Apply the dial delay the same way at boot and after a disconnect, tell socket create and setblocking failures apart, and cap the delay so the wait always elapses

AGENTS.md

@@ -44,16 +44,6 @@ This document provides essential context for AI models interacting with this pro
 
 ## 4. Coding Conventions & Style Guide
 
-**Read the developer documentation before writing a component.** https://developers.esphome.io covers the
-component lifecycle, the main loop, and the reasoning behind the rules below in far more depth than this
-file does, and it is the authority when they disagree. The most useful starting points:
-
-*   https://developers.esphome.io/architecture/components/ - component lifecycle, `setup()`, `loop()`,
-    setup priorities, and how a component is registered.
-*   https://developers.esphome.io/architecture/components/advanced/ - choosing between `loop()`,
-    `set_interval`, `set_timeout` and `defer`; waking the loop from another thread; the RAM cost of each.
-*   https://developers.esphome.io/contributing/code/ - contribution rules, public API and breaking changes.
-
 *   **Formatting:**
     *   **Python:** Uses `ruff` and `flake8` for linting and formatting. Configuration is in `pyproject.toml`.
     *   **C++:** Uses `clang-format` for formatting. Configuration is in `.clang-format`.
@@ -152,47 +142,6 @@ file does, and it is the authority when they disagree. The most useful starting
     *   **Indentation:** Use spaces (two per indentation level), not tabs
     *   **Type aliases:** Prefer `using type_t = int;` over `typedef int type_t;`
     *   **Line length:** Wrap lines at no more than 120 characters
-    *   **Timing in `loop()`:** Never call `millis()` in a `loop()` body. The current tick's timestamp is
-        already cached - use `App.get_loop_component_start_time()` (from `esphome/core/application.h`).
-        Only reach for `millis()` when you genuinely need sub-tick resolution inside a long operation.
-    *   **The main loop runs every 16 ms.** A rate-limit gate shorter than that does nothing: the check
-        passes on essentially every pass of the loop, so it costs a comparison and buys nothing. Pick an
-        interval comfortably coarser than 16 ms, or drop the gate entirely and accept running every loop.
-        ```cpp
-        // Bad - a 10ms gate against a 16ms loop never holds anything back
-        static constexpr uint32_t POLL_INTERVAL_MS = 10;
-        const uint32_t now = millis();
-        if (now - this->last_poll_ < POLL_INTERVAL_MS)
-          return;
-        this->last_poll_ = now;
-        ```
-        ```cpp
-        // Good - an interval that actually rate limits, off the cached timestamp
-        static constexpr uint32_t POLL_INTERVAL_MS = 100;
-        const uint32_t now = App.get_loop_component_start_time();
-        if (now - this->last_poll_ < POLL_INTERVAL_MS)
-          return;
-        this->last_poll_ = now;
-        ```
-        Pick the primitive by cadence: under 250 ms use a gated `loop()`; 500 ms and above use
-        `set_interval`. Full reasoning, including why `set_interval` costs more below 500 ms:
-        https://developers.esphome.io/architecture/components/advanced/#quick-rule-of-thumb
-    *   **Don't override a default with the same value:** if a base class method already returns what you
-        want, do not override it. `Component::get_setup_priority()` returns `setup_priority::DATA`, so a
-        component that wants `DATA` should simply leave it alone.
-        ```cpp
-        // Bad - this is exactly what the base class already does
-        float get_setup_priority() const override { return setup_priority::DATA; }
-        ```
-    *   **Logging string literals:** wrap literals passed as `%s` arguments in `LOG_STR_LITERAL()` so they
-        can be stored in flash rather than RAM.
-        ```cpp
-        // Bad
-        ESP_LOGV(TAG, "Key %u %s", key, pressed ? "pressed" : "released");
-
-        // Good
-        ESP_LOGV(TAG, "Key %u %s", key, pressed ? LOG_STR_LITERAL("pressed") : LOG_STR_LITERAL("released"));
-        ```
     *   **Constructor parameters vs setters:** Component properties that are both **required** and **invariant**
         (never change after construction) should be constructor parameters rather than set via setter methods.
         This makes the dependency explicit and prevents use of the object in an incompletely-initialized state.
@@ -613,33 +562,6 @@ file does, and it is the authority when they disagree. The most useful starting
            Use `cg.add_define("MAX_SERVICES", count)` to set the size from Python configuration.
            Like `std::array` but with vector-like API (`push_back()`, `size()`) and no STL reallocation code.
 
-           **Listener and child-entity registration lists are the most common case, and the most commonly
-           missed.** A `register_*()` method called once per child at code generation time has a count that
-           is known at compile time, so it should never be a `std::vector`. Use `cg.slot_counter()`: it
-           returns a function that each consumer calls once per slot it will occupy, and after every
-           `to_code` has run it emits the define with the final count. When nothing registers, no define is
-           emitted and the storage plus its registration method compile out entirely.
-           ```python
-           # hub component's __init__.py
-           _request_listener_slot = cg.slot_counter("MY_COMPONENT_LISTENER_COUNT")
-
-
-           async def register_listener(hub: MockObj, var: MockObj) -> None:
-               _request_listener_slot()
-               cg.add(hub.register_listener(var))
-           ```
-           ```cpp
-           #ifdef MY_COMPONENT_LISTENER_COUNT
-             void register_listener(MyComponentListener *listener);
-           #endif
-            protected:
-           #ifdef MY_COMPONENT_LISTENER_COUNT
-             StaticVector<MyComponentListener *, MY_COMPONENT_LISTENER_COUNT> listeners_;
-           #endif
-           ```
-           Request slots from `to_code`, not from a job that runs after `CoroPriority.FINAL` - a late
-           request raises rather than silently undercounting.
-
         3. **Runtime-known sizes:** Use `FixedVector` from `esphome/core/helpers.h` when the size is only known at runtime initialization.
            ```cpp
            // Bad - generates STL realloc code (_M_realloc_insert)
@@ -677,25 +599,9 @@ file does, and it is the authority when they disagree. The most useful starting
            ```
            Linear search on small datasets (1-16 elements) is often faster than hashing/tree overhead, but this depends on lookup frequency and access patterns. For frequent lookups in hot code paths, the O(1) vs O(n) complexity difference may still matter even for small datasets. `std::vector` with simple structs is usually fine—it's the heavy containers (`map`, `set`, `unordered_map`) that should be avoided for small datasets unless profiling shows otherwise.
 
-        5. **Strings set once from configuration:** Use `StringRef` (`esphome/core/string_ref.h`) rather than
-           `std::string`. Code generation passes a string literal that lives in flash for the life of the
-           program, so storing a `std::string` copies it onto the heap for nothing. `StringRef` is a
-           non-owning pointer plus length; it does not copy, and it must only ever refer to storage that
-           outlives it (a string literal, or a buffer owned elsewhere).
-           ```cpp
-           // Bad - heap copy of a literal that is already in flash
-           void set_keys(std::string keys) { this->keys_ = std::move(keys); }
-           std::string keys_;
-           ```
-           ```cpp
-           // Good - no allocation
-           void set_keys(const char *keys) { this->keys_ = StringRef(keys); }
-           StringRef keys_;
-           ```
+        5. **Avoid `std::deque`:** It allocates in 512-byte blocks regardless of element size, guaranteeing at least 512 bytes of RAM usage immediately. This is a major source of crashes on memory-constrained devices.
 
-        6. **Avoid `std::deque`:** It allocates in 512-byte blocks regardless of element size, guaranteeing at least 512 bytes of RAM usage immediately. This is a major source of crashes on memory-constrained devices.
-
-        7. **Detection:** Look for these patterns in compiler output:
+        6. **Detection:** Look for these patterns in compiler output:
            - Large code sections with STL symbols (vector, map, set)
            - `alloc`, `realloc`, `dealloc` in symbol names
            - `_M_realloc_insert`, `_M_default_append` (vector reallocation)

CODEOWNERS

@@ -131,7 +131,6 @@ esphome/components/cst816/* @clydebarrow
 esphome/components/cst9220/* @clydebarrow
 esphome/components/ct_clamp/* @jesserockz
 esphome/components/current_based/* @djwmarcx
-esphome/components/d01/* @ch604
 esphome/components/dac7678/* @NickB1
 esphome/components/daikin_arc/* @MagicBear
 esphome/components/daikin_brc/* @hagak
@@ -149,7 +148,6 @@ esphome/components/display_menu_base/* @numo68
 esphome/components/dlms_meter/* @latonita @PolarGoose @SimonFischer04 @Tomer27cz
 esphome/components/dps310/* @kbx81
 esphome/components/ds1307/* @badbadc0ffee
-esphome/components/ds1603l/* @JakeLC15
 esphome/components/ds2484/* @mrk-its
 esphome/components/ds248x/* @tomwellnitz
 esphome/components/dsmr/* @glmnet @PolarGoose

THREAT_MODEL.md

@@ -23,8 +23,7 @@ For this repository there are two trusted inputs by design:
 1. **The configuration.** Anyone who can supply or edit a YAML config is trusted
    (see below).
 2. **Authenticated peers of a running device** — clients holding the device's
-   API/OTA encryption key, API password, OTA password, or web server
-   credentials.
+   API encryption key / password, OTA password, or web server credentials.
 
 The security boundary is therefore **unauthenticated network traffic vs. those
 trusted inputs.** A bug that lets an unauthenticated attacker cross it is a
@@ -77,8 +76,8 @@ These *are* security bugs in this repo, and we want to hear about them privately
   captive portal, etc.) **without** valid credentials.
 - Authentication or encryption bypass on the device — reaching API calls, OTA
   updates, or the web server without the configured key/password.
-- Flaws that weaken the device's API or OTA encryption (Noise), OTA auth, or
-  web server auth below their documented guarantees.
+- Flaws that weaken the device's API encryption (Noise), OTA, or web server auth
+  below their documented guarantees.
 
 ## The web server is an open HTTP API by design
 
@@ -122,37 +121,6 @@ and any memory-safety or protocol bug in the server reachable without credential
 This section documents the current design and scope; it is not a judgment that the
 design is optimal or that it will not change.
 
-## OTA update encryption
-
-The `esphome` OTA platform optionally encrypts updates with the same Noise
-`NNpsk0` pattern the native API uses; one key protects the device. With an
-`encryption:` block configured the guarantees are: the firmware image is
-confidential in transit, the uploader is authenticated by the pre-shared key,
-and the plaintext negotiation preceding the handshake is bound into the
-handshake prologue, so stripping or tampering with it fails the first MAC.
-Both ends fail closed with no override: a device built with a key refuses
-plaintext uploads, and the CLI refuses to send plaintext when a key is
-configured.
-
-Defeating any of that without the key is in scope: a keyed device accepting a
-plaintext or downgraded upload, getting past the MAC, or recovering image
-contents from captured traffic.
-
-The following are **not** vulnerabilities, by design:
-
-- Plaintext OTA on a device with no `encryption:` block. That is the
-  documented default, authenticated (if at all) by the OTA password.
-- The enablement window: turning encryption on takes one last upload of the
-  encryption-enabled firmware over the existing plaintext channel, with the
-  pre-existing plaintext exposure.
-- The web OTA `/update` endpoint alongside encryption. The `web_server`
-  component keeps it always reachable, and `captive_portal:` auto-loads it
-  for the fallback AP window; validation warns about both combinations, and
-  the operator keeps the recovery path.
-- CLI retry behavior on transport or MAC failures; every attempt renegotiates
-  a fresh handshake with fresh ephemerals, so retrying does not weaken
-  authentication.
-
 ## Explicitly out of scope
 
 - Local attackers who already have shell access on the host that runs `esphome`.

esphome/__main__.py

@@ -26,9 +26,7 @@ from esphome.const import (
     CONF_DEASSERT_RTS_DTR,
     CONF_DISABLED,
     CONF_DISCOVER_IP,
-    CONF_ENCRYPTION,
     CONF_ESPHOME,
-    CONF_KEY,
     CONF_LEVEL,
     CONF_LOG,
     CONF_LOG_TOPIC,
@@ -1338,19 +1336,6 @@ def _upload_via_native_api(
 
     remote_port = int(ota_conf[CONF_PORT])
     password = ota_conf.get(CONF_PASSWORD)
-    # Fail closed: an encryption block whose key did not resolve must never
-    # fall back to a plaintext upload
-    noise_psk = None
-    if (encryption_conf := ota_conf.get(CONF_ENCRYPTION)) is not None:
-        noise_psk = encryption_conf.get(CONF_KEY)
-        if not noise_psk:
-            raise EsphomeError(
-                "OTA encryption is configured but no key was resolved; "
-                "set the key under 'ota: encryption:' or 'api: encryption:'"
-            )
-        # Ensure the key is a string, as required by the underlying OTA implementation.
-        # It arrives here as a SensitiveStr which aioesphomeapi rejects.
-        noise_psk = str(noise_psk)
 
     def check_partition_access(option_string: str) -> None:
         if not ota_conf.get("allow_partition_access"):
@@ -1381,9 +1366,7 @@ def _upload_via_native_api(
     if ota_type == espota2.OTA_TYPE_UPDATE_BOOTLOADER:
         _validate_bootloader_binary(binary)
 
-    return espota2.run_ota(
-        network_devices, remote_port, password, binary, ota_type, noise_psk
-    )
+    return espota2.run_ota(network_devices, remote_port, password, binary, ota_type)
 
 
 def _upload_via_web_server(
@@ -1392,16 +1375,6 @@ def _upload_via_web_server(
     from esphome import web_server_ota
     from esphome.web_server_helpers import get_web_server_connection
 
-    if any(
-        ota_item.get(CONF_PLATFORM) == CONF_ESPHOME
-        and ota_item.get(CONF_ENCRYPTION) is not None
-        for ota_item in config.get(CONF_OTA, [])
-    ):
-        _LOGGER.warning(
-            "This config has OTA encryption, but the web_server OTA path sends "
-            "the image over plaintext HTTP; use the esphome OTA platform to "
-            "keep it confidential"
-        )
     remote_port, username, password = get_web_server_connection(config)
     return web_server_ota.run_ota(
         network_devices, remote_port, username, password, binary

esphome/components/alpha3/alpha3.cpp

@@ -162,9 +162,8 @@ void Alpha3::send_request_(uint8_t *request, size_t len) {
   auto status =
       esp_ble_gattc_write_char(this->parent_->get_gattc_if(), this->parent_->get_conn_id(), this->geni_handle_, len,
                                request, ESP_GATT_WRITE_TYPE_NO_RSP, ESP_GATT_AUTH_REQ_NONE);
-  if (status) {
+  if (status)
     ESP_LOGW(TAG, "[%s] esp_ble_gattc_write_char failed, status=%d", this->parent_->address_str(), status);
-  }
 }
 
 void Alpha3::update() {

esphome/components/api/__init__.py

@@ -5,7 +5,7 @@ from typing import Any
 from esphome import automation
 from esphome.automation import Condition
 import esphome.codegen as cg
-from esphome.components.const import CONF_DESCRIPTION
+from esphome.components.const import CONF_DESCRIPTION, CONF_HOST
 from esphome.components.logger import request_log_listener
 
 # ENCRYPTION_SCHEMA and validate_encryption_key are re-exported for external
@@ -24,6 +24,8 @@ from esphome.const import (
     CONF_CAPTURE_RESPONSE,
     CONF_DATA,
     CONF_DATA_TEMPLATE,
+    CONF_DELAY,
+    CONF_ENABLE_IPV6,
     CONF_ENCRYPTION,
     CONF_EVENT,
     CONF_ID,
@@ -47,6 +49,7 @@ from esphome.const import (
 )
 from esphome.core import CORE, ID, CoroPriority, EsphomeError, coroutine_with_priority
 from esphome.cpp_generator import MockObj, TemplateArgsType
+import esphome.final_validate as fv
 from esphome.helpers import fnv1_hash
 from esphome.types import ConfigFragmentType, ConfigType
 
@@ -133,6 +136,7 @@ CONF_HOMEASSISTANT_SERVICES = "homeassistant_services"
 CONF_HOMEASSISTANT_STATES = "homeassistant_states"
 CONF_LISTEN_BACKLOG = "listen_backlog"
 CONF_MAX_SEND_QUEUE = "max_send_queue"
+CONF_OUTGOING_CONNECTION = "outgoing_connection"
 CONF_STATE_SUBSCRIPTION_ONLY = "state_subscription_only"
 
