[api] Cover the PlatformIO toolchain in the managed component tests

The ESP-IDF framework can also be built with the PlatformIO toolchain, and the
managed components are used on both. Record why that choice is deliberately
toolchain-independent: wireguard splits on the same condition, and if the two
ever disagree one of them converts a second libsodium next to the managed one.

The test now sets the toolchain explicitly and asserts the PlatformIO one takes
the managed path too, so the condition cannot narrow without a test failing.

esphome/components/adc/adc_sensor_common.cpp

@@ -3,7 +3,7 @@
 
 namespace esphome::adc {
 
-static const char *const TAG = "adc.common";
+static const char *const TAG = "adc";
 
 const LogString *sampling_mode_to_str(SamplingMode mode) {
   switch (mode) {

esphome/components/adc/adc_sensor_esp32.cpp

@@ -6,7 +6,7 @@
 
 namespace esphome::adc {
 
-static const char *const TAG = "adc.esp32";
+static const char *const TAG = "adc";
 
 adc_oneshot_unit_handle_t ADCSensor::shared_adc_handles[2] = {nullptr, nullptr};
 

esphome/components/adc/adc_sensor_esp8266.cpp

@@ -13,7 +13,7 @@ ADC_MODE(ADC_VCC)
 
 namespace esphome::adc {
 
-static const char *const TAG = "adc.esp8266";
+static const char *const TAG = "adc";
 
 void ADCSensor::setup() {
 #ifndef USE_ADC_SENSOR_VCC

esphome/components/adc/adc_sensor_libretiny.cpp

@@ -5,7 +5,7 @@
 
 namespace esphome::adc {
 
-static const char *const TAG = "adc.libretiny";
+static const char *const TAG = "adc";
 
 void ADCSensor::setup() {
 #ifndef USE_ADC_SENSOR_VCC

esphome/components/adc/adc_sensor_rp2.cpp

@@ -17,7 +17,7 @@
 
 namespace esphome::adc {
 
-static const char *const TAG = "adc.rp2";
+static const char *const TAG = "adc";
 
 // The on-die temperature sensor sits on the last ADC channel: input 4 on RP2040
 // and RP2350A, but input 8 on RP2350B, which has eight external channels rather

esphome/components/adc/adc_sensor_zephyr.cpp

@@ -7,7 +7,7 @@
 
 namespace esphome::adc {
 
-static const char *const TAG = "adc.zephyr";
+static const char *const TAG = "adc";
 
 void ADCSensor::setup() {
   if (!adc_is_ready_dt(this->channel_)) {

esphome/components/api/__init__.py

@@ -43,6 +43,11 @@ DOMAIN = "api"
 DEPENDENCIES = ["network"]
 CODEOWNERS = ["@esphome/core"]
 
+# Keep in sync with platformio.ini and esphome/idf_component.yml.
+# LIBSODIUM_VERSION must match the version noise-c pins in its idf_component.yml.
+NOISE_C_VERSION = "0.1.18"
+LIBSODIUM_VERSION = "1.10021.2"
+
 
 def AUTO_LOAD(config: ConfigType) -> list[str]:
     """Conditionally auto-load json only when capture_response is used."""
@@ -497,7 +502,28 @@ async def to_code(config: ConfigType) -> None:
             # and plaintext disabled. Only a factory reset can remove it.
             cg.add_define("USE_API_PLAINTEXT")
         cg.add_define("USE_API_NOISE")
-        cg.add_library("esphome/noise-c", "0.1.11")
+        # Both libraries build themselves as ESP-IDF components, so on ESP32
+        # they are pulled straight from the component registry instead of going
+        # through ESPHome's PlatformIO-library converter. Deliberately not
+        # conditional on the toolchain: wireguard splits on the same condition,
+        # and if the two disagree one of them converts a second libsodium next
+        # to the managed one.
+        #
+        # Not on the Arduino framework though: arduino-esp32 depends on
+        # espressif/libsodium of its own (on IDF < 6.0), so the component
+        # manager would see two managed components whose names match once the
+        # namespace is stripped, and refuse to pick between them.
+        if CORE.is_esp32 and not CORE.using_arduino:
+            from esphome.components.esp32 import add_idf_component
+
+            add_idf_component(name="esphome/noise-c", ref=NOISE_C_VERSION)
+            # noise-c pulls libsodium in itself, but declaring it here too keeps
+            # other components that depend on it (wireguard, via esp_wireguard)
+            # from converting a second copy of the PlatformIO library alongside
+            # this managed one, which IDF rejects as a duplicate requirement.
+            add_idf_component(name="esphome/libsodium", ref=LIBSODIUM_VERSION)
+        else:
+            cg.add_library("esphome/noise-c", NOISE_C_VERSION)
         # Enable optimized memzero/memcmp in libsodium instead of volatile byte loops
         cg.add_build_flag("-DHAVE_WEAK_SYMBOLS=1")
         cg.add_build_flag("-DHAVE_INLINE_ASM=1")

esphome/components/api/api_connection.cpp

@@ -160,11 +160,6 @@ APIConnection::APIConnection(std::unique_ptr<socket::Socket> sock, APIServer *pa
 #else
 #error "No frame helper defined"
 #endif
-#ifdef USE_CAMERA
-  if (camera::Camera::instance() != nullptr) {
-    this->image_reader_ = std::unique_ptr<camera::CameraImageReader>{camera::Camera::instance()->create_image_reader()};
-  }
-#endif
 }
 
 void APIConnection::start() {
@@ -1140,6 +1135,7 @@ void APIConnection::try_send_camera_image_() {
   if (!this->image_reader_)
     return;
 
+  const auto *cam = camera::Camera::instance();
   // Send as many chunks as possible without blocking
   while (this->image_reader_->available()) {
     if (!this->helper_->can_write_without_blocking())
@@ -1149,11 +1145,11 @@ void APIConnection::try_send_camera_image_() {
     bool done = this->image_reader_->available() == to_send;
 
     CameraImageResponse msg;
-    msg.key = camera::Camera::instance()->get_object_id_hash();
+    msg.key = cam->get_object_id_hash();
     msg.set_data(this->image_reader_->peek_data_buffer(), to_send);
     msg.done = done;
 #ifdef USE_DEVICES
-    msg.device_id = camera::Camera::instance()->get_device_id();
+    msg.device_id = cam->get_device_id();
 #endif
 
     if (!this->send_message(msg)) {
@@ -1169,15 +1165,19 @@ void APIConnection::try_send_camera_image_() {
 void APIConnection::set_camera_state(std::shared_ptr<camera::CameraImage> image) {
   if (!this->flags_.state_subscription)
     return;
-  if (!this->image_reader_)
+  if (this->image_reader_ && this->image_reader_->available())
     return;
-  if (this->image_reader_->available())
+  if (!image->was_requested_by(esphome::camera::API_REQUESTER) && !image->was_requested_by(esphome::camera::IDLE))
     return;
-  if (image->was_requested_by(esphome::camera::API_REQUESTER) || image->was_requested_by(esphome::camera::IDLE)) {
-    this->image_reader_->set_image(std::move(image));
-    // Try to send immediately to reduce latency
-    this->try_send_camera_image_();
+  if (!this->image_reader_) {
+    // Created on the first image this connection will send, so connections
+    // that never receive one never pay for a reader. Only a registered
+    // camera's listener can reach this, so instance() is non-null here.
+    this->image_reader_ = std::unique_ptr<camera::CameraImageReader>{camera::Camera::instance()->create_image_reader()};
   }
+  this->image_reader_->set_image(std::move(image));
+  // Try to send immediately to reduce latency
+  this->try_send_camera_image_();
 }
 uint16_t APIConnection::try_send_camera_info(EntityBase *entity, APIConnection *conn, uint32_t remaining_size) {
   auto *camera = static_cast<camera::Camera *>(entity);

esphome/components/api/api_frame_helper_noise.cpp

@@ -591,18 +591,21 @@ APIError APINoiseFrameHelper::write_frame_(const uint8_t *data, uint16_t len) {
  */
 APIError APINoiseFrameHelper::init_handshake_() {
   int err;
-  memset(&nid_, 0, sizeof(nid_));
-  // const char *proto = "Noise_NNpsk0_25519_ChaChaPoly_SHA256";
-  // err = noise_protocol_name_to_id(&nid_, proto, strlen(proto));
-  nid_.pattern_id = NOISE_PATTERN_NN;
-  nid_.cipher_id = NOISE_CIPHER_CHACHAPOLY;
-  nid_.dh_id = NOISE_DH_CURVE25519;
-  nid_.prefix_id = NOISE_PREFIX_STANDARD;
-  nid_.hybrid_id = NOISE_DH_NONE;
-  nid_.hash_id = NOISE_HASH_SHA256;
-  nid_.modifier_ids[0] = NOISE_MODIFIER_PSK0;
+  // Noise_NNpsk0_25519_ChaChaPoly_SHA256, built on the stack:
+  // noise_handshakestate_new_by_id copies it, so a member would waste
+  // 104 bytes per connection, and a static const would sit in RAM on
+  // ESP8266 (.rodata is DRAM there).
+  const NoiseProtocolId nid = {
+      .prefix_id = NOISE_PREFIX_STANDARD,
+      .pattern_id = NOISE_PATTERN_NN,
+      .modifier_ids = {NOISE_MODIFIER_PSK0},
+      .dh_id = NOISE_DH_CURVE25519,
+      .cipher_id = NOISE_CIPHER_CHACHAPOLY,
+      .hash_id = NOISE_HASH_SHA256,
+      .hybrid_id = NOISE_DH_NONE,
+  };
 
