Merge branch 'esp8266-native-build-infra' into esp8266-native-framework-installer

# Conflicts:
#	tests/unit_tests/test_main.py

CODEOWNERS

@@ -381,7 +381,6 @@ esphome/components/nextion/switch/* @senexcrenshaw
 esphome/components/nextion/text_sensor/* @senexcrenshaw
 esphome/components/nfc/* @jesserockz @kbx81
 esphome/components/noblex/* @AGalfra
-esphome/components/noise/* @esphome/core
 esphome/components/npi19/* @bakerkj
 esphome/components/nrf52/* @tomaszduda23
 esphome/components/number/* @esphome/core

esphome/__main__.py

@@ -26,9 +26,7 @@ from esphome.const import (
     CONF_DEASSERT_RTS_DTR,
     CONF_DISABLED,
     CONF_DISCOVER_IP,
-    CONF_ENCRYPTION,
     CONF_ESPHOME,
-    CONF_KEY,
     CONF_LEVEL,
     CONF_LOG,
     CONF_LOG_TOPIC,
@@ -859,7 +857,20 @@ def compile_program(args: ArgsProtocol, config: ConfigType) -> int:
         toolchain.create_factory_bin()
         toolchain.create_ota_bin()
         toolchain.create_elf_copy()
-        toolchain.get_idedata()
+        from esphome.build_helpers.idedata import IDEDATA_BEST_EFFORT_ERRORS
+
+        try:
+            if toolchain.get_idedata() is None:
+                _LOGGER.warning("No idedata was generated for this build")
+        except IDEDATA_BEST_EFFORT_ERRORS as err:
+            # The firmware already built; an idedata failure must not fail
+            # a successful build.
+            _LOGGER.warning(
+                "Could not generate idedata: %s (IDE, clang-tidy, and "
+                "memory-analysis data will be unavailable for this build)",
+                err,
+            )
+            _LOGGER.debug("Idedata failure detail", exc_info=True)
     else:
         from esphome.platformio import toolchain
 
@@ -1325,17 +1336,6 @@ def _upload_via_native_api(
 
     remote_port = int(ota_conf[CONF_PORT])
     password = ota_conf.get(CONF_PASSWORD)
-    # Final validate resolved a bare `encryption:` block to the api key.
-    # Fail closed: if the block is present but no key was resolved, never
-    # fall back to a plaintext upload of an image that carries credentials.
-    noise_psk = None
-    if (encryption_conf := ota_conf.get(CONF_ENCRYPTION)) is not None:
-        noise_psk = encryption_conf.get(CONF_KEY)
-        if not noise_psk:
-            raise EsphomeError(
-                "OTA encryption is configured but no key was resolved; "
-                "set the key under 'ota: encryption:' or 'api: encryption:'"
-            )
 
     def check_partition_access(option_string: str) -> None:
         if not ota_conf.get("allow_partition_access"):
@@ -1366,9 +1366,7 @@ def _upload_via_native_api(
     if ota_type == espota2.OTA_TYPE_UPDATE_BOOTLOADER:
         _validate_bootloader_binary(binary)
 
-    return espota2.run_ota(
-        network_devices, remote_port, password, binary, ota_type, noise_psk
-    )
+    return espota2.run_ota(network_devices, remote_port, password, binary, ota_type)
 
 
 def _upload_via_web_server(
@@ -1377,16 +1375,6 @@ def _upload_via_web_server(
     from esphome import web_server_ota
     from esphome.web_server_helpers import get_web_server_connection
 
-    if any(
-        ota_item.get(CONF_PLATFORM) == CONF_ESPHOME
-        and ota_item.get(CONF_ENCRYPTION) is not None
-        for ota_item in config.get(CONF_OTA, [])
-    ):
-        _LOGGER.warning(
-            "This config has OTA encryption, but the web_server OTA path sends "
-            "the image over plaintext HTTP; use the esphome OTA platform to "
-            "keep it confidential"
-        )
     remote_port, username, password = get_web_server_connection(config)
     return web_server_ota.run_ota(
         network_devices, remote_port, username, password, binary
@@ -2746,10 +2734,14 @@ def run_esphome(argv):
     # Skipped when -s overrides are passed, since the cache was written
     # against the previous substitution set.
     config: ConfigType | None = None
-    cache_eligible = (
+    cache_write_eligible = (
         args.command in ("upload", "logs") and not command_line_substitutions
     )
-    if cache_eligible:
+    # An explicit --toolchain must re-run the per-platform validators, so
+    # gate only the cache read; the refresh below saves the result unless
+    # the sidecar records a different toolchain.
+    cache_read_eligible = cache_write_eligible and args.toolchain is None
+    if cache_read_eligible:
         from esphome.compiled_config import load_compiled_config
 
         config = load_compiled_config(conf_path)
@@ -2773,17 +2765,14 @@ def run_esphome(argv):
             return 2
     CORE.config = config
 
-    # Fallback for platforms whose validators didn't set the toolchain
-    # (only the esp32 component reads esp32.framework.toolchain). All
-    # other platforms only support PlatformIO today. Must run before the
-    # cache refresh below so its sidecar records the same toolchain a
-    # compile would.
+    # The cache fast path skips validation, and legacy sidecars lack the
+    # toolchain field. Must run before the cache refresh below.
     if CORE.toolchain is None:
         CORE.toolchain = Toolchain.PLATFORMIO
 
     # Refresh the cache so the next upload/logs hits the fast path
     # instead of re-running read_config.
-    if cache_eligible and cache_missed:
+    if cache_write_eligible and cache_missed:
         from esphome.compiled_config import save_compiled_config_and_sidecar
 
         save_compiled_config_and_sidecar(config)

esphome/arduino8266/__init__.py

@@ -0,0 +1,9 @@
+"""Native (PlatformIO-free) build support for the ESP8266 Arduino core.
+
+This package downloads the Arduino ESP8266 core and the xtensa-lx106
+toolchain, generates a ninja build for them plus the ESPHome sources, and
+drives the build directly — the ESP8266 equivalent of ``esphome.espidf``.
+
+Deliberately importable without the esp8266 component to avoid circular
+imports; the component wires these modules in via lazy imports.
+"""

esphome/arduino8266/framework.py

@@ -0,0 +1,164 @@
+"""Download and install the Arduino ESP8266 core, toolchain, and ninja.
+
+Artifacts land in a machine-global cache (shared across projects, like the
+ESP-IDF install in ``esphome.espidf.framework``):
+
+    <cache>/arduino8266/frameworks/<version>/   framework-arduinoespressif8266
+    <cache>/arduino8266/toolchains/<version>/   toolchain-xtensa (gcc 10.3)
+
+Packages come from the PlatformIO registry (identical bits to the PlatformIO
+backend); ``ESPHOME_ARDUINO8266_*_MIRRORS`` overrides the URLs. ninja comes
+from PATH or the ninja PyPI wheel.
+"""
+
+from __future__ import annotations
+
+import os
+from pathlib import Path
+from typing import NamedTuple
+
+from esphome.build_helpers.ccache import ccache_defaults_env
+from esphome.build_helpers.ninja import find_ninja
+from esphome.build_helpers.tools_cache import ARDUINO8266_TOOLS_CACHE, tools_cache_path
+from esphome.core import EsphomeError, Version
+from esphome.framework_helpers import str_to_lst_of_str
+from esphome.platformio.registry import install_package, prefetch_packages
+
+FRAMEWORK_PACKAGE = "framework-arduinoespressif8266"
+TOOLCHAIN_PACKAGE = "toolchain-xtensa"
+# gcc 10.3, the toolchain Arduino core 3.x builds with; the build
+# generator's compile flags are tuned to it.
+TOOLCHAIN_VERSION = "2.100300.220621"
+
+ESPHOME_ARDUINO8266_FRAMEWORK_MIRRORS = str_to_lst_of_str(
+    os.environ.get("ESPHOME_ARDUINO8266_FRAMEWORK_MIRRORS", "")
+)
+ESPHOME_ARDUINO8266_TOOLCHAIN_MIRRORS = str_to_lst_of_str(
+    os.environ.get("ESPHOME_ARDUINO8266_TOOLCHAIN_MIRRORS", "")
+)
+
+
+def get_arduino8266_tools_path() -> Path:
+    # Machine-global so all projects share one install; see
+    # espidf.framework.get_idf_tools_path for the location rationale.
+    return tools_cache_path(*ARDUINO8266_TOOLS_CACHE)
+
+
+# 3.1.1 rather than 3.1.0: the registry has no package for 3.1.0, and the
+# encoder below cannot name 3.0.0/3.0.1 either (see its docstring)
+MIN_FRAMEWORK_VERSION = Version(3, 1, 1)
+
+
+def framework_package_version(ver: Version) -> str:
+    """Map an Arduino core version to its registry package version (3.1.2 ->
+    3.30102.0; the leading 3 is the package major).
+
+    Exact registry names only for cores > 2.6.2 and >= 3.0.2; callers floor
+    at MIN_FRAMEWORK_VERSION.
+    """
+    if ver.major > 3:
+        raise EsphomeError(
+            f"Arduino core {ver} is not supported yet; "
+            "the newest known core series is 3.x"
+        )
+    if ver <= Version(2, 6, 2):
+        # Cores <= 2.6.2 use the older 1.x/2.x package-major encodings (same
+        # boundary as _format_framework_arduino_version's era guard)
+        raise EsphomeError(
+            f"Arduino core {ver} uses an older package encoding than this "
+            "helper implements (newer than 2.6.2)"
+        )
+    return f"3.{ver.major}{ver.minor:02d}{ver.patch:02d}.0"
+
+
+def get_framework_path(package_version: str) -> Path:
+    return get_arduino8266_tools_path() / "frameworks" / package_version
+
+
+def get_toolchain_path() -> Path:
+    return get_arduino8266_tools_path() / "toolchains" / TOOLCHAIN_VERSION
+
+
+class InstalledPaths(NamedTuple):
+    """Locations of the installed framework, toolchain, and ninja binary."""
+
+    framework: Path
+    toolchain: Path
+    ninja: Path
+
+
+def check_and_install(framework_version: Version) -> InstalledPaths:
+    """Ensure framework, toolchain, and ninja are installed; return their paths."""
+    if framework_version < MIN_FRAMEWORK_VERSION:
+        # Config validation enforces this too; keep the module honest when
+        # called directly.
+        raise EsphomeError(
+            f"The native toolchain requires the Arduino core "
+            f">= {MIN_FRAMEWORK_VERSION}, got {framework_version}"
+        )
+    # Probe the cheap local dependency before ~110 MB of downloads
+    ninja_path = find_ninja()
+    package_version = framework_package_version(framework_version)
+    framework_path = get_framework_path(package_version)
+    downloads_dir = get_arduino8266_tools_path() / "downloads"
+    toolchain_path = get_toolchain_path()
+    # One spec per package: the prefetch and the installs must agree
+    specs = (
+        (
+            FRAMEWORK_PACKAGE,
+            package_version,
+            framework_path,
+            ESPHOME_ARDUINO8266_FRAMEWORK_MIRRORS,
+            ("cores/esp8266", "tools/sdk", "libraries"),
+        ),
+        (
+            TOOLCHAIN_PACKAGE,
+            TOOLCHAIN_VERSION,
+            toolchain_path,
+            ESPHOME_ARDUINO8266_TOOLCHAIN_MIRRORS,
+            # xtensa-lx106-elf pins the target: every gcc package has a bin/
+            ("bin", "xtensa-lx106-elf"),
+        ),
+    )
+    # Fetch both archives at once; the installs below verify and extract
+    prefetch_packages([spec[:4] for spec in specs], downloads_dir)
+    for name, version, dest, mirrors, expect in specs:
+        install_package(name, version, dest, mirrors, downloads_dir, expect=expect)
+    return InstalledPaths(
+        framework=framework_path, toolchain=toolchain_path, ninja=ninja_path
+    )
+
+
+def toolchain_tool(toolchain_path: Path, name: str) -> Path:
+    """Path to one toolchain tool (gcc, g++, ar, size, addr2line, ...).
+
+    The single owner of the ``bin/xtensa-lx106-elf-<name>`` layout and the
+    Windows suffix, so a toolchain package bump touches one spot.
+    """
+    suffix = ".exe" if os.name == "nt" else ""
+    return toolchain_path / "bin" / f"xtensa-lx106-elf-{name}{suffix}"
+
+
+def get_build_env(toolchain_path: Path, ccache: str | None) -> dict[str, str]:
+    env = os.environ.copy()
+    # Drop empty entries: a trailing separator from an absent PATH would
+    # make the shell search the current directory for tools
+    parts = [
+        str(toolchain_path / "bin"),
+        *filter(None, env.get("PATH", "").split(os.pathsep)),
+    ]
+    env["PATH"] = os.pathsep.join(parts)
+    env.update(ccache_env(ccache))
+    return env
+
+
+def ccache_env(ccache: str | None) -> dict[str, str]:
+    """Return ccache settings for the build subprocess (not os.environ).
+
+    ``ccache`` is the pre-resolved binary (resolve_ccache_path), or None
+    when disabled. Values the user already set in the environment are
+    respected.
+    """
+    if ccache is None:
+        return {}
+    return ccache_defaults_env(get_arduino8266_tools_path() / "ccache")

esphome/build_helpers/__init__.py

@@ -0,0 +1 @@
+"""Build helpers shared by the native (non-PlatformIO) toolchains."""

esphome/build_helpers/ccache.py

@@ -0,0 +1,93 @@
+"""Shared ccache policy for build backends: env-knob parsing, binary
+resolution, and default ``CCACHE_*`` values."""
+
+from __future__ import annotations
+
+import logging
+import os
+from pathlib import Path
+
+from esphome.framework_helpers import strip_win_long_path_prefix, tool_version_runs
+from esphome.helpers import FALSY_BOOL_STRINGS, TRUTHY_BOOL_STRINGS
+
+_LOGGER = logging.getLogger(__name__)
+
+# cv.boolean's spelling tables plus the 1/0 env convention
+TRUTHY_ENV_STRINGS = TRUTHY_BOOL_STRINGS | {"1"}
+FALSY_ENV_STRINGS = FALSY_BOOL_STRINGS | {"0"}
+
+
+def _ccache_runs(ccache: str) -> bool:
+    """Return True when the ``ccache`` found on PATH actually runs."""
+    return tool_version_runs(
+        ccache,
+        "Ignoring ccache at %s because it failed to run; compiling without ccache",
+    )
+
+
+def parse_enable_env(name: str) -> bool | None:
+    """Strictly parse an on/off environment knob; None when unset or invalid.
+
+    ``bool(str)`` truthiness would flip ``no``/``off`` to enabled, so only
+    1/true/yes/on and 0/false/no/off count; anything else warns and reads
+    as unset so the caller's default policy applies.
+    """
+    raw = os.environ.get(name)
+    if raw is None:
+        return None
+    lowered = raw.strip().lower()
+    if lowered in TRUTHY_ENV_STRINGS:
+        return True
+    if lowered in FALSY_ENV_STRINGS:
+        return False
+    _LOGGER.warning("Ignoring unrecognized %s=%r; use 1 or 0", name, raw)
+    return None
+
+
+def resolve_ccache_path() -> str | None:
+    """The ccache binary to wrap compiles with, or None when disabled.
+
+    An explicit ``ESPHOME_CCACHE_ENABLE=1`` skips the runnability probe; the
+    Windows extended-length prefix is stripped before probing (#18399).
+    """
+    import shutil
+
+    explicit = parse_enable_env("ESPHOME_CCACHE_ENABLE")
+    if explicit is False:
+        return None
+    ccache = shutil.which("ccache")
+    if ccache is None:
+        if explicit:
+            _LOGGER.warning(
+                "ESPHOME_CCACHE_ENABLE is set but no ccache binary is on PATH; "
+                "compiling without ccache"
+            )
+        return None
+    ccache = strip_win_long_path_prefix(ccache)
+    if not explicit and not _ccache_runs(ccache):
+        return None
+    return ccache
+
+
+def ccache_defaults_env(cache_dir: Path) -> dict[str, str]:
+    """Default ``CCACHE_*`` values for a build subprocess (not os.environ).
+
+    Values the user already set in the environment are respected. Depend
+    mode is on: both native backends emit depfiles (-MMD / CMake), which
+    keeps cache-miss overhead low.
+    """
+    from esphome.core import CORE
+
+    # An unset build_path means the env was built before preload; fail loudly
+    # rather than silently drop CCACHE_BASEDIR.
+    if CORE.build_path is None:
+        raise ValueError(
+            "CORE.build_path must be set before constructing the build environment"
+        )
+    defaults = {
+        "CCACHE_DIR": str(cache_dir),
+        "CCACHE_NOHASHDIR": "true",
+        "CCACHE_DEPEND": "1",
+        "CCACHE_BASEDIR": str(Path(CORE.build_path).resolve()),
+    }
+    return {k: v for k, v in defaults.items() if k not in os.environ}

esphome/build_helpers/idedata.py

@@ -1,10 +1,10 @@
-"""Derive idedata from an ESP-IDF native-toolchain ``compile_commands.json``.
+"""Derive idedata from a native (non-PlatformIO) build's ``compile_commands.json``.
 
-PlatformIO exposes a curated ``pio run -t idedata`` JSON; the native ESP-IDF
-toolchain has no such command, but its CMake build emits
-``build/compile_commands.json`` (CMAKE_EXPORT_COMPILE_COMMANDS). This module
-turns that file into the same fields consumers (IDE integration, clang-tidy)
-expect:
+PlatformIO exposes a curated ``pio run -t idedata`` JSON; the native
+toolchains have no such command, but each build produces a
+``compile_commands.json`` (CMAKE_EXPORT_COMPILE_COMMANDS for ESP-IDF, ninja's
+compdb tool otherwise). This module turns that file into the same fields
+consumers (IDE integration, clang-tidy) expect:
 
     {cc_path, cxx_path, cxx_flags, defines, includes: {build, toolchain}}
 """
@@ -18,6 +18,20 @@ from pathlib import Path
 import shlex
 import subprocess
 
+from esphome.core import EsphomeError
+from esphome.helpers import write_file
+
+# Everything idedata generation may raise after a successful link. Broad on
+# purpose, and shared by every consumer: idedata is a bonus artifact, so
+# these must be caught and warned about, never allowed to fail the build.
+IDEDATA_BEST_EFFORT_ERRORS = (
+    EsphomeError,
+    LookupError,
+    OSError,
+    RuntimeError,
+    ValueError,
+)
+
 _LOGGER = logging.getLogger(__name__)
 
 # C++ translation-unit suffixes used to identify ESPHome source files.
@@ -120,7 +134,18 @@ def _pick_entry(entries: list[dict]) -> dict:
     raise ValueError("no C++ translation unit found in compile_commands.json")
 
 
-def _parse_entry(entry: dict) -> tuple[str, list[str], list[str], list[str]]:
+# Compiler launchers that may prefix a compile command; a closed launcher
+# denylist beats enumerating compiler names, an open set.
+_LAUNCHER_STEMS = frozenset({"ccache", "sccache", "distcc", "icecc", "buildcache"})
+
+
+def _is_launcher(token: str) -> bool:
+    return Path(token).stem.lower() in _LAUNCHER_STEMS
+
+
+def parse_entry(
+    entry: dict, launcher: str | None = None
+) -> tuple[str, list[str], list[str], list[str]]:
     """Parse one compile_commands entry -> (cxx_path, defines, includes, cxx_flags)."""
     directory = Path(entry["directory"])
     tokens = _expand_response_files(_split_command(entry["command"]), directory)
@@ -136,6 +161,20 @@ def _parse_entry(entry: dict) -> tuple[str, list[str], list[str], list[str]]:
             raw = os.path.normpath(directory / raw)
         return raw.replace("\\", "/")
 
+    # A launcher-wrapped command ("ccache g++ ...") names the compiler second
+    if launcher is not None and tokens[:1] == [launcher]:
+        tokens = tokens[1:]
+    if not tokens:
+        # _split_command("") is [] by design, and a command that is only
+        # the launcher strips to nothing; fail like _pick_entry does
+        # instead of an IndexError traceback
+        raise ValueError(f"empty compile command for {entry.get('file')}")
+    if _is_launcher(tokens[0]) and len(tokens) > 1 and not tokens[1].startswith("-"):
+        # A stale compile DB built with a launcher the current run no longer
+        # configures: the real compiler is the next token. Warn: the DB is
+        # stale and worth regenerating.
+        _LOGGER.warning("Stripping unconfigured launcher %s", tokens[0])
+        tokens = tokens[1:]
     # token0 is the compiler path; the rest of the command already uses forward
     # slashes on Windows, so normalize it too for a consistent idedata file.
     cxx_path = tokens[0].replace("\\", "/")
@@ -168,7 +207,7 @@ def _parse_entry(entry: dict) -> tuple[str, list[str], list[str], list[str]]:
     return cxx_path, defines, includes, cxx_flags
 
 
-def _get_toolchain_includes(cxx_path: str) -> list[str]:
+def get_toolchain_includes(cxx_path: str) -> list[str]:
     """Query the compiler for its builtin ``#include <...>`` search dirs."""
     result = subprocess.run(
         [cxx_path, "-E", "-x", "c++", "-", "-v"],
@@ -219,26 +258,114 @@ def _cc_path_from_cxx(cxx_path: str) -> str:
     return f"{stem}{suffix}"
 
 
-def idedata_from_build(compile_commands: Path) -> dict:
+def load_or_build_idedata(
+    compile_commands: Path,
+    elf_path: Path,
+    cache: Path,
+    launcher: str | None = None,
+) -> dict | None:
+    """Return idedata for a compile_commands.json build, cached on mtime.
+
+    Shared by the native ESP-IDF and ESP8266 Arduino toolchains. Returns None
+    when the compile DB doesn't exist yet (nothing was built). ``launcher``
+    is the compiler-launcher path (ccache) the build was generated with, if
+    any; commands in the compile DB are prefixed with it.
+    """
+    if not compile_commands.is_file():
+        _LOGGER.debug("No %s yet; skipping idedata generation", compile_commands)
+        return None
+
+    if cache.is_file() and cache.stat().st_mtime >= compile_commands.stat().st_mtime:
+        try:
+            cached = json.loads(cache.read_text(encoding="utf-8"))
+        except (ValueError, OSError) as err:
+            # A recurring cause (interrupted write, disk full) would otherwise
+            # look like unexplained slow builds
+            _LOGGER.warning("Discarding unreadable idedata cache %s: %s", cache, err)
+        else:
+            # Rebuild pre-cc_path caches on the field, not the timestamp;
+            # the type check keeps "in" from substring-matching a string
+            if isinstance(cached, dict) and "cc_path" in cached:
+                return cached
+
+    data = idedata_from_build(compile_commands, launcher)
+    data["prog_path"] = str(elf_path)
+    cache.parent.mkdir(parents=True, exist_ok=True)
+    # Atomic so a crash mid-write cannot leave a truncated cache
+    write_file(cache, json.dumps(data, indent=2) + "\n")
+    return data
+
+
+def reject_launcher_compiler(cxx_path: str) -> None:
+    """Reject a compile DB that names a launcher (ccache) as the compiler.
+
+    Reject before the toolchain probe, which would fail opaquely on a
+    launcher; the unusable compile DB must never be cached or consumed.
+    """
+    if _is_launcher(cxx_path):
+        raise EsphomeError(
+            f"compile_commands.json names the launcher {cxx_path} as the "
+            "compiler; the compile database is unusable"
+        )
+
+
+def idedata_from_build(compile_commands: Path, launcher: str | None = None) -> dict:
     """Parse compile_commands.json into the idedata fields consumers expect.
 
-    A single ESP-IDF compile entry only carries its own component's REQUIRES
-    include set, but consumers (clang-tidy) analyze ESPHome headers that
-    transitively pull in other components. So take cxx_path / cxx_flags /
-    defines from a representative ESPHome TU, but union the include dirs across
-    all ESPHome TUs to get a project-wide superset (as PlatformIO's idedata
-    provides).
+    A single compile entry only carries the include set its own translation
+    unit was built with (per-component under ESP-IDF), but consumers
+    (clang-tidy) analyze ESPHome headers that transitively pull in other
+    components. So take cxx_path / cxx_flags / defines from a representative
+    ESPHome TU, but union the include dirs across all ESPHome TUs to get a
+    project-wide superset (as PlatformIO's idedata provides).
     """
     entries = json.loads(Path(compile_commands).read_text(encoding="utf-8"))
-    cxx_path, defines, _, cxx_flags = _parse_entry(_pick_entry(entries))
 
-    build_includes: dict[str, None] = {}
+    representative = _pick_entry(entries)
+    cxx_path, defines, rep_includes, cxx_flags = parse_entry(representative, launcher)
+    reject_launcher_compiler(cxx_path)
+
+    # Seed with the representative's includes so it is not parsed twice
+    has_esphome_tu = _is_esphome_src(representative["file"])
+    build_includes: dict[str, None] = dict.fromkeys(
+        rep_includes if has_esphome_tu else ()
+    )
+
+    def _shape(entry: dict) -> str:
+        # The command minus its TU-specific paths: entries sharing a shape
+        # carry identical include sets (one ninja rule), so tokenize once
+        # per shape instead of once per TU. Response-file commands never
+        # dedupe: per-object .rsp names strip to one shape while the files
+        # may hold different include sets.
+        command = entry["command"]
+        if "@" in command:
+            return f"unique:{entry['file']}"
+        return command.replace(entry.get("file", ""), "").replace(
+            entry.get("output", ""), ""
+        )
+
+    seen_shapes = {_shape(representative)}
     for entry in entries:
-        if not _is_esphome_src(entry["file"]):
+        if entry is representative or not _is_esphome_src(entry["file"]):
             continue
-        for inc in _parse_entry(entry)[2]:
+        has_esphome_tu = True
+        if (shape := _shape(entry)) in seen_shapes:
+            _LOGGER.debug("Include union: %s shares a command shape", entry["file"])
+            continue
+        seen_shapes.add(shape)
+        for inc in parse_entry(entry, launcher)[2]:
             build_includes.setdefault(inc, None)
 
+    if not has_esphome_tu:
+        # _pick_entry fell back to an arbitrary C++ entry: idedata built
+        # from it breaks clang-tidy/IDE consumers, and a one-time warning
+        # would be cached into permanence. The best-effort call sites
+        # downgrade this to a build warning.
+        raise EsphomeError(
+            f"No ESPHome translation unit found in {compile_commands}; "
+            "refusing to cache unusable idedata"
+        )
+
     return {
         "cc_path": _cc_path_from_cxx(cxx_path),
         "cxx_path": cxx_path,
@@ -246,6 +373,6 @@ def idedata_from_build(compile_commands: Path) -> dict:
         "defines": defines,
         "includes": {
             "build": list(build_includes),
-            "toolchain": _get_toolchain_includes(cxx_path),
+            "toolchain": get_toolchain_includes(cxx_path),
         },
     }

esphome/build_helpers/ninja.py

@@ -0,0 +1,92 @@
+"""Platform-neutral helpers for ninja-driven native builds."""
+
+from __future__ import annotations
+
+import logging
+import os
+from pathlib import Path
+import re
+import shutil
+
+from esphome.core import EsphomeError
+from esphome.framework_helpers import strip_win_long_path_prefix, tool_version_runs
+
+_LOGGER = logging.getLogger(__name__)
+
+
+def _ninja_runs(binary: str) -> bool:
+    """Whether the ninja found on PATH actually runs (see tool_version_runs)."""
+    return tool_version_runs(
+        binary,
+        "Ignoring ninja at %s because it failed to run; "
+        "falling back to the bundled wheel",
+    )
+
+
+def find_ninja() -> Path:
+    """Locate the ninja binary: a runnable PATH hit first, else the ninja
+    PyPI wheel."""
+    if binary := shutil.which("ninja"):
+        binary = strip_win_long_path_prefix(binary)
+        if _ninja_runs(binary):
+            return Path(binary)
+    import_error: ImportError | None = None
+    try:
+        import ninja
+    except ImportError as err:
+        import_error = err
+        wheel_binary = None
+    else:
+        wheel_binary = Path(ninja.BIN_DIR) / (
+            "ninja.exe" if os.name == "nt" else "ninja"
+        )
+    if wheel_binary is None or not wheel_binary.is_file():
+        raise EsphomeError(
+            "ninja not found on PATH or in the ninja package; reinstall the "
+            "esphome Python environment"
+        ) from import_error
+    return wheel_binary
+
+
+def escape(value: Path | str) -> str:
+    """Escape a path or token for a ninja file."""
+    return str(value).replace("$", "$$").replace(":", "$:").replace(" ", "$ ")
+
+
+def quote_arg(tok: str) -> str:
+    """Quote with the CreateProcess argv rule (as ``subprocess.list2cmdline``):
+    backslash runs double only before a quote. Windows-only; ``$`` must
+    already be doubled for ninja.
+    """
+    quoted = re.sub(r'(\\*)"', lambda m: m.group(1) * 2 + '\\"', tok)
+    quoted = re.sub(r"(\\+)\Z", lambda m: m.group(1) * 2, quoted)
+    return f'"{quoted}"'
+
+
+# Force-quote any token containing a character outside the shlex.quote-style
+# safe set: ninja hands POSIX commands to /bin/sh -c, so bare (, ;, <, *, `
+# and friends would be re-parsed as shell syntax.
+_NEEDS_QUOTE = re.compile(r"[^\w@%+=:,./-]")
+
+
+def shell_token(tok: str, force: bool = False) -> str:
+    """Re-quote a lexed token for the platform shell; ``force`` always quotes.
+
+    Single quotes on POSIX (/bin/sh), the argv rule on Windows
+    (CreateProcess). ``$`` is doubled first because ninja expands it before
+    the command reaches the shell.
+    """
+    tok = tok.replace("$", "$$")  # ninja would expand a bare $ to nothing
+    if not (force or not tok or _NEEDS_QUOTE.search(tok)):
+        return tok
+    # An empty token must become '' / "" or it vanishes from the argv
+    if os.name == "nt":
+        return quote_arg(tok)
+    # shlex.quote's rule; inlined because the $-doubled token must not be
+    # re-examined for safe characters
+    return "'" + tok.replace("'", "'\"'\"'") + "'"
+
+
+def quote_path(value: Path | str) -> str:
+    """Force-quote a path for the ninja command line (shell/CreateProcess)."""
+    return shell_token(str(value), force=True)

esphome/build_helpers/size_summary.py

@@ -0,0 +1,24 @@
+"""The PlatformIO-format size bar shared by the native toolchains."""
+
+from __future__ import annotations
+
+
+def format_bar(used: int, total: int) -> str:
+    """Match PlatformIO's ``_format_availale_bytes`` (sic, pioupload.py) exactly."""
+    pct_raw = used / total if total else 0
+    blocks = 10
+    filled = min(int(round(blocks * pct_raw)), blocks)
+    progress = "=" * filled
+    return (
+        f"[{progress:<{blocks}}] {pct_raw: 6.1%} "
+        f"(used {used:d} bytes from {total:d} bytes)"
+    )
+
+
+def print_size_line(label: str, used: int, total: int) -> None:
+    """One PlatformIO-format summary line (``RAM``/``Flash``).
+
+    The label padding is part of the format: ``script/ci_memory_impact_extract.py``
+    matches these lines verbatim.
+    """
+    print(f"{label + ':':<7}{format_bar(used, total)}")

esphome/build_helpers/tools_cache.py

@@ -0,0 +1,36 @@
+"""Machine-global tools cache location shared by the native backends."""
+
+from __future__ import annotations
+
+from pathlib import Path
+
+
+def tools_cache_path(env_var: str, subdir: str) -> Path:
+    """A backend's machine-global tools directory, with an env override.
+
+    A blank/whitespace override is treated as unset: ``Path("")`` resolves
+    to the CWD, which ``clean-all`` would then delete.
+    """
+    import platformdirs
+
+    from esphome.helpers import get_str_env
+
+    if prefix := get_str_env(env_var, "").strip():
+        # resolve(): symlinked prefixes otherwise trip idf.py's
+        # venv-mismatch warning on every build
+        return Path(prefix).expanduser().resolve()
+    # appauthor=False keeps the Windows path short (no vendor segment);
+    # deep IDF trees run into MAX_PATH otherwise
+    return (
+        Path(platformdirs.user_cache_dir("esphome", appauthor=False)) / subdir
+    ).resolve()
+
+
+# (env override, cache subdir) per native backend. writer.clean_all wipes
+# every entry via tools_cache_path, so listing a cache here is the single
+# step that registers it for removal; the backends' own path getters use
+# the same named pairs so the two cannot drift.
+IDF_TOOLS_CACHE = ("ESPHOME_ESP_IDF_PREFIX", "idf")
+SDK_NRF_TOOLS_CACHE = ("ESPHOME_SDK_NRF_PREFIX", "sdk-nrf")
+ARDUINO8266_TOOLS_CACHE = ("ESPHOME_ARDUINO8266_PREFIX", "arduino8266")
+TOOLS_CACHE_SPECS = (IDF_TOOLS_CACHE, SDK_NRF_TOOLS_CACHE, ARDUINO8266_TOOLS_CACHE)

esphome/compiled_config.py

@@ -100,6 +100,21 @@ def _refresh_sidecar() -> bool:
             )
             return False
         if old is not None and old.can_apply_to_core():
+            if (
+                old.toolchain is not None
+                and CORE.toolchain is not None
+                and old.toolchain != CORE.toolchain.value
+            ):
+                # Platforms normalize toolchain-sensitive keys differently;
+                # never cache a config validated under a different toolchain
+                # than the compile's
+                _LOGGER.debug(
+                    "Not caching: config validated with toolchain %r but the "
+                    "last compile used %r",
+                    CORE.toolchain.value,
+                    old.toolchain,
+                )
+                return False
             # Compile-written; nothing to refresh.
             return True
         if CORE.build_path is not None and CORE.build_path.exists():

esphome/components/api/__init__.py

@@ -1,3 +1,4 @@
+import base64
 import logging
 from typing import Any
 
@@ -5,15 +6,6 @@ from esphome import automation
 from esphome.automation import Condition
 import esphome.codegen as cg
 from esphome.components.logger import request_log_listener
-
-# ENCRYPTION_SCHEMA and validate_encryption_key are re-exported for external
-# components and downstream consumers that import them from api
-from esphome.components.noise import (  # noqa: F401
-    ENCRYPTION_SCHEMA,
-    decode_encryption_key,
-    encryption_schema,
-    validate_encryption_key,
-)
 from esphome.config_helpers import get_logger_level
 import esphome.config_validation as cv
 from esphome.const import (
@@ -46,10 +38,6 @@ from esphome.core import CORE, ID, CoroPriority, EsphomeError, coroutine_with_pr
 from esphome.cpp_generator import MockObj, TemplateArgsType
 from esphome.types import ConfigFragmentType, ConfigType
 
-# Compat alias: downstream consumers (e.g. device-builder) referenced the
-# schema by its old private name before it moved to the noise component
-_encryption_schema = encryption_schema
-
 _LOGGER = logging.getLogger(__name__)
 
 DOMAIN = "api"
@@ -58,15 +46,9 @@ CODEOWNERS = ["@esphome/core"]
 
 
 def AUTO_LOAD(config: ConfigType) -> list[str]:
-    """Conditionally auto-load noise (encryption) and json (capture_response)."""
+    """Conditionally auto-load json only when capture_response is used."""
     base = ["socket"]
 
-    # A falsy config is a tooling probe for the maximal set (None from
-    # dependency resolution, {} from the components-graph platform probe);
-    # a validated config always carries defaults, never empty
-    if not config or CONF_ENCRYPTION in config:
-        base = base + ["noise"]
-
     # Check if any homeassistant.action/homeassistant.service has capture_response: true
     # This flag is set during config validation in _validate_response_config
     if not config or CORE.data.get(DOMAIN, {}).get(CONF_CAPTURE_RESPONSE, False):
@@ -148,6 +130,20 @@ def _register_provisioning_source(config: ConfigType) -> ConfigType:
     return config
 
 
+def validate_encryption_key(value: Any) -> str:
+    value = cv.string_strict(value)
+    try:
+        decoded = base64.b64decode(value, validate=True)
+    except ValueError as err:
+        raise cv.Invalid("Invalid key format, please check it's using base64") from err
+
+    if len(decoded) != 32:
+        raise cv.Invalid("Encryption key must be base64 and 32 bytes long")
+
+    # Return original data for roundtrip conversion
+    return value
+
+
 CONF_SUPPORTS_RESPONSE = "supports_response"
 
 # Enum values in api::enums namespace
@@ -254,6 +250,18 @@ ACTIONS_SCHEMA = automation.validate_automation(
     ),
 )
 
+ENCRYPTION_SCHEMA = cv.Schema(
+    {
+        cv.Optional(CONF_KEY): cv.sensitive(validate_encryption_key),
+    }
+)
+
+
+def _encryption_schema(config: ConfigType | None) -> ConfigType:
+    if config is None:
+        config = {}
+    return ENCRYPTION_SCHEMA(config)
+
 
 def _consume_api_sockets(config: ConfigType) -> ConfigType:
     """Register socket needs for API component."""
@@ -289,7 +297,7 @@ CONFIG_SCHEMA = cv.All(
                 CONF_SERVICES, group_of_exclusion=CONF_ACTIONS
             ): ACTIONS_SCHEMA,
             cv.Exclusive(CONF_ACTIONS, group_of_exclusion=CONF_ACTIONS): ACTIONS_SCHEMA,
-            cv.Optional(CONF_ENCRYPTION): encryption_schema,
+            cv.Optional(CONF_ENCRYPTION): _encryption_schema,
             cv.Optional(CONF_BATCH_DELAY, default="100ms"): cv.All(
                 cv.positive_time_period_milliseconds,
                 cv.Range(max=cv.TimePeriod(milliseconds=65535)),
@@ -476,7 +484,7 @@ async def to_code(config: ConfigType) -> None:
 
     if (encryption_config := config.get(CONF_ENCRYPTION, None)) is not None:
         if key := encryption_config.get(CONF_KEY):
-            decoded = decode_encryption_key(key)
+            decoded = base64.b64decode(key)
             cg.add(var.set_noise_psk(list(decoded)))
             cg.add_define("USE_API_NOISE_PSK_FROM_YAML")
         else:
@@ -490,6 +498,10 @@ async def to_code(config: ConfigType) -> None:
             # and plaintext disabled. Only a factory reset can remove it.
             cg.add_define("USE_API_PLAINTEXT")
         cg.add_define("USE_API_NOISE")
+        cg.add_library("esphome/noise-c", "0.1.21")
+        # Enable optimized memzero/memcmp in libsodium instead of volatile byte loops
+        cg.add_build_flag("-DHAVE_WEAK_SYMBOLS=1")
+        cg.add_build_flag("-DHAVE_INLINE_ASM=1")
     else:
         cg.add_define("USE_API_PLAINTEXT")
 

esphome/components/api/api_connection.cpp

@@ -2130,7 +2130,7 @@ bool APIConnection::send_noise_encryption_set_key_response_(const NoiseEncryptio
   }
 #endif
 
-  noise::psk_t psk{};
+  psk_t psk{};
   if (msg.key_len == 0) {
     if (this->parent_->clear_noise_psk(true)) {
       resp.success = true;
@@ -2139,7 +2139,7 @@ bool APIConnection::send_noise_encryption_set_key_response_(const NoiseEncryptio
     }
   } else if (base64_decode(msg.key, msg.key_len, psk.data(), psk.size()) != psk.size()) {
     ESP_LOGW(TAG, "Invalid encryption key length");
-  } else if (noise::NoiseContext::is_all_zeros(psk)) {
+  } else if (APINoiseContext::is_all_zeros(psk)) {
     // Accepting the reserved provisioning PSK would report success without
     // enabling encryption (or silently clear an existing key)
     ESP_LOGW(TAG, "Rejecting all-zero encryption key");

esphome/components/api/api_frame_helper_noise.cpp

@@ -2,9 +2,9 @@
 #ifdef USE_API
 #ifdef USE_API_NOISE
 #include "api_connection.h"  // For ClientInfo struct
-#include "esphome/components/noise/noise.h"
 #include "esphome/core/application.h"
 #include "esphome/core/entity_base.h"
+#include "esphome/core/hal.h"
 #include "esphome/core/helpers.h"
 #include "esphome/core/log.h"
 #include "proto.h"
@@ -17,14 +17,6 @@
 
 namespace esphome::api {
 
-using noise::noise_err_to_logstr;
-
-// api_frame_helper.h keeps its own MAX_HANDSHAKE_SIZE because that header is
-// also compiled in plaintext-only builds without the noise component; keep
-// the two definitions from drifting apart.
-static_assert(MAX_HANDSHAKE_SIZE == noise::MAX_HANDSHAKE_SIZE,
-              "api and noise component handshake size limits must match");
-
 static const char *const TAG = "api.noise";
 #ifdef USE_ESP8266
 static constexpr char PROLOGUE_INIT[] PROGMEM = "NoiseAPIInit";
@@ -59,6 +51,45 @@ static constexpr size_t API_MAX_LOG_BYTES = 168;
 #define LOG_PACKET_RECEIVED(buffer) ((void) 0)
 #endif
 
+/// Convert a noise error code to a readable error
+const LogString *noise_err_to_logstr(int err) {
+  if (err == NOISE_ERROR_NO_MEMORY)
+    return LOG_STR("NO_MEMORY");
+  if (err == NOISE_ERROR_UNKNOWN_ID)
+    return LOG_STR("UNKNOWN_ID");
+  if (err == NOISE_ERROR_UNKNOWN_NAME)
+    return LOG_STR("UNKNOWN_NAME");
+  if (err == NOISE_ERROR_MAC_FAILURE)
+    return LOG_STR("MAC_FAILURE");
+  if (err == NOISE_ERROR_NOT_APPLICABLE)
+    return LOG_STR("NOT_APPLICABLE");
+  if (err == NOISE_ERROR_SYSTEM)
+    return LOG_STR("SYSTEM");
+  if (err == NOISE_ERROR_REMOTE_KEY_REQUIRED)
+    return LOG_STR("REMOTE_KEY_REQUIRED");
+  if (err == NOISE_ERROR_LOCAL_KEY_REQUIRED)
+    return LOG_STR("LOCAL_KEY_REQUIRED");
+  if (err == NOISE_ERROR_PSK_REQUIRED)
+    return LOG_STR("PSK_REQUIRED");
+  if (err == NOISE_ERROR_INVALID_LENGTH)
+    return LOG_STR("INVALID_LENGTH");
+  if (err == NOISE_ERROR_INVALID_PARAM)
+    return LOG_STR("INVALID_PARAM");
+  if (err == NOISE_ERROR_INVALID_STATE)
+    return LOG_STR("INVALID_STATE");
+  if (err == NOISE_ERROR_INVALID_NONCE)
+    return LOG_STR("INVALID_NONCE");
+  if (err == NOISE_ERROR_INVALID_PRIVATE_KEY)
+    return LOG_STR("INVALID_PRIVATE_KEY");
+  if (err == NOISE_ERROR_INVALID_PUBLIC_KEY)
+    return LOG_STR("INVALID_PUBLIC_KEY");
+  if (err == NOISE_ERROR_INVALID_FORMAT)
+    return LOG_STR("INVALID_FORMAT");
+  if (err == NOISE_ERROR_INVALID_SIGNATURE)
+    return LOG_STR("INVALID_SIGNATURE");
+  return LOG_STR("UNKNOWN");
+}
+
 /// Initialize the frame helper, returns OK if successful.
 APIError APINoiseFrameHelper::init() {
   APIError err = init_common_();
@@ -163,9 +194,9 @@ APIError APINoiseFrameHelper::loop() {
  */
 APIError APINoiseFrameHelper::try_read_frame_() {
   // read header
-  if (rx_header_buf_len_ < noise::FRAME_HEADER_SIZE) {
+  if (rx_header_buf_len_ < 3) {
     // no header information yet
-    uint8_t to_read = static_cast<uint8_t>(noise::FRAME_HEADER_SIZE) - rx_header_buf_len_;
+    uint8_t to_read = 3 - rx_header_buf_len_;
     ssize_t received = this->socket_->read(&rx_header_buf_[rx_header_buf_len_], to_read);
     APIError err = handle_socket_read_result_(received);
     if (err != APIError::OK) {
@@ -177,7 +208,7 @@ APIError APINoiseFrameHelper::try_read_frame_() {
       return APIError::WOULD_BLOCK;
     }
 