 
@@ -284,9 +288,53 @@ def _consume_api_sockets(config: ConfigType) -> ConfigType:
     # (not max_connections, which is the upper limit rarely reached)
     socket.consume_sockets(3, "api")(config)
     socket.consume_sockets(1, "api", socket.SocketType.TCP_LISTEN)(config)
+    if CONF_OUTGOING_CONNECTION in config:
+        socket.consume_sockets(1, "api_outgoing_connection")(config)
     return config
 
 
+def _validate_outgoing_connection(config: ConfigType) -> ConfigType:
+    if CONF_OUTGOING_CONNECTION not in config:
+        return config
+    # Platform default check here for a friendly early error; an explicit
+    # lwip_tcp selection on other platforms is caught against the resolved
+    # implementation in _validate_outgoing_socket_implementation
+    if CORE.is_esp8266 or CORE.is_rp2:
+        raise cv.Invalid(
+            "outgoing_connection is not supported on this platform because its "
+            "socket layer cannot make outgoing connections",
+            path=[CONF_OUTGOING_CONNECTION],
+        )
+    if CONF_ENCRYPTION not in config:
+        raise cv.Invalid(
+            "outgoing_connection requires 'encryption' so the peer is verified by key",
+            path=[CONF_OUTGOING_CONNECTION],
+        )
+    return config
+
+
+_OUTGOING_CONNECTION_SCHEMA = cv.Schema(
+    {
+        cv.Optional(CONF_HOST): cv.ipaddress,
+        cv.Optional(CONF_PORT, default=6054): cv.port,
+        # Bounded to half the device's uint32 millisecond range so the wait
+        # always elapses under a wrapping clock
+        cv.Optional(CONF_DELAY, default="60s"): cv.All(
+            cv.positive_time_period_milliseconds,
+            cv.Range(max=cv.TimePeriod(milliseconds=2147483647)),
+        ),
+    }
+)
+
+
+def _outgoing_connection_schema(config: ConfigType | None) -> ConfigType:
+    # A bare `outgoing_connection:` block is valid; without a host the device
+    # dials the remembered last dial-back client
+    if config is None:
+        config = {}
+    return _OUTGOING_CONNECTION_SCHEMA(config)
+
+
 CONFIG_SCHEMA = cv.All(
     cv.Schema(
         {
@@ -311,6 +359,7 @@ CONFIG_SCHEMA = cv.All(
             ): ACTIONS_SCHEMA,
             cv.Exclusive(CONF_ACTIONS, group_of_exclusion=CONF_ACTIONS): ACTIONS_SCHEMA,
             cv.Optional(CONF_ENCRYPTION): encryption_schema,
+            cv.Optional(CONF_OUTGOING_CONNECTION): _outgoing_connection_schema,
             cv.Optional(CONF_BATCH_DELAY, default="100ms"): cv.All(
                 cv.positive_time_period_milliseconds,
                 cv.Range(max=cv.TimePeriod(milliseconds=65535)),
@@ -367,6 +416,7 @@ CONFIG_SCHEMA = cv.All(
         }
     ).extend(cv.COMPONENT_SCHEMA),
     cv.rename_key(CONF_SERVICES, CONF_ACTIONS),
+    _validate_outgoing_connection,
     _consume_api_sockets,
     _register_provisioning_source,
 )
@@ -423,7 +473,47 @@ def _validate_esp8266_action_strings(config: ConfigType) -> ConfigType:
     return config
 
 
-FINAL_VALIDATE_SCHEMA = _validate_esp8266_action_strings
+def _validate_outgoing_socket_implementation(config: ConfigType) -> ConfigType:
+    """A raw lwip_tcp socket can be selected explicitly on any platform."""
+    if CONF_OUTGOING_CONNECTION not in config:
+        return config
+    from esphome.components import socket
+
+    socket_conf = fv.full_config.get().get("socket") or {}
+    if (
+        impl := socket_conf.get(socket.CONF_IMPLEMENTATION)
+    ) in socket.IMPLEMENTATIONS_WITHOUT_CONNECT:
+        raise cv.Invalid(
+            f"outgoing_connection is not supported with the {impl} socket "
+            "implementation because it cannot make outgoing connections",
+            path=[CONF_OUTGOING_CONNECTION],
+        )
+    return config
+
+
+def _validate_outgoing_host_ipv6(config: ConfigType) -> ConfigType:
+    """An IPv6 host can never be parsed, so never dialed, without IPv6."""
+    if (
+        (outgoing := config.get(CONF_OUTGOING_CONNECTION)) is None
+        or (host := outgoing.get(CONF_HOST)) is None
+        or host.version != 6
+    ):
+        return config
+    network_conf = fv.full_config.get().get("network") or {}
+    if not network_conf.get(CONF_ENABLE_IPV6):
+        raise cv.Invalid(
+            "outgoing_connection host is an IPv6 address but IPv6 is not "
+            "enabled; set 'network: enable_ipv6: true'",
+            path=[CONF_OUTGOING_CONNECTION, CONF_HOST],
+        )
+    return config
+
+
+FINAL_VALIDATE_SCHEMA = cv.All(
+    _validate_esp8266_action_strings,
+    _validate_outgoing_socket_implementation,
+    _validate_outgoing_host_ipv6,
+)
 
 
 def _add_action_strings(
@@ -606,6 +696,13 @@ async def to_code(config: ConfigType) -> None:
     else:
         cg.add_define("USE_API_PLAINTEXT")
 
+    if (outgoing := config.get(CONF_OUTGOING_CONNECTION)) is not None:
+        cg.add_define("USE_API_OUTGOING_CONNECTION")
+        if (host := outgoing.get(CONF_HOST)) is not None:
+            cg.add_define("API_OUTGOING_CONNECTION_HOST", str(host))
+        cg.add_define("API_OUTGOING_CONNECTION_PORT", outgoing[CONF_PORT])
+        cg.add_define("API_OUTGOING_CONNECTION_DELAY", outgoing[CONF_DELAY])
+
     cg.add_define("USE_API")
     cg.add_global(api_ns.using)
 
@@ -992,6 +1089,7 @@ _define_filter = filter_source_files_from_defines(
         "user_services.cpp": "USE_API_USER_DEFINED_ACTIONS",
         "api_frame_helper_noise.cpp": "USE_API_NOISE",
         "api_frame_helper_plaintext.cpp": "USE_API_PLAINTEXT",
+        "api_outgoing_connection.cpp": "USE_API_OUTGOING_CONNECTION",
     }
 )
 

esphome/components/api/api.proto

@@ -112,6 +112,11 @@ message HelloRequest {
   string client_info = 1;
   uint32 api_version_major = 2;
   uint32 api_version_minor = 3;
+
+  // Set by clients that can accept connections the device opens to them
+  // (see api: outgoing_connection:). The device remembers this client's
+  // address as the target to dial when no such client is connected.
+  bool outgoing_connection_target = 4 [(field_ifdef) = "USE_API_OUTGOING_CONNECTION"];
 }
 
 // Confirmation of successful connection request.
@@ -331,6 +336,10 @@ message DeviceInfoResponse {
   // all-zeros PSK, so the api encryption key can be provisioned without being
   // sent in plaintext (protects against passive sniffing, not active MITM)
   bool api_encryption_provisionable = 26 [(field_ifdef) = "USE_API_NOISE"];
+
+  // Device is built with the api outgoing_connection option and can open
+  // the TCP connection to a dial-back target itself
+  bool api_outgoing_connection_supported = 27 [(field_ifdef) = "USE_API_OUTGOING_CONNECTION"];
 }
 
 // ==================== DEVICE CAPABILITIES ====================
@@ -893,20 +902,6 @@ message NoiseEncryptionSetKeyResponse {
   bool success = 1;
 }
 
-// Single-use session resume ticket, sent unsolicited by the device after a
-// Noise connection authenticates. A client presents it in the ClientHello of
-// its next connection to skip the curve25519 handshake; the device then
-// issues a fresh ticket on that connection. Never sent on plaintext
-// connections. Clients that do not understand it drop it silently.
-// Contents are secret; the device generator redacts this message from dump_to
-message NoiseResumeTicket {
-  option (id) = 152;
-  option (source) = SOURCE_SERVER;
-  option (ifdef) = "USE_API_NOISE";
-
-  bytes ticket = 1;  // session_id(8) || secret(32)
-}
-
 // ==================== HOMEASSISTANT.SERVICE ====================
 message SubscribeHomeassistantServicesRequest {
   option (id) = 34;

esphome/components/api/api_connection.cpp

@@ -1779,9 +1779,6 @@ void APIConnection::complete_authentication_() {
     this->send_time_request();
   }
 #endif
-#ifdef USE_API_NOISE
-  this->send_resume_ticket_();
-#endif
 #ifdef USE_ZWAVE_PROXY
   if (zwave_proxy::global_zwave_proxy != nullptr) {
     zwave_proxy::global_zwave_proxy->api_connection_authenticated(this);
@@ -1789,27 +1786,6 @@ void APIConnection::complete_authentication_() {
 #endif
 }
 
-#ifdef USE_API_NOISE
-void APIConnection::send_resume_ticket_() {
-#ifdef USE_API_PLAINTEXT
-  // Only encrypted transports get a ticket: on dual-mode builds a plaintext
-  // connection has no frame footer
-  if (this->helper_->frame_footer_size() == 0) {
-    return;
-  }
-#endif
-  noise::ResumeTicket ticket;
-  if (!this->parent_->get_noise_ctx().resume_cache().issue(ticket)) {
-    return;
-  }
-  NoiseResumeTicket msg;
-  msg.set_ticket(reinterpret_cast<const uint8_t *>(&ticket), sizeof(ticket));
-  // A dropped ticket is harmless: the client does a full handshake next time
-  static_cast<void>(this->send_message(msg));
-  noise_clean(&ticket, sizeof(ticket));
-}
-#endif
-
 bool APIConnection::send_hello_response_(const HelloRequest &msg) {
   // Copy client name with truncation if needed (set_client_name handles truncation)
   this->helper_->set_client_name(msg.client_info.c_str(), msg.client_info.size());
@@ -1846,6 +1822,19 @@ bool APIConnection::send_hello_response_(const HelloRequest &msg) {
   // Auto-authenticate - password auth was removed in ESPHome 2026.1.0
   this->complete_authentication_();
 
+#ifdef USE_API_OUTGOING_CONNECTION
+  // With a PSK set only key-verified transports reach hello: plaintext and
+  // zero-PSK are rejected, and pre-activation sessions are force-closed
+  if (msg.outgoing_connection_target && !this->flags_.outgoing_connection_target) {
+    if (this->parent_->get_noise_ctx().has_psk()) {
+      this->flags_.outgoing_connection_target = true;
+      this->parent_->on_outgoing_target_client(this);
+    } else {
+      this->log_client_(ESPHOME_LOG_LEVEL_WARN, LOG_STR("Dial-back target refused; no key active"));
+    }
+  }
+#endif
+
   return this->send_message(resp);
 }
 
@@ -1968,6 +1957,9 @@ bool APIConnection::send_device_info_response_() {
   // one) so this advertisement survives the plaintext removal in 2027.2.0.
   resp.api_encryption_provisionable = !this->parent_->get_noise_ctx().has_psk();
 #endif
+#ifdef USE_API_OUTGOING_CONNECTION
+  resp.api_outgoing_connection_supported = true;
+#endif
 #endif
 #ifdef USE_DEVICES
   size_t device_index = 0;
@@ -2415,9 +2407,8 @@ void APIConnection::process_batch_() {
     } else if (payload_size == 0) {
       // payload_size == 0 with remove set means encoding hit OOM and the
       // connection is being dropped; warn only for a genuinely oversized message
-      if (!this->flags_.remove) {
+      if (!this->flags_.remove)
         ESP_LOGW(TAG, "Message too large to send: type=%u", item.message_type);
-      }
       this->clear_batch_();
     }
     return;

esphome/components/api/api_connection.h

@@ -375,17 +375,27 @@ class APIConnection final : public APIServerConnectionBase {
     return this->helper_->get_peername_to(buf);
   }
 
+#ifdef USE_API_OUTGOING_CONNECTION
+  /// Outgoing connection: send our server hello immediately so the peer can
+  /// pick the matching key. Outgoing connections are only dialed when a PSK
+  /// is set, so the helper is always the noise helper. Call after start().
+  void mark_outgoing() {
+    if (this->flags_.remove) {
+      return;  // start() failed; the connection is already being torn down
+    }
+    APIError err = static_cast<APINoiseFrameHelper *>(this->helper_.get())->send_server_hello_first();
+    if (err != APIError::OK) {
+      this->fatal_error_with_log_(LOG_STR("Server hello failed"), err);
+    }
+  }
+#endif
+
  protected:
   bool try_to_clear_buffer_slow_(bool log_out_of_space);
 
   // Helper function to handle authentication completion
   void complete_authentication_();
 
-#ifdef USE_API_NOISE
-  // Issue a fresh single-use session resume ticket over the encrypted channel
-  void send_resume_ticket_();
-#endif
-
   // Pattern B helpers: send response and return success/failure
   bool send_hello_response_(const HelloRequest &msg);
   bool send_disconnect_response_();
@@ -750,6 +760,9 @@ class APIConnection final : public APIServerConnectionBase {
     uint8_t batch_first_message : 1;          // For batch buffer allocation
     uint8_t should_try_send_immediately : 1;  // True after initial states are sent
     uint8_t may_have_remaining_data : 1;      // Read loop hit limit, retry without ready check
+#ifdef USE_API_OUTGOING_CONNECTION
+    uint8_t outgoing_connection_target : 1;  // Client declared itself a dial-back target in its hello
+#endif
 #ifdef HAS_PROTO_MESSAGE_DUMP
     uint8_t log_only_mode : 1;
 #endif

esphome/components/api/api_frame_helper.h

@@ -18,7 +18,7 @@
 namespace esphome::api {
 
 // uncomment to log raw packets
-//#define HELPER_LOG_PACKETS
+// #define HELPER_LOG_PACKETS
 
 // Maximum message size limits to prevent OOM on constrained devices
 // Handshake messages are limited to a small size for security
@@ -282,7 +282,8 @@ class APIFrameHelper {
     DATA = 5,
     CLOSED = 6,
     FAILED = 7,
-    EXPLICIT_REJECT = 8,  // Noise only
+    EXPLICIT_REJECT = 8,        // Noise only
+    CLIENT_HELLO_OUTGOING = 9,  // Noise only: like CLIENT_HELLO but the server hello already went out (outgoing conn)
   };
 
   // Fast inline state check for read_packet/write_protobuf_messages hot path.

esphome/components/api/api_frame_helper_noise.cpp

@@ -81,6 +81,13 @@ APIError APINoiseFrameHelper::init() {
   state_ = State::CLIENT_HELLO;
   return APIError::OK;
 }
+#ifdef USE_API_OUTGOING_CONNECTION
+APIError APINoiseFrameHelper::send_server_hello_first() {
+  // The peer needs our name and MAC to pick the key before its first message
+  this->state_ = State::CLIENT_HELLO_OUTGOING;
+  return this->send_server_hello_frame_();
+}
+#endif
 #ifdef USE_API_PLAINTEXT
 APIError APINoiseFrameHelper::init_from_handoff(const uint8_t *header, uint8_t header_len) {
   APIError err = this->init();
@@ -253,6 +260,9 @@ APIError APINoiseFrameHelper::state_action_() {
       HELPER_LOG("Bad state for method: %d", (int) this->state_);
       return APIError::BAD_STATE;
     case State::CLIENT_HELLO:
+#ifdef USE_API_OUTGOING_CONNECTION
+    case State::CLIENT_HELLO_OUTGOING:
+#endif
       return this->state_action_client_hello_();
     case State::SERVER_HELLO:
       return this->state_action_server_hello_();
@@ -271,8 +281,8 @@ APIError APINoiseFrameHelper::state_action_client_hello_() {
   if (aerr != APIError::OK) {
     return handle_handshake_frame_error_(aerr);
   }
-  // Contents are extension flags (today: the resume offer); mixed into the
-  // prologue either way. Resize for: existing prologue + 2 size bytes + frame data
+  // ignore contents, may be used in future for flags
+  // Resize for: existing prologue + 2 size bytes + frame data
   size_t old_size = this->prologue_.size();
   size_t rx_size = this->rx_buf_.size();
   if (!this->prologue_.resize(old_size + 2 + rx_size)) [[unlikely]] {
@@ -285,13 +295,16 @@ APIError APINoiseFrameHelper::state_action_client_hello_() {
     std::memcpy(this->prologue_.data() + old_size + 2, this->rx_buf_.data(), rx_size);
   }
 
