Add host unit tests for the noise component

CODEOWNERS

@@ -381,6 +381,7 @@ esphome/components/nextion/switch/* @senexcrenshaw
 esphome/components/nextion/text_sensor/* @senexcrenshaw
 esphome/components/nfc/* @jesserockz @kbx81
 esphome/components/noblex/* @AGalfra
+esphome/components/noise/* @esphome/core
 esphome/components/npi19/* @bakerkj
 esphome/components/nrf52/* @tomaszduda23
 esphome/components/number/* @esphome/core

esphome/__main__.py

@@ -857,20 +857,7 @@ def compile_program(args: ArgsProtocol, config: ConfigType) -> int:
         toolchain.create_factory_bin()
         toolchain.create_ota_bin()
         toolchain.create_elf_copy()
-        from esphome.build_helpers.idedata import IDEDATA_BEST_EFFORT_ERRORS
-
-        try:
-            if toolchain.get_idedata() is None:
-                _LOGGER.warning("No idedata was generated for this build")
-        except IDEDATA_BEST_EFFORT_ERRORS as err:
-            # The firmware already built; an idedata failure must not fail
-            # a successful build.
-            _LOGGER.warning(
-                "Could not generate idedata: %s (IDE, clang-tidy, and "
-                "memory-analysis data will be unavailable for this build)",
-                err,
-            )
-            _LOGGER.debug("Idedata failure detail", exc_info=True)
+        toolchain.get_idedata()
     else:
         from esphome.platformio import toolchain
 
@@ -2734,14 +2721,10 @@ def run_esphome(argv):
     # Skipped when -s overrides are passed, since the cache was written
     # against the previous substitution set.
     config: ConfigType | None = None
-    cache_write_eligible = (
+    cache_eligible = (
         args.command in ("upload", "logs") and not command_line_substitutions
     )
-    # An explicit --toolchain must re-run the per-platform validators, so
-    # gate only the cache read; the refresh below saves the result unless
-    # the sidecar records a different toolchain.
-    cache_read_eligible = cache_write_eligible and args.toolchain is None
-    if cache_read_eligible:
+    if cache_eligible:
         from esphome.compiled_config import load_compiled_config
 
         config = load_compiled_config(conf_path)
@@ -2765,14 +2748,17 @@ def run_esphome(argv):
             return 2
     CORE.config = config
 
-    # The cache fast path skips validation, and legacy sidecars lack the
-    # toolchain field. Must run before the cache refresh below.
+    # Fallback for platforms whose validators didn't set the toolchain
+    # (only the esp32 component reads esp32.framework.toolchain). All
+    # other platforms only support PlatformIO today. Must run before the
+    # cache refresh below so its sidecar records the same toolchain a
+    # compile would.
     if CORE.toolchain is None:
         CORE.toolchain = Toolchain.PLATFORMIO
 
     # Refresh the cache so the next upload/logs hits the fast path
     # instead of re-running read_config.
-    if cache_write_eligible and cache_missed:
+    if cache_eligible and cache_missed:
         from esphome.compiled_config import save_compiled_config_and_sidecar
 
         save_compiled_config_and_sidecar(config)

esphome/arduino8266/__init__.py

@@ -1,9 +0,0 @@
-"""Native (PlatformIO-free) build support for the ESP8266 Arduino core.
-
-This package downloads the Arduino ESP8266 core and the xtensa-lx106
-toolchain, generates a ninja build for them plus the ESPHome sources, and
-drives the build directly — the ESP8266 equivalent of ``esphome.espidf``.
-
-Deliberately importable without the esp8266 component to avoid circular
-imports; the component wires these modules in via lazy imports.
-"""

esphome/arduino8266/framework.py

@@ -1,164 +0,0 @@
-"""Download and install the Arduino ESP8266 core, toolchain, and ninja.
-
-Artifacts land in a machine-global cache (shared across projects, like the
-ESP-IDF install in ``esphome.espidf.framework``):
-
-    <cache>/arduino8266/frameworks/<version>/   framework-arduinoespressif8266
-    <cache>/arduino8266/toolchains/<version>/   toolchain-xtensa (gcc 10.3)
-
-Packages come from the PlatformIO registry (identical bits to the PlatformIO
-backend); ``ESPHOME_ARDUINO8266_*_MIRRORS`` overrides the URLs. ninja comes
-from PATH or the ninja PyPI wheel.
-"""
-
-from __future__ import annotations
-
-import os
-from pathlib import Path
-from typing import NamedTuple
-
-from esphome.build_helpers.ccache import ccache_defaults_env
-from esphome.build_helpers.ninja import find_ninja
-from esphome.build_helpers.tools_cache import ARDUINO8266_TOOLS_CACHE, tools_cache_path
-from esphome.core import EsphomeError, Version
-from esphome.framework_helpers import str_to_lst_of_str
-from esphome.platformio.registry import install_package, prefetch_packages
-
-FRAMEWORK_PACKAGE = "framework-arduinoespressif8266"
-TOOLCHAIN_PACKAGE = "toolchain-xtensa"
-# gcc 10.3, the toolchain Arduino core 3.x builds with; the build
-# generator's compile flags are tuned to it.
-TOOLCHAIN_VERSION = "2.100300.220621"
-
-ESPHOME_ARDUINO8266_FRAMEWORK_MIRRORS = str_to_lst_of_str(
-    os.environ.get("ESPHOME_ARDUINO8266_FRAMEWORK_MIRRORS", "")
-)
-ESPHOME_ARDUINO8266_TOOLCHAIN_MIRRORS = str_to_lst_of_str(
-    os.environ.get("ESPHOME_ARDUINO8266_TOOLCHAIN_MIRRORS", "")
-)
-
-
-def get_arduino8266_tools_path() -> Path:
-    # Machine-global so all projects share one install; see
-    # espidf.framework.get_idf_tools_path for the location rationale.
-    return tools_cache_path(*ARDUINO8266_TOOLS_CACHE)
-
-
-# 3.1.1 rather than 3.1.0: the registry has no package for 3.1.0, and the
-# encoder below cannot name 3.0.0/3.0.1 either (see its docstring)
-MIN_FRAMEWORK_VERSION = Version(3, 1, 1)
-
-
-def framework_package_version(ver: Version) -> str:
-    """Map an Arduino core version to its registry package version (3.1.2 ->
-    3.30102.0; the leading 3 is the package major).
-
-    Exact registry names only for cores > 2.6.2 and >= 3.0.2; callers floor
-    at MIN_FRAMEWORK_VERSION.
-    """
-    if ver.major > 3:
-        raise EsphomeError(
-            f"Arduino core {ver} is not supported yet; "
-            "the newest known core series is 3.x"
-        )
-    if ver <= Version(2, 6, 2):
-        # Cores <= 2.6.2 use the older 1.x/2.x package-major encodings (same
-        # boundary as _format_framework_arduino_version's era guard)
-        raise EsphomeError(
-            f"Arduino core {ver} uses an older package encoding than this "
-            "helper implements (newer than 2.6.2)"
-        )
-    return f"3.{ver.major}{ver.minor:02d}{ver.patch:02d}.0"
-
-
-def get_framework_path(package_version: str) -> Path:
-    return get_arduino8266_tools_path() / "frameworks" / package_version
-
-
-def get_toolchain_path() -> Path:
-    return get_arduino8266_tools_path() / "toolchains" / TOOLCHAIN_VERSION
-
-
-class InstalledPaths(NamedTuple):
-    """Locations of the installed framework, toolchain, and ninja binary."""
-
-    framework: Path
-    toolchain: Path
-    ninja: Path
-
-
-def check_and_install(framework_version: Version) -> InstalledPaths:
-    """Ensure framework, toolchain, and ninja are installed; return their paths."""
-    if framework_version < MIN_FRAMEWORK_VERSION:
-        # Config validation enforces this too; keep the module honest when
-        # called directly.
-        raise EsphomeError(
-            f"The native toolchain requires the Arduino core "
-            f">= {MIN_FRAMEWORK_VERSION}, got {framework_version}"
-        )
-    # Probe the cheap local dependency before ~110 MB of downloads
-    ninja_path = find_ninja()
-    package_version = framework_package_version(framework_version)
-    framework_path = get_framework_path(package_version)
-    downloads_dir = get_arduino8266_tools_path() / "downloads"
-    toolchain_path = get_toolchain_path()
-    # One spec per package: the prefetch and the installs must agree
-    specs = (
-        (
-            FRAMEWORK_PACKAGE,
-            package_version,
-            framework_path,
-            ESPHOME_ARDUINO8266_FRAMEWORK_MIRRORS,
-            ("cores/esp8266", "tools/sdk", "libraries"),
-        ),
-        (
-            TOOLCHAIN_PACKAGE,
-            TOOLCHAIN_VERSION,
-            toolchain_path,
-            ESPHOME_ARDUINO8266_TOOLCHAIN_MIRRORS,
-            # xtensa-lx106-elf pins the target: every gcc package has a bin/
-            ("bin", "xtensa-lx106-elf"),
-        ),
-    )
-    # Fetch both archives at once; the installs below verify and extract
-    prefetch_packages([spec[:4] for spec in specs], downloads_dir)
-    for name, version, dest, mirrors, expect in specs:
-        install_package(name, version, dest, mirrors, downloads_dir, expect=expect)
-    return InstalledPaths(
-        framework=framework_path, toolchain=toolchain_path, ninja=ninja_path
-    )
-
-
-def toolchain_tool(toolchain_path: Path, name: str) -> Path:
-    """Path to one toolchain tool (gcc, g++, ar, size, addr2line, ...).
-
-    The single owner of the ``bin/xtensa-lx106-elf-<name>`` layout and the
-    Windows suffix, so a toolchain package bump touches one spot.
-    """
-    suffix = ".exe" if os.name == "nt" else ""
-    return toolchain_path / "bin" / f"xtensa-lx106-elf-{name}{suffix}"
-
-
-def get_build_env(toolchain_path: Path, ccache: str | None) -> dict[str, str]:
-    env = os.environ.copy()
-    # Drop empty entries: a trailing separator from an absent PATH would
-    # make the shell search the current directory for tools
-    parts = [
-        str(toolchain_path / "bin"),
-        *filter(None, env.get("PATH", "").split(os.pathsep)),
-    ]
-    env["PATH"] = os.pathsep.join(parts)
-    env.update(ccache_env(ccache))
-    return env
-
-
-def ccache_env(ccache: str | None) -> dict[str, str]:
-    """Return ccache settings for the build subprocess (not os.environ).
-
-    ``ccache`` is the pre-resolved binary (resolve_ccache_path), or None
-    when disabled. Values the user already set in the environment are
-    respected.
-    """
-    if ccache is None:
-        return {}
-    return ccache_defaults_env(get_arduino8266_tools_path() / "ccache")

esphome/build_helpers/__init__.py

@@ -1 +0,0 @@
-"""Build helpers shared by the native (non-PlatformIO) toolchains."""

esphome/build_helpers/ccache.py

@@ -1,93 +0,0 @@
-"""Shared ccache policy for build backends: env-knob parsing, binary
-resolution, and default ``CCACHE_*`` values."""
-
-from __future__ import annotations
-
-import logging
-import os
-from pathlib import Path
-
-from esphome.framework_helpers import strip_win_long_path_prefix, tool_version_runs
-from esphome.helpers import FALSY_BOOL_STRINGS, TRUTHY_BOOL_STRINGS
-
-_LOGGER = logging.getLogger(__name__)
-
-# cv.boolean's spelling tables plus the 1/0 env convention
-TRUTHY_ENV_STRINGS = TRUTHY_BOOL_STRINGS | {"1"}
-FALSY_ENV_STRINGS = FALSY_BOOL_STRINGS | {"0"}
-
-
-def _ccache_runs(ccache: str) -> bool:
-    """Return True when the ``ccache`` found on PATH actually runs."""
-    return tool_version_runs(
-        ccache,
-        "Ignoring ccache at %s because it failed to run; compiling without ccache",
-    )
-
-
-def parse_enable_env(name: str) -> bool | None:
-    """Strictly parse an on/off environment knob; None when unset or invalid.
-
-    ``bool(str)`` truthiness would flip ``no``/``off`` to enabled, so only
-    1/true/yes/on and 0/false/no/off count; anything else warns and reads
-    as unset so the caller's default policy applies.
-    """
-    raw = os.environ.get(name)
-    if raw is None:
-        return None
-    lowered = raw.strip().lower()
-    if lowered in TRUTHY_ENV_STRINGS:
-        return True
-    if lowered in FALSY_ENV_STRINGS:
-        return False
-    _LOGGER.warning("Ignoring unrecognized %s=%r; use 1 or 0", name, raw)
-    return None
-
-
-def resolve_ccache_path() -> str | None:
-    """The ccache binary to wrap compiles with, or None when disabled.
-
-    An explicit ``ESPHOME_CCACHE_ENABLE=1`` skips the runnability probe; the
-    Windows extended-length prefix is stripped before probing (#18399).
-    """
-    import shutil
-
-    explicit = parse_enable_env("ESPHOME_CCACHE_ENABLE")
-    if explicit is False:
-        return None
-    ccache = shutil.which("ccache")
-    if ccache is None:
-        if explicit:
-            _LOGGER.warning(
-                "ESPHOME_CCACHE_ENABLE is set but no ccache binary is on PATH; "
-                "compiling without ccache"
-            )
-        return None
-    ccache = strip_win_long_path_prefix(ccache)
-    if not explicit and not _ccache_runs(ccache):
-        return None
-    return ccache
-
-
-def ccache_defaults_env(cache_dir: Path) -> dict[str, str]:
-    """Default ``CCACHE_*`` values for a build subprocess (not os.environ).
-
-    Values the user already set in the environment are respected. Depend
-    mode is on: both native backends emit depfiles (-MMD / CMake), which
-    keeps cache-miss overhead low.
-    """
-    from esphome.core import CORE
-
-    # An unset build_path means the env was built before preload; fail loudly
-    # rather than silently drop CCACHE_BASEDIR.
-    if CORE.build_path is None:
-        raise ValueError(
-            "CORE.build_path must be set before constructing the build environment"
-        )
-    defaults = {
-        "CCACHE_DIR": str(cache_dir),
-        "CCACHE_NOHASHDIR": "true",
-        "CCACHE_DEPEND": "1",
-        "CCACHE_BASEDIR": str(Path(CORE.build_path).resolve()),
-    }
-    return {k: v for k, v in defaults.items() if k not in os.environ}

esphome/build_helpers/ninja.py

@@ -1,92 +0,0 @@
-"""Platform-neutral helpers for ninja-driven native builds."""
-
-from __future__ import annotations
-
-import logging
-import os
-from pathlib import Path
-import re
-import shutil
-
-from esphome.core import EsphomeError
-from esphome.framework_helpers import strip_win_long_path_prefix, tool_version_runs
-
-_LOGGER = logging.getLogger(__name__)
-
-
-def _ninja_runs(binary: str) -> bool:
-    """Whether the ninja found on PATH actually runs (see tool_version_runs)."""
-    return tool_version_runs(
-        binary,
-        "Ignoring ninja at %s because it failed to run; "
-        "falling back to the bundled wheel",
-    )
-
-
-def find_ninja() -> Path:
-    """Locate the ninja binary: a runnable PATH hit first, else the ninja
-    PyPI wheel."""
-    if binary := shutil.which("ninja"):
-        binary = strip_win_long_path_prefix(binary)
-        if _ninja_runs(binary):
-            return Path(binary)
-    import_error: ImportError | None = None
-    try:
-        import ninja
-    except ImportError as err:
-        import_error = err
-        wheel_binary = None
-    else:
-        wheel_binary = Path(ninja.BIN_DIR) / (
-            "ninja.exe" if os.name == "nt" else "ninja"
-        )
-    if wheel_binary is None or not wheel_binary.is_file():
-        raise EsphomeError(
-            "ninja not found on PATH or in the ninja package; reinstall the "
-            "esphome Python environment"
-        ) from import_error
-    return wheel_binary
-
-
-def escape(value: Path | str) -> str:
-    """Escape a path or token for a ninja file."""
-    return str(value).replace("$", "$$").replace(":", "$:").replace(" ", "$ ")
-
-
-def quote_arg(tok: str) -> str:
-    """Quote with the CreateProcess argv rule (as ``subprocess.list2cmdline``):
-    backslash runs double only before a quote. Windows-only; ``$`` must
-    already be doubled for ninja.
-    """
-    quoted = re.sub(r'(\\*)"', lambda m: m.group(1) * 2 + '\\"', tok)
-    quoted = re.sub(r"(\\+)\Z", lambda m: m.group(1) * 2, quoted)
-    return f'"{quoted}"'
-
-
-# Force-quote any token containing a character outside the shlex.quote-style
-# safe set: ninja hands POSIX commands to /bin/sh -c, so bare (, ;, <, *, `
-# and friends would be re-parsed as shell syntax.
-_NEEDS_QUOTE = re.compile(r"[^\w@%+=:,./-]")
-
-
-def shell_token(tok: str, force: bool = False) -> str:
-    """Re-quote a lexed token for the platform shell; ``force`` always quotes.
-
-    Single quotes on POSIX (/bin/sh), the argv rule on Windows
-    (CreateProcess). ``$`` is doubled first because ninja expands it before
-    the command reaches the shell.
-    """
-    tok = tok.replace("$", "$$")  # ninja would expand a bare $ to nothing
-    if not (force or not tok or _NEEDS_QUOTE.search(tok)):
-        return tok
-    # An empty token must become '' / "" or it vanishes from the argv
-    if os.name == "nt":
-        return quote_arg(tok)
-    # shlex.quote's rule; inlined because the $-doubled token must not be
-    # re-examined for safe characters
-    return "'" + tok.replace("'", "'\"'\"'") + "'"
-
-
-def quote_path(value: Path | str) -> str:
-    """Force-quote a path for the ninja command line (shell/CreateProcess)."""
-    return shell_token(str(value), force=True)

esphome/build_helpers/size_summary.py

@@ -1,24 +0,0 @@
-"""The PlatformIO-format size bar shared by the native toolchains."""
-
-from __future__ import annotations
-
-
-def format_bar(used: int, total: int) -> str:
-    """Match PlatformIO's ``_format_availale_bytes`` (sic, pioupload.py) exactly."""
-    pct_raw = used / total if total else 0
-    blocks = 10
-    filled = min(int(round(blocks * pct_raw)), blocks)
-    progress = "=" * filled
-    return (
-        f"[{progress:<{blocks}}] {pct_raw: 6.1%} "
-        f"(used {used:d} bytes from {total:d} bytes)"
-    )
-
-
-def print_size_line(label: str, used: int, total: int) -> None:
-    """One PlatformIO-format summary line (``RAM``/``Flash``).
-
-    The label padding is part of the format: ``script/ci_memory_impact_extract.py``
-    matches these lines verbatim.
-    """
-    print(f"{label + ':':<7}{format_bar(used, total)}")

esphome/build_helpers/tools_cache.py

@@ -1,36 +0,0 @@
-"""Machine-global tools cache location shared by the native backends."""
-
-from __future__ import annotations
-
-from pathlib import Path
-
-
-def tools_cache_path(env_var: str, subdir: str) -> Path:
-    """A backend's machine-global tools directory, with an env override.
-
-    A blank/whitespace override is treated as unset: ``Path("")`` resolves
-    to the CWD, which ``clean-all`` would then delete.
-    """
-    import platformdirs
-
-    from esphome.helpers import get_str_env
-
-    if prefix := get_str_env(env_var, "").strip():
-        # resolve(): symlinked prefixes otherwise trip idf.py's
-        # venv-mismatch warning on every build
-        return Path(prefix).expanduser().resolve()
-    # appauthor=False keeps the Windows path short (no vendor segment);
-    # deep IDF trees run into MAX_PATH otherwise
-    return (
-        Path(platformdirs.user_cache_dir("esphome", appauthor=False)) / subdir
-    ).resolve()
-
-
-# (env override, cache subdir) per native backend. writer.clean_all wipes
-# every entry via tools_cache_path, so listing a cache here is the single
-# step that registers it for removal; the backends' own path getters use
-# the same named pairs so the two cannot drift.
-IDF_TOOLS_CACHE = ("ESPHOME_ESP_IDF_PREFIX", "idf")
-SDK_NRF_TOOLS_CACHE = ("ESPHOME_SDK_NRF_PREFIX", "sdk-nrf")
-ARDUINO8266_TOOLS_CACHE = ("ESPHOME_ARDUINO8266_PREFIX", "arduino8266")
-TOOLS_CACHE_SPECS = (IDF_TOOLS_CACHE, SDK_NRF_TOOLS_CACHE, ARDUINO8266_TOOLS_CACHE)

esphome/compiled_config.py

@@ -100,21 +100,6 @@ def _refresh_sidecar() -> bool:
             )
             return False
         if old is not None and old.can_apply_to_core():
-            if (
-                old.toolchain is not None
-                and CORE.toolchain is not None
-                and old.toolchain != CORE.toolchain.value
-            ):
-                # Platforms normalize toolchain-sensitive keys differently;
-                # never cache a config validated under a different toolchain
-                # than the compile's
-                _LOGGER.debug(
-                    "Not caching: config validated with toolchain %r but the "
-                    "last compile used %r",
-                    CORE.toolchain.value,
-                    old.toolchain,
-                )
-                return False
             # Compile-written; nothing to refresh.
             return True
         if CORE.build_path is not None and CORE.build_path.exists():

esphome/components/api/__init__.py

@@ -1,4 +1,3 @@
-import base64
 import logging
 from typing import Any
 
@@ -6,6 +5,15 @@ from esphome import automation
 from esphome.automation import Condition
 import esphome.codegen as cg
 from esphome.components.logger import request_log_listener
+
+# ENCRYPTION_SCHEMA and validate_encryption_key are re-exported for external
+# components and downstream consumers that import them from api
+from esphome.components.noise import (  # noqa: F401
+    ENCRYPTION_SCHEMA,
+    decode_encryption_key,
+    encryption_schema,
+    validate_encryption_key,
+)
 from esphome.config_helpers import get_logger_level
 import esphome.config_validation as cv
 from esphome.const import (
@@ -38,6 +46,10 @@ from esphome.core import CORE, ID, CoroPriority, EsphomeError, coroutine_with_pr
 from esphome.cpp_generator import MockObj, TemplateArgsType
 from esphome.types import ConfigFragmentType, ConfigType
 
+# Compat alias: downstream consumers (e.g. device-builder) referenced the
+# schema by its old private name before it moved to the noise component
+_encryption_schema = encryption_schema
+
 _LOGGER = logging.getLogger(__name__)
 
 DOMAIN = "api"
@@ -46,9 +58,15 @@ CODEOWNERS = ["@esphome/core"]
 
 
 def AUTO_LOAD(config: ConfigType) -> list[str]:
-    """Conditionally auto-load json only when capture_response is used."""
+    """Conditionally auto-load noise (encryption) and json (capture_response)."""
     base = ["socket"]
 
+    # A falsy config is a tooling probe for the maximal set (None from
+    # dependency resolution, {} from the components-graph platform probe);
+    # a validated config always carries defaults, never empty
+    if not config or CONF_ENCRYPTION in config:
+        base = base + ["noise"]
+
     # Check if any homeassistant.action/homeassistant.service has capture_response: true
     # This flag is set during config validation in _validate_response_config
     if not config or CORE.data.get(DOMAIN, {}).get(CONF_CAPTURE_RESPONSE, False):
@@ -130,20 +148,6 @@ def _register_provisioning_source(config: ConfigType) -> ConfigType:
     return config
 
 
-def validate_encryption_key(value: Any) -> str:
-    value = cv.string_strict(value)
-    try:
-        decoded = base64.b64decode(value, validate=True)
-    except ValueError as err:
-        raise cv.Invalid("Invalid key format, please check it's using base64") from err
-
-    if len(decoded) != 32:
-        raise cv.Invalid("Encryption key must be base64 and 32 bytes long")
-
-    # Return original data for roundtrip conversion
-    return value
-
-
 CONF_SUPPORTS_RESPONSE = "supports_response"
 
 # Enum values in api::enums namespace
@@ -250,18 +254,6 @@ ACTIONS_SCHEMA = automation.validate_automation(
     ),
 )
 
-ENCRYPTION_SCHEMA = cv.Schema(
-    {
-        cv.Optional(CONF_KEY): cv.sensitive(validate_encryption_key),
-    }
-)
-
-
-def _encryption_schema(config: ConfigType | None) -> ConfigType:
-    if config is None:
-        config = {}
-    return ENCRYPTION_SCHEMA(config)
-
 
 def _consume_api_sockets(config: ConfigType) -> ConfigType:
     """Register socket needs for API component."""
@@ -297,7 +289,7 @@ CONFIG_SCHEMA = cv.All(
                 CONF_SERVICES, group_of_exclusion=CONF_ACTIONS
             ): ACTIONS_SCHEMA,
             cv.Exclusive(CONF_ACTIONS, group_of_exclusion=CONF_ACTIONS): ACTIONS_SCHEMA,
-            cv.Optional(CONF_ENCRYPTION): _encryption_schema,
+            cv.Optional(CONF_ENCRYPTION): encryption_schema,
             cv.Optional(CONF_BATCH_DELAY, default="100ms"): cv.All(
                 cv.positive_time_period_milliseconds,
                 cv.Range(max=cv.TimePeriod(milliseconds=65535)),
@@ -484,7 +476,7 @@ async def to_code(config: ConfigType) -> None:
 
     if (encryption_config := config.get(CONF_ENCRYPTION, None)) is not None:
         if key := encryption_config.get(CONF_KEY):
-            decoded = base64.b64decode(key)
+            decoded = decode_encryption_key(key)
             cg.add(var.set_noise_psk(list(decoded)))
             cg.add_define("USE_API_NOISE_PSK_FROM_YAML")
         else:
@@ -498,10 +490,6 @@ async def to_code(config: ConfigType) -> None:
             # and plaintext disabled. Only a factory reset can remove it.
             cg.add_define("USE_API_PLAINTEXT")
         cg.add_define("USE_API_NOISE")
-        cg.add_library("esphome/noise-c", "0.1.21")
-        # Enable optimized memzero/memcmp in libsodium instead of volatile byte loops
-        cg.add_build_flag("-DHAVE_WEAK_SYMBOLS=1")
-        cg.add_build_flag("-DHAVE_INLINE_ASM=1")
     else:
         cg.add_define("USE_API_PLAINTEXT")
 

esphome/components/api/api_connection.cpp

@@ -2130,7 +2130,7 @@ bool APIConnection::send_noise_encryption_set_key_response_(const NoiseEncryptio
   }
 #endif
 
-  psk_t psk{};
+  noise::psk_t psk{};
   if (msg.key_len == 0) {
     if (this->parent_->clear_noise_psk(true)) {
       resp.success = true;
@@ -2139,7 +2139,7 @@ bool APIConnection::send_noise_encryption_set_key_response_(const NoiseEncryptio
     }
   } else if (base64_decode(msg.key, msg.key_len, psk.data(), psk.size()) != psk.size()) {
     ESP_LOGW(TAG, "Invalid encryption key length");
-  } else if (APINoiseContext::is_all_zeros(psk)) {
+  } else if (noise::NoiseContext::is_all_zeros(psk)) {
     // Accepting the reserved provisioning PSK would report success without
     // enabling encryption (or silently clear an existing key)
     ESP_LOGW(TAG, "Rejecting all-zero encryption key");

esphome/components/api/api_frame_helper_noise.cpp

@@ -2,9 +2,9 @@
 #ifdef USE_API
 #ifdef USE_API_NOISE
 #include "api_connection.h"  // For ClientInfo struct
+#include "esphome/components/noise/noise.h"
 #include "esphome/core/application.h"
 #include "esphome/core/entity_base.h"
-#include "esphome/core/hal.h"
 #include "esphome/core/helpers.h"
 #include "esphome/core/log.h"
 #include "proto.h"
@@ -17,6 +17,14 @@
 
 namespace esphome::api {
 
+using noise::noise_err_to_logstr;
+
+// api_frame_helper.h keeps its own MAX_HANDSHAKE_SIZE because that header is
+// also compiled in plaintext-only builds without the noise component; keep
+// the two definitions from drifting apart.
+static_assert(MAX_HANDSHAKE_SIZE == noise::MAX_HANDSHAKE_SIZE,
+              "api and noise component handshake size limits must match");
+
 static const char *const TAG = "api.noise";
 #ifdef USE_ESP8266
 static constexpr char PROLOGUE_INIT[] PROGMEM = "NoiseAPIInit";
@@ -51,45 +59,6 @@ static constexpr size_t API_MAX_LOG_BYTES = 168;
 #define LOG_PACKET_RECEIVED(buffer) ((void) 0)
 #endif
 
-/// Convert a noise error code to a readable error
-const LogString *noise_err_to_logstr(int err) {
-  if (err == NOISE_ERROR_NO_MEMORY)
-    return LOG_STR("NO_MEMORY");
-  if (err == NOISE_ERROR_UNKNOWN_ID)
-    return LOG_STR("UNKNOWN_ID");
-  if (err == NOISE_ERROR_UNKNOWN_NAME)
-    return LOG_STR("UNKNOWN_NAME");
-  if (err == NOISE_ERROR_MAC_FAILURE)
-    return LOG_STR("MAC_FAILURE");
-  if (err == NOISE_ERROR_NOT_APPLICABLE)
-    return LOG_STR("NOT_APPLICABLE");
-  if (err == NOISE_ERROR_SYSTEM)
-    return LOG_STR("SYSTEM");
-  if (err == NOISE_ERROR_REMOTE_KEY_REQUIRED)
-    return LOG_STR("REMOTE_KEY_REQUIRED");
-  if (err == NOISE_ERROR_LOCAL_KEY_REQUIRED)
-    return LOG_STR("LOCAL_KEY_REQUIRED");
-  if (err == NOISE_ERROR_PSK_REQUIRED)
-    return LOG_STR("PSK_REQUIRED");
-  if (err == NOISE_ERROR_INVALID_LENGTH)
-    return LOG_STR("INVALID_LENGTH");
-  if (err == NOISE_ERROR_INVALID_PARAM)
-    return LOG_STR("INVALID_PARAM");
-  if (err == NOISE_ERROR_INVALID_STATE)
-    return LOG_STR("INVALID_STATE");
-  if (err == NOISE_ERROR_INVALID_NONCE)
-    return LOG_STR("INVALID_NONCE");
-  if (err == NOISE_ERROR_INVALID_PRIVATE_KEY)
-    return LOG_STR("INVALID_PRIVATE_KEY");
-  if (err == NOISE_ERROR_INVALID_PUBLIC_KEY)
-    return LOG_STR("INVALID_PUBLIC_KEY");
-  if (err == NOISE_ERROR_INVALID_FORMAT)
-    return LOG_STR("INVALID_FORMAT");
-  if (err == NOISE_ERROR_INVALID_SIGNATURE)
-    return LOG_STR("INVALID_SIGNATURE");
-  return LOG_STR("UNKNOWN");
-}
-
 /// Initialize the frame helper, returns OK if successful.
 APIError APINoiseFrameHelper::init() {
   APIError err = init_common_();
@@ -194,9 +163,9 @@ APIError APINoiseFrameHelper::loop() {
  */
 APIError APINoiseFrameHelper::try_read_frame_() {
   // read header
-  if (rx_header_buf_len_ < 3) {
+  if (rx_header_buf_len_ < noise::FRAME_HEADER_SIZE) {
     // no header information yet
-    uint8_t to_read = 3 - rx_header_buf_len_;
+    uint8_t to_read = static_cast<uint8_t>(noise::FRAME_HEADER_SIZE) - rx_header_buf_len_;
     ssize_t received = this->socket_->read(&rx_header_buf_[rx_header_buf_len_], to_read);
     APIError err = handle_socket_read_result_(received);
     if (err != APIError::OK) {
@@ -208,7 +177,7 @@ APIError APINoiseFrameHelper::try_read_frame_() {
       return APIError::WOULD_BLOCK;
     }
 
-    if (rx_header_buf_[0] != 0x01) {
+    if (rx_header_buf_[0] != noise::FRAME_INDICATOR) {
       state_ = State::FAILED;
       HELPER_LOG("Bad indicator byte %u", rx_header_buf_[0]);
       return APIError::BAD_INDICATOR;
@@ -348,15 +317,15 @@ APIError APINoiseFrameHelper::state_action_server_hello_() {
   return APIError::OK;
 }
 APIError APINoiseFrameHelper::state_action_handshake_() {
-  int action = noise_handshakestate_get_action(this->handshake_);
-  if (action == NOISE_ACTION_READ_MESSAGE) {
+  noise::NoiseResponderHandshake::Action action = this->handshake_.action();
+  if (action == noise::NoiseResponderHandshake::Action::ACTION_READ) {
     return this->state_action_handshake_read_();
-  } else if (action == NOISE_ACTION_WRITE_MESSAGE) {
+  } else if (action == noise::NoiseResponderHandshake::Action::ACTION_WRITE) {
     return this->state_action_handshake_write_();
   }
   // bad state for action
   this->state_ = State::FAILED;
-  HELPER_LOG("Bad action for handshake: %d", action);
+  HELPER_LOG("Bad action for handshake: %d", (int) action);
   return APIError::HANDSHAKESTATE_BAD_STATE;
 }
 APIError APINoiseFrameHelper::state_action_handshake_read_() {
@@ -368,20 +337,16 @@ APIError APINoiseFrameHelper::state_action_handshake_read_() {
   if (this->rx_buf_.empty()) {
     this->send_explicit_handshake_reject_(LOG_STR("Empty handshake message"));
     return APIError::BAD_HANDSHAKE_ERROR_BYTE;
-  } else if (this->rx_buf_[0] != 0x00) {
+  } else if (this->rx_buf_[0] != noise::HANDSHAKE_STATUS_OK) {
     HELPER_LOG("Bad handshake error byte: %u", this->rx_buf_[0]);
     this->send_explicit_handshake_reject_(LOG_STR("Bad handshake error byte"));
     return APIError::BAD_HANDSHAKE_ERROR_BYTE;
   }
 
-  NoiseBuffer mbuf;
-  noise_buffer_init(mbuf);
-  noise_buffer_set_input(mbuf, this->rx_buf_.data() + 1, this->rx_buf_.size() - 1);
-  int err = noise_handshakestate_read_message(this->handshake_, &mbuf, nullptr);
+  int err = this->handshake_.read_message(this->rx_buf_.data() + 1, this->rx_buf_.size() - 1);
   if (err != 0) {
     // Special handling for MAC failure
-    this->send_explicit_handshake_reject_(err == NOISE_ERROR_MAC_FAILURE ? LOG_STR("Handshake MAC failure")
-                                                                         : LOG_STR("Handshake error"));
+    this->send_explicit_handshake_reject_(noise::reject_reason_for(err));
     return this->handle_noise_error_(err, LOG_STR("noise_handshakestate_read_message"),
                                      APIError::HANDSHAKESTATE_READ_FAILED);
   }
@@ -390,18 +355,16 @@ APIError APINoiseFrameHelper::state_action_handshake_read_() {
 }
 APIError APINoiseFrameHelper::state_action_handshake_write_() {
   uint8_t buffer[65];
-  NoiseBuffer mbuf;
-  noise_buffer_init(mbuf);
-  noise_buffer_set_output(mbuf, buffer + 1, sizeof(buffer) - 1);
+  size_t msg_len = 0;
 
-  int err = noise_handshakestate_write_message(this->handshake_, &mbuf, nullptr);
+  int err = this->handshake_.write_message(buffer + 1, sizeof(buffer) - 1, msg_len);
   APIError aerr = this->handle_noise_error_(err, LOG_STR("noise_handshakestate_write_message"),
                                             APIError::HANDSHAKESTATE_WRITE_FAILED);
   if (aerr != APIError::OK)
     return aerr;
-  buffer[0] = 0x00;  // success
+  buffer[0] = noise::HANDSHAKE_STATUS_OK;
 