-    if (rx_header_buf_[0] != noise::FRAME_INDICATOR) {
+    if (rx_header_buf_[0] != 0x01) {
       state_ = State::FAILED;
       HELPER_LOG("Bad indicator byte %u", rx_header_buf_[0]);
       return APIError::BAD_INDICATOR;
@@ -317,15 +348,15 @@ APIError APINoiseFrameHelper::state_action_server_hello_() {
   return APIError::OK;
 }
 APIError APINoiseFrameHelper::state_action_handshake_() {
-  noise::NoiseResponderHandshake::Action action = this->handshake_.action();
-  if (action == noise::NoiseResponderHandshake::Action::ACTION_READ) {
+  int action = noise_handshakestate_get_action(this->handshake_);
+  if (action == NOISE_ACTION_READ_MESSAGE) {
     return this->state_action_handshake_read_();
-  } else if (action == noise::NoiseResponderHandshake::Action::ACTION_WRITE) {
+  } else if (action == NOISE_ACTION_WRITE_MESSAGE) {
     return this->state_action_handshake_write_();
   }
   // bad state for action
   this->state_ = State::FAILED;
-  HELPER_LOG("Bad action for handshake: %d", (int) action);
+  HELPER_LOG("Bad action for handshake: %d", action);
   return APIError::HANDSHAKESTATE_BAD_STATE;
 }
 APIError APINoiseFrameHelper::state_action_handshake_read_() {
@@ -337,16 +368,20 @@ APIError APINoiseFrameHelper::state_action_handshake_read_() {
   if (this->rx_buf_.empty()) {
     this->send_explicit_handshake_reject_(LOG_STR("Empty handshake message"));
     return APIError::BAD_HANDSHAKE_ERROR_BYTE;
-  } else if (this->rx_buf_[0] != noise::HANDSHAKE_STATUS_OK) {
+  } else if (this->rx_buf_[0] != 0x00) {
     HELPER_LOG("Bad handshake error byte: %u", this->rx_buf_[0]);
     this->send_explicit_handshake_reject_(LOG_STR("Bad handshake error byte"));
     return APIError::BAD_HANDSHAKE_ERROR_BYTE;
   }
 
-  int err = this->handshake_.read_message(this->rx_buf_.data() + 1, this->rx_buf_.size() - 1);
+  NoiseBuffer mbuf;
+  noise_buffer_init(mbuf);
+  noise_buffer_set_input(mbuf, this->rx_buf_.data() + 1, this->rx_buf_.size() - 1);
+  int err = noise_handshakestate_read_message(this->handshake_, &mbuf, nullptr);
   if (err != 0) {
     // Special handling for MAC failure
-    this->send_explicit_handshake_reject_(noise::reject_reason_for(err));
+    this->send_explicit_handshake_reject_(err == NOISE_ERROR_MAC_FAILURE ? LOG_STR("Handshake MAC failure")
+                                                                         : LOG_STR("Handshake error"));
     return this->handle_noise_error_(err, LOG_STR("noise_handshakestate_read_message"),
                                      APIError::HANDSHAKESTATE_READ_FAILED);
   }
@@ -355,16 +390,18 @@ APIError APINoiseFrameHelper::state_action_handshake_read_() {
 }
 APIError APINoiseFrameHelper::state_action_handshake_write_() {
   uint8_t buffer[65];
-  size_t msg_len = 0;
+  NoiseBuffer mbuf;
+  noise_buffer_init(mbuf);
+  noise_buffer_set_output(mbuf, buffer + 1, sizeof(buffer) - 1);
 
-  int err = this->handshake_.write_message(buffer + 1, sizeof(buffer) - 1, msg_len);
+  int err = noise_handshakestate_write_message(this->handshake_, &mbuf, nullptr);
   APIError aerr = this->handle_noise_error_(err, LOG_STR("noise_handshakestate_write_message"),
                                             APIError::HANDSHAKESTATE_WRITE_FAILED);
   if (aerr != APIError::OK)
     return aerr;
-  buffer[0] = noise::HANDSHAKE_STATUS_OK;
+  buffer[0] = 0x00;  // success
 
-  aerr = this->write_frame_(buffer, msg_len + 1);
+  aerr = this->write_frame_(buffer, mbuf.size + 1);
   if (aerr != APIError::OK)
     return aerr;
   return this->check_handshake_finished_();
@@ -372,22 +409,33 @@ APIError APINoiseFrameHelper::state_action_handshake_write_() {
 void APINoiseFrameHelper::send_explicit_handshake_reject_(const LogString *reason) {
   // Max reject message: "Bad handshake packet len" (24) + 1 (failure byte) = 25 bytes
   uint8_t data[32];
-  static_assert(sizeof(data) >= noise::MAC_FAILURE_PAYLOAD_SIZE,
-                "reject buffer must fit the MAC failure wire contract");
-  size_t data_size = noise::format_reject_payload(data, sizeof(data), reason);
+  data[0] = 0x01;  // failure
+
+#ifdef USE_STORE_LOG_STR_IN_FLASH
+  // On ESP8266 with flash strings, we need to use PROGMEM-aware functions
+  size_t reason_len = strlen_P(reinterpret_cast<PGM_P>(reason));
+  reason_len = std::min(reason_len, sizeof(data) - 1);
+  if (reason_len > 0) {
+    memcpy_P(data + 1, reinterpret_cast<PGM_P>(reason), reason_len);
+  }
+#else
+  // Normal memory access
+  const char *reason_str = LOG_STR_ARG(reason);
+  size_t reason_len = strlen(reason_str);
+  reason_len = std::min(reason_len, sizeof(data) - 1);
+  if (reason_len > 0) {
+    // NOLINTNEXTLINE(bugprone-not-null-terminated-result) - binary protocol, not a C string
+    std::memcpy(data + 1, reason_str, reason_len);
+  }
+#endif
+
+  size_t data_size = reason_len + 1;
 
   // temporarily remove failed state
   auto orig_state = state_;
   state_ = State::EXPLICIT_REJECT;
-  APIError aerr = write_frame_(data, data_size);
-  if (aerr != APIError::OK) {
-    // Best effort; the reject reason is a diagnosis aid, not a protocol step
-    ESP_LOGW(TAG, "Sending handshake reject failed: %d", (int) aerr);
-  }
-  if (state_ == State::EXPLICIT_REJECT) {
-    // write_frame_ may have moved the state to FAILED; keep that decision
-    state_ = orig_state;
-  }
+  write_frame_(data, data_size);
+  state_ = orig_state;
 }
 APIError APINoiseFrameHelper::read_packet(ReadPacketBuffer *buffer) {
   APIError aerr = this->check_data_state_();
@@ -444,10 +492,12 @@ APIError APINoiseFrameHelper::read_packet(ReadPacketBuffer *buffer) {
 // Returns APIError::OK on success.
 APIError APINoiseFrameHelper::encrypt_noise_message_(uint8_t *buf_start, uint16_t payload_size, uint8_t message_type,
                                                      uint16_t &encrypted_len_out) {
-  // The noise frame header is written after encryption, when the size is known
+  // Write noise header
+  buf_start[0] = 0x01;  // indicator
+  // buf_start[1], buf_start[2] to be set after encryption
 
   // Write message header (to be encrypted)
-  constexpr uint8_t msg_offset = noise::FRAME_HEADER_SIZE;
+  constexpr uint8_t msg_offset = 3;
   buf_start[msg_offset] = static_cast<uint8_t>(message_type >> 8);      // type high byte
   buf_start[msg_offset + 1] = static_cast<uint8_t>(message_type);       // type low byte
   buf_start[msg_offset + 2] = static_cast<uint8_t>(payload_size >> 8);  // data_len high byte
@@ -465,10 +515,11 @@ APIError APINoiseFrameHelper::encrypt_noise_message_(uint8_t *buf_start, uint16_
   if (aerr != APIError::OK)
     return aerr;
 
-  // Fill in the frame header now that the encrypted size is known
-  noise::write_frame_header(buf_start, static_cast<uint16_t>(mbuf.size));
+  // Fill in the encrypted size
+  buf_start[1] = static_cast<uint8_t>(mbuf.size >> 8);
+  buf_start[2] = static_cast<uint8_t>(mbuf.size);
 
-  encrypted_len_out = static_cast<uint16_t>(noise::FRAME_HEADER_SIZE + mbuf.size);
+  encrypted_len_out = static_cast<uint16_t>(3 + mbuf.size);  // indicator + size + encrypted data
   return APIError::OK;
 }
 
@@ -517,19 +568,21 @@ APIError APINoiseFrameHelper::write_protobuf_messages(ProtoWriteBuffer buffer, s
 }
 
 APIError APINoiseFrameHelper::write_frame_(const uint8_t *data, uint16_t len) {
-  uint8_t header[noise::FRAME_HEADER_SIZE];
-  noise::write_frame_header(header, len);
+  uint8_t header[3];
+  header[0] = 0x01;  // indicator
+  header[1] = (uint8_t) (len >> 8);
+  header[2] = (uint8_t) len;
 
   if (len == 0) {
-    return this->write_raw_buf_(header, noise::FRAME_HEADER_SIZE);
+    return this->write_raw_buf_(header, 3);
   }
   struct iovec iov[2];
   iov[0].iov_base = header;
-  iov[0].iov_len = noise::FRAME_HEADER_SIZE;
+  iov[0].iov_len = 3;
   iov[1].iov_base = const_cast<uint8_t *>(data);
   iov[1].iov_len = len;
 
-  return this->write_raw_iov_(iov, 2, noise::FRAME_HEADER_SIZE + len);
+  return this->write_raw_iov_(iov, 2, 3 + len);
 }
 
 /** Initiate the data structures for the handshake.
@@ -537,12 +590,45 @@ APIError APINoiseFrameHelper::write_frame_(const uint8_t *data, uint16_t len) {
  * @return 0 on success, -1 on error (check errno)
  */
 APIError APINoiseFrameHelper::init_handshake_() {
-  int err = this->handshake_.init(this->ctx_.get_psk(), prologue_.data(), prologue_.size());
-  APIError aerr = handle_noise_error_(err, LOG_STR("noise_handshake_init"), APIError::HANDSHAKESTATE_SETUP_FAILED);
+  int err;
+  // Noise_NNpsk0_25519_ChaChaPoly_SHA256, built on the stack:
+  // noise_handshakestate_new_by_id copies it, so a member would waste
+  // 104 bytes per connection, and a static const would sit in RAM on
+  // ESP8266 (.rodata is DRAM there).
+  const NoiseProtocolId nid = {
+      .prefix_id = NOISE_PREFIX_STANDARD,
+      .pattern_id = NOISE_PATTERN_NN,
+      .modifier_ids = {NOISE_MODIFIER_PSK0},
+      .dh_id = NOISE_DH_CURVE25519,
+      .cipher_id = NOISE_CIPHER_CHACHAPOLY,
+      .hash_id = NOISE_HASH_SHA256,
+      .hybrid_id = NOISE_DH_NONE,
+  };
+
+  err = noise_handshakestate_new_by_id(&handshake_, &nid, NOISE_ROLE_RESPONDER);
+  APIError aerr =
+      handle_noise_error_(err, LOG_STR("noise_handshakestate_new_by_id"), APIError::HANDSHAKESTATE_SETUP_FAILED);
   if (aerr != APIError::OK)
     return aerr;
-  // init copies the prologue into the handshakestate, so we can get rid of it now
+
+  const auto &psk = this->ctx_.get_psk();
+  err = noise_handshakestate_set_pre_shared_key(handshake_, psk.data(), psk.size());
+  aerr = handle_noise_error_(err, LOG_STR("noise_handshakestate_set_pre_shared_key"),
+                             APIError::HANDSHAKESTATE_SETUP_FAILED);
+  if (aerr != APIError::OK)
+    return aerr;
+
+  err = noise_handshakestate_set_prologue(handshake_, prologue_.data(), prologue_.size());
+  aerr = handle_noise_error_(err, LOG_STR("noise_handshakestate_set_prologue"), APIError::HANDSHAKESTATE_SETUP_FAILED);
+  if (aerr != APIError::OK)
+    return aerr;
+  // set_prologue copies it into handshakestate, so we can get rid of it now
   prologue_.release();
+
+  err = noise_handshakestate_start(handshake_);
+  aerr = handle_noise_error_(err, LOG_STR("noise_handshakestate_start"), APIError::HANDSHAKESTATE_SETUP_FAILED);
+  if (aerr != APIError::OK)
+    return aerr;
   return APIError::OK;
 }
 
@@ -551,17 +637,15 @@ APIError APINoiseFrameHelper::check_handshake_finished_() {
   assert(state_ == State::HANDSHAKE);
 #endif
 
-  noise::NoiseResponderHandshake::Action action = this->handshake_.action();
-  if (action == noise::NoiseResponderHandshake::Action::ACTION_READ ||
-      action == noise::NoiseResponderHandshake::Action::ACTION_WRITE)
+  int action = noise_handshakestate_get_action(handshake_);
+  if (action == NOISE_ACTION_READ_MESSAGE || action == NOISE_ACTION_WRITE_MESSAGE)
     return APIError::OK;
-  if (action != noise::NoiseResponderHandshake::Action::ACTION_SPLIT) {
+  if (action != NOISE_ACTION_SPLIT) {
     state_ = State::FAILED;
-    HELPER_LOG("Bad action for handshake: %d", (int) action);
+    HELPER_LOG("Bad action for handshake: %d", action);
     return APIError::HANDSHAKESTATE_BAD_STATE;
   }
-  // split() also frees the handshake state
-  int err = this->handshake_.split(send_cipher_, recv_cipher_);
+  int err = noise_handshakestate_split(handshake_, &send_cipher_, &recv_cipher_);
   APIError aerr =
       handle_noise_error_(err, LOG_STR("noise_handshakestate_split"), APIError::HANDSHAKESTATE_SPLIT_FAILED);
   if (aerr != APIError::OK)
@@ -570,11 +654,17 @@ APIError APINoiseFrameHelper::check_handshake_finished_() {
   this->frame_footer_size_ = noise_cipherstate_get_mac_length(send_cipher_);
 
   HELPER_LOG("Handshake complete!");
+  noise_handshakestate_free(handshake_);
+  handshake_ = nullptr;
   state_ = State::DATA;
   return APIError::OK;
 }
 
 APINoiseFrameHelper::~APINoiseFrameHelper() {
+  if (handshake_ != nullptr) {
+    noise_handshakestate_free(handshake_);
+    handshake_ = nullptr;
+  }
   if (send_cipher_ != nullptr) {
     noise_cipherstate_free(send_cipher_);
     send_cipher_ = nullptr;
@@ -585,6 +675,16 @@ APINoiseFrameHelper::~APINoiseFrameHelper() {
   }
 }
 
+extern "C" {
+// declare how noise generates random bytes (here with a good HWRNG based on the RF system)
+void noise_rand_bytes(void *output, size_t len) {
+  if (!esphome::random_bytes(reinterpret_cast<uint8_t *>(output), len)) {
+    ESP_LOGE(TAG, "Acquiring random bytes failed; rebooting");
+    arch_restart();
+  }
+}
+}
+
 }  // namespace esphome::api
 #endif  // USE_API_NOISE
 #endif  // USE_API

esphome/components/api/api_frame_helper_noise.h

@@ -3,7 +3,7 @@
 #ifdef USE_API
 #ifdef USE_API_NOISE
 #include "noise/protocol.h"
-#include "esphome/components/noise/noise_handshake.h"
+#include "api_noise_context.h"
 
 namespace esphome::api {
 
@@ -14,9 +14,9 @@ class APINoiseFrameHelper final : public APIFrameHelper {
   // Pos 1-2: encrypted payload size (16-bit big-endian)
   // Pos 3-6: encrypted type (16-bit) + data_len (16-bit)
   // Pos 7+: actual payload data
-  static constexpr uint8_t HEADER_PADDING = noise::FRAME_HEADER_SIZE + 2 + 2;  // frame header + type + data_len
+  static constexpr uint8_t HEADER_PADDING = 1 + 2 + 2 + 2;  // indicator + size + type + data_len
 
-  APINoiseFrameHelper(std::unique_ptr<socket::Socket> socket, noise::NoiseContext &ctx)
+  APINoiseFrameHelper(std::unique_ptr<socket::Socket> socket, APINoiseContext &ctx)
       : APIFrameHelper(std::move(socket)), ctx_(ctx) {
     frame_header_padding_ = HEADER_PADDING;
   }
@@ -52,13 +52,13 @@ class APINoiseFrameHelper final : public APIFrameHelper {
   APIError handle_handshake_frame_error_(APIError aerr);
   APIError handle_noise_error_(int err, const LogString *func_name, APIError api_err);
 
-  // Pointers first (4 bytes each; the handshake wrapper holds one pointer)
-  noise::NoiseResponderHandshake handshake_;
+  // Pointers first (4 bytes each)
+  NoiseHandshakeState *handshake_{nullptr};
   NoiseCipherState *send_cipher_{nullptr};
   NoiseCipherState *recv_cipher_{nullptr};
 
   // Reference to noise context (4 bytes on 32-bit)
-  noise::NoiseContext &ctx_;
+  APINoiseContext &ctx_;
 
   // Buffer for noise handshake prologue (released after handshake)
   APIBuffer prologue_;
@@ -67,7 +67,7 @@ class APINoiseFrameHelper final : public APIFrameHelper {
   // Fixed-size header buffer for noise protocol:
   // 1 byte for indicator + 2 bytes for message size (16-bit value, not varint)
   // Note: Maximum message size is UINT16_MAX (65535), with a limit of 128 bytes during handshake phase
-  uint8_t rx_header_buf_[noise::FRAME_HEADER_SIZE];
+  uint8_t rx_header_buf_[3];
   uint8_t rx_header_buf_len_ = 0;
   // 4 bytes total, no padding
 };

esphome/components/api/api_noise_context.h

@@ -0,0 +1,37 @@
+#pragma once
+#include <array>
+#include <cstdint>
+#include "esphome/core/defines.h"
+
+namespace esphome::api {
+
+#ifdef USE_API_NOISE
+using psk_t = std::array<uint8_t, 32>;
+
+class APINoiseContext {
+ public:
+  // The all-zeros PSK is reserved: it marks the device as unprovisioned and
+  // doubles as the well-known provisioning PSK that unprovisioned devices
+  // accept for Noise handshakes (passive-sniffing protection only, no
+  // authentication). It is never a valid real key.
+  static bool is_all_zeros(const psk_t &psk) {
+    uint8_t acc = 0;
+    for (uint8_t b : psk) {
+      acc |= b;
+    }
+    return acc == 0;
+  }
+  void set_psk(psk_t psk) {
+    this->psk_ = psk;
+    this->has_psk_ = !is_all_zeros(psk);
+  }
+  const psk_t &get_psk() const { return this->psk_; }
+  bool has_psk() const { return this->has_psk_; }
+
+ protected:
+  psk_t psk_{};
+  bool has_psk_{false};
+};
+#endif  // USE_API_NOISE
+
+}  // namespace esphome::api

esphome/components/api/api_server.cpp

@@ -588,7 +588,7 @@ bool APIServer::load_and_apply_noise_psk_() {
   return true;
 }
 
-bool APIServer::save_noise_psk(noise::psk_t psk, bool make_active) {
+bool APIServer::save_noise_psk(psk_t psk, bool make_active) {
 #ifdef USE_API_NOISE_PSK_FROM_YAML
   // When PSK is set from YAML, this function should never be called
   // but if it is, reject the change

esphome/components/api/api_server.h

@@ -5,10 +5,7 @@
 #include "api_buffer.h"
 // Must precede clients_ so APIConnection is complete for default_delete (libc++).
 #include "api_connection.h"
-#ifdef USE_API_NOISE
-// Only present in the build when the noise component is loaded
-#include "esphome/components/noise/noise.h"
-#endif
+#include "api_noise_context.h"
 #include "api_pb2.h"
 #include "api_pb2_service.h"
 #include "esphome/components/socket/socket.h"
@@ -40,7 +37,7 @@ class UserServiceDescriptor;
 
 #ifdef USE_API_NOISE
 struct SavedNoisePsk {
-  noise::psk_t psk;
+  psk_t psk;
 } PACKED;  // NOLINT
 #endif
 
@@ -76,10 +73,10 @@ class APIServer final : public Component,
   APIBuffer &get_shared_buffer_ref() { return shared_write_buffer_; }
 
 #ifdef USE_API_NOISE
-  bool save_noise_psk(noise::psk_t psk, bool make_active = true);
+  bool save_noise_psk(psk_t psk, bool make_active = true);
   bool clear_noise_psk(bool make_active = true);
-  void set_noise_psk(noise::psk_t psk) { this->noise_ctx_.set_psk(psk); }
-  noise::NoiseContext &get_noise_ctx() { return this->noise_ctx_; }
+  void set_noise_psk(psk_t psk) { this->noise_ctx_.set_psk(psk); }
+  APINoiseContext &get_noise_ctx() { return this->noise_ctx_; }
 #endif  // USE_API_NOISE
 
   void handle_disconnect(APIConnection *conn);
@@ -357,7 +354,7 @@ class APIServer final : public Component,
 #endif
 
 #ifdef USE_API_NOISE
-  noise::NoiseContext noise_ctx_;
+  APINoiseContext noise_ctx_;
   ESPPreferenceObject noise_pref_;
 #endif  // USE_API_NOISE
 };

esphome/components/binary_sensor/__init__.py

@@ -5,7 +5,6 @@ from esphome.automation import Condition, maybe_simple_id
 import esphome.codegen as cg
 from esphome.components import mqtt, web_server, zigbee
 from esphome.components.const import CONF_ON_STATE_CHANGE
-from esphome.config_helpers import filter_source_files_from_defines
 import esphome.config_validation as cv
 from esphome.const import (
     CONF_DELAY,
@@ -561,11 +560,6 @@ _CALLBACK_AUTOMATIONS = (
 async def _build_binary_sensor_automations(var, config):
     await automation.build_callback_automations(var, config, _CALLBACK_AUTOMATIONS)
 
-    if config.get(CONF_ON_CLICK) or config.get(CONF_ON_DOUBLE_CLICK):
-        cg.add_define("USE_BINARY_SENSOR_CLICK_TRIGGER")
-    if config.get(CONF_ON_MULTI_CLICK):
-        cg.add_define("USE_BINARY_SENSOR_MULTI_CLICK_TRIGGER")
-
     for conf in config.get(CONF_ON_CLICK, []):
         trigger = cg.new_Pvariable(
             conf[CONF_TRIGGER_ID], var, conf[CONF_MIN_LENGTH], conf[CONF_MAX_LENGTH]
@@ -679,15 +673,3 @@ async def to_code(config):
 async def binary_sensor_invalidate_state_to_code(config, action_id, template_arg, args):
     paren = await cg.get_variable(config[CONF_ID])
     return cg.new_Pvariable(action_id, template_arg, paren)
-
-
-# automation.cpp only implements the click/double_click/multi_click triggers
-FILTER_SOURCE_FILES = filter_source_files_from_defines(
-    {
-        "automation.cpp": (
-            "USE_BINARY_SENSOR_CLICK_TRIGGER",
-            "USE_BINARY_SENSOR_MULTI_CLICK_TRIGGER",
-        ),
-        "filter.cpp": "USE_BINARY_SENSOR_FILTER",
-    }
-)

esphome/components/binary_sensor/automation.cpp

@@ -1,13 +1,8 @@
-#include "esphome/core/defines.h"
-#if defined(USE_BINARY_SENSOR_CLICK_TRIGGER) || defined(USE_BINARY_SENSOR_MULTI_CLICK_TRIGGER)
-
 #include "automation.h"
 #include "esphome/core/log.h"
 
 namespace esphome::binary_sensor {
 
-#ifdef USE_BINARY_SENSOR_MULTI_CLICK_TRIGGER
-
 static const char *const TAG = "binary_sensor.automation";
 
 // MultiClickTrigger timeout IDs.
@@ -125,9 +120,6 @@ void MultiClickTriggerBase::trigger_() {
   this->trigger();
 }
 
-#endif  // USE_BINARY_SENSOR_MULTI_CLICK_TRIGGER
-
-#ifdef USE_BINARY_SENSOR_CLICK_TRIGGER
 bool match_interval(uint32_t min_length, uint32_t max_length, uint32_t length) {
   if (max_length == 0) {
     return length >= min_length;
@@ -135,8 +127,4 @@ bool match_interval(uint32_t min_length, uint32_t max_length, uint32_t length) {
     return length >= min_length && length <= max_length;
   }
 }
-#endif  // USE_BINARY_SENSOR_CLICK_TRIGGER
-
 }  // namespace esphome::binary_sensor
-
-#endif  // USE_BINARY_SENSOR_CLICK_TRIGGER || USE_BINARY_SENSOR_MULTI_CLICK_TRIGGER

esphome/components/esp32/__init__.py

@@ -12,7 +12,6 @@ from typing import Any
 from esphome import yaml_util
 import esphome.codegen as cg
 from esphome.components.const import CONF_ENABLE_OTA_DOWNGRADE_PROTECTION
-from esphome.config_helpers import filter_source_files_from_defines
 import esphome.config_validation as cv
 from esphome.const import (
     CONF_ADVANCED,
@@ -1073,19 +1072,11 @@ def _check_esp_idf_versions(config: ConfigType) -> ConfigType:
     return config
 
 
-def _validate_toolchain(value) -> Toolchain:
-    return Toolchain(
-        cv.one_of(Toolchain.PLATFORMIO, Toolchain.ESP_IDF, lower=True)(value)
-    )
-
-
-def _resolve_toolchain(value: ConfigType) -> ConfigType:
-    # Resolve toolchain: CLI (already on CORE.toolchain) > YAML > default.
-    # Runs before _detect_variant so downstream validators can rely on
-    # CORE.toolchain instead of re-resolving it from the config dict.
-    if CORE.toolchain is None:
-        CORE.toolchain = value.get(CONF_TOOLCHAIN, Toolchain.ESP_IDF)
-    return value
+_TOOLCHAINS = (Toolchain.PLATFORMIO, Toolchain.ESP_IDF)
+_validate_toolchain = cv.toolchain_enum(_TOOLCHAINS)
+# Runs before _detect_variant so downstream validators can rely on
+# CORE.toolchain instead of re-resolving it from the config dict.
+_resolve_toolchain = cv.resolve_toolchain("ESP32", _TOOLCHAINS, Toolchain.ESP_IDF)
 
 
 def _check_versions(config: ConfigType) -> ConfigType:
@@ -3452,10 +3443,3 @@ def process_stacktrace(config, line, backtrace_state):
             _decode_pc(config, addr.group())
 
     return backtrace_state
-
-
-# gpio.cpp only implements ESP32InternalGPIOPin and its ISR helpers, which
-# are instantiated solely by the pin schema codegen (esp32_pin_to_code)
-FILTER_SOURCE_FILES = filter_source_files_from_defines(
-    {"gpio.cpp": "USE_ESP32_INTERNAL_GPIO"}
-)

esphome/components/esp32/crash_handler.cpp

@@ -124,15 +124,6 @@ static uint8_t IRAM_ATTR capture_riscv_backtrace(RvExcFrame *frame, uint32_t *ou
 // Version is uint32_t because it would be padded to 4 bytes anyway before the next
 // uint32_t field, so we use the full width rather than wasting 3 bytes of padding.
 static constexpr uint32_t CRASH_DATA_VERSION = 4;
-#if CONFIG_IDF_TARGET_ARCH_XTENSA
-// EXCCAUSE is a 6-bit register; larger recorded values mean the frame's
-// cause/vaddr slots were never written (not a real exception frame).
-static constexpr uint32_t XTENSA_EXCCAUSE_COUNT = XCHAL_EXCCAUSE_NUM;
-#elif CONFIG_IDF_TARGET_ARCH_RISCV
-// Synchronous mcause exception codes are small and have no interrupt bit;
-// anything else in a non-pseudo record is a stale slot.
-static constexpr uint32_t RISCV_EXCEPTION_CAUSE_COUNT = 32;
-#endif
 struct RawCrashData {
   uint32_t version;
   uint32_t magic;
@@ -207,28 +198,10 @@ void crash_handler_clear() {
   s_raw_crash_data.magic = 0;
 }
 
-// Whether the cause slot was written by a real exception frame.
-static bool cause_slot_was_written() {
-#if CONFIG_IDF_TARGET_ARCH_XTENSA
-  return s_raw_crash_data.cause < XTENSA_EXCCAUSE_COUNT;
-#else
-  return s_raw_crash_data.cause < RISCV_EXCEPTION_CAUSE_COUNT;
-#endif
-}
-
 // Look up the exception cause as a human-readable string.
 // Tables mirror ESP-IDF's panic_arch_fill_info() which uses local static arrays
 // not exposed via any public API.
 static const char *get_exception_reason() {
-  uint8_t exception = s_raw_crash_data.exception;
-  if (exception == PANIC_EXCEPTION_ABORT || exception == PANIC_EXCEPTION_TWDT) {
-    // Abort-class panics carry no cause register
-    return nullptr;
-  }
-  if (!cause_slot_was_written()) {
-    // Garbage from old-build or corrupt records; report just the type
-    return nullptr;
-  }
 #if CONFIG_IDF_TARGET_ARCH_XTENSA
   if (s_raw_crash_data.pseudo_excause) {
     // SoC-level panic: watchdog, cache error, etc.
@@ -381,11 +354,10 @@ static const char *const FAULT_ADDR_REG = "MTVAL";
 static const char *const FAULT_ADDR_REG_LOWER = "mtval";
 #endif
 
-// Whether the fault address is meaningful: real CPU faults with a validly
-// written frame only.
+// Whether the fault address is meaningful — real CPU faults only, not
+// aborts/watchdogs or SoC-level pseudo exceptions.
 static bool has_fault_addr() {
-  return s_raw_crash_data.exception == PANIC_EXCEPTION_FAULT && !s_raw_crash_data.pseudo_excause &&
-         cause_slot_was_written();
+  return s_raw_crash_data.exception == PANIC_EXCEPTION_FAULT && !s_raw_crash_data.pseudo_excause;
 }
 
 // The record was captured by a different firmware build (it survives soft
@@ -486,10 +458,6 @@ void crash_handler_log() {
 // into NOINIT memory before the normal panic handler runs.
 //
 extern "C" {
-// Set by IDF's task watchdog (task_wdt.c, no header) before it simulates an
-// abort; weak so builds without the task watchdog still link.
-extern bool g_twdt_isr __attribute__((weak));
-
 // NOLINTBEGIN(bugprone-reserved-identifier,cert-dcl37-c,cert-dcl51-cpp,readability-identifier-naming)
 // Names are mandated by the --wrap linker mechanism
 extern void __real_esp_panic_handler(panic_info_t *info);
@@ -502,14 +470,6 @@ void IRAM_ATTR __wrap_esp_panic_handler(panic_info_t *info) {
   s_raw_crash_data.exception = (uint8_t) info->exception;
   s_raw_crash_data.pseudo_excause = info->pseudo_excause ? 1 : 0;
   s_raw_crash_data.crashed_core = (uint8_t) info->core;
-  if (g_panic_abort) {
-    // IDF reclassifies to ABORT only inside esp_panic_handler(), after this
-    // wrapper captured info->exception; correct it here. TWDT is our own
-    // distinction (IDF never assigns PANIC_EXCEPTION_TWDT). The abort text is
-    // not stored; the symbolized backtrace already identifies the site.
-    bool is_twdt = &g_twdt_isr != nullptr && g_twdt_isr;
-    s_raw_crash_data.exception = (uint8_t) (is_twdt ? PANIC_EXCEPTION_TWDT : PANIC_EXCEPTION_ABORT);
-  }
   // Zero unconditionally so a null frame doesn't leave stale .noinit data from a previous boot
   s_raw_crash_data.cause = 0;
   s_raw_crash_data.fault_addr = 0;
@@ -527,12 +487,8 @@ void IRAM_ATTR __wrap_esp_panic_handler(panic_info_t *info) {
   // Xtensa: walk the backtrace using the public API
   if (info->frame != nullptr) {
     auto *xt_frame = (XtExcFrame *) info->frame;
-    if (!g_panic_abort) {
-      // Abort-class frames carry no useful cause/vaddr: TWDT task snapshots
-      // never wrote them and abort() traps describe only the synthetic trap.
-      s_raw_crash_data.cause = xt_frame->exccause;
-      s_raw_crash_data.fault_addr = xt_frame->excvaddr;
-    }
+    s_raw_crash_data.cause = xt_frame->exccause;
+    s_raw_crash_data.fault_addr = xt_frame->excvaddr;
     s_raw_crash_data.backtrace_count = walk_xtensa_backtrace(xt_frame, s_raw_crash_data.backtrace, MAX_BACKTRACE);
   }
 
@@ -554,11 +510,8 @@ void IRAM_ATTR __wrap_esp_panic_handler(panic_info_t *info) {
   // RISC-V: capture MEPC + RA, then scan stack for code addresses
   if (info->frame != nullptr) {
     auto *rv_frame = (RvExcFrame *) info->frame;
-    if (!g_panic_abort) {
-      // See the Xtensa branch: abort-class frames carry no valid cause/vaddr.
-      s_raw_crash_data.cause = rv_frame->mcause;
-      s_raw_crash_data.fault_addr = rv_frame->mtval;
-    }
+    s_raw_crash_data.cause = rv_frame->mcause;
+    s_raw_crash_data.fault_addr = rv_frame->mtval;
     s_raw_crash_data.backtrace_count =
         capture_riscv_backtrace(rv_frame, s_raw_crash_data.backtrace, MAX_BACKTRACE, &s_raw_crash_data.reg_frame_count);
   }

esphome/components/esp32/gpio.cpp

@@ -1,7 +1,4 @@
-#include "esphome/core/defines.h"
-// Also defines the core ISRInternalGPIOPin methods; those are only reachable
-// via ESP32InternalGPIOPin::to_isr(), so the same define gates both safely.
-#if defined(USE_ESP32) && defined(USE_ESP32_INTERNAL_GPIO)
+#ifdef USE_ESP32
 
 #include "gpio.h"
 #include "esphome/core/log.h"
@@ -207,4 +204,4 @@ void IRAM_ATTR ISRInternalGPIOPin::pin_mode(gpio::Flags flags) {
 
 }  // namespace esphome
 
-#endif  // USE_ESP32 && USE_ESP32_INTERNAL_GPIO
+#endif  // USE_ESP32

esphome/components/esp32/gpio.py

@@ -257,7 +257,6 @@ ESP32_PIN_SCHEMA = cv.All(
 
 @pins.PIN_SCHEMA_REGISTRY.register(PLATFORM_ESP32, ESP32_PIN_SCHEMA)
 async def esp32_pin_to_code(config):
-    cg.add_define("USE_ESP32_INTERNAL_GPIO")
     var = cg.new_Pvariable(config[CONF_ID])
     num = config[CONF_NUMBER]
     cg.add(var.set_pin(getattr(gpio_num_t, f"GPIO_NUM_{num}")))

esphome/components/esp8266/__init__.py

@@ -136,7 +136,16 @@ def _format_framework_arduino_version(ver: cv.Version) -> str:
         return f"~1.{ver.major}{ver.minor:02d}{ver.patch:02d}.0"
     if ver <= cv.Version(2, 6, 2):
         return f"~2.{ver.major}{ver.minor:02d}{ver.patch:02d}.0"
-    return f"~3.{ver.major}{ver.minor:02d}{ver.patch:02d}.0"
+    # Same encoding the native toolchain uses for its package download, so a
+    # version bump cannot drift between the two paths.
+    from esphome.arduino8266.framework import framework_package_version
+
+    try:
+        return f"~{framework_package_version(ver)}"
+    except EsphomeError as err:
+        # Anchor the 4.x rejection to the framework version line instead of
+        # aborting with a bare traceback-level error
+        raise cv.Invalid(str(err), path=[CONF_VERSION]) from err
 
 
 # NOTE: Keep this in mind when updating the recommended version:
@@ -246,6 +255,9 @@ CONFIG_SCHEMA = cv.All(
             cv.Optional(CONF_ENABLE_SCANF_FLOAT): cv.boolean,
         }
     ),
+    # Until the native toolchain lands, PlatformIO is the only backend;
+    # reject a --toolchain this platform cannot serve yet.
+    cv.require_platformio_toolchain("ESP8266"),
     set_core_data,
 )
 
@@ -397,8 +409,8 @@ async def to_code(config: ConfigType) -> None:
     )
 
     if config[CONF_BOARD] in BOARDS:
-        flash_size = BOARDS[config[CONF_BOARD]][KEY_FLASH_SIZE]
-        ld_scripts = ESP8266_LD_SCRIPTS[flash_size]
+        board_data = BOARDS[config[CONF_BOARD]]
+        ld_scripts = ESP8266_LD_SCRIPTS[board_data[KEY_FLASH_SIZE]]
 
         if ver <= cv.Version(2, 3, 0):
             # No ld script support
@@ -407,7 +419,9 @@ async def to_code(config: ConfigType) -> None:
             # Old ld script path
             ld_script = ld_scripts[0]
         else:
-            ld_script = ld_scripts[1]
+            # A per-board override preserves a layout the board shipped
+            # with (see d1_wroom_02 in boards.py)
+            ld_script = board_data.get("ldscript", ld_scripts[1])
 
         if ld_script is not None:
             cg.add_platformio_option("board_build.ldscript", ld_script)

esphome/components/esp8266/boards.py

@@ -199,6 +199,15 @@ BOARDS = {
         "name": "WeMos D1 mini Pro",
         "flash_size": FLASH_SIZE_16_MB,
     },
+    "d1_wroom_02": {
+        "name": "WeMos D1 ESP-WROOM-02",
+        "flash_size": FLASH_SIZE_2_MB,
+        # This board joined BOARDS after shipping with the manifest default
+        # (64 KB filesystem region); the flash-size default (2m.ld) would
+        # move _FS_end and with it the preferences sector, wiping existing
+        # devices' flash-backed state on update.
+        "ldscript": "eagle.flash.2m64.ld",
+    },
     "d1": {
         "name": "WEMOS D1 R1",
         "flash_size": FLASH_SIZE_4_MB,
@@ -360,3 +369,112 @@ BOARDS = {
         "flash_size": FLASH_SIZE_4_MB,
     },
 }
+
+
+# Per-board variant dir + identity defines from platform-espressif8266 4.x
+# build.extra_flags; the shared -DESP8266/-DARDUINO_ARCH_ESP8266 are added
+# by the generator.
+#
+# Regenerate ESP8266_BOARD_BUILD with (v4.2.1 is the platform version the
+# native toolchain mirrors; regenerate against the tag when bumping it):
+#
+# git clone -b v4.2.1 https://github.com/platformio/platform-espressif8266
+# python3 - <<'EOF'
+# import json, glob, os
+# for f in sorted(glob.glob("platform-espressif8266/boards/*.json")):
+#     b = json.load(open(f))["build"]
+#     extra = b["extra_flags"]
+#     extra = extra.split() if isinstance(extra, str) else extra
+#     defines = [
+#         e[2:] for e in extra if e not in ("-DESP8266", "-DARDUINO_ARCH_ESP8266")
+#     ]
+#     entries = ", ".join(f'"{d}"' for d in defines) + ("," if len(defines) == 1 else "")
+#     board = os.path.splitext(os.path.basename(f))[0]
+#     print(f'    "{board}": {{"variant": "{b["variant"]}", "defines": ({entries})}},')
+# EOF
+ESP8266_BOARD_BUILD = {
+    "agruminolemon": {
+        "variant": "agruminolemonv4",
+        "defines": ("ARDUINO_ESP8266_AGRUMINO_LEMON_V4",),
+    },
+    "d1": {"variant": "d1", "defines": ("ARDUINO_ESP8266_WEMOS_D1R1",)},
+    "d1_mini": {"variant": "d1_mini", "defines": ("ARDUINO_ESP8266_WEMOS_D1MINI",)},
+    "d1_mini_lite": {
+        "variant": "d1_mini",
+        "defines": ("ARDUINO_ESP8266_WEMOS_D1MINILITE",),
+    },
+    "d1_mini_pro": {
+        "variant": "d1_mini",
+        "defines": ("ARDUINO_ESP8266_WEMOS_D1MINIPRO",),
+    },
+    "d1_wroom_02": {
+        "variant": "d1_mini",
+        "defines": ("ARDUINO_ESP8266_WEMOS_D1WROOM02",),
+    },
+    "eduinowifi": {
+        "variant": "eduinowifi",
+        "defines": ("ARDUINO_ESP8266_SCHIRMILABS_EDUINO_WIFI",),
+    },
+    "esp01": {"variant": "generic", "defines": ("ARDUINO_ESP8266_ESP01",)},
+    "esp01_1m": {"variant": "generic", "defines": ("ARDUINO_ESP8266_ESP01",)},
+    "esp07": {"variant": "generic", "defines": ("ARDUINO_ESP8266_ESP07",)},
+    "esp07s": {"variant": "nodemcu", "defines": ("ARDUINO_ESP8266_ESP07",)},
+    "esp12e": {"variant": "nodemcu", "defines": ("ARDUINO_ESP8266_ESP12",)},
+    "esp210": {"variant": "generic", "defines": ("ARDUINO_ESP8266_ESP210",)},
+    "esp8285": {"variant": "esp8285", "defines": ("ARDUINO_ESP8266_ESP01",)},
+    "esp_wroom_02": {
+        "variant": "nodemcu",
+        "defines": ("ARDUINO_ESP8266_ESP_WROOM_02",),
+    },
+    "espduino": {"variant": "ESPDuino", "defines": ("ARDUINO_ESP8266_ESP13",)},
+    "espectro": {"variant": "espectro", "defines": ("ARDUINO_ESP8266_ESPECTRO_CORE",)},
+    "espino": {"variant": "espino", "defines": ("ARDUINO_ESP8266_ESP12",)},
+    "espinotee": {"variant": "espinotee", "defines": ("ARDUINO_ESP8266_ESP13",)},
+    "espmxdevkit": {
+        "variant": "esp8285",
+        "defines": ("ARDUINO_ESP8266_ESP01", "LED_BUILTIN=16"),
+    },
+    "espresso_lite_v1": {
+        "variant": "espresso_lite_v1",
+        "defines": ("ARDUINO_ESP8266_ESPRESSO_LITE_V1",),
+    },
+    "espresso_lite_v2": {
+        "variant": "espresso_lite_v2",
+        "defines": ("ARDUINO_ESP8266_ESPRESSO_LITE_V2",),
+    },
+    "gen4iod": {"variant": "generic", "defines": ("ARDUINO_GEN4_IOD",)},
+    "heltec_wifi_kit_8": {
+        "variant": "wifi_kit_8",
+        "defines": ("ARDUINO_wifi_kit_8",),
+    },
+    "huzzah": {"variant": "adafruit", "defines": ("ARDUINO_ESP8266_ADAFRUIT_HUZZAH",)},
+    "inventone": {"variant": "inventone", "defines": ("ARDUINO_ESP8266_INVENT_ONE",)},
+    "modwifi": {"variant": "generic", "defines": ("ARDUINO_MOD_WIFI_ESP8266",)},
+    "nodemcu": {"variant": "nodemcu", "defines": ("ARDUINO_ESP8266_NODEMCU",)},
+    "nodemcuv2": {"variant": "nodemcu", "defines": ("ARDUINO_ESP8266_NODEMCU_ESP12E",)},
+    "oak": {"variant": "oak", "defines": ("ARDUINO_ESP8266_OAK",)},
+    "phoenix_v1": {
+        "variant": "phoenix_v1",
+        "defines": ("ARDUINO_ESP8266_PHOENIX_V1",),
+    },
+    "phoenix_v2": {
+        "variant": "phoenix_v2",
+        "defines": ("ARDUINO_ESP8266_PHOENIX_V2",),
+    },
+    "sonoff_basic": {"variant": "itead", "defines": ("ARDUINO_ESP8266_SONOFF_BASIC",)},
+    "sonoff_s20": {"variant": "itead", "defines": ("ARDUINO_ESP8266_SONOFF_S20",)},
+    "sonoff_sv": {"variant": "itead", "defines": ("ARDUINO_ESP8266_SONOFF_SV",)},
+    "sonoff_th": {"variant": "itead", "defines": ("ARDUINO_ESP8266_SONOFF_TH",)},
+    "sparkfunBlynk": {"variant": "thing", "defines": ("ARDUINO_ESP8266_THING",)},
+    "thing": {"variant": "thing", "defines": ("ARDUINO_ESP8266_THING",)},
+    "thingdev": {"variant": "thing", "defines": ("ARDUINO_ESP8266_THING_DEV",)},
+    "wifi_slot": {"variant": "wifi_slot", "defines": ("ARDUINO_AMPERKA_WIFI_SLOT",)},
+    "wifiduino": {"variant": "wifiduino", "defines": ("ARDUINO_WIFIDUINO_ESP8266",)},
+    "wifinfo": {"variant": "wifinfo", "defines": ("ARDUINO_WIFINFO",)},
+    "wio_link": {"variant": "wiolink", "defines": ("ARDUINO_ESP8266_WIO_LINK",)},
+    "wio_node": {"variant": "nodemcu", "defines": ("ARDUINO_ESP8266_ESP_WROOM_02",)},
+    "xinabox_cw01": {
+        "variant": "xinabox",
+        "defines": ("ARDUINO_ESP8266_XINABOX_CW01",),
+    },
+}

esphome/components/esp8266/build_surgery.py

@@ -0,0 +1,118 @@
+"""Linker-script surgery shared with the native (PlatformIO-free) toolchain.
+
+These mirror the PlatformIO extra scripts in this directory
+(``relocate_ratetable.py.script`` and ``testing_mode.py.script``), which run
+inside SCons and must stay self-contained. The native build generator applies
+the same patches to the linker scripts it generates, so the logic lives here
+as plain functions. Keep both in sync when changing either.
+``segment_length`` is native-toolchain-only and has no script twin.
+"""
+
+from __future__ import annotations
+
+from collections.abc import Collection
+import hashlib
+import re
+
+# Move the NONOS SDK wifi rate tables from flash to DRAM; see
+# relocate_ratetable.py.script for the full background (NONOS SDK issue 320).
+RATETABLE_RULE = "*libnet80211.a:ieee80211_phy.o(.irom.text .irom.text.*)"
+_RATETABLE_COMMENT = (
+    "/* ESPHome: wifi rate tables must live in DRAM, see NONOS SDK issue 320 */"
+)
+# Match the whole line: "_data_start" is also a substring of the
+# "_dport0_data_start" line in the earlier .dport0.data section
+_RATETABLE_ANCHOR = re.compile(r"^\s*_data_start = ABSOLUTE\(\.\);", re.MULTILINE)
+
+# Memory sizes for testing mode (allow larger builds for CI component grouping)
+TESTING_IRAM_SIZE = "0x200000"  # 2MB
+TESTING_DRAM_SIZE = "0x200000"  # 2MB
+TESTING_FLASH_SIZE = "0x2000000"  # 32MB
+
+
+def relocate_ratetable(content: str) -> str:
+    """Insert the rate-table DRAM rule into a generated common linker script."""
+    if RATETABLE_RULE in content:
+        return content
+    match = _RATETABLE_ANCHOR.search(content)
+    if match is None:
+        raise RuntimeError(
+            "'_data_start' anchor not found in the generated linker script; "
+            "cannot apply wifi rate table DRAM relocation "
+            "(has the Arduino core linker script changed?)"
+        )
+    insert_pos = match.end()
+    return (
+        content[:insert_pos]
+        + f"\n    {_RATETABLE_COMMENT}"
+        + f"\n    {RATETABLE_RULE}"
+        + content[insert_pos:]
+    )
+
+
+_TESTING_SEGMENT_SIZES = {
+    "iram1_0_seg": TESTING_IRAM_SIZE,
+    "dram0_0_seg": TESTING_DRAM_SIZE,
+    "irom0_0_seg": TESTING_FLASH_SIZE,
+}
+
+
+def _segment_line_re(segment_name: str) -> re.Pattern[str]:
+    """The MEMORY line for one segment: ``<seg> : org = 0x..., len = 0x...``.
+
+    Anchored to the start of the line so a name never matches inside a
+    longer one (``ram0_0_seg`` must not read ``dram0_0_seg``). The size
+    group stops at the hex digits, leaving any ``ul`` suffix (from the
+    preprocessed ``MMU_IRAM_SIZE``) in place.
+    """
+    return re.compile(
+        rf"(^[ \t]*{re.escape(segment_name)}"
+        r"\s*:\s*org\s*=\s*0x[0-9a-fA-F]+\s*,\s*len\s*=\s*)"
+        r"(0x[0-9a-fA-F]+)",
+        re.MULTILINE,
+    )
+
+
+def apply_testing_memory_patches(content: str, segments: Collection[str]) -> str:
+    """Enlarge the named memory segments so grouped CI test builds can link.
+
+    Each caller passes the segments its linker script defines: the
+    generated common ld carries ``iram1_0_seg``; the flash ld carries
+    ``dram0_0_seg`` and ``irom0_0_seg``. A segment that fails to match
+    raises, since a silently kept real memory limit would fail grouped
+    builds far from the cause.
+    """
+    for segment in _TESTING_SEGMENT_SIZES:
+        if segment not in segments and _segment_line_re(segment).search(content):
+            raise RuntimeError(
+                f"Testing-mode segment {segment} is present in the linker "
+                "script but was not selected for patching"
+            )
+    for segment in segments:
+        if segment not in _TESTING_SEGMENT_SIZES:
+            raise RuntimeError(f"Unknown testing-mode segment {segment!r}")
+        content, count = _segment_line_re(segment).subn(
+            rf"\g<1>{_TESTING_SEGMENT_SIZES[segment]}", content
+        )
+        if count == 0:
+            raise RuntimeError(
+                f"Testing-mode memory patch failed: segment {segment} "
+                "not found (has the Arduino core linker script changed?)"
+            )
+    return content
+
+
+def segment_length(content: str, segment_name: str) -> int | None:
+    """Read a memory segment's length from linker script content."""
+    match = _segment_line_re(segment_name).search(content)
+    return int(match.group(2), 16) if match else None
+
+
+def surgery_fingerprint() -> str:
+    """Hash of this module's source; linker-script caches include it so an
+    edit here invalidates them."""
+    import inspect
+    import sys
+
+    source = inspect.getsource(sys.modules[__name__])
+    return hashlib.sha256(source.encode()).hexdigest()

esphome/components/esp8266/const.py

@@ -15,6 +15,9 @@ CONF_ENABLE_SERIAL1 = "enable_serial1"
 KEY_WAVEFORM_REQUIRED = "waveform_required"
 KEY_SERIAL_REQUIRED = "serial_required"
 KEY_SERIAL1_REQUIRED = "serial1_required"
+# Set for the native (non-PlatformIO) toolchain's build generator
+KEY_FLASH_MODE = "flash_mode"
+KEY_SCANF_FLOAT = "scanf_float"
 