-  err = noise_handshakestate_new_by_id(&handshake_, &nid_, NOISE_ROLE_RESPONDER);
+  err = noise_handshakestate_new_by_id(&handshake_, &nid, NOISE_ROLE_RESPONDER);
   APIError aerr =
       handle_noise_error_(err, LOG_STR("noise_handshakestate_new_by_id"), APIError::HANDSHAKESTATE_SETUP_FAILED);
   if (aerr != APIError::OK)

esphome/components/api/api_frame_helper_noise.h

@@ -63,9 +63,6 @@ class APINoiseFrameHelper final : public APIFrameHelper {
   // Buffer for noise handshake prologue (released after handshake)
   APIBuffer prologue_;
 
-  // NoiseProtocolId (size depends on implementation)
-  NoiseProtocolId nid_;
-
   // Group small types together
   // Fixed-size header buffer for noise protocol:
   // 1 byte for indicator + 2 bytes for message size (16-bit value, not varint)

esphome/components/bluetooth_connection/bluetooth_connection_bluedroid.cpp

@@ -20,7 +20,7 @@
 
 namespace esphome::bluetooth_connection {
 
-static const char *const TAG = "bluetooth_connection.bluedroid";
+static const char *const TAG = "bluetooth_connection";
 
 using ble_device_base::FAST_CONN_TIMEOUT;
 using ble_device_base::FAST_MAX_CONN_INTERVAL;

esphome/components/bluetooth_connection/bluetooth_connection_rp2.cpp

@@ -15,7 +15,7 @@
 
 namespace esphome::bluetooth_connection {
 
-static const char *const TAG = "bluetooth_connection.rp2";
+static const char *const TAG = "bluetooth_connection";
 
 using ble_device_base::ESPBTUUID;
 using ble_device_base::GATT_ERR_NOT_CONNECTED;

esphome/components/camera/camera.h

@@ -103,7 +103,8 @@ struct CameraImageSpec {
 /** Abstract camera base class. Collaborates with API.
  *  1) API server starts and registers as a listener (add_listener)
  *     to receive new images from the camera.
- *  2) New API client connects and creates a new image reader (create_image_reader).
+ *  2) API connection creates an image reader (create_image_reader) when it receives
+ *     the first image it will send.
  *  3) API connection receives protobuf CameraImageRequest and calls request_image.
  *  3.a) API connection receives protobuf CameraImageRequest and calls start_stream.
  *  4) Camera implementation provides JPEG data in the CameraImage and notifies listeners.

esphome/components/deep_sleep/deep_sleep_bk72xx.cpp

@@ -5,7 +5,7 @@
 
 namespace esphome::deep_sleep {
 
-static const char *const TAG = "deep_sleep.bk72xx";
+static const char *const TAG = "deep_sleep";
 
 #ifdef USE_DEEP_SLEEP_ON_WAKE
 WakeupCause get_wakeup_cause() {

esphome/components/esp32/__init__.py

@@ -3238,7 +3238,12 @@ def _write_idf_component_yml():
             # Don't process arduino libraries
             if name not in ARDUINO_DISABLED_LIBRARIES
         ]
-        for component in generate_idf_components(libraries):
+        # A library that is also declared as a managed component must not be
+        # converted as well, or IDF sees the same requirement from two
+        # components and refuses to build. Converted components still link
+        # against it via ${ESPHOME_PROJECT_MANAGED_COMPONENTS}.
+        managed = set(CORE.data[KEY_ESP32].get(KEY_COMPONENTS, {}))
+        for component in generate_idf_components(libraries, managed=managed):
             dependencies[component.get_sanitized_name()] = {
                 "override_path": str(component.path)
             }

esphome/components/http_request/http_request_arduino.cpp

@@ -16,7 +16,7 @@
 
 namespace esphome::http_request {
 
-static const char *const TAG = "http_request.arduino";
+static const char *const TAG = "http_request";
 #ifdef USE_ESP8266
 // ESP8266 Arduino core (WiFiClientSecureBearSSL.cpp) returns -1000 on OOM
 static constexpr int ESP8266_SSL_ERR_OOM = -1000;

esphome/components/http_request/http_request_host.cpp

@@ -14,7 +14,7 @@
 
 namespace esphome::http_request {
 
-static const char *const TAG = "http_request.host";
+static const char *const TAG = "http_request";
 
 std::shared_ptr<HttpContainer> HttpRequestHost::perform(const std::string &url, const std::string &method,
                                                         const std::string &body,

esphome/components/http_request/http_request_idf.cpp

@@ -16,7 +16,7 @@
 
 namespace esphome::http_request {
 
-static const char *const TAG = "http_request.idf";
+static const char *const TAG = "http_request";
 static constexpr uint32_t ERROR_DURATION_MS = 1000;
 
 void HttpRequestIDF::dump_config() {

esphome/components/i2c/i2c_bus_arduino.cpp

@@ -9,7 +9,7 @@
 
 namespace esphome::i2c {
 
-static const char *const TAG = "i2c.arduino";
+static const char *const TAG = "i2c";
 
 // Maximum bytes to log in hex format (truncates larger transfers)
 static constexpr size_t I2C_MAX_LOG_BYTES = 32;

esphome/components/i2c/i2c_bus_esp_idf.cpp

@@ -12,7 +12,7 @@
 
 namespace esphome::i2c {
 
-static const char *const TAG = "i2c.idf";
+static const char *const TAG = "i2c";
 
 // Maximum bytes to log in hex format (truncates larger transfers)
 static constexpr size_t I2C_MAX_LOG_BYTES = 32;

esphome/components/i2c/i2c_bus_host.cpp

@@ -16,7 +16,7 @@
 
 namespace esphome::i2c {
 
-static const char *const TAG = "i2c.host";
+static const char *const TAG = "i2c";
 
 HostI2CBus::~HostI2CBus() {
   if (this->file_descriptor_ != -1) {

esphome/components/i2c/i2c_bus_zephyr.cpp

@@ -6,7 +6,7 @@
 
 namespace esphome::i2c {
 
-static const char *const TAG = "i2c.zephyr";
+static const char *const TAG = "i2c";
 
 static const char *get_speed(uint32_t dev_config) {
   switch (I2C_SPEED_GET(dev_config)) {

esphome/components/internal_temperature/internal_temperature_bk72xx.cpp

@@ -9,7 +9,7 @@ uint32_t temp_single_get_current_temperature(uint32_t *temp_value);
 
 namespace esphome::internal_temperature {
 
-static const char *const TAG = "internal_temperature.bk72xx";
+static const char *const TAG = "internal_temperature";
 
 void InternalTemperatureSensor::update() {
   float temperature = NAN;

esphome/components/internal_temperature/internal_temperature_esp32.cpp

@@ -16,7 +16,7 @@ uint8_t temprature_sens_read();
 
 namespace esphome::internal_temperature {
 
-static const char *const TAG = "internal_temperature.esp32";
+static const char *const TAG = "internal_temperature";
 
 void InternalTemperatureSensor::update() {
   float temperature = NAN;

esphome/components/internal_temperature/internal_temperature_rp2.cpp

@@ -16,7 +16,7 @@
 
 namespace esphome::internal_temperature {
 
-static const char *const TAG = "internal_temperature.rp2";
+static const char *const TAG = "internal_temperature";
 
 // The on-die temperature sensor sits on the last ADC channel: input 4 on RP2040
 // and RP2350A, but input 8 on RP2350B, which has eight external channels rather

esphome/components/internal_temperature/internal_temperature_zephyr.cpp

@@ -8,7 +8,7 @@
 
 namespace esphome::internal_temperature {
 
-static const char *const TAG = "internal_temperature.zephyr";
+static const char *const TAG = "internal_temperature";
 
 static const struct device *const DIE_TEMPERATURE_SENSOR = DEVICE_DT_GET_ONE(nordic_nrf_temp);
 

esphome/components/ld2420/ld2420.cpp

@@ -184,8 +184,6 @@ static int32_t get_firmware_int(const char *version_string) {
   return result;
 }
 
-float LD2420Component::get_setup_priority() const { return setup_priority::BUS; }
-
 void LD2420Component::dump_config() {
   ESP_LOGCONFIG(TAG,
                 "LD2420:\n"

esphome/components/ld2420/ld2420.h

@@ -105,7 +105,6 @@ class LD2420Component final : public Component, public uart::UARTDevice {
   void apply_config_action();
   void factory_reset_action();
   void revert_config_action();
-  float get_setup_priority() const override;
   int send_cmd_from_array(CmdFrameT cmd_frame);
   void report_gate_data();
   void handle_cmd_error(uint16_t error);

esphome/components/mqtt/mqtt_backend_esp32.cpp

@@ -10,7 +10,7 @@
 
 namespace esphome::mqtt {
 
-static const char *const TAG = "mqtt.idf";
+static const char *const TAG = "mqtt";
 
 bool MQTTBackendESP32::initialize_() {
   mqtt_cfg_.broker.address.hostname = this->host_.c_str();

esphome/components/nextion/nextion_upload_arduino.cpp

@@ -13,7 +13,7 @@
 
 namespace esphome::nextion {
 
-static const char *const TAG = "nextion.upload.arduino";
+static const char *const TAG = "nextion.upload";
 static constexpr size_t NEXTION_MAX_RESPONSE_LOG_BYTES = 16;
 
 // Timeout for display acknowledgment during TFT upload (ms).

esphome/components/nextion/nextion_upload_esp32.cpp

@@ -16,7 +16,7 @@
 
 namespace esphome::nextion {
 
-static const char *const TAG = "nextion.upload.esp32";
+static const char *const TAG = "nextion.upload";
 static constexpr size_t NEXTION_MAX_RESPONSE_LOG_BYTES = 16;
 
 // Timeout for display acknowledgment during TFT upload (ms).