-  aerr = this->write_frame_(buffer, mbuf.size + 1);
+  aerr = this->write_frame_(buffer, msg_len + 1);
   if (aerr != APIError::OK)
     return aerr;
   return this->check_handshake_finished_();
@@ -409,33 +372,22 @@ APIError APINoiseFrameHelper::state_action_handshake_write_() {
 void APINoiseFrameHelper::send_explicit_handshake_reject_(const LogString *reason) {
   // Max reject message: "Bad handshake packet len" (24) + 1 (failure byte) = 25 bytes
   uint8_t data[32];
-  data[0] = 0x01;  // failure
-
-#ifdef USE_STORE_LOG_STR_IN_FLASH
-  // On ESP8266 with flash strings, we need to use PROGMEM-aware functions
-  size_t reason_len = strlen_P(reinterpret_cast<PGM_P>(reason));
-  reason_len = std::min(reason_len, sizeof(data) - 1);
-  if (reason_len > 0) {
-    memcpy_P(data + 1, reinterpret_cast<PGM_P>(reason), reason_len);
-  }
-#else
-  // Normal memory access
-  const char *reason_str = LOG_STR_ARG(reason);
-  size_t reason_len = strlen(reason_str);
-  reason_len = std::min(reason_len, sizeof(data) - 1);
-  if (reason_len > 0) {
-    // NOLINTNEXTLINE(bugprone-not-null-terminated-result) - binary protocol, not a C string
-    std::memcpy(data + 1, reason_str, reason_len);
-  }
-#endif
-
-  size_t data_size = reason_len + 1;
+  static_assert(sizeof(data) >= noise::MAC_FAILURE_PAYLOAD_SIZE,
+                "reject buffer must fit the MAC failure wire contract");
+  size_t data_size = noise::format_reject_payload(data, sizeof(data), reason);
 
   // temporarily remove failed state
   auto orig_state = state_;
   state_ = State::EXPLICIT_REJECT;
-  write_frame_(data, data_size);
-  state_ = orig_state;
+  APIError aerr = write_frame_(data, data_size);
+  if (aerr != APIError::OK) {
+    // Best effort; the reject reason is a diagnosis aid, not a protocol step
+    ESP_LOGW(TAG, "Sending handshake reject failed: %d", (int) aerr);
+  }
+  if (state_ == State::EXPLICIT_REJECT) {
+    // write_frame_ may have moved the state to FAILED; keep that decision
+    state_ = orig_state;
+  }
 }
 APIError APINoiseFrameHelper::read_packet(ReadPacketBuffer *buffer) {
   APIError aerr = this->check_data_state_();
@@ -492,12 +444,10 @@ APIError APINoiseFrameHelper::read_packet(ReadPacketBuffer *buffer) {
 // Returns APIError::OK on success.
 APIError APINoiseFrameHelper::encrypt_noise_message_(uint8_t *buf_start, uint16_t payload_size, uint8_t message_type,
                                                      uint16_t &encrypted_len_out) {
-  // Write noise header
-  buf_start[0] = 0x01;  // indicator
-  // buf_start[1], buf_start[2] to be set after encryption
+  // The noise frame header is written after encryption, when the size is known
 
   // Write message header (to be encrypted)
-  constexpr uint8_t msg_offset = 3;
+  constexpr uint8_t msg_offset = noise::FRAME_HEADER_SIZE;
   buf_start[msg_offset] = static_cast<uint8_t>(message_type >> 8);      // type high byte
   buf_start[msg_offset + 1] = static_cast<uint8_t>(message_type);       // type low byte
   buf_start[msg_offset + 2] = static_cast<uint8_t>(payload_size >> 8);  // data_len high byte
@@ -515,11 +465,10 @@ APIError APINoiseFrameHelper::encrypt_noise_message_(uint8_t *buf_start, uint16_
   if (aerr != APIError::OK)
     return aerr;
 
-  // Fill in the encrypted size
-  buf_start[1] = static_cast<uint8_t>(mbuf.size >> 8);
-  buf_start[2] = static_cast<uint8_t>(mbuf.size);
+  // Fill in the frame header now that the encrypted size is known
+  noise::write_frame_header(buf_start, static_cast<uint16_t>(mbuf.size));
 
-  encrypted_len_out = static_cast<uint16_t>(3 + mbuf.size);  // indicator + size + encrypted data
+  encrypted_len_out = static_cast<uint16_t>(noise::FRAME_HEADER_SIZE + mbuf.size);
   return APIError::OK;
 }
 
@@ -568,21 +517,19 @@ APIError APINoiseFrameHelper::write_protobuf_messages(ProtoWriteBuffer buffer, s
 }
 
 APIError APINoiseFrameHelper::write_frame_(const uint8_t *data, uint16_t len) {
-  uint8_t header[3];
-  header[0] = 0x01;  // indicator
-  header[1] = (uint8_t) (len >> 8);
-  header[2] = (uint8_t) len;
+  uint8_t header[noise::FRAME_HEADER_SIZE];
+  noise::write_frame_header(header, len);
 
   if (len == 0) {
-    return this->write_raw_buf_(header, 3);
+    return this->write_raw_buf_(header, noise::FRAME_HEADER_SIZE);
   }
   struct iovec iov[2];
   iov[0].iov_base = header;
-  iov[0].iov_len = 3;
+  iov[0].iov_len = noise::FRAME_HEADER_SIZE;
   iov[1].iov_base = const_cast<uint8_t *>(data);
   iov[1].iov_len = len;
 
-  return this->write_raw_iov_(iov, 2, 3 + len);
+  return this->write_raw_iov_(iov, 2, noise::FRAME_HEADER_SIZE + len);
 }
 
 /** Initiate the data structures for the handshake.
@@ -590,45 +537,12 @@ APIError APINoiseFrameHelper::write_frame_(const uint8_t *data, uint16_t len) {
  * @return 0 on success, -1 on error (check errno)
  */
 APIError APINoiseFrameHelper::init_handshake_() {
-  int err;
-  // Noise_NNpsk0_25519_ChaChaPoly_SHA256, built on the stack:
-  // noise_handshakestate_new_by_id copies it, so a member would waste
-  // 104 bytes per connection, and a static const would sit in RAM on
-  // ESP8266 (.rodata is DRAM there).
-  const NoiseProtocolId nid = {
-      .prefix_id = NOISE_PREFIX_STANDARD,
-      .pattern_id = NOISE_PATTERN_NN,
-      .modifier_ids = {NOISE_MODIFIER_PSK0},
-      .dh_id = NOISE_DH_CURVE25519,
-      .cipher_id = NOISE_CIPHER_CHACHAPOLY,
-      .hash_id = NOISE_HASH_SHA256,
-      .hybrid_id = NOISE_DH_NONE,
-  };
-
-  err = noise_handshakestate_new_by_id(&handshake_, &nid, NOISE_ROLE_RESPONDER);
-  APIError aerr =
-      handle_noise_error_(err, LOG_STR("noise_handshakestate_new_by_id"), APIError::HANDSHAKESTATE_SETUP_FAILED);
+  int err = this->handshake_.init(this->ctx_.get_psk(), prologue_.data(), prologue_.size());
+  APIError aerr = handle_noise_error_(err, LOG_STR("noise_handshake_init"), APIError::HANDSHAKESTATE_SETUP_FAILED);
   if (aerr != APIError::OK)
     return aerr;
-
-  const auto &psk = this->ctx_.get_psk();
-  err = noise_handshakestate_set_pre_shared_key(handshake_, psk.data(), psk.size());
-  aerr = handle_noise_error_(err, LOG_STR("noise_handshakestate_set_pre_shared_key"),
-                             APIError::HANDSHAKESTATE_SETUP_FAILED);
-  if (aerr != APIError::OK)
-    return aerr;
-
-  err = noise_handshakestate_set_prologue(handshake_, prologue_.data(), prologue_.size());
-  aerr = handle_noise_error_(err, LOG_STR("noise_handshakestate_set_prologue"), APIError::HANDSHAKESTATE_SETUP_FAILED);
-  if (aerr != APIError::OK)
-    return aerr;
-  // set_prologue copies it into handshakestate, so we can get rid of it now
+  // init copies the prologue into the handshakestate, so we can get rid of it now
   prologue_.release();
-
-  err = noise_handshakestate_start(handshake_);
-  aerr = handle_noise_error_(err, LOG_STR("noise_handshakestate_start"), APIError::HANDSHAKESTATE_SETUP_FAILED);
-  if (aerr != APIError::OK)
-    return aerr;
   return APIError::OK;
 }
 
@@ -637,15 +551,17 @@ APIError APINoiseFrameHelper::check_handshake_finished_() {
   assert(state_ == State::HANDSHAKE);
 #endif
 
-  int action = noise_handshakestate_get_action(handshake_);
-  if (action == NOISE_ACTION_READ_MESSAGE || action == NOISE_ACTION_WRITE_MESSAGE)
+  noise::NoiseResponderHandshake::Action action = this->handshake_.action();
+  if (action == noise::NoiseResponderHandshake::Action::ACTION_READ ||
+      action == noise::NoiseResponderHandshake::Action::ACTION_WRITE)
     return APIError::OK;
-  if (action != NOISE_ACTION_SPLIT) {
+  if (action != noise::NoiseResponderHandshake::Action::ACTION_SPLIT) {
     state_ = State::FAILED;
-    HELPER_LOG("Bad action for handshake: %d", action);
+    HELPER_LOG("Bad action for handshake: %d", (int) action);
     return APIError::HANDSHAKESTATE_BAD_STATE;
   }
-  int err = noise_handshakestate_split(handshake_, &send_cipher_, &recv_cipher_);
+  // split() also frees the handshake state
+  int err = this->handshake_.split(send_cipher_, recv_cipher_);
   APIError aerr =
       handle_noise_error_(err, LOG_STR("noise_handshakestate_split"), APIError::HANDSHAKESTATE_SPLIT_FAILED);
   if (aerr != APIError::OK)
@@ -654,17 +570,11 @@ APIError APINoiseFrameHelper::check_handshake_finished_() {
   this->frame_footer_size_ = noise_cipherstate_get_mac_length(send_cipher_);
 
   HELPER_LOG("Handshake complete!");
-  noise_handshakestate_free(handshake_);
-  handshake_ = nullptr;
   state_ = State::DATA;
   return APIError::OK;
 }
 
 APINoiseFrameHelper::~APINoiseFrameHelper() {
-  if (handshake_ != nullptr) {
-    noise_handshakestate_free(handshake_);
-    handshake_ = nullptr;
-  }
   if (send_cipher_ != nullptr) {
     noise_cipherstate_free(send_cipher_);
     send_cipher_ = nullptr;
@@ -675,16 +585,6 @@ APINoiseFrameHelper::~APINoiseFrameHelper() {
   }
 }
 
-extern "C" {
-// declare how noise generates random bytes (here with a good HWRNG based on the RF system)
-void noise_rand_bytes(void *output, size_t len) {
-  if (!esphome::random_bytes(reinterpret_cast<uint8_t *>(output), len)) {
-    ESP_LOGE(TAG, "Acquiring random bytes failed; rebooting");
-    arch_restart();
-  }
-}
-}
-
 }  // namespace esphome::api
 #endif  // USE_API_NOISE
 #endif  // USE_API

esphome/components/api/api_frame_helper_noise.h

@@ -3,7 +3,7 @@
 #ifdef USE_API
 #ifdef USE_API_NOISE
 #include "noise/protocol.h"
-#include "api_noise_context.h"
+#include "esphome/components/noise/noise_handshake.h"
 
 namespace esphome::api {
 
@@ -14,9 +14,9 @@ class APINoiseFrameHelper final : public APIFrameHelper {
   // Pos 1-2: encrypted payload size (16-bit big-endian)
   // Pos 3-6: encrypted type (16-bit) + data_len (16-bit)
   // Pos 7+: actual payload data
-  static constexpr uint8_t HEADER_PADDING = 1 + 2 + 2 + 2;  // indicator + size + type + data_len
+  static constexpr uint8_t HEADER_PADDING = noise::FRAME_HEADER_SIZE + 2 + 2;  // frame header + type + data_len
 
-  APINoiseFrameHelper(std::unique_ptr<socket::Socket> socket, APINoiseContext &ctx)
+  APINoiseFrameHelper(std::unique_ptr<socket::Socket> socket, noise::NoiseContext &ctx)
       : APIFrameHelper(std::move(socket)), ctx_(ctx) {
     frame_header_padding_ = HEADER_PADDING;
   }
@@ -52,13 +52,13 @@ class APINoiseFrameHelper final : public APIFrameHelper {
   APIError handle_handshake_frame_error_(APIError aerr);
   APIError handle_noise_error_(int err, const LogString *func_name, APIError api_err);
 
-  // Pointers first (4 bytes each)
-  NoiseHandshakeState *handshake_{nullptr};
+  // Pointers first (4 bytes each; the handshake wrapper holds one pointer)
+  noise::NoiseResponderHandshake handshake_;
   NoiseCipherState *send_cipher_{nullptr};
   NoiseCipherState *recv_cipher_{nullptr};
 
   // Reference to noise context (4 bytes on 32-bit)
-  APINoiseContext &ctx_;
+  noise::NoiseContext &ctx_;
 
   // Buffer for noise handshake prologue (released after handshake)
   APIBuffer prologue_;
@@ -67,7 +67,7 @@ class APINoiseFrameHelper final : public APIFrameHelper {
   // Fixed-size header buffer for noise protocol:
   // 1 byte for indicator + 2 bytes for message size (16-bit value, not varint)
   // Note: Maximum message size is UINT16_MAX (65535), with a limit of 128 bytes during handshake phase
-  uint8_t rx_header_buf_[3];
+  uint8_t rx_header_buf_[noise::FRAME_HEADER_SIZE];
   uint8_t rx_header_buf_len_ = 0;
   // 4 bytes total, no padding
 };

esphome/components/api/api_noise_context.h

@@ -1,37 +0,0 @@
-#pragma once
-#include <array>
-#include <cstdint>
-#include "esphome/core/defines.h"
-
-namespace esphome::api {
-
-#ifdef USE_API_NOISE
-using psk_t = std::array<uint8_t, 32>;
-
-class APINoiseContext {
- public:
-  // The all-zeros PSK is reserved: it marks the device as unprovisioned and
-  // doubles as the well-known provisioning PSK that unprovisioned devices
-  // accept for Noise handshakes (passive-sniffing protection only, no
-  // authentication). It is never a valid real key.
-  static bool is_all_zeros(const psk_t &psk) {
-    uint8_t acc = 0;
-    for (uint8_t b : psk) {
-      acc |= b;
-    }
-    return acc == 0;
-  }
-  void set_psk(psk_t psk) {
-    this->psk_ = psk;
-    this->has_psk_ = !is_all_zeros(psk);
-  }
-  const psk_t &get_psk() const { return this->psk_; }
-  bool has_psk() const { return this->has_psk_; }
-
- protected:
-  psk_t psk_{};
-  bool has_psk_{false};
-};
-#endif  // USE_API_NOISE
-
-}  // namespace esphome::api

esphome/components/api/api_server.cpp

@@ -588,7 +588,7 @@ bool APIServer::load_and_apply_noise_psk_() {
   return true;
 }
 
-bool APIServer::save_noise_psk(psk_t psk, bool make_active) {
+bool APIServer::save_noise_psk(noise::psk_t psk, bool make_active) {
 #ifdef USE_API_NOISE_PSK_FROM_YAML
   // When PSK is set from YAML, this function should never be called
   // but if it is, reject the change

esphome/components/api/api_server.h

@@ -5,7 +5,10 @@
 #include "api_buffer.h"
 // Must precede clients_ so APIConnection is complete for default_delete (libc++).
 #include "api_connection.h"
-#include "api_noise_context.h"
+#ifdef USE_API_NOISE
+// Only present in the build when the noise component is loaded
+#include "esphome/components/noise/noise.h"
+#endif
 #include "api_pb2.h"
 #include "api_pb2_service.h"
 #include "esphome/components/socket/socket.h"
@@ -37,7 +40,7 @@ class UserServiceDescriptor;
 
 #ifdef USE_API_NOISE
 struct SavedNoisePsk {
-  psk_t psk;
+  noise::psk_t psk;
 } PACKED;  // NOLINT
 #endif
 
@@ -73,10 +76,10 @@ class APIServer final : public Component,
   APIBuffer &get_shared_buffer_ref() { return shared_write_buffer_; }
 
 #ifdef USE_API_NOISE
-  bool save_noise_psk(psk_t psk, bool make_active = true);
+  bool save_noise_psk(noise::psk_t psk, bool make_active = true);
   bool clear_noise_psk(bool make_active = true);
-  void set_noise_psk(psk_t psk) { this->noise_ctx_.set_psk(psk); }
-  APINoiseContext &get_noise_ctx() { return this->noise_ctx_; }
+  void set_noise_psk(noise::psk_t psk) { this->noise_ctx_.set_psk(psk); }
+  noise::NoiseContext &get_noise_ctx() { return this->noise_ctx_; }
 #endif  // USE_API_NOISE
 
   void handle_disconnect(APIConnection *conn);
@@ -354,7 +357,7 @@ class APIServer final : public Component,
 #endif
 
 #ifdef USE_API_NOISE
-  APINoiseContext noise_ctx_;
+  noise::NoiseContext noise_ctx_;
   ESPPreferenceObject noise_pref_;
 #endif  // USE_API_NOISE
 };

esphome/components/binary_sensor/__init__.py

@@ -5,6 +5,7 @@ from esphome.automation import Condition, maybe_simple_id
 import esphome.codegen as cg
 from esphome.components import mqtt, web_server, zigbee
 from esphome.components.const import CONF_ON_STATE_CHANGE
+from esphome.config_helpers import filter_source_files_from_defines
 import esphome.config_validation as cv
 from esphome.const import (
     CONF_DELAY,
@@ -560,6 +561,11 @@ _CALLBACK_AUTOMATIONS = (
 async def _build_binary_sensor_automations(var, config):
     await automation.build_callback_automations(var, config, _CALLBACK_AUTOMATIONS)
 
+    if config.get(CONF_ON_CLICK) or config.get(CONF_ON_DOUBLE_CLICK):
+        cg.add_define("USE_BINARY_SENSOR_CLICK_TRIGGER")
+    if config.get(CONF_ON_MULTI_CLICK):
+        cg.add_define("USE_BINARY_SENSOR_MULTI_CLICK_TRIGGER")
+
     for conf in config.get(CONF_ON_CLICK, []):
         trigger = cg.new_Pvariable(
             conf[CONF_TRIGGER_ID], var, conf[CONF_MIN_LENGTH], conf[CONF_MAX_LENGTH]
@@ -673,3 +679,15 @@ async def to_code(config):
 async def binary_sensor_invalidate_state_to_code(config, action_id, template_arg, args):
     paren = await cg.get_variable(config[CONF_ID])
     return cg.new_Pvariable(action_id, template_arg, paren)
+
+
+# automation.cpp only implements the click/double_click/multi_click triggers
+FILTER_SOURCE_FILES = filter_source_files_from_defines(
+    {
+        "automation.cpp": (
+            "USE_BINARY_SENSOR_CLICK_TRIGGER",
+            "USE_BINARY_SENSOR_MULTI_CLICK_TRIGGER",
+        ),
+        "filter.cpp": "USE_BINARY_SENSOR_FILTER",
+    }
+)

esphome/components/binary_sensor/automation.cpp

@@ -1,8 +1,13 @@
+#include "esphome/core/defines.h"
+#if defined(USE_BINARY_SENSOR_CLICK_TRIGGER) || defined(USE_BINARY_SENSOR_MULTI_CLICK_TRIGGER)
+
 #include "automation.h"
 #include "esphome/core/log.h"
 
 namespace esphome::binary_sensor {
 
+#ifdef USE_BINARY_SENSOR_MULTI_CLICK_TRIGGER
+
 static const char *const TAG = "binary_sensor.automation";
 
 // MultiClickTrigger timeout IDs.
@@ -120,6 +125,9 @@ void MultiClickTriggerBase::trigger_() {
   this->trigger();
 }
 
+#endif  // USE_BINARY_SENSOR_MULTI_CLICK_TRIGGER
+
+#ifdef USE_BINARY_SENSOR_CLICK_TRIGGER
 bool match_interval(uint32_t min_length, uint32_t max_length, uint32_t length) {
   if (max_length == 0) {
     return length >= min_length;
@@ -127,4 +135,8 @@ bool match_interval(uint32_t min_length, uint32_t max_length, uint32_t length) {
     return length >= min_length && length <= max_length;
   }
 }
+#endif  // USE_BINARY_SENSOR_CLICK_TRIGGER
+
 }  // namespace esphome::binary_sensor
+
+#endif  // USE_BINARY_SENSOR_CLICK_TRIGGER || USE_BINARY_SENSOR_MULTI_CLICK_TRIGGER

esphome/components/esp32/__init__.py

@@ -12,6 +12,7 @@ from typing import Any
 from esphome import yaml_util
 import esphome.codegen as cg
 from esphome.components.const import CONF_ENABLE_OTA_DOWNGRADE_PROTECTION
+from esphome.config_helpers import filter_source_files_from_defines
 import esphome.config_validation as cv
 from esphome.const import (
     CONF_ADVANCED,
@@ -1072,11 +1073,19 @@ def _check_esp_idf_versions(config: ConfigType) -> ConfigType:
     return config
 
 
-_TOOLCHAINS = (Toolchain.PLATFORMIO, Toolchain.ESP_IDF)
-_validate_toolchain = cv.toolchain_enum(_TOOLCHAINS)
-# Runs before _detect_variant so downstream validators can rely on
-# CORE.toolchain instead of re-resolving it from the config dict.
-_resolve_toolchain = cv.resolve_toolchain("ESP32", _TOOLCHAINS, Toolchain.ESP_IDF)
+def _validate_toolchain(value) -> Toolchain:
+    return Toolchain(
+        cv.one_of(Toolchain.PLATFORMIO, Toolchain.ESP_IDF, lower=True)(value)
+    )
+
+
+def _resolve_toolchain(value: ConfigType) -> ConfigType:
+    # Resolve toolchain: CLI (already on CORE.toolchain) > YAML > default.
+    # Runs before _detect_variant so downstream validators can rely on
+    # CORE.toolchain instead of re-resolving it from the config dict.
+    if CORE.toolchain is None:
+        CORE.toolchain = value.get(CONF_TOOLCHAIN, Toolchain.ESP_IDF)
+    return value
 
 
 def _check_versions(config: ConfigType) -> ConfigType:
@@ -3443,3 +3452,10 @@ def process_stacktrace(config, line, backtrace_state):
             _decode_pc(config, addr.group())
 
     return backtrace_state
+
+
+# gpio.cpp only implements ESP32InternalGPIOPin and its ISR helpers, which
+# are instantiated solely by the pin schema codegen (esp32_pin_to_code)
+FILTER_SOURCE_FILES = filter_source_files_from_defines(
+    {"gpio.cpp": "USE_ESP32_INTERNAL_GPIO"}
+)

esphome/components/esp32/crash_handler.cpp

@@ -124,6 +124,15 @@ static uint8_t IRAM_ATTR capture_riscv_backtrace(RvExcFrame *frame, uint32_t *ou
 // Version is uint32_t because it would be padded to 4 bytes anyway before the next
 // uint32_t field, so we use the full width rather than wasting 3 bytes of padding.
 static constexpr uint32_t CRASH_DATA_VERSION = 4;
+#if CONFIG_IDF_TARGET_ARCH_XTENSA
+// EXCCAUSE is a 6-bit register; larger recorded values mean the frame's
+// cause/vaddr slots were never written (not a real exception frame).
+static constexpr uint32_t XTENSA_EXCCAUSE_COUNT = XCHAL_EXCCAUSE_NUM;
+#elif CONFIG_IDF_TARGET_ARCH_RISCV
+// Synchronous mcause exception codes are small and have no interrupt bit;
+// anything else in a non-pseudo record is a stale slot.
+static constexpr uint32_t RISCV_EXCEPTION_CAUSE_COUNT = 32;
+#endif
 struct RawCrashData {
   uint32_t version;
   uint32_t magic;
@@ -198,10 +207,28 @@ void crash_handler_clear() {
   s_raw_crash_data.magic = 0;
 }
 
+// Whether the cause slot was written by a real exception frame.
+static bool cause_slot_was_written() {
+#if CONFIG_IDF_TARGET_ARCH_XTENSA
+  return s_raw_crash_data.cause < XTENSA_EXCCAUSE_COUNT;
+#else
+  return s_raw_crash_data.cause < RISCV_EXCEPTION_CAUSE_COUNT;
+#endif
+}
+
 // Look up the exception cause as a human-readable string.
 // Tables mirror ESP-IDF's panic_arch_fill_info() which uses local static arrays
 // not exposed via any public API.
 static const char *get_exception_reason() {
+  uint8_t exception = s_raw_crash_data.exception;
+  if (exception == PANIC_EXCEPTION_ABORT || exception == PANIC_EXCEPTION_TWDT) {
+    // Abort-class panics carry no cause register
+    return nullptr;
+  }
+  if (!cause_slot_was_written()) {
+    // Garbage from old-build or corrupt records; report just the type
+    return nullptr;
+  }
 #if CONFIG_IDF_TARGET_ARCH_XTENSA
   if (s_raw_crash_data.pseudo_excause) {
     // SoC-level panic: watchdog, cache error, etc.
@@ -354,10 +381,11 @@ static const char *const FAULT_ADDR_REG = "MTVAL";
 static const char *const FAULT_ADDR_REG_LOWER = "mtval";
 #endif
 
-// Whether the fault address is meaningful — real CPU faults only, not
-// aborts/watchdogs or SoC-level pseudo exceptions.
+// Whether the fault address is meaningful: real CPU faults with a validly
+// written frame only.
 static bool has_fault_addr() {
-  return s_raw_crash_data.exception == PANIC_EXCEPTION_FAULT && !s_raw_crash_data.pseudo_excause;
+  return s_raw_crash_data.exception == PANIC_EXCEPTION_FAULT && !s_raw_crash_data.pseudo_excause &&
+         cause_slot_was_written();
 }
 
 // The record was captured by a different firmware build (it survives soft
@@ -458,6 +486,10 @@ void crash_handler_log() {
 // into NOINIT memory before the normal panic handler runs.
 //
 extern "C" {
+// Set by IDF's task watchdog (task_wdt.c, no header) before it simulates an
+// abort; weak so builds without the task watchdog still link.
+extern bool g_twdt_isr __attribute__((weak));
+
 // NOLINTBEGIN(bugprone-reserved-identifier,cert-dcl37-c,cert-dcl51-cpp,readability-identifier-naming)
 // Names are mandated by the --wrap linker mechanism
 extern void __real_esp_panic_handler(panic_info_t *info);
@@ -470,6 +502,14 @@ void IRAM_ATTR __wrap_esp_panic_handler(panic_info_t *info) {
   s_raw_crash_data.exception = (uint8_t) info->exception;
   s_raw_crash_data.pseudo_excause = info->pseudo_excause ? 1 : 0;
   s_raw_crash_data.crashed_core = (uint8_t) info->core;
+  if (g_panic_abort) {
+    // IDF reclassifies to ABORT only inside esp_panic_handler(), after this
+    // wrapper captured info->exception; correct it here. TWDT is our own
+    // distinction (IDF never assigns PANIC_EXCEPTION_TWDT). The abort text is
+    // not stored; the symbolized backtrace already identifies the site.
+    bool is_twdt = &g_twdt_isr != nullptr && g_twdt_isr;
+    s_raw_crash_data.exception = (uint8_t) (is_twdt ? PANIC_EXCEPTION_TWDT : PANIC_EXCEPTION_ABORT);
+  }
   // Zero unconditionally so a null frame doesn't leave stale .noinit data from a previous boot
   s_raw_crash_data.cause = 0;
   s_raw_crash_data.fault_addr = 0;
@@ -487,8 +527,12 @@ void IRAM_ATTR __wrap_esp_panic_handler(panic_info_t *info) {
   // Xtensa: walk the backtrace using the public API
   if (info->frame != nullptr) {
     auto *xt_frame = (XtExcFrame *) info->frame;
-    s_raw_crash_data.cause = xt_frame->exccause;
-    s_raw_crash_data.fault_addr = xt_frame->excvaddr;
+    if (!g_panic_abort) {
+      // Abort-class frames carry no useful cause/vaddr: TWDT task snapshots
+      // never wrote them and abort() traps describe only the synthetic trap.
+      s_raw_crash_data.cause = xt_frame->exccause;
+      s_raw_crash_data.fault_addr = xt_frame->excvaddr;
+    }
     s_raw_crash_data.backtrace_count = walk_xtensa_backtrace(xt_frame, s_raw_crash_data.backtrace, MAX_BACKTRACE);
   }
 
@@ -510,8 +554,11 @@ void IRAM_ATTR __wrap_esp_panic_handler(panic_info_t *info) {
   // RISC-V: capture MEPC + RA, then scan stack for code addresses
   if (info->frame != nullptr) {
     auto *rv_frame = (RvExcFrame *) info->frame;
-    s_raw_crash_data.cause = rv_frame->mcause;
-    s_raw_crash_data.fault_addr = rv_frame->mtval;
+    if (!g_panic_abort) {
+      // See the Xtensa branch: abort-class frames carry no valid cause/vaddr.
+      s_raw_crash_data.cause = rv_frame->mcause;
+      s_raw_crash_data.fault_addr = rv_frame->mtval;
+    }
     s_raw_crash_data.backtrace_count =
         capture_riscv_backtrace(rv_frame, s_raw_crash_data.backtrace, MAX_BACKTRACE, &s_raw_crash_data.reg_frame_count);
   }

esphome/components/esp32/gpio.cpp

@@ -1,4 +1,7 @@
-#ifdef USE_ESP32
+#include "esphome/core/defines.h"
+// Also defines the core ISRInternalGPIOPin methods; those are only reachable
+// via ESP32InternalGPIOPin::to_isr(), so the same define gates both safely.
+#if defined(USE_ESP32) && defined(USE_ESP32_INTERNAL_GPIO)
 
 #include "gpio.h"
 #include "esphome/core/log.h"
@@ -204,4 +207,4 @@ void IRAM_ATTR ISRInternalGPIOPin::pin_mode(gpio::Flags flags) {
 
 }  // namespace esphome
 
-#endif  // USE_ESP32
+#endif  // USE_ESP32 && USE_ESP32_INTERNAL_GPIO

esphome/components/esp32/gpio.py

@@ -257,6 +257,7 @@ ESP32_PIN_SCHEMA = cv.All(
 
 @pins.PIN_SCHEMA_REGISTRY.register(PLATFORM_ESP32, ESP32_PIN_SCHEMA)
 async def esp32_pin_to_code(config):
+    cg.add_define("USE_ESP32_INTERNAL_GPIO")
     var = cg.new_Pvariable(config[CONF_ID])
     num = config[CONF_NUMBER]
     cg.add(var.set_pin(getattr(gpio_num_t, f"GPIO_NUM_{num}")))

esphome/components/esp8266/__init__.py

@@ -136,16 +136,7 @@ def _format_framework_arduino_version(ver: cv.Version) -> str:
         return f"~1.{ver.major}{ver.minor:02d}{ver.patch:02d}.0"
     if ver <= cv.Version(2, 6, 2):
         return f"~2.{ver.major}{ver.minor:02d}{ver.patch:02d}.0"
-    # Same encoding the native toolchain uses for its package download, so a
-    # version bump cannot drift between the two paths.
-    from esphome.arduino8266.framework import framework_package_version
-
-    try:
-        return f"~{framework_package_version(ver)}"
-    except EsphomeError as err:
-        # Anchor the 4.x rejection to the framework version line instead of
-        # aborting with a bare traceback-level error
-        raise cv.Invalid(str(err), path=[CONF_VERSION]) from err
+    return f"~3.{ver.major}{ver.minor:02d}{ver.patch:02d}.0"
 
 
 # NOTE: Keep this in mind when updating the recommended version:
@@ -255,9 +246,6 @@ CONFIG_SCHEMA = cv.All(
             cv.Optional(CONF_ENABLE_SCANF_FLOAT): cv.boolean,
         }
     ),
-    # Until the native toolchain lands, PlatformIO is the only backend;
-    # reject a --toolchain this platform cannot serve yet.
-    cv.require_platformio_toolchain("ESP8266"),
     set_core_data,
 )
 