 # esp8266 namespace is already defined by arduino, manually prefix esphome
 esp8266_ns = cg.global_ns.namespace("esphome").namespace("esp8266")

esphome/components/esphome/ota/__init__.py

@@ -1,16 +1,12 @@
 import logging
 
 import esphome.codegen as cg
-from esphome.components.noise import decode_encryption_key, encryption_schema
 from esphome.components.ota import BASE_OTA_SCHEMA, OTAComponent, ota_to_code
 from esphome.config_helpers import merge_config
 import esphome.config_validation as cv
 from esphome.const import (
-    CONF_API,
-    CONF_ENCRYPTION,
     CONF_ESPHOME,
     CONF_ID,
-    CONF_KEY,
     CONF_NUM_ATTEMPTS,
     CONF_OTA,
     CONF_PASSWORD,
@@ -19,7 +15,6 @@ from esphome.const import (
     CONF_REBOOT_TIMEOUT,
     CONF_SAFE_MODE,
     CONF_VERSION,
-    CONF_WEB_SERVER,
 )
 from esphome.core import CORE, coroutine_with_priority
 from esphome.coroutine import CoroPriority
@@ -35,15 +30,7 @@ CODEOWNERS = ["@esphome/core"]
 DEPENDENCIES = ["network"]
 
 
-def AUTO_LOAD(config: ConfigType) -> list[str]:
-    """Auto-load noise only when encryption is configured."""
-    base = ["sha256", "socket"]
-    # A falsy config is a tooling probe for the maximal set (None from
-    # dependency resolution, {} from the components-graph platform probe);
-    # a validated config always carries defaults, never empty
-    if not config or CONF_ENCRYPTION in config:
-        return base + ["noise"]
-    return base
+AUTO_LOAD = ["sha256", "socket"]
 
 
 esphome = cg.esphome_ns.namespace("esphome")
@@ -80,24 +67,11 @@ def ota_esphome_final_validate(config):
                     CONF_PASSWORD in merged_ota_esphome_configs_by_port[conf_port]
                     and CONF_PASSWORD in ota_conf
                     and merged_ota_esphome_configs_by_port[conf_port][CONF_PASSWORD]
-                    != ota_conf[CONF_PASSWORD]
+                    != ota_conf.get(CONF_PASSWORD)
                 ):
                     raise cv.Invalid(
                         f"Found multiple configurations but {CONF_PASSWORD} is inconsistent"
                     )
-                # Encryption blocks conflict only when both pin a key; a bare
-                # `encryption:` (a package/device split) is compatible with a
-                # keyed one, and merge_config yields the keyed result
-                merged_key = (
-                    merged_ota_esphome_configs_by_port[conf_port]
-                    .get(CONF_ENCRYPTION, {})
-                    .get(CONF_KEY)
-                )
-                other_key = ota_conf.get(CONF_ENCRYPTION, {}).get(CONF_KEY)
-                if merged_key and other_key and merged_key != other_key:
-                    raise cv.Invalid(
-                        f"Found multiple configurations but {CONF_ENCRYPTION} is inconsistent"
-                    )
 
                 ports_with_merged_configs.append(conf_port)
                 merged_ota_esphome_configs_by_port[conf_port] = merge_config(
@@ -120,73 +94,6 @@ def ota_esphome_final_validate(config):
 
     new_ota_conf.extend(merged_ota_esphome_configs_by_port.values())
 
-    # There is one encryption key per device: when the api component has one,
-    # ota uses it, and an explicit ota key must match it. A bare `encryption:`
-    # block resolves to the api key here so both codegen and the upload CLI
-    # see the actual key.
-    api_conf = full_conf.get(CONF_API) or {}
-    api_key = api_conf.get(CONF_ENCRYPTION, {}).get(CONF_KEY)
-    has_web_server_ota = any(
-        conf.get(CONF_PLATFORM) == CONF_WEB_SERVER for conf in full_ota_conf
-    )
-    for ota_conf in merged_ota_esphome_configs_by_port.values():
-        # Merging same-port blocks can combine a password from one block with
-        # encryption from another; re-check the exclusion on the merged result.
-        _validate_no_password_with_encryption(ota_conf)
-        if (encryption_conf := ota_conf.get(CONF_ENCRYPTION)) is None:
-            continue
-        if has_web_server_ota:
-            # The web_server ota platform accepts the same image over plain
-            # HTTP with basic auth, a full bypass of the encryption.
-            if CONF_WEB_SERVER in full_conf:
-                # With the web_server component the endpoint is always on;
-                # fail closed like the password combination
-                raise cv.Invalid(
-                    f"'{CONF_OTA}' {CONF_ENCRYPTION} cannot be combined with the "
-                    f"'{CONF_WEB_SERVER}' component; its '{CONF_OTA}' platform "
-                    f"accepts the same image over plaintext HTTP, remove one of them"
-                )
-            # Without the component the platform is the captive_portal
-            # auto-load: the endpoint only exists while the fallback AP is
-            # active, so keep the recovery path and warn instead
-            _LOGGER.warning(
-                "OTA encryption does not cover the %s OTA platform (auto-loaded "
-                "by captive_portal); the plaintext /update endpoint stays "
-                "reachable while the fallback AP is active",
-                CONF_WEB_SERVER,
-            )
-        if ota_key := encryption_conf.get(CONF_KEY):
-            if api_key and ota_key != api_key:
-                raise cv.Invalid(
-                    f"'{CONF_OTA}' {CONF_ENCRYPTION} {CONF_KEY} must match the "
-                    f"'{CONF_API}' {CONF_ENCRYPTION} {CONF_KEY}; omit the "
-                    f"'{CONF_OTA}' {CONF_KEY} to use the '{CONF_API}' one"
-                )
-        elif not api_key:
-            if CONF_ENCRYPTION in api_conf:
-                # A keyless `api: encryption:` block gets its key provisioned
-                # at runtime and stored in flash, so there is nothing to
-                # inherit at build time
-                raise cv.Invalid(
-                    f"the '{CONF_API}' {CONF_ENCRYPTION} {CONF_KEY} is provisioned at "
-                    f"runtime and cannot be inherited at build time; set an explicit "
-                    f"'{CONF_OTA}' {CONF_ENCRYPTION} {CONF_KEY}"
-                )
-            raise cv.Invalid(
-                f"'{CONF_OTA}' {CONF_ENCRYPTION} has no {CONF_KEY} and there is no "
-                f"'{CONF_API}' {CONF_ENCRYPTION} {CONF_KEY} to inherit; set one of them"
-            )
-        else:
-            encryption_conf[CONF_KEY] = api_key
-        # The device treats the all-zeros PSK as "no key configured" (it is the
-        # api provisioning sentinel), so letting it through would leave the OTA
-        # port accepting plaintext while the YAML says encryption. Fail closed.
-        if not any(decode_encryption_key(encryption_conf[CONF_KEY])):
-            raise cv.Invalid(
-                f"The all-zeros {CONF_KEY} is reserved and provides no protection; "
-                f"generate a real key with: openssl rand -base64 32"
-            )
-
     full_conf[CONF_OTA] = new_ota_conf
     fv.full_config.set(full_conf)
 
@@ -200,17 +107,6 @@ def ota_esphome_final_validate(config):
         )
 
 
-# Not cv.has_at_most_one_key: this message explains the why, and the check is
-# reused on merged same-port configs in final validate where schemas do not run
-def _validate_no_password_with_encryption(config: ConfigType) -> ConfigType:
-    if CONF_PASSWORD in config and CONF_ENCRYPTION in config:
-        raise cv.Invalid(
-            f"'{CONF_PASSWORD}' cannot be combined with '{CONF_ENCRYPTION}'; the "
-            f"encryption key already authenticates the uploader, remove '{CONF_PASSWORD}'"
-        )
-    return config
-
-
 def _consume_ota_sockets(config: ConfigType) -> ConfigType:
     """Register socket needs for OTA component."""
     from esphome.components import socket
@@ -238,7 +134,6 @@ CONFIG_SCHEMA = cv.All(
             ): cv.port,
             cv.Optional(CONF_ALLOW_PARTITION_ACCESS, default=False): cv.boolean,
             cv.Optional(CONF_PASSWORD): cv.sensitive(),
-            cv.Optional(CONF_ENCRYPTION): encryption_schema,
             cv.Optional(CONF_NUM_ATTEMPTS): cv.invalid(
                 f"'{CONF_SAFE_MODE}' (and its related configuration variables) has moved from 'ota' to its own component. See https://esphome.io/components/safe_mode"
             ),
@@ -252,24 +147,12 @@ CONFIG_SCHEMA = cv.All(
     )
     .extend(BASE_OTA_SCHEMA)
     .extend(cv.COMPONENT_SCHEMA),
-    _validate_no_password_with_encryption,
     _consume_ota_sockets,
 )
 
 FINAL_VALIDATE_SCHEMA = ota_esphome_final_validate
 
 
-def FILTER_SOURCE_FILES() -> list[str]:
-    """Filter out the noise transport when no ota entry configures encryption."""
-    for ota_conf in CORE.config.get(CONF_OTA, []):
-        if (
-            ota_conf.get(CONF_PLATFORM) == CONF_ESPHOME
-            and ota_conf.get(CONF_ENCRYPTION) is not None
-        ):
-            return []
-    return ["ota_esphome_noise.cpp"]
-
-
 @coroutine_with_priority(CoroPriority.OTA_UPDATES)
 async def to_code(config: ConfigType) -> None:
     var = cg.new_Pvariable(config[CONF_ID])
@@ -288,12 +171,6 @@ async def to_code(config: ConfigType) -> None:
     if config.get(CONF_ALLOW_PARTITION_ACCESS):
         cg.add_define("USE_OTA_PARTITIONS")
 
-    if (encryption_conf := config.get(CONF_ENCRYPTION)) is not None:
-        # A missing key was resolved from the api component in final validate.
-        key = encryption_conf[CONF_KEY]
-        cg.add_define("USE_OTA_ENCRYPTION")
-        cg.add(var.set_noise_psk(list(decode_encryption_key(key))))
-
     # Build flag so lwip_fast_select.c (a .c file that can't include defines.h) sees it.
     cg.add_build_flag("-DUSE_OTA_PLATFORM_ESPHOME")
 

esphome/components/esphome/ota/ota_esphome.cpp

@@ -27,6 +27,7 @@ namespace esphome {
 
 static const char *const TAG = "esphome.ota";
 static constexpr uint16_t OTA_BLOCK_SIZE = 8192;
+static constexpr size_t OTA_BUFFER_SIZE = 1024;                  // buffer size for OTA data transfer
 static constexpr uint32_t OTA_SOCKET_TIMEOUT_HANDSHAKE = 20000;  // milliseconds for initial handshake
 static constexpr uint32_t OTA_SOCKET_TIMEOUT_DATA = 90000;       // milliseconds for data transfer
 
@@ -104,11 +105,6 @@ void ESPHomeOTAComponent::dump_config() {
     ESP_LOGCONFIG(TAG, "  Password configured");
   }
 #endif
-#ifdef USE_OTA_ENCRYPTION
-  if (this->noise_ctx_.has_psk()) {
-    ESP_LOGCONFIG(TAG, "  Encryption configured");
-  }
-#endif
 #ifdef USE_OTA_PARTITIONS
   ESP_LOGCONFIG(TAG,
                 "  Partition access allowed\n"
@@ -152,10 +148,8 @@ void ESPHomeOTAComponent::loop() {
 static constexpr uint8_t CLIENT_FEATURE_SUPPORTS_COMPRESSION = 0x01;
 static constexpr uint8_t CLIENT_FEATURE_SUPPORTS_SHA256_AUTH = 0x02;
 static constexpr uint8_t CLIENT_FEATURE_SUPPORTS_EXTENDED_PROTOCOL = 0x04;
-static constexpr uint8_t CLIENT_FEATURE_SUPPORTS_NOISE = 0x08;
 static constexpr uint8_t SERVER_FEATURE_SUPPORTS_COMPRESSION = 0x01;
 static constexpr uint8_t SERVER_FEATURE_SUPPORTS_PARTITION_ACCESS = 0x02;
-static constexpr uint8_t SERVER_FEATURE_SUPPORTS_NOISE = 0x04;
 
 void ESPHomeOTAComponent::handle_handshake_() {
   /// Handle the OTA handshake and authentication.
@@ -207,7 +201,8 @@ void ESPHomeOTAComponent::handle_handshake_() {
       }
 
       // Validate magic bytes
-      if (memcmp(this->handshake_buf_, MAGIC_BYTES, sizeof(MAGIC_BYTES)) != 0) {
+      static const uint8_t MAGIC_BYTES[5] = {0x6C, 0x26, 0xF7, 0x5C, 0x45};
+      if (memcmp(this->handshake_buf_, MAGIC_BYTES, 5) != 0) {
         ESP_LOGW(TAG, "Magic bytes mismatch! 0x%02X-0x%02X-0x%02X-0x%02X-0x%02X", this->handshake_buf_[0],
                  this->handshake_buf_[1], this->handshake_buf_[2], this->handshake_buf_[3], this->handshake_buf_[4]);
         this->send_error_and_cleanup_(ota::OTA_RESPONSE_ERROR_MAGIC);
@@ -239,19 +234,6 @@ void ESPHomeOTAComponent::handle_handshake_() {
       }
       this->ota_features_ = this->handshake_buf_[0];
       ESP_LOGV(TAG, "Features: 0x%02X", this->ota_features_);
-
-#ifdef USE_OTA_ENCRYPTION
-      // Fail closed: with a PSK configured the client must negotiate encryption
-      // (which requires the extended protocol); refuse plaintext uploads.
-      static constexpr uint8_t NOISE_REQUIRED_FEATURES =
-          CLIENT_FEATURE_SUPPORTS_NOISE | CLIENT_FEATURE_SUPPORTS_EXTENDED_PROTOCOL;
-      if (this->noise_ctx_.has_psk() && (this->ota_features_ & NOISE_REQUIRED_FEATURES) != NOISE_REQUIRED_FEATURES) {
-        ESP_LOGW(TAG, "Client does not support encryption");
-        this->send_error_and_cleanup_(ota::OTA_RESPONSE_ERROR_ENCRYPTION_REQUIRED);
-        return;
-      }
-#endif
-
       this->transition_ota_state_(OTAState::FEATURE_ACK);
 
       const bool supports_compression =
@@ -267,12 +249,6 @@ void ESPHomeOTAComponent::handle_handshake_() {
         this->handshake_buf_[1] = (supports_compression ? SERVER_FEATURE_SUPPORTS_COMPRESSION : 0);
 #ifdef USE_OTA_PARTITIONS
         this->handshake_buf_[1] |= SERVER_FEATURE_SUPPORTS_PARTITION_ACCESS;
-#endif
-#ifdef USE_OTA_ENCRYPTION
-        if (this->noise_ctx_.has_psk()) {
-          this->handshake_buf_[1] |= SERVER_FEATURE_SUPPORTS_NOISE;
-        }
-        this->server_feature_flags_ = this->handshake_buf_[1];
 #endif
       } else {
         this->handshake_buf_[0] =
@@ -288,18 +264,6 @@ void ESPHomeOTAComponent::handle_handshake_() {
       if (!this->try_write_(ack_size, LOG_STR("ack feature"))) {
         return;
       }
-#ifdef USE_OTA_ENCRYPTION
-      // With a PSK configured the rest of the session runs inside the noise
-      // transport; the client sends the first handshake frame next, so there
-      // is nothing to do until data arrives.
-      if (this->noise_ctx_.has_psk()) {
-        if (!this->noise_start_session_()) {
-          return;
-        }
-        this->transition_ota_state_(OTAState::NOISE_HANDSHAKE);
-        return;
-      }
-#endif
 #ifdef USE_OTA_PASSWORD
       // If password is set, move to auth phase
       if (!this->password_.empty()) {
@@ -337,16 +301,6 @@ void ESPHomeOTAComponent::handle_handshake_() {
       this->handle_data_();
       return;
 
-#ifdef USE_OTA_ENCRYPTION
-    case OTAState::NOISE_HANDSHAKE:
-      if (!this->handle_noise_handshake_()) {
-        return;
-      }
-      this->transition_ota_state_(OTAState::DATA);
-      this->handle_data_();
-      return;
-#endif
-
     default:
       break;
   }
@@ -406,13 +360,12 @@ void ESPHomeOTAComponent::handle_data_() {
   this->client_->setblocking(true);
 
   // Acknowledge auth OK - 1 byte
-  this->data_write_byte_(ota::OTA_RESPONSE_AUTH_OK);
+  this->write_byte_(ota::OTA_RESPONSE_AUTH_OK);
 
   if (this->extended_proto_) {
     // Read ota type, 1 byte
-    if (!this->data_readall_(buf, 1)) {
+    if (!this->readall_(buf, 1)) {
       this->log_read_error_(LOG_STR("OTA type"));
-      error_code = ota::OTA_RESPONSE_ERROR_UNKNOWN;
       goto error;  // NOLINT(cppcoreguidelines-avoid-goto)
     }
     ota_type = static_cast<ota::OTAType>(buf[0]);
@@ -420,9 +373,8 @@ void ESPHomeOTAComponent::handle_data_() {
   ESP_LOGV(TAG, "OTA type is 0x%02x", ota_type);
 
   // Read size, 4 bytes MSB first
-  if (!this->data_readall_(buf, 4)) {
+  if (!this->readall_(buf, 4)) {
     this->log_read_error_(LOG_STR("size"));
-    error_code = ota::OTA_RESPONSE_ERROR_UNKNOWN;
     goto error;  // NOLINT(cppcoreguidelines-avoid-goto)
   }
   ota_size = (static_cast<size_t>(buf[0]) << 24) | (static_cast<size_t>(buf[1]) << 16) |
@@ -446,18 +398,17 @@ void ESPHomeOTAComponent::handle_data_() {
   this->notify_state_(ota::OTA_STARTED, 0.0f, 0);
 #endif
 
-  // begin() returns quickly; flash sectors are erased incrementally during write().
+  // begin() may block for a few seconds while it locks flash.
   error_code = this->backend_->begin(ota_size, ota_type);
   if (error_code != ota::OTA_RESPONSE_OK)
     goto error;  // NOLINT(cppcoreguidelines-avoid-goto)
 
   // Acknowledge prepare OK - 1 byte
-  this->data_write_byte_(ota::OTA_RESPONSE_UPDATE_PREPARE_OK);
+  this->write_byte_(ota::OTA_RESPONSE_UPDATE_PREPARE_OK);
 
   // Read binary MD5, 32 bytes
-  if (!this->data_readall_(buf, 32)) {
+  if (!this->readall_(buf, 32)) {
     this->log_read_error_(LOG_STR("MD5 checksum"));
-    error_code = ota::OTA_RESPONSE_ERROR_UNKNOWN;
     goto error;  // NOLINT(cppcoreguidelines-avoid-goto)
   }
   sbuf[32] = '\0';
@@ -465,7 +416,7 @@ void ESPHomeOTAComponent::handle_data_() {
   this->backend_->set_update_md5(sbuf);
 
   // Acknowledge MD5 OK - 1 byte
-  this->data_write_byte_(ota::OTA_RESPONSE_BIN_MD5_OK);
+  this->write_byte_(ota::OTA_RESPONSE_BIN_MD5_OK);
 
   // Track when we last received data so a silently-vanished peer (no FIN/RST
   // delivered, e.g. uploader killed mid-transfer or NAT/router dropped state)
@@ -481,37 +432,19 @@ void ESPHomeOTAComponent::handle_data_() {
     }
     size_t remaining = ota_size - total;
     size_t requested = remaining < OTA_BUFFER_SIZE ? remaining : OTA_BUFFER_SIZE;
-    ssize_t read;
-#ifdef USE_OTA_ENCRYPTION
-    if (this->noise_ != nullptr) {
-      // One frame per call; noise_read_data_ waits internally (readall_), so
-      // there is no would-block retry here and failures are already logged.
-      read = this->noise_read_data_(buf, requested);
-      if (read <= 0) {
-        // error_code still holds the last OK; report a real failure instead
-        error_code = ota::OTA_RESPONSE_ERROR_UNKNOWN;
-        goto error;  // NOLINT(cppcoreguidelines-avoid-goto)
-      }
-    } else
-#endif
-    {
-      read = this->client_->read(buf, requested);
-      if (read == -1) {
-        const int err = errno;
-        if (this->would_block_(err)) {
-          // read() already waited up to SO_RCVTIMEO for data, just feed WDT
-          App.feed_wdt();
-          continue;
-        }
-        ESP_LOGW(TAG, "Read err %d", err);
-        // error_code still holds the last OK; report a real failure instead
-        error_code = ota::OTA_RESPONSE_ERROR_UNKNOWN;
-        goto error;  // NOLINT(cppcoreguidelines-avoid-goto)
-      } else if (read == 0) {
-        ESP_LOGW(TAG, "Remote closed");
-        error_code = ota::OTA_RESPONSE_ERROR_UNKNOWN;
-        goto error;  // NOLINT(cppcoreguidelines-avoid-goto)
+    ssize_t read = this->client_->read(buf, requested);
+    if (read == -1) {
+      const int err = errno;
+      if (this->would_block_(err)) {
+        // read() already waited up to SO_RCVTIMEO for data, just feed WDT
+        App.feed_wdt();
+        continue;
       }
+      ESP_LOGW(TAG, "Read err %d", err);
+      goto error;  // NOLINT(cppcoreguidelines-avoid-goto)
+    } else if (read == 0) {
+      ESP_LOGW(TAG, "Remote closed");
+      goto error;  // NOLINT(cppcoreguidelines-avoid-goto)
     }
 
     last_data_ms = millis();
@@ -523,7 +456,7 @@ void ESPHomeOTAComponent::handle_data_() {
     total += read;
 #if USE_OTA_VERSION == 2
     while (size_acknowledged + OTA_BLOCK_SIZE <= total || (total == ota_size && size_acknowledged < ota_size)) {
-      this->data_write_byte_(ota::OTA_RESPONSE_CHUNK_OK);
+      this->write_byte_(ota::OTA_RESPONSE_CHUNK_OK);
       size_acknowledged += OTA_BLOCK_SIZE;
     }
 #endif
@@ -542,7 +475,7 @@ void ESPHomeOTAComponent::handle_data_() {
   }
 
   // Acknowledge receive OK - 1 byte
-  this->data_write_byte_(ota::OTA_RESPONSE_RECEIVE_OK);
+  this->write_byte_(ota::OTA_RESPONSE_RECEIVE_OK);
 
   error_code = this->backend_->end();
   if (error_code != ota::OTA_RESPONSE_OK) {
@@ -551,10 +484,10 @@ void ESPHomeOTAComponent::handle_data_() {
   }
 
   // Acknowledge Update end OK - 1 byte
-  this->data_write_byte_(ota::OTA_RESPONSE_UPDATE_END_OK);
+  this->write_byte_(ota::OTA_RESPONSE_UPDATE_END_OK);
 
   // Read ACK
-  if (!this->data_readall_(buf, 1) || buf[0] != ota::OTA_RESPONSE_OK) {
+  if (!this->readall_(buf, 1) || buf[0] != ota::OTA_RESPONSE_OK) {
     this->log_read_error_(LOG_STR("ack"));
     // do not go to error, this is not fatal
   }
@@ -577,7 +510,7 @@ void ESPHomeOTAComponent::handle_data_() {
   App.safe_reboot();
 
 error:
-  this->data_write_byte_(static_cast<uint8_t>(error_code));
+  this->write_byte_(static_cast<uint8_t>(error_code));
 
   // Abort backend before cleanup - cleanup_connection_() destroys the backend.
   // Always call abort() unconditionally: backends register external partitions before
@@ -744,9 +677,6 @@ void ESPHomeOTAComponent::cleanup_connection_() {
   this->backend_ = nullptr;
 #ifdef USE_OTA_PASSWORD
   this->cleanup_auth_();
-#endif
-#ifdef USE_OTA_ENCRYPTION
-  this->noise_ = nullptr;
 #endif
   // Intentionally no disable_loop() — letting loop() run one more iteration catches
   // any connection that queued on the listener mid-session (otherwise the wake flag,

esphome/components/esphome/ota/ota_esphome.h

@@ -4,9 +4,6 @@
 #ifdef USE_OTA
 #include "esphome/components/ota/ota_backend_factory.h"
 #include "esphome/components/socket/socket.h"
-#ifdef USE_OTA_ENCRYPTION
-#include "esphome/components/noise/noise_handshake.h"
-#endif
 #include "esphome/core/helpers.h"
 #include "esphome/core/log.h"
 #include "esphome/core/preferences.h"
@@ -27,10 +24,7 @@ class ESPHomeOTAComponent final : public ota::OTAComponent {
     AUTH_SEND,  // Sending authentication request
     AUTH_READ,  // Reading authentication data
 #endif          // USE_OTA_PASSWORD
-#ifdef USE_OTA_ENCRYPTION
-    NOISE_HANDSHAKE,  // Exchanging Noise handshake frames
-#endif
-    DATA,  // BLOCKING! Processing OTA data (update, etc.)
+    DATA,       // BLOCKING! Processing OTA data (update, etc.)
   };
 #ifdef USE_OTA_PASSWORD
   void set_auth_password(const std::string &password) { password_ = password; }
@@ -44,10 +38,6 @@ class ESPHomeOTAComponent final : public ota::OTAComponent {
   }
 #endif  // USE_OTA_PASSWORD
 
-#ifdef USE_OTA_ENCRYPTION
-  void set_noise_psk(noise::psk_t psk) { this->noise_ctx_.set_psk(psk); }
-#endif
-
   /// Manually set the port OTA should listen on
   void set_port(uint16_t port) { this->port_ = port; }
 
@@ -73,48 +63,6 @@ class ESPHomeOTAComponent final : public ota::OTAComponent {
   bool writeall_(const uint8_t *buf, size_t len);
   inline bool write_byte_(uint8_t byte) { return this->writeall_(&byte, 1); }
 
-#ifdef USE_OTA_ENCRYPTION
-  // Heap-allocated only while an encrypted OTA session is active.
-  struct NoiseSession {
-    ~NoiseSession();
-    noise::NoiseResponderHandshake handshake;
-    NoiseCipherState *send_cipher{nullptr};
-    NoiseCipherState *recv_cipher{nullptr};
-    uint16_t frame_len{0};  // total frame size once the header is parsed, 0 until then
-    uint16_t frame_pos{0};  // bytes read or written so far
-    bool writing{false};    // a produced handshake frame is still being flushed
-    uint8_t frame_buf[noise::FRAME_HEADER_SIZE + 1 + noise::MAX_HANDSHAKE_SIZE];
-  };
-  bool noise_start_session_();
-  bool handle_noise_handshake_();
-  bool noise_try_read_frame_();
-  bool noise_try_write_frame_();
-  void noise_send_reject_(const LogString *reason);
-  ssize_t noise_decrypt_(uint8_t *buf, size_t len);
-  ssize_t noise_read_frame_blocking_(uint8_t *buf, size_t min_ciphertext, size_t max_ciphertext);
-  bool noise_readall_(uint8_t *buf, size_t len);
-  ssize_t noise_read_data_(uint8_t *buf, size_t capacity);
-  bool noise_write_byte_(uint8_t byte);
-#endif  // USE_OTA_ENCRYPTION
-
-  // Data-phase I/O dispatch: through the noise transport when a session is
-  // active, straight to the socket otherwise.
-  inline bool data_write_byte_(uint8_t byte) {
-#ifdef USE_OTA_ENCRYPTION
-    if (this->noise_ != nullptr)
-      return this->noise_write_byte_(byte);
-#endif
-    return this->write_byte_(byte);
-  }
-  // When encrypted, buf must have room for len + noise::MAC_SIZE bytes.
-  inline bool data_readall_(uint8_t *buf, size_t len) {
-#ifdef USE_OTA_ENCRYPTION
-    if (this->noise_ != nullptr)
-      return this->noise_readall_(buf, len);
-#endif
-    return this->readall_(buf, len);
-  }
-
   bool try_read_(size_t to_read, const LogString *desc);
   bool try_write_(size_t to_write, const LogString *desc);
 
@@ -143,11 +91,6 @@ class ESPHomeOTAComponent final : public ota::OTAComponent {
   std::string password_;
   std::unique_ptr<uint8_t[]> auth_buf_;
 #endif  // USE_OTA_PASSWORD
-#ifdef USE_OTA_ENCRYPTION
-  noise::NoiseContext noise_ctx_;
-  std::unique_ptr<NoiseSession> noise_;
-  uint8_t server_feature_flags_{0};  // as sent in the feature ack, bound into the prologue
-#endif                               // USE_OTA_ENCRYPTION
 
   socket::ListenSocket *server_{nullptr};
   std::unique_ptr<socket::Socket> client_;
@@ -155,15 +98,6 @@ class ESPHomeOTAComponent final : public ota::OTAComponent {
 
   uint32_t client_connect_time_{0};
   static constexpr size_t HANDSHAKE_BUF_SIZE = 5;
-  // Buffer size for OTA data transfer. The upload client derives its maximum
-  // encrypted frame plaintext from this (espota2.NOISE_MAX_PLAINTEXT is this
-  // minus the 16-byte MAC); both must change together.
-  static constexpr size_t OTA_BUFFER_SIZE = 1024;
-#ifdef USE_OTA_ENCRYPTION
-  // Shrinking the buffer would reject every frame a current CLI sends
-  static_assert(OTA_BUFFER_SIZE >= 1008 + noise::MAC_SIZE, "OTA_BUFFER_SIZE must fit a full encrypted data frame");
-#endif
-  static constexpr uint8_t MAGIC_BYTES[5] = {0x6C, 0x26, 0xF7, 0x5C, 0x45};
 #ifdef USE_OTA_PARTITIONS
   uint32_t running_app_offset_{0};
   size_t running_app_size_{0};

esphome/components/esphome/ota/ota_esphome_noise.cpp

@@ -1,274 +0,0 @@
-#include "ota_esphome.h"
-#ifdef USE_OTA
-#ifdef USE_OTA_ENCRYPTION
-#include "esphome/components/noise/noise.h"
-#include "esphome/components/ota/ota_backend.h"
-#include "esphome/core/log.h"
-
-#include <cstring>
-#include <new>
-
-#ifdef USE_ESP8266
-#include <pgmspace.h>
-#endif
-
-namespace esphome {
-
-static const char *const TAG = "esphome.ota";
-
-#ifdef USE_ESP8266
-static constexpr char OTA_NOISE_PROLOGUE_INIT[] PROGMEM = "NoiseOTAInit";
-#else
-static const char *const OTA_NOISE_PROLOGUE_INIT = "NoiseOTAInit";
-#endif
-static constexpr size_t OTA_NOISE_PROLOGUE_INIT_LEN = 12;  // strlen("NoiseOTAInit")
-
-ESPHomeOTAComponent::NoiseSession::~NoiseSession() {
-  if (this->send_cipher != nullptr) {
-    noise_cipherstate_free(this->send_cipher);
-  }
-  if (this->recv_cipher != nullptr) {
-    noise_cipherstate_free(this->recv_cipher);
-  }
-}
-
-/** Allocate the session and start the responder handshake.
- *
- * The prologue binds the whole plaintext preamble, so any tampering with the
- * negotiation (a stripped feature flag, a changed version) breaks the first
- * handshake MAC on either side:
- *   "NoiseOTAInit" | magic(5) | OK,version | client_features | FEATURE_FLAGS,server_flags
- */
-bool ESPHomeOTAComponent::noise_start_session_() {
-  // NOLINTNEXTLINE(clang-analyzer-cplusplus.NewDeleteLeaks)
-  this->noise_ = std::unique_ptr<NoiseSession>(new (std::nothrow) NoiseSession());
-  if (this->noise_ == nullptr) {
-    ESP_LOGW(TAG, "Session allocation failed");
-    this->cleanup_connection_();
-    return false;
-  }
-
-  uint8_t prologue[OTA_NOISE_PROLOGUE_INIT_LEN + 5 + 2 + 1 + 2];
-#ifdef USE_ESP8266
-  memcpy_P(prologue, OTA_NOISE_PROLOGUE_INIT, OTA_NOISE_PROLOGUE_INIT_LEN);
-#else
-  std::memcpy(prologue, OTA_NOISE_PROLOGUE_INIT, OTA_NOISE_PROLOGUE_INIT_LEN);
-#endif
-  uint8_t *p = prologue + OTA_NOISE_PROLOGUE_INIT_LEN;
-  // Magic bytes, already validated in MAGIC_READ
-  std::memcpy(p, MAGIC_BYTES, sizeof(MAGIC_BYTES));
-  p += sizeof(MAGIC_BYTES);
-  // Our magic ack
-  *p++ = ota::OTA_RESPONSE_OK;
-  *p++ = USE_OTA_VERSION;
-  // The feature byte the client sent
-  *p++ = this->ota_features_;
-  // The feature ack we sent (noise requires the extended protocol)
-  *p++ = ota::OTA_RESPONSE_FEATURE_FLAGS;
-  *p++ = this->server_feature_flags_;
-
-  int err = this->noise_->handshake.init(this->noise_ctx_.get_psk(), prologue, sizeof(prologue));
-  if (err != 0) {
-    ESP_LOGW(TAG, "Handshake init: %s", LOG_STR_ARG(noise::noise_err_to_logstr(err)));
-    this->cleanup_connection_();
-    return false;
-  }
-  return true;
-}
-
-/** Drive the non-blocking handshake from loop(); returns true once the
- * transport ciphers are ready and the session can enter the data phase.
- * On failure the connection is cleaned up and false is returned.
- */
-bool ESPHomeOTAComponent::handle_noise_handshake_() {
-  NoiseSession &s = *this->noise_;
-  while (true) {
-    if (s.writing) {
-      if (!this->noise_try_write_frame_()) {
-        return false;  // would block, or errored and cleaned up
-      }
-      s.writing = false;
-      s.frame_pos = 0;
-      s.frame_len = 0;
-    }
-    switch (s.handshake.action()) {
-      case noise::NoiseResponderHandshake::Action::ACTION_READ: {
-        if (!this->noise_try_read_frame_()) {
-          return false;
-        }
-        const uint16_t payload_len = s.frame_len - noise::FRAME_HEADER_SIZE;
-        s.frame_pos = 0;
-        s.frame_len = 0;
-        if (s.frame_buf[noise::FRAME_HEADER_SIZE] != noise::HANDSHAKE_STATUS_OK) {
-          ESP_LOGW(TAG, "Bad handshake error byte: %u", s.frame_buf[noise::FRAME_HEADER_SIZE]);
-          this->cleanup_connection_();
-          return false;
-        }
-        int err = s.handshake.read_message(s.frame_buf + noise::FRAME_HEADER_SIZE + 1, payload_len - 1);
-        if (err != 0) {
-          ESP_LOGW(TAG, "Handshake read: %s", LOG_STR_ARG(noise::noise_err_to_logstr(err)));
-          this->noise_send_reject_(noise::reject_reason_for(err));
-          this->cleanup_connection_();
-          return false;
-        }
-        break;
-      }
-      case noise::NoiseResponderHandshake::Action::ACTION_WRITE: {
-        size_t msg_len = 0;
-        int err =
-            s.handshake.write_message(s.frame_buf + noise::FRAME_HEADER_SIZE + 1, noise::MAX_HANDSHAKE_SIZE, msg_len);
-        if (err != 0) {
-          ESP_LOGW(TAG, "Handshake write: %s", LOG_STR_ARG(noise::noise_err_to_logstr(err)));
-          this->cleanup_connection_();
-          return false;
-        }
-        const uint16_t payload_len = msg_len + 1;
-        noise::write_frame_header(s.frame_buf, payload_len);
-        s.frame_buf[noise::FRAME_HEADER_SIZE] = noise::HANDSHAKE_STATUS_OK;
-        s.frame_len = noise::FRAME_HEADER_SIZE + payload_len;
-        s.frame_pos = 0;
-        s.writing = true;
-        break;
-      }
-      case noise::NoiseResponderHandshake::Action::ACTION_SPLIT: {
-        int err = s.handshake.split(s.send_cipher, s.recv_cipher);
-        if (err != 0) {
-          ESP_LOGW(TAG, "Handshake split: %s", LOG_STR_ARG(noise::noise_err_to_logstr(err)));
-          this->cleanup_connection_();
-          return false;
-        }
-        ESP_LOGD(TAG, "Noise handshake complete");
-        return true;
-      }
-      default: {
-        ESP_LOGW(TAG, "Bad handshake state");
-        this->cleanup_connection_();
-        return false;
-      }
-    }
-  }
-}
-
-/// Non-blocking read of one handshake frame into the session buffer.
-bool ESPHomeOTAComponent::noise_try_read_frame_() {
-  NoiseSession &s = *this->noise_;
-  while (s.frame_pos < noise::FRAME_HEADER_SIZE) {
-    ssize_t read = this->client_->read(s.frame_buf + s.frame_pos, noise::FRAME_HEADER_SIZE - s.frame_pos);
-    if (!this->handle_read_error_(read, LOG_STR("read noise header"))) {
-      return false;
-    }
-    s.frame_pos += read;
-  }
-  if (s.frame_len == 0) {
-    const uint16_t payload_len = encode_uint16(s.frame_buf[1], s.frame_buf[2]);
-    if (s.frame_buf[0] != noise::FRAME_INDICATOR || payload_len < 1 || payload_len > 1 + noise::MAX_HANDSHAKE_SIZE) {
-      ESP_LOGW(TAG, "Bad handshake frame: 0x%02X, %u bytes", s.frame_buf[0], payload_len);
-      this->cleanup_connection_();
-      return false;
-    }
-    s.frame_len = noise::FRAME_HEADER_SIZE + payload_len;
-  }
-  while (s.frame_pos < s.frame_len) {
-    ssize_t read = this->client_->read(s.frame_buf + s.frame_pos, s.frame_len - s.frame_pos);
-    if (!this->handle_read_error_(read, LOG_STR("read noise frame"))) {
-      return false;
-    }
-    s.frame_pos += read;
-  }
-  return true;
-}
-
-/// Non-blocking write of the pending session-buffer frame.
-bool ESPHomeOTAComponent::noise_try_write_frame_() {
-  NoiseSession &s = *this->noise_;
-  while (s.frame_pos < s.frame_len) {
-    ssize_t written = this->client_->write(s.frame_buf + s.frame_pos, s.frame_len - s.frame_pos);
-    if (!this->handle_write_error_(written, LOG_STR("write noise frame"))) {
-      return false;
-    }
-    s.frame_pos += written;
-  }
-  return true;
-}
-
-/// Best-effort explicit reject frame so the client can log a readable reason.
-void ESPHomeOTAComponent::noise_send_reject_(const LogString *reason) {
-  uint8_t data[noise::FRAME_HEADER_SIZE + 1 + 32];
-  static_assert(sizeof(data) - noise::FRAME_HEADER_SIZE >= noise::MAC_FAILURE_PAYLOAD_SIZE,
-                "reject buffer must fit the MAC failure wire contract");
-  const size_t payload_len =
-      noise::format_reject_payload(data + noise::FRAME_HEADER_SIZE, sizeof(data) - noise::FRAME_HEADER_SIZE, reason);
-  noise::write_frame_header(data, payload_len);
-  this->client_->write(data, noise::FRAME_HEADER_SIZE + payload_len);  // Best effort, non-blocking
-}
-
-/// Decrypt a ciphertext in place; returns the plaintext size or -1.
-ssize_t ESPHomeOTAComponent::noise_decrypt_(uint8_t *buf, size_t len) {
-  NoiseBuffer mbuf;
-  noise_buffer_init(mbuf);
-  noise_buffer_set_inout(mbuf, buf, len, len);
-  int err = noise_cipherstate_decrypt(this->noise_->recv_cipher, &mbuf);
-  if (err != 0) {
-    ESP_LOGW(TAG, "Decrypt: %s", LOG_STR_ARG(noise::noise_err_to_logstr(err)));
-    return -1;
-  }
-  return mbuf.size;
-}
-
-/** Blocking read of one frame whose ciphertext size must be within the given
- * bounds, decrypted in place; returns the plaintext size, or -1 on error.
- * buf needs max_ciphertext capacity.
- */
-ssize_t ESPHomeOTAComponent::noise_read_frame_blocking_(uint8_t *buf, size_t min_ciphertext, size_t max_ciphertext) {
-  uint8_t header[noise::FRAME_HEADER_SIZE];
-  if (!this->readall_(header, sizeof(header))) {
-    return -1;
-  }
-  const size_t ciphertext_len = encode_uint16(header[1], header[2]);
-  if (header[0] != noise::FRAME_INDICATOR || ciphertext_len < min_ciphertext || ciphertext_len > max_ciphertext) {
-    ESP_LOGW(TAG, "Bad frame: 0x%02X, %zu bytes", header[0], ciphertext_len);
-    return -1;
-  }
-  if (!this->readall_(buf, ciphertext_len)) {
-    return -1;
-  }
-  return this->noise_decrypt_(buf, ciphertext_len);
-}
-
-/** Blocking read of one frame whose plaintext must be exactly len bytes
- * (control units are one unit per frame). buf needs len + noise::MAC_SIZE
- * capacity; the plaintext lands at buf[0..len).
- */
-bool ESPHomeOTAComponent::noise_readall_(uint8_t *buf, size_t len) {
-  return this->noise_read_frame_blocking_(buf, len + noise::MAC_SIZE, len + noise::MAC_SIZE) == (ssize_t) len;
-}
-
-/** Blocking read of one data-phase frame, decrypted in place; returns the
- * plaintext size, or -1 on error. buf is the OTA_BUFFER_SIZE data buffer.
- * The ciphertext must fit that buffer and its plaintext must fit what the
- * caller accepts (the remaining image bytes).
- */
-ssize_t ESPHomeOTAComponent::noise_read_data_(uint8_t *buf, size_t capacity) {
-  const size_t max_ciphertext = std::min(capacity + noise::MAC_SIZE, OTA_BUFFER_SIZE);
-  return this->noise_read_frame_blocking_(buf, noise::MAC_SIZE + 1, max_ciphertext);
-}
-
-/// Blocking write of one response byte as an encrypted frame.
-bool ESPHomeOTAComponent::noise_write_byte_(uint8_t byte) {
-  uint8_t frame[noise::FRAME_HEADER_SIZE + 1 + noise::MAC_SIZE];
-  frame[noise::FRAME_HEADER_SIZE] = byte;
-  NoiseBuffer mbuf;
-  noise_buffer_init(mbuf);
-  noise_buffer_set_inout(mbuf, frame + noise::FRAME_HEADER_SIZE, 1, 1 + noise::MAC_SIZE);
-  int err = noise_cipherstate_encrypt(this->noise_->send_cipher, &mbuf);
-  if (err != 0) {
-    ESP_LOGW(TAG, "Encrypt: %s", LOG_STR_ARG(noise::noise_err_to_logstr(err)));
-    return false;
-  }
-  noise::write_frame_header(frame, mbuf.size);
-  return this->writeall_(frame, noise::FRAME_HEADER_SIZE + mbuf.size);
-}
-
-}  // namespace esphome
-#endif  // USE_OTA_ENCRYPTION
-#endif  // USE_OTA

esphome/components/ethernet/ethernet_component.h

@@ -159,6 +159,9 @@ class EthernetComponent final : public Component {
   const char *get_use_address() const { return this->use_address_; }
   void set_use_address(const char *use_address) { this->use_address_ = use_address; }
   void get_eth_mac_address_raw(uint8_t *mac);
+  // Remove before 2026.9.0
+  ESPDEPRECATED("Use get_eth_mac_address_pretty_into_buffer() instead. Removed in 2026.9.0", "2026.3.0")
+  std::string get_eth_mac_address_pretty();
   const char *get_eth_mac_address_pretty_into_buffer(std::span<char, MAC_ADDRESS_PRETTY_BUFFER_SIZE> buf);
   eth_duplex_t get_duplex_mode();
   eth_speed_t get_link_speed();

esphome/components/ethernet/ethernet_component_esp32.cpp

@@ -928,6 +928,11 @@ void EthernetComponent::get_eth_mac_address_raw(uint8_t *mac) {
   ESPHL_ERROR_CHECK(err, "ETH_CMD_G_MAC error");
 }
 
