        break;
-      }
-      ESP_LOGW(TAG, "NAK received for frame %d, retransmitting", ack_num);
-      if (this->tx_buffer_pending_) {
-        this->handle_retransmission_();
-      }
-      break;
-
-    case AshFrameType::RST: {
-      // An NCP never sends RST in normal operation; treat it as a reset indication
-      // and run the RSTACK handling to resynchronize state (nothing is transmitted here)
-      ESP_LOGW(TAG, "Received unexpected RST frame from NCP, resynchronizing");
-      uint8_t rstack_data[] = {0x02, 0x01, 0x00};  // Synthesized RSTACK payload
-      this->handle_rstack_frame_(rstack_data, sizeof(rstack_data));
-      break;
-    }
-
-    case AshFrameType::RSTACK:
-      this->handle_rstack_frame_(this->rx_buffer_.data() + 1, this->rx_buffer_index_ - 3);
-      break;
-
-    case AshFrameType::ERROR:
-      this->handle_error_frame_(this->rx_buffer_.data() + 1, this->rx_buffer_index_ - 3);
-      break;
-  }
-}
-
-bool ZigbeeProxy::parse_byte_(uint8_t byte) {
-  static constexpr uint8_t ASH_CAN_BYTE = 0x1A;
-  static constexpr uint8_t ASH_XON_BYTE = 0x11;
-  static constexpr uint8_t ASH_XOFF_BYTE = 0x13;
-
-  // Reserved bytes are only meaningful when they appear *bare* in the stream, so
-  // they must be filtered here, before unescaping, and never afterwards. A frame
-  // whose control or data byte happens to equal one of them arrives stuffed (0x11
-  // is sent as 7D 31), and unescaping yields the real value -- so filtering after
-  // unescaping silently eats a valid control byte, shifting the whole frame by one
-  // and failing CRC on every retransmission. This mirrors bellows, which strips
-  // flow control from the raw buffer and only then unstuffs.
-  if (!this->escape_next_byte_) {
-    if (byte == ASH_CAN_BYTE) {
-      // Cancel: discard any partial frame
-      this->rx_buffer_index_ = 0;
-      this->parsing_state_ = ParsingState::WAIT_FLAG_START;
-      return false;
-    }
-    if (byte == ASH_XON_BYTE || byte == ASH_XOFF_BYTE) {
-      // Flow control: not part of any frame, may appear anywhere
-      return false;
-    }
-  }
-
-  switch (this->parsing_state_) {
-    case ParsingState::WAIT_FLAG_START:
-      // Handle escape sequences - NCP may send escaped control byte at frame start
-      if (byte == ASH_ESCAPE_BYTE) {
-        this->escape_next_byte_ = true;
-        return false;
-      }
-
-      if (this->escape_next_byte_) {
-        byte ^= ASH_XOR_BYTE;
-        this->escape_next_byte_ = false;
-      }
-
-      if (byte == ASH_FLAG_BYTE) {
-        // Start of frame with FLAG delimiter
-        this->rx_buffer_index_ = 0;
-        this->escape_next_byte_ = false;
-        this->parsing_state_ = ParsingState::WAIT_CONTROL;
-        ESP_LOGV(TAG, "Frame start detected (FLAG)");
-      } else if (this->ash_state_ == AshState::CONNECTED) {
-        // When connected, NCP often omits leading FLAG on responses
-        // Any byte could be a control byte:
-        //   - DATA frames: 0x00-0x7F (bit 7 = 0)
-        //   - ACK frames:  0x80-0x9F (bits 7-6 = 10, bit 5 = 0)
-        //   - NAK frames:  0xA0-0xBF (bits 7-6 = 10, bit 5 = 1)
-        //   - RST/RSTACK/ERROR: 0xC0-0xC2 (bits 7-6 = 11)
-        // Bare flow-control bytes were already filtered above, so anything
-        // reaching here is genuine frame content.
-        this->rx_buffer_index_ = 0;
-        this->rx_buffer_[this->rx_buffer_index_++] = byte;
-        this->parsing_state_ = ParsingState::WAIT_DATA;
-        ESP_LOGV(TAG, "Frame start detected (control byte 0x%02X)", byte);
-      } else if ((byte & 0x80) != 0) {
-        // Before connected, only accept control/management frames (bit 7 set)
-        // This handles RSTACK (0xC1), ACK (0x8X), NAK (0xAX), ERROR (0xC2)
-        this->rx_buffer_index_ = 0;
-        this->rx_buffer_[this->rx_buffer_index_++] = byte;
-        this->parsing_state_ = ParsingState::WAIT_DATA;
-        ESP_LOGV(TAG, "Frame start detected (control byte 0x%02X)", byte);
-      }
-      break;
-
-    case ParsingState::WAIT_CONTROL:
-      if (byte == ASH_FLAG_BYTE) {
-        // Empty frame or repeated FLAG
-        ESP_LOGV(TAG, "Empty frame or repeated FLAG, restarting");
-        this->rx_buffer_index_ = 0;
-        return false;
-      }
-
-      if (byte == ASH_ESCAPE_BYTE) {
-        this->escape_next_byte_ = true;
-        return false;
-      }
-
-      if (this->escape_next_byte_) {
-        byte ^= ASH_XOR_BYTE;
-        this->escape_next_byte_ = false;
-      }
-
-      // Store control byte
-      this->rx_buffer_[this->rx_buffer_index_++] = byte;
-      this->parsing_state_ = ParsingState::WAIT_DATA;
-      break;
-
-    case ParsingState::WAIT_DATA:
-      if (byte == ASH_FLAG_BYTE) {
-        // End of frame - validate and process
-        ESP_LOGV(TAG, "Frame complete, %u bytes in buffer", this->rx_buffer_index_);
-        if (this->validate_frame_crc_()) {
-          this->parse_control_byte_(this->rx_buffer_[0]);
-        } else {
-          // CRC failed - WARN logs byte count only; hex dump at VERBOSE (truncated to ASH_MAX_LOG_BYTES)
-          ESP_LOGW(TAG, "CRC failed (%u bytes)", this->rx_buffer_index_);
-#if ESPHOME_LOG_LEVEL >= ESPHOME_LOG_LEVEL_VERBOSE
-          char hex_buf[format_hex_pretty_size(ASH_MAX_LOG_BYTES)];
-#endif
-          ESP_LOGV(TAG, "CRC failed frame: %s",
-                   format_hex_pretty_to(hex_buf, this->rx_buffer_.data(), this->rx_buffer_index_));
-          this->send_nak_frame_(this->rx_sequence_);
-        }
-        this->parsing_state_ = ParsingState::WAIT_FLAG_START;
-        return true;
-      }
-
-      if (byte == ASH_ESCAPE_BYTE) {
-        this->escape_next_byte_ = true;
-        return false;
-      }
-
-      if (this->escape_next_byte_) {
-        byte ^= ASH_XOR_BYTE;
-        this->escape_next_byte_ = false;
-      }
-
-      // Check buffer overflow
-      if (this->rx_buffer_index_ >= MAX_ASH_FRAME_SIZE) {
-        ESP_LOGE(TAG, "RX buffer overflow, frame too large");
-        this->parsing_state_ = ParsingState::WAIT_FLAG_START;
-        return false;
-      }
-
-      // Store data byte
-      this->rx_buffer_[this->rx_buffer_index_++] = byte;
-      break;
-
-    default:
-      this->parsing_state_ = ParsingState::WAIT_FLAG_START;
-      break;
-  }
-
-  return false;
-}
-
-// Appends a byte with ASH stuffing (reserved: FLAG, ESCAPE, XON, XOFF, SUB, CAN);
-// returns false if it would exceed capacity
-static bool append_byte_stuffed(uint8_t *output, size_t capacity, size_t &pos, uint8_t byte) {
-  const bool reserved = byte == ASH_FLAG_BYTE || byte == ASH_ESCAPE_BYTE || byte == 0x11 || byte == 0x13 ||
-                        byte == ASH_SUBSTITUTE_BYTE || byte == 0x1A;
-  if (pos + (reserved ? 2 : 1) > capacity) {
-    return false;
-  }
-  if (reserved) {
-    output[pos++] = ASH_ESCAPE_BYTE;
-    output[pos++] = byte ^ ASH_XOR_BYTE;
-  } else {
-    output[pos++] = byte;
-  }
-  return true;
-}
-
-size_t ZigbeeProxy::build_frame_(uint8_t *output, size_t capacity, const uint8_t *data, size_t length,
-                                 AshFrameType type, uint8_t frame_num, uint8_t ack_num, bool retx) {
-  size_t pos = 0;
-
-  // Start with FLAG
-  if (capacity < 1) {
-    return 0;
-  }
-  output[pos++] = ASH_FLAG_BYTE;
-
-  // Build control byte
-  uint8_t control = 0;
-  switch (type) {
-    case AshFrameType::DATA:
-      // DATA frame format: 0ffrPPPP
-      // Bit 7 = 0 (DATA indicator), bits 6-4 = frmNum, bit 3 = reTx, bits 2-0 = ackNum
-      control = (frame_num << 4) | (retx ? 0x08 : 0x00) | ack_num;
-      break;
-    case AshFrameType::ACK:
-      control = 0x80 | ack_num;
-      break;
-    case AshFrameType::NAK:
-      control = 0xA0 | ack_num;
-      break;
-    case AshFrameType::RST:
-      control = 0xC0;
-      break;
-    case AshFrameType::RSTACK:
-      control = 0xC1;
-      break;
-    case AshFrameType::ERROR:
-      control = 0xC2;
-      break;
-  }
-
-  // Add control byte with stuffing
-  if (!append_byte_stuffed(output, capacity, pos, control)) {
-    ESP_LOGE(TAG, "Frame too large for buffer (%u byte payload, %u byte buffer)", length, capacity);
-    return 0;
-  }
-
-  // Add data payload with stuffing
-  for (size_t i = 0; i < length; i++) {
-    if (!append_byte_stuffed(output, capacity, pos, data[i])) {
-      ESP_LOGE(TAG, "Frame too large for buffer (%u byte payload, %u byte buffer)", length, capacity);
-      return 0;
-    }
-  }
-
-  // Calculate CRC incrementally over control byte then data (avoids a MAX_ASH_FRAME_SIZE stack copy)
-  uint16_t crc = this->calculate_crc_(&control, 1);
-  if (length > 0) {
-    crc = this->calculate_crc_(data, length, crc);
-  }
-
-  // Add CRC with stuffing (big-endian), then the end FLAG
-  if (!append_byte_stuffed(output, capacity, pos, (crc >> 8) & 0xFF) ||
-      !append_byte_stuffed(output, capacity, pos, crc & 0xFF) || pos + 1 > capacity) {
-    ESP_LOGE(TAG, "Frame too large for buffer (%u byte payload, %u byte buffer)", length, capacity);
-    return 0;
-  }
-  output[pos++] = ASH_FLAG_BYTE;
-
-  return pos;
-}
-
-}  // namespace esphome::zigbee_proxy
-
-#endif  // USE_ZIGBEE_PROXY