esphome/components/ota/ota_backend_arduino_libretiny.cpp

@@ -9,7 +9,7 @@
 
 namespace esphome::ota {
 
-static const char *const TAG = "ota.arduino_libretiny";
+static const char *const TAG = "ota";
 
 std::unique_ptr<ArduinoLibreTinyOTABackend> make_ota_backend() { return make_unique<ArduinoLibreTinyOTABackend>(); }
 

esphome/components/ota/ota_backend_arduino_rp2.cpp

@@ -11,7 +11,7 @@
 
 namespace esphome::ota {
 
-static const char *const TAG = "ota.arduino_rp2";
+static const char *const TAG = "ota";
 
 std::unique_ptr<ArduinoRP2OTABackend> make_ota_backend() { return make_unique<ArduinoRP2OTABackend>(); }
 

esphome/components/ota/ota_backend_esp8266.cpp

@@ -46,7 +46,7 @@ static constexpr size_t MIN_BUFFER_SIZE = 256;
 
 namespace esphome::ota {
 
-static const char *const TAG = "ota.esp8266";
+static const char *const TAG = "ota";
 
 std::unique_ptr<ESP8266OTABackend> make_ota_backend() { return make_unique<ESP8266OTABackend>(); }
 

esphome/components/ota/ota_backend_esp_idf.cpp

@@ -15,7 +15,7 @@
 
 namespace esphome::ota {
 
-static const char *const TAG = "ota.idf";
+static const char *const TAG = "ota";
 
 std::unique_ptr<IDFOTABackend> make_ota_backend() { return make_unique<IDFOTABackend>(); }
 

esphome/components/ota/ota_backend_host.cpp

@@ -27,7 +27,7 @@ namespace esphome::ota {
 
 namespace {
 
-const char *const TAG = "ota.host";
+const char *const TAG = "ota";
 
 constexpr size_t MAX_OTA_SIZE = 256u * 1024u * 1024u;  // 256 MiB
 constexpr size_t HEADER_PEEK_SIZE = 64;

esphome/components/ota/ota_bootloader_esp_idf.cpp

@@ -11,7 +11,7 @@
 
 namespace esphome::ota {
 
-static const char *const TAG = "ota.idf";
+static const char *const TAG = "ota";
 
 OTAResponseTypes IDFOTABackend::register_and_validate_bootloader_part_() {
   // Register the bootloader partition

esphome/components/ota/ota_partitions_esp_idf.cpp

@@ -16,7 +16,7 @@
 
 namespace esphome::ota {
 
-static const char *const TAG = "ota.idf";
+static const char *const TAG = "ota";
 
 static inline bool check_overlap(uint32_t a_offset, size_t a_size, uint32_t b_offset, size_t b_size) {
   return (a_offset + a_size > b_offset && b_offset + b_size > a_offset);

esphome/components/ota/ota_signature_esp_idf.cpp

@@ -31,7 +31,7 @@
 
 namespace esphome::ota {
 
-static const char *const TAG = "ota.idf";
+static const char *const TAG = "ota";
 
 // Route the "Signature check: " prefix (and its per-block form) through one
 // shared format string each, so the prefix is pooled once by the linker instead

esphome/components/remote_receiver/remote_receiver_rmt.cpp

@@ -9,7 +9,7 @@
 
 namespace esphome::remote_receiver {
 
-static const char *const TAG = "remote_receiver.esp32";
+static const char *const TAG = "remote_receiver";
 
 static bool IRAM_ATTR HOT rmt_callback(rmt_channel_handle_t channel, const rmt_rx_done_event_data_t *event, void *arg) {
   RemoteReceiverComponentStore *store = (RemoteReceiverComponentStore *) arg;

esphome/components/socket/lwip_raw_tcp_impl.cpp

@@ -43,7 +43,7 @@ namespace esphome::socket {
 // (Ethernet). On ESP8266, it's a no-op.
 #define LWIP_LOCK() esphome::LwIPLock lwip_lock_guard  // NOLINT
 
-static const char *const TAG = "socket.lwip";
+static const char *const TAG = "socket";
 
 // set to 1 to enable verbose lwip logging
 #if 0  // NOLINT(readability-avoid-unconditional-preprocessor-if)

esphome/components/spi/spi_arduino.cpp

@@ -4,7 +4,7 @@
 namespace esphome::spi {
 #if defined(USE_ARDUINO) && !defined(USE_ESP32)
 
-static const char *const TAG = "spi-esp-arduino";
+static const char *const TAG = "spi";
 class SPIDelegateHw : public SPIDelegate {
  public:
   SPIDelegateHw(SPIInterface channel, uint32_t data_rate, SPIBitOrder bit_order, SPIMode mode, GPIOPin *cs_pin)

esphome/components/spi/spi_esp_idf.cpp

@@ -4,7 +4,7 @@
 namespace esphome::spi {
 
 #ifdef USE_ESP32
-static const char *const TAG = "spi-esp-idf";
+static const char *const TAG = "spi";
 static const size_t MAX_TRANSFER_SIZE = 4092;  // dictated by ESP-IDF API.
 
 class SPIDelegateHw : public SPIDelegate {

esphome/components/uart/uart_component_esp8266.cpp

@@ -14,7 +14,7 @@
 
 namespace esphome::uart {
 
-static const char *const TAG = "uart.arduino_esp8266";
+static const char *const TAG = "uart";
 bool ESP8266UartComponent::serial0_in_use = false;  // NOLINT(cppcoreguidelines-avoid-non-const-global-variables)
 
 uint32_t ESP8266UartComponent::get_config() {

esphome/components/uart/uart_component_esp_idf.cpp

@@ -21,7 +21,7 @@
 
 namespace esphome::uart {
 
-static const char *const TAG = "uart.idf";
+static const char *const TAG = "uart";
 
 /// Check if a pin number matches one of the default UART0 GPIO pins.
 /// These pins may have residual IOMUX state from the ROM bootloader that

esphome/components/uart/uart_component_host.cpp

@@ -98,7 +98,7 @@ speed_t get_baud(int baud) {
 
 namespace esphome::uart {
 
-static const char *const TAG = "uart.host";
+static const char *const TAG = "uart";
 
 HostUartComponent::~HostUartComponent() {
   if (this->file_descriptor_ != -1) {

esphome/components/uart/uart_component_libretiny.cpp

@@ -16,7 +16,7 @@
 
 namespace esphome::uart {
 
-static const char *const TAG = "uart.lt";
+static const char *const TAG = "uart";
 
 static const char *const UART_TYPE[] = {
     "hardware",

esphome/components/uart/uart_component_rp2.cpp

@@ -13,7 +13,7 @@
 
 namespace esphome::uart {
 
-static const char *const TAG = "uart.arduino_rp2";
+static const char *const TAG = "uart";
 
 uint16_t RP2UartComponent::get_config() {
   uint16_t config = 0;

esphome/espidf/clang_tidy.py

@@ -232,6 +232,17 @@ def _parse_lib_deps(platformio_ini: Path, framework: str):
     return libs
 
 
+def _esphome_manifest_deps() -> set[str]:
+    """Names of the managed components declared in ``esphome/idf_component.yml``."""
+    import yaml
+
+    esphome_dir = Path(__file__).resolve().parent.parent
+    manifest = yaml.safe_load(
+        (esphome_dir / "idf_component.yml").read_text(encoding="utf-8")
+    )
+    return set(manifest.get("dependencies") or {})
+
+
 def _convert_pio_libs(
     platformio_ini: Path, framework: str
 ) -> dict[str, dict[str, str]]:
@@ -244,12 +255,20 @@ def _convert_pio_libs(
     The whole library set is resolved as a single batch so a shared transitive
     dependency (e.g. esphome/libsodium pulled by both noise-c and esp_wireguard)
     is deduplicated to one component instead of clashing override_path entries.
+
+    Libraries ESPHome's own manifest already provides as managed components
+    (noise-c, libsodium, ...) are skipped, mirroring what the real esp32 build
+    does -- converting them too would make IDF see the same requirement twice.
+    On Arduino those entries are rule-disabled in the manifest (arduino-esp32
+    brings its own libsodium), so nothing provides them there and they have to
+    go through the converter as before.
     """
     from esphome.espidf.component import generate_idf_components
 
     libraries = _parse_lib_deps(platformio_ini, framework)
+    managed = set() if framework == "arduino" else _esphome_manifest_deps()
     deps: dict[str, dict[str, str]] = {}
-    for component in generate_idf_components(libraries):
+    for component in generate_idf_components(libraries, managed=managed):
         deps[component.get_sanitized_name()] = {"override_path": str(component.path)}
     return deps
 
@@ -267,19 +286,13 @@ def _arduino_excluded_stubs(work_dir: Path) -> dict[str, dict]:
     ethernet) are NOT stubbed -- those are real deps we need, and arduino-esp32
     resolves to the same component rather than conflicting.
     """
-    import yaml
-
     from esphome.components.esp32 import (
         ARDUINO_EXCLUDED_IDF_COMPONENTS,
         _idf_component_dep_name,
         _idf_component_stub_name,
     )
 
-    esphome_dir = Path(__file__).resolve().parent.parent
-    base_manifest = yaml.safe_load(
-        (esphome_dir / "idf_component.yml").read_text(encoding="utf-8")
-    )
-    esphome_deps = set(base_manifest.get("dependencies") or {})
+    esphome_deps = _esphome_manifest_deps()
 
     stubs_dir = work_dir / "component_stubs"
     stubs_dir.mkdir(parents=True, exist_ok=True)

esphome/espidf/component.py

@@ -310,12 +310,22 @@ def _emit_idf_component(component: IDFComponent) -> None:
     )
 