@@ -409,8 +397,8 @@ async def to_code(config: ConfigType) -> None:
     )
 
     if config[CONF_BOARD] in BOARDS:
-        board_data = BOARDS[config[CONF_BOARD]]
-        ld_scripts = ESP8266_LD_SCRIPTS[board_data[KEY_FLASH_SIZE]]
+        flash_size = BOARDS[config[CONF_BOARD]][KEY_FLASH_SIZE]
+        ld_scripts = ESP8266_LD_SCRIPTS[flash_size]
 
         if ver <= cv.Version(2, 3, 0):
             # No ld script support
@@ -419,9 +407,7 @@ async def to_code(config: ConfigType) -> None:
             # Old ld script path
             ld_script = ld_scripts[0]
         else:
-            # A per-board override preserves a layout the board shipped
-            # with (see d1_wroom_02 in boards.py)
-            ld_script = board_data.get("ldscript", ld_scripts[1])
+            ld_script = ld_scripts[1]
 
         if ld_script is not None:
             cg.add_platformio_option("board_build.ldscript", ld_script)

esphome/components/esp8266/boards.py

@@ -199,15 +199,6 @@ BOARDS = {
         "name": "WeMos D1 mini Pro",
         "flash_size": FLASH_SIZE_16_MB,
     },
-    "d1_wroom_02": {
-        "name": "WeMos D1 ESP-WROOM-02",
-        "flash_size": FLASH_SIZE_2_MB,
-        # This board joined BOARDS after shipping with the manifest default
-        # (64 KB filesystem region); the flash-size default (2m.ld) would
-        # move _FS_end and with it the preferences sector, wiping existing
-        # devices' flash-backed state on update.
-        "ldscript": "eagle.flash.2m64.ld",
-    },
     "d1": {
         "name": "WEMOS D1 R1",
         "flash_size": FLASH_SIZE_4_MB,
@@ -369,112 +360,3 @@ BOARDS = {
         "flash_size": FLASH_SIZE_4_MB,
     },
 }
-
-
-# Per-board variant dir + identity defines from platform-espressif8266 4.x
-# build.extra_flags; the shared -DESP8266/-DARDUINO_ARCH_ESP8266 are added
-# by the generator.
-#
-# Regenerate ESP8266_BOARD_BUILD with (v4.2.1 is the platform version the
-# native toolchain mirrors; regenerate against the tag when bumping it):
-#
-# git clone -b v4.2.1 https://github.com/platformio/platform-espressif8266
-# python3 - <<'EOF'
-# import json, glob, os
-# for f in sorted(glob.glob("platform-espressif8266/boards/*.json")):
-#     b = json.load(open(f))["build"]
-#     extra = b["extra_flags"]
-#     extra = extra.split() if isinstance(extra, str) else extra
-#     defines = [
-#         e[2:] for e in extra if e not in ("-DESP8266", "-DARDUINO_ARCH_ESP8266")
-#     ]
-#     entries = ", ".join(f'"{d}"' for d in defines) + ("," if len(defines) == 1 else "")
-#     board = os.path.splitext(os.path.basename(f))[0]
-#     print(f'    "{board}": {{"variant": "{b["variant"]}", "defines": ({entries})}},')
-# EOF
-ESP8266_BOARD_BUILD = {
-    "agruminolemon": {
-        "variant": "agruminolemonv4",
-        "defines": ("ARDUINO_ESP8266_AGRUMINO_LEMON_V4",),
-    },
-    "d1": {"variant": "d1", "defines": ("ARDUINO_ESP8266_WEMOS_D1R1",)},
-    "d1_mini": {"variant": "d1_mini", "defines": ("ARDUINO_ESP8266_WEMOS_D1MINI",)},
-    "d1_mini_lite": {
-        "variant": "d1_mini",
-        "defines": ("ARDUINO_ESP8266_WEMOS_D1MINILITE",),
-    },
-    "d1_mini_pro": {
-        "variant": "d1_mini",
-        "defines": ("ARDUINO_ESP8266_WEMOS_D1MINIPRO",),
-    },
-    "d1_wroom_02": {
-        "variant": "d1_mini",
-        "defines": ("ARDUINO_ESP8266_WEMOS_D1WROOM02",),
-    },
-    "eduinowifi": {
-        "variant": "eduinowifi",
-        "defines": ("ARDUINO_ESP8266_SCHIRMILABS_EDUINO_WIFI",),
-    },
-    "esp01": {"variant": "generic", "defines": ("ARDUINO_ESP8266_ESP01",)},
-    "esp01_1m": {"variant": "generic", "defines": ("ARDUINO_ESP8266_ESP01",)},
-    "esp07": {"variant": "generic", "defines": ("ARDUINO_ESP8266_ESP07",)},
-    "esp07s": {"variant": "nodemcu", "defines": ("ARDUINO_ESP8266_ESP07",)},
-    "esp12e": {"variant": "nodemcu", "defines": ("ARDUINO_ESP8266_ESP12",)},
-    "esp210": {"variant": "generic", "defines": ("ARDUINO_ESP8266_ESP210",)},
-    "esp8285": {"variant": "esp8285", "defines": ("ARDUINO_ESP8266_ESP01",)},
-    "esp_wroom_02": {
-        "variant": "nodemcu",
-        "defines": ("ARDUINO_ESP8266_ESP_WROOM_02",),
-    },
-    "espduino": {"variant": "ESPDuino", "defines": ("ARDUINO_ESP8266_ESP13",)},
-    "espectro": {"variant": "espectro", "defines": ("ARDUINO_ESP8266_ESPECTRO_CORE",)},
-    "espino": {"variant": "espino", "defines": ("ARDUINO_ESP8266_ESP12",)},
-    "espinotee": {"variant": "espinotee", "defines": ("ARDUINO_ESP8266_ESP13",)},
-    "espmxdevkit": {
-        "variant": "esp8285",
-        "defines": ("ARDUINO_ESP8266_ESP01", "LED_BUILTIN=16"),
-    },
-    "espresso_lite_v1": {
-        "variant": "espresso_lite_v1",
-        "defines": ("ARDUINO_ESP8266_ESPRESSO_LITE_V1",),
-    },
-    "espresso_lite_v2": {
-        "variant": "espresso_lite_v2",
-        "defines": ("ARDUINO_ESP8266_ESPRESSO_LITE_V2",),
-    },
-    "gen4iod": {"variant": "generic", "defines": ("ARDUINO_GEN4_IOD",)},
-    "heltec_wifi_kit_8": {
-        "variant": "wifi_kit_8",
-        "defines": ("ARDUINO_wifi_kit_8",),
-    },
-    "huzzah": {"variant": "adafruit", "defines": ("ARDUINO_ESP8266_ADAFRUIT_HUZZAH",)},
-    "inventone": {"variant": "inventone", "defines": ("ARDUINO_ESP8266_INVENT_ONE",)},
-    "modwifi": {"variant": "generic", "defines": ("ARDUINO_MOD_WIFI_ESP8266",)},
-    "nodemcu": {"variant": "nodemcu", "defines": ("ARDUINO_ESP8266_NODEMCU",)},
-    "nodemcuv2": {"variant": "nodemcu", "defines": ("ARDUINO_ESP8266_NODEMCU_ESP12E",)},
-    "oak": {"variant": "oak", "defines": ("ARDUINO_ESP8266_OAK",)},
-    "phoenix_v1": {
-        "variant": "phoenix_v1",
-        "defines": ("ARDUINO_ESP8266_PHOENIX_V1",),
-    },
-    "phoenix_v2": {
-        "variant": "phoenix_v2",
-        "defines": ("ARDUINO_ESP8266_PHOENIX_V2",),
-    },
-    "sonoff_basic": {"variant": "itead", "defines": ("ARDUINO_ESP8266_SONOFF_BASIC",)},
-    "sonoff_s20": {"variant": "itead", "defines": ("ARDUINO_ESP8266_SONOFF_S20",)},
-    "sonoff_sv": {"variant": "itead", "defines": ("ARDUINO_ESP8266_SONOFF_SV",)},
-    "sonoff_th": {"variant": "itead", "defines": ("ARDUINO_ESP8266_SONOFF_TH",)},
-    "sparkfunBlynk": {"variant": "thing", "defines": ("ARDUINO_ESP8266_THING",)},
-    "thing": {"variant": "thing", "defines": ("ARDUINO_ESP8266_THING",)},
-    "thingdev": {"variant": "thing", "defines": ("ARDUINO_ESP8266_THING_DEV",)},
-    "wifi_slot": {"variant": "wifi_slot", "defines": ("ARDUINO_AMPERKA_WIFI_SLOT",)},
-    "wifiduino": {"variant": "wifiduino", "defines": ("ARDUINO_WIFIDUINO_ESP8266",)},
-    "wifinfo": {"variant": "wifinfo", "defines": ("ARDUINO_WIFINFO",)},
-    "wio_link": {"variant": "wiolink", "defines": ("ARDUINO_ESP8266_WIO_LINK",)},
-    "wio_node": {"variant": "nodemcu", "defines": ("ARDUINO_ESP8266_ESP_WROOM_02",)},
-    "xinabox_cw01": {
-        "variant": "xinabox",
-        "defines": ("ARDUINO_ESP8266_XINABOX_CW01",),
-    },
-}

esphome/components/esp8266/build_surgery.py

@@ -1,118 +0,0 @@
-"""Linker-script surgery shared with the native (PlatformIO-free) toolchain.
-
-These mirror the PlatformIO extra scripts in this directory
-(``relocate_ratetable.py.script`` and ``testing_mode.py.script``), which run
-inside SCons and must stay self-contained. The native build generator applies
-the same patches to the linker scripts it generates, so the logic lives here
-as plain functions. Keep both in sync when changing either.
-``segment_length`` is native-toolchain-only and has no script twin.
-"""
-
-from __future__ import annotations
-
-from collections.abc import Collection
-import hashlib
-import re
-
-# Move the NONOS SDK wifi rate tables from flash to DRAM; see
-# relocate_ratetable.py.script for the full background (NONOS SDK issue 320).
-RATETABLE_RULE = "*libnet80211.a:ieee80211_phy.o(.irom.text .irom.text.*)"
-_RATETABLE_COMMENT = (
-    "/* ESPHome: wifi rate tables must live in DRAM, see NONOS SDK issue 320 */"
-)
-# Match the whole line: "_data_start" is also a substring of the
-# "_dport0_data_start" line in the earlier .dport0.data section
-_RATETABLE_ANCHOR = re.compile(r"^\s*_data_start = ABSOLUTE\(\.\);", re.MULTILINE)
-
-# Memory sizes for testing mode (allow larger builds for CI component grouping)
-TESTING_IRAM_SIZE = "0x200000"  # 2MB
-TESTING_DRAM_SIZE = "0x200000"  # 2MB
-TESTING_FLASH_SIZE = "0x2000000"  # 32MB
-
-
-def relocate_ratetable(content: str) -> str:
-    """Insert the rate-table DRAM rule into a generated common linker script."""
-    if RATETABLE_RULE in content:
-        return content
-    match = _RATETABLE_ANCHOR.search(content)
-    if match is None:
-        raise RuntimeError(
-            "'_data_start' anchor not found in the generated linker script; "
-            "cannot apply wifi rate table DRAM relocation "
-            "(has the Arduino core linker script changed?)"
-        )
-    insert_pos = match.end()
-    return (
-        content[:insert_pos]
-        + f"\n    {_RATETABLE_COMMENT}"
-        + f"\n    {RATETABLE_RULE}"
-        + content[insert_pos:]
-    )
-
-
-_TESTING_SEGMENT_SIZES = {
-    "iram1_0_seg": TESTING_IRAM_SIZE,
-    "dram0_0_seg": TESTING_DRAM_SIZE,
-    "irom0_0_seg": TESTING_FLASH_SIZE,
-}
-
-
-def _segment_line_re(segment_name: str) -> re.Pattern[str]:
-    """The MEMORY line for one segment: ``<seg> : org = 0x..., len = 0x...``.
-
-    Anchored to the start of the line so a name never matches inside a
-    longer one (``ram0_0_seg`` must not read ``dram0_0_seg``). The size
-    group stops at the hex digits, leaving any ``ul`` suffix (from the
-    preprocessed ``MMU_IRAM_SIZE``) in place.
-    """
-    return re.compile(
-        rf"(^[ \t]*{re.escape(segment_name)}"
-        r"\s*:\s*org\s*=\s*0x[0-9a-fA-F]+\s*,\s*len\s*=\s*)"
-        r"(0x[0-9a-fA-F]+)",
-        re.MULTILINE,
-    )
-
-
-def apply_testing_memory_patches(content: str, segments: Collection[str]) -> str:
-    """Enlarge the named memory segments so grouped CI test builds can link.
-
-    Each caller passes the segments its linker script defines: the
-    generated common ld carries ``iram1_0_seg``; the flash ld carries
-    ``dram0_0_seg`` and ``irom0_0_seg``. A segment that fails to match
-    raises, since a silently kept real memory limit would fail grouped
-    builds far from the cause.
-    """
-    for segment in _TESTING_SEGMENT_SIZES:
-        if segment not in segments and _segment_line_re(segment).search(content):
-            raise RuntimeError(
-                f"Testing-mode segment {segment} is present in the linker "
-                "script but was not selected for patching"
-            )
-    for segment in segments:
-        if segment not in _TESTING_SEGMENT_SIZES:
-            raise RuntimeError(f"Unknown testing-mode segment {segment!r}")
-        content, count = _segment_line_re(segment).subn(
-            rf"\g<1>{_TESTING_SEGMENT_SIZES[segment]}", content
-        )
-        if count == 0:
-            raise RuntimeError(
-                f"Testing-mode memory patch failed: segment {segment} "
-                "not found (has the Arduino core linker script changed?)"
-            )
-    return content
-
-
-def segment_length(content: str, segment_name: str) -> int | None:
-    """Read a memory segment's length from linker script content."""
-    match = _segment_line_re(segment_name).search(content)
-    return int(match.group(2), 16) if match else None
-
-
-def surgery_fingerprint() -> str:
-    """Hash of this module's source; linker-script caches include it so an
-    edit here invalidates them."""
-    import inspect
-    import sys
-
-    source = inspect.getsource(sys.modules[__name__])
-    return hashlib.sha256(source.encode()).hexdigest()

esphome/components/esp8266/const.py

@@ -15,9 +15,6 @@ CONF_ENABLE_SERIAL1 = "enable_serial1"
 KEY_WAVEFORM_REQUIRED = "waveform_required"
 KEY_SERIAL_REQUIRED = "serial_required"
 KEY_SERIAL1_REQUIRED = "serial1_required"
-# Set for the native (non-PlatformIO) toolchain's build generator
-KEY_FLASH_MODE = "flash_mode"
-KEY_SCANF_FLOAT = "scanf_float"
 
 # esp8266 namespace is already defined by arduino, manually prefix esphome
 esp8266_ns = cg.global_ns.namespace("esphome").namespace("esp8266")

esphome/components/esphome/ota/ota_esphome.cpp

@@ -398,7 +398,7 @@ void ESPHomeOTAComponent::handle_data_() {
   this->notify_state_(ota::OTA_STARTED, 0.0f, 0);
 #endif
 
-  // begin() may block for a few seconds while it locks flash.
+  // begin() returns quickly; flash sectors are erased incrementally during write().
   error_code = this->backend_->begin(ota_size, ota_type);
   if (error_code != ota::OTA_RESPONSE_OK)
     goto error;  // NOLINT(cppcoreguidelines-avoid-goto)

esphome/components/ethernet/ethernet_component.h

@@ -159,9 +159,6 @@ class EthernetComponent final : public Component {
   const char *get_use_address() const { return this->use_address_; }
   void set_use_address(const char *use_address) { this->use_address_ = use_address; }
   void get_eth_mac_address_raw(uint8_t *mac);
-  // Remove before 2026.9.0
-  ESPDEPRECATED("Use get_eth_mac_address_pretty_into_buffer() instead. Removed in 2026.9.0", "2026.3.0")
-  std::string get_eth_mac_address_pretty();
   const char *get_eth_mac_address_pretty_into_buffer(std::span<char, MAC_ADDRESS_PRETTY_BUFFER_SIZE> buf);
   eth_duplex_t get_duplex_mode();
   eth_speed_t get_link_speed();

esphome/components/ethernet/ethernet_component_esp32.cpp

@@ -928,11 +928,6 @@ void EthernetComponent::get_eth_mac_address_raw(uint8_t *mac) {
   ESPHL_ERROR_CHECK(err, "ETH_CMD_G_MAC error");
 }
 
-std::string EthernetComponent::get_eth_mac_address_pretty() {
-  char buf[MAC_ADDRESS_PRETTY_BUFFER_SIZE];
-  return std::string(this->get_eth_mac_address_pretty_into_buffer(buf));
-}
-
 const char *EthernetComponent::get_eth_mac_address_pretty_into_buffer(
     std::span<char, MAC_ADDRESS_PRETTY_BUFFER_SIZE> buf) {
   uint8_t mac[MAC_ADDRESS_SIZE];

esphome/components/ethernet/ethernet_component_rp2.cpp

@@ -249,11 +249,6 @@ void EthernetComponent::get_eth_mac_address_raw(uint8_t *mac) {
   }
 }
 
-std::string EthernetComponent::get_eth_mac_address_pretty() {
-  char buf[MAC_ADDRESS_PRETTY_BUFFER_SIZE];
-  return std::string(this->get_eth_mac_address_pretty_into_buffer(buf));
-}
-
 const char *EthernetComponent::get_eth_mac_address_pretty_into_buffer(
     std::span<char, MAC_ADDRESS_PRETTY_BUFFER_SIZE> buf) {
   uint8_t mac[MAC_ADDRESS_SIZE];

esphome/components/host/__init__.py

@@ -37,7 +37,6 @@ CONFIG_SCHEMA = cv.All(
             cv.Optional(CONF_MAC_ADDRESS, default="98:35:69:ab:f6:79"): cv.mac_address,
         }
     ),
-    cv.require_platformio_toolchain("host"),
     set_core_data,
 )
 

esphome/components/http_request/ota/ota_http_request.cpp

@@ -64,8 +64,9 @@ void OtaHttpRequestComponent::flash() {
   }
 }
 
-void OtaHttpRequestComponent::cleanup_(ota::OTABackendPtr backend, const std::shared_ptr<HttpContainer> &container) {
-  if (this->update_started_) {
+void OtaHttpRequestComponent::cleanup_(ota::OTABackendPtr backend, const std::shared_ptr<HttpContainer> &container,
+                                       bool abort_backend) {
+  if (abort_backend) {
     ESP_LOGV(TAG, "Aborting OTA backend");
     backend->abort();
   }
@@ -106,7 +107,8 @@ uint8_t OtaHttpRequestComponent::do_ota_() {
   auto error_code = backend->begin(container->content_length);
   if (error_code != ota::OTA_RESPONSE_OK) {
     ESP_LOGW(TAG, "backend->begin error: %d", error_code);
-    this->cleanup_(std::move(backend), container);
+    // Nothing to abort: begin() failed, so no OTA handle was opened
+    this->cleanup_(std::move(backend), container, /*abort_backend=*/false);
     return error_code;
   }
 
@@ -140,7 +142,7 @@ uint8_t OtaHttpRequestComponent::do_ota_() {
       } else {
         ESP_LOGE(TAG, "Error reading data: %d", bufsize_or_error);
       }
-      this->cleanup_(std::move(backend), container);
+      this->cleanup_(std::move(backend), container, /*abort_backend=*/true);
       return OTA_CONNECTION_ERROR;
     }
 
@@ -150,14 +152,13 @@ uint8_t OtaHttpRequestComponent::do_ota_() {
       md5_receive.add(buf, bufsize_or_error);
 
       // write bytes to OTA backend
-      this->update_started_ = true;
       error_code = backend->write(buf, bufsize_or_error);
       if (error_code != ota::OTA_RESPONSE_OK) {
         // error code explanation available at
         // https://github.com/esphome/esphome/blob/dev/esphome/components/ota/ota_backend.h
         ESP_LOGE(TAG, "Error code (%02X) writing binary data to flash at offset %d and size %d", error_code,
                  container->get_bytes_read() - bufsize_or_error, container->content_length);
-        this->cleanup_(std::move(backend), container);
+        this->cleanup_(std::move(backend), container, /*abort_backend=*/true);
         return error_code;
       }
     }
@@ -181,7 +182,7 @@ uint8_t OtaHttpRequestComponent::do_ota_() {
   this->md5_computed_ = md5_receive_str;
   if (strncmp(this->md5_computed_.c_str(), this->md5_expected_.c_str(), MD5_SIZE) != 0) {
     ESP_LOGE(TAG, "MD5 computed: %s - Aborting due to MD5 mismatch", this->md5_computed_.c_str());
-    this->cleanup_(std::move(backend), container);
+    this->cleanup_(std::move(backend), container, /*abort_backend=*/true);
     return ota::OTA_RESPONSE_ERROR_MD5_MISMATCH;
   } else {
     backend->set_update_md5(md5_receive_str);
@@ -197,7 +198,7 @@ uint8_t OtaHttpRequestComponent::do_ota_() {
   error_code = backend->end();
   if (error_code != ota::OTA_RESPONSE_OK) {
     ESP_LOGW(TAG, "Error ending update! error_code: %d", error_code);
-    this->cleanup_(std::move(backend), container);
+    this->cleanup_(std::move(backend), container, /*abort_backend=*/true);
     return error_code;
   }
 

esphome/components/http_request/ota/ota_http_request.h

@@ -38,7 +38,7 @@ class OtaHttpRequestComponent final : public ota::OTAComponent, public Parented<
   void flash();
 
  protected:
-  void cleanup_(ota::OTABackendPtr backend, const std::shared_ptr<HttpContainer> &container);
+  void cleanup_(ota::OTABackendPtr backend, const std::shared_ptr<HttpContainer> &container, bool abort_backend);
   uint8_t do_ota_();
   std::string get_url_with_auth_(const std::string &url);
   bool http_get_md5_();
@@ -51,7 +51,6 @@ class OtaHttpRequestComponent final : public ota::OTAComponent, public Parented<
   std::string username_{};
   std::string url_{};
   int status_ = -1;
-  bool update_started_ = false;
   static const uint16_t HTTP_RECV_BUFFER = 256;  // the firmware GET chunk size
 };
 

esphome/components/libretiny/__init__.py

@@ -300,7 +300,7 @@ FRAMEWORK_SCHEMA = cv.All(
     _check_debug_order,
 )
 
-CONFIG_SCHEMA = cv.All(_notify_old_style, cv.require_platformio_toolchain("LibreTiny"))
+CONFIG_SCHEMA = cv.All(_notify_old_style)
 
 BASE_SCHEMA = cv.Schema(
     {
@@ -314,7 +314,6 @@ BASE_SCHEMA = cv.Schema(
 )
 
 BASE_SCHEMA.add_extra(_detect_variant)
-BASE_SCHEMA.add_extra(cv.require_platformio_toolchain("LibreTiny"))
 BASE_SCHEMA.add_extra(_update_core_data)
 
 

esphome/components/modbus/modbus.h

@@ -618,9 +618,6 @@ class ModbusClientDevice {
   inline void clear_tx_queue_for_address() { this->parent_->clear_tx_queue_for_address(this->address_); }
   inline void clear_tx_queue_for_device() { this->parent_->clear_tx_queue_for_device(this); }
 
-  // If more than one device is connected block sending a new command before a response is received
-  ESPDEPRECATED("Use ready_for_immediate_send() instead. Removed in 2026.9.0", "2026.3.0")
-  bool waiting_for_response() { return !this->ready_for_immediate_send(); }
   bool ready_for_immediate_send() { return this->parent_->tx_buffer_empty() && !this->parent_->tx_blocked(); }
 
  protected:

esphome/components/noise/__init__.py

@@ -0,0 +1,69 @@
+import base64
+import binascii
+from typing import Any
+
+import esphome.codegen as cg
+import esphome.config_validation as cv
+from esphome.const import CONF_KEY
+from esphome.types import ConfigType
+
+CODEOWNERS = ["@esphome/core"]
+
+noise_ns = cg.esphome_ns.namespace("noise")
+
+CONFIG_SCHEMA = cv.Schema({})
+
+
+def validate_encryption_key(value: Any) -> str:
+    value = cv.string_strict(value)
+    try:
+        decoded = base64.b64decode(value, validate=True)
+    except ValueError as err:
+        raise cv.Invalid("Invalid key format, please check it's using base64") from err
+
+    if len(decoded) != 32:
+        raise cv.Invalid("Encryption key must be base64 and 32 bytes long")
+
+    # Return original data for roundtrip conversion
+    return value
+
+
+def decode_encryption_key(value: str) -> bytes:
+    """Decode a base64 encryption key to its 32 raw bytes.
+
+    a2b_base64 matches the decode the clients use (aioesphomeapi
+    decode_noise_psk), so both ends derive the same bytes. The length is
+    re-checked so a caller cannot turn an unvalidated short decode into a
+    zero-padded PSK.
+    """
+    try:
+        decoded = binascii.a2b_base64(value)
+    except ValueError as err:
+        raise cv.Invalid("Invalid key format, please check it's using base64") from err
+    if len(decoded) != 32:
+        raise cv.Invalid("Encryption key must be base64 and 32 bytes long")
+    return decoded
+
+
+ENCRYPTION_SCHEMA = cv.Schema(
+    {
+        cv.Optional(CONF_KEY): cv.sensitive(validate_encryption_key),
+    }
+)
+
+
+def encryption_schema(config: ConfigType | None) -> ConfigType:
+    # A bare `encryption:` block is valid; a missing key means the consumer
+    # falls back to its keyless behavior (api provisioning, ota inheriting
+    # the api key).
+    if config is None:
+        config = {}
+    return ENCRYPTION_SCHEMA(config)
+
+
+async def to_code(config: ConfigType) -> None:
+    cg.add_define("USE_NOISE")
+    cg.add_library("esphome/noise-c", "0.1.21")
+    # Enable optimized memzero/memcmp in libsodium instead of volatile byte loops
+    cg.add_build_flag("-DHAVE_WEAK_SYMBOLS=1")
+    cg.add_build_flag("-DHAVE_INLINE_ASM=1")

esphome/components/noise/noise.cpp

@@ -0,0 +1,88 @@
+#include "noise.h"
+#ifdef USE_NOISE
+#include "esphome/core/log.h"
+
+#include <algorithm>
+#include <cstring>
+
+#include <noise/protocol.h>
+
+#ifdef USE_ESP8266
+#include <pgmspace.h>
+#endif
+
+namespace esphome::noise {
+
+static const char *const TAG = "noise";
+
+const LogString *noise_err_to_logstr(int err) {
+  if (err == NOISE_ERROR_NO_MEMORY)
+    return LOG_STR("NO_MEMORY");
+  if (err == NOISE_ERROR_UNKNOWN_ID)
+    return LOG_STR("UNKNOWN_ID");
+  if (err == NOISE_ERROR_UNKNOWN_NAME)
+    return LOG_STR("UNKNOWN_NAME");
+  if (err == NOISE_ERROR_MAC_FAILURE)
+    return LOG_STR("MAC_FAILURE");
+  if (err == NOISE_ERROR_NOT_APPLICABLE)
+    return LOG_STR("NOT_APPLICABLE");
+  if (err == NOISE_ERROR_SYSTEM)
+    return LOG_STR("SYSTEM");
+  if (err == NOISE_ERROR_REMOTE_KEY_REQUIRED)
+    return LOG_STR("REMOTE_KEY_REQUIRED");
+  if (err == NOISE_ERROR_LOCAL_KEY_REQUIRED)
+    return LOG_STR("LOCAL_KEY_REQUIRED");
+  if (err == NOISE_ERROR_PSK_REQUIRED)
+    return LOG_STR("PSK_REQUIRED");
+  if (err == NOISE_ERROR_INVALID_LENGTH)
+    return LOG_STR("INVALID_LENGTH");
+  if (err == NOISE_ERROR_INVALID_PARAM)
+    return LOG_STR("INVALID_PARAM");
+  if (err == NOISE_ERROR_INVALID_STATE)
+    return LOG_STR("INVALID_STATE");
+  if (err == NOISE_ERROR_INVALID_NONCE)
+    return LOG_STR("INVALID_NONCE");
+  if (err == NOISE_ERROR_INVALID_PRIVATE_KEY)
+    return LOG_STR("INVALID_PRIVATE_KEY");
+  if (err == NOISE_ERROR_INVALID_PUBLIC_KEY)
+    return LOG_STR("INVALID_PUBLIC_KEY");
+  if (err == NOISE_ERROR_INVALID_FORMAT)
+    return LOG_STR("INVALID_FORMAT");
+  if (err == NOISE_ERROR_INVALID_SIGNATURE)
+    return LOG_STR("INVALID_SIGNATURE");
+  return LOG_STR("UNKNOWN");
+}
+
+const LogString *reject_reason_for(int err) {
+  return err == NOISE_ERROR_MAC_FAILURE ? LOG_STR("Handshake MAC failure") : LOG_STR("Handshake error");
+}
+
+size_t format_reject_payload(uint8_t *buf, size_t capacity, const LogString *reason) {
+  if (capacity == 0) {
+    // A caller bug; the MAC_FAILURE_PAYLOAD_SIZE static_asserts at the call
+    // sites make this unreachable, kept as cheap memory safety
+    ESP_LOGVV(TAG, "Reject buffer has no capacity");
+    return 0;
+  }
+  buf[0] = HANDSHAKE_STATUS_REJECT;
+#ifdef USE_STORE_LOG_STR_IN_FLASH
+  // On ESP8266 with flash strings, we need to use PROGMEM-aware functions
+  size_t reason_len = strlen_P(reinterpret_cast<PGM_P>(reason));
+  reason_len = std::min(reason_len, capacity - 1);
+  if (reason_len > 0) {
+    memcpy_P(buf + 1, reinterpret_cast<PGM_P>(reason), reason_len);
+  }
+#else
+  const char *reason_str = LOG_STR_ARG(reason);
+  size_t reason_len = strlen(reason_str);
+  reason_len = std::min(reason_len, capacity - 1);
+  if (reason_len > 0) {
+    // NOLINTNEXTLINE(bugprone-not-null-terminated-result) - binary protocol, not a C string
+    std::memcpy(buf + 1, reason_str, reason_len);
+  }
+#endif
+  return reason_len + 1;
+}
+
+}  // namespace esphome::noise
+#endif  // USE_NOISE

esphome/components/noise/noise.h

@@ -0,0 +1,73 @@
+#pragma once
+#include "esphome/core/defines.h"
+#ifdef USE_NOISE
+#include <array>
+#include <cstdint>
+#include "esphome/core/log.h"
+
+namespace esphome::noise {
+
+using psk_t = std::array<uint8_t, 32>;
+
+class NoiseContext {
+ public:
+  // The all-zeros PSK is reserved: it marks the device as unprovisioned and
+  // doubles as the well-known provisioning PSK that unprovisioned devices
+  // accept for Noise handshakes (passive-sniffing protection only, no
+  // authentication). It is never a valid real key.
+  static bool is_all_zeros(const psk_t &psk) {
+    uint8_t acc = 0;
+    for (uint8_t b : psk) {
+      acc |= b;
+    }
+    return acc == 0;
+  }
+  void set_psk(psk_t psk) {
+    this->psk_ = psk;
+    this->has_psk_ = !is_all_zeros(psk);
+  }
+  const psk_t &get_psk() const { return this->psk_; }
+  bool has_psk() const { return this->has_psk_; }
+
+ protected:
+  psk_t psk_{};
+  bool has_psk_{false};
+};
+
+/// Convert a noise error code to a readable error
+const LogString *noise_err_to_logstr(int err);
+
+// Shared wire format for the noise transports (api and ota): every frame is
+// FRAME_INDICATOR, a 16-bit big-endian payload length, then the payload.
+// Handshake payloads start with a status byte; transport payloads end with
+// the ChaCha20-Poly1305 MAC.
+static constexpr uint8_t FRAME_INDICATOR = 0x01;
+static constexpr size_t FRAME_HEADER_SIZE = 3;
+static constexpr size_t MAC_SIZE = 16;
+static constexpr size_t MAX_HANDSHAKE_SIZE = 128;
+static constexpr uint8_t HANDSHAKE_STATUS_OK = 0x00;
+static constexpr uint8_t HANDSHAKE_STATUS_REJECT = 0x01;
+
+inline void write_frame_header(uint8_t *buf, uint16_t payload_len) {
+  buf[0] = FRAME_INDICATOR;
+  buf[1] = (uint8_t) (payload_len >> 8);
+  buf[2] = (uint8_t) payload_len;
+}
+
+/// Fill buf with a handshake reject payload (status byte plus the reason
+/// text, PROGMEM aware); returns the payload length. buf needs capacity for
+/// the status byte plus the truncated reason.
+size_t format_reject_payload(uint8_t *buf, size_t capacity, const LogString *reason);
+
+/// Reject reason for a failed handshake read. The MAC failure string is a
+/// wire contract: clients match it to report a wrong key.
+const LogString *reject_reason_for(int err);
+
+/// Payload size of the MAC failure reject, the one reason string that is a
+/// wire contract (sizeof's NUL stands in for the status byte). static_assert
+/// reject buffers against this so a wrong key report can never truncate;
+/// longer caller-supplied reasons are informational and sized by the caller.
+static constexpr size_t MAC_FAILURE_PAYLOAD_SIZE = sizeof("Handshake MAC failure");
+
+}  // namespace esphome::noise
+#endif  // USE_NOISE

esphome/components/noise/noise_handshake.cpp

@@ -0,0 +1,139 @@
+#include "noise_handshake.h"
+#ifdef USE_NOISE
+#include "esphome/core/hal.h"
+#include "esphome/core/helpers.h"
+#include "esphome/core/log.h"
+
+namespace esphome::noise {
+
+static const char *const TAG = "noise";
+
+// Log the failing noise-c call at the same verbosity the api helper used
+// before this class existed; callers only see one collapsed error code.
+#define HANDSHAKE_STEP_LOG(func_name, err_code) \
+  ESP_LOGVV(TAG, "%s failed: %s", LOG_STR_ARG(LOG_STR(func_name)), LOG_STR_ARG(noise_err_to_logstr(err_code)))
+
+NoiseResponderHandshake::~NoiseResponderHandshake() {
+  if (this->handshake_ != nullptr) {
+    noise_handshakestate_free(this->handshake_);
+    this->handshake_ = nullptr;
+  }
+}
+
+int NoiseResponderHandshake::init(const psk_t &psk, const uint8_t *prologue, size_t prologue_len) {
+  if (this->handshake_ != nullptr) {
+    noise_handshakestate_free(this->handshake_);
+    this->handshake_ = nullptr;
+  }
+  // Noise_NNpsk0_25519_ChaChaPoly_SHA256, built on the stack:
+  // noise_handshakestate_new_by_id copies it, so a member would waste
+  // 104 bytes per connection, and a static const would sit in RAM on
+  // ESP8266 (.rodata is DRAM there).
+  const NoiseProtocolId nid = {
+      .prefix_id = NOISE_PREFIX_STANDARD,
+      .pattern_id = NOISE_PATTERN_NN,
+      .modifier_ids = {NOISE_MODIFIER_PSK0},
+      .dh_id = NOISE_DH_CURVE25519,
+      .cipher_id = NOISE_CIPHER_CHACHAPOLY,
+      .hash_id = NOISE_HASH_SHA256,
+      .hybrid_id = NOISE_DH_NONE,
+  };
+
+  int err = noise_handshakestate_new_by_id(&this->handshake_, &nid, NOISE_ROLE_RESPONDER);
+  if (err != 0) {
+    HANDSHAKE_STEP_LOG("noise_handshakestate_new_by_id", err);
+    return err;
+  }
+  err = noise_handshakestate_set_pre_shared_key(this->handshake_, psk.data(), psk.size());
+  if (err != 0) {
+    HANDSHAKE_STEP_LOG("noise_handshakestate_set_pre_shared_key", err);
+    return this->fail_init_(err);
+  }
+  err = noise_handshakestate_set_prologue(this->handshake_, prologue, prologue_len);
+  if (err != 0) {
+    HANDSHAKE_STEP_LOG("noise_handshakestate_set_prologue", err);
+    return this->fail_init_(err);
+  }
+  err = noise_handshakestate_start(this->handshake_);
+  if (err != 0) {
+    HANDSHAKE_STEP_LOG("noise_handshakestate_start", err);
+    return this->fail_init_(err);
+  }
+  return 0;
+}
+
+/// Release a half-initialized state so a failed init() leaves the object as
+/// if init() was never called.
+int NoiseResponderHandshake::fail_init_(int err) {
+  noise_handshakestate_free(this->handshake_);
+  this->handshake_ = nullptr;
+  return err;
+}
+
+NoiseResponderHandshake::Action NoiseResponderHandshake::action() const {
+  if (this->handshake_ == nullptr) {
+    // A caller bug: init() was never called, or split() already released the state
+    ESP_LOGVV(TAG, "action() on uninitialized or split handshake");
+    return Action::ACTION_FAILED;
+  }
+  int raw = noise_handshakestate_get_action(this->handshake_);
+  switch (raw) {
+    case NOISE_ACTION_READ_MESSAGE:
+      return Action::ACTION_READ;
+    case NOISE_ACTION_WRITE_MESSAGE:
+      return Action::ACTION_WRITE;
+    case NOISE_ACTION_SPLIT:
+      return Action::ACTION_SPLIT;
+    default:
+      // Preserve the raw code in debug logs; callers only see the collapsed enum
+      ESP_LOGVV(TAG, "Unexpected noise action %d", raw);
+      return Action::ACTION_FAILED;
+  }
+}
+
+int NoiseResponderHandshake::read_message(uint8_t *data, size_t len) {
+  NoiseBuffer mbuf;
+  noise_buffer_init(mbuf);
+  noise_buffer_set_input(mbuf, data, len);
+  return noise_handshakestate_read_message(this->handshake_, &mbuf, nullptr);
+}
+
+int NoiseResponderHandshake::write_message(uint8_t *out, size_t capacity, size_t &out_len) {
+  out_len = 0;
+  NoiseBuffer mbuf;
+  noise_buffer_init(mbuf);
+  noise_buffer_set_output(mbuf, out, capacity);
+  int err = noise_handshakestate_write_message(this->handshake_, &mbuf, nullptr);
+  if (err == 0)
+    out_len = mbuf.size;
+  return err;
+}
+
+int NoiseResponderHandshake::split(NoiseCipherState *&send_cipher, NoiseCipherState *&recv_cipher) {
+  // Defined error postcondition: noise-c leaves the out-params unwritten on
+  // its early error returns, so a caller passing uninitialized locals must
+  // never see garbage to free
+  send_cipher = nullptr;
+  recv_cipher = nullptr;
+  int err = noise_handshakestate_split(this->handshake_, &send_cipher, &recv_cipher);
+  if (err != 0)
+    return err;
+  noise_handshakestate_free(this->handshake_);
+  this->handshake_ = nullptr;
+  return 0;
+}
+
+extern "C" {
+// noise-c's only randomness source (the vendored library compiles no rand of
+// its own); HWRNG backed. Lives in this TU so every handshake consumer links
+// it and the definition can never be dropped from the archive.
+void noise_rand_bytes(void *output, size_t len) {
+  if (!esphome::random_bytes(reinterpret_cast<uint8_t *>(output), len)) {
+    ESP_LOGE(TAG, "Acquiring random bytes failed; rebooting");
+    arch_restart();
+  }
+}
+}
+
+}  // namespace esphome::noise
+#endif  // USE_NOISE

esphome/components/noise/noise_handshake.h

@@ -0,0 +1,63 @@
+#pragma once
+#include "esphome/core/defines.h"
+#ifdef USE_NOISE
+#include <cstddef>
+#include <cstdint>
+
+#include <noise/protocol.h>
+
+#include "noise.h"
+
+namespace esphome::noise {
+
+/** Sans-IO responder side of a Noise_NNpsk0_25519_ChaChaPoly_SHA256 handshake.
+ *
+ * Owns only the noise-c handshake state; the caller moves the raw handshake
+ * messages (no framing) over its own transport, driven by action():
+ * read_message() while READ, write_message() while WRITE, then split() to
+ * take ownership of the transport ciphers. All methods return a noise-c
+ * error code, 0 on success. Called outside their action() step (before
+ * init(), after split()) the message methods return a noise-c error rather
+ * than crashing; the library checks its state argument.
+ *
+ * Methods are deliberately small separate functions so callers on tight
+ * stacks (RP2040 core0 scratch bank) never pay for more than one branch;
+ * the curve25519 step alone needs ~2KB of stack.
+ */
+class NoiseResponderHandshake {
+ public:
+  // The ACTION_ prefix is macro-collision safety: SDK headers #define bare
+  // names like READ/WRITE, and macros expand even inside an enum class.
+  enum class Action : uint8_t { ACTION_READ, ACTION_WRITE, ACTION_SPLIT, ACTION_FAILED };
+
+  NoiseResponderHandshake() = default;
+  ~NoiseResponderHandshake();
+  // Owns a raw noise-c handshake state; copying would double free it
+  NoiseResponderHandshake(const NoiseResponderHandshake &) = delete;
+  NoiseResponderHandshake &operator=(const NoiseResponderHandshake &) = delete;
+
+  /// Create and start the handshake with the given PSK and prologue. A
+  /// repeated call frees the previous handshake state and starts over.
+  [[nodiscard]] int init(const psk_t &psk, const uint8_t *prologue, size_t prologue_len);
+  /// ACTION_FAILED is the catch-all: returned before init(), after split()
+  /// has released the state, and when noise-c reports a failed handshake.
+  [[nodiscard]] Action action() const;
+  /// Process one received handshake message. The buffer is consumed in
+  /// place: noise-c decrypts into it and zeroes it before returning.
+  [[nodiscard]] int read_message(uint8_t *data, size_t len);
+  /// Produce the next handshake message into out; out_len receives its size
+  /// and is zero on error.
+  [[nodiscard]] int write_message(uint8_t *out, size_t capacity, size_t &out_len);
+  /// Hand out the transport ciphers and free the handshake state. The caller
+  /// owns both cipher states and must free them with noise_cipherstate_free();
+  /// both are set to nullptr on error.
+  [[nodiscard]] int split(NoiseCipherState *&send_cipher, NoiseCipherState *&recv_cipher);
+
+ protected:
+  int fail_init_(int err);
+
+  NoiseHandshakeState *handshake_{nullptr};
+};
+
+}  // namespace esphome::noise
+#endif  // USE_NOISE

esphome/components/nrf52/__init__.py

@@ -125,8 +125,10 @@ def set_core_data(config: ConfigType) -> ConfigType:
     return config
 