esphome/components/zigbee_proxy/ash_protocol.h

@@ -1,115 +0,0 @@
-#pragma once
-
-#include <cstdint>
-#include <cstddef>
-
-namespace esphome::zigbee_proxy {
-
-// ASH Protocol Constants
-static constexpr uint8_t ASH_FLAG_BYTE = 0x7E;        // Frame delimiter
-static constexpr uint8_t ASH_ESCAPE_BYTE = 0x7D;      // Escape/substitution byte
-static constexpr uint8_t ASH_XOR_BYTE = 0x20;         // XOR mask for escaped bytes
-static constexpr uint8_t ASH_SUBSTITUTE_BYTE = 0x18;  // Substitution for invalid bytes
-
-static constexpr uint8_t ASH_XON_BYTE = 0x11;     // Resume transmission
-static constexpr uint8_t ASH_XOFF_BYTE = 0x13;    // Pause transmission
-static constexpr uint8_t ASH_CANCEL_BYTE = 0x1A;  // Discards the partial frame before it
-
-// A reserved byte can never appear literally inside a frame; it is escaped as
-// ESCAPE followed by the byte XOR 0x20. Rejecting frames that contain one is what
-// eliminates most non-ASH traffic before its CRC is ever computed: real firmware
-// images and Spinel payloads are dense in 0x11/0x13/0x18/0x1A.
-inline bool ash_is_reserved(uint8_t byte) {
-  return byte == ASH_FLAG_BYTE || byte == ASH_ESCAPE_BYTE || byte == ASH_XON_BYTE || byte == ASH_XOFF_BYTE ||
-         byte == ASH_SUBSTITUTE_BYTE || byte == ASH_CANCEL_BYTE;
-}
-
-// CRC-CCITT (init 0xFFFF, polynomial 0x1021, transmitted big-endian). Note this is a
-// different variant from the Kermit FCS that Spinel/HDLC-lite uses over the same
-// 0x7E framing, so Spinel frames systematically fail this check.
-uint16_t ash_crc16(const uint8_t *data, size_t length, uint16_t init = 0xFFFF);
-
-// Buffer size configuration
-#ifdef ZIGBEE_PROXY_BUFFER_SIZE
-static constexpr size_t MAX_ASH_FRAME_SIZE = ZIGBEE_PROXY_BUFFER_SIZE;
-#else
-#ifdef USE_ESP8266
-static constexpr size_t MAX_ASH_FRAME_SIZE = 512;  // Limited RAM on ESP8266
-#else
-static constexpr size_t MAX_ASH_FRAME_SIZE = 1024;  // Full buffer on ESP32/RP2040
-#endif
-#endif
-
-// Protocol limits
-static constexpr uint8_t ASH_MAX_SEQUENCE = 7;       // 3-bit sequence number (0-7)
-static constexpr uint8_t ASH_TX_WINDOW_SIZE = 1;     // Only 1 unacknowledged frame allowed
-static constexpr uint8_t ASH_MAX_RETRIES = 5;        // Maximum retransmission attempts
-static constexpr uint16_t ASH_CRC_INIT = 0xFFFF;     // CRC-CCITT initial value
-static constexpr uint32_t ASH_RESET_TIMEOUT = 3000;  // RST/RSTACK timeout in milliseconds
-
-// IEEE address size
-static constexpr size_t ZIGBEE_IEEE_ADDR_SIZE = 8;  // 64-bit IEEE address
-
-// ASH data randomization. The Data Field of every DATA frame is XORed with a
-// pseudo-random sequence (LFSR seeded at 0x42, polynomial 0xB8) before
-// transmission and again after reception; the operation is its own inverse.
-//
-// Proxied client traffic must NOT be passed through this: the client randomizes
-// and the NCP derandomizes, so payloads travel end to end untouched and the
-// proxy stays transparent. Apply it only to frames this component originates or
-// consumes itself, i.e. the boot-harvest EZSP commands and their responses.
-// Sending an unrandomized command makes the NCP derandomize it into garbage and
-// answer with an error frame that decodes as a plausible-looking wrong value.
-void ash_randomize(uint8_t *data, size_t length);
-
-// ASH Frame Types (encoded in control byte)
-// DATA format:    0ffrPPPP - bit 7=0, bits 6-4=frmNum, bit 3=reTx, bits 2-0=ackNum
-// ACK/NAK format: 10XnrPPP - bit 5 distinguishes ACK(0) from NAK(1)
-enum class AshFrameType : uint8_t {
-  DATA = 0x00,    // Data frame (bit 7 = 0)
-  ACK = 0x80,     // Acknowledge frame (100nrPPP, bit 5 = 0)
-  NAK = 0xA0,     // Negative acknowledge (101nrPPP, bit 5 = 1)
-  RST = 0xC0,     // Reset request (bits 7-6 = 11, bits 2-0 = 000)
-  RSTACK = 0xC1,  // Reset acknowledgment (bits 7-6 = 11, bits 2-0 = 001)
-  ERROR = 0xC2,   // Error indication (bits 7-6 = 11, bits 2-0 = 010)
-};
-
-// ASH Connection State
-enum class AshState : uint8_t {
-  DISCONNECTED,  // Initial state, no connection
-  CONNECTING,    // Sent RST, waiting for RSTACK
-  CONNECTED,     // Normal operation
-  FAILED,        // Too many errors/timeouts, requires reset
-};
-
-// Frame Parsing State Machine
-enum class ParsingState : uint8_t {
-  WAIT_FLAG_START,  // Looking for frame start FLAG (0x7E)
-  WAIT_CONTROL,     // Reading control byte
-  WAIT_DATA,        // Reading data payload
-  WAIT_CRC_HIGH,    // Reading CRC high byte
-  WAIT_CRC_LOW,     // Reading CRC low byte
-  WAIT_FLAG_END,    // Expecting end FLAG (0x7E)
-};
-
-// Bootloader detection states
-enum class BootloaderState : uint8_t {
-  NORMAL,    // Normal operation
-  DETECTED,  // Bootloader mode detected
-  MENU,      // In bootloader menu
-};
-
-// EZSP Error Codes (from ERROR frame)
-enum class EzspError : uint8_t {
-  VERSION_NOT_SET = 0x00,
-  RESET_UNKNOWN = 0x01,
-  RESET_EXTERNAL = 0x02,
-  RESET_POWER_ON = 0x03,
-  RESET_WATCHDOG = 0x04,
-  RESET_ASSERT = 0x05,
-  RESET_BOOTLOADER = 0x06,
-  RESET_SOFTWARE = 0x07,
-  EXCEEDED_MAXIMUM_ACK_TIMEOUT_COUNT = 0x51,
-};
-
-}  // namespace esphome::zigbee_proxy

esphome/components/zigbee_proxy/ezsp_commands.h

@@ -1,88 +0,0 @@
-#pragma once
-
-#include <cstddef>
-#include <cstdint>
-
-namespace esphome::zigbee_proxy {
-
-// EZSP Protocol Versions
-static constexpr uint8_t EZSP_MIN_VERSION = 13;  // Minimum supported version
-static constexpr uint8_t EZSP_MAX_VERSION = 13;  // Maximum version we request
-
-// EZSP Frame Control bits
-static constexpr uint8_t EZSP_FRAME_CONTROL_COMMAND = 0x00;   // Host to NCP
-static constexpr uint8_t EZSP_FRAME_CONTROL_RESPONSE = 0x80;  // NCP to Host
-static constexpr uint8_t EZSP_FRAME_CONTROL_CALLBACK = 0x90;  // Async callback from NCP
-
-// High byte of the 16-bit frame control, carrying frameFormatVersion = 1. Every
-// command after version negotiation must set this: omitting it leaves the NCP
-// reading the frame ID's low byte as frame_control_high, so the command is
-// discarded and the reply is an error frame rather than the expected response.
-static constexpr uint8_t EZSP_FRAME_CONTROL_EXTENDED = 0x01;
-
-// Legacy EZSP frame format (v4-v7): [sequence] [frame_control] [frame_id]
-// Extended EZSP frame format (v8+): [sequence] [frame_control_low] [frame_control_high] [frame_id_low] [frame_id_high]
-//
-// Only the `version` command and its response use the legacy format, because the
-// NCP starts in legacy mode and has not yet learned the negotiated version.
-// Everything after that is extended, with no per-NCP exceptions.
-
-// EZSP Frame IDs - Callbacks (NCP to host, async)
-static constexpr uint16_t EZSP_STACK_STATUS_HANDLER = 0x0019;  // Stack up/down notification
-
-// EZSP Frame IDs - Commands (host to NCP)
-static constexpr uint16_t EZSP_VERSION = 0x0000;                 // Version negotiation
-static constexpr uint16_t EZSP_GET_EUI64 = 0x0026;               // Get IEEE address
-static constexpr uint16_t EZSP_GET_NETWORK_PARAMETERS = 0x0028;  // Get network parameters
-static constexpr uint16_t EZSP_GET_TOKEN_DATA = 0x0102;          // Read an NVM3 token
-
-// Extended EZSP header: [sequence] [frame_control_lo] [frame_control_hi] [id_lo] [id_hi]
-static constexpr size_t EZSP_EXTENDED_HEADER_SIZE = 5;
-
-// Network metadata comes straight out of NVM3 instead of from a running stack.
-// NVM3KEY_STACK_NODE_DATA holds the PAN ID, channel, extended PAN ID and node type of
-// the network this radio is commissioned onto, and reading it requires nothing beyond a
-// completed version negotiation: no stack configuration, no networkInit, no waiting on
-// stackStatusHandler, and above all no joining the network -- so simply plugging the
-// device in never brings the radio up.
-//
-// Note the 0x0001 domain prefix on the NVM3 object key. The bare creator ID
-// 0x0000EE64 is a different thing and getTokenData answers FAIL for it.
-static constexpr uint32_t NVM3KEY_STACK_NODE_DATA = 0x0001EE64;
-
-// getTokenData response: [status (4)] [length (4)] [value (length)]
-static constexpr size_t TOKEN_DATA_VALUE_OFFSET = 8;
-
-// NV3StackNodeData value layout (16 bytes, little-endian):
-// [panId (2)] [radioTxPower (1)] [radioFreqChannel (1)] [stackProfile (1)]
-// [nodeType (1)] [zigbeeNodeId (2)] [extendedPanId (8)]
-static constexpr size_t NV3_NODE_DATA_SIZE = 16;
-static constexpr size_t NV3_NODE_DATA_PAN_ID_OFFSET = 0;
-static constexpr size_t NV3_NODE_DATA_CHANNEL_OFFSET = 3;
-static constexpr size_t NV3_NODE_DATA_NODE_TYPE_OFFSET = 5;
-static constexpr size_t NV3_NODE_DATA_EXT_PAN_ID_OFFSET = 8;
-
-// A radio with no network still has the token, holding a sentinel rather than being
-// absent: panId reads 0xFFFF and nodeType reads UNKNOWN_DEVICE. Detecting "no network"
-// therefore means inspecting nodeType, not treating the read as failed.
-static constexpr uint8_t NV3_NODE_TYPE_UNKNOWN_DEVICE = 0x00;
-
-// Status codes (subset). EZSP v13+ / EmberZNet 8.x report sl_status_t, not the
-// legacy 8-bit EmberStatus.
-enum class SlStatus : uint8_t {
-  OK = 0x00,
-  NETWORK_UP = 0x15,
-  NETWORK_DOWN = 0x16,
-};
-
-// getNetworkParameters response layout, used when sniffing a client's own traffic. This
-// is a different shape from the NV3 token the boot harvest reads: 25 bytes of
-// [status (4)] [nodeType (1)] [extendedPanId (8)] [panId (2)] [radioTxPower (1)]
-// [radioChannel (1)] [joinMethod (1)] [nwkManagerId (2)] [nwkUpdateId (1)] [channels (4)]
-static constexpr size_t NETWORK_PARAMS_RESPONSE_SIZE = 25;
-static constexpr size_t NETWORK_PARAMS_STATUS_OFFSET = 0;
-static constexpr size_t NETWORK_PARAMS_EXT_PAN_ID_OFFSET = 5;
-static constexpr size_t NETWORK_PARAMS_PAN_ID_OFFSET = 13;
-static constexpr size_t NETWORK_PARAMS_CHANNEL_OFFSET = 16;
-
-}  // namespace esphome::zigbee_proxy