 
-def generate_idf_components(libraries: list[Library]) -> list[IDFComponent]:
-    """Resolve and convert a batch of PlatformIO libraries to IDF components."""
+def generate_idf_components(
+    libraries: list[Library], managed: set[str] | None = None
+) -> list[IDFComponent]:
+    """Resolve and convert a batch of PlatformIO libraries to IDF components.
+
+    ``managed`` names the registry components already declared in the project
+    manifest (via ``add_idf_component``). Those are skipped by the converter --
+    a library must not be both converted and managed, or IDF fails component
+    discovery with "Requirement <owner>__<name> and requirement <name> are both
+    added as project_managed_components". Converted components pick the managed
+    one up through ``${ESPHOME_PROJECT_MANAGED_COMPONENTS}`` in their REQUIRES.
+    """
     backend = LibraryBackend(
         platform=ESP32_PLATFORM,
         framework=_idf_framework(),
         emit=_emit_idf_component,
         cache_key="idf",
     )
-    return convert_libraries(libraries, backend)
+    return convert_libraries(libraries, backend, provided=managed)

esphome/idf_component.yml

@@ -106,3 +106,16 @@ dependencies:
     version: d44c800a9e876a8394caefc2ce4915dd96dac77b
     rules:
       - if: "$ESPHOME_ARDUINO_COMPONENT == 1"
+  # api. Not on Arduino: arduino-esp32 pulls espressif/libsodium, and IDF
+  # refuses to build two managed components whose names differ only by
+  # namespace. The Arduino envs get noise-c as a PlatformIO library instead.
+  esphome/noise-c:
+    version: 0.1.18
+    rules:
+      - if: "$ESPHOME_ARDUINO_COMPONENT == 0"
+  # Declared even though noise-c depends on it, so that the PlatformIO-library
+  # converter knows to skip the copy esp_wireguard would otherwise pull in.
+  esphome/libsodium:
+    version: 1.10021.2
+    rules:
+      - if: "$ESPHOME_ARDUINO_COMPONENT == 0"

esphome/platformio/library.py

@@ -689,7 +689,9 @@ def _node_key(
 
 
 def convert_libraries(
-    libraries: list[Library], backend: LibraryBackend
+    libraries: list[Library],
+    backend: LibraryBackend,
+    provided: set[str] | None = None,
 ) -> list[ConvertedLibrary]:
     """Resolve and convert a batch of PlatformIO libraries for ``backend``.
 
@@ -710,28 +712,36 @@ def convert_libraries(
     ``lib_ignore`` from ``esphome->platformio_options`` excludes libraries by
     short name (part after the ``/``), matched against both the top-level
     libraries and every dependency discovered during the graph walk.
+
+    ``provided`` names libraries the toolchain already supplies by other means
+    (for ESP-IDF: registry-managed components declared via
+    ``add_idf_component``). They are excluded exactly like ``lib_ignore``, so a
+    library is never both converted and managed -- ESP-IDF refuses to build when
+    two components claim the same requirement.
     """
     nodes: dict[str, _LibNode] = {}
 
-    lib_ignore = {
+    excluded = {
         name.split("/")[-1].lower()
-        for name in CORE.platformio_options.get("lib_ignore", [])
+        for name in itertools.chain(
+            CORE.platformio_options.get("lib_ignore", []), provided or ()
+        )
     }
 
     # The generated build files inside the shared cache bake in the dependency
-    # wiring, which lib_ignore changes; salt the cache path so configs with
-    # different lib_ignore values don't fight over (and constantly rewrite) the
+    # wiring, which the exclusion set changes; salt the cache path so configs
+    # with different exclusions don't fight over (and constantly rewrite) the
     # same converted component files.
     salt = (
-        hashlib.sha256(",".join(sorted(lib_ignore)).encode()).hexdigest()[:8]
-        if lib_ignore
+        hashlib.sha256(",".join(sorted(excluded)).encode()).hexdigest()[:8]
+        if excluded
         else ""
     )
 
     def is_ignored(name: str | None) -> bool:
-        if not lib_ignore or name is None:
+        if not excluded or name is None:
             return False
-        return name.split("/")[-1].lower() in lib_ignore
+        return name.split("/")[-1].lower() in excluded
 
     def add_spec(name: str | None, version: str | None, repository: str | None) -> str:
         key, kind, locator = _node_key(name, version, repository)

platformio.ini

@@ -45,7 +45,6 @@ lib_deps_base =
 lib_deps =
     ${common.lib_deps_base}
     https://github.com/dudanov/MideaUART.git#eeea6c3e9b4474f067054592b435be1c4e466815 ; midea
-    esphome/noise-c@0.1.11                 ; api
     improv/Improv@1.2.6                    ; improv_serial / esp32_improv
     kikuchan98/pngle@1.1.0                 ; online_image
     ; Using the repository directly, otherwise ESP-IDF can't use the library
@@ -77,6 +76,9 @@ lib_compat_mode = strict
 extends = common
 lib_deps =
     ${common.lib_deps}
+    ; api -- on the ESP-IDF framework this comes from the component registry
+    ; instead (see esphome/idf_component.yml), so it is not in [common].
+    esphome/noise-c@0.1.18                                ; api
     SPI                                                   ; spi (Arduino built-in)
     Wire                                                  ; i2c (Arduino built-int)
     heman/AsyncMqttClient-esphome@1.0.0                   ; mqtt
@@ -244,7 +246,7 @@ lib_deps =
     ${common:idf-component-libs.lib_deps}
     ESP32Async/ESPAsyncWebServer@3.9.6    ; web_server_base
     droscy/esp_wireguard@0.4.5            ; wireguard
-    esphome/noise-c@0.1.11                ; api
+    esphome/noise-c@0.1.18                ; api
     ESP32Async/AsyncTCP@3.4.5             ; async_tcp
     DNSServer                             ; captive_portal
     heman/AsyncMqttClient-esphome@2.0.0   ; mqtt
@@ -641,7 +643,7 @@ build_unflags =
 extends = common
 platform = platformio/native
 lib_deps =
-    esphome/noise-c@0.1.11  ; used by api
+    esphome/noise-c@0.1.18  ; used by api
     lvgl/lvgl@9.5.0         ; lvgl
 build_flags =
     ${common.build_flags}

requirements.txt

@@ -12,7 +12,7 @@ pyserial==3.5
 platformio==6.1.19
 esptool==5.3.1
 click==8.3.3
-aioesphomeapi==45.10.2
+aioesphomeapi==45.10.3
 aiohappyeyeballs==2.7.1  # Happy Eyeballs for requests downloads; already pulled in by aioesphomeapi
 zeroconf==0.150.0
 puremagic==2.2.0

script/ci_memory_impact_comment.py

@@ -20,17 +20,21 @@ from jinja2 import Environment, FileSystemLoader
 sys.path.insert(0, str(Path(__file__).parent.parent))
 
 # pylint: disable=wrong-import-position
+from helpers import run_gh_command  # noqa: E402
 
 # Comment marker to identify our memory impact comments
 COMMENT_MARKER = "<!-- esphome-memory-impact-analysis -->"
 
 
-def run_gh_command(args: list[str], operation: str) -> subprocess.CompletedProcess:
-    """Run a gh CLI command with error handling.
+def run_gh_command_logged(
+    args: list[str], operation: str, *, retry: bool = True
+) -> subprocess.CompletedProcess:
+    """Run a gh CLI command with retries and error reporting.
 
     Args:
         args: Command arguments (including 'gh')
         operation: Description of the operation for error messages
+        retry: Pass False for non-idempotent commands (see run_gh_command)
 
     Returns:
         CompletedProcess result
@@ -39,12 +43,7 @@ def run_gh_command(args: list[str], operation: str) -> subprocess.CompletedProce
         subprocess.CalledProcessError: If command fails (with detailed error output)
     """
     try:
-        return subprocess.run(
-            args,
-            check=True,
-            capture_output=True,
-            text=True,
-        )
+        return run_gh_command(args, retry=retry)
     except subprocess.CalledProcessError as e:
         print(
             f"ERROR: {operation} failed with exit code {e.returncode}", file=sys.stderr
@@ -472,7 +471,7 @@ def find_existing_comment(pr_number: str) -> str | None:
     print(f"DEBUG: Looking for existing comment on PR #{pr_number}", file=sys.stderr)
 
     # Use gh api to get comments directly - this returns the numeric id field
-    result = run_gh_command(
+    result = run_gh_command_logged(
         [
             "gh",
             "api",
@@ -535,7 +534,7 @@ def update_existing_comment(comment_id: str, comment_body: str) -> None:
     """
     print(f"DEBUG: Updating existing comment {comment_id}", file=sys.stderr)
     print(f"DEBUG: Comment body length: {len(comment_body)} bytes", file=sys.stderr)
-    result = run_gh_command(
+    result = run_gh_command_logged(
         [
             "gh",
             "api",
@@ -562,9 +561,12 @@ def create_new_comment(pr_number: str, comment_body: str) -> None:
     """
     print(f"DEBUG: Posting new comment on PR #{pr_number}", file=sys.stderr)
     print(f"DEBUG: Comment body length: {len(comment_body)} bytes", file=sys.stderr)
-    result = run_gh_command(
+    # Creating a comment is not idempotent: a retry after a dropped response
+    # could post the same comment twice, so fail on the first error instead.
+    result = run_gh_command_logged(
         ["gh", "pr", "comment", pr_number, "--body", comment_body],
         operation="Create PR comment",
+        retry=False,
     )
     print(f"DEBUG: Post response: {result.stdout}", file=sys.stderr)
 