 
-_TOOLCHAINS = (Toolchain.PLATFORMIO, Toolchain.SDK_NRF)
-_resolve_toolchain = cv.resolve_toolchain("nRF52", _TOOLCHAINS, Toolchain.SDK_NRF)
+def _resolve_toolchain(config: ConfigType) -> ConfigType:
+    if CORE.toolchain is None:
+        CORE.toolchain = config.get(CONF_TOOLCHAIN, Toolchain.SDK_NRF)
+    return config
 
 
 def set_framework(config: ConfigType) -> ConfigType:
@@ -168,7 +170,10 @@ BOOTLOADERS = [
 ]
 
 
-_validate_toolchain = cv.toolchain_enum(_TOOLCHAINS)
+def _validate_toolchain(value) -> Toolchain:
+    return Toolchain(
+        cv.one_of(Toolchain.PLATFORMIO, Toolchain.SDK_NRF, lower=True)(value)
+    )
 
 
 def _detect_bootloader(config: ConfigType) -> ConfigType:

esphome/components/nrf52/framework.py

@@ -7,7 +7,8 @@ import shutil
 import sys
 import tempfile
 
-from esphome.build_helpers.tools_cache import SDK_NRF_TOOLS_CACHE, tools_cache_path
+import platformdirs
+
 import esphome.config_validation as cv
 from esphome.const import KEY_CORE, KEY_FRAMEWORK_VERSION
 from esphome.core import CORE, EsphomeError
@@ -20,6 +21,7 @@ from esphome.framework_helpers import (
     run_command_ok,
     str_to_lst_of_str,
 )
+from esphome.helpers import get_str_env
 
 _LOGGER = logging.getLogger(__name__)
 
@@ -49,9 +51,15 @@ SDK_NG_MINIMAL_MIRRORS = str_to_lst_of_str(
 
 
 def get_sdk_nrf_tools_path() -> Path:
-    # Machine-global (OS user cache dir) so all projects share one install;
-    # see espidf.framework.get_idf_tools_path for the location rationale.
-    return tools_cache_path(*SDK_NRF_TOOLS_CACHE)
+    # A blank ESPHOME_SDK_NRF_PREFIX must be treated as unset: Path("")
+    # resolves to the CWD, which clean-all would then delete.
+    if prefix := get_str_env("ESPHOME_SDK_NRF_PREFIX", "").strip():
+        path = Path(prefix).expanduser()
+    else:
+        # Machine-global (OS user cache dir) so all projects share one install;
+        # see espidf.framework.get_idf_tools_path for the location rationale.
+        path = Path(platformdirs.user_cache_dir("esphome", appauthor=False)) / "sdk-nrf"
+    return path.resolve()
 
 
 def _needs_venv_rebuild(

esphome/components/ota/__init__.py

@@ -1,6 +1,9 @@
 from esphome import automation
 import esphome.codegen as cg
-from esphome.config_helpers import filter_source_files_from_platform
+from esphome.config_helpers import (
+    filter_source_files_from_defines,
+    filter_source_files_from_platform,
+)
 import esphome.config_validation as cv
 from esphome.const import (
     CONF_ESPHOME,
@@ -171,24 +174,17 @@ _filter_backend_source_files = filter_source_files_from_platform(
 )
 
 
+# USE_OTA_SIGNED_VERIFICATION_MULTI_KEY is set only on ESP32/IDF;
+# USE_OTA_PARTITIONS is set by the esphome OTA platform when
+# allow_partition_access is enabled.
+_filter_define_source_files = filter_source_files_from_defines(
+    {
+        "ota_signature_esp_idf.cpp": "USE_OTA_SIGNED_VERIFICATION_MULTI_KEY",
+        "ota_bootloader_esp_idf.cpp": "USE_OTA_PARTITIONS",
+        "ota_partitions_esp_idf.cpp": "USE_OTA_PARTITIONS",
+    }
+)
+
+
 def FILTER_SOURCE_FILES() -> list[str]:
-    files = _filter_backend_source_files()
-    # ota_signature_esp_idf.cpp implements multi-key OTA signature verification,
-    # compiled only when the esp32 component enables it (external RSA signed
-    # OTA sets USE_OTA_SIGNED_VERIFICATION_MULTI_KEY). The define is set only on
-    # ESP32/IDF, so this also excludes the file on every other platform. Filter
-    # it out otherwise so the (otherwise fully #ifdef'd-out) file isn't opened
-    # and parsed on every build.
-    if not any(
-        define.name == "USE_OTA_SIGNED_VERIFICATION_MULTI_KEY"
-        for define in CORE.defines
-    ):
-        files.append("ota_signature_esp_idf.cpp")
-    # ota_bootloader_esp_idf.cpp and ota_partitions_esp_idf.cpp are fully
-    # #ifdef'd on USE_OTA_PARTITIONS (set by the esphome OTA platform when
-    # allow_partition_access is enabled). Filter them out otherwise for the
-    # same reason as above.
-    if not any(define.name == "USE_OTA_PARTITIONS" for define in CORE.defines):
-        files.append("ota_bootloader_esp_idf.cpp")
-        files.append("ota_partitions_esp_idf.cpp")
-    return files
+    return _filter_backend_source_files() + _filter_define_source_files()

esphome/components/ota/ota_backend.h

@@ -66,6 +66,19 @@ enum OTAResponseTypes {
  */
 bool version_is_older(const char *candidate, const char *reference);
 
+// 64 KiB flash block; the erase granularity the ESP-IDF backend erases ahead with.
+static constexpr size_t OTA_BLOCK_ERASE_SIZE = 64 * 1024;
+
+/** Target erased watermark for lazy block erase-ahead.
+ *
+ * Rounds the write end offset up to a block boundary, clamped to the partition
+ * size. Platform-independent so the arithmetic is host-testable.
+ */
+constexpr size_t next_erase_end(size_t write_end, size_t partition_size) {
+  const size_t rounded = (write_end + OTA_BLOCK_ERASE_SIZE - 1) & ~(OTA_BLOCK_ERASE_SIZE - 1);
+  return rounded < partition_size ? rounded : partition_size;
+}
+
 enum OTAState {
   OTA_COMPLETED = 0,
   OTA_STARTED,

esphome/components/ota/ota_backend_esp_idf.cpp

@@ -7,7 +7,7 @@
 #include "esphome/core/log.h"
 
 #include <esp_ota_ops.h>
-#include <esp_task_wdt.h>
+#include <sdkconfig.h>
 #include <spi_flash_mmap.h>
 #ifdef USE_OTA_DOWNGRADE_PROTECTION
 #include <esp_app_desc.h>
@@ -60,27 +60,38 @@ OTAResponseTypes IDFOTABackend::begin(size_t image_size, ota::OTAType ota_type)
     return OTA_RESPONSE_ERROR_NO_UPDATE_PARTITION;
   }
 
-  // esp_ota_begin() erases the destination region, which blocks loopTask and
-  // scales with the erase size -- a fixed watchdog overruns on large OTA slots.
-  // An unknown size (0, e.g. web_server uploads) erases the whole partition, so
-  // budget against the bytes actually erased. ~10ms/KiB (conservative
-  // ~100 KiB/s erase) over a 15s floor; panic stays on so a stuck erase still
-  // resets rather than hanging forever.
-  size_t erase_size = image_size;
-  if (erase_size == 0 || erase_size > this->partition_->size) {
-    erase_size = this->partition_->size;
+  // Both lazy-erase paths below replace esp_ota_begin()'s blocking full erase.
+  // Size check replaces the one that erase performed (0 = unknown size,
+  // e.g. web_server uploads).
+  if (image_size != 0 && image_size > this->partition_->size) {
+    return OTA_RESPONSE_ERROR_ESP32_NOT_ENOUGH_SPACE;
   }
-  const uint32_t erase_budget_ms = 15000 + (erase_size >> 10) * 10;
-  watchdog::WatchdogManager watchdog(erase_budget_ms);
-  esp_err_t err = esp_ota_begin(this->partition_, image_size, &this->update_handle_);
+  this->written_ = 0;
+  esp_err_t err;
+#ifdef USE_OTA_BLOCK_ERASE_AHEAD
+  this->erased_end_ = 0;
+  // Unlike esp_ota_begin(), esp_ota_resume() does not reject a running app in
+  // ESP_OTA_IMG_PENDING_VERIFY; that state is unreachable here because the app
+  // was marked valid at boot (esp32/hal.cpp) or just above under USE_OTA_ROLLBACK.
+  // erase_size 0 (!= OTA_WITH_SEQUENTIAL_WRITES) means no erase; erase_ahead_() handles it
+  err = esp_ota_resume(this->partition_, 0, 0, &this->update_handle_);
+#if defined(CONFIG_BOOTLOADER_APP_ROLLBACK_ENABLE) && ESP_IDF_VERSION >= ESP_IDF_VERSION_VAL(5, 5, 0)
+  // esp_ota_begin() does this on IDF 5.5+; esp_ota_resume() does not. Prevents
+  // booting a half-written slot after a crash mid-OTA. Not available on the
+  // 5.3.3/5.4.2 backports, whose esp_ota_begin() did not invalidate either.
+  if (err == ESP_OK) {
+    esp_ota_invalidate_inactive_ota_data_slot();
+  }
+#endif
+#else
+  err = esp_ota_begin(this->partition_, OTA_WITH_SEQUENTIAL_WRITES, &this->update_handle_);
+#endif
 
   if (err != ESP_OK) {
-    ESP_LOGE(TAG, "esp_ota_begin failed (err=0x%X)", err);
+    ESP_LOGE(TAG, "OTA begin failed (err=0x%X)", err);
     esp_ota_abort(this->update_handle_);
     this->update_handle_ = 0;
-    if (err == ESP_ERR_INVALID_SIZE) {
-      return OTA_RESPONSE_ERROR_ESP32_NOT_ENOUGH_SPACE;
-    } else if (err == ESP_ERR_FLASH_OP_TIMEOUT || err == ESP_ERR_FLASH_OP_FAIL) {
+    if (err == ESP_ERR_FLASH_OP_TIMEOUT || err == ESP_ERR_FLASH_OP_FAIL) {
       return OTA_RESPONSE_ERROR_WRITING_FLASH;
     } else if (err == ESP_ERR_OTA_PARTITION_CONFLICT) {
       // This error appears with 1 factory and 1 ota partition
@@ -120,6 +131,17 @@ OTAResponseTypes IDFOTABackend::write(uint8_t *data, size_t len) {
   if (!this->is_app_or_bootloader_update_()) {
     return OTA_RESPONSE_ERROR_UNSUPPORTED_OTA_TYPE;
   }
+#endif
+  // Overflow can only happen on unknown-size uploads (web_server); known
+  // sizes were rejected in begin().
+  if (this->written_ + len > this->partition_->size) {
+    return OTA_RESPONSE_ERROR_ESP32_NOT_ENOUGH_SPACE;
+  }
+#ifdef USE_OTA_BLOCK_ERASE_AHEAD
+  OTAResponseTypes erase_result = this->erase_ahead_(len);
+  if (erase_result != OTA_RESPONSE_OK) {
+    return erase_result;
+  }
 #endif
   esp_err_t err = esp_ota_write(this->update_handle_, data, len);
   this->md5_.add(data, len);
@@ -127,14 +149,40 @@ OTAResponseTypes IDFOTABackend::write(uint8_t *data, size_t len) {
     ESP_LOGE(TAG, "esp_ota_write failed (err=0x%X)", err);
     if (err == ESP_ERR_OTA_VALIDATE_FAILED) {
       return OTA_RESPONSE_ERROR_MAGIC;
+    } else if (err == ESP_ERR_INVALID_SIZE) {
+      // Sequential-writes fallback: IDF's lazy erase reports overflow here
+      return OTA_RESPONSE_ERROR_ESP32_NOT_ENOUGH_SPACE;
     } else if (err == ESP_ERR_FLASH_OP_TIMEOUT || err == ESP_ERR_FLASH_OP_FAIL) {
       return OTA_RESPONSE_ERROR_WRITING_FLASH;
     }
     return OTA_RESPONSE_ERROR_UNKNOWN;
   }
+  this->written_ += len;
   return OTA_RESPONSE_OK;
 }
 
+#ifdef USE_OTA_BLOCK_ERASE_AHEAD
+OTAResponseTypes IDFOTABackend::erase_ahead_(size_t len) {
+  const size_t end = this->written_ + len;
+  if (this->erased_end_ >= end) {
+    return OTA_RESPONSE_OK;
+  }
+  // Round up to a block boundary, clamped to the partition end; IDF splits the
+  // range into 64 KiB block erases where aligned, sector erases elsewhere.
+  const size_t erase_to = next_erase_end(end, this->partition_->size);
+  // A block erase is one uninterruptible flash op (typically ~150 ms, seconds
+  // on aged flash) and the transfer loop may not have fed the WDT for ~1s.
+  watchdog::WatchdogManager watchdog(15000);
+  esp_err_t err = esp_partition_erase_range(this->partition_, this->erased_end_, erase_to - this->erased_end_);
+  if (err != ESP_OK) {
+    ESP_LOGE(TAG, "esp_partition_erase_range failed (err=0x%X)", err);
+    return err == ESP_ERR_INVALID_SIZE ? OTA_RESPONSE_ERROR_ESP32_NOT_ENOUGH_SPACE : OTA_RESPONSE_ERROR_WRITING_FLASH;
+  }
+  this->erased_end_ = erase_to;
+  return OTA_RESPONSE_OK;
+}
+#endif
+
 OTAResponseTypes IDFOTABackend::end() {
   if (this->md5_set_) {
     this->md5_.calculate();
@@ -226,6 +274,10 @@ void IDFOTABackend::abort() {
   // or not an update is in flight.
   esp_ota_abort(this->update_handle_);
   this->update_handle_ = 0;
+  this->written_ = 0;
+#ifdef USE_OTA_BLOCK_ERASE_AHEAD
+  this->erased_end_ = 0;
+#endif
 }
 
 }  // namespace esphome::ota

esphome/components/ota/ota_backend_esp_idf.h

@@ -5,8 +5,18 @@
 #include "esphome/components/md5/md5.h"
 #include "esphome/core/defines.h"
 
+#include <esp_idf_version.h>
 #include <esp_ota_ops.h>
 
+// esp_ota_resume() (IDF 5.4.2+, backported to 5.3.3) provides a no-erase OTA
+// handle, letting write() block-erase 64 KiB ahead of the write cursor
+// (~4x faster than the per-sector lazy erase of OTA_WITH_SEQUENTIAL_WRITES,
+// used as fallback on older IDF).
+#if ESP_IDF_VERSION >= ESP_IDF_VERSION_VAL(5, 4, 2) || \
+    (ESP_IDF_VERSION >= ESP_IDF_VERSION_VAL(5, 3, 3) && ESP_IDF_VERSION < ESP_IDF_VERSION_VAL(5, 4, 0))
+#define USE_OTA_BLOCK_ERASE_AHEAD
+#endif
+
 namespace esphome::ota {
 
 #ifdef USE_OTA_PARTITIONS
@@ -54,6 +64,9 @@ class IDFOTABackend final {
 #endif
 
  private:
+#ifdef USE_OTA_BLOCK_ERASE_AHEAD
+  OTAResponseTypes erase_ahead_(size_t len);
+#endif
 #ifdef USE_OTA_SIGNED_VERIFICATION_MULTI_KEY
   // Accept an image signed by any key the running app trusts (up to 3 blocks),
   // so rotation and backup keys work. Fails closed. Covers app and bootloader.
@@ -62,7 +75,11 @@ class IDFOTABackend final {
   // Keep md5_ first since its digest_ is alignas(32) on DMA-SHA variants; md5_set_ stays last so buf_ packs tightly.
   md5::MD5Digest md5_{};
   esp_ota_handle_t update_handle_{0};
-  const esp_partition_t *partition_;
+  const esp_partition_t *partition_{nullptr};
+  size_t written_{0};  // Bytes handed to esp_ota_write()
+#ifdef USE_OTA_BLOCK_ERASE_AHEAD
+  size_t erased_end_{0};  // Erased up to this partition offset; must stay >= written_
+#endif
   char expected_bin_md5_[32];
   bool md5_set_{false};
 #ifdef USE_OTA_PARTITIONS

esphome/components/ota/ota_bootloader_esp_idf.cpp

@@ -1,6 +1,7 @@
 #ifdef USE_ESP32
 #include "ota_backend_esp_idf.h"
 
+#include "esphome/components/watchdog/watchdog.h"
 #include "esphome/core/defines.h"
 
 #ifdef USE_OTA_PARTITIONS
@@ -69,12 +70,20 @@ OTAResponseTypes IDFOTABackend::setup_bootloader_staging_() {
     return OTA_RESPONSE_ERROR_BOOTLOADER_VERIFY;
   }
   // Erase full size of the bootloader partition in the staging partition
-  // to avoid copying old data to the bootloader partition later
+  // to avoid copying old data to the bootloader partition later. Up to
+  // ESP_BOOTLOADER_SIZE of blocking erase; widen the WDT for its duration.
+  watchdog::WatchdogManager watchdog(15000);
   esp_err_t err = esp_partition_erase_range(this->partition_, 0, this->bootloader_part_->size);
   if (err != ESP_OK) {
     ESP_LOGW(TAG, "esp_partition_erase_range failed (err=0x%X)", err);
     // No critical error, don't return
   }
+#ifdef USE_OTA_BLOCK_ERASE_AHEAD
+  if (err == ESP_OK) {
+    // Skip re-erasing the pre-erased staging region in erase_ahead_()
+    this->erased_end_ = this->bootloader_part_->size;
+  }
+#endif
   err = esp_ota_set_final_partition(this->update_handle_, this->bootloader_part_, false);
   if (err != ESP_OK) {
     esp_ota_abort(this->update_handle_);

esphome/components/ota/ota_signature_esp_idf.cpp

@@ -211,7 +211,7 @@ bool rsa_pss_verify(uint8_t *block, const uint8_t *digest) {
 bool IDFOTABackend::verify_signed_image_(const esp_partition_t *incoming) {
   // Verification re-hashes the full image (after esp_ota_end already did one
   // pass), which can approach the task WDT budget on a large app. Extend it for
-  // the duration, mirroring the erase budget in begin().
+  // the duration, scaled to the image size over a 15 s floor.
   const uint32_t verify_budget_ms = 15000 + (incoming->size >> 10) * 10;
   watchdog::WatchdogManager watchdog(verify_budget_ms);
 

esphome/components/rp2/__init__.py

@@ -312,7 +312,6 @@ CONFIG_SCHEMA = cv.All(
     ),
     cv.has_at_least_one_key(CONF_BOARD, CONF_VARIANT),
     _detect_variant,
-    cv.require_platformio_toolchain("RP2"),
     set_core_data,
 )
 

esphome/components/sensor/__init__.py

@@ -5,6 +5,7 @@ from esphome import automation
 import esphome.codegen as cg
 from esphome.components import mqtt, web_server, zigbee
 from esphome.components.const import CONF_B_CONSTANT
+from esphome.config_helpers import filter_source_files_from_defines
 import esphome.config_validation as cv
 from esphome.const import (
     CONF_ABOVE,
@@ -1303,3 +1304,8 @@ def _lstsq(a, b):
 @coroutine_with_priority(CoroPriority.CORE)
 async def to_code(config):
     cg.add_global(sensor_ns.using)
+
+
+FILTER_SOURCE_FILES = filter_source_files_from_defines(
+    {"filter.cpp": "USE_SENSOR_FILTER"}
+)

esphome/components/text_sensor/__init__.py

@@ -1,6 +1,7 @@
 from esphome import automation
 import esphome.codegen as cg
 from esphome.components import mqtt, web_server
+from esphome.config_helpers import filter_source_files_from_defines
 import esphome.config_validation as cv
 from esphome.const import (
     CONF_DEVICE_CLASS,
@@ -256,3 +257,8 @@ async def text_sensor_state_to_code(config, condition_id, template_arg, args):
     templ = await cg.templatable(config[CONF_STATE], args, cg.std_string)
     cg.add(var.set_state(templ))
     return var
+
+
+FILTER_SOURCE_FILES = filter_source_files_from_defines(
+    {"filter.cpp": "USE_TEXT_SENSOR_FILTER"}
+)

esphome/components/uptime/sensor/__init__.py

@@ -1,5 +1,6 @@
 import esphome.codegen as cg
 from esphome.components import sensor, time
+from esphome.config_helpers import filter_source_files_from_defines
 import esphome.config_validation as cv
 from esphome.const import (
     CONF_TIME_ID,
@@ -10,7 +11,6 @@ from esphome.const import (
     STATE_CLASS_TOTAL_INCREASING,
     UNIT_SECOND,
 )
-from esphome.core import CORE
 
 uptime_ns = cg.esphome_ns.namespace("uptime")
 UptimeSecondsSensor = uptime_ns.class_(
@@ -62,9 +62,6 @@ async def to_code(config):
         cg.add(var.set_time(time_id))
 
 
-def FILTER_SOURCE_FILES() -> list[str]:
-    # uptime_timestamp_sensor.cpp is fully #ifdef'd on USE_TIME; skip it
-    # when no time component is configured.
-    if not any(define.name == "USE_TIME" for define in CORE.defines):
-        return ["uptime_timestamp_sensor.cpp"]
-    return []
+FILTER_SOURCE_FILES = filter_source_files_from_defines(
+    {"uptime_timestamp_sensor.cpp": "USE_TIME"}
+)

esphome/components/web_server_idf/web_server_idf.h

@@ -117,12 +117,6 @@ class AsyncWebServerRequest {
   /// Write URL (without query string) to buffer, returns StringRef pointing to buffer.
   /// URL is decoded (e.g., %20 -> space).
   StringRef url_to(std::span<char, URL_BUF_SIZE> buffer) const;
-  // Remove before 2026.9.0
-  ESPDEPRECATED("Use url_to() instead. Removed in 2026.9.0", "2026.3.0")
-  std::string url() const {
-    char buffer[URL_BUF_SIZE];
-    return std::string(this->url_to(buffer));
-  }
   // NOLINTNEXTLINE(readability-identifier-naming)
   size_t contentLength() const { return this->req_->content_len; }
 

esphome/components/wifi/wifi_component.cpp

@@ -618,8 +618,6 @@ static const char *eap_phase2_to_str(esp_eap_ttls_phase2_types type) {
 }
 #endif
 
-float WiFiComponent::get_setup_priority() const { return setup_priority::WIFI; }
-
 void WiFiComponent::setup() {
   this->wifi_pre_setup_();
 
@@ -931,10 +929,6 @@ void WiFiComponent::loop() {
 
 WiFiComponent::WiFiComponent() { global_wifi_component = this; }
 
-#ifdef USE_WIFI_11KV_SUPPORT
-void WiFiComponent::set_btm(bool btm) { this->btm_ = btm; }
-void WiFiComponent::set_rrm(bool rrm) { this->rrm_ = rrm; }
-#endif
 network::IPAddresses WiFiComponent::get_ip_addresses() {
   if (this->has_sta())
     return this->wifi_sta_ip_addresses();
@@ -1327,8 +1321,6 @@ void WiFiComponent::disable() {
   this->wifi_mode_(false, false);
 }
 
-bool WiFiComponent::is_disabled() { return this->state_ == WIFI_COMPONENT_STATE_DISABLED; }
-
 void WiFiComponent::start_scanning() {
   this->action_started_ = millis();
   ESP_LOGD(TAG, "Starting scan");
@@ -2196,7 +2188,6 @@ void WiFiComponent::retry_connect() {
   }
 }
 
-void WiFiComponent::set_reboot_timeout(uint32_t reboot_timeout) { this->reboot_timeout_ = reboot_timeout; }
 void WiFiComponent::set_power_save_mode(WiFiPowerSaveMode power_save) {
   this->power_save_ = power_save;
 #if defined(USE_ESP32) && defined(USE_WIFI_RUNTIME_POWER_SAVE)
@@ -2204,8 +2195,6 @@ void WiFiComponent::set_power_save_mode(WiFiPowerSaveMode power_save) {
 #endif
 }
 
-void WiFiComponent::set_passive_scan(bool passive) { this->passive_scan_ = passive; }
-
 bool WiFiComponent::is_captive_portal_active_() {
 #ifdef USE_CAPTIVE_PORTAL
   return captive_portal::global_captive_portal != nullptr && captive_portal::global_captive_portal->is_active();
@@ -2324,33 +2313,6 @@ void WiFiComponent::save_fast_connect_settings_(const bssid_t &bssid, uint8_t ch
 }
 #endif
 
-void WiFiAP::set_ssid(const std::string &ssid) { this->ssid_ = CompactString(ssid.c_str(), ssid.size()); }
-void WiFiAP::set_ssid(const char *ssid) { this->ssid_ = CompactString(ssid, strlen(ssid)); }
-void WiFiAP::set_bssid(const bssid_t &bssid) { this->bssid_ = bssid; }
-void WiFiAP::clear_bssid() { this->bssid_ = {}; }
-void WiFiAP::set_password(const std::string &password) {
-  this->password_ = CompactString(password.c_str(), password.size());
-}
-void WiFiAP::set_password(const char *password) { this->password_ = CompactString(password, strlen(password)); }
-#ifdef USE_WIFI_WPA2_EAP
-void WiFiAP::set_eap(optional<EAPAuth> eap_auth) { this->eap_ = std::move(eap_auth); }
-#endif
-void WiFiAP::set_channel(uint8_t channel) { this->channel_ = channel; }
-void WiFiAP::clear_channel() { this->channel_ = 0; }
-#ifdef USE_WIFI_MANUAL_IP
-void WiFiAP::set_manual_ip(optional<ManualIP> manual_ip) { this->manual_ip_ = manual_ip; }
-#endif
-void WiFiAP::set_hidden(bool hidden) { this->hidden_ = hidden; }
-const bssid_t &WiFiAP::get_bssid() const { return this->bssid_; }
-bool WiFiAP::has_bssid() const { return this->bssid_ != bssid_t{}; }
-#ifdef USE_WIFI_WPA2_EAP
-const optional<EAPAuth> &WiFiAP::get_eap() const { return this->eap_; }
-#endif
-#ifdef USE_WIFI_MANUAL_IP
-const optional<ManualIP> &WiFiAP::get_manual_ip() const { return this->manual_ip_; }
-#endif
-bool WiFiAP::get_hidden() const { return this->hidden_; }
-
 WiFiScanResult::WiFiScanResult(const bssid_t &bssid, const char *ssid, size_t ssid_len, uint8_t channel, int8_t rssi,
                                bool with_auth, bool is_hidden)
     : bssid_(bssid),

esphome/components/wifi/wifi_component.h

@@ -21,6 +21,7 @@
 #include <span>
 #include <string>
 #include <type_traits>
+#include <utility>
 #include <vector>
 
 #ifdef USE_LIBRETINY
@@ -261,38 +262,38 @@ class WiFiAP {
   friend class WiFiScanResult;
 
  public:
-  void set_ssid(const std::string &ssid);
-  void set_ssid(const char *ssid);
+  void set_ssid(const std::string &ssid) { this->ssid_ = CompactString(ssid.c_str(), ssid.size()); }
+  void set_ssid(const char *ssid) { this->set_ssid(StringRef(ssid)); }
   void set_ssid(StringRef ssid) { this->ssid_ = CompactString(ssid.c_str(), ssid.size()); }
-  void set_bssid(const bssid_t &bssid);
-  void clear_bssid();
-  void set_password(const std::string &password);
-  void set_password(const char *password);
+  void set_bssid(const bssid_t &bssid) { this->bssid_ = bssid; }
+  void clear_bssid() { this->bssid_ = {}; }
+  void set_password(const std::string &password) { this->password_ = CompactString(password.c_str(), password.size()); }
+  void set_password(const char *password) { this->set_password(StringRef(password)); }
   void set_password(StringRef password) { this->password_ = CompactString(password.c_str(), password.size()); }
 #ifdef USE_WIFI_WPA2_EAP
-  void set_eap(optional<EAPAuth> eap_auth);
+  void set_eap(optional<EAPAuth> eap_auth) { this->eap_ = std::move(eap_auth); }
 #endif  // USE_WIFI_WPA2_EAP
-  void set_channel(uint8_t channel);
-  void clear_channel();
+  void set_channel(uint8_t channel) { this->channel_ = channel; }
+  void clear_channel() { this->channel_ = 0; }
   void set_priority(int8_t priority) { priority_ = priority; }
 #ifdef USE_WIFI_MANUAL_IP
-  void set_manual_ip(optional<ManualIP> manual_ip);
+  void set_manual_ip(optional<ManualIP> manual_ip) { this->manual_ip_ = manual_ip; }
 #endif
-  void set_hidden(bool hidden);
+  void set_hidden(bool hidden) { this->hidden_ = hidden; }
   StringRef get_ssid() const { return this->ssid_.ref(); }
   StringRef get_password() const { return this->password_.ref(); }
-  const bssid_t &get_bssid() const;
-  bool has_bssid() const;
+  const bssid_t &get_bssid() const { return this->bssid_; }
+  bool has_bssid() const { return this->bssid_ != bssid_t{}; }
 #ifdef USE_WIFI_WPA2_EAP
-  const optional<EAPAuth> &get_eap() const;
+  const optional<EAPAuth> &get_eap() const { return this->eap_; }
 #endif  // USE_WIFI_WPA2_EAP
   uint8_t get_channel() const { return this->channel_; }
   bool has_channel() const { return this->channel_ != 0; }
   int8_t get_priority() const { return priority_; }
 #ifdef USE_WIFI_MANUAL_IP
-  const optional<ManualIP> &get_manual_ip() const;
+  const optional<ManualIP> &get_manual_ip() const { return this->manual_ip_; }
 #endif
-  bool get_hidden() const;
+  bool get_hidden() const { return this->hidden_; }
 
  protected:
   CompactString ssid_;
@@ -442,6 +443,7 @@ class WiFiComponent final : public Component {
   void set_sta(const WiFiAP &ap);
   // Returns a copy of the currently selected AP configuration
   WiFiAP get_sta() const;
+  // init_sta/add_sta kept out of line: inlining them into the generated setup() grows flash
   void init_sta(size_t count);
   void add_sta(const WiFiAP &ap);
   void clear_sta();
@@ -461,7 +463,7 @@ class WiFiComponent final : public Component {
 
   void enable();
   void disable();
-  bool is_disabled();
+  bool is_disabled() { return this->state_ == WIFI_COMPONENT_STATE_DISABLED; }
   void start_scanning();
   void check_scanning_finished();
   void start_connecting(const WiFiAP &ap);
@@ -472,7 +474,7 @@ class WiFiComponent final : public Component {
 
   void retry_connect();
 
-  void set_reboot_timeout(uint32_t reboot_timeout);
+  void set_reboot_timeout(uint32_t reboot_timeout) { this->reboot_timeout_ = reboot_timeout; }
 
   bool is_connected() const { return this->connected_; }
 
@@ -492,7 +494,7 @@ class WiFiComponent final : public Component {
   void set_phy_mode(WiFi8266PhyMode phy_mode) { this->phy_mode_ = phy_mode; }
 #endif
 
-  void set_passive_scan(bool passive);
+  void set_passive_scan(bool passive) { this->passive_scan_ = passive; }
 
   void save_wifi_sta(const std::string &ssid, const std::string &password);
   void save_wifi_sta(const char *ssid, const char *password);
@@ -506,7 +508,7 @@ class WiFiComponent final : public Component {
   void dump_config() override;
   void restart_adapter();
   /// WIFI setup_priority.
-  float get_setup_priority() const override;
+  float get_setup_priority() const override { return setup_priority::WIFI; }
   /// Reconnect WiFi if required.
   void loop() override;
 
@@ -515,8 +517,8 @@ class WiFiComponent final : public Component {
   bool is_ap_active() const { return this->ap_started_; }
 
 #ifdef USE_WIFI_11KV_SUPPORT
-  void set_btm(bool btm);
-  void set_rrm(bool rrm);
+  void set_btm(bool btm) { this->btm_ = btm; }
+  void set_rrm(bool rrm) { this->rrm_ = rrm; }
 #endif
 
   network::IPAddress get_dns_address(int num);
@@ -550,9 +552,6 @@ class WiFiComponent final : public Component {
   void set_sta_priority(bssid_t bssid, int8_t priority);
 
   network::IPAddresses wifi_sta_ip_addresses();
-  // Remove before 2026.9.0
-  ESPDEPRECATED("Use wifi_ssid_to() instead. Removed in 2026.9.0", "2026.3.0")
-  std::string wifi_ssid();
   /// Write SSID to buffer without heap allocation.
   /// Returns pointer to buffer, or empty string if not connected.
   const char *wifi_ssid_to(std::span<char, SSID_BUFFER_SIZE> buffer);

esphome/components/wifi/wifi_component_esp8266.cpp

@@ -944,16 +944,6 @@ bssid_t WiFiComponent::wifi_bssid() {
   }
   return bssid;
 }
-std::string WiFiComponent::wifi_ssid() {
-  struct station_config conf {};
-  if (!wifi_station_get_config(&conf)) {
-    return "";
-  }
-  // conf.ssid is uint8[32], not null-terminated if full
-  auto *ssid_s = reinterpret_cast<const char *>(conf.ssid);
-  size_t len = strnlen(ssid_s, sizeof(conf.ssid));
-  return {ssid_s, len};
-}
 const char *WiFiComponent::wifi_ssid_to(std::span<char, SSID_BUFFER_SIZE> buffer) {
   struct station_config conf {};
   if (!wifi_station_get_config(&conf)) {

esphome/components/wifi/wifi_component_esp_idf.cpp

@@ -1237,18 +1237,6 @@ bssid_t WiFiComponent::wifi_bssid() {
   std::copy(info.bssid, info.bssid + 6, bssid.begin());
   return bssid;
 }
-std::string WiFiComponent::wifi_ssid() {
-  wifi_ap_record_t info{};
-  esp_err_t err = esp_wifi_sta_get_ap_info(&info);
-  if (err != ESP_OK) {
-    // Very verbose only: this is expected during dump_config() before connection is established (PR #9823)
-    ESP_LOGVV(TAG, "esp_wifi_sta_get_ap_info failed: %s", esp_err_to_name(err));
-    return "";
-  }
-  auto *ssid_s = reinterpret_cast<const char *>(info.ssid);
-  size_t len = strnlen(ssid_s, sizeof(info.ssid));
-  return {ssid_s, len};
-}
 const char *WiFiComponent::wifi_ssid_to(std::span<char, SSID_BUFFER_SIZE> buffer) {
   wifi_ap_record_t info{};
   esp_err_t err = esp_wifi_sta_get_ap_info(&info);

esphome/components/wifi/wifi_component_libretiny.cpp

@@ -762,7 +762,6 @@ bssid_t WiFiComponent::wifi_bssid() {
   }
   return bssid;
 }
-std::string WiFiComponent::wifi_ssid() { return WiFi.SSID().c_str(); }
 const char *WiFiComponent::wifi_ssid_to(std::span<char, SSID_BUFFER_SIZE> buffer) {
 #ifdef USE_BK72XX
   LinkStatusTypeDef link_status{};

esphome/components/wifi/wifi_component_pico_w.cpp

@@ -265,7 +265,6 @@ bssid_t WiFiComponent::wifi_bssid() {
     bssid[i] = raw_bssid[i];
   return bssid;
 }
-std::string WiFiComponent::wifi_ssid() { return WiFi.SSID().c_str(); }
 const char *WiFiComponent::wifi_ssid_to(std::span<char, SSID_BUFFER_SIZE> buffer) {
   // TODO: Find direct CYW43 API to avoid Arduino String allocation
   String ssid = WiFi.SSID();

esphome/config_helpers.py

@@ -151,6 +151,31 @@ def filter_source_files_from_platform(
     return filter_source_files
 