esphome/components/zigbee_proxy/zigbee_proxy.h

@@ -1,250 +0,0 @@
-#pragma once
-
-#include "esphome/core/defines.h"
-#ifdef USE_ZIGBEE_PROXY
-
-#include "esphome/components/api/api_connection.h"
-#include "esphome/components/api/api_pb2.h"
-#include "esphome/components/serial_proxy/serial_proxy.h"
-#include "esphome/core/component.h"
-#include "esphome/core/helpers.h"
-#include "ash_protocol.h"
-#include "ash_detector.h"
-
-#include <array>
-
-namespace esphome::zigbee_proxy {
-
-// Timeout configuration structure
-struct TimeoutConfig {
-  uint32_t initial_timeout_ms{1600};  // Initial ACK timeout
-  uint32_t min_timeout_ms{400};       // Minimum adaptive timeout
-  uint32_t max_timeout_ms{3200};      // Maximum adaptive timeout
-  uint32_t current_timeout_ms{1600};  // Current adaptive timeout
-};
-
-// Network information structure
-struct NetworkInfo {
-  std::array<uint8_t, ZIGBEE_IEEE_ADDR_SIZE> ieee_address{};
-  uint16_t pan_id{0};
-  std::array<uint8_t, 8> extended_pan_id{};
-  uint8_t channel{0};
-  bool valid{false};
-};
-
-enum ZigbeeProxyFeature : uint32_t {
-  FEATURE_ZIGBEE_PROXY_ENABLED = 1 << 0,
-  // Set only when the harvest actually read a network off the radio. Without it a client
-  // cannot tell "a Zigbee radio with no network formed" from "not a Zigbee radio at all"
-  // -- both otherwise present as ENABLED with an all-zero payload, and the second happens
-  // whenever the NCP has been reflashed to Thread or is simply not responding.
-  FEATURE_ZIGBEE_NETWORK_INFO_VALID = 1 << 1,
-};
-
-// Boot-time initialization state machine
-enum class BootState : uint8_t {
-  IDLE,               // Not initializing
-  WAIT_RSTACK,        // Sent RST, waiting for RSTACK
-  SEND_VERSION,       // Send EZSP version command
-  WAIT_VERSION,       // Waiting for version response
-  SEND_TOKEN_DATA,    // Send getTokenData(NVM3KEY_STACK_NODE_DATA)
-  WAIT_TOKEN_DATA,    // Waiting for token data response
-  SEND_GET_EUI64,     // Send getEui64 command
-  WAIT_EUI64,         // Waiting for EUI64 response
-  SEND_FINAL_RST,     // Send final RST to reset NCP
-  WAIT_FINAL_RSTACK,  // Waiting for final RSTACK
-  COMPLETE,           // Boot sequence complete
-  FAILED,             // Boot sequence failed
-};
-
-// Watches a `serial_proxy` port carrying an EZSP NCP and reports what it learns about the
-// Zigbee network. It never carries client traffic: the serial proxy owns the port and the
-// bytes, and this component only observes them, plus two exceptions where it writes to the
-// port itself -- the boot-time metadata harvest, which runs before any client connects, and
-// the ASH acknowledgements a client asks it to send on its behalf.
-class ZigbeeProxy : public serial_proxy::SerialProxyTap, public Component {
- public:
-  ZigbeeProxy();
-
-  void setup() override;
-  void loop() override;
-  void dump_config() override;
-  float get_setup_priority() const override;
-  bool can_proceed() override;
-
-  void set_serial_proxy(serial_proxy::SerialProxy *parent) { this->parent_ = parent; }
-
-  // SerialProxyTap
-  void on_device_rx(const uint8_t *data, size_t len) override;
-  void on_client_tx(const uint8_t *data, size_t len) override;
-  bool tap_needs_port() const override {
-    if (this->boot_sequence_active_) {
-      return true;
-    }
-    // A pending re-harvest waits for the port to go idle. Starting one under a subscriber
-    // would inject our own ASH frames into whatever it is doing -- most likely the very
-    // firmware upload that invalidated the metadata.
-    return this->reharvest_pending_ && this->parent_->get_api_connection() == nullptr;
-  }
-
-  /// The port stopped handling our protocol, so whatever we know about the radio may no
-  /// longer be true -- a client asking for raw bytes is usually about to reflash it.
-  void on_protocol_disabled() override;
-
-  /// The radio was unplugged or a new one appeared; metadata describes neither.
-  void on_device_presence_changed_(bool connected);
-
-  // API integration
-  void api_connection_authenticated(api::APIConnection *conn);
-  void zigbee_proxy_request(api::APIConnection *api_connection, const api::ZigbeeProxyRequest &msg);
-
-  // Feature flags
-  uint32_t get_feature_flags() const {
-    uint32_t flags = ZigbeeProxyFeature::FEATURE_ZIGBEE_PROXY_ENABLED;
-    if (this->network_info_.valid) {
-      flags |= ZigbeeProxyFeature::FEATURE_ZIGBEE_NETWORK_INFO_VALID;
-    }
-    return flags;
-  }
-
-  // Network information accessors
-  const NetworkInfo &get_network_info() const { return this->network_info_; }
-  uint64_t get_ieee_address() const;
-
-  // Timeout configuration (callable from Python/API)
-  void set_timeout_config(uint32_t initial_ms, uint32_t min_ms, uint32_t max_ms);
-  void set_initial_timeout(uint32_t timeout_ms) { this->timeout_config_.initial_timeout_ms = timeout_ms; }
-  void set_min_timeout(uint32_t timeout_ms) { this->timeout_config_.min_timeout_ms = timeout_ms; }
-  void set_max_timeout(uint32_t timeout_ms) { this->timeout_config_.max_timeout_ms = timeout_ms; }
-
- protected:
-  // ASH Protocol State Machine
-  void reset_ash_protocol_();
-  void send_rst_frame_();
-  void handle_rstack_frame_(const uint8_t *data, size_t length);
-  void handle_error_frame_(const uint8_t *data, size_t length);
-  // Applies a frame's ackNum to the pending TX frame. Returns true if it
-  // acknowledged one. Valid on DATA, ACK and NAK frames alike.
-  bool handle_ack_num_(uint8_t ack_num);
-  bool send_ack_frame_(uint8_t ack_num);
-  bool send_nak_frame_(uint8_t ack_num);
-  bool send_data_frame_(const uint8_t *data, size_t length, bool retransmit = false);
-
-  // Frame parsing and building (implemented in ash_protocol.cpp)
-  bool parse_byte_(uint8_t byte);
-  void parse_control_byte_(uint8_t control);
-  bool validate_frame_crc_();
-  // Builds a stuffed frame into output; returns 0 if the frame (worst case 2*length + 8
-  // bytes after byte stuffing) would exceed capacity.
-  size_t build_frame_(uint8_t *output, size_t capacity, const uint8_t *data, size_t length, AshFrameType type,
-                      uint8_t frame_num = 0, uint8_t ack_num = 0, bool retx = false);
-  uint16_t calculate_crc_(const uint8_t *data, size_t length, uint16_t init = ASH_CRC_INIT);
-
-  // Sequence number management
-  void increment_tx_sequence_() { this->tx_sequence_ = (this->tx_sequence_ + 1) & ASH_MAX_SEQUENCE; }
-  void increment_rx_sequence_() { this->rx_sequence_ = (this->rx_sequence_ + 1) & ASH_MAX_SEQUENCE; }
-
-  // Timeout management
-  void update_adaptive_timeout_(uint32_t measured_rtt_ms);
-  void start_ack_timer_() { this->ack_timer_start_ = millis(); }
-  bool check_ack_timeout_();
-
-  // Retransmission
-  void handle_retransmission_();
-  void clear_tx_buffer_() {
-    this->tx_buffer_pending_ = false;
-    this->tx_retry_count_ = 0;
-  }
-
-  // Boot-time NCP initialization
-  void advance_boot_state_();
-  void check_boot_timeouts_();
-  void handle_boot_data_frame_(const uint8_t *data, size_t length);
-  void send_ezsp_version_();
-  void send_get_eui64_();
-  void send_get_token_data_();
-  void handle_version_response_(const uint8_t *data, size_t length);
-  void handle_eui64_response_(const uint8_t *data, size_t length);
-  void handle_token_data_response_(const uint8_t *data, size_t length);
-
-  // IEEE address and network info
-  bool set_ieee_address_(const uint8_t *new_address);
-  void send_network_info_changed_msg_(api::APIConnection *conn = nullptr);
-
-  // WiFi/Zigbee channel conflict detection
-  void check_wifi_zigbee_conflict_();
-
-  // Bootloader detection (fed consecutive raw byte pairs while not CONNECTED)
-  void check_bootloader_mode_(uint8_t prev_byte, uint8_t byte);
-
-  // Reads network metadata out of a proxied getNetworkParameters response. Read-only, so a
-  // misparse costs a missed update rather than corrupting anything.
-  void sniff_network_info_(const uint8_t *frame, size_t length);
-  // Invalidates network metadata when the stack reports it has left the network.
-  void sniff_stack_status_(const uint8_t *frame, size_t length);
-
-  // NCP-side ASH buffers
-  std::array<uint8_t, MAX_ASH_FRAME_SIZE> rx_buffer_;
-  std::array<uint8_t, MAX_ASH_FRAME_SIZE> tx_buffer_;
-  std::array<uint8_t, MAX_ASH_FRAME_SIZE> tx_pending_buffer_;  // For retransmission
-
-  // Network information
-  NetworkInfo network_info_;
-
-  // Timeout configuration
-  TimeoutConfig timeout_config_;
-
-  // The port this component observes. Owns the UART and the bytes; every write we make
-  // goes through it.
-  serial_proxy::SerialProxy *parent_{nullptr};
-
-  uint32_t setup_time_{0};       // Time when last RST frame was sent
-  uint32_t boot_start_time_{0};  // Time when the boot sequence began (for overall timeout)
-  uint32_t ack_timer_start_{0};  // Time when ACK timer started
-  uint32_t last_rtt_ms_{0};      // Last measured round-trip time
-
-  uint16_t rx_buffer_index_{0};    // Index for populating rx_buffer_
-  uint16_t tx_pending_length_{0};  // Length of pending TX frame for retransmission
-  uint16_t calculated_crc_{0};     // CRC calculated during frame reception
-
-  uint8_t tx_sequence_{0};           // TX sequence number (0-7)
-  uint8_t rx_sequence_{0};           // RX sequence number (0-7)
-  uint8_t tx_retry_count_{0};        // Number of retransmission attempts
-  uint8_t tx_pending_frame_num_{0};  // Frame number of pending TX frame
-  uint8_t last_ack_sent_{0};         // Last ACK number sent
-  uint8_t last_rx_byte_{0};          // Previous raw RX byte (bootloader detection)
-
-  AshState ash_state_{AshState::DISCONNECTED};
-  ParsingState parsing_state_{ParsingState::WAIT_FLAG_START};
-  BootloaderState bootloader_state_{BootloaderState::NORMAL};
-  BootState boot_state_{BootState::IDLE};
-
-  uint8_t ezsp_version_{0};            // NCP's EZSP protocol version
-  uint8_t ezsp_sequence_{0};           // EZSP frame sequence number
-  uint8_t ezsp_requested_version_{0};  // Version we last requested (for re-negotiation)
-  // The NCP keeps using legacy framing until `version` is repeated in the
-  // negotiated (extended) format; until then it rejects every extended command
-  // with frame ID 0x0058. Tracks whether that second handshake has happened.
-  bool ezsp_version_confirmed_{false};
-
-  bool tx_buffer_pending_{false};  // True if waiting for ACK from NCP
-  bool escape_next_byte_{false};   // True if next NCP byte should be unescaped
-
-  bool boot_sequence_active_{false};  // True during boot-time init
-  // Set when the metadata was discarded and a fresh harvest is owed once the port frees up
-  bool reharvest_pending_{false};
-  // Last observed device presence, for spotting a hot-plug
-  bool was_connected_{false};
-  // Earliest millis() at which a pending re-harvest may start
-  uint32_t reharvest_after_{0};
-
-  // Decides when acknowledging on the client's behalf is safe. Armed only by the ASH
-  // session handshake, so a bootloader or Thread NCP never triggers it.
-  AshDetector detector_;
-};
-
-extern ZigbeeProxy *global_zigbee_proxy;  // NOLINT(cppcoreguidelines-avoid-non-const-global-variables)
-
-}  // namespace esphome::zigbee_proxy
-
-#endif  // USE_ZIGBEE_PROXY

esphome/config_validation.py

@@ -133,6 +133,7 @@ Upper = vol.Upper
 Length = vol.Length
 Exclusive = vol.Exclusive
 Inclusive = vol.Inclusive
+Unique = vol.Unique
 ALLOW_EXTRA = vol.ALLOW_EXTRA
 UNDEFINED = vol.UNDEFINED
 RequiredFieldInvalid = vol.RequiredFieldInvalid

esphome/const.py

@@ -4,7 +4,7 @@ from enum import Enum
 
 from esphome.enum import StrEnum
 
-__version__ = "2026.10.0-dev"
+__version__ = "2026.9.0b2"
 
 ALLOWED_NAME_CHARS = "abcdefghijklmnopqrstuvwxyz0123456789-_"
 VALID_SUBSTITUTIONS_CHARACTERS = (

esphome/core/defines.h

@@ -71,6 +71,7 @@
 #define USE_ESP32_HOSTED
 #define USE_ESP32_HOSTED_HTTP_UPDATE
 #define USE_ESP32_IMPROV_STATE_CALLBACK
+#define USE_ESP_NOW_HOSTED
 #define USE_EVENT
 #define USE_FAN
 #define USE_GPIO_BINARY_SENSOR_INTERRUPT
@@ -180,7 +181,6 @@
 #define USE_SENSOR
 #define USE_SENSOR_FILTER
 #define USE_SERIAL_PROXY
-#define USE_SERIAL_PROXY_TAP
 #define USE_SETUP_PRIORITY_OVERRIDE
 #define USE_STATUS_LED
 #define USE_STATUS_SENSOR
@@ -198,7 +198,6 @@
 #define USE_VALVE
 #define USE_WATER_HEATER
 #define USE_WATER_HEATER_VISUAL_OVERRIDES
-#define USE_ZIGBEE_PROXY
 #define USE_ZWAVE_PROXY
 
 // Feature flags which do not work for zephyr
@@ -246,6 +245,9 @@
 #define USE_RUNTIME_STATS
 #define USE_OTA
 #define USE_OTA_ENCRYPTION
+#define USE_OTA_ENCRYPTION_FROM_API
+#define USE_OTA_ENCRYPTION_PROVISIONED
+#define USE_OTA_ENCRYPTION_REQUIRED
 #define USE_OTA_PASSWORD
 #define USE_OTA_VERSION 2
 #define USE_TIME_TIMEZONE
@@ -395,10 +397,6 @@
 #define USB_HOST_MAX_REQUESTS 16
 #define USB_HOST_MAX_PACKET_SIZE 64
 #define USB_UART_OUTPUT_CHUNK_COUNT 5
-// USB identity on serial proxy ports needs the usb_host stack
-#ifdef USE_ESP32
-#define USE_SERIAL_PROXY_USB_INFO
-#endif
 
 #ifdef USE_ARDUINO
 #define USE_ARDUINO_VERSION_CODE VERSION_CODE(3, 3, 7)

esphome/espota2.py

@@ -202,6 +202,49 @@ class OTANetworkError(OTAError):
     """Network-level OTA failure (timeout, reset, closed connection); retrying may succeed."""
 