+#ifdef USE_API_OUTGOING_CONNECTION
+  if (this->state_ == State::CLIENT_HELLO_OUTGOING) {
+    // Server hello already went out at handoff
+    return this->start_handshake_();
+  }
+#endif
   state_ = State::SERVER_HELLO;
   return APIError::OK;
 }
-APIError APINoiseFrameHelper::state_action_server_hello_() {
-  // A verified resume offer (still in rx_buf_ from the client hello step)
-  // replaces the whole handshake; any failure falls back to the full one.
-  // send server hello
+APIError APINoiseFrameHelper::send_server_hello_frame_() {
   const auto &name = App.get_name();
   char mac[MAC_ADDRESS_BUFFER_SIZE];
   get_mac_address_into_buffer(mac);
@@ -304,9 +317,7 @@ APIError APINoiseFrameHelper::state_action_server_hello_() {
 
   // 1 (proto) + name (max ESPHOME_DEVICE_NAME_MAX_LEN) + 1 (name null)
   // + mac (MAC_ADDRESS_BUFFER_SIZE - 1) + 1 (mac null)
-  // + optional resume accept extension
-  constexpr size_t max_msg_size =
-      1 + ESPHOME_DEVICE_NAME_MAX_LEN + 1 + MAC_ADDRESS_BUFFER_SIZE + noise::RESUME_ACCEPT_SIZE;
+  constexpr size_t max_msg_size = 1 + ESPHOME_DEVICE_NAME_MAX_LEN + 1 + MAC_ADDRESS_BUFFER_SIZE;
   uint8_t msg[max_msg_size];
 
   // chosen proto
@@ -317,32 +328,19 @@ APIError APINoiseFrameHelper::state_action_server_hello_() {
   // node mac, terminated by null byte
   std::memcpy(msg + mac_offset, mac, MAC_ADDRESS_BUFFER_SIZE);
 
-  // The accept extension, if any, is written straight after the mac
-  size_t ext_len = this->ctx_.resume_cache().try_accept(
-      this->rx_buf_.data(), this->rx_buf_.size(), this->prologue_.data(), this->prologue_.size(), msg + total_size,
-      sizeof(msg) - total_size, send_cipher_, recv_cipher_);
-  bool resume = ext_len != 0;
-  total_size += ext_len;
-
-  APIError aerr = write_frame_(msg, total_size);
+  return write_frame_(msg, total_size);
+}
+APIError APINoiseFrameHelper::state_action_server_hello_() {
+  APIError aerr = this->send_server_hello_frame_();
   if (aerr != APIError::OK)
     return aerr;
-
-  if (resume) {
-    // A resuming client waits for this hello instead of pipelining
-    // handshake message 1, so the transport is ready now
-    this->frame_footer_size_ = noise_cipherstate_get_mac_length(this->send_cipher_);
-    HELPER_LOG("Session resumed!");
-    state_ = State::DATA;
-  } else {
-    aerr = init_handshake_();
-    if (aerr != APIError::OK)
-      return aerr;
-    state_ = State::HANDSHAKE;
-  }
-  // init_handshake_ copied the prologue into the handshake state; the resume
-  // path is done with it too
-  this->prologue_.release();
+  return this->start_handshake_();
+}
+APIError APINoiseFrameHelper::start_handshake_() {
+  APIError aerr = init_handshake_();
+  if (aerr != APIError::OK)
+    return aerr;
+  state_ = State::HANDSHAKE;
   return APIError::OK;
 }
 APIError APINoiseFrameHelper::state_action_handshake_() {
@@ -572,6 +570,8 @@ APIError APINoiseFrameHelper::init_handshake_() {
   APIError aerr = handle_noise_error_(err, LOG_STR("noise_handshake_init"), APIError::HANDSHAKESTATE_SETUP_FAILED);
   if (aerr != APIError::OK)
     return aerr;
+  // init copies the prologue into the handshakestate, so we can get rid of it now
+  prologue_.release();
   return APIError::OK;
 }
 

esphome/components/api/api_frame_helper_noise.h

@@ -28,6 +28,12 @@ class APINoiseFrameHelper final : public APIFrameHelper {
   // Seeds the already-read header bytes and pumps the handshake state machine
   // until it would block.
   APIError init_from_handoff(const uint8_t *header, uint8_t header_len);
+#endif
+#ifdef USE_API_OUTGOING_CONNECTION
+  // Send the server hello immediately so the peer can pick the key before
+  // its PSK-mixed message. Call after init(); the mode is tracked in state_
+  // so the helper does not grow.
+  APIError send_server_hello_first();
 #endif
   APIError loop() override;
   APIError read_packet(ReadPacketBuffer *buffer) override;
@@ -39,6 +45,8 @@ class APINoiseFrameHelper final : public APIFrameHelper {
   APIError state_action_();
   APIError state_action_client_hello_();
   APIError state_action_server_hello_();
+  APIError send_server_hello_frame_();
+  APIError start_handshake_();
   APIError state_action_handshake_();
   APIError state_action_handshake_read_();
   APIError state_action_handshake_write_();

esphome/components/api/api_outgoing_connection.cpp

@@ -0,0 +1,236 @@
+#include "api_outgoing_connection.h"
+#if defined(USE_API) && defined(USE_API_OUTGOING_CONNECTION)
+
+#include "api_connection.h"
+#include "api_server.h"
+#include "esphome/components/network/util.h"
+#include "esphome/core/application.h"
+#include "esphome/core/helpers.h"
+#include "esphome/core/log.h"
+
+#include <cerrno>
+#include <cstring>
+
+namespace esphome::api {
+
+static const char *const TAG = "api.outgoing";
+
+void OutgoingConnectionManager::setup() {
+#ifndef API_OUTGOING_CONNECTION_HOST
+  this->target_pref_ = global_preferences->make_preference<SavedOutgoingTarget>(629847102UL, true);
+  if (this->target_pref_.load(&this->saved_)) {
+    this->host_persisted_ = true;
+    ESP_LOGD(TAG, "Loaded target %s", this->saved_.host);
+  } else {
+    // Never saved, or the blob failed its size/CRC check
+    ESP_LOGD(TAG, "No saved target");
+    this->saved_ = {};
+  }
+  // Defend against a corrupt or truncated preference blob
+  this->saved_.host[sizeof(this->saved_.host) - 1] = '\0';
+#endif
+}
+
+void OutgoingConnectionManager::loop(APIServer *server) {
+  if (server->has_outgoing_target_client_()) {
+    return;  // on_target_client() already reset the dial state
+  }
+  if (this->dialed_conn_ != nullptr) {
+    // A live dialed session (flagged or not, e.g. a host: peer) is the
+    // target; a silent one dies on the handshake timeout
+    return;
+  }
+  const uint32_t now = App.get_loop_component_start_time();
+  switch (this->state_) {
+    case DialState::DIAL_STATE_IDLE:
+#ifdef USE_DEEP_SLEEP
+      // A deep sleep wake window is too short to spend on the delay
+      this->schedule_wait_(now, BACKOFF_MIN_MS);
+#else
+      // Target went away; give it the configured delay to reconnect first
+      this->schedule_wait_(now, API_OUTGOING_CONNECTION_DELAY);
+#endif
+      break;
+    case DialState::DIAL_STATE_WAITING:
+      if (now - this->state_ts_ >= this->wait_) {
+        this->try_dial_(server, now);
+      }
+      break;
+    case DialState::DIAL_STATE_CONNECTING:
+      this->poll_connect_(server, now);
+      break;
+  }
+}
+
+void OutgoingConnectionManager::try_dial_(APIServer *server, uint32_t now) {
+  if (!network::is_connected()) {
+    // Flips within seconds of boot; recheck fast so a deep sleep wake
+    // window is not spent waiting
+    this->schedule_wait_(now, NETWORK_RETRY_MS);
+    return;
+  }
+  const char *host = this->target_host_();
+  if (host == nullptr) {
+    // The steady state until a dial-back client has ever connected
+    ESP_LOGV(TAG, "Not dialing: no target");
+    this->schedule_wait_(now, PRECONDITION_RETRY_MS);
+    return;
+  }
+  const bool at_limit = server->at_client_limit_();
+  if (at_limit || !server->noise_ctx_.has_psk()) {
+    ESP_LOGD(TAG, "Not dialing: %s", at_limit ? "max connections" : "no key");
+    // Not a dial failure; retry without escalating the backoff
+    this->schedule_wait_(now, PRECONDITION_RETRY_MS);
+    return;
+  }
+  struct sockaddr_storage addr;
+  socklen_t addr_len =
+      socket::set_sockaddr((struct sockaddr *) &addr, sizeof(addr), host, API_OUTGOING_CONNECTION_PORT);
+  if (addr_len == 0) {
+    ESP_LOGW(TAG, "Invalid target %s", host);
+#ifndef API_OUTGOING_CONNECTION_HOST
+    // A corrupt remembered value can never become dialable; forget it
+    // (covers an IPv6 literal left by an earlier enable_ipv6 build too)
+    this->saved_ = {};
+    if (!this->persist_target_()) {
+      ESP_LOGW(TAG, "Failed to clear target");
+    }
+#endif
+    this->schedule_retry_(now);
+    return;
+  }
+  this->dial_socket_ = socket::socket_loop_monitored(((struct sockaddr *) &addr)->sa_family, SOCK_STREAM, IPPROTO_TCP);
+  if (!this->dial_socket_ || this->dial_socket_->setblocking(false) != 0) {
+    ESP_LOGW(TAG, "Socket %s failed: errno %d", this->dial_socket_ ? "setblocking" : "create", errno);
+    this->schedule_retry_(now);
+    return;
+  }
+  ESP_LOGD(TAG, "Dialing %s:%u", host, API_OUTGOING_CONNECTION_PORT);
+  int err = this->dial_socket_->connect((struct sockaddr *) &addr, addr_len);
+  if (err == 0) {
+    // Immediate success (possible for localhost)
+    this->handoff_(server, now);
+    return;
+  }
+  if (errno != EINPROGRESS) {
+    ESP_LOGW(TAG, "Connect failed: errno %d", errno);
+    this->schedule_retry_(now);
+    return;
+  }
+  this->state_ = DialState::DIAL_STATE_CONNECTING;
+  this->state_ts_ = now;
+  this->last_poll_ = now;
+}
+
+void OutgoingConnectionManager::poll_connect_(APIServer *server, uint32_t now) {
+  if (now - this->state_ts_ >= CONNECT_TIMEOUT_MS) {
+    ESP_LOGW(TAG, "Connect timeout");
+    this->schedule_retry_(now);
+    return;
+  }
+  if (now - this->last_poll_ < CONNECT_POLL_INTERVAL_MS) {
+    return;
+  }
+  this->last_poll_ = now;
+  int err = 0;
+  switch (socket::poll_connect(*this->dial_socket_, err)) {
+    case socket::ConnectPollResult::CONNECT_POLL_PENDING:
+      break;
+    case socket::ConnectPollResult::CONNECT_POLL_CONNECTED:
+      this->handoff_(server, now);
+      break;
+    case socket::ConnectPollResult::CONNECT_POLL_ERROR:
+      ESP_LOGW(TAG, "Connect failed: %d", err);
+      this->schedule_retry_(now);
+      break;
+  }
+}
+
+void OutgoingConnectionManager::handoff_(APIServer *server, uint32_t now) {
+  this->dialed_conn_ = server->add_outgoing_client_(std::move(this->dial_socket_));
+  if (this->dialed_conn_ == nullptr) {
+    // Only preconditions (slot limit, key cleared) refuse the handoff; the
+    // peer is reachable, so do not escalate the backoff
+    this->schedule_wait_(now, PRECONDITION_RETRY_MS);
+    return;
+  }
+  // Connected; dialed_conn_ gates further dialing until the session settles
+  this->state_ = DialState::DIAL_STATE_IDLE;
+}
+
+void OutgoingConnectionManager::schedule_wait_(uint32_t now, uint32_t wait) {
+  this->dial_socket_.reset();  // no-op when the socket was handed off
+  this->state_ = DialState::DIAL_STATE_WAITING;
+  this->state_ts_ = now;
+  this->wait_ = wait;
+}
+
+void OutgoingConnectionManager::schedule_retry_(uint32_t now) {
+  // +/-20% jitter so a fleet of devices does not retry one server in lockstep
+  const uint32_t jitter_span = this->backoff_ / 5;
+  this->schedule_wait_(now, this->backoff_ - jitter_span + (random_uint32() % (2 * jitter_span + 1)));
+  this->backoff_ = std::min(this->backoff_ * 2, BACKOFF_MAX_MS);
+}
+
+void OutgoingConnectionManager::on_client_removed(APIConnection *conn, bool was_authenticated) {
+  if (conn != this->dialed_conn_) {
+    return;
+  }
+  this->dialed_conn_ = nullptr;
+  const uint32_t now = App.get_loop_component_start_time();
+  if (was_authenticated) {
+    // A working peer (e.g. a host: target that never sends the flag)
+    // disconnected normally; state is IDLE, so loop() applies the delay
+    this->backoff_ = BACKOFF_MIN_MS;
+  } else {
+    this->schedule_retry_(now);
+  }
+}
+
+void OutgoingConnectionManager::on_target_client(APIConnection *conn) {
+  // The target is connected; stop any dial in flight and reset the backoff.
+  // A dialed connection stays tracked unless it is this one: an inbound
+  // target must not orphan a still-open dial.
+  this->dial_socket_.reset();
+  if (conn == this->dialed_conn_) {
+    this->dialed_conn_ = nullptr;
+  }
+  this->state_ = DialState::DIAL_STATE_IDLE;
+  this->backoff_ = BACKOFF_MIN_MS;
+#ifndef API_OUTGOING_CONNECTION_HOST
+  SavedOutgoingTarget target{};
+  conn->get_peername_to(target.host);
+  if (target.host[0] == '\0') {
+    ESP_LOGW(TAG, "Could not read peer address; not remembering target");
+    return;
+  }
+  if (this->host_persisted_ && strcmp(target.host, this->saved_.host) == 0) {
+    return;  // unchanged and already on flash; avoid flash wear
+  }
+  // Use the fresh address this boot even if the flash write fails; a failed
+  // write is retried on the next flagged hello via host_persisted_
+  this->saved_ = target;
+  if (!this->persist_target_()) {
+    ESP_LOGW(TAG, "Failed to save target");
+    return;
+  }
+  ESP_LOGD(TAG, "Saved %s as outgoing connection target", this->saved_.host);
+#endif
+}
+
+void OutgoingConnectionManager::dump_config() const {
+  const char *host = this->target_host_();
+  if (host == nullptr) {
+    host = "none remembered yet";
+  }
+  // The boot delay differs from delay: on deep sleep builds, so print the
+  // value that actually applies
+  ESP_LOGCONFIG(TAG,
+                "  Outgoing connection port: %u\n"
+                "  Outgoing connection host: %s\n"
+                "  Outgoing connection boot delay: %ums",
+                API_OUTGOING_CONNECTION_PORT, host, BOOT_WAIT_MS);
+}
+
+}  // namespace esphome::api
+#endif  // USE_API && USE_API_OUTGOING_CONNECTION