+std::string EthernetComponent::get_eth_mac_address_pretty() {
+  char buf[MAC_ADDRESS_PRETTY_BUFFER_SIZE];
+  return std::string(this->get_eth_mac_address_pretty_into_buffer(buf));
+}
+
 const char *EthernetComponent::get_eth_mac_address_pretty_into_buffer(
     std::span<char, MAC_ADDRESS_PRETTY_BUFFER_SIZE> buf) {
   uint8_t mac[MAC_ADDRESS_SIZE];

esphome/components/ethernet/ethernet_component_rp2.cpp

@@ -249,6 +249,11 @@ void EthernetComponent::get_eth_mac_address_raw(uint8_t *mac) {
   }
 }
 
+std::string EthernetComponent::get_eth_mac_address_pretty() {
+  char buf[MAC_ADDRESS_PRETTY_BUFFER_SIZE];
+  return std::string(this->get_eth_mac_address_pretty_into_buffer(buf));
+}
+
 const char *EthernetComponent::get_eth_mac_address_pretty_into_buffer(
     std::span<char, MAC_ADDRESS_PRETTY_BUFFER_SIZE> buf) {
   uint8_t mac[MAC_ADDRESS_SIZE];

esphome/components/host/__init__.py

@@ -37,6 +37,7 @@ CONFIG_SCHEMA = cv.All(
             cv.Optional(CONF_MAC_ADDRESS, default="98:35:69:ab:f6:79"): cv.mac_address,
         }
     ),
+    cv.require_platformio_toolchain("host"),
     set_core_data,
 )
 

esphome/components/http_request/ota/ota_http_request.cpp

@@ -64,9 +64,8 @@ void OtaHttpRequestComponent::flash() {
   }
 }
 
-void OtaHttpRequestComponent::cleanup_(ota::OTABackendPtr backend, const std::shared_ptr<HttpContainer> &container,
-                                       bool abort_backend) {
-  if (abort_backend) {
+void OtaHttpRequestComponent::cleanup_(ota::OTABackendPtr backend, const std::shared_ptr<HttpContainer> &container) {
+  if (this->update_started_) {
     ESP_LOGV(TAG, "Aborting OTA backend");
     backend->abort();
   }
@@ -107,8 +106,7 @@ uint8_t OtaHttpRequestComponent::do_ota_() {
   auto error_code = backend->begin(container->content_length);
   if (error_code != ota::OTA_RESPONSE_OK) {
     ESP_LOGW(TAG, "backend->begin error: %d", error_code);
-    // Nothing to abort: begin() failed, so no OTA handle was opened
-    this->cleanup_(std::move(backend), container, /*abort_backend=*/false);
+    this->cleanup_(std::move(backend), container);
     return error_code;
   }
 
@@ -142,7 +140,7 @@ uint8_t OtaHttpRequestComponent::do_ota_() {
       } else {
         ESP_LOGE(TAG, "Error reading data: %d", bufsize_or_error);
       }
-      this->cleanup_(std::move(backend), container, /*abort_backend=*/true);
+      this->cleanup_(std::move(backend), container);
       return OTA_CONNECTION_ERROR;
     }
 
@@ -152,13 +150,14 @@ uint8_t OtaHttpRequestComponent::do_ota_() {
       md5_receive.add(buf, bufsize_or_error);
 
       // write bytes to OTA backend
+      this->update_started_ = true;
       error_code = backend->write(buf, bufsize_or_error);
       if (error_code != ota::OTA_RESPONSE_OK) {
         // error code explanation available at
         // https://github.com/esphome/esphome/blob/dev/esphome/components/ota/ota_backend.h
         ESP_LOGE(TAG, "Error code (%02X) writing binary data to flash at offset %d and size %d", error_code,
                  container->get_bytes_read() - bufsize_or_error, container->content_length);
-        this->cleanup_(std::move(backend), container, /*abort_backend=*/true);
+        this->cleanup_(std::move(backend), container);
         return error_code;
       }
     }
@@ -182,7 +181,7 @@ uint8_t OtaHttpRequestComponent::do_ota_() {
   this->md5_computed_ = md5_receive_str;
   if (strncmp(this->md5_computed_.c_str(), this->md5_expected_.c_str(), MD5_SIZE) != 0) {
     ESP_LOGE(TAG, "MD5 computed: %s - Aborting due to MD5 mismatch", this->md5_computed_.c_str());
-    this->cleanup_(std::move(backend), container, /*abort_backend=*/true);
+    this->cleanup_(std::move(backend), container);
     return ota::OTA_RESPONSE_ERROR_MD5_MISMATCH;
   } else {
     backend->set_update_md5(md5_receive_str);
@@ -198,7 +197,7 @@ uint8_t OtaHttpRequestComponent::do_ota_() {
   error_code = backend->end();
   if (error_code != ota::OTA_RESPONSE_OK) {
     ESP_LOGW(TAG, "Error ending update! error_code: %d", error_code);
-    this->cleanup_(std::move(backend), container, /*abort_backend=*/true);
+    this->cleanup_(std::move(backend), container);
     return error_code;
   }
 

esphome/components/http_request/ota/ota_http_request.h

@@ -38,7 +38,7 @@ class OtaHttpRequestComponent final : public ota::OTAComponent, public Parented<
   void flash();
 
  protected:
-  void cleanup_(ota::OTABackendPtr backend, const std::shared_ptr<HttpContainer> &container, bool abort_backend);
+  void cleanup_(ota::OTABackendPtr backend, const std::shared_ptr<HttpContainer> &container);
   uint8_t do_ota_();
   std::string get_url_with_auth_(const std::string &url);
   bool http_get_md5_();
@@ -51,6 +51,7 @@ class OtaHttpRequestComponent final : public ota::OTAComponent, public Parented<
   std::string username_{};
   std::string url_{};
   int status_ = -1;
+  bool update_started_ = false;
   static const uint16_t HTTP_RECV_BUFFER = 256;  // the firmware GET chunk size
 };
 

esphome/components/libretiny/__init__.py

@@ -300,7 +300,7 @@ FRAMEWORK_SCHEMA = cv.All(
     _check_debug_order,
 )
 
-CONFIG_SCHEMA = cv.All(_notify_old_style)
+CONFIG_SCHEMA = cv.All(_notify_old_style, cv.require_platformio_toolchain("LibreTiny"))
 
 BASE_SCHEMA = cv.Schema(
     {
@@ -314,6 +314,7 @@ BASE_SCHEMA = cv.Schema(
 )
 
 BASE_SCHEMA.add_extra(_detect_variant)
+BASE_SCHEMA.add_extra(cv.require_platformio_toolchain("LibreTiny"))
 BASE_SCHEMA.add_extra(_update_core_data)
 
 

esphome/components/modbus/modbus.h

@@ -618,6 +618,9 @@ class ModbusClientDevice {
   inline void clear_tx_queue_for_address() { this->parent_->clear_tx_queue_for_address(this->address_); }
   inline void clear_tx_queue_for_device() { this->parent_->clear_tx_queue_for_device(this); }
 
+  // If more than one device is connected block sending a new command before a response is received
+  ESPDEPRECATED("Use ready_for_immediate_send() instead. Removed in 2026.9.0", "2026.3.0")
+  bool waiting_for_response() { return !this->ready_for_immediate_send(); }
   bool ready_for_immediate_send() { return this->parent_->tx_buffer_empty() && !this->parent_->tx_blocked(); }
 
  protected:

esphome/components/noise/__init__.py

@@ -1,69 +0,0 @@
-import base64
-import binascii
-from typing import Any
-
-import esphome.codegen as cg
-import esphome.config_validation as cv
-from esphome.const import CONF_KEY
-from esphome.types import ConfigType
-
-CODEOWNERS = ["@esphome/core"]
-
-noise_ns = cg.esphome_ns.namespace("noise")
-
-CONFIG_SCHEMA = cv.Schema({})
-
-
-def validate_encryption_key(value: Any) -> str:
-    value = cv.string_strict(value)
-    try:
-        decoded = base64.b64decode(value, validate=True)
-    except ValueError as err:
-        raise cv.Invalid("Invalid key format, please check it's using base64") from err
-
-    if len(decoded) != 32:
-        raise cv.Invalid("Encryption key must be base64 and 32 bytes long")
-
-    # Return original data for roundtrip conversion
-    return value
-
-
-def decode_encryption_key(value: str) -> bytes:
-    """Decode a base64 encryption key to its 32 raw bytes.
-
-    a2b_base64 matches the decode the clients use (aioesphomeapi
-    decode_noise_psk), so both ends derive the same bytes. The length is
-    re-checked so a caller cannot turn an unvalidated short decode into a
-    zero-padded PSK.
-    """
-    try:
-        decoded = binascii.a2b_base64(value)
-    except ValueError as err:
-        raise cv.Invalid("Invalid key format, please check it's using base64") from err
-    if len(decoded) != 32:
-        raise cv.Invalid("Encryption key must be base64 and 32 bytes long")
-    return decoded
-
-
-ENCRYPTION_SCHEMA = cv.Schema(
-    {
-        cv.Optional(CONF_KEY): cv.sensitive(validate_encryption_key),
-    }
-)
-
-
-def encryption_schema(config: ConfigType | None) -> ConfigType:
-    # A bare `encryption:` block is valid; a missing key means the consumer
-    # falls back to its keyless behavior (api provisioning, ota inheriting
-    # the api key).
-    if config is None:
-        config = {}
-    return ENCRYPTION_SCHEMA(config)
-
-
-async def to_code(config: ConfigType) -> None:
-    cg.add_define("USE_NOISE")
-    cg.add_library("esphome/noise-c", "0.1.21")
-    # Enable optimized memzero/memcmp in libsodium instead of volatile byte loops
-    cg.add_build_flag("-DHAVE_WEAK_SYMBOLS=1")
-    cg.add_build_flag("-DHAVE_INLINE_ASM=1")

esphome/components/noise/noise.cpp

@@ -1,88 +0,0 @@
-#include "noise.h"
-#ifdef USE_NOISE
-#include "esphome/core/log.h"
-
-#include <algorithm>
-#include <cstring>
-
-#include <noise/protocol.h>
-
-#ifdef USE_ESP8266
-#include <pgmspace.h>
-#endif
-
-namespace esphome::noise {
-
-static const char *const TAG = "noise";
-
-const LogString *noise_err_to_logstr(int err) {
-  if (err == NOISE_ERROR_NO_MEMORY)
-    return LOG_STR("NO_MEMORY");
-  if (err == NOISE_ERROR_UNKNOWN_ID)
-    return LOG_STR("UNKNOWN_ID");
-  if (err == NOISE_ERROR_UNKNOWN_NAME)
-    return LOG_STR("UNKNOWN_NAME");
-  if (err == NOISE_ERROR_MAC_FAILURE)
-    return LOG_STR("MAC_FAILURE");
-  if (err == NOISE_ERROR_NOT_APPLICABLE)
-    return LOG_STR("NOT_APPLICABLE");
-  if (err == NOISE_ERROR_SYSTEM)
-    return LOG_STR("SYSTEM");
-  if (err == NOISE_ERROR_REMOTE_KEY_REQUIRED)
-    return LOG_STR("REMOTE_KEY_REQUIRED");
-  if (err == NOISE_ERROR_LOCAL_KEY_REQUIRED)
-    return LOG_STR("LOCAL_KEY_REQUIRED");
-  if (err == NOISE_ERROR_PSK_REQUIRED)
-    return LOG_STR("PSK_REQUIRED");
-  if (err == NOISE_ERROR_INVALID_LENGTH)
-    return LOG_STR("INVALID_LENGTH");
-  if (err == NOISE_ERROR_INVALID_PARAM)
-    return LOG_STR("INVALID_PARAM");
-  if (err == NOISE_ERROR_INVALID_STATE)
-    return LOG_STR("INVALID_STATE");
-  if (err == NOISE_ERROR_INVALID_NONCE)
-    return LOG_STR("INVALID_NONCE");
-  if (err == NOISE_ERROR_INVALID_PRIVATE_KEY)
-    return LOG_STR("INVALID_PRIVATE_KEY");
-  if (err == NOISE_ERROR_INVALID_PUBLIC_KEY)
-    return LOG_STR("INVALID_PUBLIC_KEY");
-  if (err == NOISE_ERROR_INVALID_FORMAT)
-    return LOG_STR("INVALID_FORMAT");
-  if (err == NOISE_ERROR_INVALID_SIGNATURE)
-    return LOG_STR("INVALID_SIGNATURE");
-  return LOG_STR("UNKNOWN");
-}
-
-const LogString *reject_reason_for(int err) {
-  return err == NOISE_ERROR_MAC_FAILURE ? LOG_STR("Handshake MAC failure") : LOG_STR("Handshake error");
-}
-
-size_t format_reject_payload(uint8_t *buf, size_t capacity, const LogString *reason) {
-  if (capacity == 0) {
-    // A caller bug; the MAC_FAILURE_PAYLOAD_SIZE static_asserts at the call
-    // sites make this unreachable, kept as cheap memory safety
-    ESP_LOGVV(TAG, "Reject buffer has no capacity");
-    return 0;
-  }
-  buf[0] = HANDSHAKE_STATUS_REJECT;
-#ifdef USE_STORE_LOG_STR_IN_FLASH
-  // On ESP8266 with flash strings, we need to use PROGMEM-aware functions
-  size_t reason_len = strlen_P(reinterpret_cast<PGM_P>(reason));
-  reason_len = std::min(reason_len, capacity - 1);
-  if (reason_len > 0) {
-    memcpy_P(buf + 1, reinterpret_cast<PGM_P>(reason), reason_len);
-  }
-#else
-  const char *reason_str = LOG_STR_ARG(reason);
-  size_t reason_len = strlen(reason_str);
-  reason_len = std::min(reason_len, capacity - 1);
-  if (reason_len > 0) {
-    // NOLINTNEXTLINE(bugprone-not-null-terminated-result) - binary protocol, not a C string
-    std::memcpy(buf + 1, reason_str, reason_len);
-  }
-#endif
-  return reason_len + 1;
-}
-
-}  // namespace esphome::noise
-#endif  // USE_NOISE

esphome/components/noise/noise.h

@@ -1,73 +0,0 @@
-#pragma once
-#include "esphome/core/defines.h"
-#ifdef USE_NOISE
-#include <array>
-#include <cstdint>
-#include "esphome/core/log.h"
-
-namespace esphome::noise {
-
-using psk_t = std::array<uint8_t, 32>;
-
-class NoiseContext {
- public:
-  // The all-zeros PSK is reserved: it marks the device as unprovisioned and
-  // doubles as the well-known provisioning PSK that unprovisioned devices
-  // accept for Noise handshakes (passive-sniffing protection only, no
-  // authentication). It is never a valid real key.
-  static bool is_all_zeros(const psk_t &psk) {
-    uint8_t acc = 0;
-    for (uint8_t b : psk) {
-      acc |= b;
-    }
-    return acc == 0;
-  }
-  void set_psk(psk_t psk) {
-    this->psk_ = psk;
-    this->has_psk_ = !is_all_zeros(psk);
-  }
-  const psk_t &get_psk() const { return this->psk_; }
-  bool has_psk() const { return this->has_psk_; }
-
- protected:
-  psk_t psk_{};
-  bool has_psk_{false};
-};
-
-/// Convert a noise error code to a readable error
-const LogString *noise_err_to_logstr(int err);
-
-// Shared wire format for the noise transports (api and ota): every frame is
-// FRAME_INDICATOR, a 16-bit big-endian payload length, then the payload.
-// Handshake payloads start with a status byte; transport payloads end with
-// the ChaCha20-Poly1305 MAC.
-static constexpr uint8_t FRAME_INDICATOR = 0x01;
-static constexpr size_t FRAME_HEADER_SIZE = 3;
-static constexpr size_t MAC_SIZE = 16;
-static constexpr size_t MAX_HANDSHAKE_SIZE = 128;
-static constexpr uint8_t HANDSHAKE_STATUS_OK = 0x00;
-static constexpr uint8_t HANDSHAKE_STATUS_REJECT = 0x01;
-
-inline void write_frame_header(uint8_t *buf, uint16_t payload_len) {
-  buf[0] = FRAME_INDICATOR;
-  buf[1] = (uint8_t) (payload_len >> 8);
-  buf[2] = (uint8_t) payload_len;
-}
-
-/// Fill buf with a handshake reject payload (status byte plus the reason
-/// text, PROGMEM aware); returns the payload length. buf needs capacity for
-/// the status byte plus the truncated reason.
-size_t format_reject_payload(uint8_t *buf, size_t capacity, const LogString *reason);
-
-/// Reject reason for a failed handshake read. The MAC failure string is a
-/// wire contract: clients match it to report a wrong key.
-const LogString *reject_reason_for(int err);
-
-/// Payload size of the MAC failure reject, the one reason string that is a
-/// wire contract (sizeof's NUL stands in for the status byte). static_assert
-/// reject buffers against this so a wrong key report can never truncate;
-/// longer caller-supplied reasons are informational and sized by the caller.
-static constexpr size_t MAC_FAILURE_PAYLOAD_SIZE = sizeof("Handshake MAC failure");
-
-}  // namespace esphome::noise
-#endif  // USE_NOISE

esphome/components/noise/noise_handshake.cpp

@@ -1,139 +0,0 @@
-#include "noise_handshake.h"
-#ifdef USE_NOISE
-#include "esphome/core/hal.h"
-#include "esphome/core/helpers.h"
-#include "esphome/core/log.h"
-
-namespace esphome::noise {
-
-static const char *const TAG = "noise";
-
-// Log the failing noise-c call at the same verbosity the api helper used
-// before this class existed; callers only see one collapsed error code.
-#define HANDSHAKE_STEP_LOG(func_name, err_code) \
-  ESP_LOGVV(TAG, "%s failed: %s", LOG_STR_ARG(LOG_STR(func_name)), LOG_STR_ARG(noise_err_to_logstr(err_code)))
-
-NoiseResponderHandshake::~NoiseResponderHandshake() {
-  if (this->handshake_ != nullptr) {
-    noise_handshakestate_free(this->handshake_);
-    this->handshake_ = nullptr;
-  }
-}
-
-int NoiseResponderHandshake::init(const psk_t &psk, const uint8_t *prologue, size_t prologue_len) {
-  if (this->handshake_ != nullptr) {
-    noise_handshakestate_free(this->handshake_);
-    this->handshake_ = nullptr;
-  }
-  // Noise_NNpsk0_25519_ChaChaPoly_SHA256, built on the stack:
-  // noise_handshakestate_new_by_id copies it, so a member would waste
-  // 104 bytes per connection, and a static const would sit in RAM on
-  // ESP8266 (.rodata is DRAM there).
-  const NoiseProtocolId nid = {
-      .prefix_id = NOISE_PREFIX_STANDARD,
-      .pattern_id = NOISE_PATTERN_NN,
-      .modifier_ids = {NOISE_MODIFIER_PSK0},
-      .dh_id = NOISE_DH_CURVE25519,
-      .cipher_id = NOISE_CIPHER_CHACHAPOLY,
-      .hash_id = NOISE_HASH_SHA256,
-      .hybrid_id = NOISE_DH_NONE,
-  };
-
-  int err = noise_handshakestate_new_by_id(&this->handshake_, &nid, NOISE_ROLE_RESPONDER);
-  if (err != 0) {
-    HANDSHAKE_STEP_LOG("noise_handshakestate_new_by_id", err);
-    return err;
-  }
-  err = noise_handshakestate_set_pre_shared_key(this->handshake_, psk.data(), psk.size());
-  if (err != 0) {
-    HANDSHAKE_STEP_LOG("noise_handshakestate_set_pre_shared_key", err);
-    return this->fail_init_(err);
-  }
-  err = noise_handshakestate_set_prologue(this->handshake_, prologue, prologue_len);
-  if (err != 0) {
-    HANDSHAKE_STEP_LOG("noise_handshakestate_set_prologue", err);
-    return this->fail_init_(err);
-  }
-  err = noise_handshakestate_start(this->handshake_);
-  if (err != 0) {
-    HANDSHAKE_STEP_LOG("noise_handshakestate_start", err);
-    return this->fail_init_(err);
-  }
-  return 0;
-}
-
-/// Release a half-initialized state so a failed init() leaves the object as
-/// if init() was never called.
-int NoiseResponderHandshake::fail_init_(int err) {
-  noise_handshakestate_free(this->handshake_);
-  this->handshake_ = nullptr;
-  return err;
-}
-
-NoiseResponderHandshake::Action NoiseResponderHandshake::action() const {
-  if (this->handshake_ == nullptr) {
-    // A caller bug: init() was never called, or split() already released the state
-    ESP_LOGVV(TAG, "action() on uninitialized or split handshake");
-    return Action::ACTION_FAILED;
-  }
-  int raw = noise_handshakestate_get_action(this->handshake_);
-  switch (raw) {
-    case NOISE_ACTION_READ_MESSAGE:
-      return Action::ACTION_READ;
-    case NOISE_ACTION_WRITE_MESSAGE:
-      return Action::ACTION_WRITE;
-    case NOISE_ACTION_SPLIT:
-      return Action::ACTION_SPLIT;
-    default:
-      // Preserve the raw code in debug logs; callers only see the collapsed enum
-      ESP_LOGVV(TAG, "Unexpected noise action %d", raw);
-      return Action::ACTION_FAILED;
-  }
-}
-
-int NoiseResponderHandshake::read_message(uint8_t *data, size_t len) {
-  NoiseBuffer mbuf;
-  noise_buffer_init(mbuf);
-  noise_buffer_set_input(mbuf, data, len);
-  return noise_handshakestate_read_message(this->handshake_, &mbuf, nullptr);
-}
-
-int NoiseResponderHandshake::write_message(uint8_t *out, size_t capacity, size_t &out_len) {
-  out_len = 0;
-  NoiseBuffer mbuf;
-  noise_buffer_init(mbuf);
-  noise_buffer_set_output(mbuf, out, capacity);
-  int err = noise_handshakestate_write_message(this->handshake_, &mbuf, nullptr);
-  if (err == 0)
-    out_len = mbuf.size;
-  return err;
-}
-
-int NoiseResponderHandshake::split(NoiseCipherState *&send_cipher, NoiseCipherState *&recv_cipher) {
-  // Defined error postcondition: noise-c leaves the out-params unwritten on
-  // its early error returns, so a caller passing uninitialized locals must
-  // never see garbage to free
-  send_cipher = nullptr;
-  recv_cipher = nullptr;
-  int err = noise_handshakestate_split(this->handshake_, &send_cipher, &recv_cipher);
-  if (err != 0)
-    return err;
-  noise_handshakestate_free(this->handshake_);
-  this->handshake_ = nullptr;
-  return 0;
-}
-
-extern "C" {
-// noise-c's only randomness source (the vendored library compiles no rand of
-// its own); HWRNG backed. Lives in this TU so every handshake consumer links
-// it and the definition can never be dropped from the archive.
-void noise_rand_bytes(void *output, size_t len) {
-  if (!esphome::random_bytes(reinterpret_cast<uint8_t *>(output), len)) {
-    ESP_LOGE(TAG, "Acquiring random bytes failed; rebooting");
-    arch_restart();
-  }
-}
-}
-
-}  // namespace esphome::noise
-#endif  // USE_NOISE

esphome/components/noise/noise_handshake.h

@@ -1,63 +0,0 @@
-#pragma once
-#include "esphome/core/defines.h"
-#ifdef USE_NOISE
-#include <cstddef>
-#include <cstdint>
-
-#include <noise/protocol.h>
-
-#include "noise.h"
-
-namespace esphome::noise {
-
-/** Sans-IO responder side of a Noise_NNpsk0_25519_ChaChaPoly_SHA256 handshake.
- *
- * Owns only the noise-c handshake state; the caller moves the raw handshake
- * messages (no framing) over its own transport, driven by action():
- * read_message() while READ, write_message() while WRITE, then split() to
- * take ownership of the transport ciphers. All methods return a noise-c
- * error code, 0 on success. Called outside their action() step (before
- * init(), after split()) the message methods return a noise-c error rather
- * than crashing; the library checks its state argument.
- *
- * Methods are deliberately small separate functions so callers on tight
- * stacks (RP2040 core0 scratch bank) never pay for more than one branch;
- * the curve25519 step alone needs ~2KB of stack.
- */
-class NoiseResponderHandshake {
- public:
-  // The ACTION_ prefix is macro-collision safety: SDK headers #define bare
-  // names like READ/WRITE, and macros expand even inside an enum class.
-  enum class Action : uint8_t { ACTION_READ, ACTION_WRITE, ACTION_SPLIT, ACTION_FAILED };
-
-  NoiseResponderHandshake() = default;
-  ~NoiseResponderHandshake();
-  // Owns a raw noise-c handshake state; copying would double free it
-  NoiseResponderHandshake(const NoiseResponderHandshake &) = delete;
-  NoiseResponderHandshake &operator=(const NoiseResponderHandshake &) = delete;
-
-  /// Create and start the handshake with the given PSK and prologue. A
-  /// repeated call frees the previous handshake state and starts over.
-  [[nodiscard]] int init(const psk_t &psk, const uint8_t *prologue, size_t prologue_len);
-  /// ACTION_FAILED is the catch-all: returned before init(), after split()
-  /// has released the state, and when noise-c reports a failed handshake.
-  [[nodiscard]] Action action() const;
-  /// Process one received handshake message. The buffer is consumed in
-  /// place: noise-c decrypts into it and zeroes it before returning.
-  [[nodiscard]] int read_message(uint8_t *data, size_t len);
-  /// Produce the next handshake message into out; out_len receives its size
-  /// and is zero on error.
-  [[nodiscard]] int write_message(uint8_t *out, size_t capacity, size_t &out_len);
-  /// Hand out the transport ciphers and free the handshake state. The caller
-  /// owns both cipher states and must free them with noise_cipherstate_free();
-  /// both are set to nullptr on error.
-  [[nodiscard]] int split(NoiseCipherState *&send_cipher, NoiseCipherState *&recv_cipher);
-
- protected:
-  int fail_init_(int err);
-
-  NoiseHandshakeState *handshake_{nullptr};
-};
-
-}  // namespace esphome::noise
-#endif  // USE_NOISE

esphome/components/nrf52/__init__.py

@@ -125,10 +125,8 @@ def set_core_data(config: ConfigType) -> ConfigType:
     return config
 
 
-def _resolve_toolchain(config: ConfigType) -> ConfigType:
-    if CORE.toolchain is None:
-        CORE.toolchain = config.get(CONF_TOOLCHAIN, Toolchain.SDK_NRF)
-    return config
+_TOOLCHAINS = (Toolchain.PLATFORMIO, Toolchain.SDK_NRF)
+_resolve_toolchain = cv.resolve_toolchain("nRF52", _TOOLCHAINS, Toolchain.SDK_NRF)
 
 
 def set_framework(config: ConfigType) -> ConfigType:
@@ -170,10 +168,7 @@ BOOTLOADERS = [
 ]
 
 
-def _validate_toolchain(value) -> Toolchain:
-    return Toolchain(
-        cv.one_of(Toolchain.PLATFORMIO, Toolchain.SDK_NRF, lower=True)(value)
-    )
+_validate_toolchain = cv.toolchain_enum(_TOOLCHAINS)
 
 
 def _detect_bootloader(config: ConfigType) -> ConfigType:

esphome/components/nrf52/framework.py

@@ -7,8 +7,7 @@ import shutil
 import sys
 import tempfile
 
-import platformdirs
-
+from esphome.build_helpers.tools_cache import SDK_NRF_TOOLS_CACHE, tools_cache_path
 import esphome.config_validation as cv
 from esphome.const import KEY_CORE, KEY_FRAMEWORK_VERSION
 from esphome.core import CORE, EsphomeError
@@ -21,7 +20,6 @@ from esphome.framework_helpers import (
     run_command_ok,
     str_to_lst_of_str,
 )
-from esphome.helpers import get_str_env
 
 _LOGGER = logging.getLogger(__name__)
 
@@ -51,15 +49,9 @@ SDK_NG_MINIMAL_MIRRORS = str_to_lst_of_str(
 
 
 def get_sdk_nrf_tools_path() -> Path:
-    # A blank ESPHOME_SDK_NRF_PREFIX must be treated as unset: Path("")
-    # resolves to the CWD, which clean-all would then delete.
-    if prefix := get_str_env("ESPHOME_SDK_NRF_PREFIX", "").strip():
-        path = Path(prefix).expanduser()
-    else:
-        # Machine-global (OS user cache dir) so all projects share one install;
-        # see espidf.framework.get_idf_tools_path for the location rationale.
-        path = Path(platformdirs.user_cache_dir("esphome", appauthor=False)) / "sdk-nrf"
-    return path.resolve()
+    # Machine-global (OS user cache dir) so all projects share one install;
+    # see espidf.framework.get_idf_tools_path for the location rationale.
+    return tools_cache_path(*SDK_NRF_TOOLS_CACHE)
 
 
 def _needs_venv_rebuild(

esphome/components/ota/__init__.py

@@ -1,9 +1,6 @@
 from esphome import automation
 import esphome.codegen as cg
-from esphome.config_helpers import (
-    filter_source_files_from_defines,
-    filter_source_files_from_platform,
-)
+from esphome.config_helpers import filter_source_files_from_platform
 import esphome.config_validation as cv
 from esphome.const import (
     CONF_ESPHOME,
@@ -174,17 +171,24 @@ _filter_backend_source_files = filter_source_files_from_platform(
 )
 
 
-# USE_OTA_SIGNED_VERIFICATION_MULTI_KEY is set only on ESP32/IDF;
-# USE_OTA_PARTITIONS is set by the esphome OTA platform when
-# allow_partition_access is enabled.
-_filter_define_source_files = filter_source_files_from_defines(
-    {
-        "ota_signature_esp_idf.cpp": "USE_OTA_SIGNED_VERIFICATION_MULTI_KEY",
-        "ota_bootloader_esp_idf.cpp": "USE_OTA_PARTITIONS",
-        "ota_partitions_esp_idf.cpp": "USE_OTA_PARTITIONS",
-    }
-)
-
-
 def FILTER_SOURCE_FILES() -> list[str]:
-    return _filter_backend_source_files() + _filter_define_source_files()
+    files = _filter_backend_source_files()
+    # ota_signature_esp_idf.cpp implements multi-key OTA signature verification,
+    # compiled only when the esp32 component enables it (external RSA signed
+    # OTA sets USE_OTA_SIGNED_VERIFICATION_MULTI_KEY). The define is set only on
+    # ESP32/IDF, so this also excludes the file on every other platform. Filter
+    # it out otherwise so the (otherwise fully #ifdef'd-out) file isn't opened
+    # and parsed on every build.
+    if not any(
+        define.name == "USE_OTA_SIGNED_VERIFICATION_MULTI_KEY"
+        for define in CORE.defines
+    ):
+        files.append("ota_signature_esp_idf.cpp")
+    # ota_bootloader_esp_idf.cpp and ota_partitions_esp_idf.cpp are fully
+    # #ifdef'd on USE_OTA_PARTITIONS (set by the esphome OTA platform when
+    # allow_partition_access is enabled). Filter them out otherwise for the
+    # same reason as above.
+    if not any(define.name == "USE_OTA_PARTITIONS" for define in CORE.defines):
+        files.append("ota_bootloader_esp_idf.cpp")
+        files.append("ota_partitions_esp_idf.cpp")
+    return files

esphome/components/ota/ota_backend.h

@@ -49,7 +49,6 @@ enum OTAResponseTypes {
   OTA_RESPONSE_ERROR_BOOTLOADER_VERIFY = 0x91,
   OTA_RESPONSE_ERROR_BOOTLOADER_UPDATE = 0x92,
   OTA_RESPONSE_ERROR_VERSION_DOWNGRADE = 0x93,
-  OTA_RESPONSE_ERROR_ENCRYPTION_REQUIRED = 0x94,
   OTA_RESPONSE_ERROR_UNKNOWN = 0xFF,
 };
 
@@ -67,19 +66,6 @@ enum OTAResponseTypes {
  */
 bool version_is_older(const char *candidate, const char *reference);
 
-// 64 KiB flash block; the erase granularity the ESP-IDF backend erases ahead with.
-static constexpr size_t OTA_BLOCK_ERASE_SIZE = 64 * 1024;
-
-/** Target erased watermark for lazy block erase-ahead.
- *
- * Rounds the write end offset up to a block boundary, clamped to the partition
- * size. Platform-independent so the arithmetic is host-testable.
- */
-constexpr size_t next_erase_end(size_t write_end, size_t partition_size) {
-  const size_t rounded = (write_end + OTA_BLOCK_ERASE_SIZE - 1) & ~(OTA_BLOCK_ERASE_SIZE - 1);
-  return rounded < partition_size ? rounded : partition_size;
-}
-
 enum OTAState {
   OTA_COMPLETED = 0,
   OTA_STARTED,

esphome/components/ota/ota_backend_esp_idf.cpp

@@ -7,7 +7,7 @@
 #include "esphome/core/log.h"
 
 #include <esp_ota_ops.h>
-#include <sdkconfig.h>
+#include <esp_task_wdt.h>
 #include <spi_flash_mmap.h>
 #ifdef USE_OTA_DOWNGRADE_PROTECTION
 #include <esp_app_desc.h>
@@ -60,38 +60,27 @@ OTAResponseTypes IDFOTABackend::begin(size_t image_size, ota::OTAType ota_type)
     return OTA_RESPONSE_ERROR_NO_UPDATE_PARTITION;
   }
 
-  // Both lazy-erase paths below replace esp_ota_begin()'s blocking full erase.
-  // Size check replaces the one that erase performed (0 = unknown size,
-  // e.g. web_server uploads).
-  if (image_size != 0 && image_size > this->partition_->size) {
-    return OTA_RESPONSE_ERROR_ESP32_NOT_ENOUGH_SPACE;
+  // esp_ota_begin() erases the destination region, which blocks loopTask and
+  // scales with the erase size -- a fixed watchdog overruns on large OTA slots.
+  // An unknown size (0, e.g. web_server uploads) erases the whole partition, so
+  // budget against the bytes actually erased. ~10ms/KiB (conservative
+  // ~100 KiB/s erase) over a 15s floor; panic stays on so a stuck erase still
+  // resets rather than hanging forever.
+  size_t erase_size = image_size;
+  if (erase_size == 0 || erase_size > this->partition_->size) {
+    erase_size = this->partition_->size;
   }
-  this->written_ = 0;
-  esp_err_t err;
-#ifdef USE_OTA_BLOCK_ERASE_AHEAD
-  this->erased_end_ = 0;
-  // Unlike esp_ota_begin(), esp_ota_resume() does not reject a running app in
-  // ESP_OTA_IMG_PENDING_VERIFY; that state is unreachable here because the app
-  // was marked valid at boot (esp32/hal.cpp) or just above under USE_OTA_ROLLBACK.
-  // erase_size 0 (!= OTA_WITH_SEQUENTIAL_WRITES) means no erase; erase_ahead_() handles it
-  err = esp_ota_resume(this->partition_, 0, 0, &this->update_handle_);
-#if defined(CONFIG_BOOTLOADER_APP_ROLLBACK_ENABLE) && ESP_IDF_VERSION >= ESP_IDF_VERSION_VAL(5, 5, 0)
-  // esp_ota_begin() does this on IDF 5.5+; esp_ota_resume() does not. Prevents
-  // booting a half-written slot after a crash mid-OTA. Not available on the
-  // 5.3.3/5.4.2 backports, whose esp_ota_begin() did not invalidate either.
-  if (err == ESP_OK) {
-    esp_ota_invalidate_inactive_ota_data_slot();
-  }
-#endif
-#else
-  err = esp_ota_begin(this->partition_, OTA_WITH_SEQUENTIAL_WRITES, &this->update_handle_);
-#endif
+  const uint32_t erase_budget_ms = 15000 + (erase_size >> 10) * 10;
+  watchdog::WatchdogManager watchdog(erase_budget_ms);
+  esp_err_t err = esp_ota_begin(this->partition_, image_size, &this->update_handle_);
 
   if (err != ESP_OK) {
-    ESP_LOGE(TAG, "OTA begin failed (err=0x%X)", err);
+    ESP_LOGE(TAG, "esp_ota_begin failed (err=0x%X)", err);
     esp_ota_abort(this->update_handle_);
     this->update_handle_ = 0;
-    if (err == ESP_ERR_FLASH_OP_TIMEOUT || err == ESP_ERR_FLASH_OP_FAIL) {
+    if (err == ESP_ERR_INVALID_SIZE) {
+      return OTA_RESPONSE_ERROR_ESP32_NOT_ENOUGH_SPACE;
+    } else if (err == ESP_ERR_FLASH_OP_TIMEOUT || err == ESP_ERR_FLASH_OP_FAIL) {
       return OTA_RESPONSE_ERROR_WRITING_FLASH;
     } else if (err == ESP_ERR_OTA_PARTITION_CONFLICT) {
       // This error appears with 1 factory and 1 ota partition
@@ -131,17 +120,6 @@ OTAResponseTypes IDFOTABackend::write(uint8_t *data, size_t len) {
   if (!this->is_app_or_bootloader_update_()) {
     return OTA_RESPONSE_ERROR_UNSUPPORTED_OTA_TYPE;
   }
-#endif
-  // Overflow can only happen on unknown-size uploads (web_server); known
-  // sizes were rejected in begin().
-  if (this->written_ + len > this->partition_->size) {
-    return OTA_RESPONSE_ERROR_ESP32_NOT_ENOUGH_SPACE;
-  }
-#ifdef USE_OTA_BLOCK_ERASE_AHEAD
-  OTAResponseTypes erase_result = this->erase_ahead_(len);
-  if (erase_result != OTA_RESPONSE_OK) {
-    return erase_result;
-  }
 #endif
   esp_err_t err = esp_ota_write(this->update_handle_, data, len);
   this->md5_.add(data, len);
@@ -149,40 +127,14 @@ OTAResponseTypes IDFOTABackend::write(uint8_t *data, size_t len) {
     ESP_LOGE(TAG, "esp_ota_write failed (err=0x%X)", err);
     if (err == ESP_ERR_OTA_VALIDATE_FAILED) {
       return OTA_RESPONSE_ERROR_MAGIC;
-    } else if (err == ESP_ERR_INVALID_SIZE) {
-      // Sequential-writes fallback: IDF's lazy erase reports overflow here
-      return OTA_RESPONSE_ERROR_ESP32_NOT_ENOUGH_SPACE;
     } else if (err == ESP_ERR_FLASH_OP_TIMEOUT || err == ESP_ERR_FLASH_OP_FAIL) {
       return OTA_RESPONSE_ERROR_WRITING_FLASH;
     }
     return OTA_RESPONSE_ERROR_UNKNOWN;
   }
-  this->written_ += len;
   return OTA_RESPONSE_OK;
 }
 
-#ifdef USE_OTA_BLOCK_ERASE_AHEAD
-OTAResponseTypes IDFOTABackend::erase_ahead_(size_t len) {
-  const size_t end = this->written_ + len;
-  if (this->erased_end_ >= end) {
-    return OTA_RESPONSE_OK;
-  }
-  // Round up to a block boundary, clamped to the partition end; IDF splits the
-  // range into 64 KiB block erases where aligned, sector erases elsewhere.
-  const size_t erase_to = next_erase_end(end, this->partition_->size);
-  // A block erase is one uninterruptible flash op (typically ~150 ms, seconds
-  // on aged flash) and the transfer loop may not have fed the WDT for ~1s.
-  watchdog::WatchdogManager watchdog(15000);
-  esp_err_t err = esp_partition_erase_range(this->partition_, this->erased_end_, erase_to - this->erased_end_);
-  if (err != ESP_OK) {
-    ESP_LOGE(TAG, "esp_partition_erase_range failed (err=0x%X)", err);
-    return err == ESP_ERR_INVALID_SIZE ? OTA_RESPONSE_ERROR_ESP32_NOT_ENOUGH_SPACE : OTA_RESPONSE_ERROR_WRITING_FLASH;
-  }
-  this->erased_end_ = erase_to;
-  return OTA_RESPONSE_OK;
-}
-#endif
-
 OTAResponseTypes IDFOTABackend::end() {
   if (this->md5_set_) {
     this->md5_.calculate();
@@ -274,10 +226,6 @@ void IDFOTABackend::abort() {
   // or not an update is in flight.
   esp_ota_abort(this->update_handle_);
   this->update_handle_ = 0;
-  this->written_ = 0;
-#ifdef USE_OTA_BLOCK_ERASE_AHEAD
-  this->erased_end_ = 0;
-#endif
 }
 
 }  // namespace esphome::ota

esphome/components/ota/ota_backend_esp_idf.h

@@ -5,18 +5,8 @@
 #include "esphome/components/md5/md5.h"
 #include "esphome/core/defines.h"
 