script/helpers.py

@@ -469,6 +469,77 @@ def get_target_branch() -> str | None:
     return None
 
 
+# Substrings (matched case-insensitively against gh's stderr) that identify
+# transient failures worth retrying: server errors (HTTP 5xx) and dropped or
+# failed connections. Permanent failures (bad auth, missing PR, the 300-file
+# diff limit) never match so callers see them immediately. Phrases are
+# anchored so gh's GraphQL "Could not resolve to a PullRequest" (a missing
+# PR) never classifies as a DNS failure.
+_TRANSIENT_GH_ERROR_RE = re.compile(
+    r"http 5\d\d"
+    r"|timed out|timeout"
+    r"|connection (?:reset|refused|closed)"
+    r"|no such host|could not resolve host"
+    # gh intercepts DNS errors and prints its own "error connecting to
+    # <host>" text; the Go phrases above are kept as a hedge in case a
+    # future gh stops swallowing the underlying error
+    r"|error connecting to"
+    r"|failed to verify certificate"
+    # Go reports a server-closed connection as 'Post "<url>": EOF'; the
+    # quote-and-colon anchor keeps a URL or message body containing the
+    # letters from matching
+    r"|unexpected eof"
+    r'|": eof'
+    r"|network is unreachable"
+    r"|temporary failure"
+)
+
+# Same retry policy as git network commands in esphome/git.py: 3 attempts
+# with 2s/4s backoff.
+_GH_MAX_ATTEMPTS = 3
+
+
+def run_gh_command(
+    args: list[str], *, retry: bool = True
+) -> subprocess.CompletedProcess[str]:
+    """Run a gh CLI command, retrying transient network and server failures.
+
+    Args:
+        args: Full command line, including the leading "gh".
+        retry: Pass False for commands that are not idempotent (e.g. posting
+            a comment), where a retry after a dropped response could repeat
+            a write that already succeeded server-side.
+
+    Returns:
+        CompletedProcess with captured text output.
+
+    Raises:
+        subprocess.CalledProcessError: If the command fails with a permanent
+            error, or is still failing after the retries are exhausted.
+    """
+    attempts = _GH_MAX_ATTEMPTS if retry else 1
+    attempt = 0
+    while True:
+        try:
+            return subprocess.run(
+                args, check=True, capture_output=True, text=True, close_fds=False
+            )
+        except subprocess.CalledProcessError as err:
+            attempt += 1
+            stderr = err.stderr or ""
+            if attempt >= attempts or not _TRANSIENT_GH_ERROR_RE.search(stderr.lower()):
+                raise
+            delay = 2**attempt
+            # Only the leading arguments: comment-update calls carry the
+            # whole multi-KB comment body in the argument list
+            print(
+                f"WARNING: {' '.join(args[:3])} failed: {stderr.strip()}; "
+                f"retrying in {delay}s (attempt {attempt}/{attempts})",
+                file=sys.stderr,
+            )
+            time.sleep(delay)
+
+
 @cache
 def _get_changed_files_github_actions() -> list[str] | None:
     """Get changed files in GitHub Actions environment.
@@ -542,10 +613,22 @@ def changed_files(branch: str | None = None) -> list[str]:
 
 
 def _get_changed_files_from_command(command: list[str]) -> list[str]:
-    """Run a git command to get changed files and return them as a list."""
-    proc = subprocess.run(command, capture_output=True, text=True, check=False)
-    if proc.returncode != 0:
-        raise Exception(f"Command failed: {' '.join(command)}\nstderr: {proc.stderr}")
+    """Run a git or gh command to get changed files and return them as a list."""
+    if command[0] == "gh":
+        try:
+            proc = run_gh_command(command)
+        except subprocess.CalledProcessError as e:
+            raise Exception(
+                f"Command failed: {' '.join(command)}\nstderr: {e.stderr}"
+            ) from e
+    else:
+        proc = subprocess.run(
+            command, capture_output=True, text=True, check=False, close_fds=False
+        )
+        if proc.returncode != 0:
+            raise Exception(
+                f"Command failed: {' '.join(command)}\nstderr: {proc.stderr}"
+            )
 
     changed_files = splitlines_no_ends(proc.stdout)
     cwd = Path.cwd()

tests/integration/fixtures/camera_mock.yaml

@@ -0,0 +1,19 @@
+esphome:
+  name: camera-mock-test
+
+host:
+api:
+logger:
+  level: VERBOSE
+
+external_components:
+  - source:
+      type: local
+      path: EXTERNAL_COMPONENT_PATH
+
+mock_camera:
+  name: Mock Camera
+  # Larger than MAX_BATCH_PACKET_SIZE (1390) so the image is split across
+  # multiple CameraImageResponse chunks and the client must reassemble.
+  # Must match IMAGE_SIZE in test_camera_mock.py.
+  image_size: 4096

tests/integration/fixtures/external_components/mock_camera/__init__.py

@@ -0,0 +1,28 @@
+import esphome.codegen as cg
+import esphome.config_validation as cv
+from esphome.const import CONF_ID
+from esphome.core.entity_helpers import setup_entity
+from esphome.types import ConfigType
+
+CODEOWNERS = ["@esphome/tests"]
+AUTO_LOAD = ["camera"]
+
+CONF_IMAGE_SIZE = "image_size"
+
+mock_camera_ns = cg.esphome_ns.namespace("mock_camera")
+MockCamera = mock_camera_ns.class_("MockCamera", cg.Component, cg.EntityBase)
+
+CONFIG_SCHEMA = cv.ENTITY_BASE_SCHEMA.extend(
+    {
+        cv.GenerateID(): cv.declare_id(MockCamera),
+        cv.Optional(CONF_IMAGE_SIZE, default=1024): cv.positive_not_null_int,
+    }
+).extend(cv.COMPONENT_SCHEMA)
+
+
+async def to_code(config: ConfigType) -> None:
+    cg.add_define("USE_CAMERA")
+    var = cg.new_Pvariable(config[CONF_ID])
+    await setup_entity(var, config, "camera")
+    await cg.register_component(var, config)
+    cg.add(var.set_image_size(config[CONF_IMAGE_SIZE]))

tests/integration/fixtures/external_components/mock_camera/mock_camera.cpp

@@ -0,0 +1,30 @@
+#include "mock_camera.h"
+#include "esphome/core/application.h"
+#include "esphome/core/log.h"
+
+namespace esphome::mock_camera {
+
+static const char *const TAG = "mock_camera";
+
+void MockCamera::loop() {
+  uint8_t requesters = this->single_requesters_ | this->stream_requesters_;
+  if (requesters == 0)
+    return;
+  uint32_t now = App.get_loop_component_start_time();
+  if (now - this->last_frame_ms_ < FRAME_INTERVAL_MS)
+    return;
+  this->last_frame_ms_ = now;
+  this->single_requesters_ = 0;
+
+  auto image = std::make_shared<MockCameraImage>(this->image_size_, this->frame_counter_, requesters);
+  ESP_LOGV(TAG, "Producing frame %u (%u bytes, requesters 0x%02X)", this->frame_counter_, this->image_size_,
+           requesters);
+  this->frame_counter_++;
+  for (auto *listener : this->listeners_) {
+    listener->on_camera_image(image);
+  }
+}
+
+void MockCamera::dump_config() { ESP_LOGCONFIG(TAG, "Mock Camera (%u byte frames)", this->image_size_); }
+
+}  // namespace esphome::mock_camera

tests/integration/fixtures/external_components/mock_camera/mock_camera.h

@@ -0,0 +1,80 @@
+#pragma once
+
+#include "esphome/components/camera/camera.h"
+#include "esphome/core/component.h"
+
+#include <memory>
+#include <vector>
+
+namespace esphome::mock_camera {
+
+/** Deterministic in-memory camera image.
+ *  Byte i of frame N is (N + i) & 0xFF so tests can validate
+ *  reassembled data from just the first byte.
+ */
+class MockCameraImage : public camera::CameraImage {
+ public:
+  MockCameraImage(size_t size, uint8_t frame_counter, uint8_t requesters)
+      : data_(new uint8_t[size]), size_(size), requesters_(requesters) {
+    for (size_t i = 0; i < size; i++) {
+      this->data_[i] = static_cast<uint8_t>(frame_counter + i);
+    }
+  }
+  uint8_t *get_data_buffer() override { return this->data_.get(); }
+  size_t get_data_length() override { return this->size_; }
+  bool was_requested_by(camera::CameraRequester requester) const override {
+    return (this->requesters_ & (1 << requester)) != 0;
+  }
+
+ protected:
+  std::unique_ptr<uint8_t[]> data_;
+  size_t size_;
+  uint8_t requesters_;
+};
+
+class MockCameraImageReader : public camera::CameraImageReader {
+ public:
+  void set_image(std::shared_ptr<camera::CameraImage> image) override {
+    this->image_ = std::move(image);
+    this->offset_ = 0;
+  }
+  size_t available() const override { return this->image_ ? this->image_->get_data_length() - this->offset_ : 0; }
+  uint8_t *peek_data_buffer() override { return this->image_->get_data_buffer() + this->offset_; }
+  void consume_data(size_t consumed) override { this->offset_ += consumed; }
+  void return_image() override {
+    this->image_.reset();
+    this->offset_ = 0;
+  }
+
+ protected:
+  std::shared_ptr<camera::CameraImage> image_;
+  size_t offset_{0};
+};
+
+/** Virtual camera producing deterministic frames on request or stream. */
+class MockCamera : public camera::Camera {
+ public:
+  void loop() override;
+  void dump_config() override;
+
+  void add_listener(camera::CameraListener *listener) override { this->listeners_.push_back(listener); }
+  camera::CameraImageReader *create_image_reader() override { return new MockCameraImageReader(); }
+  void request_image(camera::CameraRequester requester) override { this->single_requesters_ |= (1 << requester); }
+  void start_stream(camera::CameraRequester requester) override { this->stream_requesters_ |= (1 << requester); }
+  void stop_stream(camera::CameraRequester requester) override { this->stream_requesters_ &= ~(1 << requester); }
+
+  void set_image_size(uint32_t size) { this->image_size_ = size; }
+
+ protected:
+  static constexpr uint32_t FRAME_INTERVAL_MS = 50;
+
+  // Members ordered largest to smallest to minimize padding
+  std::vector<camera::CameraListener *> listeners_;
+  uint32_t image_size_{1024};
+  uint32_t last_frame_ms_{0};
+  uint8_t frame_counter_{0};
+  uint8_t single_requesters_{0};
+  uint8_t stream_requesters_{0};
+};
+
+}  // namespace esphome::mock_camera