 
+# Remove before 2027.3.0
+class OTAEncryptionFallback(OTAError):
+    """The encrypted attempt failed and the caller may retry in plaintext."""
+
+
+# Remove before 2027.3.0
+PLAINTEXT_FALLBACK_NOTICE = (
+    "A device with an api encryption key offers encryption after this "
+    "install; add 'encryption:' under 'ota: platform: esphome' to require it. "
+    "This plaintext fallback is removed in 2027.3.0."
+)
+
+
+# Remove before 2027.3.0
+class _EncryptionAttempt:
+    """The key an upload tries and whether it may fall back to plaintext;
+    a rejected handshake falls back at once, a transport fault only on repeat."""
+
+    def __init__(self, noise_psk: str | None, plaintext_fallback: bool) -> None:
+        self.noise_psk = noise_psk
+        self.plaintext_fallback = plaintext_fallback
+        self.handshake_faults = 0
+
+    def handshake_fault_falls_back(self) -> bool:
+        self.handshake_faults += 1
+        return self.plaintext_fallback and self.handshake_faults >= 2
+
+    def downgrade(self, reason: str) -> None:
+        _LOGGER.warning(
+            "%s. Retrying in plaintext; a device that requires encryption "
+            "refuses it. %s",
+            reason,
+            PLAINTEXT_FALLBACK_NOTICE,
+        )
+        self.noise_psk = None
+        self.plaintext_fallback = False
+
+
+# Remove before 2027.3.0: only the fallback decision needs this distinction
+class OTAHandshakeNetworkError(OTANetworkError):
+    """A transport failure inside the noise handshake; retrying encrypted may succeed."""
+
+
 def _committed_error(err: OTANetworkError) -> OTAError:
     """Wrap a network failure that happened once the device had the full image.
 
@@ -464,6 +507,7 @@ def perform_ota(
     filename: Path,
     ota_type: int = OTA_TYPE_UPDATE_APP,
     noise_psk: str | None = None,
+    plaintext_fallback: bool = False,
 ) -> None:
     # Validate up front; an out-of-range value would only surface as a
     # ValueError deep inside send_check, bypassing OTAError handling
@@ -528,19 +572,28 @@ def perform_ota(
     else:
         features = 0
 
-    if noise_psk:
-        # Fail closed: never fall back to a plaintext upload when an
-        # encryption key is configured, an active attacker could otherwise
-        # strip the feature flag and capture the image (it contains the wifi
-        # credentials and the api encryption key).
-        if not (extended_proto and features & SERVER_FEATURE_SUPPORTS_NOISE):
+    if noise_psk and not (extended_proto and features & SERVER_FEATURE_SUPPORTS_NOISE):
+        if plaintext_fallback:
+            # Remove before 2027.3.0: older firmware that cannot encrypt still
+            # gets its update on this connection
+            _LOGGER.warning(
+                "The device did not offer OTA encryption; continuing in plaintext. %s",
+                PLAINTEXT_FALLBACK_NOTICE,
+            )
+            noise_psk = None
+        else:
+            # Fail closed: an attacker could otherwise strip the offer and
+            # capture the image (wifi credentials, api key)
             raise OTAError(
                 "An OTA encryption key is configured but the device did not "
                 "offer encryption; refusing to send the image in plaintext. "
-                "If the running firmware predates OTA encryption, first update "
-                "it without the 'ota: encryption:' block (over a trusted "
-                "network or via USB), then restore the block and upload again."
+                "The running firmware predates ESPHome 2026.9.0 or has no "
+                "'api: encryption: key'. With an api key, install once "
+                "without the 'ota: encryption:' block (that build offers "
+                "encryption), then restore it; otherwise flash by serial or "
+                "the web_server OTA platform."
             )
+    if noise_psk:
         # The prologue binds every negotiation byte both sides saw, so any
         # tampering with the plaintext preamble breaks the handshake.
         prologue = (
@@ -549,8 +602,18 @@ def perform_ota(
             + bytes([RESPONSE_OK, version, features_to_send])
             + bytes([RESPONSE_FEATURE_FLAGS, features])
         )
+        # Built outside the try: a local failure must never downgrade the upload
         sock = NoiseSocketWrapper(sock, noise_psk, prologue)
-        sock.do_handshake()
+        try:
+            sock.do_handshake()
+        except OTANetworkError as err:
+            # A transport fault: retry encrypted before considering plaintext
+            raise OTAHandshakeNetworkError(str(err)) from err
+        except OTAError as err:
+            # Remove before 2027.3.0
+            if plaintext_fallback:
+                raise OTAEncryptionFallback(str(err)) from err
+            raise
         _LOGGER.info("Encrypted connection established")
 
     if ota_type != OTA_TYPE_UPDATE_APP:
@@ -757,6 +820,7 @@ def run_ota_impl_(
     filename: Path,
     ota_type: int = OTA_TYPE_UPDATE_APP,
     noise_psk: str | None = None,
+    plaintext_fallback: bool = False,
 ) -> tuple[int, str | None]:
     from esphome.core import CORE
 
@@ -795,7 +859,9 @@ def run_ota_impl_(
     total_attempts = len(res) + EXTRA_UPLOAD_ATTEMPTS
     last_error = ""
     reached_device = False
-    for attempt in range(total_attempts):
+    attempt = 0
+    encryption = _EncryptionAttempt(noise_psk, plaintext_fallback)
+    while attempt < total_attempts:
         af, socktype, _, _, sa = res[attempt % len(res)]
         if reached_device or attempt >= len(res):
             _LOGGER.info(
@@ -815,17 +881,40 @@ def run_ota_impl_(
             sock.close()
             _LOGGER.warning("Connecting to %s port %s failed: %s", sa[0], sa[1], err)
             last_error = f"connecting to {sa[0]} failed: {err}"
+            attempt += 1
             continue
 
         _LOGGER.info("Connected to %s", sa[0])
         reached_device = True
         with contextlib.closing(sock), Path(filename).open("rb") as file_handle:
             try:
-                perform_ota(sock, password, file_handle, filename, ota_type, noise_psk)
+                perform_ota(
+                    sock,
+                    password,
+                    file_handle,
+                    filename,
+                    ota_type,
+                    encryption.noise_psk,
+                    encryption.plaintext_fallback,
+                )
+            except OTAEncryptionFallback as err:
+                # Same address and attempt budget: not a network retry
+                last_error = str(err)
+                encryption.downgrade(last_error)
+                continue
+            except OTAHandshakeNetworkError as err:
+                last_error = str(err)
+                if encryption.handshake_fault_falls_back():
+                    encryption.downgrade(last_error)
+                    continue
+                _LOGGER.warning("%s", last_error)
+                attempt += 1
+                continue
             except OTANetworkError as err:
                 # Transient network failure; retry
                 last_error = str(err)
                 _LOGGER.warning("%s", last_error)
+                attempt += 1
                 continue
             except OTAError as err:
                 # Device-reported error (wrong password, wrong flash size, ...);
@@ -847,10 +936,17 @@ def run_ota(
     filename: Path,
     ota_type: int = OTA_TYPE_UPDATE_APP,
     noise_psk: str | None = None,
+    plaintext_fallback: bool = False,
 ) -> tuple[int, str | None]:
     try:
         return run_ota_impl_(
-            remote_host, remote_port, password, filename, ota_type, noise_psk
+            remote_host,
+            remote_port,
+            password,
+            filename,
+            ota_type,
+            noise_psk,
+            plaintext_fallback,
         )
     except OTAError as err:
         _LOGGER.error(err)

esphome/framework_helpers.py

@@ -23,6 +23,7 @@ from esphome.net_retry import (
 )
 
 if TYPE_CHECKING:
+    from filelock import FileLock
     import requests
 
 PathType = str | os.PathLike
@@ -909,6 +910,61 @@ def _part_path(dest: Path) -> Path:
     return dest.with_name(dest.name + ".part")
 
 
+def downloaded_bytes(dest: Path, size: int | None = None) -> int:
+    """Bytes of ``dest`` on disk (its ``.part`` while streaming), capped at ``size``."""
+    done = 0
+    for candidate in (_part_path(dest), dest):
+        try:
+            done = candidate.stat().st_size
+            break
+        except FileNotFoundError:
+            continue
+    return done if size is None else min(done, size)
+
+
+# Short lock-acquire slices so a waiting worker still observes Ctrl-C
+_DOWNLOAD_LOCK_POLL = 1
+
+# Waiting on another process's download; past this the caller leaves the
+# file to its holder (the later sequential install waits on the same lock)
+DOWNLOAD_LOCK_TIMEOUT = 60
+
+
+class DownloadLockUnavailable(OSError):
+    """The lock file cannot be used at all (a lock-less filesystem)."""
+
+
+def wait_for_download_lock(
+    lock: "FileLock",
+    tracker: Callable[[int], None],
+    on_disk: Callable[[], int],
+    name: str,
+) -> None:
+    """Acquire ``lock``, reporting ``on_disk()`` to ``tracker`` each poll so the
+    bar follows the holder's download. Raises filelock's ``Timeout`` once
+    ``DOWNLOAD_LOCK_TIMEOUT`` seconds pass."""
+    from filelock import Timeout
+
+    deadline = time.monotonic() + DOWNLOAD_LOCK_TIMEOUT
+    waiting = False
+    while True:
+        try:
+            lock.acquire(timeout=_DOWNLOAD_LOCK_POLL)
+            return
+        except Timeout:
+            pass
+        except OSError as err:
+            # Distinct from an OSError out of on_disk(), which must not
+            # read as "locks unsupported"
+            raise DownloadLockUnavailable(*err.args) from err
+        if not waiting:
+            waiting = True
+            _LOGGER.info("Waiting for another process downloading %s", name)
+        tracker(on_disk())  # raises when the batch is cancelled
+        if time.monotonic() >= deadline:
+            raise Timeout(lock.lock_file)
+
+
 def discard_partial_download(dest: Path) -> None:
     """Remove ``dest`` and the resume sidecars of an abandoned download."""
     part = _part_path(dest)
@@ -1319,10 +1375,7 @@ def download_from_mirrors(
             )
             # Tick with the bytes already on disk so a combined bar holds
             # steady during the backoff instead of rewinding to zero
-            done = 0
-            if progress is not None:
-                part = _part_path(path_target)
-                done = part.stat().st_size if part.is_file() else 0
+            done = downloaded_bytes(path_target) if progress is not None else 0
             _cancellable_sleep(delay, progress, done)
 
     # 3. Report every attempted URL if all mirrors failed. failures spans

esphome/platformio/prefetch.py

@@ -33,11 +33,14 @@ import time
 from typing import Any, NamedTuple
 
 from esphome.framework_helpers import (
+    DownloadLockUnavailable,
     content_length,
     discard_partial_download,
+    downloaded_bytes,
     failure_reason,
     resume_fetch_job,
     run_batch_downloads,
+    wait_for_download_lock,
     warn_prefetch_failures,
 )
 from esphome.helpers import get_bool_env, get_usable_cpu_count, rmtree
@@ -61,16 +64,10 @@ _RESOLVE_WORKERS = 8
 # A hung child must not block the build; downloads resume on the next run
 _PREFETCH_TIMEOUT = 20 * 60
 
-# Waiting on another process's URL download; past this, leave it to pio
-_DOWNLOAD_LOCK_TIMEOUT = 60
-
 # Child exit for a handled, already-warned failure; 1 would collide with
 # the interpreter's own import-failure exit
 _EXIT_HANDLED = 3
 
-# Short lock-acquire slices so a waiting worker still observes Ctrl-C
-_URI_LOCK_POLL = 1
-
 # Resolution errored (vs a clean skip); suppresses the warm sentinel
 _RESOLVE_FAILED = object()
 
@@ -462,51 +459,54 @@ def _uri_jobs(
 
 
 def _serialized_fetch_job(
-    dl_path: Path, lock_path: str, body: Any, unlocked_ok: bool = True
+    dl_path: Path,
+    lock_path: str,
+    body: Any,
+    size: int,
+    stream_dest: Path | None = None,
+    unlocked_ok: bool = True,
 ) -> Any:
-    """Wrap ``body`` so the shared destination is single-writer.
-
-    Interleaved writers truncate each other's ``.part`` bytes (see
-    registry.py). The bounded poll observes Ctrl-C via the tracker; a
-    blown deadline is a clean skip (the holder's copy is what the build
-    needs). On a lock-less filesystem a sha256-verified body runs
-    unlocked with one warning; a checksum-less one
-    (``unlocked_ok=False``) is a counted failure instead.
+    """Wrap ``body`` so the shared destination is single-writer (interleaved
+    writers truncate each other's ``.part``, see registry.py). A blown deadline
+    is a clean skip. On a lock-less filesystem a sha256-verified body runs
+    unlocked with one warning; a checksum-less one (``unlocked_ok=False``) fails.
     """
 
+    def on_disk() -> int:
+        # A URL job's holder streams beside the staging path until it
+        # promotes; after that only dl_path is left
+        done = downloaded_bytes(dl_path, size)
+        if not done and stream_dest is not None:
+            done = downloaded_bytes(stream_dest, size)
+        return done
+
     def run(tracker: Any) -> None:
         from filelock import FileLock, Timeout
 