-#include <esp_idf_version.h>
 #include <esp_ota_ops.h>
 
-// esp_ota_resume() (IDF 5.4.2+, backported to 5.3.3) provides a no-erase OTA
-// handle, letting write() block-erase 64 KiB ahead of the write cursor
-// (~4x faster than the per-sector lazy erase of OTA_WITH_SEQUENTIAL_WRITES,
-// used as fallback on older IDF).
-#if ESP_IDF_VERSION >= ESP_IDF_VERSION_VAL(5, 4, 2) || \
-    (ESP_IDF_VERSION >= ESP_IDF_VERSION_VAL(5, 3, 3) && ESP_IDF_VERSION < ESP_IDF_VERSION_VAL(5, 4, 0))
-#define USE_OTA_BLOCK_ERASE_AHEAD
-#endif
-
 namespace esphome::ota {
 
 #ifdef USE_OTA_PARTITIONS
@@ -64,9 +54,6 @@ class IDFOTABackend final {
 #endif
 
  private:
-#ifdef USE_OTA_BLOCK_ERASE_AHEAD
-  OTAResponseTypes erase_ahead_(size_t len);
-#endif
 #ifdef USE_OTA_SIGNED_VERIFICATION_MULTI_KEY
   // Accept an image signed by any key the running app trusts (up to 3 blocks),
   // so rotation and backup keys work. Fails closed. Covers app and bootloader.
@@ -75,11 +62,7 @@ class IDFOTABackend final {
   // Keep md5_ first since its digest_ is alignas(32) on DMA-SHA variants; md5_set_ stays last so buf_ packs tightly.
   md5::MD5Digest md5_{};
   esp_ota_handle_t update_handle_{0};
-  const esp_partition_t *partition_{nullptr};
-  size_t written_{0};  // Bytes handed to esp_ota_write()
-#ifdef USE_OTA_BLOCK_ERASE_AHEAD
-  size_t erased_end_{0};  // Erased up to this partition offset; must stay >= written_
-#endif
+  const esp_partition_t *partition_;
   char expected_bin_md5_[32];
   bool md5_set_{false};
 #ifdef USE_OTA_PARTITIONS

esphome/components/ota/ota_bootloader_esp_idf.cpp

@@ -1,7 +1,6 @@
 #ifdef USE_ESP32
 #include "ota_backend_esp_idf.h"
 
-#include "esphome/components/watchdog/watchdog.h"
 #include "esphome/core/defines.h"
 
 #ifdef USE_OTA_PARTITIONS
@@ -70,20 +69,12 @@ OTAResponseTypes IDFOTABackend::setup_bootloader_staging_() {
     return OTA_RESPONSE_ERROR_BOOTLOADER_VERIFY;
   }
   // Erase full size of the bootloader partition in the staging partition
-  // to avoid copying old data to the bootloader partition later. Up to
-  // ESP_BOOTLOADER_SIZE of blocking erase; widen the WDT for its duration.
-  watchdog::WatchdogManager watchdog(15000);
+  // to avoid copying old data to the bootloader partition later
   esp_err_t err = esp_partition_erase_range(this->partition_, 0, this->bootloader_part_->size);
   if (err != ESP_OK) {
     ESP_LOGW(TAG, "esp_partition_erase_range failed (err=0x%X)", err);
     // No critical error, don't return
   }
-#ifdef USE_OTA_BLOCK_ERASE_AHEAD
-  if (err == ESP_OK) {
-    // Skip re-erasing the pre-erased staging region in erase_ahead_()
-    this->erased_end_ = this->bootloader_part_->size;
-  }
-#endif
   err = esp_ota_set_final_partition(this->update_handle_, this->bootloader_part_, false);
   if (err != ESP_OK) {
     esp_ota_abort(this->update_handle_);

esphome/components/ota/ota_signature_esp_idf.cpp

@@ -211,7 +211,7 @@ bool rsa_pss_verify(uint8_t *block, const uint8_t *digest) {
 bool IDFOTABackend::verify_signed_image_(const esp_partition_t *incoming) {
   // Verification re-hashes the full image (after esp_ota_end already did one
   // pass), which can approach the task WDT budget on a large app. Extend it for
-  // the duration, scaled to the image size over a 15 s floor.
+  // the duration, mirroring the erase budget in begin().
   const uint32_t verify_budget_ms = 15000 + (incoming->size >> 10) * 10;
   watchdog::WatchdogManager watchdog(verify_budget_ms);
 

esphome/components/rp2/__init__.py

@@ -312,6 +312,7 @@ CONFIG_SCHEMA = cv.All(
     ),
     cv.has_at_least_one_key(CONF_BOARD, CONF_VARIANT),
     _detect_variant,
+    cv.require_platformio_toolchain("RP2"),
     set_core_data,
 )
 

esphome/components/sensor/__init__.py

@@ -5,7 +5,6 @@ from esphome import automation
 import esphome.codegen as cg
 from esphome.components import mqtt, web_server, zigbee
 from esphome.components.const import CONF_B_CONSTANT
-from esphome.config_helpers import filter_source_files_from_defines
 import esphome.config_validation as cv
 from esphome.const import (
     CONF_ABOVE,
@@ -1304,8 +1303,3 @@ def _lstsq(a, b):
 @coroutine_with_priority(CoroPriority.CORE)
 async def to_code(config):
     cg.add_global(sensor_ns.using)
-
-
-FILTER_SOURCE_FILES = filter_source_files_from_defines(
-    {"filter.cpp": "USE_SENSOR_FILTER"}
-)

esphome/components/text_sensor/__init__.py

@@ -1,7 +1,6 @@
 from esphome import automation
 import esphome.codegen as cg
 from esphome.components import mqtt, web_server
-from esphome.config_helpers import filter_source_files_from_defines
 import esphome.config_validation as cv
 from esphome.const import (
     CONF_DEVICE_CLASS,
@@ -257,8 +256,3 @@ async def text_sensor_state_to_code(config, condition_id, template_arg, args):
     templ = await cg.templatable(config[CONF_STATE], args, cg.std_string)
     cg.add(var.set_state(templ))
     return var
-
-
-FILTER_SOURCE_FILES = filter_source_files_from_defines(
-    {"filter.cpp": "USE_TEXT_SENSOR_FILTER"}
-)

esphome/components/uptime/sensor/__init__.py

@@ -1,6 +1,5 @@
 import esphome.codegen as cg
 from esphome.components import sensor, time
-from esphome.config_helpers import filter_source_files_from_defines
 import esphome.config_validation as cv
 from esphome.const import (
     CONF_TIME_ID,
@@ -11,6 +10,7 @@ from esphome.const import (
     STATE_CLASS_TOTAL_INCREASING,
     UNIT_SECOND,
 )
+from esphome.core import CORE
 
 uptime_ns = cg.esphome_ns.namespace("uptime")
 UptimeSecondsSensor = uptime_ns.class_(
@@ -62,6 +62,9 @@ async def to_code(config):
         cg.add(var.set_time(time_id))
 
 
-FILTER_SOURCE_FILES = filter_source_files_from_defines(
-    {"uptime_timestamp_sensor.cpp": "USE_TIME"}
-)
+def FILTER_SOURCE_FILES() -> list[str]:
+    # uptime_timestamp_sensor.cpp is fully #ifdef'd on USE_TIME; skip it
+    # when no time component is configured.
+    if not any(define.name == "USE_TIME" for define in CORE.defines):
+        return ["uptime_timestamp_sensor.cpp"]
+    return []

esphome/components/web_server_idf/web_server_idf.h

@@ -117,6 +117,12 @@ class AsyncWebServerRequest {
   /// Write URL (without query string) to buffer, returns StringRef pointing to buffer.
   /// URL is decoded (e.g., %20 -> space).
   StringRef url_to(std::span<char, URL_BUF_SIZE> buffer) const;
+  // Remove before 2026.9.0
+  ESPDEPRECATED("Use url_to() instead. Removed in 2026.9.0", "2026.3.0")
+  std::string url() const {
+    char buffer[URL_BUF_SIZE];
+    return std::string(this->url_to(buffer));
+  }
   // NOLINTNEXTLINE(readability-identifier-naming)
   size_t contentLength() const { return this->req_->content_len; }
 

esphome/components/wifi/wifi_component.cpp

@@ -618,6 +618,8 @@ static const char *eap_phase2_to_str(esp_eap_ttls_phase2_types type) {
 }
 #endif
 
+float WiFiComponent::get_setup_priority() const { return setup_priority::WIFI; }
+
 void WiFiComponent::setup() {
   this->wifi_pre_setup_();
 
@@ -929,6 +931,10 @@ void WiFiComponent::loop() {
 
 WiFiComponent::WiFiComponent() { global_wifi_component = this; }
 
+#ifdef USE_WIFI_11KV_SUPPORT
+void WiFiComponent::set_btm(bool btm) { this->btm_ = btm; }
+void WiFiComponent::set_rrm(bool rrm) { this->rrm_ = rrm; }
+#endif
 network::IPAddresses WiFiComponent::get_ip_addresses() {
   if (this->has_sta())
     return this->wifi_sta_ip_addresses();
@@ -1321,6 +1327,8 @@ void WiFiComponent::disable() {
   this->wifi_mode_(false, false);
 }
 
+bool WiFiComponent::is_disabled() { return this->state_ == WIFI_COMPONENT_STATE_DISABLED; }
+
 void WiFiComponent::start_scanning() {
   this->action_started_ = millis();
   ESP_LOGD(TAG, "Starting scan");
@@ -2188,6 +2196,7 @@ void WiFiComponent::retry_connect() {
   }
 }
 
+void WiFiComponent::set_reboot_timeout(uint32_t reboot_timeout) { this->reboot_timeout_ = reboot_timeout; }
 void WiFiComponent::set_power_save_mode(WiFiPowerSaveMode power_save) {
   this->power_save_ = power_save;
 #if defined(USE_ESP32) && defined(USE_WIFI_RUNTIME_POWER_SAVE)
@@ -2195,6 +2204,8 @@ void WiFiComponent::set_power_save_mode(WiFiPowerSaveMode power_save) {
 #endif
 }
 
+void WiFiComponent::set_passive_scan(bool passive) { this->passive_scan_ = passive; }
+
 bool WiFiComponent::is_captive_portal_active_() {
 #ifdef USE_CAPTIVE_PORTAL
   return captive_portal::global_captive_portal != nullptr && captive_portal::global_captive_portal->is_active();
@@ -2313,6 +2324,33 @@ void WiFiComponent::save_fast_connect_settings_(const bssid_t &bssid, uint8_t ch
 }
 #endif
 
+void WiFiAP::set_ssid(const std::string &ssid) { this->ssid_ = CompactString(ssid.c_str(), ssid.size()); }
+void WiFiAP::set_ssid(const char *ssid) { this->ssid_ = CompactString(ssid, strlen(ssid)); }
+void WiFiAP::set_bssid(const bssid_t &bssid) { this->bssid_ = bssid; }
+void WiFiAP::clear_bssid() { this->bssid_ = {}; }
+void WiFiAP::set_password(const std::string &password) {
+  this->password_ = CompactString(password.c_str(), password.size());
+}
+void WiFiAP::set_password(const char *password) { this->password_ = CompactString(password, strlen(password)); }
+#ifdef USE_WIFI_WPA2_EAP
+void WiFiAP::set_eap(optional<EAPAuth> eap_auth) { this->eap_ = std::move(eap_auth); }
+#endif
+void WiFiAP::set_channel(uint8_t channel) { this->channel_ = channel; }
+void WiFiAP::clear_channel() { this->channel_ = 0; }
+#ifdef USE_WIFI_MANUAL_IP
+void WiFiAP::set_manual_ip(optional<ManualIP> manual_ip) { this->manual_ip_ = manual_ip; }
+#endif
+void WiFiAP::set_hidden(bool hidden) { this->hidden_ = hidden; }
+const bssid_t &WiFiAP::get_bssid() const { return this->bssid_; }
+bool WiFiAP::has_bssid() const { return this->bssid_ != bssid_t{}; }
+#ifdef USE_WIFI_WPA2_EAP
+const optional<EAPAuth> &WiFiAP::get_eap() const { return this->eap_; }
+#endif
+#ifdef USE_WIFI_MANUAL_IP
+const optional<ManualIP> &WiFiAP::get_manual_ip() const { return this->manual_ip_; }
+#endif
+bool WiFiAP::get_hidden() const { return this->hidden_; }
+
 WiFiScanResult::WiFiScanResult(const bssid_t &bssid, const char *ssid, size_t ssid_len, uint8_t channel, int8_t rssi,
                                bool with_auth, bool is_hidden)
     : bssid_(bssid),

esphome/components/wifi/wifi_component.h

@@ -21,7 +21,6 @@
 #include <span>
 #include <string>
 #include <type_traits>
-#include <utility>
 #include <vector>
 
 #ifdef USE_LIBRETINY
@@ -262,38 +261,38 @@ class WiFiAP {
   friend class WiFiScanResult;
 
  public:
-  void set_ssid(const std::string &ssid) { this->ssid_ = CompactString(ssid.c_str(), ssid.size()); }
-  void set_ssid(const char *ssid) { this->set_ssid(StringRef(ssid)); }
+  void set_ssid(const std::string &ssid);
+  void set_ssid(const char *ssid);
   void set_ssid(StringRef ssid) { this->ssid_ = CompactString(ssid.c_str(), ssid.size()); }
-  void set_bssid(const bssid_t &bssid) { this->bssid_ = bssid; }
-  void clear_bssid() { this->bssid_ = {}; }
-  void set_password(const std::string &password) { this->password_ = CompactString(password.c_str(), password.size()); }
-  void set_password(const char *password) { this->set_password(StringRef(password)); }
+  void set_bssid(const bssid_t &bssid);
+  void clear_bssid();
+  void set_password(const std::string &password);
+  void set_password(const char *password);
   void set_password(StringRef password) { this->password_ = CompactString(password.c_str(), password.size()); }
 #ifdef USE_WIFI_WPA2_EAP
-  void set_eap(optional<EAPAuth> eap_auth) { this->eap_ = std::move(eap_auth); }
+  void set_eap(optional<EAPAuth> eap_auth);
 #endif  // USE_WIFI_WPA2_EAP
-  void set_channel(uint8_t channel) { this->channel_ = channel; }
-  void clear_channel() { this->channel_ = 0; }
+  void set_channel(uint8_t channel);
+  void clear_channel();
   void set_priority(int8_t priority) { priority_ = priority; }
 #ifdef USE_WIFI_MANUAL_IP
-  void set_manual_ip(optional<ManualIP> manual_ip) { this->manual_ip_ = manual_ip; }
+  void set_manual_ip(optional<ManualIP> manual_ip);
 #endif
-  void set_hidden(bool hidden) { this->hidden_ = hidden; }
+  void set_hidden(bool hidden);
   StringRef get_ssid() const { return this->ssid_.ref(); }
   StringRef get_password() const { return this->password_.ref(); }
-  const bssid_t &get_bssid() const { return this->bssid_; }
-  bool has_bssid() const { return this->bssid_ != bssid_t{}; }
+  const bssid_t &get_bssid() const;
+  bool has_bssid() const;
 #ifdef USE_WIFI_WPA2_EAP
-  const optional<EAPAuth> &get_eap() const { return this->eap_; }
+  const optional<EAPAuth> &get_eap() const;
 #endif  // USE_WIFI_WPA2_EAP
   uint8_t get_channel() const { return this->channel_; }
   bool has_channel() const { return this->channel_ != 0; }
   int8_t get_priority() const { return priority_; }
 #ifdef USE_WIFI_MANUAL_IP
-  const optional<ManualIP> &get_manual_ip() const { return this->manual_ip_; }
+  const optional<ManualIP> &get_manual_ip() const;
 #endif
-  bool get_hidden() const { return this->hidden_; }
+  bool get_hidden() const;
 
  protected:
   CompactString ssid_;
@@ -443,7 +442,6 @@ class WiFiComponent final : public Component {
   void set_sta(const WiFiAP &ap);
   // Returns a copy of the currently selected AP configuration
   WiFiAP get_sta() const;
-  // init_sta/add_sta kept out of line: inlining them into the generated setup() grows flash
   void init_sta(size_t count);
   void add_sta(const WiFiAP &ap);
   void clear_sta();
@@ -463,7 +461,7 @@ class WiFiComponent final : public Component {
 
   void enable();
   void disable();
-  bool is_disabled() { return this->state_ == WIFI_COMPONENT_STATE_DISABLED; }
+  bool is_disabled();
   void start_scanning();
   void check_scanning_finished();
   void start_connecting(const WiFiAP &ap);
@@ -474,7 +472,7 @@ class WiFiComponent final : public Component {
 
   void retry_connect();
 
-  void set_reboot_timeout(uint32_t reboot_timeout) { this->reboot_timeout_ = reboot_timeout; }
+  void set_reboot_timeout(uint32_t reboot_timeout);
 
   bool is_connected() const { return this->connected_; }
 
@@ -494,7 +492,7 @@ class WiFiComponent final : public Component {
   void set_phy_mode(WiFi8266PhyMode phy_mode) { this->phy_mode_ = phy_mode; }
 #endif
 
-  void set_passive_scan(bool passive) { this->passive_scan_ = passive; }
+  void set_passive_scan(bool passive);
 
   void save_wifi_sta(const std::string &ssid, const std::string &password);
   void save_wifi_sta(const char *ssid, const char *password);
@@ -508,7 +506,7 @@ class WiFiComponent final : public Component {
   void dump_config() override;
   void restart_adapter();
   /// WIFI setup_priority.
-  float get_setup_priority() const override { return setup_priority::WIFI; }
+  float get_setup_priority() const override;
   /// Reconnect WiFi if required.
   void loop() override;
 
@@ -517,8 +515,8 @@ class WiFiComponent final : public Component {
   bool is_ap_active() const { return this->ap_started_; }
 
 #ifdef USE_WIFI_11KV_SUPPORT
-  void set_btm(bool btm) { this->btm_ = btm; }
-  void set_rrm(bool rrm) { this->rrm_ = rrm; }
+  void set_btm(bool btm);
+  void set_rrm(bool rrm);
 #endif
 
   network::IPAddress get_dns_address(int num);
@@ -552,6 +550,9 @@ class WiFiComponent final : public Component {
   void set_sta_priority(bssid_t bssid, int8_t priority);
 
   network::IPAddresses wifi_sta_ip_addresses();
+  // Remove before 2026.9.0
+  ESPDEPRECATED("Use wifi_ssid_to() instead. Removed in 2026.9.0", "2026.3.0")
+  std::string wifi_ssid();
   /// Write SSID to buffer without heap allocation.
   /// Returns pointer to buffer, or empty string if not connected.
   const char *wifi_ssid_to(std::span<char, SSID_BUFFER_SIZE> buffer);

esphome/components/wifi/wifi_component_esp8266.cpp

@@ -944,6 +944,16 @@ bssid_t WiFiComponent::wifi_bssid() {
   }
   return bssid;
 }
+std::string WiFiComponent::wifi_ssid() {
+  struct station_config conf {};
+  if (!wifi_station_get_config(&conf)) {
+    return "";
+  }
+  // conf.ssid is uint8[32], not null-terminated if full
+  auto *ssid_s = reinterpret_cast<const char *>(conf.ssid);
+  size_t len = strnlen(ssid_s, sizeof(conf.ssid));
+  return {ssid_s, len};
+}
 const char *WiFiComponent::wifi_ssid_to(std::span<char, SSID_BUFFER_SIZE> buffer) {
   struct station_config conf {};
   if (!wifi_station_get_config(&conf)) {

esphome/components/wifi/wifi_component_esp_idf.cpp

@@ -1237,6 +1237,18 @@ bssid_t WiFiComponent::wifi_bssid() {
   std::copy(info.bssid, info.bssid + 6, bssid.begin());
   return bssid;
 }
+std::string WiFiComponent::wifi_ssid() {
+  wifi_ap_record_t info{};
+  esp_err_t err = esp_wifi_sta_get_ap_info(&info);
+  if (err != ESP_OK) {
+    // Very verbose only: this is expected during dump_config() before connection is established (PR #9823)
+    ESP_LOGVV(TAG, "esp_wifi_sta_get_ap_info failed: %s", esp_err_to_name(err));
+    return "";
+  }
+  auto *ssid_s = reinterpret_cast<const char *>(info.ssid);
+  size_t len = strnlen(ssid_s, sizeof(info.ssid));
+  return {ssid_s, len};
+}
 const char *WiFiComponent::wifi_ssid_to(std::span<char, SSID_BUFFER_SIZE> buffer) {
   wifi_ap_record_t info{};
   esp_err_t err = esp_wifi_sta_get_ap_info(&info);

esphome/components/wifi/wifi_component_libretiny.cpp

@@ -762,6 +762,7 @@ bssid_t WiFiComponent::wifi_bssid() {
   }
   return bssid;
 }
+std::string WiFiComponent::wifi_ssid() { return WiFi.SSID().c_str(); }
 const char *WiFiComponent::wifi_ssid_to(std::span<char, SSID_BUFFER_SIZE> buffer) {
 #ifdef USE_BK72XX
   LinkStatusTypeDef link_status{};

esphome/components/wifi/wifi_component_pico_w.cpp

@@ -265,6 +265,7 @@ bssid_t WiFiComponent::wifi_bssid() {
     bssid[i] = raw_bssid[i];
   return bssid;
 }
+std::string WiFiComponent::wifi_ssid() { return WiFi.SSID().c_str(); }
 const char *WiFiComponent::wifi_ssid_to(std::span<char, SSID_BUFFER_SIZE> buffer) {
   // TODO: Find direct CYW43 API to avoid Arduino String allocation
   String ssid = WiFi.SSID();

esphome/config_helpers.py

@@ -151,31 +151,6 @@ def filter_source_files_from_platform(
     return filter_source_files
 
 
-def filter_source_files_from_defines(
-    files_map: dict[str, str | tuple[str, ...]],
-) -> Callable[[], list[str]]:
-    """Helper to build a FILTER_SOURCE_FILES function from a define mapping.
-
-    Args:
-        files_map: Dict mapping filename to the define name (or tuple of
-            define names) that keeps the file in the build; the file is
-            excluded when none of its defines is set for the current config.
-
-    Returns:
-        Function that returns the files to exclude for the current config.
-    """
-
-    def filter_source_files() -> list[str]:
-        defines = {define.name for define in CORE.defines}
-        return [
-            filename
-            for filename, needed in files_map.items()
-            if defines.isdisjoint((needed,) if isinstance(needed, str) else needed)
-        ]
-
-    return filter_source_files
-
-
 def get_logger_level() -> str:
     """Get the configured logger level.
 

esphome/config_validation.py

@@ -53,6 +53,7 @@ from esphome.const import (
     CONF_SETUP_PRIORITY,
     CONF_STATE_TOPIC,
     CONF_SUBSCRIBE_QOS,
+    CONF_TOOLCHAIN,
     CONF_TOPIC,
     CONF_TYPE,
     CONF_TYPE_ID,
@@ -75,6 +76,7 @@ from esphome.const import (
     TYPE_GIT,
     TYPE_LOCAL,
     Framework,
+    Toolchain,
     __version__ as ESPHOME_VERSION,
 )
 from esphome.core import (
@@ -91,7 +93,13 @@ from esphome.core import (
 )
 from esphome.enum import StrEnum
 from esphome.expression import SUBSTITUTION_VARIABLE_PROG as VARIABLE_PROG
-from esphome.helpers import add_class_to_obj, docs_url, list_starts_with
+from esphome.helpers import (
+    FALSY_BOOL_STRINGS,
+    TRUTHY_BOOL_STRINGS,
+    add_class_to_obj,
+    docs_url,
+    list_starts_with,
+)
 from esphome.schema_extractors import (
     SCHEMA_EXTRACT,
     schema_extractor,
@@ -106,6 +114,9 @@ from esphome.util import parse_esphome_version  # noqa: F401
 from esphome.voluptuous_schema import _Schema
 from esphome.yaml_util import SensitiveStr, make_data_base
 
+if typing.TYPE_CHECKING:
+    from esphome.types import ConfigType
+
 _LOGGER = logging.getLogger(__name__)
 
 # pylint: disable=invalid-name
@@ -576,9 +587,9 @@ def boolean(value):
         return value
     if isinstance(value, str):
         value = value.lower()
-        if value in ("true", "yes", "on", "enable"):
+        if value in TRUTHY_BOOL_STRINGS:
             return True
-        if value in ("false", "no", "off", "disable"):
+        if value in FALSY_BOOL_STRINGS:
             return False
     raise Invalid(
         f"Expected boolean value, but cannot convert {value} to a boolean. Please use 'true' or 'false'"
@@ -2532,6 +2543,63 @@ def platformio_version_constraint(value):
     return constraints
 
 
+def _check_supported_toolchain(
+    platform_name: str, supported: tuple[Toolchain, ...]
+) -> None:
+    """Raise when the resolved ``CORE.toolchain`` is not in ``supported``
+    (one message shape for every platform)."""
+    toolchain = CORE.toolchain
+    if toolchain is None:
+        # A caller ran the check before resolving; an ordering bug, not a
+        # user error
+        raise Invalid(f"Toolchain was not resolved before {platform_name} validation")
+    if toolchain not in supported:
+        names = ", ".join(f"'{tc.value}'" for tc in supported)
+        raise Invalid(
+            f"Unsupported toolchain "
+            f"'{toolchain.value}' for "
+            f"{platform_name}. Supported: {names}."
+        )
+
+
+def toolchain_enum(supported: tuple[Toolchain, ...]) -> Callable[[str], Toolchain]:
+    """Schema validator for a platform's ``toolchain`` config key."""
+
+    def validator(value: str) -> Toolchain:
+        return Toolchain(one_of(*supported, lower=True)(value))
+
+    return validator
+
+
+def resolve_toolchain(
+    platform_name: str, supported: tuple[Toolchain, ...], default: Toolchain
+) -> Callable[[ConfigType], ConfigType]:
+    """Resolve ``CORE.toolchain`` (CLI > YAML > default) and reject one the
+    platform cannot serve.
+
+    Add to the platform's validation chain before anything that reads
+    ``CORE.toolchain``.
+    """
+
+    def validator(config: ConfigType) -> ConfigType:
+        if CORE.toolchain is None:
+            CORE.toolchain = config.get(CONF_TOOLCHAIN, default)
+        _check_supported_toolchain(platform_name, supported)
+        return config
+
+    return validator
+
+
+def require_platformio_toolchain(
+    platform_name: str,
+) -> Callable[[ConfigType], ConfigType]:
+    """Reject a CLI-selected toolchain other than PlatformIO, for platforms
+    with only the PlatformIO backend."""
+    return resolve_toolchain(
+        platform_name, (Toolchain.PLATFORMIO,), Toolchain.PLATFORMIO
+    )
+
+
 def require_framework_version(
     *,
     max_version=False,

esphome/const.py

@@ -21,6 +21,14 @@ class Toolchain(StrEnum):
     PLATFORMIO = "platformio"
     ESP_IDF = "esp-idf"
     SDK_NRF = "sdk-nrf"
+    # ESP8266: the Arduino core built directly (no PlatformIO)
+    ARDUINO = "arduino"
+
+
+# Toolchains that drive their build natively and never read platformio.ini.
+# SDK_NRF is absent on purpose: the zephyr backend keeps consuming
+# platformio_options.
+NATIVE_TOOLCHAINS = frozenset({Toolchain.ESP_IDF, Toolchain.ARDUINO})
 
 
 class Platform(StrEnum):

esphome/core/__init__.py

@@ -21,6 +21,7 @@ from esphome.const import (
     KEY_CORE,
     KEY_TARGET_FRAMEWORK,
     KEY_TARGET_PLATFORM,
+    NATIVE_TOOLCHAINS,
     PLATFORM_BK72XX,
     PLATFORM_ESP32,
     PLATFORM_ESP8266,
@@ -982,6 +983,19 @@ class EsphomeCore:
     def using_toolchain_sdk_nrf(self):
         return self.toolchain == Toolchain.SDK_NRF
 
+    @property
+    def using_toolchain_arduino(self):
+        """The native ESP8266 Arduino build toolchain (unlike
+        ``using_arduino``, which is the target framework)."""
+        return self.toolchain == Toolchain.ARDUINO
+
+    @property
+    def using_native_toolchain(self):
+        """Whether the selected toolchain builds natively, without reading
+        ``platformio.ini`` (see ``NATIVE_TOOLCHAINS`` in ``esphome.const``;
+        keep its membership in sync with ``write_cpp_file``'s dispatch)."""
+        return self.toolchain in NATIVE_TOOLCHAINS
+
     @property
     def using_zephyr(self):
         return self.target_framework == "zephyr"
@@ -1095,6 +1109,8 @@ class EsphomeCore:
         return build_flag
 
     def add_build_unflag(self, build_unflag: str) -> None:
+        # No warning for using_toolchain_arduino: the native ESP8266 build
+        # honors build_unflags (token-level, matching PlatformIO).
         if self.using_toolchain_esp_idf:
             # The native ESP-IDF build generator does not consume build_unflags
             _LOGGER.warning(

esphome/core/config.py

@@ -555,12 +555,24 @@ def _add_library_str(lib: str) -> None:
         cg.add_library(lib, None)
 
 
+# platformio_options keys the native ESP8266 Arduino generator (a later PR
+# in this chain) will honor; its ignored-option warning will consume the same
+# list so the two cannot drift
+NATIVE_ARDUINO_PIO_OPTIONS = frozenset({"board_build.f_cpu", "board_build.ldscript"})
+# The full set that survives into CORE.platformio_options under the native
+# arduino toolchain: lib_ignore is the only specially-translated key below
+# that is stored rather than translated away. Consumed by the esp8266 native
+# backend (later in this chain) for its ignored-option warning; defined here
+# so it stays adjacent to the routing.
+NATIVE_ARDUINO_CONSUMED_PIO_OPTIONS = NATIVE_ARDUINO_PIO_OPTIONS | {"lib_ignore"}
+
+
 @coroutine_with_priority(CoroPriority.FINAL)
 async def _add_platformio_options(pio_options: dict[str, str | list[str]]) -> None:
-    if CORE.using_toolchain_esp_idf:
-        # The native ESP-IDF build doesn't read platformio.ini; honor the
-        # options with a native equivalent and warn about the rest, which
-        # would otherwise be silently ignored.
+    if CORE.using_native_toolchain:
+        # The native builds don't read platformio.ini; honor the options
+        # with a native equivalent and warn about the rest, which would
+        # otherwise be silently ignored.
         for key, val in pio_options.items():
             vals = [val] if isinstance(val, str) else val
             if key == CONF_BUILD_FLAGS:
@@ -573,23 +585,41 @@ async def _add_platformio_options(pio_options: dict[str, str | list[str]]) -> No
                 )
                 for flag in vals:
                     cg.add_build_flag(flag)
+            elif key == "build_unflags":
+                # Native equivalent: add_build_unflag (honored token-level by
+                # the arduino generator; the IDF generator warns there)
+                for flag in vals:
+                    CORE.add_build_unflag(flag)
             elif key == "lib_deps":
-                # Routed through the regular library mechanism so the libraries
-                # are converted to IDF components like any other PIO library
+                # Routed through the regular library mechanism so the
+                # libraries reach the native backend's converter (IDF
+                # components, or the ESP8266 native library resolution)
                 for lib in vals:
                     _add_library_str(lib)
             elif key == "lib_ignore":
-                # Read by the PIO-library-to-IDF-component conversion
-                # (generate_idf_components); filters both top-level libraries
-                # and dependencies discovered during conversion
+                # Read by the shared library conversion (lib_ignore_set in
+                # platformio/library.py); filters top-level libraries and
+                # discovered dependencies
                 cg.add_platformio_option(key, vals)
+            elif (
+                key in NATIVE_ARDUINO_PIO_OPTIONS
+                and CORE.using_toolchain_arduino
+                and vals
+            ):
+                # The esp8266 native generator reads these as scalars; the
+                # schema also permits the list form, where the last value
+                # wins like a later platformio.ini line (an empty list falls
+                # through to the ignored-option warning). Other native
+                # toolchains have no equivalent and fall through too.
+                cg.add_platformio_option(key, vals[-1])
             elif key != "upload_speed":
                 # upload_speed needs no handling: it is read from the raw
                 # config at upload time (upload_using_esptool)
                 _LOGGER.warning(
                     "esphome->platformio_options->%s is ignored when building with "
-                    "the native ESP-IDF toolchain",
+                    "the native '%s' toolchain",
                     key,
+                    CORE.toolchain.value,
                 )
         return
     # Add includes at the very end, so that they override everything

esphome/core/defines.h

@@ -43,9 +43,7 @@
 #define USE_ALARM_CONTROL_PANEL
 #define USE_AREAS
 #define USE_BINARY_SENSOR
-#define USE_BINARY_SENSOR_CLICK_TRIGGER
 #define USE_BINARY_SENSOR_FILTER
-#define USE_BINARY_SENSOR_MULTI_CLICK_TRIGGER
 #define USE_BLE_DEVICE_IRK
 #define USE_BUTTON
 #define USE_CAMERA
@@ -222,7 +220,6 @@
 #define API_MAX_SEND_QUEUE 8
 #define MAX_API_CONNECTIONS 6
 #define USE_MD5
-#define USE_NOISE
 #define USE_SHA256
 #ifndef USE_RP2  // no MQTT backend or esp_wireguard library on RP2
 #define USE_MQTT
@@ -235,7 +232,6 @@
 #define USE_RUNTIME_IMAGE_JPEG
 #define USE_RUNTIME_STATS
 #define USE_OTA
-#define USE_OTA_ENCRYPTION
 #define USE_OTA_PASSWORD
 #define USE_OTA_VERSION 2
 #define USE_TIME_TIMEZONE
@@ -285,7 +281,6 @@
 // ESP32-specific feature flags
 #ifdef USE_ESP32
 #define USE_ESP32_CRASH_HANDLER
-#define USE_ESP32_INTERNAL_GPIO
 #define USE_MQTT_IDF_ENQUEUE
 #define USE_ESPHOME_TASK_LOG_BUFFER
 #define ESPHOME_TASK_LOG_BUFFER_SIZE 768

esphome/core/entity_base.cpp

@@ -80,6 +80,24 @@ const char *EntityBase::get_device_class_to([[maybe_unused]] std::span<char, MAX
 #endif
 }
 
+#ifndef USE_ESP8266
+// Deprecated device class accessors — not available on ESP8266 (rodata is RAM)
+StringRef EntityBase::get_device_class_ref() const {
+#ifdef USE_ENTITY_DEVICE_CLASS
+  return StringRef(entity_device_class_lookup(this->device_class_idx_));
+#else
+  return StringRef(entity_device_class_lookup(0));
+#endif
+}
+std::string EntityBase::get_device_class() const {
+#ifdef USE_ENTITY_DEVICE_CLASS
+  return std::string(entity_device_class_lookup(this->device_class_idx_));
+#else
+  return std::string(entity_device_class_lookup(0));
+#endif
+}
+#endif  // !USE_ESP8266
+
 // Entity unit of measurement (from index)
 StringRef EntityBase::get_unit_of_measurement_ref() const {
 #ifdef USE_ENTITY_UNIT_OF_MEASUREMENT
@@ -88,6 +106,10 @@ StringRef EntityBase::get_unit_of_measurement_ref() const {
   return StringRef(entity_uom_lookup(0));
 #endif
 }
+std::string EntityBase::get_unit_of_measurement() const {
+  return std::string(this->get_unit_of_measurement_ref().c_str());
+}
+
 // Entity icon — buffer-based API for PROGMEM safety on ESP8266
 const char *EntityBase::get_icon_to([[maybe_unused]] std::span<char, MAX_ICON_LENGTH> buffer) const {
 #ifdef USE_ENTITY_ICON
@@ -107,6 +129,24 @@ const char *EntityBase::get_icon_to([[maybe_unused]] std::span<char, MAX_ICON_LE
 #endif
 }
 
+#ifndef USE_ESP8266
+// Deprecated icon accessors — not available on ESP8266 (rodata is RAM)
+StringRef EntityBase::get_icon_ref() const {
+#ifdef USE_ENTITY_ICON
+  return StringRef(entity_icon_lookup(this->icon_idx_));
+#else
+  return StringRef(entity_icon_lookup(0));
+#endif
+}
+std::string EntityBase::get_icon() const {
+#ifdef USE_ENTITY_ICON
+  return std::string(entity_icon_lookup(this->icon_idx_));
+#else
+  return std::string(entity_icon_lookup(0));
+#endif
+}
+#endif  // !USE_ESP8266
+
 // Calculate Object ID Hash directly from name using snake_case + sanitize
 void EntityBase::calc_object_id_() {
   this->object_id_hash_ = fnv1_hash_object_id(this->name_.c_str(), this->name_.size());

esphome/core/entity_base.h

@@ -109,14 +109,60 @@ class EntityBase {
   // On ESP8266: copies from PROGMEM to buffer, returns buffer pointer.
   const char *get_device_class_to(std::span<char, MAX_DEVICE_CLASS_LENGTH> buffer) const;
 
+#ifdef USE_ESP8266
+  // On ESP8266, rodata is RAM. Device classes are in PROGMEM and cannot be accessed
+  // directly as const char*. Use get_device_class_to() with a stack buffer instead.
+  template<typename T = int> StringRef get_device_class_ref() const {
+    static_assert(sizeof(T) == 0, "get_device_class_ref() unavailable on ESP8266 (rodata is RAM). "
+                                  "Use get_device_class_to() with a stack buffer.");
+    return StringRef("");
+  }
+  template<typename T = int> std::string get_device_class() const {
+    static_assert(sizeof(T) == 0, "get_device_class() unavailable on ESP8266 (rodata is RAM). "
+                                  "Use get_device_class_to() with a stack buffer.");
+    return "";
+  }
+#else
+  // Deprecated: use get_device_class_to() instead. Device classes are in PROGMEM.
+  ESPDEPRECATED("Use get_device_class_to() instead. Will be removed in ESPHome 2026.9.0", "2026.3.0")
+  StringRef get_device_class_ref() const;
+  ESPDEPRECATED("Use get_device_class_to() instead. Will be removed in ESPHome 2026.9.0", "2026.3.0")
+  std::string get_device_class() const;
+#endif
   // Get unit of measurement as StringRef (from packed index)
   StringRef get_unit_of_measurement_ref() const;
+  /// Get the unit of measurement as std::string (deprecated, prefer get_unit_of_measurement_ref())
+  ESPDEPRECATED("Use get_unit_of_measurement_ref() instead for better performance (avoids string copy). Will be "
+                "removed in ESPHome 2026.9.0",
+                "2026.3.0")
+  std::string get_unit_of_measurement() const;
 
   // Get this entity's icon into a stack buffer.
   // On ESP32: returns pointer to PROGMEM string directly (buffer unused).
   // On ESP8266: copies from PROGMEM to buffer, returns buffer pointer.
   const char *get_icon_to(std::span<char, MAX_ICON_LENGTH> buffer) const;
 
+#ifdef USE_ESP8266
+  // On ESP8266, rodata is RAM. Icons are in PROGMEM and cannot be accessed
+  // directly as const char*. Use get_icon_to() with a stack buffer instead.
+  template<typename T = int> StringRef get_icon_ref() const {
+    static_assert(sizeof(T) == 0,
+                  "get_icon_ref() unavailable on ESP8266 (rodata is RAM). Use get_icon_to() with a stack buffer.");
+    return StringRef("");
+  }
+  template<typename T = int> std::string get_icon() const {
+    static_assert(sizeof(T) == 0,
+                  "get_icon() unavailable on ESP8266 (rodata is RAM). Use get_icon_to() with a stack buffer.");
+    return "";
+  }
+#else
+  // Deprecated: use get_icon_to() instead. Icons are in PROGMEM.
+  ESPDEPRECATED("Use get_icon_to() instead. Will be removed in ESPHome 2026.9.0", "2026.3.0")
+  StringRef get_icon_ref() const;
+  ESPDEPRECATED("Use get_icon_to() instead. Will be removed in ESPHome 2026.9.0", "2026.3.0")
+  std::string get_icon() const;
+#endif
+
 #ifdef USE_DEVICES
   // Get this entity's device id
   uint32_t get_device_id() const {

esphome/core/helpers.cpp

@@ -723,6 +723,23 @@ bool base64_decode_int32_vector(const std::string &base64, std::vector<int32_t>
 
 // Colors
 
+float gamma_correct(float value, float gamma) {
+  if (value <= 0.0f)
+    return 0.0f;
+  if (gamma <= 0.0f)
+    return value;
+
+  return powf(value, gamma);  // NOLINT - deprecated, removal 2026.9.0
+}
+float gamma_uncorrect(float value, float gamma) {
+  if (value <= 0.0f)
+    return 0.0f;
+  if (gamma <= 0.0f)
+    return value;
+
+  return powf(value, 1 / gamma);  // NOLINT - deprecated, removal 2026.9.0
+}
+
 void rgb_to_hsv(float red, float green, float blue, int &hue, float &saturation, float &value) {
   float max_color_value = std::max({red, green, blue});
   float min_color_value = std::min({red, green, blue});

esphome/core/helpers.h

@@ -1646,6 +1646,15 @@ bool base64_decode_int32_vector(const std::string &base64, std::vector<int32_t>
 /// @name Colors
 ///@{
 
+/// Applies gamma correction of \p gamma to \p value.
+// Remove before 2026.9.0
+ESPDEPRECATED("Use LightState::gamma_correct_lut() instead. Removed in 2026.9.0.", "2026.3.0")
+float gamma_correct(float value, float gamma);
+/// Reverts gamma correction of \p gamma to \p value.
+// Remove before 2026.9.0
+ESPDEPRECATED("Use LightState::gamma_uncorrect_lut() instead. Removed in 2026.9.0.", "2026.3.0")
+float gamma_uncorrect(float value, float gamma);
+
 /// Convert \p red, \p green and \p blue (all 0-1) values to \p hue (0-360), \p saturation (0-1) and \p value (0-1).
 void rgb_to_hsv(float red, float green, float blue, int &hue, float &saturation, float &value);
 /// Convert \p hue (0-360), \p saturation (0-1) and \p value (0-1) to \p red, \p green and \p blue (all 0-1).

esphome/core/log.cpp

@@ -60,6 +60,16 @@ void HOT esp_log_vprintf_(int level, const char *tag, int line, const char *form
 #endif
 }
 
+#ifdef USE_STORE_LOG_STR_IN_FLASH
+// Remove before 2026.9.0
+void HOT esp_log_vprintf_(int level, const char *tag, int line, const __FlashStringHelper *format, va_list args) {
+#ifdef USE_LOGGER
+  ESPHOME_DEBUG_ASSERT(logger::global_logger != nullptr);
+  logger::global_logger->log_vprintf_(static_cast<uint8_t>(level), tag, line, format, args);
+#endif
+}
+#endif
+
 #ifdef USE_ESP32
 int HOT esp_idf_log_vprintf_(const char *format, va_list args) {  // NOLINT
 #ifdef USE_LOGGER

esphome/core/log.h

@@ -68,6 +68,11 @@ void esp_log_printf_(int level, const char *tag, int line, const char *format, .
 void esp_log_printf_(int level, const char *tag, int line, const __FlashStringHelper *format, ...);
 #endif
 void esp_log_vprintf_(int level, const char *tag, int line, const char *format, va_list args);  // NOLINT
+#ifdef USE_STORE_LOG_STR_IN_FLASH
+// Remove before 2026.9.0
+__attribute__((deprecated("Use esp_log_printf_() instead. Removed in 2026.9.0."))) void esp_log_vprintf_(
+    int level, const char *tag, int line, const __FlashStringHelper *format, va_list args);
+#endif
 #if defined(USE_ESP32)
 int esp_idf_log_vprintf_(const char *format, va_list args);  // NOLINT
 #endif

esphome/espidf/clang_tidy.py

@@ -23,6 +23,12 @@ from dataclasses import dataclass
 import os
 from pathlib import Path
 
+from esphome.build_helpers.idedata import (
+    get_toolchain_includes,
+    parse_entry,
+    reject_launcher_compiler,
+)
+
 TIDY_PROJECT_NAME = "esphome_tidy"
 
 # A do-nothing C++ app: just enough for IDF to configure a valid project. It's
@@ -415,13 +421,12 @@ def _idedata_from_tidy_project(compile_commands: Path) -> dict:
     """
     import json
 
-    from esphome.espidf.idedata import _get_toolchain_includes, _parse_entry
-
     entries = json.loads(Path(compile_commands).read_text(encoding="utf-8"))
     entry = next((e for e in entries if e["file"].endswith("tidy.cpp")), None)
     if entry is None:
         raise RuntimeError(f"tidy.cpp not found in {compile_commands}")
-    cxx_path, defines, includes, cxx_flags = _parse_entry(entry)
+    cxx_path, defines, includes, cxx_flags = parse_entry(entry)
+    reject_launcher_compiler(cxx_path)
 
     return {
         "cxx_path": cxx_path,
@@ -429,7 +434,7 @@ def _idedata_from_tidy_project(compile_commands: Path) -> dict:
         "defines": defines,
         "includes": {
             "build": includes,
-            "toolchain": _get_toolchain_includes(cxx_path),
+            "toolchain": get_toolchain_includes(cxx_path),
         },
     }
 

esphome/espidf/component.py

@@ -27,6 +27,7 @@ from esphome.platformio.library import (
     collect_filtered_files,
     convert_libraries,
     ensure_list,
+    lex_build_flags,
     split_list_by_condition,
 )
 