tests/integration/test_camera_mock.py

@@ -0,0 +1,73 @@
+"""Integration test for the camera API flow using a mock camera platform."""
+
+from __future__ import annotations
+
+import asyncio
+
+from aioesphomeapi import CameraInfo, CameraState, EntityState
+import pytest
+
+from .state_utils import require_entity
+from .types import APIClientConnectedFactory, RunCompiledFunction
+
+# Must match image_size in fixtures/camera_mock.yaml
+IMAGE_SIZE = 4096
+STREAM_FRAMES = 3
+
+
+def _verify_frame(data: bytes) -> int:
+    """Verify the deterministic frame pattern and return the frame counter."""
+    assert len(data) == IMAGE_SIZE, f"expected {IMAGE_SIZE} bytes, got {len(data)}"
+    counter = data[0]
+    assert data == bytes((counter + i) & 0xFF for i in range(IMAGE_SIZE)), (
+        "frame pattern mismatch"
+    )
+    return counter
+
+
+@pytest.mark.asyncio
+async def test_camera_mock(
+    yaml_config: str,
+    run_compiled: RunCompiledFunction,
+    api_client_connected: APIClientConnectedFactory,
+) -> None:
+    """Single-image and stream requests deliver reassembled deterministic frames."""
+    async with run_compiled(yaml_config), api_client_connected() as client:
+        entities, _ = await client.list_entities_services()
+        camera = require_entity(entities, "mock_camera", CameraInfo)
+
+        loop = asyncio.get_running_loop()
+        images: list[bytes] = []
+        single_image: asyncio.Future[None] = loop.create_future()
+        stream_done: asyncio.Future[None] = loop.create_future()
+
+        def on_state(state: EntityState) -> None:
+            if not (isinstance(state, CameraState) and state.key == camera.key):
+                return
+            images.append(bytes(state.data))
+            if not single_image.done():
+                single_image.set_result(None)
+            elif len(images) >= STREAM_FRAMES and not stream_done.done():
+                stream_done.set_result(None)
+
+        client.subscribe_states(on_state)
+
+        # Single image request: one complete frame arrives, reassembled
+        # from multiple chunks (4096 > 1390 byte packets)
+        client.request_single_image()
+        await asyncio.wait_for(single_image, timeout=10)
+        first_counter = _verify_frame(images[0])
+
+        # Stream request: multiple consecutive frames arrive
+        images.clear()
+        client.request_image_stream()
+        await asyncio.wait_for(stream_done, timeout=10)
+
+        # Frames are distinct, ordered, and fresh per the mock's counter.
+        # Not exactly consecutive: the API drops frames by design while the
+        # previous image is still being sent, so allow small gaps.
+        counters = [_verify_frame(img) for img in images[:STREAM_FRAMES]]
+        for prev, cur in zip(counters, counters[1:], strict=False):
+            assert cur != prev, f"duplicate frames: {counters}"
+            assert ((cur - prev) & 0xFF) < 16, f"frames out of order: {counters}"
+        assert counters[0] != first_counter, "stream should produce new frames"

tests/script/test_helpers.py

@@ -20,6 +20,7 @@ changed_files = helpers.changed_files
 filter_changed = helpers.filter_changed
 get_changed_components = helpers.get_changed_components
 _get_changed_files_from_command = helpers._get_changed_files_from_command
+run_gh_command = helpers.run_gh_command
 _get_pr_number_from_github_env = helpers._get_pr_number_from_github_env
 _get_changed_files_github_actions = helpers._get_changed_files_github_actions
 _filter_changed_ci = helpers._filter_changed_ci
@@ -1872,3 +1873,123 @@ def test_is_validate_only_file(filename: str, expected: bool, tmp_path: Path) ->
 def test_base_python_changed(files: list[str], expected: bool) -> None:
     """Only Python modules directly in esphome/ count as base Python changes."""
     assert helpers.base_python_changed(files) is expected
+
+
+def _gh_error(stderr: str) -> subprocess.CalledProcessError:
+    return subprocess.CalledProcessError(1, ["gh"], output="", stderr=stderr)
+
+
+def _gh_success(stdout: str = "ok\n") -> subprocess.CompletedProcess:
+    return subprocess.CompletedProcess(["gh"], 0, stdout=stdout, stderr="")
+
+
+def test_run_gh_command_success() -> None:
+    """A successful command returns without retrying."""
+    with patch("helpers.subprocess.run", return_value=_gh_success()) as mock_run:
+        result = run_gh_command(["gh", "pr", "diff", "123", "--name-only"])
+
+    assert result.stdout == "ok\n"
+    mock_run.assert_called_once()
+
+
+@pytest.mark.parametrize(
+    "second_error",
+    [
+        (
+            'Post "https://api.github.com/graphql": tls: failed to verify'
+            " certificate: x509: certificate is not valid for any names,"
+            " but wanted to match api.github.com"
+        ),
+        'Post "https://api.github.com/graphql": EOF',
+        (
+            "error connecting to api.github.com\n"
+            "check your internet connection or https://githubstatus.com"
+        ),
+    ],
+)
+def test_run_gh_command_retries_transient_error(second_error: str) -> None:
+    """Transient server errors are retried with 2s/4s backoff."""
+    with (
+        patch(
+            "helpers.subprocess.run",
+            side_effect=[
+                _gh_error("HTTP 502: 502 Bad Gateway (https://api.github.com/graphql)"),
+                _gh_error(second_error),
+                _gh_success(),
+            ],
+        ) as mock_run,
+        patch("helpers.time.sleep") as mock_sleep,
+    ):
+        result = run_gh_command(["gh", "pr", "diff", "123", "--name-only"])
+
+    assert result.stdout == "ok\n"
+    assert mock_run.call_count == 3
+    assert [call.args[0] for call in mock_sleep.call_args_list] == [2, 4]
+
+
+def test_run_gh_command_gives_up_after_max_attempts() -> None:
+    """A persistent transient error raises after the third attempt."""
+    with (
+        patch(
+            "helpers.subprocess.run",
+            side_effect=_gh_error("HTTP 503: Service Unavailable"),
+        ) as mock_run,
+        patch("helpers.time.sleep") as mock_sleep,
+        pytest.raises(subprocess.CalledProcessError),
+    ):
+        run_gh_command(["gh", "pr", "diff", "123", "--name-only"])
+
+    assert mock_run.call_count == 3
+    assert mock_sleep.call_count == 2
+
+
+@pytest.mark.parametrize(
+    "stderr",
+    [
+        "HTTP 404: Not Found (https://api.github.com/repos/x)",
+        "HTTP 401: Bad credentials",
+        "HTTP 403: API rate limit exceeded for installation ID 123.",
+        "diff exceeded the maximum number of changed files (300)",
+        (
+            "GraphQL: Could not resolve to a PullRequest with the number of 999999."
+            " (repository.pullRequest)"
+        ),
+    ],
+)
+def test_run_gh_command_permanent_error_not_retried(stderr: str) -> None:
+    """Permanent failures raise immediately without any retry."""
+    with (
+        patch("helpers.subprocess.run", side_effect=_gh_error(stderr)) as mock_run,
+        patch("helpers.time.sleep") as mock_sleep,
+        pytest.raises(subprocess.CalledProcessError),
+    ):
+        run_gh_command(["gh", "pr", "diff", "123", "--name-only"])
+
+    mock_run.assert_called_once()
+    mock_sleep.assert_not_called()
+
+
+def test_run_gh_command_no_retry_for_non_idempotent_commands() -> None:
+    """retry=False fails on the first error even when it looks transient."""
+    with (
+        patch(
+            "helpers.subprocess.run",
+            side_effect=_gh_error("HTTP 502: 502 Bad Gateway"),
+        ) as mock_run,
+        patch("helpers.time.sleep") as mock_sleep,
+        pytest.raises(subprocess.CalledProcessError),
+    ):
+        run_gh_command(["gh", "pr", "comment", "123", "--body", "x"], retry=False)
+
+    mock_run.assert_called_once()
+    mock_sleep.assert_not_called()
+
+
+def test_get_changed_files_from_command_gh_failure_keeps_stderr() -> None:
+    """Failures from gh surface stderr so callers can detect the 300-file limit."""
+    stderr = "diff exceeded the maximum number of changed files (300)"
+    with (
+        patch("helpers.subprocess.run", side_effect=_gh_error(stderr)),
+        pytest.raises(Exception, match="maximum number of changed files"),
+    ):
+        _get_changed_files_from_command(["gh", "pr", "diff", "123", "--name-only"])