esphome/components/api/api_outgoing_connection.h

@@ -0,0 +1,117 @@
+#pragma once
+
+#include "esphome/core/defines.h"
+#if defined(USE_API) && defined(USE_API_OUTGOING_CONNECTION)
+
+#ifdef USE_SOCKET_IMPL_LWIP_TCP
+#error "api outgoing_connection needs a socket implementation that can make outgoing connections"
+#endif
+#ifndef USE_API_NOISE
+#error "api outgoing_connection needs noise encryption so the peer is verified by key"
+#endif
+
+#include "esphome/components/socket/socket.h"
+#include "esphome/core/preferences.h"
+
+#include <memory>
+
+namespace esphome::api {
+
+class APIServer;
+class APIConnection;
+
+// Follows the build's address family (ifdef'd in socket/headers.h): toggling
+// enable_ipv6 changes the blob size, load() rejects the old blob, and the
+// target is simply relearned
+static constexpr size_t SAVED_TARGET_HOST_LEN = socket::SOCKADDR_STR_LEN;
+
+struct SavedOutgoingTarget {
+  // IP as text so the socket component's v4-mapped-IPv6 normalization is
+  // reused on both ends; empty = none remembered
+  char host[SAVED_TARGET_HOST_LEN];
+} PACKED;  // NOLINT
+
+/// Dials out when no dial-back target client is connected. Only the TCP
+/// direction flips: the device stays the Noise responder, so both sides
+/// still verify by key. Targets the YAML host or the last remembered client.
+class OutgoingConnectionManager {
+ public:
+  void setup();
+  void loop(APIServer *server);
+  /// A key-verified client declared itself a dial-back target; last one wins
+  void on_target_client(APIConnection *conn);
+  /// Clears the dialed-connection gate; dying unauthenticated escalates the backoff
+  void on_client_removed(APIConnection *conn, bool was_authenticated);
+  void on_shutdown() { this->dial_socket_.reset(); }
+  void dump_config() const;
+
+ protected:
+  enum class DialState : uint8_t {
+    DIAL_STATE_IDLE,
+    DIAL_STATE_WAITING,
+    DIAL_STATE_CONNECTING,
+  };
+
+  static constexpr uint32_t BACKOFF_MIN_MS = 5000;
+  static constexpr uint32_t BACKOFF_MAX_MS = 300000;
+  static constexpr uint32_t CONNECT_TIMEOUT_MS = 10000;
+  static constexpr uint32_t CONNECT_POLL_INTERVAL_MS = 250;
+  static constexpr uint32_t NETWORK_RETRY_MS = 500;
+  static constexpr uint32_t PRECONDITION_RETRY_MS = 5000;
+  // Boot waits for the client to connect in first; a deep sleep wake window
+  // is short, so connecting out immediately is the wake state
+#ifdef USE_DEEP_SLEEP
+  static constexpr uint32_t BOOT_WAIT_MS = 0;
+#else
+  static constexpr uint32_t BOOT_WAIT_MS = API_OUTGOING_CONNECTION_DELAY;
+#endif
+
+  void try_dial_(APIServer *server, uint32_t now);
+  void poll_connect_(APIServer *server, uint32_t now);
+  // Hand the connected socket to the server and gate on the new connection
+  void handoff_(APIServer *server, uint32_t now);
+  // Close any half-open dial and wait a jittered backoff before retrying
+  void schedule_retry_(uint32_t now);
+  // Wait without escalating the backoff (used for unmet preconditions)
+  void schedule_wait_(uint32_t now, uint32_t wait);
+#ifndef API_OUTGOING_CONNECTION_HOST
+  // Write saved_ to flash, tracking success in host_persisted_
+  bool persist_target_() {
+    this->host_persisted_ = this->target_pref_.save(&this->saved_) && global_preferences->sync();
+    return this->host_persisted_;
+  }
+#endif
+  const char *target_host_() const {
+#ifdef API_OUTGOING_CONNECTION_HOST
+    return API_OUTGOING_CONNECTION_HOST;
+#else
+    return this->saved_.host[0] != '\0' ? this->saved_.host : nullptr;
+#endif
+  }
+
+  // Pointers first (4 bytes each on 32-bit)
+  std::unique_ptr<socket::Socket> dial_socket_;
+  // Compared only, never dereferenced
+  APIConnection *dialed_conn_{nullptr};
+#ifndef API_OUTGOING_CONNECTION_HOST
+  ESPPreferenceObject target_pref_;
+#endif
+
+  // 4-byte types
+  uint32_t backoff_{BACKOFF_MIN_MS};
+  uint32_t wait_{BOOT_WAIT_MS};
+  uint32_t state_ts_{0};
+  uint32_t last_poll_{0};
+
+  // Byte-aligned types last
+#ifndef API_OUTGOING_CONNECTION_HOST
+  SavedOutgoingTarget saved_{};
+  // False while saved_ holds a value the flash write failed for; retried on
+  // the next flagged hello
+  bool host_persisted_{false};
+#endif
+  DialState state_{DialState::DIAL_STATE_WAITING};
+};
+
+}  // namespace esphome::api
+#endif  // USE_API && USE_API_OUTGOING_CONNECTION

esphome/components/api/api_pb2.cpp

@@ -15,6 +15,11 @@ bool HelloRequest::decode_varint(uint32_t field_id, proto_varint_value_t value)
     case 3:
       this->api_version_minor = value;
       break;
+#ifdef USE_API_OUTGOING_CONNECTION
+    case 4:
+      this->outgoing_connection_target = value != 0;
+      break;
+#endif
     default:
       return false;
   }
@@ -175,6 +180,9 @@ uint8_t *DeviceInfoResponse::encode(ProtoWriteBuffer &buffer PROTO_ENCODE_DEBUG_
 #endif
 #ifdef USE_API_NOISE
   ProtoEncode::encode_bool(pos PROTO_ENCODE_DEBUG_ARG, 26, this->api_encryption_provisionable);
+#endif
+#ifdef USE_API_OUTGOING_CONNECTION
+  ProtoEncode::encode_bool(pos PROTO_ENCODE_DEBUG_ARG, 27, this->api_outgoing_connection_supported);
 #endif
   return pos;
 }
@@ -240,6 +248,9 @@ uint32_t DeviceInfoResponse::calculate_size() const {
 #endif
 #ifdef USE_API_NOISE
   size += ProtoSize::calc_bool(2, this->api_encryption_provisionable);
+#endif
+#ifdef USE_API_OUTGOING_CONNECTION
+  size += ProtoSize::calc_bool(2, this->api_outgoing_connection_supported);
 #endif
   return size;
 }
@@ -1061,16 +1072,6 @@ uint32_t NoiseEncryptionSetKeyResponse::calculate_size() const {
   size += ProtoSize::calc_bool(1, this->success);
   return size;
 }
-uint8_t *NoiseResumeTicket::encode(ProtoWriteBuffer &buffer PROTO_ENCODE_DEBUG_PARAM) const {
-  uint8_t *__restrict__ pos = buffer.get_pos();
-  ProtoEncode::encode_bytes(pos PROTO_ENCODE_DEBUG_ARG, 1, this->ticket_ptr_, this->ticket_len_);
-  return pos;
-}
-uint32_t NoiseResumeTicket::calculate_size() const {
-  uint32_t size = 0;
-  size += ProtoSize::calc_length(1, this->ticket_len_);
-  return size;
-}
 #endif
 #ifdef USE_API_HOMEASSISTANT_SERVICES
 uint8_t *HomeassistantServiceMap::encode(ProtoWriteBuffer &buffer PROTO_ENCODE_DEBUG_PARAM) const {

esphome/components/api/api_pb2.h

@@ -412,13 +412,16 @@ class CommandProtoMessage : public ProtoDecodableMessage {
 class HelloRequest final : public ProtoDecodableMessage {
  public:
   static constexpr uint16_t MESSAGE_TYPE = 1;
-  static constexpr uint8_t ESTIMATED_SIZE = 17;
+  static constexpr uint8_t ESTIMATED_SIZE = 19;
 #ifdef HAS_PROTO_MESSAGE_DUMP
   const LogString *message_name() const override { return LOG_STR("hello_request"); }
 #endif
   StringRef client_info{};
   uint32_t api_version_major{0};
   uint32_t api_version_minor{0};
+#ifdef USE_API_OUTGOING_CONNECTION
+  bool outgoing_connection_target{false};
+#endif
 #ifdef HAS_PROTO_MESSAGE_DUMP
   const char *dump_to(DumpBuffer &out) const override;
 #endif
@@ -549,7 +552,7 @@ class SerialProxyInfo final : public ProtoMessage {
 class DeviceInfoResponse final : public ProtoMessage {
  public:
   static constexpr uint16_t MESSAGE_TYPE = 10;
-  static constexpr uint16_t ESTIMATED_SIZE = 312;
+  static constexpr uint16_t ESTIMATED_SIZE = 315;
 #ifdef HAS_PROTO_MESSAGE_DUMP
   const LogString *message_name() const override { return LOG_STR("device_info_response"); }
 #endif
@@ -607,6 +610,9 @@ class DeviceInfoResponse final : public ProtoMessage {
 #endif
 #ifdef USE_API_NOISE
   bool api_encryption_provisionable{false};
+#endif
+#ifdef USE_API_OUTGOING_CONNECTION
+  bool api_outgoing_connection_supported{false};
 #endif
   uint8_t *encode(ProtoWriteBuffer &buffer PROTO_ENCODE_DEBUG_PARAM) const;
   uint32_t calculate_size() const;
@@ -1147,27 +1153,6 @@ class NoiseEncryptionSetKeyResponse final : public ProtoMessage {
 
  protected:
 };
-class NoiseResumeTicket final : public ProtoMessage {
- public:
-  static constexpr uint16_t MESSAGE_TYPE = 152;
-  static constexpr uint8_t ESTIMATED_SIZE = 19;
-#ifdef HAS_PROTO_MESSAGE_DUMP
-  const LogString *message_name() const override { return LOG_STR("noise_resume_ticket"); }
-#endif
-  const uint8_t *ticket_ptr_{nullptr};
-  size_t ticket_len_{0};
-  void set_ticket(const uint8_t *data, size_t len) {
-    this->ticket_ptr_ = data;
-    this->ticket_len_ = len;
-  }
-  uint8_t *encode(ProtoWriteBuffer &buffer PROTO_ENCODE_DEBUG_PARAM) const;
-  uint32_t calculate_size() const;
-#ifdef HAS_PROTO_MESSAGE_DUMP
-  const char *dump_to(DumpBuffer &out) const override;
-#endif
-
- protected:
-};
 #endif
 #ifdef USE_API_HOMEASSISTANT_SERVICES
 class HomeassistantServiceMap final : public ProtoMessage {

esphome/components/api/api_pb2_dump.cpp

@@ -885,6 +885,9 @@ const char *HelloRequest::dump_to(DumpBuffer &out) const {
   dump_field(out, ESPHOME_PSTR("client_info"), this->client_info);
   dump_field(out, ESPHOME_PSTR("api_version_major"), this->api_version_major);
   dump_field(out, ESPHOME_PSTR("api_version_minor"), this->api_version_minor);
+#ifdef USE_API_OUTGOING_CONNECTION
+  dump_field(out, ESPHOME_PSTR("outgoing_connection_target"), this->outgoing_connection_target);
+#endif
   return out.c_str();
 }
 const char *HelloResponse::dump_to(DumpBuffer &out) const {
@@ -1008,6 +1011,9 @@ const char *DeviceInfoResponse::dump_to(DumpBuffer &out) const {
 #endif
 #ifdef USE_API_NOISE
   dump_field(out, ESPHOME_PSTR("api_encryption_provisionable"), this->api_encryption_provisionable);
+#endif
+#ifdef USE_API_OUTGOING_CONNECTION
+  dump_field(out, ESPHOME_PSTR("api_outgoing_connection_supported"), this->api_outgoing_connection_supported);
 #endif
   return out.c_str();
 }
@@ -1393,10 +1399,6 @@ const char *NoiseEncryptionSetKeyResponse::dump_to(DumpBuffer &out) const {
   dump_field(out, ESPHOME_PSTR("success"), this->success);
   return out.c_str();
 }
-const char *NoiseResumeTicket::dump_to(DumpBuffer &out) const {
-  out.append_p(ESPHOME_PSTR("NoiseResumeTicket {}"));
-  return out.c_str();
-}
 #endif
 #ifdef USE_API_HOMEASSISTANT_SERVICES
 const char *HomeassistantServiceMap::dump_to(DumpBuffer &out) const {

esphome/components/api/api_server.cpp

@@ -34,7 +34,52 @@ APIServer::APIServer() { global_api_server = this; }
 void APIServer::socket_failed_(const LogString *msg) {
   ESP_LOGW(TAG, "Socket %s: errno %d", LOG_STR_ARG(msg), errno);
   this->destroy_socket_();
+#ifdef USE_API_OUTGOING_CONNECTION
+  // Dial-out needs no listener; degrade instead of stopping the component
+  this->status_set_error(LOG_STR("listen socket failed"));
+#else
   this->mark_failed();
+#endif
+}
+
+bool APIServer::create_listen_socket_() {
+  this->socket_ = socket::socket_ip_loop_monitored(SOCK_STREAM, 0).release();  // monitored for incoming connections
+  if (this->socket_ == nullptr) {
+    this->socket_failed_(LOG_STR("creation"));
+    return false;
+  }
+  int enable = 1;
+  int err = this->socket_->setsockopt(SOL_SOCKET, SO_REUSEADDR, &enable, sizeof(int));
+  if (err != 0) {
+    ESP_LOGW(TAG, "Socket reuseaddr: errno %d", errno);
+    // we can still continue
+  }
+  err = this->socket_->setblocking(false);
+  if (err != 0) {
+    this->socket_failed_(LOG_STR("nonblocking"));
+    return false;
+  }
+
+  struct sockaddr_storage server;
+
+  socklen_t sl = socket::set_sockaddr_any((struct sockaddr *) &server, sizeof(server), this->port_);
+  if (sl == 0) {
+    this->socket_failed_(LOG_STR("set sockaddr"));
+    return false;
+  }
+
+  err = this->socket_->bind((struct sockaddr *) &server, sl);
+  if (err != 0) {
+    this->socket_failed_(LOG_STR("bind"));
+    return false;
+  }
+
+  err = this->socket_->listen(this->listen_backlog_);
+  if (err != 0) {
+    this->socket_failed_(LOG_STR("listen"));
+    return false;
+  }
+  return true;
 }
 
 void APIServer::setup() {
@@ -53,42 +98,14 @@ void APIServer::setup() {
 #endif
 #endif
 
-  this->socket_ = socket::socket_ip_loop_monitored(SOCK_STREAM, 0).release();  // monitored for incoming connections
-  if (this->socket_ == nullptr) {
-    this->socket_failed_(LOG_STR("creation"));
-    return;
-  }
-  int enable = 1;
-  int err = this->socket_->setsockopt(SOL_SOCKET, SO_REUSEADDR, &enable, sizeof(int));
-  if (err != 0) {
-    ESP_LOGW(TAG, "Socket reuseaddr: errno %d", errno);
-    // we can still continue
-  }
-  err = this->socket_->setblocking(false);
-  if (err != 0) {
-    this->socket_failed_(LOG_STR("nonblocking"));
-    return;
-  }
-
-  struct sockaddr_storage server;
-
-  socklen_t sl = socket::set_sockaddr_any((struct sockaddr *) &server, sizeof(server), this->port_);
-  if (sl == 0) {
-    this->socket_failed_(LOG_STR("set sockaddr"));
-    return;
-  }
-
-  err = this->socket_->bind((struct sockaddr *) &server, sl);
-  if (err != 0) {
-    this->socket_failed_(LOG_STR("bind"));
-    return;
-  }
-
-  err = this->socket_->listen(this->listen_backlog_);
-  if (err != 0) {
-    this->socket_failed_(LOG_STR("listen"));
+#ifdef USE_API_OUTGOING_CONNECTION
+  // A dead listener degrades to an error status; dial-out still runs
+  this->create_listen_socket_();
+#else
+  if (!this->create_listen_socket_()) {
     return;
   }
+#endif
 
 #ifdef USE_LOGGER
   if (logger::global_logger != nullptr) {
@@ -135,6 +152,9 @@ void APIServer::setup() {
   if (this->reboot_timeout_ != 0 && !this->provisioning_pending_()) {
     this->status_set_warning(LOG_STR("waiting for client connection"));
   }
+#ifdef USE_API_OUTGOING_CONNECTION
+  this->outgoing_conn_.setup();
+#endif
 }
 
 void APIServer::loop() {
@@ -143,6 +163,12 @@ void APIServer::loop() {
     this->accept_new_connections_();
   }
 