@@ -40,37 +41,6 @@ def _idf_framework() -> str:
     return "arduino" if CORE.using_arduino else "espidf"
 
 
-def _apply_extra_script(component: IDFComponent) -> None:
-    """Run a PIO ``extraScript`` and fold its captured env vars into
-    ``component.data["build"]["flags"]`` so the existing -L/-l/-D
-    extraction in ``generate_cmakelists_txt`` picks them up."""
-    extra_script = component.data.get("build", {}).get("extraScript")
-    if not extra_script:
-        return
-    # Resolve and confine to the library's source dir so a malicious
-    # library.json can't escape (e.g. ``"extraScript": "../../etc/passwd"``).
-    source_path = component.source_dir
-    library_root = source_path.resolve()
-    script_path = (source_path / extra_script).resolve()
-    if not script_path.is_relative_to(library_root) or not script_path.is_file():
-        return
-    from esphome.components.esp32 import get_esp32_variant
-    from esphome.espidf.extra_script import captured_as_build_flags, run_extra_script
-
-    idf_target = variant_to_idf_target(get_esp32_variant())
-    result = run_extra_script(
-        script_path, library_dir=source_path, idf_target=idf_target
-    )
-    extra_flags = captured_as_build_flags(result, library_dir=source_path)
-    if not extra_flags:
-        return
-    flags = component.data.setdefault("build", {}).setdefault("flags", [])
-    if isinstance(flags, str):
-        flags = [flags]
-    flags.extend(extra_flags)
-    component.data["build"]["flags"] = flags
-
-
 def generate_cmakelists_txt(component: IDFComponent) -> str:
     """
     Generate a CMakeLists.txt file for an ESP-IDF component.
@@ -85,10 +55,6 @@ def generate_cmakelists_txt(component: IDFComponent) -> str:
     Returns:
         str: The complete CMakeLists.txt content as a string
     """
-    # Late import: this module loads with the esp32 platform on every
-    # validate/compile, but shlex is only needed when generating component
-    # CMakeLists.
-    import shlex
 
     def escape_entry(p: PathType) -> str:
         # In CMakeLists.txt, backslashes need to be escaped
@@ -122,26 +88,12 @@ def generate_cmakelists_txt(component: IDFComponent) -> str:
     build_src_filter = ensure_list(
         component.data.get("build", {}).get("srcFilter", DEFAULT_BUILD_SRC_FILTER)
     )
-    build_flags = ensure_list(
-        component.data.get("build", {}).get("flags", DEFAULT_BUILD_FLAGS)
+    # PlatformIO shell-lexes each build.flags entry; bare -I/-L/-l/-D tokens
+    # re-glue to their argument so the prefix classifiers below route them.
+    build_flags = lex_build_flags(
+        component.data.get("build", {}).get("flags", DEFAULT_BUILD_FLAGS),
+        f"library {component.name}",
     )
-    # PlatformIO shell-lexes each build.flags entry, so one entry can carry a
-    # flag and its argument (e.g. "-include cp_custom_alloc.h"). Split the
-    # same way; emitting such an entry as a single quoted compile option
-    # hands the compiler one argv with an embedded space.
-    build_flags = [token for entry in build_flags for token in shlex.split(entry)]
-    # Re-glue bare -I/-L/-l tokens to their argument ("-I foo" -> "-Ifoo") so
-    # the prefix classifiers below still route them to INCLUDE_DIRS and the
-    # link handling.
-    tokens, build_flags = build_flags, []
-    i = 0
-    while i < len(tokens):
-        if tokens[i] in ("-I", "-L", "-l") and i + 1 < len(tokens):
-            build_flags.append(tokens[i] + tokens[i + 1])
-            i += 2
-        else:
-            build_flags.append(tokens[i])
-            i += 1
 
     # List all sources files
     build_src_files = collect_filtered_files(
@@ -299,7 +251,14 @@ def generate_idf_component_yml(component: IDFComponent) -> str:
 
 def _emit_idf_component(component: IDFComponent) -> None:
     """Write the ESP-IDF build files for a resolved library into its cache dir."""
-    _apply_extra_script(component)
+    from esphome.components.esp32 import get_esp32_variant
+    from esphome.platformio.extra_script import apply_extra_script
+
+    apply_extra_script(
+        component,
+        board_mcu=lambda: variant_to_idf_target(get_esp32_variant()),
+        pio_platform="espressif32",
+    )
     write_file_if_changed(
         component.path / "CMakeLists.txt",
         generate_cmakelists_txt(component),

esphome/espidf/extra_script.py

@@ -1,161 +0,0 @@
-"""Run a PlatformIO ``extraScript`` against a captured SCons-env stand-in.
-
-PlatformIO libraries occasionally configure per-target link/build state
-via a Python ``extraScript`` declared in ``library.json``'s ``build``
-section instead of static fields. The script runs under SCons during
-PIO's build and mutates the active ``Environment`` (``env.Append``,
-``env.Replace``, …) — chiefly to set ``LIBPATH``/``LIBS`` per chip MCU.
-
-ESPHome's PIO→IDF converter doesn't run SCons, so these scripts were
-previously ignored and any library
-relying on them failed to link under ``toolchain: esp-idf``. This
-module provides a small shim that ``exec``s an extra-script with a
-fake ``env`` object, captures the common ``env.Append(...)`` calls,
-and returns the captured vars so the caller can fold them back into
-the library's generated CMakeLists.
-
-Caveats
--------
-* Only the ``env.Append`` API is captured. ``env.Replace``,
-  ``env.Prepend``, ``env.AddPreAction``, SCons file generators, and any
-  arbitrary I/O are silently no-ops. Scripts that depend on those will
-  produce incomplete output.
-* Running arbitrary Python from third-party libraries is a non-trivial
-  trust decision. The shim does no sandboxing — anything in the
-  script's process can run. Use only with libraries whose source you
-  trust.
-"""
-
-from __future__ import annotations
-
-from dataclasses import dataclass, field
-import logging
-import os
-from pathlib import Path
-
-_LOGGER = logging.getLogger(__name__)
-
-# Keys we know how to translate back into ESPHome's build-flag pipeline.
-# Other env.Append kwargs are recorded but ignored downstream.
-_CAPTURED_KEYS = frozenset({"LIBPATH", "LIBS", "CPPDEFINES", "LINKFLAGS", "CPPFLAGS"})
-
-
-@dataclass
-class ExtraScriptResult:
-    """Build-var deltas captured from a PIO extra-script ``env.Append`` call."""
-
-    libpath: list[str] = field(default_factory=list)
-    libs: list[str] = field(default_factory=list)
-    cppdefines: list[str | tuple[str, str]] = field(default_factory=list)
-    linkflags: list[str] = field(default_factory=list)
-    cppflags: list[str] = field(default_factory=list)
-
-
-class _FakeSConsEnv:
-    """Minimal stand-in for SCons ``Environment`` exposed to extra-scripts.
-
-    Implements just enough surface area to let scripts query ``BOARD_MCU``
-    / ``PIOENV`` and call ``env.Append(LIBPATH=…, LIBS=…, …)``. Every
-    other env method swallows silently so unrelated calls don't raise
-    ``AttributeError`` and abort the script.
-    """
-
-    def __init__(self, *, board_mcu: str, pio_env: str) -> None:
-        self._vars: dict[str, str] = {
-            "BOARD_MCU": board_mcu,
-            "PIOPLATFORM": "espressif32",
-            "PIOENV": pio_env,
-        }
-        self.result = ExtraScriptResult()
-
-    # ----- SCons env API the common scripts use -----
-
-    def get(self, key: str, default: str | None = None) -> str | None:
-        return self._vars.get(key, default)
-
-    def Append(self, **kwargs) -> None:  # noqa: N802 (SCons API name)
-        for key, value in kwargs.items():
-            if key not in _CAPTURED_KEYS:
-                continue
-            items = list(value) if isinstance(value, (list, tuple)) else [value]
-            bucket = getattr(self.result, key.lower())
-            bucket.extend(items)
-
-    # ----- Everything else is a no-op so unsupported scripts don't crash -----
-
-    def __getattr__(self, name: str):
-        def _noop(*args, **kwargs):
-            return None
-
-        return _noop
-
-
-def run_extra_script(
-    script_path: Path, *, library_dir: Path, idf_target: str
-) -> ExtraScriptResult:
-    """Execute ``script_path`` with a fake SCons env and return captured vars.
-
-    ``idf_target`` is the active ESP-IDF target name (e.g. ``esp32``,
-    ``esp32s3``); it's exposed to the script as PlatformIO's
-    ``BOARD_MCU`` so chip-conditional logic resolves the same way it
-    would under PIO. The script runs with ``library_dir`` as the
-    process CWD so relative-path lookups (``join``, ``realpath``,
-    ``open``) resolve against the library tree.
-
-    On any exception inside the script we log at debug level and return
-    an empty result — extra-scripts are best-effort, and an unsupported
-    script shouldn't block the build.
-    """
-    env = _FakeSConsEnv(board_mcu=idf_target, pio_env=f"esphome_{idf_target}")
-    code = compile(script_path.read_text(encoding="utf-8"), str(script_path), "exec")
-    old_cwd = Path.cwd()
-    try:
-        os.chdir(library_dir)
-        exec(  # noqa: S102 pylint: disable=exec-used
-            code,
-            {
-                "Import": lambda *_args: None,  # SCons-side import; harmless here
-                "env": env,
-                "__file__": str(script_path),
-                "__name__": "__pio_extra_script__",
-            },
-        )
-    except Exception as e:  # noqa: BLE001  # pylint: disable=broad-exception-caught
-        _LOGGER.warning("PIO extra-script %s raised %s; skipping", script_path, e)
-        return ExtraScriptResult()
-    finally:
-        os.chdir(old_cwd)
-    return env.result
-
-
-def captured_as_build_flags(
-    result: ExtraScriptResult, *, library_dir: Path
-) -> list[str]:
-    """Translate captured env vars into the ``-L`` / ``-l`` / ``-D`` /
-    raw-flag form ``_generate_cmakelists_txt`` already knows how to consume.
-
-    ``LIBPATH`` entries are made relative to ``library_dir`` so the
-    generated CMakeLists is portable; absolute paths outside the library
-    tree are kept as-is (CMake handles absolute paths in
-    ``target_link_directories`` fine).
-    """
-    flags: list[str] = []
-    library_root = library_dir.resolve()
-    for path in result.libpath:
-        # Anchor relative paths to library_dir (not the current CWD, which
-        # has been restored by the time we get here). Joining an absolute
-        # path against library_dir returns the absolute path unchanged.
-        resolved = (library_dir / path).resolve()
-        try:
-            flags.append(f"-L{resolved.relative_to(library_root)}")
-        except ValueError:
-            flags.append(f"-L{resolved}")
-    flags.extend(f"-l{lib}" for lib in result.libs)
-    for define in result.cppdefines:
-        if isinstance(define, tuple) and len(define) == 2:
-            flags.append(f"-D{define[0]}={define[1]}")
-        else:
-            flags.append(f"-D{define}")
-    flags.extend(result.linkflags)
-    flags.extend(result.cppflags)
-    return flags

esphome/espidf/framework.py

@@ -11,10 +11,15 @@ import re
 import shutil
 from typing import Any, NoReturn
 
-import platformdirs
-
-from esphome.core import CORE, Version
+from esphome.build_helpers.ccache import (
+    ccache_defaults_env,
+    parse_enable_env,
+    resolve_ccache_path,
+)
+from esphome.build_helpers.tools_cache import IDF_TOOLS_CACHE, tools_cache_path
+from esphome.core import Version
 from esphome.framework_helpers import (
+    BatchDownloadProgress,
     PathType,
     archive_extract_all,
     create_venv,
@@ -23,11 +28,12 @@ from esphome.framework_helpers import (
     get_python_env_executable_path,
     get_system_python_path,
     rmdir,
+    run_batch_downloads,
     run_command,
     run_command_ok,
     str_to_lst_of_str,
 )
-from esphome.helpers import get_bool_env, get_str_env, write_file_if_changed
+from esphome.helpers import write_file_if_changed
 
 _LOGGER = logging.getLogger(__name__)
 
@@ -88,22 +94,10 @@ def get_idf_tools_path() -> Path:
     Returns:
         Path object pointing to the ESP-IDF tools directory
     """
-    # Treat an empty/whitespace ESPHOME_ESP_IDF_PREFIX as unset: Path("")
-    # resolves to the CWD, which would install into (and let clean-all delete)
-    # the working directory by accident.
-    if prefix := get_str_env("ESPHOME_ESP_IDF_PREFIX", "").strip():
-        path = Path(prefix).expanduser()
-    else:
-        # Machine-global so all projects share the multi-GB install instead of
-        # a per-config-directory copy. The user cache dir (not ~/.esphome)
-        # avoids colliding with data_dir when configs live in the home dir.
-        # appauthor=False drops the redundant <author>\ segment on Windows
-        # (which otherwise repeats "esphome\esphome\") to keep the path short.
-        path = Path(platformdirs.user_cache_dir("esphome", appauthor=False)) / "idf"
-    # Resolve so an unnormalized config path (e.g. compiling ``../config/x.yaml``)
-    # doesn't leave ``..`` segments in the IDF_TOOLS_PATH handed to idf.py, which
-    # otherwise warns that the venv interpreter path doesn't match the install.
-    return path.resolve()
+    # Machine-global so all projects share the multi-GB install instead of
+    # a per-config-directory copy; see build_helpers.tools_cache.tools_cache_path
+    # for the env-override and normalization rules.
+    return tools_cache_path(*IDF_TOOLS_CACHE)
 
 
 # Windows' default MAX_PATH is 260 characters. ESP-IDF toolchains nest deeply
@@ -702,10 +696,10 @@ def _prefetch_idf_tool_archives(
     which makes large archives effectively impossible to fetch on unstable
     connections (#17703). This asks the framework's idf_tools (via
     ``get_tool_downloads.py``) which archives the coming install needs, then
-    downloads each into ``<IDF_TOOLS_PATH>/dist`` with
-    ``download_with_resume``. The installer then finds the verified archives
-    already in place ("file ... is already downloaded") and never touches the
-    network.
+    downloads them into ``<IDF_TOOLS_PATH>/dist`` with
+    ``download_with_resume``, a few at a time under one combined progress
+    bar. The installer then finds the verified archives already in place
+    ("file ... is already downloaded") and never touches the network.
 
     Strictly best-effort: any failure here just logs and returns, leaving
     ``idf_tools.py install`` to download whatever is missing exactly as
@@ -727,26 +721,58 @@ def _prefetch_idf_tool_archives(
             )
             return
         dist_path = get_idf_tools_path() / "dist"
-        entries = [
-            entry
-            for entry in json.loads(stdout)
-            if not (dist_path / entry["dest"]).is_file()
-        ]
-        for index, entry in enumerate(entries, start=1):
-            _LOGGER.info(
-                "Downloading %s (%d/%d) ...", entry["name"], index, len(entries)
-            )
-            try:
-                download_with_resume(
-                    entry["url"],
-                    dist_path / entry["dest"],
-                    sha256=entry["sha256"],
-                    size=entry["size"],
+        entries = []
+        seen_dests: set[str] = set()
+        for entry in json.loads(stdout):
+            if (dist_path / entry["dest"]).is_file():
+                continue
+            if entry["dest"] in seen_dests:
+                # Two workers on one .part file would interleave
+                # seek/truncate writes; mirror the library prefetch's dedupe
+                continue
+            seen_dests.add(entry["dest"])
+            # tools.json always carries sha256 and size; an entry missing
+            # either must not be downloaded unverified here, so leave it to
+            # the installer (which fails loudly on a bad archive).
+            if entry.get("sha256") and entry.get("size"):
+                entries.append(entry)
+            else:
+                _LOGGER.warning(
+                    "Tool %s has no sha256/size in the download list; "
+                    "leaving it to the installer",
+                    entry["name"],
                 )
-            except Exception as e:  # noqa: BLE001  # pylint: disable=broad-exception-caught
-                # Keep prefetching the remaining archives; the installer
-                # will retry this one itself (without resume).
-                _LOGGER.warning("Could not prefetch %s: %s", entry["name"], e)
+        if not entries:
+            return
+        _LOGGER.info(
+            "Downloading %d ESP-IDF tool archive(s): %s",
+            len(entries),
+            ", ".join(entry["name"] for entry in entries),
+        )
+
+        # Every entry carries a size (checked above), so the combined bar can
+        # be trusted. Unlike the library prefetch there is no sequential
+        # fallback: per-file bars from several threads would interleave, and
+        # skipping the prefetch would lose the resume workaround for #17703.
+        def _download(entry: dict):
+            return lambda tracker: download_with_resume(
+                entry["url"],
+                dist_path / entry["dest"],
+                sha256=entry["sha256"],
+                size=entry["size"],
+                progress=tracker,
+            )
+
+        # A failed archive is retried by the installer itself (without
+        # resume); keep prefetching the rest.
+        failures = run_batch_downloads(
+            BatchDownloadProgress(
+                "Downloading ESP-IDF tools", sum(entry["size"] for entry in entries)
+            ),
+            [(entry["name"], _download(entry)) for entry in entries],
+        )
+        for name, e in failures:
+            _LOGGER.warning("Could not prefetch %s: %s", name, e)
     except Exception as e:  # noqa: BLE001  # pylint: disable=broad-exception-caught
         # The installer downloads anything missing itself; never let the
         # prefetch become a new way for the install to fail.
@@ -1145,8 +1171,10 @@ def check_esp_idf_install(
 def _ccache_env() -> dict[str, str]:
     """Return ccache settings for ESP-IDF compiles.
 
-    Enabled by default whenever the ``ccache`` binary is on PATH; set
-    ``IDF_CCACHE_ENABLE=0`` in the environment to opt out. The cache lives under
+    Enabled by default whenever a runnable ``ccache`` binary is on PATH.
+    ``IDF_CCACHE_ENABLE=0`` opts out and ``=1`` forces it on; when that knob
+    is unset the shared ``ESPHOME_CCACHE_ENABLE`` applies (same 0/1 forms,
+    unrecognized values warn and count as unset). The cache lives under
     the IDF tools path (the machine-global cache dir, or
     ``ESPHOME_ESP_IDF_PREFIX``), so it is shared across all projects and removed
     by ``esphome clean-all`` along with the framework.
@@ -1161,33 +1189,23 @@ def _ccache_env() -> dict[str, str]:
     Only values the user has not already set in the environment are returned, so
     a custom ``CCACHE_DIR`` / ``CCACHE_MAXSIZE`` / etc. is respected.
     """
-    # Honor an explicit choice already in the environment (opt-out or opt-in).
-    if "IDF_CCACHE_ENABLE" in os.environ:
-        if not get_bool_env("IDF_CCACHE_ENABLE"):
-            return {}
-    elif shutil.which("ccache") is None:
+    # IDF_CCACHE_ENABLE (the backend-native knob) wins over the shared
+    # ESPHOME_CCACHE_ENABLE.
+    idf_knob = parse_enable_env("IDF_CCACHE_ENABLE")
+    if idf_knob is False:
+        # The raw value (e.g. "disable") is still inherited by idf.py via
+        # os.environ, where a non-false-constant string reads as truthy;
+        # export the canonical off spelling instead
+        return {"IDF_CCACHE_ENABLE": "0"}
+    if idf_knob is None and resolve_ccache_path() is None:
         # ESP-IDF silently skips ccache without the binary; don't enable it.
         return {}
 
-    # ccache is enabled past here. build_path is set during preload for every
-    # config-loading command, so it being unset means a caller built the IDF env
-    # too early -- fail loudly rather than silently drop CCACHE_BASEDIR (which
-    # would quietly cost cross-device cache hits).
-    if CORE.build_path is None:
-        raise ValueError(
-            "CORE.build_path must be set before constructing the ESP-IDF build "
-            "environment"
-        )
-
-    defaults = {
-        "IDF_CCACHE_ENABLE": "1",
-        "CCACHE_DIR": str(get_idf_tools_path() / "ccache"),
-        "CCACHE_NOHASHDIR": "true",
-        "CCACHE_DEPEND": "1",
-        "CCACHE_BASEDIR": str(Path(CORE.build_path).resolve()),
-    }
-    # Don't override CCACHE_* values the user already set in their environment.
-    return {k: v for k, v in defaults.items() if k not in os.environ}
+    env = ccache_defaults_env(get_idf_tools_path() / "ccache")
+    if idf_knob is None:
+        # An unparsable IDF_CCACHE_ENABLE must not leak to idf.py as truthy
+        env["IDF_CCACHE_ENABLE"] = "1"
+    return env
 
 
 def get_framework_env(

esphome/espidf/size_summary.py

@@ -28,6 +28,8 @@ import json
 import logging
 from pathlib import Path
 
+from esphome.build_helpers.size_summary import print_size_line
+
 _LOGGER = logging.getLogger(__name__)
 _SIZE_SUFFIXES = {"K": 1024, "M": 1024 * 1024}
 
@@ -67,31 +69,26 @@ def _find_app_partition_size(partitions_csv: Path) -> int:
     raise ValueError(f"No app+factory or app+ota_0 partition in {partitions_csv}")
 
 
-def _format_bar(used: int, total: int) -> str:
-    """Match PlatformIO's ``_format_availale_bytes`` (pioupload.py) exactly."""
-    pct_raw = used / total if total else 0
-    blocks = 10
-    filled = min(int(round(blocks * pct_raw)), blocks)
-    progress = "=" * filled
-    return (
-        f"[{progress:<{blocks}}] {pct_raw: 6.1%} "
-        f"(used {used:d} bytes from {total:d} bytes)"
-    )
-
-
 def print_summary(size_json: Path, partitions_csv: Path | None) -> None:
     """Print PlatformIO-shaped RAM and Flash one-liners.
 
     Failures are non-fatal: the build has already succeeded, we just couldn't
-    summarize. Logs the cause at debug level.
+    summarize. Logs the cause at warning level, so a missing RAM/Flash line
+    (which CI's memory-impact extraction greps for) is diagnosable.
     """
     if not size_json.is_file():
-        _LOGGER.debug("Skipping size summary: %s not found", size_json)
+        _LOGGER.warning("Skipping size summary: %s not found", size_json)
         return
     try:
         data = json.loads(size_json.read_text(encoding="utf-8"))
     except (OSError, json.JSONDecodeError) as e:
-        _LOGGER.debug("Skipping size summary: %s", e)
+        _LOGGER.warning("Skipping size summary: %s", e)
+        return
+
+    if not isinstance(data, dict):
+        # Valid JSON that is not an object (truncated tool output) must
+        # not raise past a build that already linked
+        _LOGGER.warning("Skipping size summary: unexpected shape in %s", size_json)
         return
 
     memory_types = data.get("memory_types", {})
@@ -99,14 +96,32 @@ def print_summary(size_json: Path, partitions_csv: Path | None) -> None:
     ram_used = ram_region.get("used")
     ram_total = ram_region.get("size")
     if ram_total and ram_used is not None:
-        print(f"RAM:   {_format_bar(ram_used, ram_total)}")
+        print_size_line("RAM", ram_used, ram_total)
+    else:
+        _LOGGER.warning(
+            "Skipping RAM summary: no usable DRAM/DIRAM region in %s", size_json
+        )
 
     image_size = data.get("image_size")
-    if image_size is None or partitions_csv is None:
+    if image_size is None:
+        _LOGGER.warning("Skipping Flash summary: no image_size in %s", size_json)
+        return
+    if partitions_csv is None:
+        _LOGGER.warning("Skipping Flash summary: no partition table given")
         return
     try:
         app_size = _find_app_partition_size(partitions_csv)
-    except ValueError as e:
-        _LOGGER.debug("Skipping Flash summary: %s", e)
+    except (ValueError, OSError) as e:
+        _LOGGER.warning("Skipping Flash summary: %s", e)
         return
-    print(f"Flash: {_format_bar(image_size, app_size)}")
+    if app_size <= 0:
+        # A "from 0 bytes" denominator is meaningless to a reader. The skip
+        # costs CI's memory-impact extraction its Flash match, which is the
+        # loud outcome a broken partition table deserves.
+        _LOGGER.warning(
+            "Skipping Flash summary: app partition size is %s in %s",
+            app_size,
+            partitions_csv,
+        )
+        return
+    print_size_line("Flash", image_size, app_size)

esphome/espidf/toolchain.py

@@ -526,32 +526,15 @@ def get_idedata() -> dict | None:
     idedata fields IDE integrations and clang-tidy expect, cached alongside the
     PlatformIO idedata path. Returns None if the compile DB doesn't exist yet.
     """
-    from esphome.espidf.idedata import idedata_from_build
+    from esphome.build_helpers.idedata import load_or_build_idedata
 
-    compile_commands = CORE.relative_build_path("build", "compile_commands.json")
-    if not compile_commands.is_file():
-        _LOGGER.debug("No %s yet; skipping idedata generation", compile_commands)
-        return None
-
-    cache = CORE.relative_internal_path("idedata", f"{CORE.name}.json")
-    if cache.is_file() and cache.stat().st_mtime >= compile_commands.stat().st_mtime:
-        try:
-            cached = json.loads(cache.read_text(encoding="utf-8"))
-        except ValueError:
-            pass
-        else:
-            # Caches written before cc_path was emitted stay newer than
-            # compile_commands.json forever, so rebuild them on the field rather
-            # than on the timestamp. Check the type too: a corrupted cache can
-            # still be valid JSON, and "in" would match a substring of a string.
-            if isinstance(cached, dict) and "cc_path" in cached:
-                return cached
-
-    data = idedata_from_build(compile_commands)
-    data["prog_path"] = str(get_elf_path())
-    cache.parent.mkdir(parents=True, exist_ok=True)
-    cache.write_text(json.dumps(data, indent=2) + "\n", encoding="utf-8")
-    return data
+    # No launcher: CMake excludes CMAKE_<LANG>_COMPILER_LAUNCHER (ccache)
+    # from the exported compile database, unlike ninja's compdb dump.
+    return load_or_build_idedata(
+        CORE.relative_build_path("build", "compile_commands.json"),
+        get_elf_path(),
+        CORE.relative_internal_path("idedata", f"{CORE.name}.json"),
+    )
 
 
 def create_factory_bin() -> bool:

esphome/espota2.py

@@ -53,7 +53,6 @@ RESPONSE_ERROR_PARTITION_TABLE_UPDATE = 0x90
 RESPONSE_ERROR_BOOTLOADER_VERIFY = 0x91
 RESPONSE_ERROR_BOOTLOADER_UPDATE = 0x92
 RESPONSE_ERROR_VERSION_DOWNGRADE = 0x93
-RESPONSE_ERROR_ENCRYPTION_REQUIRED = 0x94
 RESPONSE_ERROR_UNKNOWN = 0xFF
 
 OTA_VERSION_1_0 = 1
@@ -64,17 +63,8 @@ MAGIC_BYTES = [0x6C, 0x26, 0xF7, 0x5C, 0x45]
 CLIENT_FEATURE_SUPPORTS_COMPRESSION = 0x01
 CLIENT_FEATURE_SUPPORTS_SHA256_AUTH = 0x02
 CLIENT_FEATURE_SUPPORTS_EXTENDED_PROTOCOL = 0x04
-CLIENT_FEATURE_SUPPORTS_NOISE = 0x08
 SERVER_FEATURE_SUPPORTS_COMPRESSION = 0x01
 SERVER_FEATURE_SUPPORTS_PARTITION_ACCESS = 0x02
-SERVER_FEATURE_SUPPORTS_NOISE = 0x04
-
-NOISE_FRAME_INDICATOR = 0x01
-NOISE_HANDSHAKE_OK = 0x00
-# The device decrypts frames in its 1024-byte transfer buffer; the 16-byte
-# ChaCha20-Poly1305 MAC leaves this much plaintext per frame.
-NOISE_MAX_PLAINTEXT = 1008
-NOISE_PROLOGUE_INIT = b"NoiseOTAInit"
 
 # OTA types this client knows how to send. Future PRs that add bootloader/partition
 # updates extend this set. Anything outside the set is rejected up front so callers
@@ -181,12 +171,6 @@ _ERROR_MESSAGES: dict[int, str] = {
         "enabled: the new firmware's version must be newer than the version the "
         "device is currently running."
     ),
-    RESPONSE_ERROR_ENCRYPTION_REQUIRED: (
-        "The device requires an encrypted OTA connection but this upload has no "
-        "encryption key. Add 'encryption:' to the 'ota: platform: esphome' section "
-        "of the YAML this upload uses, or update your esphome installation if it "
-        "predates OTA encryption."
-    ),
     RESPONSE_ERROR_UNKNOWN: "Unknown error from ESP",
 }
 
@@ -321,155 +305,12 @@ def send_check(
         raise OTANetworkError(f"sending {msg}: {err}") from err
 
 
-class NoiseSocketWrapper:
-    """Runs the OTA session inside a Noise (ChaCha20-Poly1305) transport.
-
-    Presents the small subset of the socket API perform_ota uses (recv,
-    sendall, and the settimeout/setsockopt/close pass-throughs), so the rest
-    of the upload flow works unchanged. Frames on the wire are
-    indicator 0x01, 16-bit big-endian length, ciphertext; recv() serves the
-    decrypted stream from an internal buffer one frame at a time. Writes keep
-    each sendall() unit within one frame when it fits (the device expects
-    control units one per frame) and split larger data blocks at
-    NOISE_MAX_PLAINTEXT.
-    """
-
-    def __init__(self, sock: socket.socket, psk: str, prologue: bytes) -> None:
-        # Deliberately lazy: the noise stack (noiseprotocol, cryptography) is
-        # only imported when an encrypted upload actually runs.
-        try:
-            from aioesphomeapi.noise import NoiseHandshake
-        except ImportError as err:
-            raise OTAError(
-                "OTA encryption requires a newer aioesphomeapi; update your "
-                "esphome installation (pip install -U esphome) and retry"
-            ) from err
-        from cryptography.exceptions import InvalidTag
-
-        self._invalid_tag = InvalidTag
-        self._sock = sock
-        try:
-            self._handshake = NoiseHandshake(psk, prologue)
-        except ValueError as err:
-            raise OTAError(f"Invalid OTA encryption key: {err}") from err
-        self._encrypt = None
-        self._decrypt = None
-        self._buffer = b""
-
-    # Only harmless socket controls pass through; anything that moves bytes
-    # must go through the encrypted recv/sendall. Byte-moving socket methods
-    # (send, recv_into, ...) are deliberately not defined, so reaching for
-    # one raises AttributeError instead of leaking plaintext.
-    def settimeout(self, timeout: float | None) -> None:
-        self._sock.settimeout(timeout)
-
-    def setsockopt(self, level: int, optname: int, value: int) -> None:
-        self._sock.setsockopt(level, optname, value)
-
-    def close(self) -> None:
-        self._sock.close()
-
-    def do_handshake(self) -> None:
-        """Run the two-message NNpsk0 handshake and set up the transport ciphers."""
-        try:
-            self._send_frame(
-                bytes([NOISE_HANDSHAKE_OK]) + self._handshake.write_message()
-            )
-            payload = self._recv_frame()
-        except OSError as err:
-            raise OTANetworkError(f"noise handshake: {err}") from err
-        if not payload:
-            raise OTANetworkError("Device closed connection during the noise handshake")
-        if payload[0] != NOISE_HANDSHAKE_OK:
-            reason = payload[1:].decode("utf-8", "replace")
-            if reason == "Handshake MAC failure":
-                raise OTAError(
-                    "Device rejected the handshake; is the OTA encryption key correct?"
-                )
-            raise OTAError(f"Device rejected the noise handshake: {reason}")
-        try:
-            self._handshake.read_message(payload[1:])
-        except (ValueError, self._invalid_tag) as err:
-            # InvalidTag is a wrong key; ValueError covers a device sending an
-            # invalid curve point, which cryptography rejects during the DH
-            raise OTAError(
-                "Noise handshake failed; is the OTA encryption key correct?"
-            ) from err
-        self._encrypt, self._decrypt = self._handshake.get_ciphers()
-
-    def sendall(self, data: bytes) -> None:
-        frames: list[bytes] = []
-        for offset in range(0, len(data), NOISE_MAX_PLAINTEXT):
-            ciphertext = self._encrypt.encrypt(
-                data[offset : offset + NOISE_MAX_PLAINTEXT]
-            )
-            frames.append(self._frame_header(len(ciphertext)))
-            frames.append(ciphertext)
-        self._sock.sendall(b"".join(frames))
-
-    def recv(self, amount: int) -> bytes:
-        if not self._buffer:
-            ciphertext = self._recv_frame()
-            if not ciphertext:
-                return b""  # connection closed at a frame boundary
-            try:
-                self._buffer = self._decrypt.decrypt(ciphertext)
-            except self._invalid_tag as err:
-                # A fresh connection renegotiates the session, so this is
-                # retryable like other transport failures. The message names
-                # the MAC so repeated failures read as tampering or a cipher
-                # desync, not a flaky link.
-                raise OTANetworkError(
-                    "Noise decryption failed (MAC mismatch); frame corrupted or tampered"
-                ) from err
-            if not self._buffer:
-                # A MAC-only frame decrypts to nothing; reject it so recv's
-                # b"" always means the peer closed
-                raise OTANetworkError("Device sent an empty noise frame")
-        data = self._buffer[:amount]
-        self._buffer = self._buffer[amount:]
-        return data
-
-    @staticmethod
-    def _frame_header(length: int) -> bytes:
-        return bytes([NOISE_FRAME_INDICATOR, (length >> 8) & 0xFF, length & 0xFF])
-
-    def _send_frame(self, payload: bytes) -> None:
-        self._sock.sendall(self._frame_header(len(payload)) + payload)
-
-    def _recv_frame(self) -> bytes:
-        header = self._recv_exact(3, closed_ok=True)
-        if not header:
-            return b""  # connection closed at a frame boundary
-        # A malformed frame is a broken transport, not a device-reported
-        # error; raise the retryable class so the send-failure probe keeps its
-        # semantics and a fresh session is tried
-        if header[0] != NOISE_FRAME_INDICATOR:
-            raise OTANetworkError(f"Bad noise frame indicator 0x{header[0]:02X}")
-        length = (header[1] << 8) | header[2]
-        if length == 0:
-            raise OTANetworkError("Device sent an empty noise frame")
-        return self._recv_exact(length)
-
-    def _recv_exact(self, amount: int, closed_ok: bool = False) -> bytes:
-        data = b""
-        while len(data) < amount:
-            chunk = self._sock.recv(amount - len(data))
-            if not chunk:
-                if closed_ok and not data:
-                    return b""
-                raise OSError("connection closed inside a noise frame")
-            data += chunk
-        return data
-
-
 def perform_ota(
     sock: socket.socket,
     password: str | None,
     file_handle: io.IOBase,
     filename: Path,
     ota_type: int = OTA_TYPE_UPDATE_APP,
-    noise_psk: str | None = None,
 ) -> None:
     # Validate ota_type up front. It travels as a single byte on the wire, and
     # passing an out-of-range value would only surface as a ValueError from
@@ -484,11 +325,6 @@ def perform_ota(
             f"Unsupported OTA type 0x{ota_type:02X}; this ESPHome supports: {supported}"
         )
 
-    if noise_psk is not None and not noise_psk:
-        raise OTAError(
-            "An empty OTA encryption key was provided; refusing to upload in plaintext"
-        )
-
     file_contents = file_handle.read()
     file_size = len(file_contents)
     _LOGGER.info("Uploading %s (%s bytes)", filename, file_size)
@@ -511,8 +347,6 @@ def perform_ota(
         | CLIENT_FEATURE_SUPPORTS_SHA256_AUTH
         | CLIENT_FEATURE_SUPPORTS_EXTENDED_PROTOCOL
     )
-    if noise_psk:
-        features_to_send |= CLIENT_FEATURE_SUPPORTS_NOISE
     send_check(sock, features_to_send, "features")
     features = receive_exactly(
         sock,
@@ -535,31 +369,6 @@ def perform_ota(
     else:
         features = 0
 
-    if noise_psk:
-        # Fail closed: never fall back to a plaintext upload when an
-        # encryption key is configured, an active attacker could otherwise
-        # strip the feature flag and capture the image (it contains the wifi
-        # credentials and the api encryption key).
-        if not (extended_proto and features & SERVER_FEATURE_SUPPORTS_NOISE):
-            raise OTAError(
-                "An OTA encryption key is configured but the device did not "
-                "offer encryption; refusing to send the image in plaintext. "
-                "If the running firmware predates OTA encryption, first update "
-                "it without the 'ota: encryption:' block (over a trusted "
-                "network or via USB), then restore the block and upload again."
-            )
-        # The prologue binds every negotiation byte both sides saw, so any
-        # tampering with the plaintext preamble breaks the handshake.
-        prologue = (
-            NOISE_PROLOGUE_INIT
-            + bytes(MAGIC_BYTES)
-            + bytes([RESPONSE_OK, version, features_to_send])
-            + bytes([RESPONSE_FEATURE_FLAGS, features])
-        )
-        sock = NoiseSocketWrapper(sock, noise_psk, prologue)
-        sock.do_handshake()
-        _LOGGER.info("Encrypted connection established")
-
     if ota_type != OTA_TYPE_UPDATE_APP:
         # Any non-app OTA type requires the extended protocol and the
         # partition-access server feature. Reject up front so the user gets
@@ -763,7 +572,6 @@ def run_ota_impl_(
     password: str | None,
     filename: Path,
     ota_type: int = OTA_TYPE_UPDATE_APP,
-    noise_psk: str | None = None,
 ) -> tuple[int, str | None]:
     from esphome.core import CORE
 
@@ -828,7 +636,7 @@ def run_ota_impl_(
         reached_device = True
         with contextlib.closing(sock), Path(filename).open("rb") as file_handle:
             try:
-                perform_ota(sock, password, file_handle, filename, ota_type, noise_psk)
+                perform_ota(sock, password, file_handle, filename, ota_type)
             except OTANetworkError as err:
                 # Transient network failure; retry
                 last_error = str(err)
@@ -853,12 +661,9 @@ def run_ota(
     password: str | None,
     filename: Path,
     ota_type: int = OTA_TYPE_UPDATE_APP,
-    noise_psk: str | None = None,
 ) -> tuple[int, str | None]:
     try:
-        return run_ota_impl_(
-            remote_host, remote_port, password, filename, ota_type, noise_psk
-        )
+        return run_ota_impl_(remote_host, remote_port, password, filename, ota_type)
     except OTAError as err:
         _LOGGER.error(err)
         return 1, None

esphome/framework_helpers.py

@@ -1,6 +1,7 @@
 """Generic toolchain installation helpers shared across framework implementations."""
 
-from collections.abc import Iterable
+from collections.abc import Callable, Iterable
+from concurrent.futures import ThreadPoolExecutor
 from contextlib import ExitStack
 import hashlib
 import io
@@ -10,6 +11,7 @@ import os
 from pathlib import Path
 import subprocess
 import sys
+import threading
 import time
 from typing import IO, TYPE_CHECKING
 
@@ -23,6 +25,7 @@ PathType = str | os.PathLike
 
 _LOGGER = logging.getLogger(__name__)
 
+
 # Attempts per mirror URL before falling through to the next mirror; only
 # mid-stream drops retry (resuming when the server gave a validator),
 # connect errors move on to the next mirror immediately.
@@ -196,6 +199,30 @@ def run_command(
         return False, None, None
 
 
+def tool_version_runs(binary: str, warning: str) -> bool:
+    """Probe ``binary --version``; on failure warn with ``warning`` % binary.
+
+    ``shutil.which`` proves existence, not runnability (Windows .bat/.cmd
+    shims, stale package-manager shims).
+    """
+    try:
+        subprocess.run(
+            [binary, "--version"],
+            check=True,
+            stdout=subprocess.DEVNULL,
+            stderr=subprocess.DEVNULL,
+            timeout=15,
+            # Repo-wide convention (posix_spawn fast path)
+            close_fds=False,
+        )
+    except (OSError, subprocess.SubprocessError) as err:
+        # The cause (permission denied, missing DLL, timeout) is the one
+        # detail the user needs to fix it
+        _LOGGER.warning("%s (%s)", warning % binary, err)
+        return False
+    return True
+
+
 def run_command_ok(*args, **kwargs) -> bool:
     """
     Execute a command and return only the success status.
@@ -697,7 +724,11 @@ def _response_validator(resp: "requests.Response") -> str | None:
 
 
 def _stream_response_to_file(
-    resp: "requests.Response", f: IO[bytes], offset: int, size: int | None = None
+    resp: "requests.Response",
+    f: IO[bytes],
+    offset: int,
+    size: int | None = None,
+    progress: Callable[[int], None] | None = None,
 ) -> None:
     """Stream an open ``_open_ranged`` response body into ``f`` at ``offset``.
 
@@ -705,21 +736,112 @@ def _stream_response_to_file(
     (effective offset 0) discards the stale bytes. ``offset`` also seeds the
     progress bar so a resumed download shows overall progress. ``size`` is
     the known full file size; when None it is derived from the response's
-    content-length, and without either there is no progress bar.
+    content-length, and without either there is no progress bar. With
+    ``progress`` set, no bar is drawn here; the callback gets the absolute
+    byte count, seeded with ``offset`` and then after each chunk.
     """
     f.seek(offset)
     f.truncate(offset)
     total_size = size or offset + _content_length(resp)
     downloaded = offset
-    progress = ProgressBar("Downloading") if total_size > 0 else None
+    own_bar: ProgressBar | None = None
+    if progress is None:
+        own_bar = ProgressBar("Downloading") if total_size > 0 else None
+        progress = (
+            (lambda done: own_bar.update(done / total_size))
+            if own_bar
+            else (lambda _: None)
+        )
+    progress(downloaded)
     for chunk in resp.iter_content(chunk_size=256 * 1024):
         if chunk:
             f.write(chunk)
             downloaded += len(chunk)
-        if progress is not None:
-            progress.update(downloaded / total_size)
-    if progress is not None:
-        progress.update(1)
+        progress(downloaded)
+    if own_bar is not None:
+        own_bar.update(1)
+
+
+# Concurrent downloads per batch; enough to hide latency without
+# hammering the host or the mirrors.
+BATCH_DOWNLOAD_WORKERS = 4
+
+
+def run_batch_downloads(
+    progress: "BatchDownloadProgress",
+    jobs: list[tuple[str, Callable[[Callable[[int], None]], None]]],
+    max_workers: int = BATCH_DOWNLOAD_WORKERS,
+) -> list[tuple[str, Exception]]:
+    """Run download jobs concurrently, reporting into one combined bar.
+
+    ``jobs`` holds ``(name, fetch)`` pairs where ``fetch(tracker)`` performs
+    one download reporting absolute byte counts to ``tracker``. Failures are
+    collected (list.append is atomic under the GIL) and returned after the
+    bar is done, so the caller's warnings never land on the bar's row; a
+    failed job credits its tracker 0 so the bar can still complete. Ctrl-C
+    drops queued jobs instead of downloading them all before the process
+    can exit; in-flight ones still finish. ``jobs`` must be non-empty.
+    """
+    failures: list[tuple[str, Exception]] = []
+
+    def _run(name: str, fetch: Callable[[Callable[[int], None]], None]) -> None:
+        tracker = progress.tracker()
+        try:
+            fetch(tracker)
+        except Exception as err:  # noqa: BLE001  # pylint: disable=broad-exception-caught
+            failures.append((name, err))
+            tracker(0)
+
+    ex = ThreadPoolExecutor(max_workers=min(max_workers, len(jobs)))
+    try:
+        for future in [ex.submit(_run, name, fetch) for name, fetch in jobs]:
+            future.result()
+    finally:
+        ex.shutdown(wait=True, cancel_futures=True)
+        progress.done()
+    return failures
+
+
+class BatchDownloadProgress:
+    """One progress bar across several concurrent ``download_with_resume`` calls.
+
+    Each ``tracker()`` is a ``progress`` callback for one download; it reports
+    that file's absolute byte count and the bar shows the sum over ``total``.
+    The lock also serialises the bar's stderr writes, so worker threads never
+    interleave frames. With an unknown ``total`` (0) nothing is drawn. Call
+    ``done()`` once every download has finished (or failed) so a bar that
+    never reached 100% still ends its line before the next log message.
+    """
+
+    def __init__(self, header: str, total: int) -> None:
+        self._bar = ProgressBar(header) if total > 0 else None
+        self._total = total
+        self._sum = 0
+        self._lock = threading.Lock()
+
+    def tracker(self) -> Callable[[int], None]:
+        last = 0
+
+        def update(done: int) -> None:
+            nonlocal last
+            if self._bar is None:
+                return
+            with self._lock:
+                self._sum += done - last
+                last = done
+                self._bar.update(min(self._sum / self._total, 1))
+
+        return update
+
+    def done(self) -> None:
+        # Nothing to end unless a frame was drawn and it was not the final
+        # one (update(1) already emitted its own newline).
+        if (
+            self._bar is not None
+            and self._bar.last_progress is not None
+            and self._bar.last_progress != 100
+        ):
+            self._bar.done()
 
 
 def download_with_resume(
@@ -732,6 +854,7 @@ def download_with_resume(
     attempts: int = 5,
     timeout: int = 30,
     retry_connect_errors: bool = True,
+    progress: Callable[[int], None] | None = None,
 ) -> None:
     """Download ``url`` to ``dest``, resuming partial downloads.
 