         # fallback_to_soft would leave a stale marker on lock-less
         # filesystems that blocks every later build (see git.py)
         lock = FileLock(lock_path, fallback_to_soft=False)
-        deadline = time.monotonic() + _DOWNLOAD_LOCK_TIMEOUT
-        while True:
-            try:
-                lock.acquire(timeout=_URI_LOCK_POLL)
-                break
-            except Timeout:
-                tracker(0)  # raises when the batch is cancelled
-                if time.monotonic() >= deadline:
-                    # Another process is fetching this same file; its copy
-                    # is what the build needs (a large framework archive
-                    # can hold the lock far longer than this deadline)
-                    _LOGGER.debug("Leaving %s to its current downloader", dl_path.name)
-                    return
-            except OSError as err:
-                if not unlocked_ok:
-                    # A body with no checksum to catch interleaved corruption
-                    raise
-                lock = None
-                _LOGGER.warning(
-                    "Could not lock %s (%s); downloading unlocked",
-                    dl_path.name,
-                    err,
-                )
-                break
+        try:
+            wait_for_download_lock(lock, tracker, on_disk, dl_path.name)
+        except Timeout:
+            # The holder's copy is what the build needs (a large
+            # framework archive can outlast this deadline)
+            _LOGGER.debug("Leaving %s to its current downloader", dl_path.name)
+            return
+        except DownloadLockUnavailable as err:
+            if not unlocked_ok:
+                # A body with no checksum to catch interleaved corruption
+                raise
+            lock = None
+            _LOGGER.warning(
+                "Could not lock %s (%s); downloading unlocked",
+                dl_path.name,
+                err,
+            )
         try:
             if dl_path.is_file():
-                return  # another process finished it while we waited
+                tracker(size)  # another process finished it while we waited
+                return
             body(tracker)
         finally:
             if lock is not None:
@@ -540,6 +540,7 @@ def _registry_fetch_job(
         dl_path,
         f"{dl_path}.esphome.lock",
         resume_fetch_job(url, dl_path, sha256=checksum, size=size),
+        size,
     )
 
     def run(tracker: Any) -> None:
@@ -571,9 +572,9 @@ def _uri_fetch_job(manager: Any, url: str, dl_path: Path, size: int) -> Any:
         tmp.replace(dl_path)
 
     def run(tracker: Any) -> None:
-        _serialized_fetch_job(dl_path, f"{tmp}.lock", promote, unlocked_ok=False)(
-            tracker
-        )
+        _serialized_fetch_job(
+            dl_path, f"{tmp}.lock", promote, size, tmp, unlocked_ok=False
+        )(tracker)
         if dl_path.is_file():
             # Won or lost, the race is over; staging files left behind
             # are dead weight PlatformIO's cache never prunes

esphome/platformio/registry.py

@@ -17,8 +17,10 @@ from esphome.framework_helpers import (
     archive_extract_all,
     download_from_mirrors,
     download_with_resume,
+    downloaded_bytes,
     rmdir,
     run_batch_downloads,
+    wait_for_download_lock,
 )
 from esphome.net_retry import fetch_with_retry, http_request
 
@@ -164,11 +166,17 @@ class _PendingArchive(NamedTuple):
     name: str
     version: str
     dest: Path
+    archive: Path
     url: str
     sha256: str
     size: int
 
 
+def _archive_path(downloads_dir: Path, name: str, version: str) -> Path:
+    """The one archive path the prefetch and the sequential install share."""
+    return downloads_dir / f"{name}-{version}"
+
+
 def _already_installed(dest: Path) -> bool:
     """Whether ``dest`` holds a completed install (extraction marker)."""
     return (dest / ".esphome_extracted").is_file()
@@ -187,18 +195,18 @@ def prefetch_packages(
     lock as ``install_package``: the archive's ``.part`` file is shared, and
     two concurrent writers would truncate each other's bytes.
     """
-    from filelock import FileLock
+    from filelock import FileLock, Timeout
 
     pending: list[_PendingArchive] = []
-    seen: set[str] = set()
+    seen: set[Path] = set()
     for name, version, dest, mirrors in packages:
         if mirrors or (dest / ".esphome_extracted").is_file():
             continue
-        archive_name = f"{name}-{version}"
-        if archive_name in seen:
+        archive = _archive_path(downloads_dir, name, version)
+        if archive in seen:
             # A duplicate entry would race itself between two workers
             continue
-        seen.add(archive_name)
+        seen.add(archive)
         try:
             url, sha256, size = registry_download(name, version)
         except EsphomeError as err:
@@ -207,10 +215,9 @@ def prefetch_packages(
             continue
         if not size:
             continue
-        archive = downloads_dir / archive_name
         if archive.is_file() and archive.stat().st_size == size:
             continue
-        pending.append(_PendingArchive(name, version, dest, url, sha256, size))
+        pending.append(_PendingArchive(name, version, dest, archive, url, sha256, size))
     if len(pending) < 2:
         return
     downloads_dir.mkdir(parents=True, exist_ok=True)
@@ -222,20 +229,36 @@ def prefetch_packages(
 
     def _fetch(entry: _PendingArchive, tracker: Callable[[int], None]) -> None:
         entry.dest.parent.mkdir(parents=True, exist_ok=True)
-        with FileLock(f"{entry.dest}.lock", fallback_to_soft=False):
-            # Marker re-check: a concurrent build may have installed (and
-            # deleted the archive of) this package while we waited;
-            # re-downloading would orphan a fresh copy in downloads_dir
-            # no branch: the thread tracer misses the skip edge; both
-            # arms of _already_installed are pinned directly
-            if not _already_installed(entry.dest):  # pragma: no branch
-                download_with_resume(
-                    entry.url,
-                    downloads_dir / f"{entry.name}-{entry.version}",
-                    sha256=entry.sha256,
-                    size=entry.size,
-                    progress=tracker,
-                )
+
+        def on_disk() -> int:
+            if done := downloaded_bytes(entry.archive, entry.size):
+                return done
+            # The holder deletes the archive once it has installed it
+            return entry.size if _already_installed(entry.dest) else 0
+
+        lock = FileLock(f"{entry.dest}.lock", fallback_to_soft=False)
+        try:
+            wait_for_download_lock(lock, tracker, on_disk, entry.name)
+        except Timeout:
+            # install_package waits on this same lock and verifies the
+            # holder's copy
+            _LOGGER.debug("Leaving %s to its current downloader", entry.name)
+            return
+        try:
+            if _already_installed(entry.dest):
+                # A concurrent build installed it while we waited; a
+                # re-download would orphan a fresh copy in downloads_dir
+                tracker(entry.size)
+                return
+            download_with_resume(
+                entry.url,
+                entry.archive,
+                sha256=entry.sha256,
+                size=entry.size,
+                progress=tracker,
+            )
+        finally:
+            lock.release()
 
     failures = run_batch_downloads(
         "Downloading packages",
@@ -288,7 +311,7 @@ def install_package(
         rmdir(dest, msg=f"Clean up incomplete {name} install")
         # Persistent location so an interrupted download resumes across runs.
         downloads_dir.mkdir(parents=True, exist_ok=True)
-        archive = downloads_dir / f"{name}-{version}"
+        archive = _archive_path(downloads_dir, name, version)
         _LOGGER.info("Downloading %s %s ...", name, version)
         if mirrors:
             _LOGGER.warning(

esphome/wizard.py

@@ -148,11 +148,13 @@ def wizard_file(**kwargs: Unpack[WizardFileKwargs]) -> str:
     if "api_encryption_key" in kwargs:
         config += f'  encryption:\n    key: "{kwargs["api_encryption_key"]}"\n'
 
-    # Configure OTA
+    # The api key also secures OTA; a password only serves older uploaders
     config += "\nota:\n"
     config += "  - platform: esphome\n"
     if "ota_password" in kwargs:
         config += f'    password: "{kwargs["ota_password"]}"'
+    elif "api_encryption_key" in kwargs:
+        config += "    encryption:"
 
     # Configuring wifi
     config += "\n\nwifi:\n"
@@ -529,20 +531,9 @@ def wizard(path: Path) -> int:
         safe_print()
         safe_print("You'll need this key when adding the device to Home Assistant.")
         sleep(1)
-
-        safe_print()
-        safe_print(
-            f"Do you want to set a {color(AnsiFore.GREEN, 'password')} for OTA updates? "
-            "This can be insecure if you do not trust the WiFi network."
-        )
-        safe_print()
-        sleep(0.25)
-        safe_print("Press ENTER for no password")
-        ota_password = safe_input(color(AnsiFore.BOLD_WHITE, "(password): "))
     else:
         ssid, psk = "", ""
         api_encryption_key = None
-        ota_password = ""
 
     kwargs = {
         "path": path,
@@ -553,10 +544,9 @@ def wizard(path: Path) -> int:
         "psk": psk,
         "type": "basic",
     }
+    # The api key also secures OTA updates, so the wizard sets no OTA password
     if api_encryption_key:
         kwargs["api_encryption_key"] = api_encryption_key
-    if ota_password:
-        kwargs["ota_password"] = ota_password
 
     if not wizard_write(**kwargs):
         return 1

platformio.ini

@@ -45,7 +45,7 @@ lib_deps_base =
 lib_deps =
     ${common.lib_deps_base}
     https://github.com/dudanov/MideaUART.git#eeea6c3e9b4474f067054592b435be1c4e466815 ; midea
-    esphome/noise-c@0.1.21                 ; noise (api, ota)
+    esphome/noise-c@0.1.24                 ; noise (api, ota)
     improv/Improv@1.2.7                    ; improv_serial / esp32_improv
     kikuchan98/pngle@1.1.0                 ; online_image
     ; Using the repository directly, otherwise ESP-IDF can't use the library
@@ -244,7 +244,7 @@ lib_deps =
     ${common:idf-component-libs.lib_deps}
     ESP32Async/ESPAsyncWebServer@3.9.6    ; web_server_base
     droscy/esp_wireguard@0.4.5            ; wireguard
-    esphome/noise-c@0.1.21                ; noise (api, ota)
+    esphome/noise-c@0.1.24                ; noise (api, ota)
     ESP32Async/AsyncTCP@3.4.5             ; async_tcp
     DNSServer                             ; captive_portal
     heman/AsyncMqttClient-esphome@2.0.0   ; mqtt
@@ -641,7 +641,7 @@ build_unflags =
 extends = common
 platform = platformio/native
 lib_deps =
-    esphome/noise-c@0.1.21  ; used by noise (api, ota)
+    esphome/noise-c@0.1.24  ; used by noise (api, ota)
     lvgl/lvgl@9.5.0         ; lvgl
 build_flags =
     ${common.build_flags}

requirements.txt

@@ -14,7 +14,7 @@ esptool==5.3.1
 click==8.3.3
 aioesphomeapi==46.3.0
 aiohappyeyeballs==2.7.1  # Happy Eyeballs for requests downloads; already pulled in by aioesphomeapi
-zeroconf==0.151.3
+zeroconf==0.151.2
 puremagic==2.2.0
 ruamel.yaml==0.19.1 # dashboard_import
 ruamel.yaml.clib==0.2.15 # dashboard_import
@@ -28,8 +28,8 @@ smpclient==7.2.0
 requests==2.34.2
 py7zr==1.1.3
 platformdirs==4.11.5  # native esp-idf toolchain global cache dir
-ninja==1.13.2  # native esp8266 arduino toolchain build driver
-filelock==3.32.5  # inter-process locks (PlatformIO cache heal, git clone cache); >=3.32 for FileLock(fallback_to_soft=...), older versions silently drop the kwarg
+ninja==1.13.0  # native esp8266 arduino toolchain build driver
+filelock==3.32.4  # inter-process locks (PlatformIO cache heal, git clone cache); >=3.32 for FileLock(fallback_to_soft=...), older versions silently drop the kwarg
 
 # esp-idf >= 5.0 requires this
 pyparsing >= 3.3.2

script/ci-custom.py

@@ -294,6 +294,9 @@ def highlight(s):
         "esphome/components/socket/headers.h",
         "esphome/core/defines.h",
         "esphome/components/http_request/httplib.h",
+        # Shared C wire header (byte-identical with the co-processor firmware);
+        # these are protocol constants and constexpr is C++-only.
+        "esphome/components/esp32_hosted/esp_now_hosted_rpc.h",
     ],
 )
 def lint_no_defines(fname, match):
@@ -816,6 +819,10 @@ def lint_relative_py_import(fname: Path, line, col, content):
         "esphome/components/host/helpers.cpp",
         "esphome/components/zephyr/helpers.cpp",
         "esphome/components/http_request/httplib.h",
+        # Global extern "C" esp_now_* linker symbols + shared C wire header;
+        # neither can live in a C++ namespace.
+        "esphome/components/esp32_hosted/esp_now_hosted.cpp",
+        "esphome/components/esp32_hosted/esp_now_hosted_rpc.h",
     ],
 )
 def lint_namespace(fname: Path, content: str) -> str | None:
@@ -841,7 +848,15 @@ def lint_esphome_h(fname, line, col, content):
     )
 