 
+def filter_source_files_from_defines(
+    files_map: dict[str, str | tuple[str, ...]],
+) -> Callable[[], list[str]]:
+    """Helper to build a FILTER_SOURCE_FILES function from a define mapping.
+
+    Args:
+        files_map: Dict mapping filename to the define name (or tuple of
+            define names) that keeps the file in the build; the file is
+            excluded when none of its defines is set for the current config.
+
+    Returns:
+        Function that returns the files to exclude for the current config.
+    """
+
+    def filter_source_files() -> list[str]:
+        defines = {define.name for define in CORE.defines}
+        return [
+            filename
+            for filename, needed in files_map.items()
+            if defines.isdisjoint((needed,) if isinstance(needed, str) else needed)
+        ]
+
+    return filter_source_files
+
+
 def get_logger_level() -> str:
     """Get the configured logger level.
 

esphome/config_validation.py

@@ -53,7 +53,6 @@ from esphome.const import (
     CONF_SETUP_PRIORITY,
     CONF_STATE_TOPIC,
     CONF_SUBSCRIBE_QOS,
-    CONF_TOOLCHAIN,
     CONF_TOPIC,
     CONF_TYPE,
     CONF_TYPE_ID,
@@ -76,7 +75,6 @@ from esphome.const import (
     TYPE_GIT,
     TYPE_LOCAL,
     Framework,
-    Toolchain,
     __version__ as ESPHOME_VERSION,
 )
 from esphome.core import (
@@ -93,13 +91,7 @@ from esphome.core import (
 )
 from esphome.enum import StrEnum
 from esphome.expression import SUBSTITUTION_VARIABLE_PROG as VARIABLE_PROG
-from esphome.helpers import (
-    FALSY_BOOL_STRINGS,
-    TRUTHY_BOOL_STRINGS,
-    add_class_to_obj,
-    docs_url,
-    list_starts_with,
-)
+from esphome.helpers import add_class_to_obj, docs_url, list_starts_with
 from esphome.schema_extractors import (
     SCHEMA_EXTRACT,
     schema_extractor,
@@ -114,9 +106,6 @@ from esphome.util import parse_esphome_version  # noqa: F401
 from esphome.voluptuous_schema import _Schema
 from esphome.yaml_util import SensitiveStr, make_data_base
 
-if typing.TYPE_CHECKING:
-    from esphome.types import ConfigType
-
 _LOGGER = logging.getLogger(__name__)
 
 # pylint: disable=invalid-name
@@ -587,9 +576,9 @@ def boolean(value):
         return value
     if isinstance(value, str):
         value = value.lower()
-        if value in TRUTHY_BOOL_STRINGS:
+        if value in ("true", "yes", "on", "enable"):
             return True
-        if value in FALSY_BOOL_STRINGS:
+        if value in ("false", "no", "off", "disable"):
             return False
     raise Invalid(
         f"Expected boolean value, but cannot convert {value} to a boolean. Please use 'true' or 'false'"
@@ -2543,63 +2532,6 @@ def platformio_version_constraint(value):
     return constraints
 
 
-def _check_supported_toolchain(
-    platform_name: str, supported: tuple[Toolchain, ...]
-) -> None:
-    """Raise when the resolved ``CORE.toolchain`` is not in ``supported``
-    (one message shape for every platform)."""
-    toolchain = CORE.toolchain
-    if toolchain is None:
-        # A caller ran the check before resolving; an ordering bug, not a
-        # user error
-        raise Invalid(f"Toolchain was not resolved before {platform_name} validation")
-    if toolchain not in supported:
-        names = ", ".join(f"'{tc.value}'" for tc in supported)
-        raise Invalid(
-            f"Unsupported toolchain "
-            f"'{toolchain.value}' for "
-            f"{platform_name}. Supported: {names}."
-        )
-
-
-def toolchain_enum(supported: tuple[Toolchain, ...]) -> Callable[[str], Toolchain]:
-    """Schema validator for a platform's ``toolchain`` config key."""
-
-    def validator(value: str) -> Toolchain:
-        return Toolchain(one_of(*supported, lower=True)(value))
-
-    return validator
-
-
-def resolve_toolchain(
-    platform_name: str, supported: tuple[Toolchain, ...], default: Toolchain
-) -> Callable[[ConfigType], ConfigType]:
-    """Resolve ``CORE.toolchain`` (CLI > YAML > default) and reject one the
-    platform cannot serve.
-
-    Add to the platform's validation chain before anything that reads
-    ``CORE.toolchain``.
-    """
-
-    def validator(config: ConfigType) -> ConfigType:
-        if CORE.toolchain is None:
-            CORE.toolchain = config.get(CONF_TOOLCHAIN, default)
-        _check_supported_toolchain(platform_name, supported)
-        return config
-
-    return validator
-
-
-def require_platformio_toolchain(
-    platform_name: str,
-) -> Callable[[ConfigType], ConfigType]:
-    """Reject a CLI-selected toolchain other than PlatformIO, for platforms
-    with only the PlatformIO backend."""
-    return resolve_toolchain(
-        platform_name, (Toolchain.PLATFORMIO,), Toolchain.PLATFORMIO
-    )
-
-
 def require_framework_version(
     *,
     max_version=False,

esphome/const.py

@@ -21,14 +21,6 @@ class Toolchain(StrEnum):
     PLATFORMIO = "platformio"
     ESP_IDF = "esp-idf"
     SDK_NRF = "sdk-nrf"
-    # ESP8266: the Arduino core built directly (no PlatformIO)
-    ARDUINO = "arduino"
-
-
-# Toolchains that drive their build natively and never read platformio.ini.
-# SDK_NRF is absent on purpose: the zephyr backend keeps consuming
-# platformio_options.
-NATIVE_TOOLCHAINS = frozenset({Toolchain.ESP_IDF, Toolchain.ARDUINO})
 
 
 class Platform(StrEnum):

esphome/core/__init__.py

@@ -21,7 +21,6 @@ from esphome.const import (
     KEY_CORE,
     KEY_TARGET_FRAMEWORK,
     KEY_TARGET_PLATFORM,
-    NATIVE_TOOLCHAINS,
     PLATFORM_BK72XX,
     PLATFORM_ESP32,
     PLATFORM_ESP8266,
@@ -983,19 +982,6 @@ class EsphomeCore:
     def using_toolchain_sdk_nrf(self):
         return self.toolchain == Toolchain.SDK_NRF
 
-    @property
-    def using_toolchain_arduino(self):
-        """The native ESP8266 Arduino build toolchain (unlike
-        ``using_arduino``, which is the target framework)."""
-        return self.toolchain == Toolchain.ARDUINO
-
-    @property
-    def using_native_toolchain(self):
-        """Whether the selected toolchain builds natively, without reading
-        ``platformio.ini`` (see ``NATIVE_TOOLCHAINS`` in ``esphome.const``;
-        keep its membership in sync with ``write_cpp_file``'s dispatch)."""
-        return self.toolchain in NATIVE_TOOLCHAINS
-
     @property
     def using_zephyr(self):
         return self.target_framework == "zephyr"
@@ -1109,8 +1095,6 @@ class EsphomeCore:
         return build_flag
 
     def add_build_unflag(self, build_unflag: str) -> None:
-        # No warning for using_toolchain_arduino: the native ESP8266 build
-        # honors build_unflags (token-level, matching PlatformIO).
         if self.using_toolchain_esp_idf:
             # The native ESP-IDF build generator does not consume build_unflags
             _LOGGER.warning(

esphome/core/config.py

@@ -555,24 +555,12 @@ def _add_library_str(lib: str) -> None:
         cg.add_library(lib, None)
 
 
-# platformio_options keys the native ESP8266 Arduino generator (a later PR
-# in this chain) will honor; its ignored-option warning will consume the same
-# list so the two cannot drift
-NATIVE_ARDUINO_PIO_OPTIONS = frozenset({"board_build.f_cpu", "board_build.ldscript"})
-# The full set that survives into CORE.platformio_options under the native
-# arduino toolchain: lib_ignore is the only specially-translated key below
-# that is stored rather than translated away. Consumed by the esp8266 native
-# backend (later in this chain) for its ignored-option warning; defined here
-# so it stays adjacent to the routing.
-NATIVE_ARDUINO_CONSUMED_PIO_OPTIONS = NATIVE_ARDUINO_PIO_OPTIONS | {"lib_ignore"}
-
-
 @coroutine_with_priority(CoroPriority.FINAL)
 async def _add_platformio_options(pio_options: dict[str, str | list[str]]) -> None:
-    if CORE.using_native_toolchain:
-        # The native builds don't read platformio.ini; honor the options
-        # with a native equivalent and warn about the rest, which would
-        # otherwise be silently ignored.
+    if CORE.using_toolchain_esp_idf:
+        # The native ESP-IDF build doesn't read platformio.ini; honor the
+        # options with a native equivalent and warn about the rest, which
+        # would otherwise be silently ignored.
         for key, val in pio_options.items():
             vals = [val] if isinstance(val, str) else val
             if key == CONF_BUILD_FLAGS:
@@ -585,41 +573,23 @@ async def _add_platformio_options(pio_options: dict[str, str | list[str]]) -> No
                 )
                 for flag in vals:
                     cg.add_build_flag(flag)
-            elif key == "build_unflags":
-                # Native equivalent: add_build_unflag (honored token-level by
-                # the arduino generator; the IDF generator warns there)
-                for flag in vals:
-                    CORE.add_build_unflag(flag)
             elif key == "lib_deps":
-                # Routed through the regular library mechanism so the
-                # libraries reach the native backend's converter (IDF
-                # components, or the ESP8266 native library resolution)
+                # Routed through the regular library mechanism so the libraries
+                # are converted to IDF components like any other PIO library
                 for lib in vals:
                     _add_library_str(lib)
             elif key == "lib_ignore":
-                # Read by the shared library conversion (lib_ignore_set in
-                # platformio/library.py); filters top-level libraries and
-                # discovered dependencies
+                # Read by the PIO-library-to-IDF-component conversion
+                # (generate_idf_components); filters both top-level libraries
+                # and dependencies discovered during conversion
                 cg.add_platformio_option(key, vals)
-            elif (
-                key in NATIVE_ARDUINO_PIO_OPTIONS
-                and CORE.using_toolchain_arduino
-                and vals
-            ):
-                # The esp8266 native generator reads these as scalars; the
-                # schema also permits the list form, where the last value
-                # wins like a later platformio.ini line (an empty list falls
-                # through to the ignored-option warning). Other native
-                # toolchains have no equivalent and fall through too.
-                cg.add_platformio_option(key, vals[-1])
             elif key != "upload_speed":
                 # upload_speed needs no handling: it is read from the raw
                 # config at upload time (upload_using_esptool)
                 _LOGGER.warning(
                     "esphome->platformio_options->%s is ignored when building with "
-                    "the native '%s' toolchain",
+                    "the native ESP-IDF toolchain",
                     key,
-                    CORE.toolchain.value,
                 )
         return
     # Add includes at the very end, so that they override everything

esphome/core/defines.h

@@ -43,7 +43,9 @@
 #define USE_ALARM_CONTROL_PANEL
 #define USE_AREAS
 #define USE_BINARY_SENSOR
+#define USE_BINARY_SENSOR_CLICK_TRIGGER
 #define USE_BINARY_SENSOR_FILTER
+#define USE_BINARY_SENSOR_MULTI_CLICK_TRIGGER
 #define USE_BLE_DEVICE_IRK
 #define USE_BUTTON
 #define USE_CAMERA
@@ -220,6 +222,7 @@
 #define API_MAX_SEND_QUEUE 8
 #define MAX_API_CONNECTIONS 6
 #define USE_MD5
+#define USE_NOISE
 #define USE_SHA256
 #ifndef USE_RP2  // no MQTT backend or esp_wireguard library on RP2
 #define USE_MQTT
@@ -281,6 +284,7 @@
 // ESP32-specific feature flags
 #ifdef USE_ESP32
 #define USE_ESP32_CRASH_HANDLER
+#define USE_ESP32_INTERNAL_GPIO
 #define USE_MQTT_IDF_ENQUEUE
 #define USE_ESPHOME_TASK_LOG_BUFFER
 #define ESPHOME_TASK_LOG_BUFFER_SIZE 768

esphome/core/entity_base.cpp

@@ -80,24 +80,6 @@ const char *EntityBase::get_device_class_to([[maybe_unused]] std::span<char, MAX
 #endif
 }
 
-#ifndef USE_ESP8266
-// Deprecated device class accessors — not available on ESP8266 (rodata is RAM)
-StringRef EntityBase::get_device_class_ref() const {
-#ifdef USE_ENTITY_DEVICE_CLASS
-  return StringRef(entity_device_class_lookup(this->device_class_idx_));
-#else
-  return StringRef(entity_device_class_lookup(0));
-#endif
-}
-std::string EntityBase::get_device_class() const {
-#ifdef USE_ENTITY_DEVICE_CLASS
-  return std::string(entity_device_class_lookup(this->device_class_idx_));
-#else
-  return std::string(entity_device_class_lookup(0));
-#endif
-}
-#endif  // !USE_ESP8266
-
 // Entity unit of measurement (from index)
 StringRef EntityBase::get_unit_of_measurement_ref() const {
 #ifdef USE_ENTITY_UNIT_OF_MEASUREMENT
@@ -106,10 +88,6 @@ StringRef EntityBase::get_unit_of_measurement_ref() const {
   return StringRef(entity_uom_lookup(0));
 #endif
 }
-std::string EntityBase::get_unit_of_measurement() const {
-  return std::string(this->get_unit_of_measurement_ref().c_str());
-}
-
 // Entity icon — buffer-based API for PROGMEM safety on ESP8266
 const char *EntityBase::get_icon_to([[maybe_unused]] std::span<char, MAX_ICON_LENGTH> buffer) const {
 #ifdef USE_ENTITY_ICON
@@ -129,24 +107,6 @@ const char *EntityBase::get_icon_to([[maybe_unused]] std::span<char, MAX_ICON_LE
 #endif
 }
 
-#ifndef USE_ESP8266
-// Deprecated icon accessors — not available on ESP8266 (rodata is RAM)
-StringRef EntityBase::get_icon_ref() const {
-#ifdef USE_ENTITY_ICON
-  return StringRef(entity_icon_lookup(this->icon_idx_));
-#else
-  return StringRef(entity_icon_lookup(0));
-#endif
-}
-std::string EntityBase::get_icon() const {
-#ifdef USE_ENTITY_ICON
-  return std::string(entity_icon_lookup(this->icon_idx_));
-#else
-  return std::string(entity_icon_lookup(0));
-#endif
-}
-#endif  // !USE_ESP8266
-
 // Calculate Object ID Hash directly from name using snake_case + sanitize
 void EntityBase::calc_object_id_() {
   this->object_id_hash_ = fnv1_hash_object_id(this->name_.c_str(), this->name_.size());

esphome/core/entity_base.h

@@ -109,60 +109,14 @@ class EntityBase {
   // On ESP8266: copies from PROGMEM to buffer, returns buffer pointer.
   const char *get_device_class_to(std::span<char, MAX_DEVICE_CLASS_LENGTH> buffer) const;
 
-#ifdef USE_ESP8266
-  // On ESP8266, rodata is RAM. Device classes are in PROGMEM and cannot be accessed
-  // directly as const char*. Use get_device_class_to() with a stack buffer instead.
-  template<typename T = int> StringRef get_device_class_ref() const {
-    static_assert(sizeof(T) == 0, "get_device_class_ref() unavailable on ESP8266 (rodata is RAM). "
-                                  "Use get_device_class_to() with a stack buffer.");
-    return StringRef("");
-  }
-  template<typename T = int> std::string get_device_class() const {
-    static_assert(sizeof(T) == 0, "get_device_class() unavailable on ESP8266 (rodata is RAM). "
-                                  "Use get_device_class_to() with a stack buffer.");
-    return "";
-  }
-#else
-  // Deprecated: use get_device_class_to() instead. Device classes are in PROGMEM.
-  ESPDEPRECATED("Use get_device_class_to() instead. Will be removed in ESPHome 2026.9.0", "2026.3.0")
-  StringRef get_device_class_ref() const;
-  ESPDEPRECATED("Use get_device_class_to() instead. Will be removed in ESPHome 2026.9.0", "2026.3.0")
-  std::string get_device_class() const;
-#endif
   // Get unit of measurement as StringRef (from packed index)
   StringRef get_unit_of_measurement_ref() const;
-  /// Get the unit of measurement as std::string (deprecated, prefer get_unit_of_measurement_ref())
-  ESPDEPRECATED("Use get_unit_of_measurement_ref() instead for better performance (avoids string copy). Will be "
-                "removed in ESPHome 2026.9.0",
-                "2026.3.0")
-  std::string get_unit_of_measurement() const;
 
   // Get this entity's icon into a stack buffer.
   // On ESP32: returns pointer to PROGMEM string directly (buffer unused).
   // On ESP8266: copies from PROGMEM to buffer, returns buffer pointer.
   const char *get_icon_to(std::span<char, MAX_ICON_LENGTH> buffer) const;
 
-#ifdef USE_ESP8266
-  // On ESP8266, rodata is RAM. Icons are in PROGMEM and cannot be accessed
-  // directly as const char*. Use get_icon_to() with a stack buffer instead.
-  template<typename T = int> StringRef get_icon_ref() const {
-    static_assert(sizeof(T) == 0,
-                  "get_icon_ref() unavailable on ESP8266 (rodata is RAM). Use get_icon_to() with a stack buffer.");
-    return StringRef("");
-  }
-  template<typename T = int> std::string get_icon() const {
-    static_assert(sizeof(T) == 0,
-                  "get_icon() unavailable on ESP8266 (rodata is RAM). Use get_icon_to() with a stack buffer.");
-    return "";
-  }
-#else
-  // Deprecated: use get_icon_to() instead. Icons are in PROGMEM.
-  ESPDEPRECATED("Use get_icon_to() instead. Will be removed in ESPHome 2026.9.0", "2026.3.0")
-  StringRef get_icon_ref() const;
-  ESPDEPRECATED("Use get_icon_to() instead. Will be removed in ESPHome 2026.9.0", "2026.3.0")
-  std::string get_icon() const;
-#endif
-
 #ifdef USE_DEVICES
   // Get this entity's device id
   uint32_t get_device_id() const {

esphome/core/helpers.cpp

@@ -723,23 +723,6 @@ bool base64_decode_int32_vector(const std::string &base64, std::vector<int32_t>
 
 // Colors
 
-float gamma_correct(float value, float gamma) {
-  if (value <= 0.0f)
-    return 0.0f;
-  if (gamma <= 0.0f)
-    return value;
-
-  return powf(value, gamma);  // NOLINT - deprecated, removal 2026.9.0
-}
-float gamma_uncorrect(float value, float gamma) {
-  if (value <= 0.0f)
-    return 0.0f;
-  if (gamma <= 0.0f)
-    return value;
-
-  return powf(value, 1 / gamma);  // NOLINT - deprecated, removal 2026.9.0
-}
-
 void rgb_to_hsv(float red, float green, float blue, int &hue, float &saturation, float &value) {
   float max_color_value = std::max({red, green, blue});
   float min_color_value = std::min({red, green, blue});

esphome/core/helpers.h

@@ -1646,15 +1646,6 @@ bool base64_decode_int32_vector(const std::string &base64, std::vector<int32_t>
 /// @name Colors
 ///@{
 
-/// Applies gamma correction of \p gamma to \p value.
-// Remove before 2026.9.0
-ESPDEPRECATED("Use LightState::gamma_correct_lut() instead. Removed in 2026.9.0.", "2026.3.0")
-float gamma_correct(float value, float gamma);
-/// Reverts gamma correction of \p gamma to \p value.
-// Remove before 2026.9.0
-ESPDEPRECATED("Use LightState::gamma_uncorrect_lut() instead. Removed in 2026.9.0.", "2026.3.0")
-float gamma_uncorrect(float value, float gamma);
-
 /// Convert \p red, \p green and \p blue (all 0-1) values to \p hue (0-360), \p saturation (0-1) and \p value (0-1).
 void rgb_to_hsv(float red, float green, float blue, int &hue, float &saturation, float &value);
 /// Convert \p hue (0-360), \p saturation (0-1) and \p value (0-1) to \p red, \p green and \p blue (all 0-1).

esphome/core/log.cpp

@@ -60,16 +60,6 @@ void HOT esp_log_vprintf_(int level, const char *tag, int line, const char *form
 #endif
 }
 
-#ifdef USE_STORE_LOG_STR_IN_FLASH
-// Remove before 2026.9.0
-void HOT esp_log_vprintf_(int level, const char *tag, int line, const __FlashStringHelper *format, va_list args) {
-#ifdef USE_LOGGER
-  ESPHOME_DEBUG_ASSERT(logger::global_logger != nullptr);
-  logger::global_logger->log_vprintf_(static_cast<uint8_t>(level), tag, line, format, args);
-#endif
-}
-#endif
-
 #ifdef USE_ESP32
 int HOT esp_idf_log_vprintf_(const char *format, va_list args) {  // NOLINT
 #ifdef USE_LOGGER

esphome/core/log.h

@@ -68,11 +68,6 @@ void esp_log_printf_(int level, const char *tag, int line, const char *format, .
 void esp_log_printf_(int level, const char *tag, int line, const __FlashStringHelper *format, ...);
 #endif
 void esp_log_vprintf_(int level, const char *tag, int line, const char *format, va_list args);  // NOLINT
-#ifdef USE_STORE_LOG_STR_IN_FLASH
-// Remove before 2026.9.0
-__attribute__((deprecated("Use esp_log_printf_() instead. Removed in 2026.9.0."))) void esp_log_vprintf_(
-    int level, const char *tag, int line, const __FlashStringHelper *format, va_list args);
-#endif
 #if defined(USE_ESP32)
 int esp_idf_log_vprintf_(const char *format, va_list args);  // NOLINT
 #endif

esphome/espidf/clang_tidy.py

@@ -23,12 +23,6 @@ from dataclasses import dataclass
 import os
 from pathlib import Path
 
-from esphome.build_helpers.idedata import (
-    get_toolchain_includes,
-    parse_entry,
-    reject_launcher_compiler,
-)
-
 TIDY_PROJECT_NAME = "esphome_tidy"
 
 # A do-nothing C++ app: just enough for IDF to configure a valid project. It's
@@ -421,12 +415,13 @@ def _idedata_from_tidy_project(compile_commands: Path) -> dict:
     """
     import json
 
+    from esphome.espidf.idedata import _get_toolchain_includes, _parse_entry
+
     entries = json.loads(Path(compile_commands).read_text(encoding="utf-8"))
     entry = next((e for e in entries if e["file"].endswith("tidy.cpp")), None)
     if entry is None:
         raise RuntimeError(f"tidy.cpp not found in {compile_commands}")
-    cxx_path, defines, includes, cxx_flags = parse_entry(entry)
-    reject_launcher_compiler(cxx_path)
+    cxx_path, defines, includes, cxx_flags = _parse_entry(entry)
 
     return {
         "cxx_path": cxx_path,
@@ -434,7 +429,7 @@ def _idedata_from_tidy_project(compile_commands: Path) -> dict:
         "defines": defines,
         "includes": {
             "build": includes,
-            "toolchain": get_toolchain_includes(cxx_path),
+            "toolchain": _get_toolchain_includes(cxx_path),
         },
     }
 

esphome/espidf/component.py

@@ -27,7 +27,6 @@ from esphome.platformio.library import (
     collect_filtered_files,
     convert_libraries,
     ensure_list,
-    lex_build_flags,
     split_list_by_condition,
 )
 
@@ -41,6 +40,37 @@ def _idf_framework() -> str:
     return "arduino" if CORE.using_arduino else "espidf"
 
 
+def _apply_extra_script(component: IDFComponent) -> None:
+    """Run a PIO ``extraScript`` and fold its captured env vars into
+    ``component.data["build"]["flags"]`` so the existing -L/-l/-D
+    extraction in ``generate_cmakelists_txt`` picks them up."""
+    extra_script = component.data.get("build", {}).get("extraScript")
+    if not extra_script:
+        return
+    # Resolve and confine to the library's source dir so a malicious
+    # library.json can't escape (e.g. ``"extraScript": "../../etc/passwd"``).
+    source_path = component.source_dir
+    library_root = source_path.resolve()
+    script_path = (source_path / extra_script).resolve()
+    if not script_path.is_relative_to(library_root) or not script_path.is_file():
+        return
+    from esphome.components.esp32 import get_esp32_variant
+    from esphome.espidf.extra_script import captured_as_build_flags, run_extra_script
+
+    idf_target = variant_to_idf_target(get_esp32_variant())
+    result = run_extra_script(
+        script_path, library_dir=source_path, idf_target=idf_target
+    )
+    extra_flags = captured_as_build_flags(result, library_dir=source_path)
+    if not extra_flags:
+        return
+    flags = component.data.setdefault("build", {}).setdefault("flags", [])
+    if isinstance(flags, str):
+        flags = [flags]
+    flags.extend(extra_flags)
+    component.data["build"]["flags"] = flags
+
+
 def generate_cmakelists_txt(component: IDFComponent) -> str:
     """
     Generate a CMakeLists.txt file for an ESP-IDF component.
@@ -55,6 +85,10 @@ def generate_cmakelists_txt(component: IDFComponent) -> str:
     Returns:
         str: The complete CMakeLists.txt content as a string
     """
+    # Late import: this module loads with the esp32 platform on every
+    # validate/compile, but shlex is only needed when generating component
+    # CMakeLists.
+    import shlex
 
     def escape_entry(p: PathType) -> str:
         # In CMakeLists.txt, backslashes need to be escaped
@@ -88,12 +122,26 @@ def generate_cmakelists_txt(component: IDFComponent) -> str:
     build_src_filter = ensure_list(
         component.data.get("build", {}).get("srcFilter", DEFAULT_BUILD_SRC_FILTER)
     )
-    # PlatformIO shell-lexes each build.flags entry; bare -I/-L/-l/-D tokens
-    # re-glue to their argument so the prefix classifiers below route them.
-    build_flags = lex_build_flags(
-        component.data.get("build", {}).get("flags", DEFAULT_BUILD_FLAGS),
-        f"library {component.name}",
+    build_flags = ensure_list(
+        component.data.get("build", {}).get("flags", DEFAULT_BUILD_FLAGS)
     )
+    # PlatformIO shell-lexes each build.flags entry, so one entry can carry a
+    # flag and its argument (e.g. "-include cp_custom_alloc.h"). Split the
+    # same way; emitting such an entry as a single quoted compile option
+    # hands the compiler one argv with an embedded space.
+    build_flags = [token for entry in build_flags for token in shlex.split(entry)]
+    # Re-glue bare -I/-L/-l tokens to their argument ("-I foo" -> "-Ifoo") so
+    # the prefix classifiers below still route them to INCLUDE_DIRS and the
+    # link handling.
+    tokens, build_flags = build_flags, []
+    i = 0
+    while i < len(tokens):
+        if tokens[i] in ("-I", "-L", "-l") and i + 1 < len(tokens):
+            build_flags.append(tokens[i] + tokens[i + 1])
+            i += 2
+        else:
+            build_flags.append(tokens[i])
+            i += 1
 
     # List all sources files
     build_src_files = collect_filtered_files(
@@ -251,14 +299,7 @@ def generate_idf_component_yml(component: IDFComponent) -> str:
 
 def _emit_idf_component(component: IDFComponent) -> None:
     """Write the ESP-IDF build files for a resolved library into its cache dir."""
-    from esphome.components.esp32 import get_esp32_variant
-    from esphome.platformio.extra_script import apply_extra_script
-
-    apply_extra_script(
-        component,
-        board_mcu=lambda: variant_to_idf_target(get_esp32_variant()),
-        pio_platform="espressif32",
-    )
+    _apply_extra_script(component)
     write_file_if_changed(
         component.path / "CMakeLists.txt",
         generate_cmakelists_txt(component),

esphome/espidf/extra_script.py

@@ -0,0 +1,161 @@
+"""Run a PlatformIO ``extraScript`` against a captured SCons-env stand-in.
+
+PlatformIO libraries occasionally configure per-target link/build state
+via a Python ``extraScript`` declared in ``library.json``'s ``build``
+section instead of static fields. The script runs under SCons during
+PIO's build and mutates the active ``Environment`` (``env.Append``,
+``env.Replace``, …) — chiefly to set ``LIBPATH``/``LIBS`` per chip MCU.
+
+ESPHome's PIO→IDF converter doesn't run SCons, so these scripts were
+previously ignored and any library
+relying on them failed to link under ``toolchain: esp-idf``. This
+module provides a small shim that ``exec``s an extra-script with a
+fake ``env`` object, captures the common ``env.Append(...)`` calls,
+and returns the captured vars so the caller can fold them back into
+the library's generated CMakeLists.
+
+Caveats
+-------
+* Only the ``env.Append`` API is captured. ``env.Replace``,
+  ``env.Prepend``, ``env.AddPreAction``, SCons file generators, and any
+  arbitrary I/O are silently no-ops. Scripts that depend on those will
+  produce incomplete output.
+* Running arbitrary Python from third-party libraries is a non-trivial
+  trust decision. The shim does no sandboxing — anything in the
+  script's process can run. Use only with libraries whose source you
+  trust.
+"""
+
+from __future__ import annotations
+
+from dataclasses import dataclass, field
+import logging
+import os
+from pathlib import Path
+
+_LOGGER = logging.getLogger(__name__)
+
+# Keys we know how to translate back into ESPHome's build-flag pipeline.
+# Other env.Append kwargs are recorded but ignored downstream.
+_CAPTURED_KEYS = frozenset({"LIBPATH", "LIBS", "CPPDEFINES", "LINKFLAGS", "CPPFLAGS"})
+
+
+@dataclass
+class ExtraScriptResult:
+    """Build-var deltas captured from a PIO extra-script ``env.Append`` call."""
+
+    libpath: list[str] = field(default_factory=list)
+    libs: list[str] = field(default_factory=list)
+    cppdefines: list[str | tuple[str, str]] = field(default_factory=list)
+    linkflags: list[str] = field(default_factory=list)
+    cppflags: list[str] = field(default_factory=list)
+
+
+class _FakeSConsEnv:
+    """Minimal stand-in for SCons ``Environment`` exposed to extra-scripts.
+
+    Implements just enough surface area to let scripts query ``BOARD_MCU``
+    / ``PIOENV`` and call ``env.Append(LIBPATH=…, LIBS=…, …)``. Every
+    other env method swallows silently so unrelated calls don't raise
+    ``AttributeError`` and abort the script.
+    """
+
+    def __init__(self, *, board_mcu: str, pio_env: str) -> None:
+        self._vars: dict[str, str] = {
+            "BOARD_MCU": board_mcu,
+            "PIOPLATFORM": "espressif32",
+            "PIOENV": pio_env,
+        }
+        self.result = ExtraScriptResult()
+
+    # ----- SCons env API the common scripts use -----
+
+    def get(self, key: str, default: str | None = None) -> str | None:
+        return self._vars.get(key, default)
+
+    def Append(self, **kwargs) -> None:  # noqa: N802 (SCons API name)
+        for key, value in kwargs.items():
+            if key not in _CAPTURED_KEYS:
+                continue
+            items = list(value) if isinstance(value, (list, tuple)) else [value]
+            bucket = getattr(self.result, key.lower())
+            bucket.extend(items)
+
+    # ----- Everything else is a no-op so unsupported scripts don't crash -----
+
+    def __getattr__(self, name: str):
+        def _noop(*args, **kwargs):
+            return None
+
+        return _noop
+
+
+def run_extra_script(
+    script_path: Path, *, library_dir: Path, idf_target: str
+) -> ExtraScriptResult:
+    """Execute ``script_path`` with a fake SCons env and return captured vars.
+
+    ``idf_target`` is the active ESP-IDF target name (e.g. ``esp32``,
+    ``esp32s3``); it's exposed to the script as PlatformIO's
+    ``BOARD_MCU`` so chip-conditional logic resolves the same way it
+    would under PIO. The script runs with ``library_dir`` as the
+    process CWD so relative-path lookups (``join``, ``realpath``,
+    ``open``) resolve against the library tree.
+
+    On any exception inside the script we log at debug level and return
+    an empty result — extra-scripts are best-effort, and an unsupported
+    script shouldn't block the build.
+    """
+    env = _FakeSConsEnv(board_mcu=idf_target, pio_env=f"esphome_{idf_target}")
+    code = compile(script_path.read_text(encoding="utf-8"), str(script_path), "exec")
+    old_cwd = Path.cwd()
+    try:
+        os.chdir(library_dir)
+        exec(  # noqa: S102 pylint: disable=exec-used
+            code,
+            {
+                "Import": lambda *_args: None,  # SCons-side import; harmless here
+                "env": env,
+                "__file__": str(script_path),
+                "__name__": "__pio_extra_script__",
+            },
+        )
+    except Exception as e:  # noqa: BLE001  # pylint: disable=broad-exception-caught
+        _LOGGER.warning("PIO extra-script %s raised %s; skipping", script_path, e)
+        return ExtraScriptResult()
+    finally:
+        os.chdir(old_cwd)
+    return env.result
+
+
+def captured_as_build_flags(
+    result: ExtraScriptResult, *, library_dir: Path
+) -> list[str]:
+    """Translate captured env vars into the ``-L`` / ``-l`` / ``-D`` /
+    raw-flag form ``_generate_cmakelists_txt`` already knows how to consume.
+
+    ``LIBPATH`` entries are made relative to ``library_dir`` so the
+    generated CMakeLists is portable; absolute paths outside the library
+    tree are kept as-is (CMake handles absolute paths in
+    ``target_link_directories`` fine).
+    """
+    flags: list[str] = []
+    library_root = library_dir.resolve()
+    for path in result.libpath:
+        # Anchor relative paths to library_dir (not the current CWD, which
+        # has been restored by the time we get here). Joining an absolute
+        # path against library_dir returns the absolute path unchanged.
+        resolved = (library_dir / path).resolve()
+        try:
+            flags.append(f"-L{resolved.relative_to(library_root)}")
+        except ValueError:
+            flags.append(f"-L{resolved}")
+    flags.extend(f"-l{lib}" for lib in result.libs)
+    for define in result.cppdefines:
+        if isinstance(define, tuple) and len(define) == 2:
+            flags.append(f"-D{define[0]}={define[1]}")
+        else:
+            flags.append(f"-D{define}")
+    flags.extend(result.linkflags)
+    flags.extend(result.cppflags)
+    return flags

esphome/espidf/framework.py

@@ -11,15 +11,10 @@ import re
 import shutil
 from typing import Any, NoReturn
 
-from esphome.build_helpers.ccache import (
-    ccache_defaults_env,
-    parse_enable_env,
-    resolve_ccache_path,
-)
-from esphome.build_helpers.tools_cache import IDF_TOOLS_CACHE, tools_cache_path
-from esphome.core import Version
+import platformdirs
+
+from esphome.core import CORE, Version
 from esphome.framework_helpers import (
-    BatchDownloadProgress,
     PathType,
     archive_extract_all,
     create_venv,
@@ -28,12 +23,11 @@ from esphome.framework_helpers import (
     get_python_env_executable_path,
     get_system_python_path,
     rmdir,
-    run_batch_downloads,
     run_command,
     run_command_ok,
     str_to_lst_of_str,
 )
-from esphome.helpers import write_file_if_changed
+from esphome.helpers import get_bool_env, get_str_env, write_file_if_changed
 
 _LOGGER = logging.getLogger(__name__)
 
@@ -94,10 +88,22 @@ def get_idf_tools_path() -> Path:
     Returns:
         Path object pointing to the ESP-IDF tools directory
     """
-    # Machine-global so all projects share the multi-GB install instead of
-    # a per-config-directory copy; see build_helpers.tools_cache.tools_cache_path
-    # for the env-override and normalization rules.
-    return tools_cache_path(*IDF_TOOLS_CACHE)
+    # Treat an empty/whitespace ESPHOME_ESP_IDF_PREFIX as unset: Path("")
+    # resolves to the CWD, which would install into (and let clean-all delete)
+    # the working directory by accident.
+    if prefix := get_str_env("ESPHOME_ESP_IDF_PREFIX", "").strip():
+        path = Path(prefix).expanduser()
+    else:
+        # Machine-global so all projects share the multi-GB install instead of
+        # a per-config-directory copy. The user cache dir (not ~/.esphome)
+        # avoids colliding with data_dir when configs live in the home dir.
+        # appauthor=False drops the redundant <author>\ segment on Windows
+        # (which otherwise repeats "esphome\esphome\") to keep the path short.
+        path = Path(platformdirs.user_cache_dir("esphome", appauthor=False)) / "idf"
+    # Resolve so an unnormalized config path (e.g. compiling ``../config/x.yaml``)
+    # doesn't leave ``..`` segments in the IDF_TOOLS_PATH handed to idf.py, which
+    # otherwise warns that the venv interpreter path doesn't match the install.
+    return path.resolve()
 
 
 # Windows' default MAX_PATH is 260 characters. ESP-IDF toolchains nest deeply
@@ -696,10 +702,10 @@ def _prefetch_idf_tool_archives(
     which makes large archives effectively impossible to fetch on unstable
     connections (#17703). This asks the framework's idf_tools (via
     ``get_tool_downloads.py``) which archives the coming install needs, then
-    downloads them into ``<IDF_TOOLS_PATH>/dist`` with
-    ``download_with_resume``, a few at a time under one combined progress
-    bar. The installer then finds the verified archives already in place
-    ("file ... is already downloaded") and never touches the network.
+    downloads each into ``<IDF_TOOLS_PATH>/dist`` with
+    ``download_with_resume``. The installer then finds the verified archives
+    already in place ("file ... is already downloaded") and never touches the
+    network.
 