+#ifdef USE_API_OUTGOING_CONNECTION
+  if (!this->shutting_down_) {
+    this->outgoing_conn_.loop(this);
+  }
+#endif
+
   if (this->api_connection_count_ == 0) {
     // Check reboot timeout - done in loop to avoid scheduler heap churn
     // (cancelled scheduler items sit in heap memory until their scheduled time).
@@ -151,7 +177,12 @@ void APIServer::loop() {
     if (this->reboot_timeout_ != 0 && !this->provisioning_pending_()) {
       const uint32_t now = App.get_loop_component_start_time();
       if (now - this->last_connected_ > this->reboot_timeout_) {
-        ESP_LOGE(TAG, "No clients; rebooting");
+        // Distinguish a wrong-key peer from nothing connecting at all
+        if (this->saw_unauthenticated_client_) {
+          ESP_LOGE(TAG, "Clients connected but none authenticated; rebooting");
+        } else {
+          ESP_LOGE(TAG, "No clients; rebooting");
+        }
         App.reboot();
       }
     }
@@ -203,6 +234,15 @@ void APIServer::remove_client_(uint8_t client_index) {
   std::string client_peername(client->get_peername_to(peername_buf));
 #endif
 
+  // Read before the swap-and-reset below destroys the connection
+  const bool was_authenticated = client->is_authenticated();
+#ifdef USE_API_OUTGOING_CONNECTION
+  if (client->flags_.outgoing_connection_target) {
+    this->outgoing_target_count_--;
+  }
+  this->outgoing_conn_.on_client_removed(client.get(), was_authenticated);
+#endif
+
   // Close socket now (was deferred from on_fatal_error to allow getpeername)
   client->helper_->close();
 
@@ -221,9 +261,18 @@ void APIServer::remove_client_(uint8_t client_index) {
 
   // Last client disconnected - set warning and start tracking for reboot timeout
   // (suppressed while provisioning is pending - see loop()).
+  // Refresh on every authenticated removal, not just the last one, so an
+  // unauthenticated straggler removed later (e.g. a port scan, or a dial to
+  // a host that accepts TCP but never speaks the API) cannot discard a
+  // healthy session's timestamp and trigger a spurious reboot
+  if (was_authenticated) {
+    this->last_connected_ = App.get_loop_component_start_time();
+    this->saw_unauthenticated_client_ = false;
+  } else {
+    this->saw_unauthenticated_client_ = true;
+  }
   if (this->api_connection_count_ == 0 && this->reboot_timeout_ != 0 && !this->provisioning_pending_()) {
     this->status_set_warning(LOG_STR("waiting for client connection"));
-    this->last_connected_ = App.get_loop_component_start_time();
   }
 
 #ifdef USE_API_CLIENT_DISCONNECTED_TRIGGER
@@ -245,7 +294,7 @@ void __attribute__((flatten)) APIServer::accept_new_connections_() {
     sock->getpeername_to(peername);
 
     // Check if we're at the connection limit
-    if (this->api_connection_count_ >= MAX_API_CONNECTIONS) {
+    if (this->at_client_limit_()) {
       ESP_LOGW(TAG, "Max connections (%d), rejecting %s", MAX_API_CONNECTIONS, peername);
       // Immediately close - socket destructor will handle cleanup
       sock.reset();
@@ -254,18 +303,53 @@ void __attribute__((flatten)) APIServer::accept_new_connections_() {
 
     ESP_LOGD(TAG, "Accept %s", peername);
 
-    auto *conn = new APIConnection(std::move(sock), this);
-    this->clients_[this->api_connection_count_++].reset(conn);
-    conn->start();
-
-    // First client connected - clear warning and update timestamp
-    if (this->api_connection_count_ == 1 && this->reboot_timeout_ != 0 && !this->provisioning_pending_()) {
-      this->status_clear_warning();
-      this->last_connected_ = App.get_loop_component_start_time();
-    }
+    this->add_client_(new APIConnection(std::move(sock), this));
   }
 }
 
+bool APIServer::add_client_(APIConnection *conn) {
+  if (this->at_client_limit_()) {
+    // Callers check first; enforce the array bound where the write happens
+    ESP_LOGW(TAG, "Max connections (%d), dropping client", MAX_API_CONNECTIONS);
+    delete conn;
+    return false;
+  }
+  this->clients_[this->api_connection_count_++].reset(conn);
+  conn->start();
+
+  // First client connected - clear warning. The reboot watchdog timestamp is
+  // refreshed when an authenticated client is removed (see remove_client_),
+  // never on bare TCP connects.
+  if (this->api_connection_count_ == 1 && this->reboot_timeout_ != 0 && !this->provisioning_pending_()) {
+    this->status_clear_warning();
+  }
+  return true;
+}
+
+#ifdef USE_API_OUTGOING_CONNECTION
+APIConnection *APIServer::add_outgoing_client_(std::unique_ptr<socket::Socket> sock) {
+  // Re-check at the handoff: inbound clients may have filled the slots and
+  // the PSK may have been cleared (mark_outgoing() needs the noise helper)
+  const bool at_limit = this->at_client_limit_();
+  if (at_limit || !this->noise_ctx_.has_psk()) {
+    ESP_LOGW(TAG, "Dropping outgoing connection (%s)", at_limit ? "max connections" : "no key");
+    return nullptr;
+  }
+  auto *conn = new APIConnection(std::move(sock), this);
+  if (!this->add_client_(conn)) {
+    return nullptr;
+  }
+  // After start(): sends our server hello first so the peer can pick the key
+  conn->mark_outgoing();
+  return conn;
+}
+
+void APIServer::on_outgoing_target_client(APIConnection *conn) {
+  this->outgoing_target_count_++;
+  this->outgoing_conn_.on_target_client(conn);
+}
+#endif
+
 void APIServer::dump_config() {
   char addr_buf[network::USE_ADDRESS_BUFFER_SIZE];
   ESP_LOGCONFIG(TAG,
@@ -282,6 +366,9 @@ void APIServer::dump_config() {
 #else
   ESP_LOGCONFIG(TAG, "  Noise encryption: NO");
 #endif
+#ifdef USE_API_OUTGOING_CONNECTION
+  this->outgoing_conn_.dump_config();
+#endif
 }
 
 void APIServer::handle_disconnect(APIConnection *conn) {}
@@ -576,6 +663,8 @@ bool APIServer::update_noise_psk_(const SavedNoisePsk &new_psk, const LogString
         if (!c->send_message(req)) {
           API_LOG_MSG_DROPPED(TAG, "Disconnect request");
         }
+        // Force it: a session from before the key was active must not survive
+        c->flags_.next_close = true;
       }
     });
   }
@@ -687,6 +776,9 @@ void APIServer::on_shutdown() {
 
   // Close the listening socket to prevent new connections
   this->destroy_socket_();
+#ifdef USE_API_OUTGOING_CONNECTION
+  this->outgoing_conn_.on_shutdown();
+#endif
 
   // Change batch delay to 5ms for quick flushing during shutdown
   this->batch_delay_ = 5;

esphome/components/api/api_server.h

@@ -11,6 +11,7 @@
 #endif
 #include "api_pb2.h"
 #include "api_pb2_service.h"
+#include "api_outgoing_connection.h"
 #include "esphome/components/socket/socket.h"
 #include "esphome/core/automation.h"
 #include "esphome/core/component.h"
@@ -81,6 +82,10 @@ class APIServer final : public Component,
   void set_noise_psk(noise::psk_t psk) { this->noise_ctx_.set_psk(psk); }
   noise::NoiseContext &get_noise_ctx() { return this->noise_ctx_; }
 #endif  // USE_API_NOISE
+#ifdef USE_API_OUTGOING_CONNECTION
+  // Called by APIConnection when a client declares itself a dial-back target in its hello
+  void on_outgoing_target_client(APIConnection *conn);
+#endif
 
   void handle_disconnect(APIConnection *conn);
 #ifdef USE_BINARY_SENSOR
@@ -258,6 +263,16 @@ class APIServer final : public Component,
  protected:
   // Accept incoming socket connections. Only called when socket has pending connections.
   void __attribute__((noinline)) accept_new_connections_();
+  // Insert a constructed connection into the client slots and start it.
+  // Takes ownership; deletes the connection and returns false at the limit
+  bool add_client_(APIConnection *conn);
+  bool at_client_limit_() const { return this->api_connection_count_ >= MAX_API_CONNECTIONS; }
+#ifdef USE_API_OUTGOING_CONNECTION
+  // Returns the new connection, or nullptr (socket dropped) when at the limit
+  APIConnection *add_outgoing_client_(std::unique_ptr<socket::Socket> sock);
+  bool has_outgoing_target_client_() const { return this->outgoing_target_count_ != 0; }
+  friend class OutgoingConnectionManager;
+#endif
   // Remove a disconnected client by index. Swaps with the last populated slot and resets it.
   void __attribute__((noinline)) remove_client_(uint8_t client_index);
 
@@ -297,6 +312,7 @@ class APIServer final : public Component,
     this->socket_ = nullptr;
   }
   void socket_failed_(const LogString *msg);
+  bool create_listen_socket_();
   // Pointers and pointer-like types first (4 bytes each)
   socket::ListenSocket *socket_{nullptr};
 #ifdef USE_API_CLIENT_CONNECTED_TRIGGER
@@ -349,8 +365,16 @@ class APIServer final : public Component,
   // Connection limits - these defaults will be overridden by config values
   // from cv.SplitDefault in __init__.py which sets platform-specific defaults.
   uint8_t listen_backlog_{4};
-  bool shutting_down_ = false;
+  // Bit-packed so the two flags share one byte
+  bool shutting_down_ : 1 = false;
+  // For the reboot log: whether any removal since the last watchdog refresh
+  // was an unauthenticated session (e.g. a wrong-key peer)
+  bool saw_unauthenticated_client_ : 1 = false;
   uint8_t api_connection_count_{0};
+#ifdef USE_API_OUTGOING_CONNECTION
+  // Connected clients whose hello declared them a dial-back target
+  uint8_t outgoing_target_count_{0};
+#endif
 #if defined(USE_PROVISIONING) && defined(USE_API_NOISE)
   // Index assigned by the provisioning manager for reporting this transport's state.
   uint8_t provisioning_source_{0};
@@ -360,6 +384,9 @@ class APIServer final : public Component,
   noise::NoiseContext noise_ctx_;
   ESPPreferenceObject noise_pref_;
 #endif  // USE_API_NOISE
+#ifdef USE_API_OUTGOING_CONNECTION
+  OutgoingConnectionManager outgoing_conn_;
+#endif
 };
 
 extern APIServer *global_api_server;  // NOLINT(cppcoreguidelines-avoid-non-const-global-variables)

esphome/components/async_tcp/async_tcp_socket.cpp

@@ -42,7 +42,16 @@ bool AsyncClient::connect(const char *host, uint16_t port) {
     return false;
   }
 
-  socket_->setblocking(false);
+  if (socket_->setblocking(false) != 0) {
+    // Capture before the log and reset() below can clobber errno; a blocking
+    // connect()/read() would otherwise stall the whole loop
+    const int saved_errno = errno;
+    ESP_LOGE(TAG, "Failed to set nonblocking: errno %d", saved_errno);
+    socket_.reset();
+    if (error_cb_)
+      error_cb_(error_arg_, this, saved_errno);
+    return false;
+  }
 
   int err = socket_->connect((struct sockaddr *) &addr, addrlen);
   if (err == 0) {
@@ -97,45 +106,22 @@ void AsyncClient::loop() {
     return;
 
   if (connecting_) {
-    // For connecting, we need to check writability, not readability
-    // The Application's select() only monitors read FDs, so we do our own check here
-    // For ESP platforms lwip_select() might be faster, but this code isn't used
-    // on those platforms anyway. If it was, we'd fix the Application select()
-    // to report writability instead of doing it this way.
-    int fd = socket_->get_fd();
-    if (fd < 0) {
-      ESP_LOGW(TAG, "Invalid socket fd");
-      close();
-      return;
-    }
-
-    fd_set writefds;
-    FD_ZERO(&writefds);
-    FD_SET(fd, &writefds);
-
-    struct timeval tv = {0, 0};
-    int ret = select(fd + 1, nullptr, &writefds, nullptr, &tv);
-
-    if (ret > 0 && FD_ISSET(fd, &writefds)) {
-      int error = 0;
-      socklen_t len = sizeof(error);
-      if (socket_->getsockopt(SOL_SOCKET, SO_ERROR, &error, &len) == 0 && error == 0) {
+    int err = 0;
+    switch (socket::poll_connect(*socket_, err)) {
+      case socket::ConnectPollResult::CONNECT_POLL_PENDING:
+        break;
+      case socket::ConnectPollResult::CONNECT_POLL_CONNECTED:
         connecting_ = false;
         connected_ = true;
         if (connect_cb_)
           connect_cb_(connect_arg_, this);
-      } else {
-        ESP_LOGW(TAG, "Connection failed: %d", error);
+        break;
+      case socket::ConnectPollResult::CONNECT_POLL_ERROR:
+        ESP_LOGW(TAG, "Connection failed: %d", err);
         close();
         if (error_cb_)
-          error_cb_(error_arg_, this, error);
-      }
-    } else if (ret < 0) {
-      const int err = errno;
-      ESP_LOGE(TAG, "Select error: %d", err);
-      close();
-      if (error_cb_)
-        error_cb_(error_arg_, this, err);
+          error_cb_(error_arg_, this, err);
+        break;
     }
   } else if (connected_) {
     // For connected sockets, use the Application's select() results

esphome/components/bk72xx_ble/bdk_scan.cpp

@@ -62,9 +62,8 @@ BdkActivityState bdk_scan_state(uint8_t activity_idx) {
 
 uint8_t bdk_scan_acquire_activity() {
   uint8_t idx = app_ble_get_idle_actv_idx_handle(SCAN_ACTV);
-  if (idx == INVALID_ACTIVITY_IDX) {
+  if (idx == INVALID_ACTIVITY_IDX)
     ESP_LOGE(TAG, "Scan start failed: no idle activity handle");
-  }
   return idx;
 }
 

esphome/components/bk72xx_ble/bk72xx_ble.cpp

@@ -181,9 +181,8 @@ void BK72xxBLE::enable() {
       break;
     }
   }
-  if (!bdaddr_live) {
+  if (!bdaddr_live)
     ESP_LOGW(TAG, "Controller address still unset after init; BLE stack may not have started");
-  }
 #endif
 
   this->state_ = BLEComponentState::ACTIVE;
@@ -211,9 +210,8 @@ void BK72xxBLE::loop() {
     // Re-check a settled scan; scan_start() refills the bring-up budget.
     // WARN: the only report of a drop that recovers inside its budget.
     if (this->scan_start(this->requested_.interval, this->requested_.window, this->requested_.active) !=
-        ScanOpResult::SETTLED) {
+        ScanOpResult::SETTLED)
       ESP_LOGW(TAG, "Controller dropped the scan; restarting");
-    }
   }
 