@@ -754,6 +877,12 @@ def download_with_resume(
     of consuming attempts — for callers with their own fallback, like
     ``download_from_mirrors``.
 
+    ``progress``, when given, replaces the built-in progress bar: it is called
+    with the absolute number of bytes of ``dest`` obtained so far (including
+    a resumed prefix, and the final size once the file is verified), so a
+    caller running several downloads at once can draw one combined bar (see
+    ``BatchDownloadProgress``).
+
     Raises EsphomeError when all attempts are exhausted.
     """
     # Imported lazily: requests is a heavy import (~85ms) and is only needed
@@ -777,6 +906,8 @@ def download_with_resume(
     if dest.is_file() and (sha256 is not None or size is not None):
         try:
             _verify_file(dest, sha256, size)
+            if progress is not None:
+                progress(size if size is not None else dest.stat().st_size)
             return
         except EsphomeError:
             dest.unlink()
@@ -822,7 +953,7 @@ def download_with_resume(
                             # Recorded so a later run can prove an If-Range
                             # resume of this part file safe.
                             _write_download_meta(meta, url, validator, expected_total)
-                        _stream_response_to_file(resp, f, offset, size)
+                        _stream_response_to_file(resp, f, offset, size, progress)
             # else: a previous run already wrote every byte (or more) but
             # was killed before the rename below. Skip the network entirely
             # — a Range request past EOF would draw HTTP 416 — and let
@@ -831,6 +962,10 @@ def download_with_resume(
 
             expected_size = size if size is not None else expected_total
             _verify_file(part, sha256, expected_size or None)
+            if progress is not None:
+                # Also credits a part file an earlier run completed without
+                # streaming anything this time.
+                progress(expected_size or part.stat().st_size)
             if not expected_size and sha256 is None:
                 # No sha, no size, and the server sent no usable
                 # content-length: nothing can prove the download complete
@@ -933,6 +1068,7 @@ def _try_mirrors_once(
     f: IO[bytes] | None,
     timeout: int,
     failures: list[tuple[str, Exception]],
+    progress: Callable[[int], None] | None = None,
 ) -> str | None:
     """Single pass over the resolved mirror ``urls``, one try per URL.
 
@@ -961,6 +1097,7 @@ def _try_mirrors_once(
                     # next mirror immediately; only mid-stream drops
                     # retry-with-resume on the same URL.
                     retry_connect_errors=False,
+                    progress=progress,
                 )
                 return url
             except (requests.RequestException, OSError, EsphomeError) as e:
@@ -1002,7 +1139,7 @@ def _try_mirrors_once(
                         if offset == 0:
                             validator = _response_validator(resp)
                             expected_total = _content_length(resp)
-                        _stream_response_to_file(resp, f, offset)
+                        _stream_response_to_file(resp, f, offset, progress=progress)
 
                 if expected_total and f.tell() != expected_total:
                     raise EsphomeError(
@@ -1051,6 +1188,7 @@ def download_from_mirrors(
     substitutions: dict[str, str],
     target: io.RawIOBase | IO[bytes] | PathType,
     timeout: int = 30,
+    progress: Callable[[int], None] | None = None,
 ) -> str:
     """
     Download file from multiple mirrors with substitution support.
@@ -1060,6 +1198,8 @@ def download_from_mirrors(
         substitutions: Dictionary of substitutions to apply to URLs
         target: Target file path or file-like object
         timeout: Download timeout in seconds
+        progress: Passed through to the download (see ``download_with_resume``);
+            replaces the built-in per-file bar
 
     Returns:
         The source URL.
@@ -1124,7 +1264,9 @@ def download_from_mirrors(
     for sweep in range(1, _MIRROR_SWEEP_ATTEMPTS + 1):
         sweep_failures: list[tuple[str, Exception]] = []
         if (
-            url := _try_mirrors_once(urls, path_target, f, timeout, sweep_failures)
+            url := _try_mirrors_once(
+                urls, path_target, f, timeout, sweep_failures, progress
+            )
         ) is not None:
             return url
         failures.extend(sweep_failures)
@@ -1169,3 +1311,37 @@ def download_from_mirrors(
             f"No mirror URL template matched the provided substitutions:{details}"
         )
     raise ValueError("download_from_mirrors called with an empty mirrors list")
+
+
+def strip_win_long_path_prefix(path: str) -> str:
+    r"""Strip the Windows extended-length path prefix from ``path``.
+
+    Handles both forms documented at
+    https://learn.microsoft.com/windows/win32/fileio/naming-a-file:
+
+    * ``\\?\C:\path\to\file`` -> ``C:\path\to\file``
+    * ``\\?\UNC\server\share\path`` -> ``\\server\share\path``
+
+    The NSIS-installed ``esphome.exe`` launcher on Windows starts Python with
+    ``sys.executable`` already prefixed with ``\\?\``. That prefix propagates
+    into PlatformIO's ``$PYTHONEXE`` (PlatformIO reads ``PYTHONEXEPATH`` from
+    the environment, falling back to ``os.path.normpath(sys.executable)``)
+    and ends up baked into SCons-emitted command lines for build steps such
+    as the esp8266 ``elf2bin`` invocation. ``cmd.exe`` does not understand
+    the ``\\?\`` prefix, so the build fails with
+    "The system cannot find the path specified." Stripping the prefix early
+    keeps the path shell-quotable.
+
+    Also applied to the ccache path exported by the ccache helpers, which
+    ``shutil.which`` can return with the same prefix.
+
+    No-op on non-Windows platforms.
+    """
+    if sys.platform != "win32":
+        return path
+    if path.startswith("\\\\?\\UNC\\"):
+        # \\?\UNC\server\share\... -> \\server\share\...
+        return "\\\\" + path[len("\\\\?\\UNC\\") :]
+    if path.startswith("\\\\?\\"):
+        return path[len("\\\\?\\") :]
+    return path

esphome/helpers.py

@@ -31,6 +31,12 @@ SockAddr = IPv4SockAddr | IPv6SockAddr
 
 _LOGGER = logging.getLogger(__name__)
 
+# cv.boolean's closed spelling tables, shared with the strict env-knob
+# parser (build_helpers.ccache.parse_enable_env). The legacy get_bool_env
+# below keeps its own laxer table for backward compatibility.
+TRUTHY_BOOL_STRINGS = frozenset({"true", "yes", "on", "enable"})
+FALSY_BOOL_STRINGS = frozenset({"false", "no", "off", "disable"})
+
 IS_MACOS = platform.system() == "Darwin"
 IS_WINDOWS = platform.system() == "Windows"
 IS_LINUX = platform.system() == "Linux"
@@ -552,18 +558,7 @@ def write_file_if_changed(path: Path, text: str) -> bool:
     """
     src_content = None
     if path.is_file():
-        try:
-            src_content = path.read_text(encoding="utf-8")
-        except UnicodeDecodeError as err:
-            # Replace a damaged file rather than abort the regeneration that
-            # fixes it; an OSError may hide an intact file, so it still raises
-            _LOGGER.warning("Replacing damaged file %s: %s", path, err)
-            with suppress(OSError):
-                path.unlink(missing_ok=True)
-        except OSError as err:
-            from esphome.core import EsphomeError
-
-            raise EsphomeError(f"Error reading file {path}: {err}") from err
+        src_content = read_file(path)
     if src_content == text:
         return False
     write_file(path, text)

esphome/platformio/extra_script.py

@@ -0,0 +1,263 @@
+"""Run a PlatformIO library ``extraScript`` against a fake SCons env.
+
+The shim execs the script with a stand-in ``env``, captures ``env.Append``
+calls (everything else is a logged no-op), and folds the result into the
+library's build flags. No sandboxing: the script runs with full process
+access, so it carries the same trust as the library's own source.
+"""
+
+from __future__ import annotations
+
+from collections.abc import Callable
+from dataclasses import dataclass, field
+import logging
+import os
+from pathlib import Path
+from typing import TYPE_CHECKING
+
+from esphome.core import EsphomeError
+
+if TYPE_CHECKING:
+    from esphome.platformio.library import ConvertedLibrary
+
+_LOGGER = logging.getLogger(__name__)
+
+
+def apply_extra_script(
+    component: ConvertedLibrary,
+    board_mcu: Callable[[], str],
+    pio_platform: str,
+) -> None:
+    """Run a library's ``extraScript`` and fold its captured env vars into
+    ``component.data["build"]["flags"]``.
+
+    ``board_mcu`` is a callable so its lookup runs only when a script will.
+    """
+    extra_script = component.data.get("build", {}).get("extraScript")
+    if not extra_script:
+        return
+    # Resolve and confine to the library's source dir so a malicious
+    # library.json can't escape (e.g. ``"extraScript": "../../etc/passwd"``).
+    source_path = component.source_dir
+    library_root = source_path.resolve()
+    script_path = (source_path / extra_script).resolve()
+    if not script_path.is_relative_to(library_root):
+        # More hostile than a missing script; must not be quieter than it
+        raise EsphomeError(
+            f"extraScript {extra_script} of library {component.name} escapes "
+            "the library directory"
+        )
+    if not script_path.is_file():
+        # A declared-but-absent script is a broken or half-downloaded
+        # package, not an unsupported script; PlatformIO fails on it too
+        raise EsphomeError(
+            f"extraScript {extra_script} of library {component.name} not found"
+        )
+    result = run_extra_script(
+        script_path,
+        library_dir=source_path,
+        board_mcu=board_mcu(),
+        pio_platform=pio_platform,
+    )
+    extra_flags = captured_as_build_flags(result, library_dir=source_path)
+    if not extra_flags:
+        return
+    flags = component.data.setdefault("build", {}).setdefault("flags", [])
+    if isinstance(flags, str):
+        flags = [flags]
+    elif not isinstance(flags, list):
+        # A null/dict value coerced through a list wrapper would inject a
+        # non-string into the compiler command line; fail naming the library
+        raise EsphomeError(
+            f"Library {component.name} has a malformed build.flags "
+            f"({type(flags).__name__}); expected a string or list"
+        )
+    component.data["build"]["flags"] = [*flags, *extra_flags]
+
+
+# Keys we know how to translate back into ESPHome's build-flag pipeline.
+# Other env.Append kwargs are recorded but ignored downstream.
+_CAPTURED_KEYS = frozenset({"LIBPATH", "LIBS", "CPPDEFINES", "LINKFLAGS", "CPPFLAGS"})
+
+
+@dataclass
+class ExtraScriptResult:
+    """Build-var deltas captured from a PIO extra-script ``env.Append`` call."""
+
+    libpath: list[str] = field(default_factory=list)
+    libs: list[str] = field(default_factory=list)
+    cppdefines: list[str | tuple[str, str]] = field(default_factory=list)
+    linkflags: list[str] = field(default_factory=list)
+    cppflags: list[str] = field(default_factory=list)
+
+
+class _FakeSConsEnv:
+    """Minimal SCons ``Environment`` stand-in: ``get`` and ``Append`` work;
+    every other method is a swallowed no-op so scripts don't abort."""
+
+    def __init__(self, *, board_mcu: str, pio_env: str, pio_platform: str) -> None:
+        self._vars: dict[str, str] = {
+            "BOARD_MCU": board_mcu,
+            "PIOPLATFORM": pio_platform,
+            "PIOENV": pio_env,
+        }
+        self.result = ExtraScriptResult()
+        self._warned_methods: set[str] = set()
+        self._warned_keys: set[str] = set()
+
+    # ----- SCons env API the common scripts use -----
+
+    def get(self, key: str, default: str | None = None) -> str | None:
+        return self._vars.get(key, default)
+
+    def __getitem__(self, key: str) -> str:
+        # Scripts also read env["BOARD_MCU"]; without this the broad
+        # handler would discard every flag the script captured
+        return self._vars[key]
+
+    def Append(self, **kwargs) -> None:  # noqa: N802 (SCons API name)
+        for key, value in kwargs.items():
+            if key not in _CAPTURED_KEYS:
+                # Warn once per key so a loop of Appends cannot spam
+                if key not in self._warned_keys:
+                    self._warned_keys.add(key)
+                    _LOGGER.warning(
+                        "PIO extra-script env.Append(%s=...) is not captured; ignoring",
+                        key,
+                    )
+                continue
+            items = list(value) if isinstance(value, (list, tuple)) else [value]
+            bucket = getattr(self.result, key.lower())
+            bucket.extend(items)
+
+    # ----- Everything else is a no-op so unsupported scripts don't crash -----
+
+    def __getattr__(self, name: str):
+        def _noop(*args, **kwargs):
+            # Once per method: a script whose whole effect is env.Replace()
+            # must be diagnosable from a normal build log
+            if name not in self._warned_methods:
+                self._warned_methods.add(name)
+                _LOGGER.warning(
+                    "PIO extra-script env.%s(...) is not supported; ignoring", name
+                )
+
+        return _noop
+
+
+def run_extra_script(
+    script_path: Path,
+    *,
+    library_dir: Path,
+    board_mcu: str,
+    pio_platform: str,
+) -> ExtraScriptResult:
+    """Execute ``script_path`` with a fake SCons env and return captured vars.
+
+    Runs with ``library_dir`` as CWD so relative lookups resolve against
+    the library tree. A crashed script warns and returns an empty result,
+    never a partial capture.
+    """
+    env = _FakeSConsEnv(
+        board_mcu=board_mcu,
+        pio_env=f"esphome_{board_mcu}",
+        pio_platform=pio_platform,
+    )
+    try:
+        source = script_path.read_text(encoding="utf-8")
+    except OSError as err:
+        # An unreadable declared script is a broken package, exactly like a
+        # missing one; must not be quieter than that case
+        raise EsphomeError(f"extraScript {script_path} is unreadable: {err}") from err
+    except UnicodeDecodeError as e:
+        # A content problem, best-effort like a SyntaxError below
+        _LOGGER.warning(
+            "PIO extra-script %s (in %s) is not UTF-8 (%r); ignoring its output",
+            script_path,
+            library_dir.name,
+            e,
+        )
+        return ExtraScriptResult()
+    old_cwd = Path.cwd()
+    try:
+        # Inside the try: a SyntaxError in a vendored script is just as
+        # best-effort as a runtime failure
+        code = compile(source, str(script_path), "exec")
+        os.chdir(library_dir)
+        exec(  # noqa: S102 pylint: disable=exec-used
+            code,
+            {
+                "Import": lambda *_args: None,  # SCons-side import; harmless here
+                "env": env,
+                "__file__": str(script_path),
+                "__name__": "__pio_extra_script__",
+            },
+        )
+    except SystemExit as e:
+        if not e.code:
+            # sys.exit() / sys.exit(0) is a normal PlatformIO script ending;
+            # the capture is complete
+            return env.result
+        _LOGGER.warning(
+            "PIO extra-script %s (in %s) exited with status %r; ignoring its output",
+            script_path,
+            library_dir.name,
+            e.code,
+        )
+        return ExtraScriptResult()
+    except Exception as e:  # noqa: BLE001  # pylint: disable=broad-exception-caught
+        # Discard any partial capture: half-applied flags could build wrong
+        # firmware that links cleanly.
+        _LOGGER.warning(
+            "PIO extra-script %s (in %s) raised %r; ignoring its output",
+            script_path,
+            library_dir.name,
+            e,
+        )
+        return ExtraScriptResult()
+    finally:
+        os.chdir(old_cwd)
+    return env.result
+
+
+def captured_as_build_flags(
+    result: ExtraScriptResult, *, library_dir: Path
+) -> list[str]:
+    """Translate captured env vars into -L/-l/-D/raw build flags.
+
+    ``LIBPATH`` entries are made relative to ``library_dir`` so the
+    generated build files stay portable.
+    """
+    flags: list[str] = []
+
+    def _strs(bucket: list, kind: str) -> list[str]:
+        # Third-party scripts legally append SCons nodes, ints, or dicts;
+        # stringifying those into flags would hand the compiler garbage
+        good = [entry for entry in bucket if isinstance(entry, str)]
+        for entry in bucket:
+            if not isinstance(entry, str):
+                _LOGGER.warning("Ignoring unsupported %s entry %r", kind, entry)
+        return good
+
+    library_root = library_dir.resolve()
+    for path in _strs(result.libpath, "LIBPATH"):
+        # Anchor relative paths to library_dir; the script's CWD has been
+        # restored by now
+        resolved = (library_dir / path).resolve()
+        try:
+            flags.append(f"-L{resolved.relative_to(library_root)}")
+        except ValueError:
+            flags.append(f"-L{resolved}")
+    flags.extend(f"-l{lib}" for lib in _strs(result.libs, "LIBS"))
+    for define in result.cppdefines:
+        # SCons also accepts dict/list CPPDEFINES; formatting those blind
+        # would hand the compiler garbage like -D{'FOO': '1'}
+        if isinstance(define, (tuple, list)) and len(define) == 2:
+            flags.append(f"-D{define[0]}={define[1]}")
+        elif isinstance(define, str):
+            flags.append(f"-D{define}")
+        else:
+            _LOGGER.warning("Ignoring unsupported CPPDEFINES entry %r", define)
+    flags.extend(_strs(result.linkflags, "LINKFLAGS"))
+    flags.extend(_strs(result.cppflags, "CPPFLAGS"))
+    return flags

esphome/platformio/library.py

@@ -13,7 +13,8 @@ regardless of which toolchain consumes the result.
 """
 
 from collections import deque
-from collections.abc import Callable
+from collections.abc import Callable, Iterable
+from concurrent.futures import ThreadPoolExecutor
 from dataclasses import dataclass, field
 import glob
 import hashlib
@@ -30,7 +31,14 @@ from urllib.request import url2pathname
 
 from esphome import git
 from esphome.core import CORE, EsphomeError, Library
-from esphome.framework_helpers import archive_extract_all, download_from_mirrors, rmdir
+from esphome.framework_helpers import (
+    BATCH_DOWNLOAD_WORKERS,
+    BatchDownloadProgress,
+    archive_extract_all,
+    download_from_mirrors,
+    rmdir,
+    run_batch_downloads,
+)
 
 _LOGGER = logging.getLogger(__name__)
 
@@ -47,20 +55,28 @@ DEFAULT_BUILD_SRC_FILTER = (
 DEFAULT_BUILD_SRC_DIRS = "src"
 DEFAULT_BUILD_INCLUDE_DIR = "include"
 DEFAULT_BUILD_FLAGS = []
-SRC_FILE_EXTENSIONS = [
-    ".c",
-    ".cpp",
-    ".cc",
-    ".cxx",
-    ".c++",
-    ".S",
-    ".spp",
-    ".SPP",
-    ".sx",
-    ".s",
-    ".asm",
-    ".ASM",
-]
+# Suffix -> compiler kind (PlatformIO's CSUFFIXES/CXXSUFFIXES/ASSUFFIXES).
+# "asm" merges SCons's AS and ASPP sets: all compile as assembler-with-cpp.
+# The kind values drive the ESP8266 native ninja rules (later in this
+# chain); existing backends consume only the keys. Note .C/.C++ join the
+# suffix set here, matching PlatformIO's CXXSUFFIXES.
+SOURCE_KIND_FOR_SUFFIX: dict[str, str] = {
+    ".c": "c",
+    ".cpp": "cxx",
+    ".cc": "cxx",
+    ".cxx": "cxx",
+    ".c++": "cxx",
+    ".C": "cxx",
+    ".C++": "cxx",
+    ".S": "asm",
+    ".spp": "asm",
+    ".SPP": "asm",
+    ".sx": "asm",
+    ".s": "asm",
+    ".asm": "asm",
+    ".ASM": "asm",
+}
+SRC_FILE_EXTENSIONS = list(SOURCE_KIND_FOR_SUFFIX)
 
 DOMAIN = "pio_components"
 
@@ -70,7 +86,12 @@ ESPHOME_DATA_EXTRA_CMAKE_KEY = "EXTRA_CMAKE"
 
 class Source:
     def download(
-        self, dir_suffix: str, force: bool = False, salt: str = "", namespace: str = ""
+        self,
+        dir_suffix: str,
+        force: bool = False,
+        salt: str = "",
+        namespace: str = "",
+        progress: Callable[[int], None] | None = None,
     ) -> Path:
         raise NotImplementedError
 
@@ -87,9 +108,7 @@ class URLSource(Source):
     def __init__(self, url: str):
         self.url = url
 
-    def download(
-        self, dir_suffix: str, force: bool = False, salt: str = "", namespace: str = ""
-    ) -> Path:
+    def _cache_dir(self, dir_suffix: str, salt: str, namespace: str) -> Path:
         # Namespace the cache per backend (e.g. pio_components/idf, .../zephyr) so
         # the build files each backend writes into the library dir can't collide.
         base_dir = Path(CORE.data_dir) / DOMAIN
@@ -99,7 +118,23 @@ class URLSource(Source):
         h.update(self.url.encode())
         if salt:
             h.update(salt.encode())
-        path = base_dir / h.hexdigest()[:8] / dir_suffix
+        return base_dir / h.hexdigest()[:8] / dir_suffix
+
+    def is_cached(self, dir_suffix: str, salt: str = "", namespace: str = "") -> bool:
+        """Whether a completed extraction already exists for this source."""
+        return (
+            self._cache_dir(dir_suffix, salt, namespace) / ".esphome_extracted"
+        ).is_file()
+
+    def download(
+        self,
+        dir_suffix: str,
+        force: bool = False,
+        salt: str = "",
+        namespace: str = "",
+        progress: Callable[[int], None] | None = None,
+    ) -> Path:
+        path = self._cache_dir(dir_suffix, salt, namespace)
         # Marker file written last to signal a complete extraction. Using a
         # marker (instead of just `path.is_dir()`) means an interrupted
         # extraction is correctly detected and re-run on the next invocation,
@@ -111,10 +146,12 @@ class URLSource(Source):
 
             # Download in temporary file
             with tempfile.NamedTemporaryFile() as tmp:
-                _LOGGER.info("Downloading %s ...", self.url)
+                if progress is None:
+                    # A batch caller draws one combined bar and logs the list
+                    _LOGGER.info("Downloading %s ...", self.url)
                 _LOGGER.debug("Location: %s", path)
 
-                download_from_mirrors([self.url], {}, tmp.file)
+                download_from_mirrors([self.url], {}, tmp.file, progress=progress)
 
                 _LOGGER.debug("Extracting archive to %s ...", path)
                 archive_extract_all(tmp.file, path)
@@ -131,7 +168,12 @@ class GitSource(Source):
         self.ref = ref
 
     def download(
-        self, dir_suffix: str, force: bool = False, salt: str = "", namespace: str = ""
+        self,
+        dir_suffix: str,
+        force: bool = False,
+        salt: str = "",
+        namespace: str = "",
+        progress: Callable[[int], None] | None = None,
     ) -> Path:
         domain = DOMAIN
         if namespace:
@@ -166,7 +208,12 @@ class LocalSource(Source):
         self.local_path = path
 
     def download(
-        self, dir_suffix: str, force: bool = False, salt: str = "", namespace: str = ""
+        self,
+        dir_suffix: str,
+        force: bool = False,
+        salt: str = "",
+        namespace: str = "",
+        progress: Callable[[int], None] | None = None,
     ) -> Path:
         src = Path(self.local_path)
         if not src.is_dir():
@@ -203,6 +250,14 @@ class InvalidLibrary(Exception):
     pass
 
 
+class IncompatiblePlatform(InvalidLibrary):
+    """The manifest's platform filter rejected the target platform.
+
+    A distinct type so callers can treat the routine cross-platform skip
+    differently from other manifest problems without matching message text.
+    """
+
+
 class ConvertedLibrary:
     """A resolved PlatformIO library plus its parsed manifest and on-disk path.
 
@@ -251,7 +306,13 @@ class ConvertedLibrary:
     def get_require_name(self):
         return self.get_sanitized_name().replace("/", "__")
 
-    def download(self, force: bool = False, salt: str = "", namespace: str = ""):
+    def download(
+        self,
+        force: bool = False,
+        salt: str = "",
+        namespace: str = "",
+        progress: Callable[[int], None] | None = None,
+    ):
         """Fetch the library into the shared cache and record its ``path``.
 
         The cache directory is named after the sanitized library name; backends
@@ -260,7 +321,11 @@ class ConvertedLibrary:
         ``get_require_name``). ``namespace`` keeps each backend's cache separate.
         """
         self.path = self.source.download(
-            self.get_sanitized_name(), force=force, salt=salt, namespace=namespace
+            self.get_sanitized_name(),
+            force=force,
+            salt=salt,
+            namespace=namespace,
+            progress=progress,
         )
         self.source_path = self.source.source_root(self.path)
 
@@ -432,7 +497,7 @@ def check_library_data(data: dict, platform: str | None, framework: str):
     valid_platforms = platform is None or "*" in platforms or platform in platforms
 
     if not valid_platforms:
-        raise InvalidLibrary(f"Unsupported library platforms: {platforms}")
+        raise IncompatiblePlatform(f"Unsupported library platforms: {platforms}")
 
     frameworks = data.get("frameworks", "*")
     if isinstance(frameworks, str):
@@ -455,7 +520,7 @@ def check_library_data(data: dict, platform: str | None, framework: str):
         )
 
 
-def _parse_library_json(library_json_path: PathType):
+def parse_library_json(library_json_path: PathType):
     """
     Load and parse a JSON file describing a library.
 
@@ -469,7 +534,7 @@ def _parse_library_json(library_json_path: PathType):
         return json.load(fp)
 
 
-def _parse_library_properties(library_properties_path: PathType):
+def parse_library_properties(library_properties_path: PathType):
     """
     Parse a key-value platformio .properties style file into a dictionary.
 
@@ -553,19 +618,147 @@ def _resolve_registry_version(
     return owner, name, best["name"], pkgfile["download_url"]
 
 
-def _normalize_dependencies(dependencies: Any) -> list[dict]:
+def split_flag_entry(entry: Any, owner: str) -> list[str]:
+    """``shlex.split`` with a clean error naming the offending flags entry."""
+    # Late import: shlex is only needed when actually lexing flags
+    import shlex
+
+    try:
+        return shlex.split(entry)
+    except (ValueError, AttributeError, TypeError) as err:
+        # AttributeError/TypeError: a dict or number from a third-party
+        # manifest; name the entry instead of an opaque shlex traceback
+        raise EsphomeError(f"Malformed build flag {entry!r} in {owner}: {err}") from err
+
+
+def lex_build_flags(entries: str | list[str], owner: str) -> list[str]:
+    """Shell-lex ``build.flags`` entries the way PlatformIO's ParseFlags
+    does; bare -I/-L/-l/-D tokens re-glue to their argument."""
+    # Join per entry, as SCons's ParseFlags lexes each string independently:
+    # a dangling -I ending one entry must warn, not absorb the next entry's
+    # first token.
+    return [
+        token
+        for entry in ensure_list(entries)
+        for token in join_flag_args(split_flag_entry(entry, owner), owner)
+    ]
+
+
+# Flags whose argument may follow as a separate token; ParseFlags glues them
+BARE_ARG_FLAGS = frozenset({"-I", "-L", "-l", "-D"})
+
+
+def raise_on_empty_arg_flags(tokens: list[str], owner: str) -> None:
+    """Reject bare ``-I``/``-D``/``-L``/``-l`` tokens left by an empty glued
+    argument (``-D ""``).
+
+    Consumed by the ESP8266 native build generator (later in this chain)
+    for user build_flags; library manifests deliberately stay warn-and-drop.
+
+    Lives next to ``join_flag_args`` because the bare token is its
+    postcondition: a trailing bare flag is warned and dropped there, so a
+    surviving one always means an empty argument. gcc would eat the next
+    flag as the argument (or add the CWD for ``-L``); always a typo.
+    """
+    if empty := sorted({tok for tok in tokens if tok in BARE_ARG_FLAGS}):
+        raise EsphomeError(
+            f"{owner} contain empty-argument flag(s): {', '.join(empty)}"
+        )
+
+
+def join_flag_args(tokens: Iterable[str], owner: str) -> list[str]:
+    """Join a bare ``-I``/``-L``/``-l``/``-D`` with its following token,
+    the way PlatformIO's ParseFlags lexes them."""
+    out: list[str] = []
+    it = iter(tokens)
+    for tok in it:
+        if tok in BARE_ARG_FLAGS:
+            arg = next(it, None)
+            if arg is None:
+                _LOGGER.warning("Ignoring trailing '%s' in %s build flags", tok, owner)
+                break
+            tok += arg
+        out.append(tok)
+    return out
+
+
+def warn_properties_depends(name: str, data: object) -> None:
+    """Warn when a manifest declares dependencies only as ``depends=``.
+
+    The dependency walk reads the JSON ``dependencies`` key; the raw
+    ``library.properties`` spelling would otherwise drop silently.
+    """
+    if isinstance(data, dict) and not data.get("dependencies") and data.get("depends"):
+        # INFO: common and unactionable for transitive libraries; a WARNING
+        # on every build would train users to ignore the stream
+        _LOGGER.info(
+            "Library %s declares dependencies via library.properties "
+            "depends=, which are not resolved automatically; add them with "
+            "add_library() if needed",
+            name,
+        )
+
+
+def dependency_is_usable(
+    dep: dict, platform: str | None, framework: str, requester: str
+) -> bool:
+    """Compatibility filter for a manifest dependency: platform mismatches
+    skip at debug, any other ``InvalidLibrary`` warns naming the requester."""
+    try:
+        check_library_data(dep, platform, framework)
+    except IncompatiblePlatform as e:
+        _LOGGER.debug("Skip dependency %s of %s: %s", dep.get("name"), requester, e)
+        return False
+    except InvalidLibrary as e:
+        _LOGGER.warning(
+            "Skipping dependency %s of %s: %s", dep.get("name"), requester, e
+        )
+        return False
+    return True
+
+
+def _valid_dependency_entry(entry: dict, manifest_name: str) -> bool:
+    """Whether a normalized entry carries a usable name and version.
+
+    The name must be a non-empty string (every consumer indexes or joins
+    it); a present version must be a string (a container would raise from
+    ``set.add()``, an int fails opaquely inside the registry resolution).
+    Invalid entries warn naming the manifest.
+    """
+    name = entry.get("name")
+    if (
+        isinstance(name, str)
+        and name
+        and ("version" not in entry or isinstance(entry["version"], str))
+    ):
+        return True
+    _LOGGER.warning(
+        "Ignoring unrecognized dependency entry %r of %s", entry, manifest_name
+    )
+    return False
+
+
+def normalize_dependencies(
+    dependencies: Any, manifest_name: str = "manifest"
+) -> list[dict]:
     """Normalize a library manifest's ``dependencies`` to a list of dicts.
 
-    PIO's library.json accepts both the list-of-dicts form and the shorthand
-    dict form (``{"owner/Name": "version_spec"}``); normalize the latter so
-    callers see a uniform list.
+    PIO's library.json accepts the list-of-dicts form, the shorthand dict
+    form (``{"owner/Name": "version_spec"}``), bare name strings inside the
+    list, and a plain (possibly comma-separated) string; normalize them all
+    so callers see a uniform list. ``manifest_name`` names the manifest in the
+    warning for entries that cannot be normalized.
     """
     if not dependencies:
         return []
+    if isinstance(dependencies, str):
+        # A plain string is one or more comma-separated names; iterating it
+        # as a list would shred it into one-character "libraries"
+        return [{"name": n.strip()} for n in dependencies.split(",") if n.strip()]
     if isinstance(dependencies, dict):
         normalized = []
         for raw_name, spec in dependencies.items():
-            if "/" in raw_name:
+            if isinstance(raw_name, str) and "/" in raw_name:
                 owner, pkgname = raw_name.split("/", 1)
             else:
                 owner, pkgname = None, raw_name
@@ -574,9 +767,31 @@ def _normalize_dependencies(dependencies: Any) -> list[dict]:
                 entry.update(spec)
             else:
                 entry["version"] = spec
-            normalized.append(entry)
+            if _valid_dependency_entry(entry, manifest_name):
+                normalized.append(entry)
         return normalized
-    return [d for d in dependencies if isinstance(d, dict)]
+    if not isinstance(dependencies, (list, tuple)):
+        _LOGGER.warning(
+            "Ignoring unrecognized dependencies %r of %s",
+            dependencies,
+            manifest_name,
+        )
+        return []
+    normalized = []
+    for entry in dependencies:
+        if isinstance(entry, dict):
+            if _valid_dependency_entry(entry, manifest_name):
+                normalized.append(entry)
+        elif isinstance(entry, str) and entry:
+            # PIO also accepts a bare list of names ("dependencies": ["Wire"])
+            normalized.append({"name": entry})
+        else:
+            _LOGGER.warning(
+                "Ignoring unrecognized dependency entry %r of %s",
+                entry,
+                manifest_name,
+            )
+    return normalized
 
 
 @dataclass
@@ -688,6 +903,112 @@ def _node_key(
     return name, "registry", (owner, pkgname)
 
 
+def lib_ignore_set() -> set[str]:
+    """The ``lib_ignore`` names from ``esphome->platformio_options``,
+    normalized to lowercase short names (the part after the ``/``)."""
+    return {
+        name.split("/")[-1].lower()
+        for name in CORE.platformio_options.get("lib_ignore", [])
+    }
+
+
+def is_lib_ignored(name: str | None, lib_ignore: set[str]) -> bool:
+    """Whether ``name`` matches the normalized ``lib_ignore`` set."""
+    return (
+        bool(lib_ignore)
+        and name is not None
+        and (name.split("/")[-1].lower() in lib_ignore)
+    )
+
+
+def _content_lengths(urls: list[str]) -> list[int | None]:
+    """Content-Length per URL via HEAD requests; None when unknown."""
+    import requests
+
+    def head(url: str) -> int | None:
+        try:
+            resp = requests.head(url, timeout=10, allow_redirects=True)
+            if not resp.ok:
+                _LOGGER.debug("HEAD %s returned %s", url, resp.status_code)
+                return None
+            return int(resp.headers.get("content-length", 0)) or None
+        except (requests.RequestException, ValueError) as err:
+            _LOGGER.debug("HEAD %s failed: %s", url, err)
+            return None
+
+    with ThreadPoolExecutor(max_workers=min(BATCH_DOWNLOAD_WORKERS, len(urls))) as ex:
+        return list(ex.map(head, urls))
+
+
+def _prefetch_wave(
+    wave: list[tuple[str, ConvertedLibrary]], salt: str, namespace: str
+) -> None:
+    """Best-effort parallel download of a wave's registry archives.
+
+    The walk's own ``download()`` call stays authoritative (it surfaces real
+    failures, with resume); bars are suppressed since parallel bars would
+    interleave. Duplicate URLs prefetch once so two threads never extract
+    into the same cache directory.
+    """
+    components: list[ConvertedLibrary] = []
+    seen: set[str] = set()
+    for _key, component in wave:
+        if not isinstance(component.source, URLSource):
+            continue
+        if component.source.url in seen:
+            continue
+        seen.add(component.source.url)
+        try:
+            cached = component.source.is_cached(
+                component.get_sanitized_name(), salt=salt, namespace=namespace
+            )
+        except Exception as err:  # noqa: BLE001  # pylint: disable=broad-exception-caught
+            # Best-effort: a failing probe prefetches (and re-downloads)
+            _LOGGER.debug("Cache probe for %s failed: %s", component.name, err)
+            cached = False
+        if cached:
+            # A completed extraction downloads nothing; a warm build must
+            # stay silent
+            continue
+        components.append(component)
+    if len(components) < 2:
+        return
+    # One combined bar over the batch, sized by HEAD requests. An unknown
+    # size would mean a silent multi-MB download; fall back to sequential
+    # downloads with their per-file bars instead.
+    sizes = _content_lengths([c.source.url for c in components])
+    if not all(sizes):
+        # Announced before the sequential per-file downloads take over, so
+        # the fallback is distinguishable from a hang
+        _LOGGER.info(
+            "No Content-Length for %s; downloading sequentially",
+            ", ".join(
+                c.source.url
+                for c, size in zip(components, sizes, strict=True)
+                if not size
+            ),
+        )
+        return
+    _LOGGER.info(
+        "Downloading %d libraries: %s",
+        len(components),
+        ", ".join(c.name for c in components),
+    )
+
+    def _fetch(component: ConvertedLibrary):
+        return lambda tracker: component.download(
+            salt=salt, namespace=namespace, progress=tracker
+        )
+
+    failures = run_batch_downloads(
+        BatchDownloadProgress("Downloading libraries", sum(sizes)),
+        [(component.name, _fetch(component)) for component in components],
+    )
+    for name, err in failures:
+        # The sequential call below retries and raises the real error
+        _LOGGER.warning("Prefetch of %s failed (retrying sequentially): %s", name, err)
+
+
 def convert_libraries(
     libraries: list[Library], backend: LibraryBackend
 ) -> list[ConvertedLibrary]:
@@ -713,10 +1034,7 @@ def convert_libraries(
     """
     nodes: dict[str, _LibNode] = {}
 
-    lib_ignore = {
-        name.split("/")[-1].lower()
-        for name in CORE.platformio_options.get("lib_ignore", [])
-    }
+    lib_ignore = lib_ignore_set()
 
     # The generated build files inside the shared cache bake in the dependency
     # wiring, which lib_ignore changes; salt the cache path so configs with
@@ -728,11 +1046,6 @@ def convert_libraries(
         else ""
     )
 
-    def is_ignored(name: str | None) -> bool:
-        if not lib_ignore or name is None:
-            return False
-        return name.split("/")[-1].lower() in lib_ignore
-
     def add_spec(name: str | None, version: str | None, repository: str | None) -> str:
         key, kind, locator = _node_key(name, version, repository)
         node = nodes.get(key) or _LibNode(key=key, is_git=kind == "git")
@@ -781,7 +1094,7 @@ def convert_libraries(
     top_level = [
         add_spec(library.name, library.version, library.repository)
         for library in libraries
-        if not is_ignored(library.name)
+        if not is_lib_ignored(library.name, lib_ignore)
     ]
 
     # Collect + resolve to a fixpoint: a node is (re)resolved whenever its
@@ -792,105 +1105,132 @@ def convert_libraries(
     top_level_keys = set(top_level)
     worklist = deque(dict.fromkeys(top_level))
     while worklist:
-        key = worklist.popleft()
-        node = nodes[key]
+        # Drain the frontier sequentially (spec resolution mutates shared
+        # node state), then prefetch the wave's registry archives in
+        # parallel; the per-component download() below stays authoritative.
+        wave: list[tuple[str, ConvertedLibrary]] = []
+        while worklist:
+            key = worklist.popleft()
+            node = nodes[key]
 
-        # A node is queued once per referring edge; skip the (uncached) registry
-        # lookup + download + dependency walk unless its requirement set grew
-        # since the last resolve. Requirements only ever grow, so this still
-        # converges the fixpoint and terminates dependency cycles.
-        requirements = frozenset(node.requirements)
-        if resolved_requirements.get(key) == requirements:
-            continue
-        resolved_requirements[key] = requirements
+            # Re-resolve only when the requirement set grew; requirements
+            # only ever grow, so the fixpoint converges and cycles terminate
+            requirements = frozenset(node.requirements)
+            if resolved_requirements.get(key) == requirements:
+                continue
+            resolved_requirements[key] = requirements
 
-        if node.is_git:
-            component = ConvertedLibrary(key, "*", GitSource(node.url, node.ref))
-        elif node.is_local:
-            component = ConvertedLibrary(key, "*", LocalSource(node.local_path))
-        else:
-            owner, name, version, url = _resolve_registry_version(
-                node.owner, node.pkgname, node.requirements
-            )
-            component = ConvertedLibrary(
-                _owner_pkgname_to_name(owner, name), version, URLSource(url)
-            )
-        component.download(salt=salt, namespace=backend.cache_key)
+            if node.is_git:
+                component = ConvertedLibrary(key, "*", GitSource(node.url, node.ref))
+            elif node.is_local:
+                component = ConvertedLibrary(key, "*", LocalSource(node.local_path))
+            else:
+                owner, name, version, url = _resolve_registry_version(
+                    node.owner, node.pkgname, node.requirements
+                )
+                component = ConvertedLibrary(
+                    _owner_pkgname_to_name(owner, name), version, URLSource(url)
+                )
+            wave.append((key, component))
+        _prefetch_wave(wave, salt, backend.cache_key)
+        for key, component in wave:
+            node = nodes[key]
+            if frozenset(node.requirements) != resolved_requirements[key]:
+                # An earlier wave entry grew this node's requirements after
+                # the drain resolved it; downloading the superseded version
+                # would be wasted work, and the next wave re-resolves it
+                worklist.append(key)
+                continue
+            component.download(salt=salt, namespace=backend.cache_key)
 
-        source_dir = component.source_dir
-        library_json_path = source_dir / "library.json"
-        library_properties_path = source_dir / "library.properties"
-        has_json = library_json_path.is_file()
-        has_properties = library_properties_path.is_file()
-        if not has_json and not has_properties and not node.is_local:
-            # The shared cache can hold a broken copy (e.g. a clone or an
-            # extraction interrupted by a killed process). Force one
-            # re-download so a bad cache entry self-heals instead of failing
-            # every build until the user runs a full clean. A local source is
-            # read in place, so there is nothing to re-download.
-            _LOGGER.warning(
-                "Library %s at %s is missing library.json and library.properties; "
-                "re-downloading",
-                key,
-                source_dir,
-            )
-            component.download(force=True, salt=salt, namespace=backend.cache_key)
+            source_dir = component.source_dir
+            library_json_path = source_dir / "library.json"
+            library_properties_path = source_dir / "library.properties"
             has_json = library_json_path.is_file()
             has_properties = library_properties_path.is_file()
-        if has_json:
-            component.data = _parse_library_json(library_json_path)
-        elif has_properties:
-            component.data = _parse_library_properties(library_properties_path)
-        else:
-            # For a local library a missing manifest is user input, so raise
-            # EsphomeError (clean CLI message) like the missing-directory case;
-            # for registry/git a missing manifest means a corrupt cache, which
-            # is not user error, so keep RuntimeError.
-            error_cls = EsphomeError if node.is_local else RuntimeError
-            raise error_cls(
-                f"Invalid PIO library {key}: missing library.json and "
-                f"library.properties in {source_dir}"
-            )
+            if not has_json and not has_properties and not node.is_local:
+                # An interrupted clone/extraction self-heals with one forced
+                # re-download; a local source has nothing to re-download
+                _LOGGER.warning(
+                    "Library %s at %s is missing library.json and library.properties; "
+                    "re-downloading",
+                    key,
+                    source_dir,
+                )
+                component.download(force=True, salt=salt, namespace=backend.cache_key)
+                has_json = library_json_path.is_file()
+                has_properties = library_properties_path.is_file()
+            if has_json:
+                component.data = parse_library_json(library_json_path)
+            elif has_properties:
+                component.data = parse_library_properties(library_properties_path)
+            else:
+                # Local sources are user input (EsphomeError); a registry/git
+                # miss means a corrupt cache (RuntimeError)
+                error_cls = EsphomeError if node.is_local else RuntimeError
+                raise error_cls(
+                    f"Invalid PIO library {key}: missing library.json and "
+                    f"library.properties in {source_dir}"
+                )
 
-        try:
-            check_library_data(component.data, backend.platform, backend.framework)
-        except InvalidLibrary as e:
-            # Skip an incompatible transitive dependency, but fail fast if a
-            # top-level library the build explicitly requested is incompatible.
-            if key in top_level_keys:
-                raise RuntimeError(
-                    f"Requested library {key} is not compatible with "
-                    f"{backend.framework}: {e}"
-                ) from e
-            _LOGGER.debug("Skip incompatible dependency %s: %s", key, str(e))
-            continue
-        components[key] = component
+            if not isinstance(component.data, dict) or not isinstance(
+                component.data.get("build", {}), dict
+            ):
+                # A bare json.load imposes no shape; every backend dereferences
+                # data/build, so validate once here and name the library
+                raise EsphomeError(f"Library {key} has a malformed manifest")
+            warn_properties_depends(component.name, component.data)
 