     Strictly best-effort: any failure here just logs and returns, leaving
     ``idf_tools.py install`` to download whatever is missing exactly as
@@ -721,58 +727,26 @@ def _prefetch_idf_tool_archives(
             )
             return
         dist_path = get_idf_tools_path() / "dist"
-        entries = []
-        seen_dests: set[str] = set()
-        for entry in json.loads(stdout):
-            if (dist_path / entry["dest"]).is_file():
-                continue
-            if entry["dest"] in seen_dests:
-                # Two workers on one .part file would interleave
-                # seek/truncate writes; mirror the library prefetch's dedupe
-                continue
-            seen_dests.add(entry["dest"])
-            # tools.json always carries sha256 and size; an entry missing
-            # either must not be downloaded unverified here, so leave it to
-            # the installer (which fails loudly on a bad archive).
-            if entry.get("sha256") and entry.get("size"):
-                entries.append(entry)
-            else:
-                _LOGGER.warning(
-                    "Tool %s has no sha256/size in the download list; "
-                    "leaving it to the installer",
-                    entry["name"],
-                )
-        if not entries:
-            return
-        _LOGGER.info(
-            "Downloading %d ESP-IDF tool archive(s): %s",
-            len(entries),
-            ", ".join(entry["name"] for entry in entries),
-        )
-
-        # Every entry carries a size (checked above), so the combined bar can
-        # be trusted. Unlike the library prefetch there is no sequential
-        # fallback: per-file bars from several threads would interleave, and
-        # skipping the prefetch would lose the resume workaround for #17703.
-        def _download(entry: dict):
-            return lambda tracker: download_with_resume(
-                entry["url"],
-                dist_path / entry["dest"],
-                sha256=entry["sha256"],
-                size=entry["size"],
-                progress=tracker,
+        entries = [
+            entry
+            for entry in json.loads(stdout)
+            if not (dist_path / entry["dest"]).is_file()
+        ]
+        for index, entry in enumerate(entries, start=1):
+            _LOGGER.info(
+                "Downloading %s (%d/%d) ...", entry["name"], index, len(entries)
             )
-
-        # A failed archive is retried by the installer itself (without
-        # resume); keep prefetching the rest.
-        failures = run_batch_downloads(
-            BatchDownloadProgress(
-                "Downloading ESP-IDF tools", sum(entry["size"] for entry in entries)
-            ),
-            [(entry["name"], _download(entry)) for entry in entries],
-        )
-        for name, e in failures:
-            _LOGGER.warning("Could not prefetch %s: %s", name, e)
+            try:
+                download_with_resume(
+                    entry["url"],
+                    dist_path / entry["dest"],
+                    sha256=entry["sha256"],
+                    size=entry["size"],
+                )
+            except Exception as e:  # noqa: BLE001  # pylint: disable=broad-exception-caught
+                # Keep prefetching the remaining archives; the installer
+                # will retry this one itself (without resume).
+                _LOGGER.warning("Could not prefetch %s: %s", entry["name"], e)
     except Exception as e:  # noqa: BLE001  # pylint: disable=broad-exception-caught
         # The installer downloads anything missing itself; never let the
         # prefetch become a new way for the install to fail.
@@ -1171,10 +1145,8 @@ def check_esp_idf_install(
 def _ccache_env() -> dict[str, str]:
     """Return ccache settings for ESP-IDF compiles.
 
-    Enabled by default whenever a runnable ``ccache`` binary is on PATH.
-    ``IDF_CCACHE_ENABLE=0`` opts out and ``=1`` forces it on; when that knob
-    is unset the shared ``ESPHOME_CCACHE_ENABLE`` applies (same 0/1 forms,
-    unrecognized values warn and count as unset). The cache lives under
+    Enabled by default whenever the ``ccache`` binary is on PATH; set
+    ``IDF_CCACHE_ENABLE=0`` in the environment to opt out. The cache lives under
     the IDF tools path (the machine-global cache dir, or
     ``ESPHOME_ESP_IDF_PREFIX``), so it is shared across all projects and removed
     by ``esphome clean-all`` along with the framework.
@@ -1189,23 +1161,33 @@ def _ccache_env() -> dict[str, str]:
     Only values the user has not already set in the environment are returned, so
     a custom ``CCACHE_DIR`` / ``CCACHE_MAXSIZE`` / etc. is respected.
     """
-    # IDF_CCACHE_ENABLE (the backend-native knob) wins over the shared
-    # ESPHOME_CCACHE_ENABLE.
-    idf_knob = parse_enable_env("IDF_CCACHE_ENABLE")
-    if idf_knob is False:
-        # The raw value (e.g. "disable") is still inherited by idf.py via
-        # os.environ, where a non-false-constant string reads as truthy;
-        # export the canonical off spelling instead
-        return {"IDF_CCACHE_ENABLE": "0"}
-    if idf_knob is None and resolve_ccache_path() is None:
+    # Honor an explicit choice already in the environment (opt-out or opt-in).
+    if "IDF_CCACHE_ENABLE" in os.environ:
+        if not get_bool_env("IDF_CCACHE_ENABLE"):
+            return {}
+    elif shutil.which("ccache") is None:
         # ESP-IDF silently skips ccache without the binary; don't enable it.
         return {}
 
-    env = ccache_defaults_env(get_idf_tools_path() / "ccache")
-    if idf_knob is None:
-        # An unparsable IDF_CCACHE_ENABLE must not leak to idf.py as truthy
-        env["IDF_CCACHE_ENABLE"] = "1"
-    return env
+    # ccache is enabled past here. build_path is set during preload for every
+    # config-loading command, so it being unset means a caller built the IDF env
+    # too early -- fail loudly rather than silently drop CCACHE_BASEDIR (which
+    # would quietly cost cross-device cache hits).
+    if CORE.build_path is None:
+        raise ValueError(
+            "CORE.build_path must be set before constructing the ESP-IDF build "
+            "environment"
+        )
+
+    defaults = {
+        "IDF_CCACHE_ENABLE": "1",
+        "CCACHE_DIR": str(get_idf_tools_path() / "ccache"),
+        "CCACHE_NOHASHDIR": "true",
+        "CCACHE_DEPEND": "1",
+        "CCACHE_BASEDIR": str(Path(CORE.build_path).resolve()),
+    }
+    # Don't override CCACHE_* values the user already set in their environment.
+    return {k: v for k, v in defaults.items() if k not in os.environ}
 
 
 def get_framework_env(

esphome/espidf/idedata.py

@@ -1,10 +1,10 @@
-"""Derive idedata from a native (non-PlatformIO) build's ``compile_commands.json``.
+"""Derive idedata from an ESP-IDF native-toolchain ``compile_commands.json``.
 
-PlatformIO exposes a curated ``pio run -t idedata`` JSON; the native
-toolchains have no such command, but each build produces a
-``compile_commands.json`` (CMAKE_EXPORT_COMPILE_COMMANDS for ESP-IDF, ninja's
-compdb tool otherwise). This module turns that file into the same fields
-consumers (IDE integration, clang-tidy) expect:
+PlatformIO exposes a curated ``pio run -t idedata`` JSON; the native ESP-IDF
+toolchain has no such command, but its CMake build emits
+``build/compile_commands.json`` (CMAKE_EXPORT_COMPILE_COMMANDS). This module
+turns that file into the same fields consumers (IDE integration, clang-tidy)
+expect:
 
     {cc_path, cxx_path, cxx_flags, defines, includes: {build, toolchain}}
 """
@@ -18,20 +18,6 @@ from pathlib import Path
 import shlex
 import subprocess
 
-from esphome.core import EsphomeError
-from esphome.helpers import write_file
-
-# Everything idedata generation may raise after a successful link. Broad on
-# purpose, and shared by every consumer: idedata is a bonus artifact, so
-# these must be caught and warned about, never allowed to fail the build.
-IDEDATA_BEST_EFFORT_ERRORS = (
-    EsphomeError,
-    LookupError,
-    OSError,
-    RuntimeError,
-    ValueError,
-)
-
 _LOGGER = logging.getLogger(__name__)
 
 # C++ translation-unit suffixes used to identify ESPHome source files.
@@ -134,18 +120,7 @@ def _pick_entry(entries: list[dict]) -> dict:
     raise ValueError("no C++ translation unit found in compile_commands.json")
 
 
-# Compiler launchers that may prefix a compile command; a closed launcher
-# denylist beats enumerating compiler names, an open set.
-_LAUNCHER_STEMS = frozenset({"ccache", "sccache", "distcc", "icecc", "buildcache"})
-
-
-def _is_launcher(token: str) -> bool:
-    return Path(token).stem.lower() in _LAUNCHER_STEMS
-
-
-def parse_entry(
-    entry: dict, launcher: str | None = None
-) -> tuple[str, list[str], list[str], list[str]]:
+def _parse_entry(entry: dict) -> tuple[str, list[str], list[str], list[str]]:
     """Parse one compile_commands entry -> (cxx_path, defines, includes, cxx_flags)."""
     directory = Path(entry["directory"])
     tokens = _expand_response_files(_split_command(entry["command"]), directory)
@@ -161,20 +136,6 @@ def parse_entry(
             raw = os.path.normpath(directory / raw)
         return raw.replace("\\", "/")
 
-    # A launcher-wrapped command ("ccache g++ ...") names the compiler second
-    if launcher is not None and tokens[:1] == [launcher]:
-        tokens = tokens[1:]
-    if not tokens:
-        # _split_command("") is [] by design, and a command that is only
-        # the launcher strips to nothing; fail like _pick_entry does
-        # instead of an IndexError traceback
-        raise ValueError(f"empty compile command for {entry.get('file')}")
-    if _is_launcher(tokens[0]) and len(tokens) > 1 and not tokens[1].startswith("-"):
-        # A stale compile DB built with a launcher the current run no longer
-        # configures: the real compiler is the next token. Warn: the DB is
-        # stale and worth regenerating.
-        _LOGGER.warning("Stripping unconfigured launcher %s", tokens[0])
-        tokens = tokens[1:]
     # token0 is the compiler path; the rest of the command already uses forward
     # slashes on Windows, so normalize it too for a consistent idedata file.
     cxx_path = tokens[0].replace("\\", "/")
@@ -207,7 +168,7 @@ def parse_entry(
     return cxx_path, defines, includes, cxx_flags
 
 
-def get_toolchain_includes(cxx_path: str) -> list[str]:
+def _get_toolchain_includes(cxx_path: str) -> list[str]:
     """Query the compiler for its builtin ``#include <...>`` search dirs."""
     result = subprocess.run(
         [cxx_path, "-E", "-x", "c++", "-", "-v"],
@@ -258,114 +219,26 @@ def _cc_path_from_cxx(cxx_path: str) -> str:
     return f"{stem}{suffix}"
 
 
-def load_or_build_idedata(
-    compile_commands: Path,
-    elf_path: Path,
-    cache: Path,
-    launcher: str | None = None,
-) -> dict | None:
-    """Return idedata for a compile_commands.json build, cached on mtime.
-
-    Shared by the native ESP-IDF and ESP8266 Arduino toolchains. Returns None
-    when the compile DB doesn't exist yet (nothing was built). ``launcher``
-    is the compiler-launcher path (ccache) the build was generated with, if
-    any; commands in the compile DB are prefixed with it.
-    """
-    if not compile_commands.is_file():
-        _LOGGER.debug("No %s yet; skipping idedata generation", compile_commands)
-        return None
-
-    if cache.is_file() and cache.stat().st_mtime >= compile_commands.stat().st_mtime:
-        try:
-            cached = json.loads(cache.read_text(encoding="utf-8"))
-        except (ValueError, OSError) as err:
-            # A recurring cause (interrupted write, disk full) would otherwise
-            # look like unexplained slow builds
-            _LOGGER.warning("Discarding unreadable idedata cache %s: %s", cache, err)
-        else:
-            # Rebuild pre-cc_path caches on the field, not the timestamp;
-            # the type check keeps "in" from substring-matching a string
-            if isinstance(cached, dict) and "cc_path" in cached:
-                return cached
-
-    data = idedata_from_build(compile_commands, launcher)
-    data["prog_path"] = str(elf_path)
-    cache.parent.mkdir(parents=True, exist_ok=True)
-    # Atomic so a crash mid-write cannot leave a truncated cache
-    write_file(cache, json.dumps(data, indent=2) + "\n")
-    return data
-
-
-def reject_launcher_compiler(cxx_path: str) -> None:
-    """Reject a compile DB that names a launcher (ccache) as the compiler.
-
-    Reject before the toolchain probe, which would fail opaquely on a
-    launcher; the unusable compile DB must never be cached or consumed.
-    """
-    if _is_launcher(cxx_path):
-        raise EsphomeError(
-            f"compile_commands.json names the launcher {cxx_path} as the "
-            "compiler; the compile database is unusable"
-        )
-
-
-def idedata_from_build(compile_commands: Path, launcher: str | None = None) -> dict:
+def idedata_from_build(compile_commands: Path) -> dict:
     """Parse compile_commands.json into the idedata fields consumers expect.
 
-    A single compile entry only carries the include set its own translation
-    unit was built with (per-component under ESP-IDF), but consumers
-    (clang-tidy) analyze ESPHome headers that transitively pull in other
-    components. So take cxx_path / cxx_flags / defines from a representative
-    ESPHome TU, but union the include dirs across all ESPHome TUs to get a
-    project-wide superset (as PlatformIO's idedata provides).
+    A single ESP-IDF compile entry only carries its own component's REQUIRES
+    include set, but consumers (clang-tidy) analyze ESPHome headers that
+    transitively pull in other components. So take cxx_path / cxx_flags /
+    defines from a representative ESPHome TU, but union the include dirs across
+    all ESPHome TUs to get a project-wide superset (as PlatformIO's idedata
+    provides).
     """
     entries = json.loads(Path(compile_commands).read_text(encoding="utf-8"))
+    cxx_path, defines, _, cxx_flags = _parse_entry(_pick_entry(entries))
 
-    representative = _pick_entry(entries)
-    cxx_path, defines, rep_includes, cxx_flags = parse_entry(representative, launcher)
-    reject_launcher_compiler(cxx_path)
-
-    # Seed with the representative's includes so it is not parsed twice
-    has_esphome_tu = _is_esphome_src(representative["file"])
-    build_includes: dict[str, None] = dict.fromkeys(
-        rep_includes if has_esphome_tu else ()
-    )
-
-    def _shape(entry: dict) -> str:
-        # The command minus its TU-specific paths: entries sharing a shape
-        # carry identical include sets (one ninja rule), so tokenize once
-        # per shape instead of once per TU. Response-file commands never
-        # dedupe: per-object .rsp names strip to one shape while the files
-        # may hold different include sets.
-        command = entry["command"]
-        if "@" in command:
-            return f"unique:{entry['file']}"
-        return command.replace(entry.get("file", ""), "").replace(
-            entry.get("output", ""), ""
-        )
-
-    seen_shapes = {_shape(representative)}
+    build_includes: dict[str, None] = {}
     for entry in entries:
-        if entry is representative or not _is_esphome_src(entry["file"]):
+        if not _is_esphome_src(entry["file"]):
             continue
-        has_esphome_tu = True
-        if (shape := _shape(entry)) in seen_shapes:
-            _LOGGER.debug("Include union: %s shares a command shape", entry["file"])
-            continue
-        seen_shapes.add(shape)
-        for inc in parse_entry(entry, launcher)[2]:
+        for inc in _parse_entry(entry)[2]:
             build_includes.setdefault(inc, None)
 
-    if not has_esphome_tu:
-        # _pick_entry fell back to an arbitrary C++ entry: idedata built
-        # from it breaks clang-tidy/IDE consumers, and a one-time warning
-        # would be cached into permanence. The best-effort call sites
-        # downgrade this to a build warning.
-        raise EsphomeError(
-            f"No ESPHome translation unit found in {compile_commands}; "
-            "refusing to cache unusable idedata"
-        )
-
     return {
         "cc_path": _cc_path_from_cxx(cxx_path),
         "cxx_path": cxx_path,
@@ -373,6 +246,6 @@ def idedata_from_build(compile_commands: Path, launcher: str | None = None) -> d
         "defines": defines,
         "includes": {
             "build": list(build_includes),
-            "toolchain": get_toolchain_includes(cxx_path),
+            "toolchain": _get_toolchain_includes(cxx_path),
         },
     }

esphome/espidf/size_summary.py

@@ -28,8 +28,6 @@ import json
 import logging
 from pathlib import Path
 
-from esphome.build_helpers.size_summary import print_size_line
-
 _LOGGER = logging.getLogger(__name__)
 _SIZE_SUFFIXES = {"K": 1024, "M": 1024 * 1024}
 
@@ -69,26 +67,31 @@ def _find_app_partition_size(partitions_csv: Path) -> int:
     raise ValueError(f"No app+factory or app+ota_0 partition in {partitions_csv}")
 
 
+def _format_bar(used: int, total: int) -> str:
+    """Match PlatformIO's ``_format_availale_bytes`` (pioupload.py) exactly."""
+    pct_raw = used / total if total else 0
+    blocks = 10
+    filled = min(int(round(blocks * pct_raw)), blocks)
+    progress = "=" * filled
+    return (
+        f"[{progress:<{blocks}}] {pct_raw: 6.1%} "
+        f"(used {used:d} bytes from {total:d} bytes)"
+    )
+
+
 def print_summary(size_json: Path, partitions_csv: Path | None) -> None:
     """Print PlatformIO-shaped RAM and Flash one-liners.
 
     Failures are non-fatal: the build has already succeeded, we just couldn't
-    summarize. Logs the cause at warning level, so a missing RAM/Flash line
-    (which CI's memory-impact extraction greps for) is diagnosable.
+    summarize. Logs the cause at debug level.
     """
     if not size_json.is_file():
-        _LOGGER.warning("Skipping size summary: %s not found", size_json)
+        _LOGGER.debug("Skipping size summary: %s not found", size_json)
         return
     try:
         data = json.loads(size_json.read_text(encoding="utf-8"))
     except (OSError, json.JSONDecodeError) as e:
-        _LOGGER.warning("Skipping size summary: %s", e)
-        return
-
-    if not isinstance(data, dict):
-        # Valid JSON that is not an object (truncated tool output) must
-        # not raise past a build that already linked
-        _LOGGER.warning("Skipping size summary: unexpected shape in %s", size_json)
+        _LOGGER.debug("Skipping size summary: %s", e)
         return
 
     memory_types = data.get("memory_types", {})
@@ -96,32 +99,14 @@ def print_summary(size_json: Path, partitions_csv: Path | None) -> None:
     ram_used = ram_region.get("used")
     ram_total = ram_region.get("size")
     if ram_total and ram_used is not None:
-        print_size_line("RAM", ram_used, ram_total)
-    else:
-        _LOGGER.warning(
-            "Skipping RAM summary: no usable DRAM/DIRAM region in %s", size_json
-        )
+        print(f"RAM:   {_format_bar(ram_used, ram_total)}")
 
     image_size = data.get("image_size")
-    if image_size is None:
-        _LOGGER.warning("Skipping Flash summary: no image_size in %s", size_json)
-        return
-    if partitions_csv is None:
-        _LOGGER.warning("Skipping Flash summary: no partition table given")
+    if image_size is None or partitions_csv is None:
         return
     try:
         app_size = _find_app_partition_size(partitions_csv)
-    except (ValueError, OSError) as e:
-        _LOGGER.warning("Skipping Flash summary: %s", e)
+    except ValueError as e:
+        _LOGGER.debug("Skipping Flash summary: %s", e)
         return
-    if app_size <= 0:
-        # A "from 0 bytes" denominator is meaningless to a reader. The skip
-        # costs CI's memory-impact extraction its Flash match, which is the
-        # loud outcome a broken partition table deserves.
-        _LOGGER.warning(
-            "Skipping Flash summary: app partition size is %s in %s",
-            app_size,
-            partitions_csv,
-        )
-        return
-    print_size_line("Flash", image_size, app_size)
+    print(f"Flash: {_format_bar(image_size, app_size)}")

esphome/espidf/toolchain.py

@@ -526,15 +526,32 @@ def get_idedata() -> dict | None:
     idedata fields IDE integrations and clang-tidy expect, cached alongside the
     PlatformIO idedata path. Returns None if the compile DB doesn't exist yet.
     """
-    from esphome.build_helpers.idedata import load_or_build_idedata
+    from esphome.espidf.idedata import idedata_from_build
 
-    # No launcher: CMake excludes CMAKE_<LANG>_COMPILER_LAUNCHER (ccache)
-    # from the exported compile database, unlike ninja's compdb dump.
-    return load_or_build_idedata(
-        CORE.relative_build_path("build", "compile_commands.json"),
-        get_elf_path(),
-        CORE.relative_internal_path("idedata", f"{CORE.name}.json"),
-    )
+    compile_commands = CORE.relative_build_path("build", "compile_commands.json")
+    if not compile_commands.is_file():
+        _LOGGER.debug("No %s yet; skipping idedata generation", compile_commands)
+        return None
+
+    cache = CORE.relative_internal_path("idedata", f"{CORE.name}.json")
+    if cache.is_file() and cache.stat().st_mtime >= compile_commands.stat().st_mtime:
+        try:
+            cached = json.loads(cache.read_text(encoding="utf-8"))
+        except ValueError:
+            pass
+        else:
+            # Caches written before cc_path was emitted stay newer than
+            # compile_commands.json forever, so rebuild them on the field rather
+            # than on the timestamp. Check the type too: a corrupted cache can
+            # still be valid JSON, and "in" would match a substring of a string.
+            if isinstance(cached, dict) and "cc_path" in cached:
+                return cached
+
+    data = idedata_from_build(compile_commands)
+    data["prog_path"] = str(get_elf_path())
+    cache.parent.mkdir(parents=True, exist_ok=True)
+    cache.write_text(json.dumps(data, indent=2) + "\n", encoding="utf-8")
+    return data
 
 
 def create_factory_bin() -> bool:

esphome/framework_helpers.py

@@ -1,7 +1,6 @@
 """Generic toolchain installation helpers shared across framework implementations."""
 
-from collections.abc import Callable, Iterable
-from concurrent.futures import ThreadPoolExecutor
+from collections.abc import Iterable
 from contextlib import ExitStack
 import hashlib
 import io
@@ -11,7 +10,6 @@ import os
 from pathlib import Path
 import subprocess
 import sys
-import threading
 import time
 from typing import IO, TYPE_CHECKING
 
@@ -25,7 +23,6 @@ PathType = str | os.PathLike
 
 _LOGGER = logging.getLogger(__name__)
 
-
 # Attempts per mirror URL before falling through to the next mirror; only
 # mid-stream drops retry (resuming when the server gave a validator),
 # connect errors move on to the next mirror immediately.
@@ -199,30 +196,6 @@ def run_command(
         return False, None, None
 
 
-def tool_version_runs(binary: str, warning: str) -> bool:
-    """Probe ``binary --version``; on failure warn with ``warning`` % binary.
-
-    ``shutil.which`` proves existence, not runnability (Windows .bat/.cmd
-    shims, stale package-manager shims).
-    """
-    try:
-        subprocess.run(
-            [binary, "--version"],
-            check=True,
-            stdout=subprocess.DEVNULL,
-            stderr=subprocess.DEVNULL,
-            timeout=15,
-            # Repo-wide convention (posix_spawn fast path)
-            close_fds=False,
-        )
-    except (OSError, subprocess.SubprocessError) as err:
-        # The cause (permission denied, missing DLL, timeout) is the one
-        # detail the user needs to fix it
-        _LOGGER.warning("%s (%s)", warning % binary, err)
-        return False
-    return True
-
-
 def run_command_ok(*args, **kwargs) -> bool:
     """
     Execute a command and return only the success status.
@@ -724,11 +697,7 @@ def _response_validator(resp: "requests.Response") -> str | None:
 
 
 def _stream_response_to_file(
-    resp: "requests.Response",
-    f: IO[bytes],
-    offset: int,
-    size: int | None = None,
-    progress: Callable[[int], None] | None = None,
+    resp: "requests.Response", f: IO[bytes], offset: int, size: int | None = None
 ) -> None:
     """Stream an open ``_open_ranged`` response body into ``f`` at ``offset``.
 
@@ -736,112 +705,21 @@ def _stream_response_to_file(
     (effective offset 0) discards the stale bytes. ``offset`` also seeds the
     progress bar so a resumed download shows overall progress. ``size`` is
     the known full file size; when None it is derived from the response's
-    content-length, and without either there is no progress bar. With
-    ``progress`` set, no bar is drawn here; the callback gets the absolute
-    byte count, seeded with ``offset`` and then after each chunk.
+    content-length, and without either there is no progress bar.
     """
     f.seek(offset)
     f.truncate(offset)
     total_size = size or offset + _content_length(resp)
     downloaded = offset
-    own_bar: ProgressBar | None = None
-    if progress is None:
-        own_bar = ProgressBar("Downloading") if total_size > 0 else None
-        progress = (
-            (lambda done: own_bar.update(done / total_size))
-            if own_bar
-            else (lambda _: None)
-        )
-    progress(downloaded)
+    progress = ProgressBar("Downloading") if total_size > 0 else None
     for chunk in resp.iter_content(chunk_size=256 * 1024):
         if chunk:
             f.write(chunk)
             downloaded += len(chunk)
-        progress(downloaded)
-    if own_bar is not None:
-        own_bar.update(1)
-
-
-# Concurrent downloads per batch; enough to hide latency without
-# hammering the host or the mirrors.
-BATCH_DOWNLOAD_WORKERS = 4
-
-
-def run_batch_downloads(
-    progress: "BatchDownloadProgress",
-    jobs: list[tuple[str, Callable[[Callable[[int], None]], None]]],
-    max_workers: int = BATCH_DOWNLOAD_WORKERS,
-) -> list[tuple[str, Exception]]:
-    """Run download jobs concurrently, reporting into one combined bar.
-
-    ``jobs`` holds ``(name, fetch)`` pairs where ``fetch(tracker)`` performs
-    one download reporting absolute byte counts to ``tracker``. Failures are
-    collected (list.append is atomic under the GIL) and returned after the
-    bar is done, so the caller's warnings never land on the bar's row; a
-    failed job credits its tracker 0 so the bar can still complete. Ctrl-C
-    drops queued jobs instead of downloading them all before the process
-    can exit; in-flight ones still finish. ``jobs`` must be non-empty.
-    """
-    failures: list[tuple[str, Exception]] = []
-
-    def _run(name: str, fetch: Callable[[Callable[[int], None]], None]) -> None:
-        tracker = progress.tracker()
-        try:
-            fetch(tracker)
-        except Exception as err:  # noqa: BLE001  # pylint: disable=broad-exception-caught
-            failures.append((name, err))
-            tracker(0)
-
-    ex = ThreadPoolExecutor(max_workers=min(max_workers, len(jobs)))
-    try:
-        for future in [ex.submit(_run, name, fetch) for name, fetch in jobs]:
-            future.result()
-    finally:
-        ex.shutdown(wait=True, cancel_futures=True)
-        progress.done()
-    return failures
-
-
-class BatchDownloadProgress:
-    """One progress bar across several concurrent ``download_with_resume`` calls.
-
-    Each ``tracker()`` is a ``progress`` callback for one download; it reports
-    that file's absolute byte count and the bar shows the sum over ``total``.
-    The lock also serialises the bar's stderr writes, so worker threads never
-    interleave frames. With an unknown ``total`` (0) nothing is drawn. Call
-    ``done()`` once every download has finished (or failed) so a bar that
-    never reached 100% still ends its line before the next log message.
-    """
-
-    def __init__(self, header: str, total: int) -> None:
-        self._bar = ProgressBar(header) if total > 0 else None
-        self._total = total
-        self._sum = 0
-        self._lock = threading.Lock()
-
-    def tracker(self) -> Callable[[int], None]:
-        last = 0
-
-        def update(done: int) -> None:
-            nonlocal last
-            if self._bar is None:
-                return
-            with self._lock:
-                self._sum += done - last
-                last = done
-                self._bar.update(min(self._sum / self._total, 1))
-
-        return update
-
-    def done(self) -> None:
-        # Nothing to end unless a frame was drawn and it was not the final
-        # one (update(1) already emitted its own newline).
-        if (
-            self._bar is not None
-            and self._bar.last_progress is not None
-            and self._bar.last_progress != 100
-        ):
-            self._bar.done()
+        if progress is not None:
+            progress.update(downloaded / total_size)
+    if progress is not None:
+        progress.update(1)
 
 
 def download_with_resume(
@@ -854,7 +732,6 @@ def download_with_resume(
     attempts: int = 5,
     timeout: int = 30,
     retry_connect_errors: bool = True,
-    progress: Callable[[int], None] | None = None,
 ) -> None:
     """Download ``url`` to ``dest``, resuming partial downloads.
 
@@ -877,12 +754,6 @@ def download_with_resume(
     of consuming attempts — for callers with their own fallback, like
     ``download_from_mirrors``.
 
-    ``progress``, when given, replaces the built-in progress bar: it is called
-    with the absolute number of bytes of ``dest`` obtained so far (including
-    a resumed prefix, and the final size once the file is verified), so a
-    caller running several downloads at once can draw one combined bar (see
-    ``BatchDownloadProgress``).
-
     Raises EsphomeError when all attempts are exhausted.
     """
     # Imported lazily: requests is a heavy import (~85ms) and is only needed
@@ -906,8 +777,6 @@ def download_with_resume(
     if dest.is_file() and (sha256 is not None or size is not None):
         try:
             _verify_file(dest, sha256, size)
-            if progress is not None:
-                progress(size if size is not None else dest.stat().st_size)
             return
         except EsphomeError:
             dest.unlink()
@@ -953,7 +822,7 @@ def download_with_resume(
                             # Recorded so a later run can prove an If-Range
                             # resume of this part file safe.
                             _write_download_meta(meta, url, validator, expected_total)
-                        _stream_response_to_file(resp, f, offset, size, progress)
+                        _stream_response_to_file(resp, f, offset, size)
             # else: a previous run already wrote every byte (or more) but
             # was killed before the rename below. Skip the network entirely
             # — a Range request past EOF would draw HTTP 416 — and let
@@ -962,10 +831,6 @@ def download_with_resume(
 
             expected_size = size if size is not None else expected_total
             _verify_file(part, sha256, expected_size or None)
-            if progress is not None:
-                # Also credits a part file an earlier run completed without
-                # streaming anything this time.
-                progress(expected_size or part.stat().st_size)
             if not expected_size and sha256 is None:
                 # No sha, no size, and the server sent no usable
                 # content-length: nothing can prove the download complete
@@ -1068,7 +933,6 @@ def _try_mirrors_once(
     f: IO[bytes] | None,
     timeout: int,
     failures: list[tuple[str, Exception]],
-    progress: Callable[[int], None] | None = None,
 ) -> str | None:
     """Single pass over the resolved mirror ``urls``, one try per URL.
 