   // Drain the lock-free ring filled by the BLE task; all per-report work runs
@@ -232,9 +230,8 @@ void BK72xxBLE::loop() {
   // Log dropped reports — only reachable when reports were processed; drops can
   // only occur while the queue is full, and only this loop drains it.
   uint16_t dropped = this->report_queue_.get_and_reset_dropped_count();
-  if (dropped > 0) {
+  if (dropped > 0)
     ESP_LOGW(TAG, "Dropped %u scan reports due to queue overflow", dropped);
-  }
 }
 
 void BK72xxBLE::get_mac_lsb_first(uint8_t out[MAC_ADDRESS_SIZE]) const {
@@ -452,9 +449,8 @@ ScanOpResult BK72xxBLE::advance_stop_(BdkActivityState state, bool ready) {
   if (!ready) {
     // Acting mid-operation could delete an activity whose start lands
     // afterwards, leaking the slot with the radio on; wait.
-    if (this->last_result_ == ScanOpResult::SETTLED) {
+    if (this->last_result_ == ScanOpResult::SETTLED)
       ESP_LOGD(TAG, "Scan stop deferred (controller busy)");
-    }
     return ScanOpResult::PENDING;
   }
   // Settled, so CREATED unambiguously means "never started".
@@ -478,9 +474,8 @@ ScanOpResult BK72xxBLE::advance_start_(BdkActivityState state, bool ready) {
     return ScanOpResult::PENDING;
   }
   if (!ready) {
-    if (this->last_result_ == ScanOpResult::SETTLED) {
+    if (this->last_result_ == ScanOpResult::SETTLED)
       ESP_LOGD(TAG, "Scan start deferred (controller busy)");
-    }
     return ScanOpResult::PENDING;
   }
   if (state == BdkActivityState::CREATED) {

esphome/components/bk72xx_ble_tracker/bk72xx_ble_tracker.cpp

@@ -69,9 +69,8 @@ void BK72xxBLETracker::on_ota_global_state(ota::OTAState state, float progress,
     this->stop_scan();
     // The transfer starves the loop; a deferred stop would leave the radio
     // scanning for the whole update, so drain it here, bounded.
-    if (!this->parent_->flush_pending_stop(OTA_STOP_FLUSH_MS)) {
+    if (!this->parent_->flush_pending_stop(OTA_STOP_FLUSH_MS))
       ESP_LOGE(TAG, "Scan still stopping at OTA start; the radio may contend with the update");
-    }
   } else if (state == ota::OTA_ERROR || state == ota::OTA_ABORT) {
     // On success the device reboots, so restore only on a failed/aborted update;
     // loop() restarts the scan on its next iteration (continuous idle branch).

esphome/components/ble_client/output/ble_binary_output.cpp

@@ -80,9 +80,8 @@ void BLEBinaryOutput::write_state(bool state) {
   esp_err_t err =
       esp_ble_gattc_write_char(this->parent()->get_gattc_if(), this->parent()->get_conn_id(), this->char_handle_,
                                sizeof(state_as_uint), &state_as_uint, this->write_type_, ESP_GATT_AUTH_REQ_NONE);
-  if (err != ESP_GATT_OK) {
+  if (err != ESP_GATT_OK)
     ESP_LOGW(TAG, "[%s] Write error, err=%d", this->char_uuid_.to_str(char_buf), err);
-  }
 }
 
 }  // namespace esphome::ble_client

esphome/components/bme680/bme680.cpp

@@ -327,12 +327,10 @@ void BME680Component::read_data_() {
 
   ESP_LOGD(TAG, "Got temperature=%.1f°C pressure=%.1fhPa humidity=%.1f%% gas_resistance=%.1fΩ", temperature, pressure,
            humidity, gas_resistance);
-  if (!gas_valid) {
+  if (!gas_valid)
     ESP_LOGW(TAG, "Gas measurement unsuccessful, reading invalid!");
-  }
-  if (!heat_stable) {
+  if (!heat_stable)
     ESP_LOGW(TAG, "Heater unstable, reading invalid! (Normal for a few readings after a power cycle)");
-  }
 
   if (this->temperature_sensor_ != nullptr)
     this->temperature_sensor_->publish_state(temperature);

esphome/components/climate/climate.cpp

@@ -749,39 +749,33 @@ void Climate::dump_traits_(const char *tag) {
   }
   if (!traits.get_supported_modes().empty()) {
     ESP_LOGCONFIG(tag, "  Supported modes:");
-    for (ClimateMode m : traits.get_supported_modes()) {
+    for (ClimateMode m : traits.get_supported_modes())
       ESP_LOGCONFIG(tag, "  - %s", LOG_STR_ARG(climate_mode_to_string(m)));
-    }
   }
   if (!traits.get_supported_fan_modes().empty()) {
     ESP_LOGCONFIG(tag, "  Supported fan modes:");
-    for (ClimateFanMode m : traits.get_supported_fan_modes()) {
+    for (ClimateFanMode m : traits.get_supported_fan_modes())
       ESP_LOGCONFIG(tag, "  - %s", LOG_STR_ARG(climate_fan_mode_to_string(m)));
-    }
   }
   if (!traits.get_supported_custom_fan_modes().empty()) {
     ESP_LOGCONFIG(tag, "  Supported custom fan modes:");
-    for (const char *s : traits.get_supported_custom_fan_modes()) {
+    for (const char *s : traits.get_supported_custom_fan_modes())
       ESP_LOGCONFIG(tag, "  - %s", s);
-    }
   }
   if (!traits.get_supported_presets().empty()) {
     ESP_LOGCONFIG(tag, "  Supported presets:");
-    for (ClimatePreset p : traits.get_supported_presets()) {
+    for (ClimatePreset p : traits.get_supported_presets())
       ESP_LOGCONFIG(tag, "  - %s", LOG_STR_ARG(climate_preset_to_string(p)));
-    }
   }
   if (!traits.get_supported_custom_presets().empty()) {
     ESP_LOGCONFIG(tag, "  Supported custom presets:");
-    for (const char *s : traits.get_supported_custom_presets()) {
+    for (const char *s : traits.get_supported_custom_presets())
       ESP_LOGCONFIG(tag, "  - %s", s);
-    }
   }
   if (!traits.get_supported_swing_modes().empty()) {
     ESP_LOGCONFIG(tag, "  Supported swing modes:");
-    for (ClimateSwingMode m : traits.get_supported_swing_modes()) {
+    for (ClimateSwingMode m : traits.get_supported_swing_modes())
       ESP_LOGCONFIG(tag, "  - %s", LOG_STR_ARG(climate_swing_mode_to_string(m)));
-    }
   }
 }
 

esphome/components/const/__init__.py

@@ -14,7 +14,6 @@ CONF_CHANNEL_COLORS = "channel_colors"
 CONF_CLIMATE_ID = "climate_id"
 CONF_CO2_EQUIVALENT = "co2_equivalent"
 CONF_COLOR_DEPTH = "color_depth"
-CONF_COLUMNS = "columns"
 CONF_CRC_ENABLE = "crc_enable"
 CONF_DATA_BITS = "data_bits"
 CONF_DESCRIPTION = "description"
@@ -23,10 +22,10 @@ CONF_ENABLE_OTA_DOWNGRADE_PROTECTION = "enable_ota_downgrade_protection"
 CONF_ENABLED = "enabled"
 CONF_GYROSCOPE_ODR = "gyroscope_odr"
 CONF_GYROSCOPE_RANGE = "gyroscope_range"
+CONF_HOST = "host"
 CONF_IAQ = "iaq"
 CONF_IGNORE_NOT_FOUND = "ignore_not_found"
 CONF_IS_WRGB = "is_wrgb"
-CONF_KEYS = "keys"
 CONF_LABEL = "label"
 CONF_LIBRETINY = "libretiny"
 CONF_LOOP = "loop"

esphome/components/d01/d01.cpp

@@ -1,45 +0,0 @@
-#include "d01.h"
-#include "esphome/core/log.h"
-
-// uart specification for d01 sensor from https://manuals.plus/ae/1005006417362019:
-//
-// A frame of serial output data includes 4 bytes, formatted as follows:
-// __Characteristic byte: Fixed value 0xA5.
-// __Data byte: DATAH is the high 7 bits of the concentration value, and DATAL is the low 7 bits of the concentration
-// value.
-// __Check byte: The low 7 bits of the sum of all bytes before the check byte.
-//
-// If the serial output is 4 bytes of data: 0*A5 0*01 0*2C 0*52, then DATAH = 0*01 = 1, DATAL = 0*2C = 44.
-// Concentration value = 1*128 + 44 = 172 µg/m³.
-//
-// The PM2.5 dust concentration value obtained from the dust sensor needs to be calibrated with a K value coefficient
-// based on the TSI instrument's photometric method. It is generally recommended to use 0.4.
-
-namespace esphome::d01 {
-
-static const char *const TAG = "d01";
-
-static const uint8_t D01_FRAME_HEADER = 0xA5;
-
-void D01SensorComponent::dump_config() { LOG_SENSOR("  ", "D01 PM2.5", this); }
-
-void D01SensorComponent::loop() {
-  uint8_t buf[4];
-  while (this->available() >= 4) {
-    if (this->peek() != D01_FRAME_HEADER) {
-      this->read();
-      continue;
-    }
-    this->read_array(buf, 4);
-    uint8_t sum = (buf[0] + buf[1] + buf[2]) & 0x7F;
-    if (sum != buf[3]) {
-      ESP_LOGW(TAG, "checksum mismatch");
-      continue;
-    }
-    uint16_t latest_concentration = (buf[1] & 0x7F) * 128 + (buf[2] & 0x7F);
-    ESP_LOGV(TAG, "Unadjusted PM2.5 Concentration: %d µg/m³", latest_concentration);
-    this->publish_state(latest_concentration);
-  }
-}
-
-}  // namespace esphome::d01

esphome/components/d01/d01.h

@@ -1,14 +0,0 @@
-#pragma once
-#include "esphome/core/component.h"
-#include "esphome/components/sensor/sensor.h"
-#include "esphome/components/uart/uart.h"
-
-namespace esphome::d01 {
-
-class D01SensorComponent final : public sensor::Sensor, public Component, public uart::UARTDevice {
- public:
-  void dump_config() override;
-  void loop() override;
-};
-
-}  // namespace esphome::d01

esphome/components/d01/sensor.py

@@ -1,45 +0,0 @@
-import esphome.codegen as cg
-from esphome.components import sensor, uart
-import esphome.config_validation as cv
-from esphome.const import (
-    DEVICE_CLASS_PM25,
-    ICON_BLUR,
-    STATE_CLASS_MEASUREMENT,
-    UNIT_MICROGRAMS_PER_CUBIC_METER,
-)
-from esphome.types import ConfigType
-
-CODEOWNERS = ["@ch604"]
-DEPENDENCIES = ["uart"]
-
-d01_ns = cg.esphome_ns.namespace("d01")
-D01SensorComponent = d01_ns.class_(
-    "D01SensorComponent", sensor.Sensor, uart.UARTDevice, cg.Component
-)
-
-
-CONFIG_SCHEMA = (
-    sensor.sensor_schema(
-        D01SensorComponent,
-        unit_of_measurement=UNIT_MICROGRAMS_PER_CUBIC_METER,
-        icon=ICON_BLUR,
-        accuracy_decimals=0,
-        device_class=DEVICE_CLASS_PM25,
-        state_class=STATE_CLASS_MEASUREMENT,
-    )
-    .extend(cv.COMPONENT_SCHEMA)
-    .extend(uart.UART_DEVICE_SCHEMA)
-)
-
-FINAL_VALIDATE_SCHEMA = uart.final_validate_device_schema(
-    "d01",
-    baud_rate=9600,
-    require_rx=True,
-    require_tx=False,
-)
-
-
-async def to_code(config: ConfigType) -> None:
-    var = await sensor.new_sensor(config)
-    await cg.register_component(var, config)
-    await uart.register_uart_device(var, config)

esphome/components/dht/dht.cpp

@@ -154,9 +154,8 @@ bool HOT IRAM_ATTR DHT::read_sensor_(float *temperature, float *humidity, bool r
     }
   }
   if (error_code != 0) {
-    if (report_errors) {
+    if (report_errors)
       ESP_LOGW(TAG, ESP_LOG_MSG_COMM_FAIL);
-    }
     return false;
   }
 

esphome/components/ds1603l/ds1603l.cpp

@@ -1,68 +0,0 @@
-#include "ds1603l.h"
-
-#include <cstring>
-
-#include "esphome/core/helpers.h"
-#include "esphome/core/log.h"
-
-namespace esphome::ds1603l {
-
-static const char *const TAG = "ds1603l.sensor";
-
-void DS1603L::loop() {
-  // Assemble frames one byte at a time so a stream that starts mid-frame can realign
-  uint8_t byte;
-  while (this->available() > 0 && this->read_byte(&byte)) {
-    if (this->rx_count_ == 0 && byte != HEADER_BYTE) {
-      ESP_LOGV(TAG, "Skipping byte 0x%02X while looking for header", byte);
-      continue;
-    }
-
-    this->rx_buffer_[this->rx_count_++] = byte;
-    if (this->rx_count_ < FRAME_SIZE) {
-      continue;
-    }
-
-    if (this->parse_data_()) {
-      this->rx_count_ = 0;
-    } else {
-      // The header byte was part of the payload of a misaligned frame, so realign instead of dropping everything
-      this->resync_();
-    }
-  }
-}
-
-void DS1603L::dump_config() { LOG_SENSOR("", "DS1603L", this); }
-
-bool DS1603L::parse_data_() {
-  uint8_t header = this->rx_buffer_[0];
-  uint8_t data_h = this->rx_buffer_[1];
-  uint8_t data_l = this->rx_buffer_[2];
-  uint8_t checksum = this->rx_buffer_[3];
-
-  uint8_t computed_checksum = (header + data_h + data_l) & 0xFF;
-
-  ESP_LOGV(TAG, "Data: Header=0x%02X, Data_H=0x%02X, Data_L=0x%02X, Checksum=0x%02X", header, data_h, data_l, checksum);
-
-  if (checksum != computed_checksum) {
-    ESP_LOGW(TAG, "Checksum mismatch: received 0x%02X, expected 0x%02X", checksum, computed_checksum);
-    return false;
-  }
-
-  this->publish_state(encode_uint16(data_h, data_l));
-  return true;
-}
-
-void DS1603L::resync_() {
-  // Drop the byte that was treated as the header, then look for the next candidate header in what is left
-  size_t start = 1;
-  while (start < this->rx_count_ && this->rx_buffer_[start] != HEADER_BYTE) {
-    start++;
-  }
-  this->rx_count_ -= start;
-  if (this->rx_count_ > 0) {
-    memmove(this->rx_buffer_, this->rx_buffer_ + start, this->rx_count_);
-  }
-}
-
-}  // namespace esphome::ds1603l

esphome/components/ds1603l/ds1603l.h

@@ -1,30 +0,0 @@
-#pragma once
-
-#include <cstddef>
-#include <cstdint>
-
-#include "esphome/components/sensor/sensor.h"
-#include "esphome/components/uart/uart.h"
-#include "esphome/core/component.h"
-
-namespace esphome::ds1603l {
-
-class DS1603L final : public sensor::Sensor, public Component, public uart::UARTDevice {
- public:
-  void loop() override;
-  void dump_config() override;
-
- protected:
-  static constexpr uint8_t HEADER_BYTE = 0xFF;
-  static constexpr size_t FRAME_SIZE = 4;
-
-  // Validates the checksum of the frame in rx_buffer_ and publishes it. Returns false if the frame is invalid.
-  bool parse_data_();
-  // Drops the first buffered byte and realigns the buffer on the next possible header byte.
-  void resync_();
-
-  uint8_t rx_buffer_[FRAME_SIZE];  // Buffer for the frame being assembled
-  size_t rx_count_{0};             // Number of bytes currently in rx_buffer_
-};
-
-}  // namespace esphome::ds1603l

esphome/components/ds1603l/sensor.py

@@ -1,43 +0,0 @@
-import esphome.codegen as cg
-from esphome.components import sensor, uart
-import esphome.config_validation as cv
-from esphome.const import (
-    DEVICE_CLASS_DISTANCE,
-    STATE_CLASS_MEASUREMENT,
-    UNIT_MILLIMETER,
-)
-from esphome.types import ConfigType
-
-CODEOWNERS = ["@JakeLC15"]
-DEPENDENCIES = ["uart"]
-
-ds1603l_ns = cg.esphome_ns.namespace("ds1603l")
-DS1603L = ds1603l_ns.class_("DS1603L", sensor.Sensor, cg.Component, uart.UARTDevice)
-
-
-CONFIG_SCHEMA = (
-    sensor.sensor_schema(
-        DS1603L,
-        unit_of_measurement=UNIT_MILLIMETER,
-        accuracy_decimals=0,
-        device_class=DEVICE_CLASS_DISTANCE,
-        state_class=STATE_CLASS_MEASUREMENT,
-    )
-    .extend(uart.UART_DEVICE_SCHEMA)
-    .extend(cv.COMPONENT_SCHEMA)
-)
-
-FINAL_VALIDATE_SCHEMA = uart.final_validate_device_schema(
-    "ds1603l",
-    baud_rate=9600,
-    require_tx=False,
-    require_rx=True,
-    data_bits=8,
-    stop_bits=1,
-)
-
-
-async def to_code(config: ConfigType) -> None:
-    var = await sensor.new_sensor(config)
-    await cg.register_component(var, config)
-    await uart.register_uart_device(var, config)