 
-@lint_content_check(include=["*.h"], exclude=["esphome/core/entity_types.h"])
+@lint_content_check(
+    include=["*.h"],
+    exclude=[
+        "esphome/core/entity_types.h",
+        # Shared C wire header; uses a classic #ifndef guard for portability
+        # across the co-processor firmware repo it stays byte-identical with.
+        "esphome/components/esp32_hosted/esp_now_hosted_rpc.h",
+    ],
+)
 def lint_pragma_once(fname, content):
     if "#pragma once" not in content:
         return (

tests/benchmarks/stubs/esphome/components/serial_proxy/serial_proxy.h

@@ -40,9 +40,6 @@ class SerialProxy {
     return SerialProxyResult::SERIAL_PROXY_RESULT_OK;
   }
   void write_from_client(api::APIConnection *api_connection, const uint8_t *data, size_t len) {}
-  SerialProxyResult set_mode_from_client(api::APIConnection *api_connection, api::enums::SerialProxyMode mode) {
-    return SerialProxyResult::SERIAL_PROXY_RESULT_OK;
-  }
   SerialProxyResult set_modem_pins(api::APIConnection *api_connection, uint32_t line_states) {
     return SerialProxyResult::SERIAL_PROXY_RESULT_OK;
   }

tests/component_tests/esp32_ble_server/config/improv_only.yaml

@@ -0,0 +1,13 @@
+esphome:
+  name: test
+
+esp32:
+  variant: esp32
+
+wifi:
+  ssid: MySSID
+  password: password1
+
+# esp32_ble_server is only auto-loaded here, so it has no services of its own.
+esp32_improv:
+  authorizer: none

tests/component_tests/esp32_ble_server/config/manufacturer_data_only.yaml

@@ -0,0 +1,9 @@
+esphome:
+  name: test
+
+esp32:
+  variant: esp32
+
+esp32_ble_server:
+  id: ble_server
+  manufacturer_data: [0x72, 0x04, 0x00, 0x23]

tests/component_tests/esp32_ble_server/config/own_service.yaml

@@ -0,0 +1,14 @@
+esphome:
+  name: test
+
+esp32:
+  variant: esp32
+
+esp32_ble_server:
+  id: ble_server
+  services:
+    - uuid: 2a24b789-7aab-4535-af3e-ee76a35cc12d
+      characteristics:
+        - uuid: cad48e28-7fbe-41cf-bae9-d77a6c233423
+          read: true
+          value: [1, 2, 3, 4]

tests/component_tests/esp32_ble_server/test_esp32_ble_server.py

@@ -1,5 +1,10 @@
 """Tests for esp32_ble_server configuration helpers."""
 
+from __future__ import annotations
+
+from collections.abc import Callable
+from pathlib import Path
+
 import pytest
 
 from esphome.components.esp32_ble_server import (
@@ -45,3 +50,26 @@ def test_uuid_is_matches_descriptor_short_strings(uuid16) -> None:
     assert uuid_is(uuid16, uuid16)
     assert uuid_is(f"{uuid16:04X}", uuid16)
     assert uuid_is(f"{uuid16:08X}", uuid16)
+
+
+@pytest.mark.parametrize(
+    ("config_file", "required"),
+    [
+        # Auto-loaded by esp32_improv only: nothing to find until Improv asks for it
+        ("improv_only.yaml", False),
+        # The configuration defines a service clients are meant to connect to
+        ("own_service.yaml", True),
+        # Manufacturer data is only useful if it is actually broadcast
+        ("manufacturer_data_only.yaml", True),
+    ],
+)
+def test_advertising_required(
+    generate_main: Callable[[str | Path], str],
+    component_config_path: Callable[[str], Path],
+    config_file: str,
+    required: bool,
+) -> None:
+    """The server only requests advertising when the configuration needs it."""
+    main_cpp = generate_main(component_config_path(config_file))
+
+    assert f"set_advertising_required({str(required).lower()})" in main_cpp

tests/component_tests/noise/test_encryption_key.py

@@ -5,11 +5,7 @@ from __future__ import annotations
 import pytest
 
 from esphome import config_validation as cv
-from esphome.components.noise import (
-    decode_encryption_key,
-    is_reserved_key,
-    validate_encryption_key,
-)
+from esphome.components.noise import decode_encryption_key, validate_encryption_key
 
 KEY = "AAECAwQFBgcICQoLDA0ODxAREhMUFRYXGBkaGxwdHh8="
 
@@ -41,6 +37,8 @@ def test_decode_encryption_key_rejects_short_decode() -> None:
         decode_encryption_key("AAECAw==")
 
 
-def test_is_reserved_key() -> None:
-    assert is_reserved_key("AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=")
-    assert not is_reserved_key(KEY)
+def test_validate_encryption_key_rejects_all_zeros() -> None:
+    """The all-zeros key is the provisioning sentinel the device treats as no
+    key, so it never reaches a build."""
+    with pytest.raises(cv.Invalid, match="all-zeros key is reserved"):
+        validate_encryption_key("AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=")

tests/component_tests/ota/test_esphome_ota.py

@@ -2,6 +2,7 @@
 
 from __future__ import annotations
 
+from collections.abc import Callable
 import logging
 from typing import Any
 
@@ -14,6 +15,7 @@ from esphome.components.esphome.ota import (
     _validate_no_password_with_encryption,
     ota_esphome_final_validate,
 )
+from esphome.components.noise import static_encryption_key
 from esphome.const import (
     CONF_API,
     CONF_ENCRYPTION,
@@ -115,7 +117,6 @@ def test_non_esphome_ota_unaffected() -> None:
 
 API_KEY = "AAECAwQFBgcICQoLDA0ODxAREhMUFRYXGBkaGxwdHh8="
 OTHER_KEY = "AQIDBAUGBwgJCgsMDQ4PEBESExQVFhcYGRobHB0eHyA="
-ZEROS_KEY = "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA="
 
 
 def test_encryption_key_inherited_from_api() -> None:
@@ -197,36 +198,6 @@ def test_encryption_without_any_key_rejected() -> None:
         fv.full_config.reset(token)
 
 
-def test_encryption_explicit_all_zeros_key_rejected() -> None:
-    """The all-zeros key is the provisioning sentinel; the device would treat
-    it as no PSK and accept plaintext, so it must fail validation."""
-    full_conf = {
-        CONF_OTA: [
-            _make_ota_config(port=3232, **{CONF_ENCRYPTION: {CONF_KEY: ZEROS_KEY}})
-        ],
-    }
-    token = fv.full_config.set(full_conf)
-    try:
-        with pytest.raises(cv.Invalid, match="all-zeros key is reserved"):
-            ota_esphome_final_validate({})
-    finally:
-        fv.full_config.reset(token)
-
-
-def test_encryption_inherited_all_zeros_key_rejected() -> None:
-    """An all-zeros api key must not silently disable ota encryption either."""
-    full_conf = {
-        CONF_API: {CONF_ENCRYPTION: {CONF_KEY: ZEROS_KEY}},
-        CONF_OTA: [_make_ota_config(port=3232, **{CONF_ENCRYPTION: {}})],
-    }
-    token = fv.full_config.set(full_conf)
-    try:
-        with pytest.raises(cv.Invalid, match="all-zeros key is reserved"):
-            ota_esphome_final_validate({})
-    finally:
-        fv.full_config.reset(token)
-
-
 def test_encryption_key_mismatch_between_merged_configs_rejected() -> None:
     """Same-port configs with different encryption keys raise."""
     full_conf = {
@@ -295,13 +266,14 @@ def test_encryption_explicit_key_with_runtime_provisioned_api_accepted() -> None
         fv.full_config.reset(token)
 
 
+@pytest.mark.parametrize("component", ["web_server", "prometheus"])
 def test_encryption_with_web_server_ota_warns(
-    caplog: pytest.LogCaptureFixture,
+    caplog: pytest.LogCaptureFixture, component: str
 ) -> None:
-    """With the web_server component the plaintext /update endpoint is always
-    on; the combination validates with a warning."""
+    """web_server and prometheus keep the shared listener up, so the
+    plaintext /update endpoint is always on and the combination warns."""
     full_conf = {
-        "web_server": {},
+        component: {},
         CONF_OTA: [
             _make_ota_config(port=3232, **{CONF_ENCRYPTION: {CONF_KEY: OTHER_KEY}}),
             {CONF_PLATFORM: "web_server", CONF_ID: ID("ota_ws", is_manual=False)},
@@ -316,12 +288,12 @@ def test_encryption_with_web_server_ota_warns(
         fv.full_config.reset(token)
 
 
-def test_encryption_with_captive_portal_web_server_ota_warns(
+def test_encryption_with_captive_portal_does_not_warn(
     caplog: pytest.LogCaptureFixture,
 ) -> None:
     """captive_portal auto-loads the web_server ota platform without the
-    web_server component; encryption stays usable and only warns, so the
-    fallback AP recovery path is not lost."""
+    web_server component; its endpoint only exists while the fallback AP is
+    active and is the intended recovery path, so there is no warning."""
     full_conf = {
         "captive_portal": {},
         CONF_OTA: [
@@ -333,7 +305,10 @@ def test_encryption_with_captive_portal_web_server_ota_warns(
     try:
         with caplog.at_level(logging.WARNING):
             ota_esphome_final_validate({})
-        assert any("captive_portal" in record.message for record in caplog.records)
+        assert not any(
+            "OTA encryption does not cover" in record.message
+            for record in caplog.records
+        )
         esphome_conf = next(
             conf
             for conf in fv.full_config.get()[CONF_OTA]
@@ -344,6 +319,100 @@ def test_encryption_with_captive_portal_web_server_ota_warns(
         fv.full_config.reset(token)
 
 
+def test_password_with_api_key_warns(caplog: pytest.LogCaptureFixture) -> None:
+    """A static api key makes the device offer encryption and the CLI take
+    it, so the password is dead weight; the config validates with a warning."""
+    full_conf = {
+        CONF_API: {CONF_ENCRYPTION: {CONF_KEY: API_KEY}},
+        CONF_OTA: [_make_ota_config(port=3232, **{CONF_PASSWORD: "pw"})],
+    }
+    token = fv.full_config.set(full_conf)
+    try:
+        with caplog.at_level(logging.WARNING):
+            ota_esphome_final_validate({})
+        assert any("wastes significant flash" in r.message for r in caplog.records)
+    finally:
+        fv.full_config.reset(token)
+
+
+def test_password_with_runtime_api_key_warns_differently(
+    caplog: pytest.LogCaptureFixture,
+) -> None:
+    """The CLI still needs the password, but the provisioned key also
+    authenticates uploads; the warning says so without the flash advice."""
+    full_conf = {
+        CONF_API: {CONF_ENCRYPTION: {}},
+        CONF_OTA: [_make_ota_config(port=3232, **{CONF_PASSWORD: "pw"})],
+    }
+    token = fv.full_config.set(full_conf)
+    try:
+        with caplog.at_level(logging.WARNING):
+            ota_esphome_final_validate({})
+        messages = [r.message for r in caplog.records]
+        assert any("provisioned at runtime also authenticates" in m for m in messages)
+        assert not any("wastes significant flash" in m for m in messages)
+    finally:
+        fv.full_config.reset(token)
+
+
+def test_password_without_api_key_no_warning(
+    caplog: pytest.LogCaptureFixture,
+) -> None:
+    """Without an api key there is no offer, so nothing to warn about."""
+    full_conf = {
+        CONF_API: {},
+        CONF_OTA: [_make_ota_config(port=3232, **{CONF_PASSWORD: "pw"})],
+    }
+    token = fv.full_config.set(full_conf)
+    try:
+        with caplog.at_level(logging.WARNING):
+            ota_esphome_final_validate({})
+        assert not any("authenticates" in r.message for r in caplog.records)
+    finally:
+        fv.full_config.reset(token)
+
+
+def test_web_server_component_without_ota_platform_does_not_warn(
+    caplog: pytest.LogCaptureFixture,
+) -> None:
+    """The web_server component alone has no /update endpoint."""
+    full_conf = {
+        "web_server": {},
+        CONF_OTA: [
+            _make_ota_config(port=3232, **{CONF_ENCRYPTION: {CONF_KEY: OTHER_KEY}})
+        ],
+    }
+    token = fv.full_config.set(full_conf)
+    try:
+        with caplog.at_level(logging.WARNING):
+            ota_esphome_final_validate({})
+        assert not any(
+            "OTA encryption does not cover" in r.message for r in caplog.records
+        )
+    finally:
+        fv.full_config.reset(token)
+
+
+def test_web_server_ota_platform_alone_does_not_warn(
+    caplog: pytest.LogCaptureFixture,
+) -> None:
+    """Only the web_server component starts the shared listener, so the ota
+    platform on its own never exposes /update."""
+    full_conf = {
+        CONF_OTA: [
+            _make_ota_config(port=3232, **{CONF_ENCRYPTION: {CONF_KEY: OTHER_KEY}}),
+            {CONF_PLATFORM: "web_server", CONF_ID: ID("ota_ws", is_manual=False)},
+        ],
+    }
+    token = fv.full_config.set(full_conf)
+    try:
+        with caplog.at_level(logging.WARNING):
+            ota_esphome_final_validate({})
+        assert not any("plaintext /update" in r.message for r in caplog.records)
+    finally:
+        fv.full_config.reset(token)
+
+
 def test_web_server_ota_without_encryption_unaffected() -> None:
     """web_server ota stays valid alongside an unencrypted esphome entry."""
     full_conf = {
@@ -370,20 +439,87 @@ def test_auto_load_pulls_noise_only_for_encryption() -> None:
     assert "noise" in AUTO_LOAD({})
 