@@ -1097,7 +961,6 @@ def _try_mirrors_once(
                     # next mirror immediately; only mid-stream drops
                     # retry-with-resume on the same URL.
                     retry_connect_errors=False,
-                    progress=progress,
                 )
                 return url
             except (requests.RequestException, OSError, EsphomeError) as e:
@@ -1139,7 +1002,7 @@ def _try_mirrors_once(
                         if offset == 0:
                             validator = _response_validator(resp)
                             expected_total = _content_length(resp)
-                        _stream_response_to_file(resp, f, offset, progress=progress)
+                        _stream_response_to_file(resp, f, offset)
 
                 if expected_total and f.tell() != expected_total:
                     raise EsphomeError(
@@ -1188,7 +1051,6 @@ def download_from_mirrors(
     substitutions: dict[str, str],
     target: io.RawIOBase | IO[bytes] | PathType,
     timeout: int = 30,
-    progress: Callable[[int], None] | None = None,
 ) -> str:
     """
     Download file from multiple mirrors with substitution support.
@@ -1198,8 +1060,6 @@ def download_from_mirrors(
         substitutions: Dictionary of substitutions to apply to URLs
         target: Target file path or file-like object
         timeout: Download timeout in seconds
-        progress: Passed through to the download (see ``download_with_resume``);
-            replaces the built-in per-file bar
 
     Returns:
         The source URL.
@@ -1264,9 +1124,7 @@ def download_from_mirrors(
     for sweep in range(1, _MIRROR_SWEEP_ATTEMPTS + 1):
         sweep_failures: list[tuple[str, Exception]] = []
         if (
-            url := _try_mirrors_once(
-                urls, path_target, f, timeout, sweep_failures, progress
-            )
+            url := _try_mirrors_once(urls, path_target, f, timeout, sweep_failures)
         ) is not None:
             return url
         failures.extend(sweep_failures)
@@ -1311,37 +1169,3 @@ def download_from_mirrors(
             f"No mirror URL template matched the provided substitutions:{details}"
         )
     raise ValueError("download_from_mirrors called with an empty mirrors list")
-
-
-def strip_win_long_path_prefix(path: str) -> str:
-    r"""Strip the Windows extended-length path prefix from ``path``.
-
-    Handles both forms documented at
-    https://learn.microsoft.com/windows/win32/fileio/naming-a-file:
-
-    * ``\\?\C:\path\to\file`` -> ``C:\path\to\file``
-    * ``\\?\UNC\server\share\path`` -> ``\\server\share\path``
-
-    The NSIS-installed ``esphome.exe`` launcher on Windows starts Python with
-    ``sys.executable`` already prefixed with ``\\?\``. That prefix propagates
-    into PlatformIO's ``$PYTHONEXE`` (PlatformIO reads ``PYTHONEXEPATH`` from
-    the environment, falling back to ``os.path.normpath(sys.executable)``)
-    and ends up baked into SCons-emitted command lines for build steps such
-    as the esp8266 ``elf2bin`` invocation. ``cmd.exe`` does not understand
-    the ``\\?\`` prefix, so the build fails with
-    "The system cannot find the path specified." Stripping the prefix early
-    keeps the path shell-quotable.
-
-    Also applied to the ccache path exported by the ccache helpers, which
-    ``shutil.which`` can return with the same prefix.
-
-    No-op on non-Windows platforms.
-    """
-    if sys.platform != "win32":
-        return path
-    if path.startswith("\\\\?\\UNC\\"):
-        # \\?\UNC\server\share\... -> \\server\share\...
-        return "\\\\" + path[len("\\\\?\\UNC\\") :]
-    if path.startswith("\\\\?\\"):
-        return path[len("\\\\?\\") :]
-    return path

esphome/helpers.py

@@ -31,12 +31,6 @@ SockAddr = IPv4SockAddr | IPv6SockAddr
 
 _LOGGER = logging.getLogger(__name__)
 
-# cv.boolean's closed spelling tables, shared with the strict env-knob
-# parser (build_helpers.ccache.parse_enable_env). The legacy get_bool_env
-# below keeps its own laxer table for backward compatibility.
-TRUTHY_BOOL_STRINGS = frozenset({"true", "yes", "on", "enable"})
-FALSY_BOOL_STRINGS = frozenset({"false", "no", "off", "disable"})
-
 IS_MACOS = platform.system() == "Darwin"
 IS_WINDOWS = platform.system() == "Windows"
 IS_LINUX = platform.system() == "Linux"
@@ -558,7 +552,18 @@ def write_file_if_changed(path: Path, text: str) -> bool:
     """
     src_content = None
     if path.is_file():
-        src_content = read_file(path)
+        try:
+            src_content = path.read_text(encoding="utf-8")
+        except UnicodeDecodeError as err:
+            # Replace a damaged file rather than abort the regeneration that
+            # fixes it; an OSError may hide an intact file, so it still raises
+            _LOGGER.warning("Replacing damaged file %s: %s", path, err)
+            with suppress(OSError):
+                path.unlink(missing_ok=True)
+        except OSError as err:
+            from esphome.core import EsphomeError
+
+            raise EsphomeError(f"Error reading file {path}: {err}") from err
     if src_content == text:
         return False
     write_file(path, text)

esphome/platformio/extra_script.py

@@ -1,263 +0,0 @@
-"""Run a PlatformIO library ``extraScript`` against a fake SCons env.
-
-The shim execs the script with a stand-in ``env``, captures ``env.Append``
-calls (everything else is a logged no-op), and folds the result into the
-library's build flags. No sandboxing: the script runs with full process
-access, so it carries the same trust as the library's own source.
-"""
-
-from __future__ import annotations
-
-from collections.abc import Callable
-from dataclasses import dataclass, field
-import logging
-import os
-from pathlib import Path
-from typing import TYPE_CHECKING
-
-from esphome.core import EsphomeError
-
-if TYPE_CHECKING:
-    from esphome.platformio.library import ConvertedLibrary
-
-_LOGGER = logging.getLogger(__name__)
-
-
-def apply_extra_script(
-    component: ConvertedLibrary,
-    board_mcu: Callable[[], str],
-    pio_platform: str,
-) -> None:
-    """Run a library's ``extraScript`` and fold its captured env vars into
-    ``component.data["build"]["flags"]``.
-
-    ``board_mcu`` is a callable so its lookup runs only when a script will.
-    """
-    extra_script = component.data.get("build", {}).get("extraScript")
-    if not extra_script:
-        return
-    # Resolve and confine to the library's source dir so a malicious
-    # library.json can't escape (e.g. ``"extraScript": "../../etc/passwd"``).
-    source_path = component.source_dir
-    library_root = source_path.resolve()
-    script_path = (source_path / extra_script).resolve()
-    if not script_path.is_relative_to(library_root):
-        # More hostile than a missing script; must not be quieter than it
-        raise EsphomeError(
-            f"extraScript {extra_script} of library {component.name} escapes "
-            "the library directory"
-        )
-    if not script_path.is_file():
-        # A declared-but-absent script is a broken or half-downloaded
-        # package, not an unsupported script; PlatformIO fails on it too
-        raise EsphomeError(
-            f"extraScript {extra_script} of library {component.name} not found"
-        )
-    result = run_extra_script(
-        script_path,
-        library_dir=source_path,
-        board_mcu=board_mcu(),
-        pio_platform=pio_platform,
-    )
-    extra_flags = captured_as_build_flags(result, library_dir=source_path)
-    if not extra_flags:
-        return
-    flags = component.data.setdefault("build", {}).setdefault("flags", [])
-    if isinstance(flags, str):
-        flags = [flags]
-    elif not isinstance(flags, list):
-        # A null/dict value coerced through a list wrapper would inject a
-        # non-string into the compiler command line; fail naming the library
-        raise EsphomeError(
-            f"Library {component.name} has a malformed build.flags "
-            f"({type(flags).__name__}); expected a string or list"
-        )
-    component.data["build"]["flags"] = [*flags, *extra_flags]
-
-
-# Keys we know how to translate back into ESPHome's build-flag pipeline.
-# Other env.Append kwargs are recorded but ignored downstream.
-_CAPTURED_KEYS = frozenset({"LIBPATH", "LIBS", "CPPDEFINES", "LINKFLAGS", "CPPFLAGS"})
-
-
-@dataclass
-class ExtraScriptResult:
-    """Build-var deltas captured from a PIO extra-script ``env.Append`` call."""
-
-    libpath: list[str] = field(default_factory=list)
-    libs: list[str] = field(default_factory=list)
-    cppdefines: list[str | tuple[str, str]] = field(default_factory=list)
-    linkflags: list[str] = field(default_factory=list)
-    cppflags: list[str] = field(default_factory=list)
-
-
-class _FakeSConsEnv:
-    """Minimal SCons ``Environment`` stand-in: ``get`` and ``Append`` work;
-    every other method is a swallowed no-op so scripts don't abort."""
-
-    def __init__(self, *, board_mcu: str, pio_env: str, pio_platform: str) -> None:
-        self._vars: dict[str, str] = {
-            "BOARD_MCU": board_mcu,
-            "PIOPLATFORM": pio_platform,
-            "PIOENV": pio_env,
-        }
-        self.result = ExtraScriptResult()
-        self._warned_methods: set[str] = set()
-        self._warned_keys: set[str] = set()
-
-    # ----- SCons env API the common scripts use -----
-
-    def get(self, key: str, default: str | None = None) -> str | None:
-        return self._vars.get(key, default)
-
-    def __getitem__(self, key: str) -> str:
-        # Scripts also read env["BOARD_MCU"]; without this the broad
-        # handler would discard every flag the script captured
-        return self._vars[key]
-
-    def Append(self, **kwargs) -> None:  # noqa: N802 (SCons API name)
-        for key, value in kwargs.items():
-            if key not in _CAPTURED_KEYS:
-                # Warn once per key so a loop of Appends cannot spam
-                if key not in self._warned_keys:
-                    self._warned_keys.add(key)
-                    _LOGGER.warning(
-                        "PIO extra-script env.Append(%s=...) is not captured; ignoring",
-                        key,
-                    )
-                continue
-            items = list(value) if isinstance(value, (list, tuple)) else [value]
-            bucket = getattr(self.result, key.lower())
-            bucket.extend(items)
-
-    # ----- Everything else is a no-op so unsupported scripts don't crash -----
-
-    def __getattr__(self, name: str):
-        def _noop(*args, **kwargs):
-            # Once per method: a script whose whole effect is env.Replace()
-            # must be diagnosable from a normal build log
-            if name not in self._warned_methods:
-                self._warned_methods.add(name)
-                _LOGGER.warning(
-                    "PIO extra-script env.%s(...) is not supported; ignoring", name
-                )
-
-        return _noop
-
-
-def run_extra_script(
-    script_path: Path,
-    *,
-    library_dir: Path,
-    board_mcu: str,
-    pio_platform: str,
-) -> ExtraScriptResult:
-    """Execute ``script_path`` with a fake SCons env and return captured vars.
-
-    Runs with ``library_dir`` as CWD so relative lookups resolve against
-    the library tree. A crashed script warns and returns an empty result,
-    never a partial capture.
-    """
-    env = _FakeSConsEnv(
-        board_mcu=board_mcu,
-        pio_env=f"esphome_{board_mcu}",
-        pio_platform=pio_platform,
-    )
-    try:
-        source = script_path.read_text(encoding="utf-8")
-    except OSError as err:
-        # An unreadable declared script is a broken package, exactly like a
-        # missing one; must not be quieter than that case
-        raise EsphomeError(f"extraScript {script_path} is unreadable: {err}") from err
-    except UnicodeDecodeError as e:
-        # A content problem, best-effort like a SyntaxError below
-        _LOGGER.warning(
-            "PIO extra-script %s (in %s) is not UTF-8 (%r); ignoring its output",
-            script_path,
-            library_dir.name,
-            e,
-        )
-        return ExtraScriptResult()
-    old_cwd = Path.cwd()
-    try:
-        # Inside the try: a SyntaxError in a vendored script is just as
-        # best-effort as a runtime failure
-        code = compile(source, str(script_path), "exec")
-        os.chdir(library_dir)
-        exec(  # noqa: S102 pylint: disable=exec-used
-            code,
-            {
-                "Import": lambda *_args: None,  # SCons-side import; harmless here
-                "env": env,
-                "__file__": str(script_path),
-                "__name__": "__pio_extra_script__",
-            },
-        )
-    except SystemExit as e:
-        if not e.code:
-            # sys.exit() / sys.exit(0) is a normal PlatformIO script ending;
-            # the capture is complete
-            return env.result
-        _LOGGER.warning(
-            "PIO extra-script %s (in %s) exited with status %r; ignoring its output",
-            script_path,
-            library_dir.name,
-            e.code,
-        )
-        return ExtraScriptResult()
-    except Exception as e:  # noqa: BLE001  # pylint: disable=broad-exception-caught
-        # Discard any partial capture: half-applied flags could build wrong
-        # firmware that links cleanly.
-        _LOGGER.warning(
-            "PIO extra-script %s (in %s) raised %r; ignoring its output",
-            script_path,
-            library_dir.name,
-            e,
-        )
-        return ExtraScriptResult()
-    finally:
-        os.chdir(old_cwd)
-    return env.result
-
-
-def captured_as_build_flags(
-    result: ExtraScriptResult, *, library_dir: Path
-) -> list[str]:
-    """Translate captured env vars into -L/-l/-D/raw build flags.
-
-    ``LIBPATH`` entries are made relative to ``library_dir`` so the
-    generated build files stay portable.
-    """
-    flags: list[str] = []
-
-    def _strs(bucket: list, kind: str) -> list[str]:
-        # Third-party scripts legally append SCons nodes, ints, or dicts;
-        # stringifying those into flags would hand the compiler garbage
-        good = [entry for entry in bucket if isinstance(entry, str)]
-        for entry in bucket:
-            if not isinstance(entry, str):
-                _LOGGER.warning("Ignoring unsupported %s entry %r", kind, entry)
-        return good
-
-    library_root = library_dir.resolve()
-    for path in _strs(result.libpath, "LIBPATH"):
-        # Anchor relative paths to library_dir; the script's CWD has been
-        # restored by now
-        resolved = (library_dir / path).resolve()
-        try:
-            flags.append(f"-L{resolved.relative_to(library_root)}")
-        except ValueError:
-            flags.append(f"-L{resolved}")
-    flags.extend(f"-l{lib}" for lib in _strs(result.libs, "LIBS"))
-    for define in result.cppdefines:
-        # SCons also accepts dict/list CPPDEFINES; formatting those blind
-        # would hand the compiler garbage like -D{'FOO': '1'}
-        if isinstance(define, (tuple, list)) and len(define) == 2:
-            flags.append(f"-D{define[0]}={define[1]}")
-        elif isinstance(define, str):
-            flags.append(f"-D{define}")
-        else:
-            _LOGGER.warning("Ignoring unsupported CPPDEFINES entry %r", define)
-    flags.extend(_strs(result.linkflags, "LINKFLAGS"))
-    flags.extend(_strs(result.cppflags, "CPPFLAGS"))
-    return flags

esphome/platformio/library.py

@@ -13,8 +13,7 @@ regardless of which toolchain consumes the result.
 """
 
 from collections import deque
-from collections.abc import Callable, Iterable
-from concurrent.futures import ThreadPoolExecutor
+from collections.abc import Callable
 from dataclasses import dataclass, field
 import glob
 import hashlib
@@ -31,14 +30,7 @@ from urllib.request import url2pathname
 
 from esphome import git
 from esphome.core import CORE, EsphomeError, Library
-from esphome.framework_helpers import (
-    BATCH_DOWNLOAD_WORKERS,
-    BatchDownloadProgress,
-    archive_extract_all,
-    download_from_mirrors,
-    rmdir,
-    run_batch_downloads,
-)
+from esphome.framework_helpers import archive_extract_all, download_from_mirrors, rmdir
 
 _LOGGER = logging.getLogger(__name__)
 
@@ -55,28 +47,20 @@ DEFAULT_BUILD_SRC_FILTER = (
 DEFAULT_BUILD_SRC_DIRS = "src"
 DEFAULT_BUILD_INCLUDE_DIR = "include"
 DEFAULT_BUILD_FLAGS = []
-# Suffix -> compiler kind (PlatformIO's CSUFFIXES/CXXSUFFIXES/ASSUFFIXES).
-# "asm" merges SCons's AS and ASPP sets: all compile as assembler-with-cpp.
-# The kind values drive the ESP8266 native ninja rules (later in this
-# chain); existing backends consume only the keys. Note .C/.C++ join the
-# suffix set here, matching PlatformIO's CXXSUFFIXES.
-SOURCE_KIND_FOR_SUFFIX: dict[str, str] = {
-    ".c": "c",
-    ".cpp": "cxx",
-    ".cc": "cxx",
-    ".cxx": "cxx",
-    ".c++": "cxx",
-    ".C": "cxx",
-    ".C++": "cxx",
-    ".S": "asm",
-    ".spp": "asm",
-    ".SPP": "asm",
-    ".sx": "asm",
-    ".s": "asm",
-    ".asm": "asm",
-    ".ASM": "asm",
-}
-SRC_FILE_EXTENSIONS = list(SOURCE_KIND_FOR_SUFFIX)
+SRC_FILE_EXTENSIONS = [
+    ".c",
+    ".cpp",
+    ".cc",
+    ".cxx",
+    ".c++",
+    ".S",
+    ".spp",
+    ".SPP",
+    ".sx",
+    ".s",
+    ".asm",
+    ".ASM",
+]
 
 DOMAIN = "pio_components"
 
@@ -86,12 +70,7 @@ ESPHOME_DATA_EXTRA_CMAKE_KEY = "EXTRA_CMAKE"
 
 class Source:
     def download(
-        self,
-        dir_suffix: str,
-        force: bool = False,
-        salt: str = "",
-        namespace: str = "",
-        progress: Callable[[int], None] | None = None,
+        self, dir_suffix: str, force: bool = False, salt: str = "", namespace: str = ""
     ) -> Path:
         raise NotImplementedError
 
@@ -108,7 +87,9 @@ class URLSource(Source):
     def __init__(self, url: str):
         self.url = url
 
-    def _cache_dir(self, dir_suffix: str, salt: str, namespace: str) -> Path:
+    def download(
+        self, dir_suffix: str, force: bool = False, salt: str = "", namespace: str = ""
+    ) -> Path:
         # Namespace the cache per backend (e.g. pio_components/idf, .../zephyr) so
         # the build files each backend writes into the library dir can't collide.
         base_dir = Path(CORE.data_dir) / DOMAIN
@@ -118,23 +99,7 @@ class URLSource(Source):
         h.update(self.url.encode())
         if salt:
             h.update(salt.encode())
-        return base_dir / h.hexdigest()[:8] / dir_suffix
-
-    def is_cached(self, dir_suffix: str, salt: str = "", namespace: str = "") -> bool:
-        """Whether a completed extraction already exists for this source."""
-        return (
-            self._cache_dir(dir_suffix, salt, namespace) / ".esphome_extracted"
-        ).is_file()
-
-    def download(
-        self,
-        dir_suffix: str,
-        force: bool = False,
-        salt: str = "",
-        namespace: str = "",
-        progress: Callable[[int], None] | None = None,
-    ) -> Path:
-        path = self._cache_dir(dir_suffix, salt, namespace)
+        path = base_dir / h.hexdigest()[:8] / dir_suffix
         # Marker file written last to signal a complete extraction. Using a
         # marker (instead of just `path.is_dir()`) means an interrupted
         # extraction is correctly detected and re-run on the next invocation,
@@ -146,12 +111,10 @@ class URLSource(Source):
 
             # Download in temporary file
             with tempfile.NamedTemporaryFile() as tmp:
-                if progress is None:
-                    # A batch caller draws one combined bar and logs the list
-                    _LOGGER.info("Downloading %s ...", self.url)
+                _LOGGER.info("Downloading %s ...", self.url)
                 _LOGGER.debug("Location: %s", path)
 
-                download_from_mirrors([self.url], {}, tmp.file, progress=progress)
+                download_from_mirrors([self.url], {}, tmp.file)
 
                 _LOGGER.debug("Extracting archive to %s ...", path)
                 archive_extract_all(tmp.file, path)
@@ -168,12 +131,7 @@ class GitSource(Source):
         self.ref = ref
 
     def download(
-        self,
-        dir_suffix: str,
-        force: bool = False,
-        salt: str = "",
-        namespace: str = "",
-        progress: Callable[[int], None] | None = None,
+        self, dir_suffix: str, force: bool = False, salt: str = "", namespace: str = ""
     ) -> Path:
         domain = DOMAIN
         if namespace:
@@ -208,12 +166,7 @@ class LocalSource(Source):
         self.local_path = path
 
     def download(
-        self,
-        dir_suffix: str,
-        force: bool = False,
-        salt: str = "",
-        namespace: str = "",
-        progress: Callable[[int], None] | None = None,
+        self, dir_suffix: str, force: bool = False, salt: str = "", namespace: str = ""
     ) -> Path:
         src = Path(self.local_path)
         if not src.is_dir():
@@ -250,14 +203,6 @@ class InvalidLibrary(Exception):
     pass
 
 
-class IncompatiblePlatform(InvalidLibrary):
-    """The manifest's platform filter rejected the target platform.
-
-    A distinct type so callers can treat the routine cross-platform skip
-    differently from other manifest problems without matching message text.
-    """
-
-
 class ConvertedLibrary:
     """A resolved PlatformIO library plus its parsed manifest and on-disk path.
 
@@ -306,13 +251,7 @@ class ConvertedLibrary:
     def get_require_name(self):
         return self.get_sanitized_name().replace("/", "__")
 
-    def download(
-        self,
-        force: bool = False,
-        salt: str = "",
-        namespace: str = "",
-        progress: Callable[[int], None] | None = None,
-    ):
+    def download(self, force: bool = False, salt: str = "", namespace: str = ""):
         """Fetch the library into the shared cache and record its ``path``.
 
         The cache directory is named after the sanitized library name; backends
@@ -321,11 +260,7 @@ class ConvertedLibrary:
         ``get_require_name``). ``namespace`` keeps each backend's cache separate.
         """
         self.path = self.source.download(
-            self.get_sanitized_name(),
-            force=force,
-            salt=salt,
-            namespace=namespace,
-            progress=progress,
+            self.get_sanitized_name(), force=force, salt=salt, namespace=namespace
         )
         self.source_path = self.source.source_root(self.path)
 
@@ -497,7 +432,7 @@ def check_library_data(data: dict, platform: str | None, framework: str):
     valid_platforms = platform is None or "*" in platforms or platform in platforms
 
     if not valid_platforms:
-        raise IncompatiblePlatform(f"Unsupported library platforms: {platforms}")
+        raise InvalidLibrary(f"Unsupported library platforms: {platforms}")
 
     frameworks = data.get("frameworks", "*")
     if isinstance(frameworks, str):
@@ -520,7 +455,7 @@ def check_library_data(data: dict, platform: str | None, framework: str):
         )
 
 
-def parse_library_json(library_json_path: PathType):
+def _parse_library_json(library_json_path: PathType):
     """
     Load and parse a JSON file describing a library.
 
@@ -534,7 +469,7 @@ def parse_library_json(library_json_path: PathType):
         return json.load(fp)
 
 
-def parse_library_properties(library_properties_path: PathType):
+def _parse_library_properties(library_properties_path: PathType):
     """
     Parse a key-value platformio .properties style file into a dictionary.
 
@@ -618,147 +553,19 @@ def _resolve_registry_version(
     return owner, name, best["name"], pkgfile["download_url"]
 
 
-def split_flag_entry(entry: Any, owner: str) -> list[str]:
-    """``shlex.split`` with a clean error naming the offending flags entry."""
-    # Late import: shlex is only needed when actually lexing flags
-    import shlex
-
-    try:
-        return shlex.split(entry)
-    except (ValueError, AttributeError, TypeError) as err:
-        # AttributeError/TypeError: a dict or number from a third-party
-        # manifest; name the entry instead of an opaque shlex traceback
-        raise EsphomeError(f"Malformed build flag {entry!r} in {owner}: {err}") from err
-
-
-def lex_build_flags(entries: str | list[str], owner: str) -> list[str]:
-    """Shell-lex ``build.flags`` entries the way PlatformIO's ParseFlags
-    does; bare -I/-L/-l/-D tokens re-glue to their argument."""
-    # Join per entry, as SCons's ParseFlags lexes each string independently:
-    # a dangling -I ending one entry must warn, not absorb the next entry's
-    # first token.
-    return [
-        token
-        for entry in ensure_list(entries)
-        for token in join_flag_args(split_flag_entry(entry, owner), owner)
-    ]
-
-
-# Flags whose argument may follow as a separate token; ParseFlags glues them
-BARE_ARG_FLAGS = frozenset({"-I", "-L", "-l", "-D"})
-
-
-def raise_on_empty_arg_flags(tokens: list[str], owner: str) -> None:
-    """Reject bare ``-I``/``-D``/``-L``/``-l`` tokens left by an empty glued
-    argument (``-D ""``).
-
-    Consumed by the ESP8266 native build generator (later in this chain)
-    for user build_flags; library manifests deliberately stay warn-and-drop.
-
-    Lives next to ``join_flag_args`` because the bare token is its
-    postcondition: a trailing bare flag is warned and dropped there, so a
-    surviving one always means an empty argument. gcc would eat the next
-    flag as the argument (or add the CWD for ``-L``); always a typo.
-    """
-    if empty := sorted({tok for tok in tokens if tok in BARE_ARG_FLAGS}):
-        raise EsphomeError(
-            f"{owner} contain empty-argument flag(s): {', '.join(empty)}"
-        )
-
-
-def join_flag_args(tokens: Iterable[str], owner: str) -> list[str]:
-    """Join a bare ``-I``/``-L``/``-l``/``-D`` with its following token,
-    the way PlatformIO's ParseFlags lexes them."""
-    out: list[str] = []
-    it = iter(tokens)
-    for tok in it:
-        if tok in BARE_ARG_FLAGS:
-            arg = next(it, None)
-            if arg is None:
-                _LOGGER.warning("Ignoring trailing '%s' in %s build flags", tok, owner)
-                break
-            tok += arg
-        out.append(tok)
-    return out
-
-
-def warn_properties_depends(name: str, data: object) -> None:
-    """Warn when a manifest declares dependencies only as ``depends=``.
-
-    The dependency walk reads the JSON ``dependencies`` key; the raw
-    ``library.properties`` spelling would otherwise drop silently.
-    """
-    if isinstance(data, dict) and not data.get("dependencies") and data.get("depends"):
-        # INFO: common and unactionable for transitive libraries; a WARNING
-        # on every build would train users to ignore the stream
-        _LOGGER.info(
-            "Library %s declares dependencies via library.properties "
-            "depends=, which are not resolved automatically; add them with "
-            "add_library() if needed",
-            name,
-        )
-
-
-def dependency_is_usable(
-    dep: dict, platform: str | None, framework: str, requester: str
-) -> bool:
-    """Compatibility filter for a manifest dependency: platform mismatches
-    skip at debug, any other ``InvalidLibrary`` warns naming the requester."""
-    try:
-        check_library_data(dep, platform, framework)
-    except IncompatiblePlatform as e:
-        _LOGGER.debug("Skip dependency %s of %s: %s", dep.get("name"), requester, e)
-        return False
-    except InvalidLibrary as e:
-        _LOGGER.warning(
-            "Skipping dependency %s of %s: %s", dep.get("name"), requester, e
-        )
-        return False
-    return True
-
-
-def _valid_dependency_entry(entry: dict, manifest_name: str) -> bool:
-    """Whether a normalized entry carries a usable name and version.
-
-    The name must be a non-empty string (every consumer indexes or joins
-    it); a present version must be a string (a container would raise from
-    ``set.add()``, an int fails opaquely inside the registry resolution).
-    Invalid entries warn naming the manifest.
-    """
-    name = entry.get("name")
-    if (
-        isinstance(name, str)
-        and name
-        and ("version" not in entry or isinstance(entry["version"], str))
-    ):
-        return True
-    _LOGGER.warning(
-        "Ignoring unrecognized dependency entry %r of %s", entry, manifest_name
-    )
-    return False
-
-
-def normalize_dependencies(
-    dependencies: Any, manifest_name: str = "manifest"
-) -> list[dict]:
+def _normalize_dependencies(dependencies: Any) -> list[dict]:
     """Normalize a library manifest's ``dependencies`` to a list of dicts.
 
-    PIO's library.json accepts the list-of-dicts form, the shorthand dict
-    form (``{"owner/Name": "version_spec"}``), bare name strings inside the
-    list, and a plain (possibly comma-separated) string; normalize them all
-    so callers see a uniform list. ``manifest_name`` names the manifest in the
-    warning for entries that cannot be normalized.
+    PIO's library.json accepts both the list-of-dicts form and the shorthand
+    dict form (``{"owner/Name": "version_spec"}``); normalize the latter so
+    callers see a uniform list.
     """
     if not dependencies:
         return []
-    if isinstance(dependencies, str):
-        # A plain string is one or more comma-separated names; iterating it
-        # as a list would shred it into one-character "libraries"
-        return [{"name": n.strip()} for n in dependencies.split(",") if n.strip()]
     if isinstance(dependencies, dict):
         normalized = []
         for raw_name, spec in dependencies.items():
-            if isinstance(raw_name, str) and "/" in raw_name:
+            if "/" in raw_name:
                 owner, pkgname = raw_name.split("/", 1)
             else:
                 owner, pkgname = None, raw_name
@@ -767,31 +574,9 @@ def normalize_dependencies(
                 entry.update(spec)
             else:
                 entry["version"] = spec
-            if _valid_dependency_entry(entry, manifest_name):
-                normalized.append(entry)
+            normalized.append(entry)
         return normalized
-    if not isinstance(dependencies, (list, tuple)):
-        _LOGGER.warning(
-            "Ignoring unrecognized dependencies %r of %s",
-            dependencies,
-            manifest_name,
-        )
-        return []
-    normalized = []
-    for entry in dependencies:
-        if isinstance(entry, dict):
-            if _valid_dependency_entry(entry, manifest_name):
-                normalized.append(entry)
-        elif isinstance(entry, str) and entry:
-            # PIO also accepts a bare list of names ("dependencies": ["Wire"])
-            normalized.append({"name": entry})
-        else:
-            _LOGGER.warning(
-                "Ignoring unrecognized dependency entry %r of %s",
-                entry,
-                manifest_name,
-            )
-    return normalized
+    return [d for d in dependencies if isinstance(d, dict)]
 
 
 @dataclass
@@ -903,112 +688,6 @@ def _node_key(
     return name, "registry", (owner, pkgname)
 
 
-def lib_ignore_set() -> set[str]:
-    """The ``lib_ignore`` names from ``esphome->platformio_options``,
-    normalized to lowercase short names (the part after the ``/``)."""
-    return {
-        name.split("/")[-1].lower()
-        for name in CORE.platformio_options.get("lib_ignore", [])
-    }
-
-
-def is_lib_ignored(name: str | None, lib_ignore: set[str]) -> bool:
-    """Whether ``name`` matches the normalized ``lib_ignore`` set."""
-    return (
-        bool(lib_ignore)
-        and name is not None
-        and (name.split("/")[-1].lower() in lib_ignore)
-    )
-
-
-def _content_lengths(urls: list[str]) -> list[int | None]:
-    """Content-Length per URL via HEAD requests; None when unknown."""
-    import requests
-
-    def head(url: str) -> int | None:
-        try:
-            resp = requests.head(url, timeout=10, allow_redirects=True)
-            if not resp.ok:
-                _LOGGER.debug("HEAD %s returned %s", url, resp.status_code)
-                return None
-            return int(resp.headers.get("content-length", 0)) or None
-        except (requests.RequestException, ValueError) as err:
-            _LOGGER.debug("HEAD %s failed: %s", url, err)
-            return None
-
-    with ThreadPoolExecutor(max_workers=min(BATCH_DOWNLOAD_WORKERS, len(urls))) as ex:
-        return list(ex.map(head, urls))
-
-
-def _prefetch_wave(
-    wave: list[tuple[str, ConvertedLibrary]], salt: str, namespace: str
-) -> None:
-    """Best-effort parallel download of a wave's registry archives.
-
-    The walk's own ``download()`` call stays authoritative (it surfaces real
-    failures, with resume); bars are suppressed since parallel bars would
-    interleave. Duplicate URLs prefetch once so two threads never extract
-    into the same cache directory.
-    """
-    components: list[ConvertedLibrary] = []
-    seen: set[str] = set()
-    for _key, component in wave:
-        if not isinstance(component.source, URLSource):
-            continue
-        if component.source.url in seen:
-            continue
-        seen.add(component.source.url)
-        try:
-            cached = component.source.is_cached(
-                component.get_sanitized_name(), salt=salt, namespace=namespace
-            )
-        except Exception as err:  # noqa: BLE001  # pylint: disable=broad-exception-caught
-            # Best-effort: a failing probe prefetches (and re-downloads)
-            _LOGGER.debug("Cache probe for %s failed: %s", component.name, err)
-            cached = False
-        if cached:
-            # A completed extraction downloads nothing; a warm build must
-            # stay silent
-            continue
-        components.append(component)
-    if len(components) < 2:
-        return
-    # One combined bar over the batch, sized by HEAD requests. An unknown
-    # size would mean a silent multi-MB download; fall back to sequential
-    # downloads with their per-file bars instead.
-    sizes = _content_lengths([c.source.url for c in components])
-    if not all(sizes):
-        # Announced before the sequential per-file downloads take over, so
-        # the fallback is distinguishable from a hang
-        _LOGGER.info(
-            "No Content-Length for %s; downloading sequentially",
-            ", ".join(
-                c.source.url
-                for c, size in zip(components, sizes, strict=True)
-                if not size
-            ),
-        )
-        return
-    _LOGGER.info(
-        "Downloading %d libraries: %s",
-        len(components),
-        ", ".join(c.name for c in components),
-    )
-
-    def _fetch(component: ConvertedLibrary):
-        return lambda tracker: component.download(
-            salt=salt, namespace=namespace, progress=tracker
-        )
-
-    failures = run_batch_downloads(
-        BatchDownloadProgress("Downloading libraries", sum(sizes)),
-        [(component.name, _fetch(component)) for component in components],
-    )
-    for name, err in failures:
-        # The sequential call below retries and raises the real error
-        _LOGGER.warning("Prefetch of %s failed (retrying sequentially): %s", name, err)
-
-
 def convert_libraries(
     libraries: list[Library], backend: LibraryBackend
 ) -> list[ConvertedLibrary]:
@@ -1034,7 +713,10 @@ def convert_libraries(
     """
     nodes: dict[str, _LibNode] = {}
 
-    lib_ignore = lib_ignore_set()
+    lib_ignore = {
+        name.split("/")[-1].lower()
+        for name in CORE.platformio_options.get("lib_ignore", [])
+    }
 
     # The generated build files inside the shared cache bake in the dependency
     # wiring, which lib_ignore changes; salt the cache path so configs with
@@ -1046,6 +728,11 @@ def convert_libraries(
         else ""
     )
 
+    def is_ignored(name: str | None) -> bool:
+        if not lib_ignore or name is None:
+            return False
+        return name.split("/")[-1].lower() in lib_ignore
+
     def add_spec(name: str | None, version: str | None, repository: str | None) -> str:
         key, kind, locator = _node_key(name, version, repository)
         node = nodes.get(key) or _LibNode(key=key, is_git=kind == "git")
@@ -1094,7 +781,7 @@ def convert_libraries(
     top_level = [
         add_spec(library.name, library.version, library.repository)
         for library in libraries
-        if not is_lib_ignored(library.name, lib_ignore)
+        if not is_ignored(library.name)
     ]
 
     # Collect + resolve to a fixpoint: a node is (re)resolved whenever its
@@ -1105,132 +792,105 @@ def convert_libraries(
     top_level_keys = set(top_level)
     worklist = deque(dict.fromkeys(top_level))
     while worklist:
-        # Drain the frontier sequentially (spec resolution mutates shared
-        # node state), then prefetch the wave's registry archives in
-        # parallel; the per-component download() below stays authoritative.
-        wave: list[tuple[str, ConvertedLibrary]] = []
-        while worklist:
-            key = worklist.popleft()
-            node = nodes[key]
+        key = worklist.popleft()
+        node = nodes[key]
 
-            # Re-resolve only when the requirement set grew; requirements
-            # only ever grow, so the fixpoint converges and cycles terminate
-            requirements = frozenset(node.requirements)
-            if resolved_requirements.get(key) == requirements:
-                continue
-            resolved_requirements[key] = requirements
+        # A node is queued once per referring edge; skip the (uncached) registry
+        # lookup + download + dependency walk unless its requirement set grew
+        # since the last resolve. Requirements only ever grow, so this still
+        # converges the fixpoint and terminates dependency cycles.
+        requirements = frozenset(node.requirements)
+        if resolved_requirements.get(key) == requirements:
+            continue
+        resolved_requirements[key] = requirements
 
-            if node.is_git:
-                component = ConvertedLibrary(key, "*", GitSource(node.url, node.ref))
-            elif node.is_local:
-                component = ConvertedLibrary(key, "*", LocalSource(node.local_path))
-            else:
-                owner, name, version, url = _resolve_registry_version(
-                    node.owner, node.pkgname, node.requirements
-                )
-                component = ConvertedLibrary(
-                    _owner_pkgname_to_name(owner, name), version, URLSource(url)
-                )
-            wave.append((key, component))
-        _prefetch_wave(wave, salt, backend.cache_key)
-        for key, component in wave:
-            node = nodes[key]
-            if frozenset(node.requirements) != resolved_requirements[key]:
-                # An earlier wave entry grew this node's requirements after
-                # the drain resolved it; downloading the superseded version
-                # would be wasted work, and the next wave re-resolves it
-                worklist.append(key)
-                continue
-            component.download(salt=salt, namespace=backend.cache_key)
+        if node.is_git:
+            component = ConvertedLibrary(key, "*", GitSource(node.url, node.ref))
+        elif node.is_local:
+            component = ConvertedLibrary(key, "*", LocalSource(node.local_path))
+        else:
+            owner, name, version, url = _resolve_registry_version(
+                node.owner, node.pkgname, node.requirements
+            )
+            component = ConvertedLibrary(
+                _owner_pkgname_to_name(owner, name), version, URLSource(url)
+            )
+        component.download(salt=salt, namespace=backend.cache_key)
 