esphome/components/epaper_spi/epaper_spi_uc8179.cpp

@@ -1,139 +0,0 @@
-#include "epaper_spi_uc8179.h"
-
-#include <algorithm>
-
-#include "esphome/core/log.h"
-
-namespace esphome::epaper_spi {
-
-static constexpr const char *const TAG = "epaper_spi.uc8179";
-
-bool EPaperUC8179::initialise(bool partial) {
-  EPaperBase::initialise(partial);  // send the model init sequence
-  this->partial_ = partial;
-  ESP_LOGV(TAG, "Power on");
-  // POWER ON must precede the waveform/mode registers and the data transfer
-  // (the original driver powers on and busy-waits before writing them).
-  // The state machine busy-waits before entering TRANSFER_DATA.
-  this->command(0x04);
-  // Give the busy line time to assert before the state machine polls it
-  this->next_delay_ = 100;
-  return true;
-}
-
-// Set up the refresh mode. Must be called after power-on has completed.
-void EPaperUC8179::set_refresh_mode_() {
-  if (!this->is_using_partial_update_()) {
-    return;  // plain full refresh uses the mode set by the init sequence
-  }
-  // Fast and partial refresh use flipped data polarity and a floating border
-  this->cmd_data(0x50, {0xA9, 0x07});
-  // Force the waveform via the temperature registers: 0x5A selects the fast
-  // full-refresh waveform, 0x6E the partial-refresh waveform
-  this->cmd_data(0xE0, {0x02});
-  if (this->partial_) {
-    this->cmd_data(0xE5, {0x6E});
-    this->command(0x91);  // enter partial mode
-    // Set the partial window to the full screen
-    const uint16_t x_end = this->width_ - 1;
-    const uint16_t y_end = this->height_ - 1;
-    this->cmd_data(0x90, {0x00, 0x00, static_cast<uint8_t>(x_end >> 8), static_cast<uint8_t>(x_end & 0xFF), 0x00, 0x00,
-                          static_cast<uint8_t>(y_end >> 8), static_cast<uint8_t>(y_end & 0xFF), 0x01});
-  } else {
-    this->cmd_data(0xE5, {0x5A});
-    this->command(0x92);  // exit partial mode
-  }
-}
-
-bool HOT EPaperUC8179::transfer_data() {
-  const uint32_t start_time = millis();
-  const size_t buffer_length = this->buffer_length_;
-  if (this->current_data_index_ == 0) {
-    this->set_refresh_mode_();
-  }
-  // Fast full refresh sends the previous-image plane as well, so that every pixel transitions
-  const bool two_pass = this->is_using_partial_update_() && !this->partial_;
-  // Plain full refresh sends inverted data (buffer is 1=white, the wire wants 0=white);
-  // in fast/partial mode the data polarity is flipped via the VCOM/data-interval
-  // register instead, so the new-image plane is sent unmodified
-  const bool invert_new_data = !this->is_using_partial_update_();
-
-  uint8_t bytes_to_send[MAX_TRANSFER_SIZE];
-
-  // Phase 1 (fast full refresh only): previous image via 0x10 (DTM1), inverse of the new image
-  if (two_pass && this->current_data_index_ < buffer_length) {
-    if (this->current_data_index_ == 0) {
-      this->command(0x10);  // DATA START TRANSMISSION 1 (previous image)
-    }
-    this->start_data_();
-    while (this->current_data_index_ < buffer_length) {
-      const size_t bytes_to_copy = std::min(MAX_TRANSFER_SIZE, buffer_length - this->current_data_index_);
-      for (size_t i = 0; i < bytes_to_copy; i++) {
-        bytes_to_send[i] = ~this->buffer_[this->current_data_index_ + i];
-      }
-      this->write_array(bytes_to_send, bytes_to_copy);
-      this->current_data_index_ += bytes_to_copy;
-      if (millis() - start_time > MAX_TRANSFER_TIME) {
-        this->disable();
-        return false;
-      }
-    }
-    this->disable();
-  }
-
-  // Phase 2: new image via 0x13 (DTM2)
-  const size_t offset = two_pass ? buffer_length : 0;
-  const size_t total = offset + buffer_length;
-  if (this->current_data_index_ < total) {
-    if (this->current_data_index_ == offset) {
-      this->command(0x13);  // DATA START TRANSMISSION 2 (new image)
-    }
-    this->start_data_();
-    while (this->current_data_index_ < total) {
-      const size_t bytes_to_copy = std::min(MAX_TRANSFER_SIZE, total - this->current_data_index_);
-      const size_t data_idx = this->current_data_index_ - offset;
-      for (size_t i = 0; i < bytes_to_copy; i++) {
-        const uint8_t byte = this->buffer_[data_idx + i];
-        bytes_to_send[i] = invert_new_data ? ~byte : byte;
-      }
-      this->write_array(bytes_to_send, bytes_to_copy);
-      this->current_data_index_ += bytes_to_copy;
-      if (millis() - start_time > MAX_TRANSFER_TIME) {
-        this->disable();
-        return false;
-      }
-    }
-    this->disable();
-  }
-
-  this->current_data_index_ = 0;
-  return true;
-}
-
-void EPaperUC8179::power_on() {
-  // Power-on is sent at the end of initialise() instead, because the
-  // waveform/mode registers and the data transfer must follow it
-}
-
-void EPaperUC8179::refresh_screen(bool /*partial*/) {
-  ESP_LOGV(TAG, "Refresh");
-  this->command(0x12);  // DISPLAY REFRESH
-  // Delay the next busy poll: the busy line takes a short time to assert after
-  // the refresh command, and polling too early would read it as already idle
-  this->next_delay_ = 100;
-}
-
-void EPaperUC8179::power_off() {
-  ESP_LOGV(TAG, "Power off");
-  this->command(0x02);  // POWER OFF
-}
-
-void EPaperUC8179::deep_sleep() {
-  // Deep sleep loses the previous-image RAM that partial refresh compares against
-  if (!this->is_using_partial_update_()) {
-    ESP_LOGV(TAG, "Deep sleep");
-    this->cmd_data(0x07, {0xA5});  // DEEP SLEEP with check code
-  }
-}
-
-}  // namespace esphome::epaper_spi

esphome/components/epaper_spi/epaper_spi_uc8179.h

@@ -1,52 +0,0 @@
-#pragma once
-
-#include "epaper_spi.h"
-
-namespace esphome::epaper_spi {
-
-/**
- * Monochrome e-paper displays using the UC8179 controller.
- * Supports: 7.5" V2 (EPD_7in5_V2), 800x480 pixels, as used by the
- * Waveshare 7.5" V2 HAT and the Seeed reTerminal E1001.
- *
- * Buffer layout: 1 bit per pixel, 1=white, 0=black (the base class default).
- *
- * The INITIALISE state sends the panel configuration followed by power-on
- * (0x04); the state machine busy-waits for power-on to complete before
- * TRANSFER_DATA, which first writes the waveform/mode registers (these are
- * only accepted while powered) and then the image data. The state machine
- * busy-waits again before triggering REFRESH_SCREEN (0x12).
- *
- * Three refresh modes are used, following the Waveshare EPD_7in5_V2 examples:
- * - full_update_every == 1: plain full refresh. The new image is sent
- *   inverted to DTM2 (0x13) and the controller uses its normal waveform.
- * - full_update_every > 1, full update: fast full refresh. The data polarity
- *   is flipped via the VCOM/data-interval register, a fast waveform is forced
- *   via the temperature registers, and the image is sent to both DTM1 (0x10,
- *   inverted) and DTM2 (0x13) so that every pixel transitions.
- * - full_update_every > 1, partial update: partial refresh. A partial-update
- *   waveform is forced, partial mode is entered with a full-screen window and
- *   only DTM2 is sent; the controller compares against its previous-image RAM.
- */
-class EPaperUC8179 final : public EPaperBase {
- public:
-  EPaperUC8179(const char *name, uint16_t width, uint16_t height, const uint8_t *init_sequence,
-               size_t init_sequence_length)
-      : EPaperBase(name, width, height, init_sequence, init_sequence_length, DISPLAY_TYPE_BINARY) {
-    this->buffer_length_ = this->row_width_ * height;
-  }
-
- protected:
-  bool initialise(bool partial) override;
-  bool transfer_data() override;
-  void refresh_screen(bool partial) override;
-  void power_on() override;
-  void power_off() override;
-  void deep_sleep() override;
-  void set_refresh_mode_();
-
-  // Set by initialise() so transfer_data() knows which planes to send
-  bool partial_{};
-};
-
-}  // namespace esphome::epaper_spi

esphome/components/epaper_spi/models/uc8179.py

@@ -1,93 +0,0 @@
-"""Monochrome e-paper displays using the UC8179 controller.
-
-Supported models:
-- waveshare-7.5in-v2: 7.5" mono display, 800x480 pixels (EPD_7in5_V2)
-- seeed-reterminal-e1001: Seeed reTerminal E1001, which uses the same
-  7.5" 800x480 panel on an integrated ESP32-S3 board
-
-Panel configuration and power-on (0x04) are both sent during the INITIALISE
-state; the state machine's built-in busy wait then covers the power-on delay
-before the waveform/mode registers and image data are transferred.
-
-These displays support fast full and partial refresh: set ``full_update_every``
-greater than 1 to enable it. Every ``full_update_every``-th update is a fast
-full refresh, with partial refreshes in between.
-"""
-
-from typing import Any
-
-from esphome.const import CONF_DATA_RATE
-
-from . import EpaperModel
-
-
-class UC8179(EpaperModel):
-    """EpaperModel class for monochrome displays using the UC8179 controller."""
-
-    def __init__(
-        self,
-        name: str,
-        class_name: str = "EPaperUC8179",
-        data_rate: str = "10MHz",
-        **defaults: Any,
-    ) -> None:
-        defaults.setdefault(CONF_DATA_RATE, data_rate)
-        super().__init__(name, class_name, **defaults)
-
-    def get_init_sequence(self, config: dict) -> tuple:
-        """Generate the initialization sequence for UC8179 mono displays.
-
-        Panel configuration only — the driver appends power-on (0x04) at the
-        end of the INITIALISE state, and the state machine busy-waits for it
-        to complete before the data transfer starts.
-        """
-        width, height = self.get_dimensions(config)
-        return (
-            # POWER SETTING
-            (0x01, 0x07, 0x07, 0x3F, 0x3F),
-            # BOOSTER SOFT START
-            (0x06, 0x17, 0x17, 0x28, 0x17),
-            # PANEL SETTING (black/white mode, LUT from OTP)
-            (0x00, 0x1F),
-            # RESOLUTION SETTING (width x height)
-            (
-                0x61,
-                (width >> 8) & 0xFF,
-                width & 0xFF,
-                (height >> 8) & 0xFF,
-                height & 0xFF,
-            ),
-            # DUAL SPI MODE (disabled)
-            (0x15, 0x00),
-            # VCOM AND DATA INTERVAL SETTING
-            (0x50, 0x10, 0x07),
-            # TCON SETTING
-            (0x60, 0x22),
-        )
-
-
-uc8179 = UC8179("uc8179")
-
-# Waveshare 7.5" V2 mono (EPD_7in5_V2) — 800x480, UC8179 controller
-waveshare_7_5_v2 = uc8179.extend(
-    "waveshare-7.5in-v2",
-    width=800,
-    height=480,
-)
-
-# Seeed reTerminal E1001 — 7.5" mono e-paper (800x480), same panel as the
-# Waveshare 7.5" V2, driven by an integrated ESP32-S3 board
-waveshare_7_5_v2.extend(
-    "seeed-reterminal-e1001",
-    cs_pin=10,
-    dc_pin=11,
-    reset_pin=12,
-    busy_pin={
-        "number": 13,
-        "inverted": True,
-        "mode": {
-            "input": True,
-            "pullup": True,
-        },
-    },
-)

esphome/components/esp32/__init__.py

@@ -182,13 +182,6 @@ SIGNED_OTA_V1_ECDSA_VARIANTS = {
     VARIANT_ESP32,
 }
 
-# Variants that support execution from PSRAM
-PSRAM_XIP_VARIANTS = {
-    VARIANT_ESP32S3,
-    VARIANT_ESP32P4,
-    VARIANT_ESP32S31,
-}
-
 # NVS encryption (HMAC peripheral scheme) is only available on variants that
 # expose the HMAC peripheral (SOC_HMAC_SUPPORTED in soc_caps.h). The original
 # ESP32 and ESP32-C2 do not have it. New variants with an HMAC peripheral
@@ -1530,7 +1523,7 @@ def final_validate(config) -> None:
             )
         )
     if advanced[CONF_EXECUTE_FROM_PSRAM]:
-        if config[CONF_VARIANT] not in PSRAM_XIP_VARIANTS:
+        if config[CONF_VARIANT] not in {VARIANT_ESP32S3, VARIANT_ESP32P4}:
             errs.append(
                 cv.Invalid(
                     f"'{CONF_EXECUTE_FROM_PSRAM}' is not available on this esp32 variant",
@@ -2734,7 +2727,13 @@ async def to_code(config):
     _configure_lwip_max_sockets(conf)
 
     if advanced[CONF_EXECUTE_FROM_PSRAM]:
-        add_idf_sdkconfig_option("CONFIG_SPIRAM_XIP_FROM_PSRAM", True)
+        if variant == VARIANT_ESP32S3:
+            add_idf_sdkconfig_option("CONFIG_SPIRAM_FETCH_INSTRUCTIONS", True)
+            add_idf_sdkconfig_option("CONFIG_SPIRAM_RODATA", True)
+        elif variant == VARIANT_ESP32P4:
+            add_idf_sdkconfig_option("CONFIG_SPIRAM_XIP_FROM_PSRAM", True)
+        else:
+            raise ValueError("Unhandled ESP32 variant")
 
     # Apply LWIP core locking for better socket performance
     # This is already enabled by default in Arduino framework, where it provides

esphome/components/esp32_camera_web_server/camera_web_server.cpp

@@ -210,9 +210,8 @@ esp_err_t CameraWebServer::streaming_handler_(struct httpd_req *req) {
     if (!image) {
       // A shutdown is not a lost frame: wait_for_image_() returns empty as soon
       // as running_ clears, and the loop condition below ends the stream anyway.
-      if (this->running_) {
+      if (this->running_)
         ESP_LOGW(TAG, "STREAM: failed to acquire frame");
-      }
       res = ESP_FAIL;
     }
     if (res == ESP_OK) {

esphome/components/esphome/ota/__init__.py

@@ -1,20 +1,12 @@
 import logging
 
 import esphome.codegen as cg
-from esphome.components.noise import (
-    decode_encryption_key,
-    encryption_schema,
-    is_reserved_key,
-)
 from esphome.components.ota import BASE_OTA_SCHEMA, OTAComponent, ota_to_code
 from esphome.config_helpers import merge_config
 import esphome.config_validation as cv
 from esphome.const import (
-    CONF_API,
-    CONF_ENCRYPTION,
     CONF_ESPHOME,
     CONF_ID,
-    CONF_KEY,
     CONF_NUM_ATTEMPTS,
     CONF_OTA,
     CONF_PASSWORD,
@@ -23,7 +15,6 @@ from esphome.const import (
     CONF_REBOOT_TIMEOUT,
     CONF_SAFE_MODE,
     CONF_VERSION,
-    CONF_WEB_SERVER,
 )
 from esphome.core import CORE, coroutine_with_priority
 from esphome.coroutine import CoroPriority
@@ -31,7 +22,6 @@ import esphome.final_validate as fv
 from esphome.types import ConfigType
 
 CONF_ALLOW_PARTITION_ACCESS = "allow_partition_access"
-CONF_CAPTIVE_PORTAL = "captive_portal"
 
 _LOGGER = logging.getLogger(__name__)
 
@@ -40,15 +30,7 @@ CODEOWNERS = ["@esphome/core"]
 DEPENDENCIES = ["network"]
 