 
-def test_filter_source_files_excludes_noise_without_encryption() -> None:
-    """The noise transport source compiles only for encrypted builds."""
-    old_config = CORE.config
-    try:
-        CORE.config = {CONF_OTA: [_make_ota_config(port=3232)]}
-        assert FILTER_SOURCE_FILES() == ["ota_esphome_noise.cpp"]
-        CORE.config = {
-            CONF_OTA: [
-                _make_ota_config(port=3232, **{CONF_ENCRYPTION: {CONF_KEY: API_KEY}})
-            ]
-        }
-        assert FILTER_SOURCE_FILES() == []
-    finally:
-        CORE.config = old_config
+def test_static_encryption_key() -> None:
+    """Only a build-time key counts; a runtime provisioned one does not."""
+    assert static_encryption_key({}) is None
+    assert static_encryption_key({CONF_ENCRYPTION: {}}) is None
+    assert static_encryption_key({CONF_ENCRYPTION: {CONF_KEY: API_KEY}}) == API_KEY
+
+
+@pytest.mark.parametrize(
+    ("yaml_name", "defines_present", "defines_absent"),
+    [
+        # An api key alone compiles the transport in without requiring it;
+        # the device uses the api server's key, not a copy
+        (
+            "api_key_offer",
+            {"USE_OTA_ENCRYPTION", "USE_OTA_ENCRYPTION_FROM_API"},
+            {"USE_OTA_ENCRYPTION_REQUIRED", "USE_OTA_ENCRYPTION_PROVISIONED"},
+        ),
+        # A password still guards plaintext uploads on an offering device
+        (
+            "api_key_offer_password",
+            {"USE_OTA_ENCRYPTION", "USE_OTA_ENCRYPTION_FROM_API", "USE_OTA_PASSWORD"},
+            {"USE_OTA_ENCRYPTION_REQUIRED", "USE_OTA_ENCRYPTION_PROVISIONED"},
+        ),
+        # The ota encryption block is what makes the device refuse plaintext
+        (
+            "encryption_required",
+            {
+                "USE_OTA_ENCRYPTION",
+                "USE_OTA_ENCRYPTION_REQUIRED",
+                "USE_OTA_ENCRYPTION_FROM_API",
+            },
+            {"USE_OTA_ENCRYPTION_PROVISIONED"},
+        ),
+        # Without api encryption the ota key is the device's own
+        (
+            "own_key",
+            {"USE_OTA_ENCRYPTION", "USE_OTA_ENCRYPTION_REQUIRED"},
+            {"USE_OTA_ENCRYPTION_FROM_API", "USE_OTA_ENCRYPTION_PROVISIONED"},
+        ),
+        # A key provisioned at runtime lives in the api server; the device
+        # offers with it once provisioned and never requires it
+        (
+            "runtime_api_key",
+            {
+                "USE_OTA_ENCRYPTION",
+                "USE_OTA_ENCRYPTION_FROM_API",
+                "USE_OTA_ENCRYPTION_PROVISIONED",
+            },
+            {"USE_OTA_ENCRYPTION_REQUIRED"},
+        ),
+        # No api encryption at all keeps the noise glue out of the build
+        (
+            "plain",
+            set(),
+            {
+                "USE_OTA_ENCRYPTION",
+                "USE_OTA_ENCRYPTION_REQUIRED",
+                "USE_OTA_ENCRYPTION_FROM_API",
+                "USE_OTA_ENCRYPTION_PROVISIONED",
+            },
+        ),
+    ],
+)
+def test_encryption_offer_codegen(
+    generate_main: Callable[[str], str],
+    yaml_name: str,
+    defines_present: set[str],
+    defines_absent: set[str],
+) -> None:
+    main_cpp = generate_main(
+        f"tests/component_tests/ota/test_esphome_ota_{yaml_name}.yaml"
+    )
+    defines = {define.name for define in CORE.defines}
+    assert defines_present <= defines
+    assert not (defines_absent & defines)
+    encrypted = "USE_OTA_ENCRYPTION" in defines_present
+    own_key = encrypted and "USE_OTA_ENCRYPTION_FROM_API" not in defines_present
+    assert ("esphome_esphomeotacomponent_id->set_noise_psk(" in main_cpp) is own_key
+    assert ("set_auth_password(" in main_cpp) is ("USE_OTA_PASSWORD" in defines_present)
+    # The noise transport source compiles only when the define is set
+    assert FILTER_SOURCE_FILES() == ([] if encrypted else ["ota_esphome_noise.cpp"])
 
 
 def test_password_with_encryption_rejected() -> None:

tests/component_tests/ota/test_esphome_ota_api_key_offer.yaml

@@ -0,0 +1,11 @@
+esphome:
+  name: ota-offer
+
+host:
+
+api:
+  encryption:
+    key: "AAECAwQFBgcICQoLDA0ODxAREhMUFRYXGBkaGxwdHh8="
+
+ota:
+  - platform: esphome

tests/component_tests/ota/test_esphome_ota_api_key_offer_password.yaml

@@ -0,0 +1,12 @@
+esphome:
+  name: ota-offer-password
+
+host:
+
+api:
+  encryption:
+    key: "AAECAwQFBgcICQoLDA0ODxAREhMUFRYXGBkaGxwdHh8="
+
+ota:
+  - platform: esphome
+    password: "superlongpasswordthatnoonewillknow"

tests/component_tests/ota/test_esphome_ota_encryption_required.yaml

@@ -0,0 +1,12 @@
+esphome:
+  name: ota-encryption-required
+
+host:
+
+api:
+  encryption:
+    key: "AAECAwQFBgcICQoLDA0ODxAREhMUFRYXGBkaGxwdHh8="
+
+ota:
+  - platform: esphome
+    encryption:

tests/component_tests/ota/test_esphome_ota_own_key.yaml

@@ -0,0 +1,11 @@
+esphome:
+  name: ota-own-key
+
+host:
+
+api:
+
+ota:
+  - platform: esphome
+    encryption:
+      key: "AAECAwQFBgcICQoLDA0ODxAREhMUFRYXGBkaGxwdHh8="

tests/component_tests/ota/test_esphome_ota_plain.yaml

@@ -0,0 +1,9 @@
+esphome:
+  name: ota-plain
+
+host:
+
+api:
+
+ota:
+  - platform: esphome

tests/component_tests/ota/test_esphome_ota_runtime_api_key.yaml

@@ -0,0 +1,10 @@
+esphome:
+  name: ota-runtime-key
+
+host:
+
+api:
+  encryption:
+
+ota:
+  - platform: esphome

tests/component_tests/template/test_template_climate.py

@@ -0,0 +1,145 @@
+"""Tests for template climate config validation."""
+
+import pytest
+
+from esphome import config_validation as cv
+from esphome.components.template.climate import (
+    CONF_SET_TARGET_HUMIDITY_ACTION,
+    CONF_SET_TARGET_TEMPERATURE_ACTION,
+    CONF_SET_TARGET_TEMPERATURE_HIGH_ACTION,
+    CONF_SET_TARGET_TEMPERATURE_LOW_ACTION,
+    CONF_SUPPORTS_CURRENT_HUMIDITY,
+    CONF_SUPPORTS_CURRENT_TEMPERATURE,
+    CONF_SUPPORTS_TARGET_HUMIDITY,
+    CONF_SUPPORTS_TWO_POINT_TARGET_TEMPERATURE,
+    CONF_TARGET_HUMIDITY,
+    _resolve_supports,
+    _validate_initial_state,
+    _validate_set_actions,
+)
+from esphome.const import (
+    CONF_HUMIDITY_SENSOR,
+    CONF_INITIAL_STATE,
+    CONF_SENSOR,
+    CONF_TARGET_TEMPERATURE,
+    CONF_TARGET_TEMPERATURE_HIGH,
+    CONF_TARGET_TEMPERATURE_LOW,
+)
+from esphome.types import ConfigType
+
+
+def test_supports_current_temperature_derived_from_sensor() -> None:
+    config: ConfigType = {CONF_SENSOR: "some_sensor"}
+    assert _resolve_supports(config)[CONF_SUPPORTS_CURRENT_TEMPERATURE] is True
+
+
+def test_supports_current_temperature_false_without_sensor() -> None:
+    assert _resolve_supports({})[CONF_SUPPORTS_CURRENT_TEMPERATURE] is False
+
+
+def test_supports_current_temperature_explicit_true_without_sensor_allowed() -> None:
+    # The value can still be reported with climate.template.publish.
+    config: ConfigType = {CONF_SUPPORTS_CURRENT_TEMPERATURE: True}
+    assert _resolve_supports(config)[CONF_SUPPORTS_CURRENT_TEMPERATURE] is True
+
+
+def test_supports_current_temperature_false_with_sensor_rejected() -> None:
+    config: ConfigType = {
+        CONF_SENSOR: "some_sensor",
+        CONF_SUPPORTS_CURRENT_TEMPERATURE: False,
+    }
+    with pytest.raises(cv.Invalid, match="cannot be false"):
+        _resolve_supports(config)
+
+
+def test_supports_current_humidity_false_with_sensor_rejected() -> None:
+    config: ConfigType = {
+        CONF_HUMIDITY_SENSOR: "some_sensor",
+        CONF_SUPPORTS_CURRENT_HUMIDITY: False,
+    }
+    with pytest.raises(cv.Invalid, match="cannot be false"):
+        _resolve_supports(config)
+
+
+def test_two_point_derived_from_set_actions() -> None:
+    config: ConfigType = {
+        CONF_SET_TARGET_TEMPERATURE_LOW_ACTION: [{}],
+        CONF_SET_TARGET_TEMPERATURE_HIGH_ACTION: [{}],
+    }
+    assert _resolve_supports(config)[CONF_SUPPORTS_TWO_POINT_TARGET_TEMPERATURE] is True
+
+
+def test_two_point_false_with_set_action_rejected() -> None:
+    config: ConfigType = {
+        CONF_SET_TARGET_TEMPERATURE_LOW_ACTION: [{}],
+        CONF_SUPPORTS_TWO_POINT_TARGET_TEMPERATURE: False,
+    }
+    with pytest.raises(cv.Invalid, match="cannot be false"):
+        _resolve_supports(config)
+
+
+def test_target_humidity_derived_from_set_action() -> None:
+    config: ConfigType = {CONF_SET_TARGET_HUMIDITY_ACTION: [{}]}
+    assert _resolve_supports(config)[CONF_SUPPORTS_TARGET_HUMIDITY] is True
+
+
+def test_set_target_temperature_low_requires_high() -> None:
+    config: ConfigType = {CONF_SET_TARGET_TEMPERATURE_LOW_ACTION: [{}]}
+    with pytest.raises(cv.Invalid, match="must be used together"):
+        _validate_set_actions(config)
+
+
+def test_set_target_temperature_conflicts_with_two_point_actions() -> None:
+    config: ConfigType = {
+        CONF_SET_TARGET_TEMPERATURE_ACTION: [{}],
+        CONF_SET_TARGET_TEMPERATURE_LOW_ACTION: [{}],
+        CONF_SET_TARGET_TEMPERATURE_HIGH_ACTION: [{}],
+    }
+    with pytest.raises(cv.Invalid, match="cannot be used together"):
+        _validate_set_actions(config)
+
+
+def test_initial_state_target_temperature_rejected_with_two_point() -> None:
+    config: ConfigType = {
+        CONF_SUPPORTS_TWO_POINT_TARGET_TEMPERATURE: True,
+        CONF_SUPPORTS_TARGET_HUMIDITY: False,
+        CONF_INITIAL_STATE: {CONF_TARGET_TEMPERATURE: 21.0},
+    }
+    with pytest.raises(cv.Invalid, match="is not available"):
+        _validate_initial_state(config)
+
+
+def test_initial_state_two_point_values_rejected_without_two_point() -> None:
+    config: ConfigType = {
+        CONF_SUPPORTS_TWO_POINT_TARGET_TEMPERATURE: False,
+        CONF_SUPPORTS_TARGET_HUMIDITY: False,
+        CONF_INITIAL_STATE: {
+            CONF_TARGET_TEMPERATURE_LOW: 18.0,
+            CONF_TARGET_TEMPERATURE_HIGH: 24.0,
+        },
+    }
+    with pytest.raises(cv.Invalid, match="requires"):
+        _validate_initial_state(config)
+
+
+def test_initial_state_target_humidity_rejected_without_support() -> None:
+    config: ConfigType = {
+        CONF_SUPPORTS_TWO_POINT_TARGET_TEMPERATURE: False,
+        CONF_SUPPORTS_TARGET_HUMIDITY: False,
+        CONF_INITIAL_STATE: {CONF_TARGET_HUMIDITY: 50},
+    }
+    with pytest.raises(cv.Invalid, match="requires"):
+        _validate_initial_state(config)
+
+
+def test_initial_state_matching_two_point_accepted() -> None:
+    config: ConfigType = {
+        CONF_SUPPORTS_TWO_POINT_TARGET_TEMPERATURE: True,
+        CONF_SUPPORTS_TARGET_HUMIDITY: True,
+        CONF_INITIAL_STATE: {
+            CONF_TARGET_TEMPERATURE_LOW: 18.0,
+            CONF_TARGET_TEMPERATURE_HIGH: 24.0,
+            CONF_TARGET_HUMIDITY: 50,
+        },
+    }
+    assert _validate_initial_state(config) is config