tests/unit_tests/components/api/test_api_to_code.py

@@ -0,0 +1,179 @@
+"""Tests for the noise-c/libsodium library wiring in api's to_code.
+
+On ESP32 (but not the Arduino framework) both libraries build themselves as
+native ESP-IDF managed components, so they are declared via add_idf_component()
+instead of going through ESPHome's PlatformIO-library converter, on either
+toolchain. Elsewhere noise-c still goes through that converter via
+cg.add_library(): on the Arduino framework because arduino-esp32 depends on
+espressif/libsodium of its own, and off ESP32 because there are no IDF
+components at all. This drives the real to_code() coroutine so every branch of
+that decision is exercised end to end, not just mocked.
+"""
+
+from __future__ import annotations
+
+import asyncio
+import base64
+from unittest.mock import MagicMock
+
+import pytest
+
+import esphome.codegen as cg
+from esphome.components import api, esp32
+import esphome.config_validation as cv
+from esphome.const import (
+    KEY_CORE,
+    KEY_TARGET_FRAMEWORK,
+    KEY_TARGET_PLATFORM,
+    Framework,
+    Platform,
+    Toolchain,
+)
+from esphome.core import CORE, ID
+
+
+def _build_config(encryption_key: str) -> dict:
+    """A minimal, already-validated api config with encryption enabled."""
+    return {
+        api.CONF_ID: ID("api_id", is_declaration=True, type=api.APIServer),
+        api.CONF_PORT: 6053,
+        api.CONF_REBOOT_TIMEOUT: cv.positive_time_period_milliseconds("15min"),
+        api.CONF_BATCH_DELAY: cv.positive_time_period_milliseconds("100ms"),
+        api.CONF_MAX_CONNECTIONS: 5,
+        api.CONF_MAX_SEND_QUEUE: 8,
+        api.CONF_CUSTOM_SERVICES: False,
+        api.CONF_HOMEASSISTANT_SERVICES: False,
+        api.CONF_HOMEASSISTANT_STATES: False,
+        api.CONF_ENCRYPTION: {api.CONF_KEY: encryption_key},
+    }
+
+
+@pytest.fixture(name="encryption_key")
+def fixture_encryption_key() -> str:
+    return base64.b64encode(b"0" * 32).decode()
+
+
+def _setup_core(platform: Platform, framework: Framework, toolchain: Toolchain) -> None:
+    CORE.reset()
+    CORE.toolchain = toolchain
+    CORE.data[KEY_CORE] = {
+        KEY_TARGET_PLATFORM: str(platform),
+        KEY_TARGET_FRAMEWORK: str(framework),
+    }
+    if platform == Platform.ESP32:
+        CORE.data[esp32.KEY_ESP32] = {esp32.KEY_VARIANT: "ESP32"}
+
+
+def test_to_code_esp32_idf_encryption_uses_managed_idf_components(
+    encryption_key: str,
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    """On ESP32 + the ESP-IDF toolchain, noise-c and libsodium are declared as
+    managed IDF components (add_idf_component), not converted PlatformIO
+    libraries."""
+    _setup_core(Platform.ESP32, Framework.ESP_IDF, Toolchain.ESP_IDF)
+    config = _build_config(encryption_key)
+    CORE.component_ids.add("api_id")
+
+    add_idf_component_calls: list[dict] = []
+    monkeypatch.setattr(
+        esp32,
+        "add_idf_component",
+        lambda **kwargs: add_idf_component_calls.append(kwargs),
+    )
+    add_library_mock = MagicMock()
+    monkeypatch.setattr(cg, "add_library", add_library_mock)
+
+    asyncio.run(api.to_code(config))
+
+    assert add_idf_component_calls == [
+        {"name": "esphome/noise-c", "ref": api.NOISE_C_VERSION},
+        {"name": "esphome/libsodium", "ref": api.LIBSODIUM_VERSION},
+    ]
+    add_library_mock.assert_not_called()
+
+
+def test_to_code_esp32_arduino_encryption_uses_add_library(
+    encryption_key: str,
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    """On the Arduino framework, arduino-esp32 brings its own bundled
+    espressif/libsodium, so noise-c must still go through the PlatformIO-
+    library converter (cg.add_library) instead of add_idf_component()."""
+    _setup_core(Platform.ESP32, Framework.ARDUINO, Toolchain.ESP_IDF)
+    config = _build_config(encryption_key)
+    CORE.component_ids.add("api_id")
+
+    add_idf_component_mock = MagicMock()
+    monkeypatch.setattr(esp32, "add_idf_component", add_idf_component_mock)
+    add_library_calls: list[tuple] = []
+    monkeypatch.setattr(
+        cg,
+        "add_library",
+        lambda name, version, repository=None: add_library_calls.append(
+            (name, version)
+        ),
+    )
+
+    asyncio.run(api.to_code(config))
+
+    assert add_library_calls == [("esphome/noise-c", api.NOISE_C_VERSION)]
+    add_idf_component_mock.assert_not_called()
+
+
+def test_to_code_esp32_idf_platformio_toolchain_also_uses_managed_components(
+    encryption_key: str,
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    """The ESP-IDF framework can also be built with the PlatformIO toolchain,
+    and the managed components are used there too. The choice deliberately does
+    not depend on the toolchain: wireguard splits on the same condition, and if
+    the two ever disagree one of them converts a second libsodium next to the
+    managed one, which IDF refuses to build."""
+    _setup_core(Platform.ESP32, Framework.ESP_IDF, Toolchain.PLATFORMIO)
+    config = _build_config(encryption_key)
+    CORE.component_ids.add("api_id")
+
+    add_idf_component_calls: list[dict] = []
+    monkeypatch.setattr(
+        esp32,
+        "add_idf_component",
+        lambda **kwargs: add_idf_component_calls.append(kwargs),
+    )
+    add_library_mock = MagicMock()
+    monkeypatch.setattr(cg, "add_library", add_library_mock)
+
+    asyncio.run(api.to_code(config))
+
+    assert add_idf_component_calls == [
+        {"name": "esphome/noise-c", "ref": api.NOISE_C_VERSION},
+        {"name": "esphome/libsodium", "ref": api.LIBSODIUM_VERSION},
+    ]
+    add_library_mock.assert_not_called()
+
+
+def test_to_code_non_esp32_encryption_uses_add_library(
+    encryption_key: str,
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    """Off ESP32 entirely (e.g. host), noise-c always goes through the
+    PlatformIO-library converter -- add_idf_component is ESP-IDF-only."""
+    _setup_core(Platform.HOST, Framework.NATIVE, Toolchain.PLATFORMIO)
+    config = _build_config(encryption_key)
+    CORE.component_ids.add("api_id")
+
+    add_idf_component_mock = MagicMock()
+    monkeypatch.setattr(esp32, "add_idf_component", add_idf_component_mock)
+    add_library_calls: list[tuple] = []
+    monkeypatch.setattr(
+        cg,
+        "add_library",
+        lambda name, version, repository=None: add_library_calls.append(
+            (name, version)
+        ),
+    )
+
+    asyncio.run(api.to_code(config))
+
+    assert add_library_calls == [("esphome/noise-c", api.NOISE_C_VERSION)]
+    add_idf_component_mock.assert_not_called()

tests/unit_tests/components/test_esp32_write_idf_component_yml.py

@@ -0,0 +1,107 @@
+"""Tests for esp32's _write_idf_component_yml() managed-component wiring.
+
+A library that is already declared as a managed IDF component (via
+add_idf_component(), e.g. api's noise-c/libsodium) must not also be converted
+from a PlatformIO library, or ESP-IDF sees the same requirement declared by
+two components and refuses to build. _write_idf_component_yml() passes the
+set of already-managed component names to generate_idf_components() so the
+converter excludes them.
+"""
+
+from __future__ import annotations
+
+from pathlib import Path
+from unittest.mock import MagicMock
+
+import pytest
+
+from esphome.components import esp32
+from esphome.const import (
+    KEY_CORE,
+    KEY_TARGET_FRAMEWORK,
+    KEY_TARGET_PLATFORM,
+    Framework,
+    Platform,
+    Toolchain,
+)
+from esphome.core import CORE
+
+
+def _setup_core(tmp_path: Path) -> None:
+    CORE.reset()
+    CORE.name = "testdevice"
+    CORE.build_path = tmp_path
+    CORE.toolchain = Toolchain.ESP_IDF
+    CORE.data[KEY_CORE] = {
+        KEY_TARGET_PLATFORM: str(Platform.ESP32),
+        KEY_TARGET_FRAMEWORK: str(Framework.ESP_IDF),
+    }
+
+
+def test_write_idf_component_yml_passes_managed_components(
+    tmp_path: Path,
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    """The names already registered via add_idf_component (e.g. noise-c from
+    api's encryption config) are passed through as ``managed`` so the
+    PlatformIO-library converter skips them."""
+    _setup_core(tmp_path)
+    CORE.data[esp32.KEY_ESP32] = {
+        esp32.KEY_COMPONENTS: {
+            "esphome/noise-c": {
+                esp32.KEY_REPO: None,
+                esp32.KEY_REF: "0.1.15",
+                esp32.KEY_PATH: None,
+            },
+        },
+    }
+
+    captured: dict[str, set[str] | None] = {}
+
+    # A converted (non-managed) library the batch still resolves, so the loop
+    # wiring its override_path into the manifest is exercised for real too.
+    converted = MagicMock()
+    converted.get_sanitized_name.return_value = "esphome/other-lib"
+    converted.path = tmp_path / "pio_components" / "other-lib"
+
+    def fake_generate_idf_components(libraries, managed=None):
+        captured["managed"] = managed
+        return [converted]
+
+    monkeypatch.setattr(esp32, "generate_idf_components", fake_generate_idf_components)
+
+    esp32._write_idf_component_yml()
+
+    assert captured["managed"] == {"esphome/noise-c"}
+    # The managed component itself is still written into the manifest deps
+    # directly (from KEY_COMPONENTS), just not converted a second time.
+    yml_path = tmp_path / "src" / "idf_component.yml"
+    assert yml_path.is_file()
+    contents = yml_path.read_text(encoding="utf-8")
+    assert "esphome/noise-c" in contents
+    assert "0.1.15" in contents
+    # The converted library the batch DID return is still wired in.
+    assert "esphome/other-lib" in contents
+    assert str(converted.path) in contents
+
+
+def test_write_idf_component_yml_empty_managed_when_no_components(
+    tmp_path: Path,
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    """No managed components registered yet (no add_idf_component calls) ->
+    an empty managed set, matching the pre-existing (unfiltered) behavior."""
+    _setup_core(tmp_path)
+    CORE.data[esp32.KEY_ESP32] = {esp32.KEY_COMPONENTS: {}}
+
+    captured: dict[str, set[str] | None] = {}
+
+    def fake_generate_idf_components(libraries, managed=None):
+        captured["managed"] = managed
+        return []
+
+    monkeypatch.setattr(esp32, "generate_idf_components", fake_generate_idf_components)
+
+    esp32._write_idf_component_yml()
+
+    assert captured["managed"] == set()

tests/unit_tests/test_espidf_clang_tidy.py

@@ -2,10 +2,21 @@
 
 import os
 from pathlib import Path
+from types import SimpleNamespace
 
 import pytest
+import yaml
 
-from esphome.espidf.clang_tidy import _Settings, _setup_core, _write_tidy_project
+from esphome.espidf import clang_tidy
+from esphome.espidf.clang_tidy import (
+    _arduino_excluded_stubs,
+    _convert_pio_libs,
+    _esphome_manifest_deps,
+    _Settings,
+    _setup_core,
+    _write_tidy_project,
+)
+import esphome.espidf.component as espidf_component
 