-            source_dir = component.source_dir
-            library_json_path = source_dir / "library.json"
-            library_properties_path = source_dir / "library.properties"
+        source_dir = component.source_dir
+        library_json_path = source_dir / "library.json"
+        library_properties_path = source_dir / "library.properties"
+        has_json = library_json_path.is_file()
+        has_properties = library_properties_path.is_file()
+        if not has_json and not has_properties and not node.is_local:
+            # The shared cache can hold a broken copy (e.g. a clone or an
+            # extraction interrupted by a killed process). Force one
+            # re-download so a bad cache entry self-heals instead of failing
+            # every build until the user runs a full clean. A local source is
+            # read in place, so there is nothing to re-download.
+            _LOGGER.warning(
+                "Library %s at %s is missing library.json and library.properties; "
+                "re-downloading",
+                key,
+                source_dir,
+            )
+            component.download(force=True, salt=salt, namespace=backend.cache_key)
             has_json = library_json_path.is_file()
             has_properties = library_properties_path.is_file()
-            if not has_json and not has_properties and not node.is_local:
-                # An interrupted clone/extraction self-heals with one forced
-                # re-download; a local source has nothing to re-download
-                _LOGGER.warning(
-                    "Library %s at %s is missing library.json and library.properties; "
-                    "re-downloading",
-                    key,
-                    source_dir,
-                )
-                component.download(force=True, salt=salt, namespace=backend.cache_key)
-                has_json = library_json_path.is_file()
-                has_properties = library_properties_path.is_file()
-            if has_json:
-                component.data = parse_library_json(library_json_path)
-            elif has_properties:
-                component.data = parse_library_properties(library_properties_path)
-            else:
-                # Local sources are user input (EsphomeError); a registry/git
-                # miss means a corrupt cache (RuntimeError)
-                error_cls = EsphomeError if node.is_local else RuntimeError
-                raise error_cls(
-                    f"Invalid PIO library {key}: missing library.json and "
-                    f"library.properties in {source_dir}"
-                )
+        if has_json:
+            component.data = _parse_library_json(library_json_path)
+        elif has_properties:
+            component.data = _parse_library_properties(library_properties_path)
+        else:
+            # For a local library a missing manifest is user input, so raise
+            # EsphomeError (clean CLI message) like the missing-directory case;
+            # for registry/git a missing manifest means a corrupt cache, which
+            # is not user error, so keep RuntimeError.
+            error_cls = EsphomeError if node.is_local else RuntimeError
+            raise error_cls(
+                f"Invalid PIO library {key}: missing library.json and "
+                f"library.properties in {source_dir}"
+            )
 
-            if not isinstance(component.data, dict) or not isinstance(
-                component.data.get("build", {}), dict
-            ):
-                # A bare json.load imposes no shape; every backend dereferences
-                # data/build, so validate once here and name the library
-                raise EsphomeError(f"Library {key} has a malformed manifest")
-            warn_properties_depends(component.name, component.data)
+        try:
+            check_library_data(component.data, backend.platform, backend.framework)
+        except InvalidLibrary as e:
+            # Skip an incompatible transitive dependency, but fail fast if a
+            # top-level library the build explicitly requested is incompatible.
+            if key in top_level_keys:
+                raise RuntimeError(
+                    f"Requested library {key} is not compatible with "
+                    f"{backend.framework}: {e}"
+                ) from e
+            _LOGGER.debug("Skip incompatible dependency %s: %s", key, str(e))
+            continue
+        components[key] = component
 
-            try:
-                check_library_data(component.data, backend.platform, backend.framework)
-            except InvalidLibrary as e:
-                # An explicitly requested library fails fast; the routine
-                # cross-platform skip stays at debug, other causes warn
-                if key in top_level_keys:
-                    raise RuntimeError(
-                        f"Requested library {key} is not compatible with "
-                        f"{backend.framework}: {e}"
-                    ) from e
-                if isinstance(e, IncompatiblePlatform):
-                    _LOGGER.debug("Skip incompatible dependency %s: %s", key, str(e))
-                else:
-                    _LOGGER.warning("Skipping dependency %s: %s", key, str(e))
+        # Requirements changed (we got past the short-circuit above), so
+        # (re)walk this component's dependencies.
+        node.edges = set()
+        for dependency in _normalize_dependencies(component.data.get("dependencies")):
+            if "name" not in dependency or "version" not in dependency:
                 continue
-            components[key] = component
-
-            # Requirements changed (we got past the short-circuit above), so
-            # (re)walk this component's dependencies.
-            node.edges = set()
-            for dependency in normalize_dependencies(
-                component.data.get("dependencies"), component.name
-            ):
-                if "version" not in dependency:
-                    # Cannot resolve from the registry; the arduino-backend
-                    # PR adds the reconciliation that reports real drops
-                    _LOGGER.debug(
-                        "Skip version-less dependency %r of %s",
-                        dependency.get("name"),
-                        component.name,
-                    )
-                    continue
-                if not dependency_is_usable(
-                    dependency, backend.platform, backend.framework, component.name
-                ):
-                    continue
-                dep_name = _owner_pkgname_to_name(
-                    dependency.get("owner"), dependency.get("name")
-                )
-                if is_lib_ignored(dep_name, lib_ignore):
-                    _LOGGER.debug("Skip ignored dependency %s", dep_name)
-                    continue
-                # The version field may actually be a URL (git/archive dependency).
-                dep_version = dependency["version"]
-                dep_url = _url_or_none(dep_version)
-                if dep_url is not None:
-                    dep_version = None
-                dep_key = add_spec(dep_name, dep_version, dep_url)
-                node.edges.add(dep_key)
-                worklist.append(dep_key)
+            try:
+                check_library_data(dependency, backend.platform, backend.framework)
+            except InvalidLibrary as e:
+                _LOGGER.debug("Skip dependency %s: %s", dependency.get("name"), str(e))
+                continue
+            dep_name = _owner_pkgname_to_name(
+                dependency.get("owner"), dependency.get("name")
+            )
+            if is_ignored(dep_name):
+                _LOGGER.debug("Skip ignored dependency %s", dep_name)
+                continue
+            # The version field may actually be a URL (git/archive dependency).
+            dep_version = dependency["version"]
+            dep_url = _url_or_none(dep_version)
+            if dep_url is not None:
+                dep_version = None
+            dep_key = add_spec(dep_name, dep_version, dep_url)
+            node.edges.add(dep_key)
+            worklist.append(dep_key)
 
     # A git or local source wins over the same component requested from the
     # registry. That's intentional, but warn so the dropped registry spec isn't

esphome/platformio/registry.py

@@ -1,280 +0,0 @@
-"""Install packages from the PlatformIO registry without importing the
-platformio package (identical bits, esphome's own download machinery)."""
-
-from __future__ import annotations
-
-from collections.abc import Collection
-import io
-import json
-import logging
-import os
-from pathlib import Path
-import platform
-
-from esphome.core import EsphomeError
-from esphome.framework_helpers import (
-    BatchDownloadProgress,
-    archive_extract_all,
-    download_from_mirrors,
-    download_with_resume,
-    rmdir,
-    run_batch_downloads,
-)
-
-_LOGGER = logging.getLogger(__name__)
-
-_REGISTRY_URL = (
-    "https://api.registry.platformio.org/v3/packages/platformio/tool/{package}"
-)
-
-
-def get_systype() -> str:
-    """The registry system tag for the current host.
-
-    Transliterates ``platformio.util.get_systype()`` (same
-    ``PLATFORMIO_SYSTEM_TYPE`` override). Deviation: windows-arm64 maps to
-    ``windows_amd64`` (no arm64 toolchains; x86 emulation).
-    """
-    if systype := os.environ.get("PLATFORMIO_SYSTEM_TYPE"):
-        return systype
-    system = platform.system().lower()
-    arch = platform.machine().lower()
-    if system == "windows":
-        if not arch:  # same fallback as upstream (platformio issue #4353)
-            arch = "x86_" + platform.architecture()[0]
-        if "x86" in arch:
-            arch = "amd64" if "64" in arch else "x86"
-        elif arch == "arm64":
-            arch = "amd64"
-    if arch == "aarch64" and platform.architecture()[0] == "32bit":
-        # 64-bit kernel with a 32-bit userland (e.g. 32-bit Raspberry Pi OS)
-        arch = "armv7l"
-    return f"{system}_{arch}" if arch else system
-
-
-def registry_download(package: str, version: str) -> tuple[str, str, int | None]:
-    """Resolve a package's download URL, sha256, and size via the registry.
-
-    The metadata fetch goes through ``download_from_mirrors`` so it shares
-    the retry, backoff, and error reporting of every other download here.
-    """
-    buf = io.BytesIO()
-    download_from_mirrors([_REGISTRY_URL], {"package": package}, buf)
-    try:
-        data = json.loads(buf.getvalue())
-    except ValueError as err:
-        raise EsphomeError(
-            f"The package registry returned invalid JSON for {package}: {err}"
-        ) from err
-    if not isinstance(data, dict):
-        raise EsphomeError(
-            f"Unexpected package registry response for {package}: {str(data)[:200]}"
-        )
-    systype = get_systype()
-    versions = data.get("versions")
-    if not isinstance(versions, list):
-        # A schema change or an error/captive-portal payload must not be
-        # reported as "version not found"
-        raise EsphomeError(
-            f"Unexpected package registry response for {package}: {str(data)[:200]}"
-        )
-    for ver in versions:
-        if not isinstance(ver, dict):
-            raise EsphomeError(
-                f"Unexpected package registry response for {package}: {str(data)[:200]}"
-            )
-        if ver.get("name") != version:
-            continue
-        files = ver.get("files")
-        if not isinstance(files, list):
-            raise EsphomeError(
-                f"Unexpected package registry response for {package}: {str(ver)[:200]}"
-            )
-        for file in files:
-            if not isinstance(file, dict):
-                raise EsphomeError(
-                    f"Unexpected package registry response for {package}: "
-                    f"{str(ver)[:200]}"
-                )
-            # Only a missing key means "any system"; an empty list must not
-            # match, and a bare string would make ``in`` a substring test.
-            systems = file.get("system")
-            if systems is None:
-                systems = ["*"]
-            elif isinstance(systems, str):
-                systems = [systems]
-            elif not isinstance(systems, list):
-                # An int would make ``in`` a TypeError and a dict a key test
-                raise EsphomeError(
-                    f"Unexpected package registry response for {package}: "
-                    f"{str(file)[:200]}"
-                )
-            if "*" in systems or systype in systems:
-                sha256 = (file.get("checksum") or {}).get("sha256")
-                if not sha256:
-                    # Never extract an unverified archive; the registry
-                    # publishes a checksum for every package file.
-                    raise EsphomeError(
-                        f"The package registry returned no sha256 for "
-                        f"{package} {version}; refusing the unverified download"
-                    )
-                url = file.get("download_url")
-                if not url:
-                    raise EsphomeError(
-                        f"The package registry returned no download URL for "
-                        f"{package} {version}"
-                    )
-                return (url, sha256, file.get("size"))
-        raise EsphomeError(
-            f"No {package} {version} build for this platform ({systype})"
-        )
-    raise EsphomeError(f"{package} {version} not found in the package registry")
-
-
-def _check_layout(name: str, dest: Path, expect: Collection[str]) -> None:
-    """Raise when an install tree is missing an expected directory (runs on
-    fresh extracts and on marker hits)."""
-    for rel in expect:
-        if not (dest / rel).is_dir():
-            raise EsphomeError(
-                f"{name} at {dest} is missing the expected {rel} "
-                "directory; run 'esphome clean-all' and retry"
-            )
-
-
-def prefetch_packages(
-    packages: list[tuple[str, str, Path, list[str]]], downloads_dir: Path
-) -> None:
-    """Download pending package archives in parallel under one combined bar.
-
-    ``packages`` holds ``(name, version, dest, mirrors)`` per package. Purely
-    an optimization: ``install_package`` verifies every archive and
-    re-downloads anything this pass left unfinished. Mirror overrides and
-    registry entries without a size stay on the sequential path so its
-    per-file bars remain trustworthy. Each fetch holds the same per-dest
-    lock as ``install_package``: the archive's ``.part`` file is shared, and
-    two concurrent writers would truncate each other's bytes.
-    """
-    from filelock import FileLock
-
-    pending: list[tuple[str, str, Path, str, str, int]] = []
-    seen: set[str] = set()
-    for name, version, dest, mirrors in packages:
-        if mirrors or (dest / ".esphome_extracted").is_file():
-            continue
-        archive_name = f"{name}-{version}"
-        if archive_name in seen:
-            # A duplicate entry would race itself between two workers
-            continue
-        seen.add(archive_name)
-        try:
-            url, sha256, size = registry_download(name, version)
-        except EsphomeError as err:
-            # The sequential install reports the real failure with context
-            _LOGGER.debug("Prefetch resolve for %s failed: %s", name, err)
-            continue
-        if not size:
-            continue
-        archive = downloads_dir / archive_name
-        if archive.is_file() and archive.stat().st_size == size:
-            continue
-        pending.append((name, version, dest, url, sha256, size))
-    if len(pending) < 2:
-        return
-    downloads_dir.mkdir(parents=True, exist_ok=True)
-    _LOGGER.info(
-        "Downloading %d package archive(s): %s",
-        len(pending),
-        ", ".join(name for name, *_ in pending),
-    )
-
-    def _fetch(entry: tuple[str, str, Path, str, str, int]):
-        name, version, dest, url, sha256, size = entry
-
-        def fetch(tracker):
-            dest.parent.mkdir(parents=True, exist_ok=True)
-            with FileLock(f"{dest}.lock", fallback_to_soft=False):
-                download_with_resume(
-                    url,
-                    downloads_dir / f"{name}-{version}",
-                    sha256=sha256,
-                    size=size,
-                    progress=tracker,
-                )
-
-        return fetch
-
-    failures = run_batch_downloads(
-        BatchDownloadProgress(
-            "Downloading packages", sum(size for *_, size in pending)
-        ),
-        [(entry[0], _fetch(entry)) for entry in pending],
-    )
-    for name, err in failures:
-        if isinstance(err, (EsphomeError, OSError)):
-            # Expected download failures: install_package retries this one
-            # itself, with a visible bar
-            _LOGGER.debug("Prefetch of %s failed: %s", name, err)
-        else:
-            # Anything else is a programming error that would otherwise
-            # become a permanent silent no-op
-            _LOGGER.warning("Prefetch of %s failed: %r", name, err)
-
-
-def install_package(
-    name: str,
-    version: str,
-    dest: Path,
-    mirrors: list[str],
-    downloads_dir: Path,
-    expect: Collection[str],
-) -> None:
-    """Download, verify, and extract one package if not already installed.
-
-    The registry path is integrity-checked against the sha256 the registry
-    publishes; a mirror override (URL templates with ``{VERSION}``/``{SYSTEM}``
-    substitution) is trusted as configured. ``downloads_dir`` holds the
-    archive between runs so an interrupted download resumes.
-    """
-    if not expect:
-        # Layout validation before marker.touch() is the only guard against
-        # caching a truncated mirror archive as a good install
-        raise ValueError("install_package requires a non-empty expect")
-    marker = dest / ".esphome_extracted"
-    if marker.is_file():
-        _check_layout(name, dest, expect)
-        return
-    from filelock import FileLock
-
-    # Serialize concurrent cold builds (same filelock pattern as git.py).
-    dest.parent.mkdir(parents=True, exist_ok=True)
-    # A soft-lock fallback would turn a hard-killed run into a permanent
-    # hang (see git.py).
-    with FileLock(f"{dest}.lock", fallback_to_soft=False):
-        if marker.is_file():
-            # Another process finished the install while we waited
-            return
-        rmdir(dest, msg=f"Clean up incomplete {name} install")
-        # Persistent location so an interrupted download resumes across runs.
-        downloads_dir.mkdir(parents=True, exist_ok=True)
-        archive = downloads_dir / f"{name}-{version}"
-        _LOGGER.info("Downloading %s %s ...", name, version)
-        if mirrors:
-            _LOGGER.warning(
-                "Downloading %s from a mirror override; checksum verification "
-                "is skipped for mirrors",
-                name,
-            )
-            download_from_mirrors(
-                mirrors, {"VERSION": version, "SYSTEM": get_systype()}, archive
-            )
-        else:
-            url, sha256, size = registry_download(name, version)
-            download_with_resume(url, archive, sha256=sha256, size=size)
-        _LOGGER.info("Extracting %s ...", name)
-        archive_extract_all(archive, dest, progress_header="Extracting")
-        # Validate the layout before recording success, so an unexpected
-        # package is never cached as a working install.
-        _check_layout(name, dest, expect)
-        marker.touch()
-        archive.unlink(missing_ok=True)

esphome/platformio/toolchain.py

@@ -4,18 +4,19 @@ import logging
 import os
 from pathlib import Path
 import re
+import shutil
+import subprocess
 import sys
 from typing import TYPE_CHECKING, Any
 
 import platformdirs
 
-from esphome.build_helpers.ccache import resolve_ccache_path
 from esphome.const import CONF_COMPILE_PROCESS_LIMIT, CONF_ESPHOME, KEY_CORE
 from esphome.core import CORE, EsphomeError
-from esphome.framework_helpers import strip_win_long_path_prefix
 from esphome.helpers import (
     add_git_ceiling_directory,
     copy_file_if_changed,
+    get_bool_env,
     rmtree,
     write_file,
 )
@@ -40,6 +41,40 @@ _PIO_PYTHON_STAMP_LOCK = ".esphome.pio.stamp.lock"
 _PIO_PYTHON_STAMP_SCHEMA = "0"
 
 
+def _strip_win_long_path_prefix(path: str) -> str:
+    r"""Strip the Windows extended-length path prefix from ``path``.
+
+    Handles both forms documented at
+    https://learn.microsoft.com/windows/win32/fileio/naming-a-file:
+
+    * ``\\?\C:\path\to\file`` -> ``C:\path\to\file``
+    * ``\\?\UNC\server\share\path`` -> ``\\server\share\path``
+
+    The NSIS-installed ``esphome.exe`` launcher on Windows starts Python with
+    ``sys.executable`` already prefixed with ``\\?\``. That prefix propagates
+    into PlatformIO's ``$PYTHONEXE`` (PlatformIO reads ``PYTHONEXEPATH`` from
+    the environment, falling back to ``os.path.normpath(sys.executable)``)
+    and ends up baked into SCons-emitted command lines for build steps such
+    as the esp8266 ``elf2bin`` invocation. ``cmd.exe`` does not understand
+    the ``\\?\`` prefix, so the build fails with
+    "The system cannot find the path specified." Stripping the prefix early
+    keeps the path shell-quotable.
+
+    Also applied to the ccache path exported by ``_ccache_env()``, which
+    ``shutil.which`` can return with the same prefix.
+
+    No-op on non-Windows platforms.
+    """
+    if sys.platform != "win32":
+        return path
+    if path.startswith("\\\\?\\UNC\\"):
+        # \\?\UNC\server\share\... -> \\server\share\...
+        return "\\\\" + path[len("\\\\?\\UNC\\") :]
+    if path.startswith("\\\\?\\"):
+        return path[len("\\\\?\\") :]
+    return path
+
+
 def get_platformio_config() -> "ProjectConfig | None":
     """Return PlatformIO's ``ProjectConfig``, or None when PlatformIO is absent."""
     try:
@@ -203,6 +238,32 @@ def _check_platformio_python_stamp(config: "ProjectConfig") -> None:
         _write_pio_stamp_python(stamp_file, current)
 
 
+def _ccache_runs(ccache: str) -> bool:
+    """Return True when the ``ccache`` found on PATH actually runs.
+
+    ``shutil.which`` proves existence, not runnability: on Windows it also
+    matches ``.bat``/``.cmd`` wrappers and stale package-manager shims whose
+    target is gone. Wrapping compiles around such a find fails every compile
+    step with an opaque OS error, so probe once and fall back to compiling
+    without ccache when the probe fails.
+    """
+    try:
+        subprocess.run(
+            [ccache, "--version"],
+            check=True,
+            stdout=subprocess.DEVNULL,
+            stderr=subprocess.DEVNULL,
+            timeout=15,
+        )
+    except (OSError, subprocess.SubprocessError):
+        _LOGGER.warning(
+            "Ignoring ccache at %s because it failed to run; compiling without ccache",
+            ccache,
+        )
+        return False
+    return True
+
+
 def _ccache_env() -> dict[str, str]:
     r"""Return ccache settings for PlatformIO builds.
 
@@ -221,7 +282,7 @@ def _ccache_env() -> dict[str, str]:
     runs fine through ``CreateProcess``, which is how ESP-IDF invokes it,
     but SCons runs every compile through ``cmd.exe``, which fails on it with
     "The system cannot find the path specified." (#18399), so the prefix is
-    stripped here with ``strip_win_long_path_prefix()`` before the
+    stripped here with ``_strip_win_long_path_prefix()`` before the
     runnability probe, which therefore validates the exact string the build
     will execute.
     ``ESPHOME_CCACHE_PATH`` is an internal channel, not a user setting: the
@@ -247,8 +308,22 @@ def _ccache_env() -> dict[str, str]:
     build dir. The other ``CCACHE_*`` values the user already set in the
     environment are respected.
     """
-    ccache_path = resolve_ccache_path()
+    explicit = "ESPHOME_CCACHE_ENABLE" in os.environ
+    if explicit and not get_bool_env("ESPHOME_CCACHE_ENABLE"):
+        return {"ESPHOME_CCACHE_ENABLE": "0"}
+    ccache_path = shutil.which("ccache")
     if ccache_path is None:
+        if explicit:
+            _LOGGER.warning(
+                "ESPHOME_CCACHE_ENABLE is set but no ccache binary is on PATH; "
+                "compiling without ccache"
+            )
+        return {"ESPHOME_CCACHE_ENABLE": "0"}
+    # Strip before probing so the probe validates (and the failure warning
+    # names) the exact string the build will execute through cmd.exe.
+    ccache_path = _strip_win_long_path_prefix(ccache_path)
+    # An explicit opt-in skips the runnability probe.
+    if not explicit and not _ccache_runs(ccache_path):
         return {"ESPHOME_CCACHE_ENABLE": "0"}
     env = {
         "ESPHOME_CCACHE_ENABLE": "1",
@@ -310,7 +385,7 @@ def run_platformio_cli(*args, **kwargs) -> str | int:
     # Strip the Windows extended-length path prefix from sys.executable so it
     # doesn't propagate into PlatformIO's $PYTHONEXE and break SCons-emitted
     # command lines run through cmd.exe.
-    python_exe = strip_win_long_path_prefix(sys.executable)
+    python_exe = _strip_win_long_path_prefix(sys.executable)
     if python_exe != sys.executable:
         # Only override PYTHONEXEPATH when we actually stripped a prefix.
         # PlatformIO's get_pythonexe_path() reads this and falls back to

esphome/writer.py

@@ -288,13 +288,11 @@ def copy_src_tree():
             # Source file removed, delete target
             p.unlink()
             if target not in generated_files:
-                _LOGGER.debug("Source removed: %s", target)
                 sources_changed = True
         else:
             src_file = source_files_copy.pop(target)
             with src_file.path() as src_path:
                 if copy_file_if_changed(src_path, p) and target not in generated_files:
-                    _LOGGER.debug("Source changed: %s", target)
                     sources_changed = True
 
     # Now copy new files
@@ -305,25 +303,21 @@ def copy_src_tree():
                 copy_file_if_changed(src_path, dst_path)
                 and target not in generated_files
             ):
-                _LOGGER.debug("Source added: %s", target)
                 sources_changed = True
 
     # Finally copy defines
     if write_file_if_changed(
         CORE.relative_src_path("esphome", "core", "defines.h"), generate_defines_h()
     ):
-        _LOGGER.debug("Source changed: esphome/core/defines.h")
         sources_changed = True
     write_file_if_changed(CORE.relative_build_path("README.txt"), ESPHOME_README_TXT)
     if write_file_if_changed(
         CORE.relative_src_path("esphome.h"), ESPHOME_H_FORMAT.format(include_s)
     ):
-        _LOGGER.debug("Source changed: esphome.h")
         sources_changed = True
     if write_file_if_changed(
         CORE.relative_src_path("esphome", "core", "version.h"), generate_version_h()
     ):
-        _LOGGER.debug("Source changed: esphome/core/version.h")
         sources_changed = True
 
     # Generate new build_info files if needed
@@ -338,13 +332,18 @@ def copy_src_tree():
 
     # Defensively force a rebuild if the build_info files don't exist, or if
     # there was a config change which didn't actually cause a source change
-    if _build_info_stale(
-        build_info_data_h_path,
-        build_info_data_cpp_path,
-        build_info_json_path,
-        config_hash,
-    ):
+    if not build_info_data_h_path.exists() or not build_info_data_cpp_path.exists():
         sources_changed = True
+    else:
+        try:
+            existing = json.loads(build_info_json_path.read_text(encoding="utf-8"))
+            if (
+                existing.get("config_hash") != config_hash
+                or existing.get("esphome_version") != __version__
+            ):
+                sources_changed = True
+        except (json.JSONDecodeError, KeyError, OSError):
+            sources_changed = True
 
     # Write build_info header and JSON metadata
     if sources_changed:
@@ -398,38 +397,6 @@ def generate_version_h():
     )
 
 
-def _build_info_stale(
-    h_path: Path, cpp_path: Path, json_path: Path, config_hash: int
-) -> bool:
-    """Whether the build-info sources must regenerate (missing or stale)."""
-    if not h_path.exists() or not cpp_path.exists():
-        _LOGGER.debug("Build info files missing; regenerating")
-        return True
-    try:
-        existing = json.loads(json_path.read_text(encoding="utf-8"))
-    except (json.JSONDecodeError, OSError):
-        _LOGGER.debug("Build info JSON unreadable; regenerating")
-        return True
-    if not isinstance(existing, dict):
-        # Valid JSON that is not an object (truncated or hand-edited) is
-        # stale, not a traceback
-        _LOGGER.debug("Build info JSON malformed; regenerating")
-        return True
-    if (
-        existing.get("config_hash") != config_hash
-        or existing.get("esphome_version") != __version__
-    ):
-        _LOGGER.debug(
-            "Build info stale (config_hash %s -> %s, version %s -> %s)",
-            existing.get("config_hash"),
-            config_hash,
-            existing.get("esphome_version"),
-            __version__,
-        )
-        return True
-    return False
-
-
 def get_build_info() -> tuple[int, int, str, str]:
     """Calculate build_info values from current config.
 
@@ -690,17 +657,14 @@ def clean_all(configuration: list[str]):
     # the per-config loop above can't reach. Wipe the default cache root
     # (also catches leftovers from older install layouts), then the resolved
     # install paths for the ESPHOME_*_PREFIX overrides (docker/add-on/CI)
-    # that live outside it. Every backend's cache is listed in
-    # TOOLS_CACHE_SPECS, so registering one there is the only step.
+    # that live outside it.
     import platformdirs
 
-    from esphome.build_helpers.tools_cache import TOOLS_CACHE_SPECS, tools_cache_path
+    from esphome.components.nrf52.framework import get_sdk_nrf_tools_path
+    from esphome.espidf.framework import get_idf_tools_path
 
     cache_root = Path(platformdirs.user_cache_dir("esphome", appauthor=False)).resolve()
-    install_paths = [cache_root] + [
-        tools_cache_path(*spec) for spec in TOOLS_CACHE_SPECS
-    ]
-    for install_path in install_paths:
+    for install_path in (cache_root, get_idf_tools_path(), get_sdk_nrf_tools_path()):
         if install_path.is_dir():
             _LOGGER.info("Deleting %s", install_path)
             rmtree(install_path)

platformio.ini

@@ -45,7 +45,7 @@ lib_deps_base =
 lib_deps =
     ${common.lib_deps_base}
     https://github.com/dudanov/MideaUART.git#eeea6c3e9b4474f067054592b435be1c4e466815 ; midea
-    esphome/noise-c@0.1.21                 ; api
+    esphome/noise-c@0.1.21                 ; noise (api, ota)
     improv/Improv@1.2.6                    ; improv_serial / esp32_improv
     kikuchan98/pngle@1.1.0                 ; online_image
     ; Using the repository directly, otherwise ESP-IDF can't use the library
@@ -244,7 +244,7 @@ lib_deps =
     ${common:idf-component-libs.lib_deps}
     ESP32Async/ESPAsyncWebServer@3.9.6    ; web_server_base
     droscy/esp_wireguard@0.4.5            ; wireguard
-    esphome/noise-c@0.1.21                ; api
+    esphome/noise-c@0.1.21                ; noise (api, ota)
     ESP32Async/AsyncTCP@3.4.5             ; async_tcp
     DNSServer                             ; captive_portal
     heman/AsyncMqttClient-esphome@2.0.0   ; mqtt
@@ -641,7 +641,7 @@ build_unflags =
 extends = common
 platform = platformio/native
 lib_deps =
-    esphome/noise-c@0.1.21  ; used by api
+    esphome/noise-c@0.1.21  ; used by noise (api, ota)
     lvgl/lvgl@9.5.0         ; lvgl
 build_flags =
     ${common.build_flags}

requirements.txt

@@ -28,7 +28,6 @@ smpclient==7.2.0
 requests==2.34.2
 py7zr==1.1.3
 platformdirs==4.11.3  # native esp-idf toolchain global cache dir
-ninja==1.13.0  # native esp8266 arduino toolchain build driver
 filelock==3.32.3  # inter-process locks (PlatformIO cache heal, git clone cache); >=3.32 for FileLock(fallback_to_soft=...), older versions silently drop the kwarg
 
 # esp-idf >= 5.0 requires this

script/determine-jobs.py

@@ -525,21 +525,13 @@ def _esp32_platformio_path_or_file_trigger(files: list[str]) -> bool:
     return False
 
 
-# Native-build infra: changes under esphome/espidf/, the shared
-# esphome/build_helpers/ package, or the modules the native ESP-IDF build
-# imports affect every esp32 IDF build (now the default toolchain) but aren't
+# ESP-IDF infra: changes under esphome/espidf/ or to the IDF build generator
+# affect every esp32 IDF build (now the default toolchain) but aren't
 # components, so the component matrix wouldn't otherwise force any esp32
 # compile. When they change we fold the `esp32` component into the matrix so
 # the default native-IDF build path is still compiled on an infra-only PR.
-ESP_IDF_INFRA_TRIGGER_PATH_PREFIXES = ("esphome/espidf/", "esphome/build_helpers/")
-ESP_IDF_INFRA_TRIGGER_FILES = frozenset(
-    {
-        "esphome/build_gen/espidf.py",
-        "esphome/framework_helpers.py",
-        "esphome/platformio/library.py",
-        "esphome/platformio/extra_script.py",
-    }
-)
+ESP_IDF_INFRA_TRIGGER_PATH_PREFIXES = ("esphome/espidf/",)
+ESP_IDF_INFRA_TRIGGER_FILES = frozenset({"esphome/build_gen/espidf.py"})
 
 
 def _esp_idf_infra_changed(files: list[str]) -> bool:

tests/benchmarks/components/api/__init__.py

@@ -3,8 +3,9 @@ from tests.testing_helpers import ComponentManifestOverride
 
 
 def override_manifest(manifest: ComponentManifestOverride) -> None:
-    # api must run its to_code to define USE_API, USE_API_PLAINTEXT,
-    # and add the noise-c library dependency.
+    # api must run its to_code to define USE_API and USE_API_NOISE. The
+    # AUTO_LOADed noise component runs its own to_code via the override in
+    # tests/benchmarks/components/noise/__init__.py.
     manifest.enable_codegen()
 
     original_to_code = manifest.to_code

tests/benchmarks/components/noise/__init__.py

@@ -0,0 +1,7 @@
+from tests.testing_helpers import ComponentManifestOverride
+
+
+def override_manifest(manifest: ComponentManifestOverride) -> None:
+    # to_code must run: it defines USE_NOISE and adds the noise-c library
+    # the api benchmark sources need.
+    manifest.enable_codegen()

tests/component_tests/esp32/test_esp32.py

@@ -131,20 +131,6 @@ def test_esp32_rejects_unsupported_toolchains(
         CONFIG_SCHEMA({"variant": VARIANT_ESP32, "toolchain": config_toolchain})
 
 
-def test_esp32_rejects_unsupported_cli_toolchain(
-    set_core_config: SetCoreConfigCallable,
-) -> None:
-    """A --toolchain the platform cannot serve fails instead of silently
-    building with PlatformIO (the CLI path bypasses the YAML validator)."""
-    set_core_config(PlatformFramework.ESP32_IDF)
-
-    from esphome.components.esp32 import CONFIG_SCHEMA
-
-    CORE.toolchain = Toolchain.ARDUINO
-    with pytest.raises(cv.Invalid, match="Unsupported toolchain 'arduino'"):
-        CONFIG_SCHEMA({"variant": VARIANT_ESP32})
-
-
 @pytest.mark.parametrize(
     ("config", "error_match"),
     [

tests/component_tests/noise/test_encryption_key.py

@@ -0,0 +1,37 @@
+"""Tests for the shared noise encryption key helpers."""
+
+from __future__ import annotations
+
+import pytest
+
+from esphome import config_validation as cv
+from esphome.components.noise import decode_encryption_key, validate_encryption_key
+
+KEY = "AAECAwQFBgcICQoLDA0ODxAREhMUFRYXGBkaGxwdHh8="
+
+
+def test_validate_encryption_key_roundtrips() -> None:
+    assert validate_encryption_key(KEY) == KEY
+
+
+@pytest.mark.parametrize("value", ["not-base64!!!", "AAECAw=="])
+def test_validate_encryption_key_rejects_bad_input(value: str) -> None:
+    with pytest.raises(cv.Invalid):
+        validate_encryption_key(value)
+
+
+def test_decode_encryption_key_returns_32_bytes() -> None:
+    assert decode_encryption_key(KEY) == bytes(range(32))
+
+
+def test_decode_encryption_key_rejects_invalid_base64() -> None:
+    """The shared helper raises cv.Invalid, not binascii.Error."""
+    with pytest.raises(cv.Invalid, match="base64"):
+        decode_encryption_key("A")
+
+
+def test_decode_encryption_key_rejects_short_decode() -> None:
+    """a2b_base64 stops at embedded padding; a short decode must not become
+    a zero padded PSK on the device."""
+    with pytest.raises(cv.Invalid, match="32 bytes"):
+        decode_encryption_key("AAECAw==")

tests/components/binary_sensor/common.yaml

@@ -136,3 +136,19 @@ binary_sensor:
         invalid_cooldown: 2s
         then:
           - logger.log: "Click with custom cooldown"
+
+  # Test on_click and on_double_click (compiles match_interval via
+  # USE_BINARY_SENSOR_CLICK_TRIGGER)
+  - platform: template
+    id: click_triggers
+    name: "Click Triggers"
+    on_click:
+      min_length: 50ms
+      max_length: 350ms
+      then:
+        - logger.log: "Clicked"
+    on_double_click:
+      min_length: 50ms
+      max_length: 350ms
+      then:
+        - logger.log: "Double clicked"

tests/components/noise/__init__.py

@@ -0,0 +1,7 @@
+from tests.testing_helpers import ComponentManifestOverride
+
+
+def override_manifest(manifest: ComponentManifestOverride) -> None:
+    # to_code must run: it defines USE_NOISE and adds the noise-c library
+    # the component sources under test need.
+    manifest.enable_codegen()

tests/components/noise/common.yaml

@@ -0,0 +1 @@
+noise:

tests/components/noise/test.esp32-idf.yaml

@@ -0,0 +1,2 @@
+packages:
+  noise: !include common.yaml

tests/components/noise/test.esp8266-ard.yaml

@@ -0,0 +1,2 @@
+packages:
+  noise: !include common.yaml

tests/components/noise/test.host.yaml

@@ -0,0 +1,2 @@
+packages:
+  noise: !include common.yaml