-        # Requirements changed (we got past the short-circuit above), so
-        # (re)walk this component's dependencies.
-        node.edges = set()
-        for dependency in _normalize_dependencies(component.data.get("dependencies")):
-            if "name" not in dependency or "version" not in dependency:
-                continue
             try:
-                check_library_data(dependency, backend.platform, backend.framework)
+                check_library_data(component.data, backend.platform, backend.framework)
             except InvalidLibrary as e:
-                _LOGGER.debug("Skip dependency %s: %s", dependency.get("name"), str(e))
+                # An explicitly requested library fails fast; the routine
+                # cross-platform skip stays at debug, other causes warn
+                if key in top_level_keys:
+                    raise RuntimeError(
+                        f"Requested library {key} is not compatible with "
+                        f"{backend.framework}: {e}"
+                    ) from e
+                if isinstance(e, IncompatiblePlatform):
+                    _LOGGER.debug("Skip incompatible dependency %s: %s", key, str(e))
+                else:
+                    _LOGGER.warning("Skipping dependency %s: %s", key, str(e))
                 continue
-            dep_name = _owner_pkgname_to_name(
-                dependency.get("owner"), dependency.get("name")
-            )
-            if is_ignored(dep_name):
-                _LOGGER.debug("Skip ignored dependency %s", dep_name)
-                continue
-            # The version field may actually be a URL (git/archive dependency).
-            dep_version = dependency["version"]
-            dep_url = _url_or_none(dep_version)
-            if dep_url is not None:
-                dep_version = None
-            dep_key = add_spec(dep_name, dep_version, dep_url)
-            node.edges.add(dep_key)
-            worklist.append(dep_key)
+            components[key] = component
+
+            # Requirements changed (we got past the short-circuit above), so
+            # (re)walk this component's dependencies.
+            node.edges = set()
+            for dependency in normalize_dependencies(
+                component.data.get("dependencies"), component.name
+            ):
+                if "version" not in dependency:
+                    # Cannot resolve from the registry; the arduino-backend
+                    # PR adds the reconciliation that reports real drops
+                    _LOGGER.debug(
+                        "Skip version-less dependency %r of %s",
+                        dependency.get("name"),
+                        component.name,
+                    )
+                    continue
+                if not dependency_is_usable(
+                    dependency, backend.platform, backend.framework, component.name
+                ):
+                    continue
+                dep_name = _owner_pkgname_to_name(
+                    dependency.get("owner"), dependency.get("name")
+                )
+                if is_lib_ignored(dep_name, lib_ignore):
+                    _LOGGER.debug("Skip ignored dependency %s", dep_name)
+                    continue
+                # The version field may actually be a URL (git/archive dependency).
+                dep_version = dependency["version"]
+                dep_url = _url_or_none(dep_version)
+                if dep_url is not None:
+                    dep_version = None
+                dep_key = add_spec(dep_name, dep_version, dep_url)
+                node.edges.add(dep_key)
+                worklist.append(dep_key)
 
     # A git or local source wins over the same component requested from the
     # registry. That's intentional, but warn so the dropped registry spec isn't

esphome/platformio/registry.py

@@ -0,0 +1,280 @@
+"""Install packages from the PlatformIO registry without importing the
+platformio package (identical bits, esphome's own download machinery)."""
+
+from __future__ import annotations
+
+from collections.abc import Collection
+import io
+import json
+import logging
+import os
+from pathlib import Path
+import platform
+
+from esphome.core import EsphomeError
+from esphome.framework_helpers import (
+    BatchDownloadProgress,
+    archive_extract_all,
+    download_from_mirrors,
+    download_with_resume,
+    rmdir,
+    run_batch_downloads,
+)
+
+_LOGGER = logging.getLogger(__name__)
+
+_REGISTRY_URL = (
+    "https://api.registry.platformio.org/v3/packages/platformio/tool/{package}"
+)
+
+
+def get_systype() -> str:
+    """The registry system tag for the current host.
+
+    Transliterates ``platformio.util.get_systype()`` (same
+    ``PLATFORMIO_SYSTEM_TYPE`` override). Deviation: windows-arm64 maps to
+    ``windows_amd64`` (no arm64 toolchains; x86 emulation).
+    """
+    if systype := os.environ.get("PLATFORMIO_SYSTEM_TYPE"):
+        return systype
+    system = platform.system().lower()
+    arch = platform.machine().lower()
+    if system == "windows":
+        if not arch:  # same fallback as upstream (platformio issue #4353)
+            arch = "x86_" + platform.architecture()[0]
+        if "x86" in arch:
+            arch = "amd64" if "64" in arch else "x86"
+        elif arch == "arm64":
+            arch = "amd64"
+    if arch == "aarch64" and platform.architecture()[0] == "32bit":
+        # 64-bit kernel with a 32-bit userland (e.g. 32-bit Raspberry Pi OS)
+        arch = "armv7l"
+    return f"{system}_{arch}" if arch else system
+
+
+def registry_download(package: str, version: str) -> tuple[str, str, int | None]:
+    """Resolve a package's download URL, sha256, and size via the registry.
+
+    The metadata fetch goes through ``download_from_mirrors`` so it shares
+    the retry, backoff, and error reporting of every other download here.
+    """
+    buf = io.BytesIO()
+    download_from_mirrors([_REGISTRY_URL], {"package": package}, buf)
+    try:
+        data = json.loads(buf.getvalue())
+    except ValueError as err:
+        raise EsphomeError(
+            f"The package registry returned invalid JSON for {package}: {err}"
+        ) from err
+    if not isinstance(data, dict):
+        raise EsphomeError(
+            f"Unexpected package registry response for {package}: {str(data)[:200]}"
+        )
+    systype = get_systype()
+    versions = data.get("versions")
+    if not isinstance(versions, list):
+        # A schema change or an error/captive-portal payload must not be
+        # reported as "version not found"
+        raise EsphomeError(
+            f"Unexpected package registry response for {package}: {str(data)[:200]}"
+        )
+    for ver in versions:
+        if not isinstance(ver, dict):
+            raise EsphomeError(
+                f"Unexpected package registry response for {package}: {str(data)[:200]}"
+            )
+        if ver.get("name") != version:
+            continue
+        files = ver.get("files")
+        if not isinstance(files, list):
+            raise EsphomeError(
+                f"Unexpected package registry response for {package}: {str(ver)[:200]}"
+            )
+        for file in files:
+            if not isinstance(file, dict):
+                raise EsphomeError(
+                    f"Unexpected package registry response for {package}: "
+                    f"{str(ver)[:200]}"
+                )
+            # Only a missing key means "any system"; an empty list must not
+            # match, and a bare string would make ``in`` a substring test.
+            systems = file.get("system")
+            if systems is None:
+                systems = ["*"]
+            elif isinstance(systems, str):
+                systems = [systems]
+            elif not isinstance(systems, list):
+                # An int would make ``in`` a TypeError and a dict a key test
+                raise EsphomeError(
+                    f"Unexpected package registry response for {package}: "
+                    f"{str(file)[:200]}"
+                )
+            if "*" in systems or systype in systems:
+                sha256 = (file.get("checksum") or {}).get("sha256")
+                if not sha256:
+                    # Never extract an unverified archive; the registry
+                    # publishes a checksum for every package file.
+                    raise EsphomeError(
+                        f"The package registry returned no sha256 for "
+                        f"{package} {version}; refusing the unverified download"
+                    )
+                url = file.get("download_url")
+                if not url:
+                    raise EsphomeError(
+                        f"The package registry returned no download URL for "
+                        f"{package} {version}"
+                    )
+                return (url, sha256, file.get("size"))
+        raise EsphomeError(
+            f"No {package} {version} build for this platform ({systype})"
+        )
+    raise EsphomeError(f"{package} {version} not found in the package registry")
+
+
+def _check_layout(name: str, dest: Path, expect: Collection[str]) -> None:
+    """Raise when an install tree is missing an expected directory (runs on
+    fresh extracts and on marker hits)."""
+    for rel in expect:
+        if not (dest / rel).is_dir():
+            raise EsphomeError(
+                f"{name} at {dest} is missing the expected {rel} "
+                "directory; run 'esphome clean-all' and retry"
+            )
+
+
+def prefetch_packages(
+    packages: list[tuple[str, str, Path, list[str]]], downloads_dir: Path
+) -> None:
+    """Download pending package archives in parallel under one combined bar.
+
+    ``packages`` holds ``(name, version, dest, mirrors)`` per package. Purely
+    an optimization: ``install_package`` verifies every archive and
+    re-downloads anything this pass left unfinished. Mirror overrides and
+    registry entries without a size stay on the sequential path so its
+    per-file bars remain trustworthy. Each fetch holds the same per-dest
+    lock as ``install_package``: the archive's ``.part`` file is shared, and
+    two concurrent writers would truncate each other's bytes.
+    """
+    from filelock import FileLock
+
+    pending: list[tuple[str, str, Path, str, str, int]] = []
+    seen: set[str] = set()
+    for name, version, dest, mirrors in packages:
+        if mirrors or (dest / ".esphome_extracted").is_file():
+            continue
+        archive_name = f"{name}-{version}"
+        if archive_name in seen:
+            # A duplicate entry would race itself between two workers
+            continue
+        seen.add(archive_name)
+        try:
+            url, sha256, size = registry_download(name, version)
+        except EsphomeError as err:
+            # The sequential install reports the real failure with context
+            _LOGGER.debug("Prefetch resolve for %s failed: %s", name, err)
+            continue
+        if not size:
+            continue
+        archive = downloads_dir / archive_name
+        if archive.is_file() and archive.stat().st_size == size:
+            continue
+        pending.append((name, version, dest, url, sha256, size))
+    if len(pending) < 2:
+        return
+    downloads_dir.mkdir(parents=True, exist_ok=True)
+    _LOGGER.info(
+        "Downloading %d package archive(s): %s",
+        len(pending),
+        ", ".join(name for name, *_ in pending),
+    )
+
+    def _fetch(entry: tuple[str, str, Path, str, str, int]):
+        name, version, dest, url, sha256, size = entry
+
+        def fetch(tracker):
+            dest.parent.mkdir(parents=True, exist_ok=True)
+            with FileLock(f"{dest}.lock", fallback_to_soft=False):
+                download_with_resume(
+                    url,
+                    downloads_dir / f"{name}-{version}",
+                    sha256=sha256,
+                    size=size,
+                    progress=tracker,
+                )
+
+        return fetch
+
+    failures = run_batch_downloads(
+        BatchDownloadProgress(
+            "Downloading packages", sum(size for *_, size in pending)
+        ),
+        [(entry[0], _fetch(entry)) for entry in pending],
+    )
+    for name, err in failures:
+        if isinstance(err, (EsphomeError, OSError)):
+            # Expected download failures: install_package retries this one
+            # itself, with a visible bar
+            _LOGGER.debug("Prefetch of %s failed: %s", name, err)
+        else:
+            # Anything else is a programming error that would otherwise
+            # become a permanent silent no-op
+            _LOGGER.warning("Prefetch of %s failed: %r", name, err)
+
+
+def install_package(
+    name: str,
+    version: str,
+    dest: Path,
+    mirrors: list[str],
+    downloads_dir: Path,
+    expect: Collection[str],
+) -> None:
+    """Download, verify, and extract one package if not already installed.
+
+    The registry path is integrity-checked against the sha256 the registry
+    publishes; a mirror override (URL templates with ``{VERSION}``/``{SYSTEM}``
+    substitution) is trusted as configured. ``downloads_dir`` holds the
+    archive between runs so an interrupted download resumes.
+    """
+    if not expect:
+        # Layout validation before marker.touch() is the only guard against
+        # caching a truncated mirror archive as a good install
+        raise ValueError("install_package requires a non-empty expect")
+    marker = dest / ".esphome_extracted"
+    if marker.is_file():
+        _check_layout(name, dest, expect)
+        return
+    from filelock import FileLock
+
+    # Serialize concurrent cold builds (same filelock pattern as git.py).
+    dest.parent.mkdir(parents=True, exist_ok=True)
+    # A soft-lock fallback would turn a hard-killed run into a permanent
+    # hang (see git.py).
+    with FileLock(f"{dest}.lock", fallback_to_soft=False):
+        if marker.is_file():
+            # Another process finished the install while we waited
+            return
+        rmdir(dest, msg=f"Clean up incomplete {name} install")
+        # Persistent location so an interrupted download resumes across runs.
+        downloads_dir.mkdir(parents=True, exist_ok=True)
+        archive = downloads_dir / f"{name}-{version}"
+        _LOGGER.info("Downloading %s %s ...", name, version)
+        if mirrors:
+            _LOGGER.warning(
+                "Downloading %s from a mirror override; checksum verification "
+                "is skipped for mirrors",
+                name,
+            )
+            download_from_mirrors(
+                mirrors, {"VERSION": version, "SYSTEM": get_systype()}, archive
+            )
+        else:
+            url, sha256, size = registry_download(name, version)
+            download_with_resume(url, archive, sha256=sha256, size=size)
+        _LOGGER.info("Extracting %s ...", name)
+        archive_extract_all(archive, dest, progress_header="Extracting")
+        # Validate the layout before recording success, so an unexpected
+        # package is never cached as a working install.
+        _check_layout(name, dest, expect)
+        marker.touch()
+        archive.unlink(missing_ok=True)

esphome/platformio/toolchain.py

@@ -4,19 +4,18 @@ import logging
 import os
 from pathlib import Path
 import re
-import shutil
-import subprocess
 import sys
 from typing import TYPE_CHECKING, Any
 
 import platformdirs
 
+from esphome.build_helpers.ccache import resolve_ccache_path
 from esphome.const import CONF_COMPILE_PROCESS_LIMIT, CONF_ESPHOME, KEY_CORE
 from esphome.core import CORE, EsphomeError
+from esphome.framework_helpers import strip_win_long_path_prefix
 from esphome.helpers import (
     add_git_ceiling_directory,
     copy_file_if_changed,
-    get_bool_env,
     rmtree,
     write_file,
 )
@@ -41,40 +40,6 @@ _PIO_PYTHON_STAMP_LOCK = ".esphome.pio.stamp.lock"
 _PIO_PYTHON_STAMP_SCHEMA = "0"
 
 
-def _strip_win_long_path_prefix(path: str) -> str:
-    r"""Strip the Windows extended-length path prefix from ``path``.
-
-    Handles both forms documented at
-    https://learn.microsoft.com/windows/win32/fileio/naming-a-file:
-
-    * ``\\?\C:\path\to\file`` -> ``C:\path\to\file``
-    * ``\\?\UNC\server\share\path`` -> ``\\server\share\path``
-
-    The NSIS-installed ``esphome.exe`` launcher on Windows starts Python with
-    ``sys.executable`` already prefixed with ``\\?\``. That prefix propagates
-    into PlatformIO's ``$PYTHONEXE`` (PlatformIO reads ``PYTHONEXEPATH`` from
-    the environment, falling back to ``os.path.normpath(sys.executable)``)
-    and ends up baked into SCons-emitted command lines for build steps such
-    as the esp8266 ``elf2bin`` invocation. ``cmd.exe`` does not understand
-    the ``\\?\`` prefix, so the build fails with
-    "The system cannot find the path specified." Stripping the prefix early
-    keeps the path shell-quotable.
-
-    Also applied to the ccache path exported by ``_ccache_env()``, which
-    ``shutil.which`` can return with the same prefix.
-
-    No-op on non-Windows platforms.
-    """
-    if sys.platform != "win32":
-        return path
-    if path.startswith("\\\\?\\UNC\\"):
-        # \\?\UNC\server\share\... -> \\server\share\...
-        return "\\\\" + path[len("\\\\?\\UNC\\") :]
-    if path.startswith("\\\\?\\"):
-        return path[len("\\\\?\\") :]
-    return path
-
-
 def get_platformio_config() -> "ProjectConfig | None":
     """Return PlatformIO's ``ProjectConfig``, or None when PlatformIO is absent."""
     try:
@@ -238,32 +203,6 @@ def _check_platformio_python_stamp(config: "ProjectConfig") -> None:
         _write_pio_stamp_python(stamp_file, current)
 
 
-def _ccache_runs(ccache: str) -> bool:
-    """Return True when the ``ccache`` found on PATH actually runs.
-
-    ``shutil.which`` proves existence, not runnability: on Windows it also
-    matches ``.bat``/``.cmd`` wrappers and stale package-manager shims whose
-    target is gone. Wrapping compiles around such a find fails every compile
-    step with an opaque OS error, so probe once and fall back to compiling
-    without ccache when the probe fails.
-    """
-    try:
-        subprocess.run(
-            [ccache, "--version"],
-            check=True,
-            stdout=subprocess.DEVNULL,
-            stderr=subprocess.DEVNULL,
-            timeout=15,
-        )
-    except (OSError, subprocess.SubprocessError):
-        _LOGGER.warning(
-            "Ignoring ccache at %s because it failed to run; compiling without ccache",
-            ccache,
-        )
-        return False
-    return True
-
-
 def _ccache_env() -> dict[str, str]:
     r"""Return ccache settings for PlatformIO builds.
 
@@ -282,7 +221,7 @@ def _ccache_env() -> dict[str, str]:
     runs fine through ``CreateProcess``, which is how ESP-IDF invokes it,
     but SCons runs every compile through ``cmd.exe``, which fails on it with
     "The system cannot find the path specified." (#18399), so the prefix is
-    stripped here with ``_strip_win_long_path_prefix()`` before the
+    stripped here with ``strip_win_long_path_prefix()`` before the
     runnability probe, which therefore validates the exact string the build
     will execute.
     ``ESPHOME_CCACHE_PATH`` is an internal channel, not a user setting: the
@@ -308,22 +247,8 @@ def _ccache_env() -> dict[str, str]:
     build dir. The other ``CCACHE_*`` values the user already set in the
     environment are respected.
     """
-    explicit = "ESPHOME_CCACHE_ENABLE" in os.environ
-    if explicit and not get_bool_env("ESPHOME_CCACHE_ENABLE"):
-        return {"ESPHOME_CCACHE_ENABLE": "0"}
-    ccache_path = shutil.which("ccache")
+    ccache_path = resolve_ccache_path()
     if ccache_path is None:
-        if explicit:
-            _LOGGER.warning(
-                "ESPHOME_CCACHE_ENABLE is set but no ccache binary is on PATH; "
-                "compiling without ccache"
-            )
-        return {"ESPHOME_CCACHE_ENABLE": "0"}
-    # Strip before probing so the probe validates (and the failure warning
-    # names) the exact string the build will execute through cmd.exe.
-    ccache_path = _strip_win_long_path_prefix(ccache_path)
-    # An explicit opt-in skips the runnability probe.
-    if not explicit and not _ccache_runs(ccache_path):
         return {"ESPHOME_CCACHE_ENABLE": "0"}
     env = {
         "ESPHOME_CCACHE_ENABLE": "1",
@@ -385,7 +310,7 @@ def run_platformio_cli(*args, **kwargs) -> str | int:
     # Strip the Windows extended-length path prefix from sys.executable so it
     # doesn't propagate into PlatformIO's $PYTHONEXE and break SCons-emitted
     # command lines run through cmd.exe.
-    python_exe = _strip_win_long_path_prefix(sys.executable)
+    python_exe = strip_win_long_path_prefix(sys.executable)
     if python_exe != sys.executable:
         # Only override PYTHONEXEPATH when we actually stripped a prefix.
         # PlatformIO's get_pythonexe_path() reads this and falls back to

esphome/writer.py

@@ -288,11 +288,13 @@ def copy_src_tree():
             # Source file removed, delete target
             p.unlink()
             if target not in generated_files:
+                _LOGGER.debug("Source removed: %s", target)
                 sources_changed = True
         else:
             src_file = source_files_copy.pop(target)
             with src_file.path() as src_path:
                 if copy_file_if_changed(src_path, p) and target not in generated_files:
+                    _LOGGER.debug("Source changed: %s", target)
                     sources_changed = True
 
     # Now copy new files
@@ -303,21 +305,25 @@ def copy_src_tree():
                 copy_file_if_changed(src_path, dst_path)
                 and target not in generated_files
             ):
+                _LOGGER.debug("Source added: %s", target)
                 sources_changed = True
 
     # Finally copy defines
     if write_file_if_changed(
         CORE.relative_src_path("esphome", "core", "defines.h"), generate_defines_h()
     ):
+        _LOGGER.debug("Source changed: esphome/core/defines.h")
         sources_changed = True
     write_file_if_changed(CORE.relative_build_path("README.txt"), ESPHOME_README_TXT)
     if write_file_if_changed(
         CORE.relative_src_path("esphome.h"), ESPHOME_H_FORMAT.format(include_s)
     ):
+        _LOGGER.debug("Source changed: esphome.h")
         sources_changed = True
     if write_file_if_changed(
         CORE.relative_src_path("esphome", "core", "version.h"), generate_version_h()
     ):
+        _LOGGER.debug("Source changed: esphome/core/version.h")
         sources_changed = True
 
     # Generate new build_info files if needed
@@ -332,18 +338,13 @@ def copy_src_tree():
 
     # Defensively force a rebuild if the build_info files don't exist, or if
     # there was a config change which didn't actually cause a source change
-    if not build_info_data_h_path.exists() or not build_info_data_cpp_path.exists():
+    if _build_info_stale(
+        build_info_data_h_path,
+        build_info_data_cpp_path,
+        build_info_json_path,
+        config_hash,
+    ):
         sources_changed = True
-    else:
-        try:
-            existing = json.loads(build_info_json_path.read_text(encoding="utf-8"))
-            if (
-                existing.get("config_hash") != config_hash
-                or existing.get("esphome_version") != __version__
-            ):
-                sources_changed = True
-        except (json.JSONDecodeError, KeyError, OSError):
-            sources_changed = True
 
     # Write build_info header and JSON metadata
     if sources_changed:
@@ -397,6 +398,38 @@ def generate_version_h():
     )
 
 
+def _build_info_stale(
+    h_path: Path, cpp_path: Path, json_path: Path, config_hash: int
+) -> bool:
+    """Whether the build-info sources must regenerate (missing or stale)."""
+    if not h_path.exists() or not cpp_path.exists():
+        _LOGGER.debug("Build info files missing; regenerating")
+        return True
+    try:
+        existing = json.loads(json_path.read_text(encoding="utf-8"))
+    except (json.JSONDecodeError, OSError):
+        _LOGGER.debug("Build info JSON unreadable; regenerating")
+        return True
+    if not isinstance(existing, dict):
+        # Valid JSON that is not an object (truncated or hand-edited) is
+        # stale, not a traceback
+        _LOGGER.debug("Build info JSON malformed; regenerating")
+        return True
+    if (
+        existing.get("config_hash") != config_hash
+        or existing.get("esphome_version") != __version__
+    ):
+        _LOGGER.debug(
+            "Build info stale (config_hash %s -> %s, version %s -> %s)",
+            existing.get("config_hash"),
+            config_hash,
+            existing.get("esphome_version"),
+            __version__,
+        )
+        return True
+    return False
+
+
 def get_build_info() -> tuple[int, int, str, str]:
     """Calculate build_info values from current config.
 
@@ -657,14 +690,17 @@ def clean_all(configuration: list[str]):
     # the per-config loop above can't reach. Wipe the default cache root
     # (also catches leftovers from older install layouts), then the resolved
     # install paths for the ESPHOME_*_PREFIX overrides (docker/add-on/CI)
-    # that live outside it.
+    # that live outside it. Every backend's cache is listed in
+    # TOOLS_CACHE_SPECS, so registering one there is the only step.
     import platformdirs
 
-    from esphome.components.nrf52.framework import get_sdk_nrf_tools_path
-    from esphome.espidf.framework import get_idf_tools_path
+    from esphome.build_helpers.tools_cache import TOOLS_CACHE_SPECS, tools_cache_path
 
     cache_root = Path(platformdirs.user_cache_dir("esphome", appauthor=False)).resolve()
-    for install_path in (cache_root, get_idf_tools_path(), get_sdk_nrf_tools_path()):
+    install_paths = [cache_root] + [
+        tools_cache_path(*spec) for spec in TOOLS_CACHE_SPECS
+    ]
+    for install_path in install_paths:
         if install_path.is_dir():
             _LOGGER.info("Deleting %s", install_path)
             rmtree(install_path)

platformio.ini

@@ -45,7 +45,7 @@ lib_deps_base =
 lib_deps =
     ${common.lib_deps_base}
     https://github.com/dudanov/MideaUART.git#eeea6c3e9b4474f067054592b435be1c4e466815 ; midea
-    esphome/noise-c@0.1.21                 ; noise (api, ota)
+    esphome/noise-c@0.1.21                 ; api
     improv/Improv@1.2.6                    ; improv_serial / esp32_improv
     kikuchan98/pngle@1.1.0                 ; online_image
     ; Using the repository directly, otherwise ESP-IDF can't use the library
@@ -244,7 +244,7 @@ lib_deps =
     ${common:idf-component-libs.lib_deps}
     ESP32Async/ESPAsyncWebServer@3.9.6    ; web_server_base
     droscy/esp_wireguard@0.4.5            ; wireguard
-    esphome/noise-c@0.1.21                ; noise (api, ota)
+    esphome/noise-c@0.1.21                ; api
     ESP32Async/AsyncTCP@3.4.5             ; async_tcp
     DNSServer                             ; captive_portal
     heman/AsyncMqttClient-esphome@2.0.0   ; mqtt
@@ -641,7 +641,7 @@ build_unflags =
 extends = common
 platform = platformio/native
 lib_deps =
-    esphome/noise-c@0.1.21  ; used by noise (api, ota)
+    esphome/noise-c@0.1.21  ; used by api
     lvgl/lvgl@9.5.0         ; lvgl
 build_flags =
     ${common.build_flags}

requirements.txt

@@ -28,6 +28,7 @@ smpclient==7.2.0
 requests==2.34.2
 py7zr==1.1.3
 platformdirs==4.11.3  # native esp-idf toolchain global cache dir
+ninja==1.13.0  # native esp8266 arduino toolchain build driver
 filelock==3.32.3  # inter-process locks (PlatformIO cache heal, git clone cache); >=3.32 for FileLock(fallback_to_soft=...), older versions silently drop the kwarg
 
 # esp-idf >= 5.0 requires this

script/determine-jobs.py

@@ -525,13 +525,21 @@ def _esp32_platformio_path_or_file_trigger(files: list[str]) -> bool:
     return False
 
 
-# ESP-IDF infra: changes under esphome/espidf/ or to the IDF build generator
-# affect every esp32 IDF build (now the default toolchain) but aren't
+# Native-build infra: changes under esphome/espidf/, the shared
+# esphome/build_helpers/ package, or the modules the native ESP-IDF build
+# imports affect every esp32 IDF build (now the default toolchain) but aren't
 # components, so the component matrix wouldn't otherwise force any esp32
 # compile. When they change we fold the `esp32` component into the matrix so
 # the default native-IDF build path is still compiled on an infra-only PR.
-ESP_IDF_INFRA_TRIGGER_PATH_PREFIXES = ("esphome/espidf/",)
-ESP_IDF_INFRA_TRIGGER_FILES = frozenset({"esphome/build_gen/espidf.py"})
+ESP_IDF_INFRA_TRIGGER_PATH_PREFIXES = ("esphome/espidf/", "esphome/build_helpers/")
+ESP_IDF_INFRA_TRIGGER_FILES = frozenset(
+    {
+        "esphome/build_gen/espidf.py",
+        "esphome/framework_helpers.py",
+        "esphome/platformio/library.py",
+        "esphome/platformio/extra_script.py",
+    }
+)
 
 
 def _esp_idf_infra_changed(files: list[str]) -> bool:

tests/benchmarks/components/api/__init__.py

@@ -3,9 +3,8 @@ from tests.testing_helpers import ComponentManifestOverride
 
 
 def override_manifest(manifest: ComponentManifestOverride) -> None:
-    # api must run its to_code to define USE_API and USE_API_NOISE. The
-    # AUTO_LOADed noise component runs its own to_code via the override in
-    # tests/benchmarks/components/noise/__init__.py.
+    # api must run its to_code to define USE_API, USE_API_PLAINTEXT,
+    # and add the noise-c library dependency.
     manifest.enable_codegen()
 
     original_to_code = manifest.to_code

tests/benchmarks/components/noise/__init__.py

@@ -1,7 +0,0 @@
-from tests.testing_helpers import ComponentManifestOverride
-
-
-def override_manifest(manifest: ComponentManifestOverride) -> None:
-    # to_code must run: it defines USE_NOISE and adds the noise-c library
-    # the api benchmark sources need.
-    manifest.enable_codegen()

tests/component_tests/esp32/test_esp32.py

@@ -131,6 +131,20 @@ def test_esp32_rejects_unsupported_toolchains(
         CONFIG_SCHEMA({"variant": VARIANT_ESP32, "toolchain": config_toolchain})
 
 
+def test_esp32_rejects_unsupported_cli_toolchain(
+    set_core_config: SetCoreConfigCallable,
+) -> None:
+    """A --toolchain the platform cannot serve fails instead of silently
+    building with PlatformIO (the CLI path bypasses the YAML validator)."""
+    set_core_config(PlatformFramework.ESP32_IDF)
+
+    from esphome.components.esp32 import CONFIG_SCHEMA
+
+    CORE.toolchain = Toolchain.ARDUINO
+    with pytest.raises(cv.Invalid, match="Unsupported toolchain 'arduino'"):
+        CONFIG_SCHEMA({"variant": VARIANT_ESP32})
+
+
 @pytest.mark.parametrize(
     ("config", "error_match"),
     [

tests/component_tests/noise/test_encryption_key.py

@@ -1,37 +0,0 @@
-"""Tests for the shared noise encryption key helpers."""
-
-from __future__ import annotations
-
-import pytest
-
-from esphome import config_validation as cv
-from esphome.components.noise import decode_encryption_key, validate_encryption_key
-
-KEY = "AAECAwQFBgcICQoLDA0ODxAREhMUFRYXGBkaGxwdHh8="
-
-
-def test_validate_encryption_key_roundtrips() -> None:
-    assert validate_encryption_key(KEY) == KEY
-
-
-@pytest.mark.parametrize("value", ["not-base64!!!", "AAECAw=="])
-def test_validate_encryption_key_rejects_bad_input(value: str) -> None:
-    with pytest.raises(cv.Invalid):
-        validate_encryption_key(value)
-
-
-def test_decode_encryption_key_returns_32_bytes() -> None:
-    assert decode_encryption_key(KEY) == bytes(range(32))
-
-
-def test_decode_encryption_key_rejects_invalid_base64() -> None:
-    """The shared helper raises cv.Invalid, not binascii.Error."""
-    with pytest.raises(cv.Invalid, match="base64"):
-        decode_encryption_key("A")
-
-
-def test_decode_encryption_key_rejects_short_decode() -> None:
-    """a2b_base64 stops at embedded padding; a short decode must not become
-    a zero padded PSK on the device."""
-    with pytest.raises(cv.Invalid, match="32 bytes"):
-        decode_encryption_key("AAECAw==")

tests/component_tests/ota/test_esphome_ota.py

@@ -8,25 +8,17 @@ from typing import Any
 import pytest
 
 from esphome import config_validation as cv
-from esphome.components.esphome.ota import (
-    AUTO_LOAD,
-    FILTER_SOURCE_FILES,
-    _validate_no_password_with_encryption,
-    ota_esphome_final_validate,
-)
+from esphome.components.esphome.ota import ota_esphome_final_validate
 from esphome.const import (
-    CONF_API,
-    CONF_ENCRYPTION,
     CONF_ESPHOME,
     CONF_ID,
-    CONF_KEY,
     CONF_OTA,
     CONF_PASSWORD,
     CONF_PLATFORM,
     CONF_PORT,
     CONF_VERSION,
 )
-from esphome.core import CORE, ID
+from esphome.core import ID
 import esphome.final_validate as fv
 
 
@@ -111,301 +103,3 @@ def test_non_esphome_ota_unaffected() -> None:
         assert len(updated[CONF_OTA]) == 3
     finally:
         fv.full_config.reset(token)
-
-
-API_KEY = "AAECAwQFBgcICQoLDA0ODxAREhMUFRYXGBkaGxwdHh8="
-OTHER_KEY = "AQIDBAUGBwgJCgsMDQ4PEBESExQVFhcYGRobHB0eHyA="
-ZEROS_KEY = "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA="
-
-
-def test_encryption_key_inherited_from_api() -> None:
-    """A bare encryption block resolves to the api encryption key."""
-    full_conf = {
-        CONF_API: {CONF_ENCRYPTION: {CONF_KEY: API_KEY}},
-        CONF_OTA: [_make_ota_config(port=3232, **{CONF_ENCRYPTION: {}})],
-    }
-    token = fv.full_config.set(full_conf)
-    try:
-        ota_esphome_final_validate({})
-        updated = fv.full_config.get()
-        assert updated[CONF_OTA][0][CONF_ENCRYPTION][CONF_KEY] == API_KEY
-    finally:
-        fv.full_config.reset(token)
-
-
-def test_encryption_explicit_key_matching_api_accepted() -> None:
-    """An explicit ota key equal to the api key validates."""
-    full_conf = {
-        CONF_API: {CONF_ENCRYPTION: {CONF_KEY: API_KEY}},
-        CONF_OTA: [
-            _make_ota_config(port=3232, **{CONF_ENCRYPTION: {CONF_KEY: API_KEY}})
-        ],
-    }
-    token = fv.full_config.set(full_conf)
-    try:
-        ota_esphome_final_validate({})
-        updated = fv.full_config.get()
-        assert updated[CONF_OTA][0][CONF_ENCRYPTION][CONF_KEY] == API_KEY
-    finally:
-        fv.full_config.reset(token)
-
-
-def test_encryption_key_differing_from_api_rejected() -> None:
-    """There is one key per device; an ota key differing from the api key raises."""
-    full_conf = {
-        CONF_API: {CONF_ENCRYPTION: {CONF_KEY: API_KEY}},
-        CONF_OTA: [
-            _make_ota_config(port=3232, **{CONF_ENCRYPTION: {CONF_KEY: OTHER_KEY}})
-        ],
-    }
-    token = fv.full_config.set(full_conf)
-    try:
-        with pytest.raises(cv.Invalid, match="must match the 'api' encryption key"):
-            ota_esphome_final_validate({})
-    finally:
-        fv.full_config.reset(token)
-
-
-def test_encryption_explicit_key_without_api_encryption_accepted() -> None:
-    """An explicit ota key with a plaintext api has nothing to match; it stands."""
-    full_conf = {
-        CONF_API: {},
-        CONF_OTA: [
-            _make_ota_config(port=3232, **{CONF_ENCRYPTION: {CONF_KEY: OTHER_KEY}})
-        ],
-    }
-    token = fv.full_config.set(full_conf)
-    try:
-        ota_esphome_final_validate({})
-        updated = fv.full_config.get()
-        assert updated[CONF_OTA][0][CONF_ENCRYPTION][CONF_KEY] == OTHER_KEY
-    finally:
-        fv.full_config.reset(token)
-
-
-def test_encryption_without_any_key_rejected() -> None:
-    """A bare encryption block with no api key to inherit raises."""
-    full_conf = {
-        CONF_API: {},
-        CONF_OTA: [_make_ota_config(port=3232, **{CONF_ENCRYPTION: {}})],
-    }
-    token = fv.full_config.set(full_conf)
-    try:
-        with pytest.raises(cv.Invalid, match="no 'api' encryption key to inherit"):
-            ota_esphome_final_validate({})
-    finally:
-        fv.full_config.reset(token)
-
-
-def test_encryption_explicit_all_zeros_key_rejected() -> None:
-    """The all-zeros key is the provisioning sentinel; the device would treat
-    it as no PSK and accept plaintext, so it must fail validation."""
-    full_conf = {
-        CONF_OTA: [
-            _make_ota_config(port=3232, **{CONF_ENCRYPTION: {CONF_KEY: ZEROS_KEY}})
-        ],
-    }
-    token = fv.full_config.set(full_conf)
-    try:
-        with pytest.raises(cv.Invalid, match="all-zeros key is reserved"):
-            ota_esphome_final_validate({})
-    finally:
-        fv.full_config.reset(token)
-
-
-def test_encryption_inherited_all_zeros_key_rejected() -> None:
-    """An all-zeros api key must not silently disable ota encryption either."""
-    full_conf = {
-        CONF_API: {CONF_ENCRYPTION: {CONF_KEY: ZEROS_KEY}},
-        CONF_OTA: [_make_ota_config(port=3232, **{CONF_ENCRYPTION: {}})],
-    }
-    token = fv.full_config.set(full_conf)
-    try:
-        with pytest.raises(cv.Invalid, match="all-zeros key is reserved"):
-            ota_esphome_final_validate({})
-    finally:
-        fv.full_config.reset(token)
-
-
-def test_encryption_key_mismatch_between_merged_configs_rejected() -> None:
-    """Same-port configs with different encryption keys raise."""
-    full_conf = {
-        CONF_OTA: [
-            _make_ota_config(port=3232, **{CONF_ENCRYPTION: {CONF_KEY: API_KEY}}),
-            _make_ota_config(port=3232, **{CONF_ENCRYPTION: {CONF_KEY: OTHER_KEY}}),
-        ]
-    }
-    token = fv.full_config.set(full_conf)
-    try:
-        with pytest.raises(cv.Invalid, match="encryption is inconsistent"):
-            ota_esphome_final_validate({})
-    finally:
-        fv.full_config.reset(token)
-
-
-@pytest.mark.parametrize("keyed_first", [True, False])
-def test_encryption_bare_and_keyed_blocks_merge(keyed_first: bool) -> None:
-    """A bare encryption block (package/device split) is compatible with a
-    keyed one on the same port; the merge resolves to the keyed result."""
-    keyed = _make_ota_config(port=3232, **{CONF_ENCRYPTION: {CONF_KEY: OTHER_KEY}})
-    bare = _make_ota_config(port=3232, **{CONF_ENCRYPTION: {}})
-    full_conf = {
-        CONF_OTA: [keyed, bare] if keyed_first else [bare, keyed],
-    }
-    token = fv.full_config.set(full_conf)
-    try:
-        ota_esphome_final_validate({})
-        updated = fv.full_config.get()
-        assert len(updated[CONF_OTA]) == 1
-        assert updated[CONF_OTA][0][CONF_ENCRYPTION][CONF_KEY] == OTHER_KEY
-    finally:
-        fv.full_config.reset(token)
-
-
-def test_encryption_runtime_provisioned_api_key_not_inheritable() -> None:
-    """A keyless api encryption block provisions its key at runtime; a bare
-    ota encryption block cannot inherit it and the message says so."""
-    full_conf = {
-        CONF_API: {CONF_ENCRYPTION: {}},
-        CONF_OTA: [_make_ota_config(port=3232, **{CONF_ENCRYPTION: {}})],
-    }
-    token = fv.full_config.set(full_conf)
-    try:
-        with pytest.raises(cv.Invalid, match="provisioned at runtime"):
-            ota_esphome_final_validate({})
-    finally:
-        fv.full_config.reset(token)
-
-
-def test_encryption_explicit_key_with_runtime_provisioned_api_accepted() -> None:
-    """The documented remedy for a runtime-provisioned api key: set an
-    explicit ota key."""
-    full_conf = {
-        CONF_API: {CONF_ENCRYPTION: {}},
-        CONF_OTA: [
-            _make_ota_config(port=3232, **{CONF_ENCRYPTION: {CONF_KEY: OTHER_KEY}})
-        ],
-    }
-    token = fv.full_config.set(full_conf)
-    try:
-        ota_esphome_final_validate({})
-        updated = fv.full_config.get()
-        assert updated[CONF_OTA][0][CONF_ENCRYPTION][CONF_KEY] == OTHER_KEY
-    finally:
-        fv.full_config.reset(token)
-
-
-def test_encryption_with_web_server_ota_rejected() -> None:
-    """With the web_server component the plaintext /update endpoint is always
-    on, a full bypass of the encryption; the combination fails closed."""
-    full_conf = {
-        "web_server": {},
-        CONF_OTA: [
-            _make_ota_config(port=3232, **{CONF_ENCRYPTION: {CONF_KEY: OTHER_KEY}}),
-            {CONF_PLATFORM: "web_server", CONF_ID: ID("ota_ws", is_manual=False)},
-        ],
-    }
-    token = fv.full_config.set(full_conf)
-    try:
-        with pytest.raises(cv.Invalid, match="plaintext HTTP"):
-            ota_esphome_final_validate({})
-    finally:
-        fv.full_config.reset(token)
-
-
-def test_encryption_with_captive_portal_web_server_ota_warns(
-    caplog: pytest.LogCaptureFixture,
-) -> None:
-    """captive_portal auto-loads the web_server ota platform without the
-    web_server component; encryption stays usable and only warns, so the
-    fallback AP recovery path is not lost."""
-    full_conf = {
-        CONF_OTA: [
-            _make_ota_config(port=3232, **{CONF_ENCRYPTION: {CONF_KEY: OTHER_KEY}}),
-            {CONF_PLATFORM: "web_server", CONF_ID: ID("ota_ws", is_manual=False)},
-        ],
-    }
-    token = fv.full_config.set(full_conf)
-    try:
-        with caplog.at_level(logging.WARNING):
-            ota_esphome_final_validate({})
-        assert any("captive_portal" in record.message for record in caplog.records)
-        esphome_conf = next(
-            conf
-            for conf in fv.full_config.get()[CONF_OTA]
-            if conf.get(CONF_PLATFORM) == CONF_ESPHOME
-        )
-        assert esphome_conf[CONF_ENCRYPTION][CONF_KEY] == OTHER_KEY
-    finally:
-        fv.full_config.reset(token)
-
-
-def test_web_server_ota_without_encryption_unaffected() -> None:
-    """web_server ota stays valid alongside an unencrypted esphome entry."""
-    full_conf = {
-        CONF_OTA: [
-            _make_ota_config(port=3232),
-            {CONF_PLATFORM: "web_server", CONF_ID: ID("ota_ws", is_manual=False)},
-        ],
-    }
-    token = fv.full_config.set(full_conf)
-    try:
-        ota_esphome_final_validate({})
-        assert len(fv.full_config.get()[CONF_OTA]) == 2
-    finally:
-        fv.full_config.reset(token)
-
-
-def test_auto_load_pulls_noise_only_for_encryption() -> None:
-    """A plain ota entry must never pull noise-c into the build."""
-    assert AUTO_LOAD({CONF_PORT: 3232}) == ["sha256", "socket"]
-    assert "noise" in AUTO_LOAD({CONF_ENCRYPTION: {}})
-    # Tooling probes must get the maximal set: None from dependency
-    # resolution, {} from the components-graph platform probe
-    assert "noise" in AUTO_LOAD(None)
-    assert "noise" in AUTO_LOAD({})
-
-
-def test_filter_source_files_excludes_noise_without_encryption() -> None:
-    """The noise transport source compiles only for encrypted builds."""
-    old_config = CORE.config
-    try:
-        CORE.config = {CONF_OTA: [_make_ota_config(port=3232)]}
-        assert FILTER_SOURCE_FILES() == ["ota_esphome_noise.cpp"]
-        CORE.config = {
-            CONF_OTA: [
-                _make_ota_config(port=3232, **{CONF_ENCRYPTION: {CONF_KEY: API_KEY}})
-            ]
-        }
-        assert FILTER_SOURCE_FILES() == []
-    finally:
-        CORE.config = old_config
-
-
-def test_password_with_encryption_rejected() -> None:
-    """The password and encryption options are mutually exclusive."""
-    config = {CONF_PASSWORD: "pw", CONF_ENCRYPTION: {CONF_KEY: API_KEY}}
-    with pytest.raises(cv.Invalid, match="cannot be combined"):
-        _validate_no_password_with_encryption(config)
-
-
-def test_password_alone_accepted() -> None:
-    """A password without encryption still validates."""
-    config = {CONF_PASSWORD: "pw"}
-    assert _validate_no_password_with_encryption(config) is config
-
-
-def test_merged_password_and_encryption_rejected() -> None:
-    """A password block and an encryption block merged on one port raise."""
-    full_conf = {
-        CONF_OTA: [
-            _make_ota_config(port=3232, **{CONF_PASSWORD: "pw"}),
-            _make_ota_config(port=3232, **{CONF_ENCRYPTION: {CONF_KEY: API_KEY}}),
-        ]
-    }
-    token = fv.full_config.set(full_conf)
-    try:
-        with pytest.raises(cv.Invalid, match="cannot be combined"):
-            ota_esphome_final_validate({})
-    finally:
-        fv.full_config.reset(token)

tests/components/binary_sensor/common.yaml

@@ -136,19 +136,3 @@ binary_sensor:
         invalid_cooldown: 2s
         then:
           - logger.log: "Click with custom cooldown"
-
-  # Test on_click and on_double_click (compiles match_interval via
-  # USE_BINARY_SENSOR_CLICK_TRIGGER)
-  - platform: template
-    id: click_triggers
-    name: "Click Triggers"
-    on_click:
-      min_length: 50ms
-      max_length: 350ms
-      then:
-        - logger.log: "Clicked"
-    on_double_click:
-      min_length: 50ms
-      max_length: 350ms
-      then:
-        - logger.log: "Double clicked"

tests/components/noise/__init__.py

@@ -1,7 +0,0 @@
-from tests.testing_helpers import ComponentManifestOverride
-
-
-def override_manifest(manifest: ComponentManifestOverride) -> None:
-    # to_code must run: it defines USE_NOISE and adds the noise-c library
-    # the component sources under test need.
-    manifest.enable_codegen()