 REPO_ROOT = Path(__file__).resolve().parents[2]
 
@@ -64,3 +75,105 @@ def test_setup_core_sets_arduino_env(
     _setup_core(tmp_path / "proj", _settings(target_framework=target_framework))
 
     assert os.environ["ESPHOME_ARDUINO_COMPONENT"] == expected
+
+
+def test_esphome_manifest_deps_reads_repo_manifest() -> None:
+    """Returns the top-level dependency names from esphome/idf_component.yml,
+    independent of any per-dependency framework rules."""
+    manifest = yaml.safe_load(
+        (REPO_ROOT / "esphome" / "idf_component.yml").read_text(encoding="utf-8")
+    )
+
+    deps = _esphome_manifest_deps()
+
+    assert isinstance(deps, set)
+    assert "esphome/noise-c" in deps
+    assert "esphome/libsodium" in deps
+    # Cross-check against a fresh parse instead of hardcoding the manifest's
+    # whole key list, so this doesn't need updating whenever a dependency is
+    # added or removed.
+    assert deps == set(manifest["dependencies"])
+
+
+def test_convert_pio_libs_arduino_framework_passes_empty_managed(
+    tmp_path: Path,
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    """On Arduino, ESPHome's manifest entries for noise-c/libsodium are
+    rule-gated off (arduino-esp32 brings its own libsodium), so nothing
+    provides them there -- managed must be empty and they go through the
+    PlatformIO-library converter as before."""
+    monkeypatch.setattr(clang_tidy, "_parse_lib_deps", lambda ini, framework: [])
+
+    captured: dict[str, set[str] | None] = {}
+
+    # A converted library the batch resolves, so the loop wiring its
+    # override_path into the returned deps mapping is exercised for real too.
+    converted = SimpleNamespace(
+        get_sanitized_name=lambda: "esphome/other-lib",
+        path=tmp_path / "other-lib",
+    )
+
+    def fake_generate_idf_components(libraries, managed=None):
+        captured["managed"] = managed
+        return [converted]
+
+    monkeypatch.setattr(
+        espidf_component, "generate_idf_components", fake_generate_idf_components
+    )
+
+    result = _convert_pio_libs(tmp_path / "platformio.ini", "arduino")
+
+    assert captured["managed"] == set()
+    assert result == {
+        "esphome/other-lib": {"override_path": str(tmp_path / "other-lib")}
+    }
+
+
+def test_convert_pio_libs_espidf_framework_passes_manifest_deps(
+    tmp_path: Path,
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    """On ESP-IDF, libraries ESPHome's own manifest already provides as
+    managed components (noise-c, libsodium, ...) must be passed through as
+    ``managed`` so the converter skips them -- converting them too would make
+    IDF see the same requirement twice."""
+    monkeypatch.setattr(clang_tidy, "_parse_lib_deps", lambda ini, framework: [])
+
+    captured: dict[str, set[str] | None] = {}
+
+    def fake_generate_idf_components(libraries, managed=None):
+        captured["managed"] = managed
+        return []
+
+    monkeypatch.setattr(
+        espidf_component, "generate_idf_components", fake_generate_idf_components
+    )
+
+    result = _convert_pio_libs(tmp_path / "platformio.ini", "espidf")
+
+    assert captured["managed"] == _esphome_manifest_deps()
+    assert "esphome/noise-c" in captured["managed"]
+    assert result == {}
+
+
+def test_arduino_excluded_stubs_skips_components_esphome_manifest_provides(
+    tmp_path: Path,
+) -> None:
+    """A component ESPHome's own idf_component.yml declares for real (e.g.
+    espressif/lan867x for ethernet) must not be stubbed away -- stubbing it
+    would silently disable ethernet on Arduino. A component that is only ever
+    bundled by arduino-esp32 (never in ESPHome's own manifest) still gets a
+    stub so the arduino-bundled copy doesn't clash with noise-c's libsodium."""
+    deps = _arduino_excluded_stubs(tmp_path)
+
+    # lan867x is a real ESPHome dependency (esphome/idf_component.yml), so it
+    # must be excluded from the stub set.
+    assert "espressif/lan867x" not in deps
+    # espressif/libsodium (arduino-esp32's bundled copy) is a different
+    # package from ESPHome's own esphome/libsodium, so it's still stubbed.
+    assert "espressif/libsodium" in deps
+    stub_info = deps["espressif/libsodium"]
+    assert stub_info["version"] == "*"
+    stub_path = Path(stub_info["override_path"])
+    assert (stub_path / "CMakeLists.txt").is_file()

tests/unit_tests/test_espidf_component.py

@@ -876,6 +876,112 @@ def test_generate_idf_components_lib_ignore_filters_top_level_and_dependencies(
     assert download_salts == [hashlib.sha256(b"b,c").hexdigest()[:8]]
 
 
+def test_generate_idf_components_managed_filters_top_level_and_dependencies(
+    tmp_path: Path,
+    monkeypatch: pytest.MonkeyPatch,
+    esp32_idf_core: None,
+) -> None:
+    # managed (e.g. noise-c/libsodium already declared via add_idf_component)
+    # must drop B at the top level and C when discovered as a dependency of A,
+    # exactly like lib_ignore -- neither may be resolved, downloaded, or wired
+    # into a manifest.
+    manifests = {
+        "esphome/A": {
+            "name": "A",
+            "dependencies": [
+                {"owner": "esphome", "name": "C", "version": "==1.10021.0"}
+            ],
+        },
+        "esphome/B": {"name": "B"},
+    }
+
+    download_salts: list[str] = []
+
+    def fake_download(self, force=False, salt="", namespace=""):
+        download_salts.append(salt)
+        self.path = tmp_path / self.get_sanitized_name().replace("/", "__")
+        (self.path / "src").mkdir(parents=True, exist_ok=True)
+        (self.path / "src" / "x.c").write_text("int x;")
+        (self.path / "library.json").write_text(json.dumps(manifests[self.name]))
+
+    monkeypatch.setattr(IDFComponent, "download", fake_download)
+
+    resolve_calls: list[str] = []
+
+    def fake_resolve(owner, pkgname, requirements):
+        resolve_calls.append(pkgname)
+        return owner, pkgname, "1.0.0", f"http://x/{pkgname}.tar.gz"
+
+    monkeypatch.setattr(
+        esphome.platformio.library, "_resolve_registry_version", fake_resolve
+    )
+
+    top = generate_idf_components(
+        [Library("esphome/A", "1.0.0", None), Library("esphome/B", "1.0.0", None)],
+        managed={"esphome/B", "esphome/C"},
+    )
+
+    assert [c.name for c in top] == ["esphome/A"]
+    # Managed libraries were never resolved (and therefore never downloaded).
+    assert resolve_calls == ["A"]
+    # The managed dependency is not wired into A's manifest.
+    assert top[0].dependencies == []
+    # managed changes the generated wiring just like lib_ignore, so the cache
+    # path is salted the same way.
+    assert download_salts == [hashlib.sha256(b"b,c").hexdigest()[:8]]
+
+
+def test_generate_idf_components_lib_ignore_and_managed_combine_into_salt(
+    tmp_path: Path,
+    monkeypatch: pytest.MonkeyPatch,
+    esp32_idf_core: None,
+) -> None:
+    # lib_ignore and managed both contribute to the same exclusion set, so a
+    # config using both gets a salt reflecting the union of the two sources
+    # rather than either alone.
+    manifests = {
+        "esphome/A": {"name": "A"},
+        "esphome/D": {"name": "D"},
+        "esphome/E": {"name": "E"},
+    }
+
+    download_salts: list[str] = []
+
+    def fake_download(self, force=False, salt="", namespace=""):
+        download_salts.append(salt)
+        self.path = tmp_path / self.get_sanitized_name().replace("/", "__")
+        (self.path / "src").mkdir(parents=True, exist_ok=True)
+        (self.path / "src" / "x.c").write_text("int x;")
+        (self.path / "library.json").write_text(json.dumps(manifests[self.name]))
+
+    monkeypatch.setattr(IDFComponent, "download", fake_download)
+
+    resolve_calls: list[str] = []
+
+    def fake_resolve(owner, pkgname, requirements):
+        resolve_calls.append(pkgname)
+        return owner, pkgname, "1.0.0", f"http://x/{pkgname}.tar.gz"
+
+    monkeypatch.setattr(
+        esphome.platformio.library, "_resolve_registry_version", fake_resolve
+    )
+    monkeypatch.setattr(CORE, "platformio_options", {"lib_ignore": ["D"]})
+
+    top = generate_idf_components(
+        [
+            Library("esphome/A", "1.0.0", None),
+            Library("esphome/D", "1.0.0", None),
+            Library("esphome/E", "1.0.0", None),
+        ],
+        managed={"esphome/E"},
+    )
+
+    assert [c.name for c in top] == ["esphome/A"]
+    assert resolve_calls == ["A"]
+    # The salt reflects BOTH lib_ignore's "D" and managed's "E" together.
+    assert download_salts == [hashlib.sha256(b"d,e").hexdigest()[:8]]
+
+
 def test_generate_idf_components_handles_dependency_cycle(
     tmp_path: Path,
     monkeypatch: pytest.MonkeyPatch,