tests/components/climate/common.yaml

@@ -30,8 +30,7 @@ climate:
       - switch.turn_on: climate_heater_switch
       - switch.turn_off: climate_cooler_switch
   # Thermostat-based climate so climate.control: action variants get build
-  # coverage (bang_bang doesn't support fan modes, presets, etc.). Climate
-  # has no template platform, so thermostat is the right vehicle.
+  # coverage (bang_bang doesn't support fan modes, presets, etc.).
   - platform: thermostat
     id: climate_test_thermostat
     name: Test Thermostat

tests/components/esp32_hosted/test-espnow.esp32-p4-idf.yaml

@@ -0,0 +1,5 @@
+# Exercises the ESP-NOW-over-hosted shim: on the ESP32-P4 host, esp32_hosted
+# supplies the esp_now_* symbols that the espnow component links against.
+packages:
+  esp32_hosted: !include common.yaml
+  espnow: !include ../espnow/common.yaml

tests/components/noise/test_noise_handshake.cpp

@@ -68,6 +68,14 @@ class Initiator {
 
 static const uint8_t PROLOGUE[] = {'t', 'e', 's', 't', 'p', 'r', 'o', 'l', 'o', 'g', 'u', 'e'};
 
+// The context only points at the key and init() copies it before returning,
+// so a temporary context over a temporary key is safe within one call
+static NoiseContext ctx_for(const psk_t &psk) {
+  NoiseContext ctx;
+  ctx.set_psk(psk.data());
+  return ctx;
+}
+
 static psk_t make_psk(uint8_t seed) {
   psk_t psk;
   for (size_t i = 0; i < psk.size(); i++) {
@@ -102,7 +110,7 @@ TEST(NoiseResponderHandshakeTest, MessageMethodsErrorBeforeInit) {
 TEST(NoiseResponderHandshakeTest, FullHandshakeAndTransportRoundTrip) {
   const psk_t psk = make_psk(7);
   NoiseResponderHandshake responder;
-  ASSERT_EQ(responder.init(psk, PROLOGUE, sizeof(PROLOGUE)), 0);
+  ASSERT_EQ(responder.init(ctx_for(psk), PROLOGUE, sizeof(PROLOGUE)), 0);
   EXPECT_EQ(responder.action(), Action::ACTION_READ);
 
   Initiator initiator(psk, PROLOGUE, sizeof(PROLOGUE));
@@ -155,8 +163,8 @@ TEST(NoiseResponderHandshakeTest, ReInitRestartsHandshake) {
   // proves the restart took effect; the old state surviving would fail the
   // MAC here.
   NoiseResponderHandshake responder;
-  ASSERT_EQ(responder.init(make_psk(7), PROLOGUE, sizeof(PROLOGUE)), 0);
-  ASSERT_EQ(responder.init(make_psk(9), PROLOGUE, sizeof(PROLOGUE)), 0);
+  ASSERT_EQ(responder.init(ctx_for(make_psk(7)), PROLOGUE, sizeof(PROLOGUE)), 0);
+  ASSERT_EQ(responder.init(ctx_for(make_psk(9)), PROLOGUE, sizeof(PROLOGUE)), 0);
   EXPECT_EQ(responder.action(), Action::ACTION_READ);
 
   Initiator initiator(make_psk(9), PROLOGUE, sizeof(PROLOGUE));
@@ -168,7 +176,7 @@ TEST(NoiseResponderHandshakeTest, ReInitRestartsHandshake) {
 
 TEST(NoiseResponderHandshakeTest, WrongPskFailsWithMacFailure) {
   NoiseResponderHandshake responder;
-  ASSERT_EQ(responder.init(make_psk(7), PROLOGUE, sizeof(PROLOGUE)), 0);
+  ASSERT_EQ(responder.init(ctx_for(make_psk(7)), PROLOGUE, sizeof(PROLOGUE)), 0);
 
   Initiator initiator(make_psk(200), PROLOGUE, sizeof(PROLOGUE));
   uint8_t msg[MAX_HANDSHAKE_SIZE];
@@ -185,7 +193,7 @@ TEST(NoiseResponderHandshakeTest, MismatchedPrologueFailsWithMacFailure) {
   // tampered preamble must fail even with the right key.
   const psk_t psk = make_psk(7);
   NoiseResponderHandshake responder;
-  ASSERT_EQ(responder.init(psk, PROLOGUE, sizeof(PROLOGUE)), 0);
+  ASSERT_EQ(responder.init(ctx_for(psk), PROLOGUE, sizeof(PROLOGUE)), 0);
 
   static const uint8_t TAMPERED[] = {'x'};
   Initiator initiator(psk, TAMPERED, sizeof(TAMPERED));

tests/components/noise/test_noise_primitives.cpp

@@ -17,12 +17,17 @@ TEST(NoiseContextTest, AllZerosPskIsReserved) {
   EXPECT_FALSE(NoiseContext::is_all_zeros(psk));
 
   NoiseContext ctx;
+  psk_t loaded;
   EXPECT_FALSE(ctx.has_psk());
-  ctx.set_psk(zeros);
-  EXPECT_FALSE(ctx.has_psk());
-  ctx.set_psk(psk);
+  ctx.load_psk(loaded);
+  EXPECT_EQ(loaded, zeros);
+  ctx.set_psk(psk.data());
   EXPECT_TRUE(ctx.has_psk());
-  EXPECT_EQ(ctx.get_psk(), psk);
+  ctx.load_psk(loaded);
+  EXPECT_EQ(loaded, psk);
+  // Callers map the reserved key to nullptr; the context just stores what it is given
+  ctx.set_psk(nullptr);
+  EXPECT_FALSE(ctx.has_psk());
 }
 
 TEST(WireFormatTest, FrameHeaderIsIndicatorPlusBigEndianLength) {

tests/components/ota/api_key_offer.yaml

@@ -0,0 +1,12 @@
+wifi:
+  ssid: MySSID
+  password: password1
+
+api:
+  encryption:
+    key: "AAECAwQFBgcICQoLDA0ODxAREhMUFRYXGBkaGxwdHh8="
+
+ota:
+  - platform: esphome
+    port: 3290
+    password: "superlongpasswordthatnoonewillknow"

tests/components/ota/api_runtime_key.yaml

@@ -0,0 +1,10 @@
+wifi:
+  ssid: MySSID
+  password: password1
+
+api:
+  encryption:
+
+ota:
+  - platform: esphome
+    port: 3291

tests/components/ota/test-api_key_offer.esp32-idf.yaml

@@ -0,0 +1,2 @@
+packages:
+  ota: !include api_key_offer.yaml

tests/components/ota/test-api_key_offer.esp8266-ard.yaml

@@ -0,0 +1,2 @@
+packages:
+  ota: !include api_key_offer.yaml

tests/components/ota/test-api_runtime_key.esp32-idf.yaml

@@ -0,0 +1,2 @@
+packages:
+  ota: !include api_runtime_key.yaml

tests/components/ota/test-api_runtime_key.esp8266-ard.yaml

@@ -0,0 +1,2 @@
+packages:
+  ota: !include api_runtime_key.yaml

tests/components/serial_proxy/test-tap.esp32-idf.yaml

@@ -1,14 +0,0 @@
-substitutions:
-  tx_pin: GPIO4
-  rx_pin: GPIO5
-
-# Compile the tap code paths; no tap is attached, so this exercises the
-# null-tap branches that a normal build never defines.
-esphome:
-  platformio_options:
-    build_flags:
-      - "-DUSE_SERIAL_PROXY_TAP"
-
-packages:
-  uart: !include ../../test_build_components/common/uart/esp32-idf.yaml
-  serial_proxy: !include common.yaml

tests/components/serial_proxy/test-usb.esp32-s3-idf.yaml

@@ -1,21 +0,0 @@
-wifi:
-  ssid: MySSID
-  password: password1
-
-api:
-
-usb_host:
-
-# port_type is omitted deliberately: a port on a USB UART channel derives USB_SERIAL
-usb_uart:
-  - type: CDC_ACM
-    vid: 0x303A
-    pid: 0x831A
-    channels:
-      - id: usb_serial_channel
-        baud_rate: 460800
-
-serial_proxy:
-  - id: serial_proxy_usb
-    uart_id: usb_serial_channel
-    name: USB Serial Port

tests/components/template/common-base.yaml

@@ -25,6 +25,27 @@ esphome:
         away: !lambda "return true;"
         is_on: !lambda "return false;"
 
+    - climate.template.publish:
+        id: template_climate
+        current_temperature: 21.0
+        mode: HEAT
+        fan_mode: AUTO
+        swing_mode: "OFF"
+        preset: NONE
+        target_temperature: 22.0
+
+    # Templated
+    - climate.template.publish:
+        id: template_climate
+        current_temperature: !lambda "return 21.5f;"
+        mode: !lambda "return climate::CLIMATE_MODE_COOL;"
+        target_temperature: !lambda "return 23.0f;"
+
+    - climate.template.publish:
+        id: template_climate_custom_modes
+        custom_fan_mode: "turbo"
+        custom_preset: "eco_plus"
+
     # Test C++ API: set_template() with stateless lambda (no captures)
     # NOTE: set_template() is not intended to be a public API, but we test it to ensure it doesn't break.
     - lambda: |-
@@ -513,6 +534,98 @@ alarm_control_panel:
     codes:
       - "1234"
 
+climate:
+  - platform: template
+    id: template_climate
+    name: "Template Climate"
+    optimistic: true
+    sensor: template_template_sens
+    supports_action: true
+    supports_current_humidity: true
+    restore_mode: NO_RESTORE
+    initial_state:
+      mode: HEAT
+      target_temperature: 21.0
+      fan_mode: LOW
+    supported_modes:
+      - "OFF"
+      - HEAT
+      - COOL
+    supported_fan_modes:
+      - AUTO
+      - LOW
+      - HIGH
+    supported_swing_modes:
+      - "OFF"
+      - VERTICAL
+    supported_presets:
+      - NONE
+      - ECO
+    visual:
+      min_temperature: 16.0
+      max_temperature: 30.0
+      temperature_step: 0.5
+    set_mode_action:
+      - logger.log:
+          format: "set_mode_action %d"
+          args: ["(int) x"]
+    set_target_temperature_action:
+      - logger.log:
+          format: "set_target_temperature_action %.1f"
+          args: ["x"]
+    set_target_humidity_action:
+      - logger.log:
+          format: "set_target_humidity_action %.1f"
+          args: ["x"]
+    set_fan_mode_action:
+      - logger.log:
+          format: "set_fan_mode_action %d"
+          args: ["(int) x"]
+    set_swing_mode_action:
+      - logger.log:
+          format: "set_swing_mode_action %d"
+          args: ["(int) x"]
+    set_preset_action:
+      - logger.log:
+          format: "set_preset_action %d"
+          args: ["(int) x"]
+    on_control:
+      - logger.log: "on_control fired"
+    on_state:
+      - logger.log: "on_state fired"
+
+  - platform: template
+    id: template_climate_custom_modes
+    name: "Template Climate Custom Modes"
+    optimistic: true
+    sensor: template_template_sens
+    supported_modes:
+      - "OFF"
+      - HEAT
+    custom_fan_modes:
+      - turbo
+      - silent
+      - eco
+    custom_presets:
+      - eco_plus
+      - power_save
+      - max
+    set_custom_fan_mode_action:
+      - logger.log:
+          format: "set_custom_fan_mode_action %s"
+          args: ["x.c_str()"]
+    set_custom_preset_action:
+      - logger.log:
+          format: "set_custom_preset_action %s"
+          args: ["x.c_str()"]
+    initial_state:
+      custom_fan_mode: eco
+      custom_preset: max
+    visual:
+      min_temperature: 16.0
+      max_temperature: 30.0
+      temperature_step: 0.5
+
 water_heater:
   - platform: template
     id: template_water_heater

tests/components/zigbee_proxy/.gitignore

@@ -1,5 +0,0 @@
-# Gitignore settings for ESPHome
-# This is an example and may include too much for your use-case.
-# You can modify this file to suit your needs.
-/.esphome/
-/secrets.yaml