 
-def AUTO_LOAD(config: ConfigType) -> list[str]:
-    """Auto-load noise only when encryption is configured."""
-    base = ["sha256", "socket"]
-    # A falsy config is a tooling probe for the maximal set (None from
-    # dependency resolution, {} from the components-graph platform probe);
-    # a validated config always carries defaults, never empty
-    if not config or CONF_ENCRYPTION in config:
-        return base + ["noise"]
-    return base
+AUTO_LOAD = ["sha256", "socket"]
 
 
 esphome = cg.esphome_ns.namespace("esphome")
@@ -85,24 +67,11 @@ def ota_esphome_final_validate(config: ConfigType) -> None:
                     CONF_PASSWORD in merged_ota_esphome_configs_by_port[conf_port]
                     and CONF_PASSWORD in ota_conf
                     and merged_ota_esphome_configs_by_port[conf_port][CONF_PASSWORD]
-                    != ota_conf[CONF_PASSWORD]
+                    != ota_conf.get(CONF_PASSWORD)
                 ):
                     raise cv.Invalid(
                         f"Found multiple configurations but {CONF_PASSWORD} is inconsistent"
                     )
-                # Encryption blocks conflict only when both pin a key; a bare
-                # `encryption:` (a package/device split) is compatible with a
-                # keyed one, and merge_config yields the keyed result
-                merged_key = (
-                    merged_ota_esphome_configs_by_port[conf_port]
-                    .get(CONF_ENCRYPTION, {})
-                    .get(CONF_KEY)
-                )
-                other_key = ota_conf.get(CONF_ENCRYPTION, {}).get(CONF_KEY)
-                if merged_key and other_key and merged_key != other_key:
-                    raise cv.Invalid(
-                        f"Found multiple configurations but {CONF_ENCRYPTION} is inconsistent"
-                    )
 
                 ports_with_merged_configs.append(conf_port)
                 merged_ota_esphome_configs_by_port[conf_port] = merge_config(
@@ -125,20 +94,6 @@ def ota_esphome_final_validate(config: ConfigType) -> None:
 
     new_ota_conf.extend(merged_ota_esphome_configs_by_port.values())
 
-    api_conf = full_conf.get(CONF_API) or {}
-    for ota_conf in merged_ota_esphome_configs_by_port.values():
-        # Merging same-port blocks can combine a password from one block with
-        # encryption from another; re-check the exclusion on the merged result.
-        _validate_no_password_with_encryption(ota_conf)
-        if (encryption_conf := ota_conf.get(CONF_ENCRYPTION)) is not None:
-            _resolve_encryption_key(encryption_conf, api_conf)
-    if any(
-        conf.get(CONF_PLATFORM) == CONF_WEB_SERVER for conf in full_ota_conf
-    ) and any(
-        CONF_ENCRYPTION in conf for conf in merged_ota_esphome_configs_by_port.values()
-    ):
-        _warn_web_server_ota(full_conf)
-
     full_conf[CONF_OTA] = new_ota_conf
     fv.full_config.set(full_conf)
 
@@ -152,73 +107,6 @@ def ota_esphome_final_validate(config: ConfigType) -> None:
         )
 
 
-def _warn_web_server_ota(full_conf: ConfigType) -> None:
-    """The web_server ota platform accepts the same image over plaintext HTTP
-    with basic auth, bypassing the encryption; warn rather than fail so the
-    operator keeps the recovery path."""
-    if CONF_CAPTIVE_PORTAL in full_conf and CONF_WEB_SERVER not in full_conf:
-        # The captive_portal auto-load: the endpoint only exists while the
-        # fallback AP is active
-        _LOGGER.warning(
-            "OTA encryption does not cover the %s OTA platform (auto-loaded "
-            "by captive_portal); the plaintext /update endpoint stays "
-            "reachable while the fallback AP is active",
-            CONF_WEB_SERVER,
-        )
-    else:
-        _LOGGER.warning(
-            "OTA encryption does not cover the %s OTA platform; its "
-            "plaintext /update endpoint accepts the same image",
-            CONF_WEB_SERVER,
-        )
-
-
-def _resolve_encryption_key(encryption_conf: ConfigType, api_conf: ConfigType) -> None:
-    """Resolve the one encryption key per device into the ota block.
-
-    An explicit ota key must match the api key, a bare block inherits it,
-    a runtime provisioned api key cannot be inherited, and the all-zeros
-    provisioning sentinel is rejected (the device treats it as no key).
-    """
-    api_key = api_conf.get(CONF_ENCRYPTION, {}).get(CONF_KEY)
-    if ota_key := encryption_conf.get(CONF_KEY):
-        if api_key and ota_key != api_key:
-            raise cv.Invalid(
-                f"'{CONF_OTA}' {CONF_ENCRYPTION} {CONF_KEY} must match the "
-                f"'{CONF_API}' {CONF_ENCRYPTION} {CONF_KEY}; omit the "
-                f"'{CONF_OTA}' {CONF_KEY} to use the '{CONF_API}' one"
-            )
-    elif not api_key:
-        if CONF_ENCRYPTION in api_conf:
-            raise cv.Invalid(
-                f"the '{CONF_API}' {CONF_ENCRYPTION} {CONF_KEY} is provisioned at "
-                f"runtime and cannot be inherited at build time; set an explicit "
-                f"'{CONF_OTA}' {CONF_ENCRYPTION} {CONF_KEY}"
-            )
-        raise cv.Invalid(
-            f"'{CONF_OTA}' {CONF_ENCRYPTION} has no {CONF_KEY} and there is no "
-            f"'{CONF_API}' {CONF_ENCRYPTION} {CONF_KEY} to inherit; set one of them"
-        )
-    else:
-        encryption_conf[CONF_KEY] = api_key
-    if is_reserved_key(encryption_conf[CONF_KEY]):
-        raise cv.Invalid(
-            f"The all-zeros {CONF_KEY} is reserved and provides no protection; "
-            f"generate a real key with: openssl rand -base64 32"
-        )
-
-
-# Also called on merged same-port configs in final validate, where schemas
-# do not run
-def _validate_no_password_with_encryption(config: ConfigType) -> ConfigType:
-    if CONF_PASSWORD in config and CONF_ENCRYPTION in config:
-        raise cv.Invalid(
-            f"'{CONF_PASSWORD}' cannot be combined with '{CONF_ENCRYPTION}'; the "
-            f"encryption key already authenticates the uploader, remove '{CONF_PASSWORD}'"
-        )
-    return config
-
-
 def _consume_ota_sockets(config: ConfigType) -> ConfigType:
     """Register socket needs for OTA component."""
     from esphome.components import socket
@@ -246,7 +134,6 @@ CONFIG_SCHEMA = cv.All(
             ): cv.port,
             cv.Optional(CONF_ALLOW_PARTITION_ACCESS, default=False): cv.boolean,
             cv.Optional(CONF_PASSWORD): cv.sensitive(),
-            cv.Optional(CONF_ENCRYPTION): encryption_schema,
             cv.Optional(CONF_NUM_ATTEMPTS): cv.invalid(
                 f"'{CONF_SAFE_MODE}' (and its related configuration variables) has moved from 'ota' to its own component. See https://esphome.io/components/safe_mode"
             ),
@@ -260,24 +147,12 @@ CONFIG_SCHEMA = cv.All(
     )
     .extend(BASE_OTA_SCHEMA)
     .extend(cv.COMPONENT_SCHEMA),
-    _validate_no_password_with_encryption,
     _consume_ota_sockets,
 )
 
 FINAL_VALIDATE_SCHEMA = ota_esphome_final_validate
 
 
-def FILTER_SOURCE_FILES() -> list[str]:
-    """Filter out the noise transport when no ota entry configures encryption."""
-    for ota_conf in CORE.config.get(CONF_OTA, []):
-        if (
-            ota_conf.get(CONF_PLATFORM) == CONF_ESPHOME
-            and ota_conf.get(CONF_ENCRYPTION) is not None
-        ):
-            return []
-    return ["ota_esphome_noise.cpp"]
-
-
 @coroutine_with_priority(CoroPriority.OTA_UPDATES)
 async def to_code(config: ConfigType) -> None:
     var = cg.new_Pvariable(config[CONF_ID])
@@ -296,12 +171,6 @@ async def to_code(config: ConfigType) -> None:
     if config.get(CONF_ALLOW_PARTITION_ACCESS):
         cg.add_define("USE_OTA_PARTITIONS")
 
-    if (encryption_conf := config.get(CONF_ENCRYPTION)) is not None:
-        # A missing key was resolved from the api component in final validate.
-        key = encryption_conf[CONF_KEY]
-        cg.add_define("USE_OTA_ENCRYPTION")
-        cg.add(var.set_noise_psk(list(decode_encryption_key(key))))
-
     # Build flag so lwip_fast_select.c (a .c file that can't include defines.h) sees it.
     cg.add_build_flag("-DUSE_OTA_PLATFORM_ESPHOME")
 

esphome/components/esphome/ota/ota_esphome.cpp

@@ -27,6 +27,7 @@ namespace esphome {
 
 static const char *const TAG = "esphome.ota";
 static constexpr uint16_t OTA_BLOCK_SIZE = 8192;
+static constexpr size_t OTA_BUFFER_SIZE = 1024;                  // buffer size for OTA data transfer
 static constexpr uint32_t OTA_SOCKET_TIMEOUT_HANDSHAKE = 20000;  // milliseconds for initial handshake
 static constexpr uint32_t OTA_SOCKET_TIMEOUT_DATA = 90000;       // milliseconds for data transfer
 
@@ -104,11 +105,6 @@ void ESPHomeOTAComponent::dump_config() {
     ESP_LOGCONFIG(TAG, "  Password configured");
   }
 #endif
-#ifdef USE_OTA_ENCRYPTION
-  if (this->noise_ctx_.has_psk()) {
-    ESP_LOGCONFIG(TAG, "  Encryption configured");
-  }
-#endif
 #ifdef USE_OTA_PARTITIONS
   ESP_LOGCONFIG(TAG,
                 "  Partition access allowed\n"
@@ -153,10 +149,8 @@ void ESPHomeOTAComponent::loop() {
 static constexpr uint8_t CLIENT_FEATURE_SUPPORTS_COMPRESSION = 0x01;
 static constexpr uint8_t CLIENT_FEATURE_SUPPORTS_SHA256_AUTH = 0x02;
 static constexpr uint8_t CLIENT_FEATURE_SUPPORTS_EXTENDED_PROTOCOL = 0x04;
-static constexpr uint8_t CLIENT_FEATURE_SUPPORTS_NOISE = 0x08;
 static constexpr uint8_t SERVER_FEATURE_SUPPORTS_COMPRESSION = 0x01;
 static constexpr uint8_t SERVER_FEATURE_SUPPORTS_PARTITION_ACCESS = 0x02;
-static constexpr uint8_t SERVER_FEATURE_SUPPORTS_NOISE = 0x04;
 
 void ESPHomeOTAComponent::handle_handshake_() {
   /// Handle the OTA handshake and authentication.
@@ -208,7 +202,8 @@ void ESPHomeOTAComponent::handle_handshake_() {
       }
 
       // Validate magic bytes
-      if (memcmp(this->handshake_buf_, MAGIC_BYTES, sizeof(MAGIC_BYTES)) != 0) {
+      static const uint8_t MAGIC_BYTES[5] = {0x6C, 0x26, 0xF7, 0x5C, 0x45};
+      if (memcmp(this->handshake_buf_, MAGIC_BYTES, 5) != 0) {
         ESP_LOGW(TAG, "Magic bytes mismatch! 0x%02X-0x%02X-0x%02X-0x%02X-0x%02X", this->handshake_buf_[0],
                  this->handshake_buf_[1], this->handshake_buf_[2], this->handshake_buf_[3], this->handshake_buf_[4]);
         this->send_error_and_cleanup_(ota::OTA_RESPONSE_ERROR_MAGIC);
@@ -240,19 +235,6 @@ void ESPHomeOTAComponent::handle_handshake_() {
       }
       this->ota_features_ = this->handshake_buf_[0];
       ESP_LOGV(TAG, "Features: 0x%02X", this->ota_features_);
-
-#ifdef USE_OTA_ENCRYPTION
-      // Fail closed: with a PSK configured the client must negotiate encryption
-      // (which requires the extended protocol); refuse plaintext uploads.
-      static constexpr uint8_t NOISE_REQUIRED_FEATURES =
-          CLIENT_FEATURE_SUPPORTS_NOISE | CLIENT_FEATURE_SUPPORTS_EXTENDED_PROTOCOL;
-      if (this->noise_ctx_.has_psk() && (this->ota_features_ & NOISE_REQUIRED_FEATURES) != NOISE_REQUIRED_FEATURES) {
-        ESP_LOGW(TAG, "Client does not support encryption");
-        this->send_error_and_cleanup_(ota::OTA_RESPONSE_ERROR_ENCRYPTION_REQUIRED);
-        return;
-      }
-#endif
-
       this->transition_ota_state_(OTAState::FEATURE_ACK);
 
       const bool supports_compression =
@@ -268,11 +250,6 @@ void ESPHomeOTAComponent::handle_handshake_() {
         this->handshake_buf_[1] = (supports_compression ? SERVER_FEATURE_SUPPORTS_COMPRESSION : 0);
 #ifdef USE_OTA_PARTITIONS
         this->handshake_buf_[1] |= SERVER_FEATURE_SUPPORTS_PARTITION_ACCESS;
-#endif
-#ifdef USE_OTA_ENCRYPTION
-        if (this->noise_ctx_.has_psk()) {
-          this->handshake_buf_[1] |= SERVER_FEATURE_SUPPORTS_NOISE;
-        }
 #endif
       } else {
         this->handshake_buf_[0] =
@@ -288,20 +265,6 @@ void ESPHomeOTAComponent::handle_handshake_() {
       if (!this->try_write_(ack_size, LOG_STR("ack feature"))) {
         return;
       }
-#ifdef USE_OTA_ENCRYPTION
-      // With a PSK configured the rest of the session runs inside the noise
-      // transport; the client sends the first handshake frame next, so there
-      // is nothing to do until data arrives.
-      if (this->noise_ctx_.has_psk()) {
-        // handshake_buf_ still holds the feature ack composed above; a
-        // would-block re-entry lands here without rebuilding it
-        if (!this->noise_start_session_(this->handshake_buf_[1])) {
-          return;
-        }
-        this->transition_ota_state_(OTAState::NOISE_HANDSHAKE);
-        return;
-      }
-#endif
 #ifdef USE_OTA_PASSWORD
       // If password is set, move to auth phase
       if (!this->password_.empty()) {
@@ -339,16 +302,6 @@ void ESPHomeOTAComponent::handle_handshake_() {
       this->handle_data_();
       return;
 
-#ifdef USE_OTA_ENCRYPTION
-    case OTAState::NOISE_HANDSHAKE:
-      if (!this->handle_noise_handshake_()) {
-        return;
-      }
-      this->transition_ota_state_(OTAState::DATA);
-      this->handle_data_();
-      return;
-#endif
-
     default:
       break;
   }
@@ -387,8 +340,6 @@ void ESPHomeOTAComponent::handle_data_() {
   ///   Raw TCP (8266, RP2040):  setblocking is no-op; SO_RCVTIMEO uses
   ///                            wakeable_delay() in read();
   ///                            write() always returns immediately
-  // Backend calls overwrite this with OK; reset to UNKNOWN before any
-  // goto error that follows a successful begin()/write()
   ota::OTAResponseTypes error_code = ota::OTA_RESPONSE_ERROR_UNKNOWN;
   size_t total = 0;
   uint32_t last_progress = 0;
@@ -407,14 +358,17 @@ void ESPHomeOTAComponent::handle_data_() {
   tv.tv_usec = 0;
   this->client_->setsockopt(SOL_SOCKET, SO_RCVTIMEO, &tv, sizeof(tv));
   this->client_->setsockopt(SOL_SOCKET, SO_SNDTIMEO, &tv, sizeof(tv));
-  this->client_->setblocking(true);
+  if (this->client_->setblocking(true) != 0) {
+    this->log_socket_error_(LOG_STR("blocking"));
+    goto error;  // NOLINT(cppcoreguidelines-avoid-goto)
+  }
 
   // Acknowledge auth OK - 1 byte
-  this->data_write_byte_(ota::OTA_RESPONSE_AUTH_OK);
+  this->write_byte_(ota::OTA_RESPONSE_AUTH_OK);
 
   if (this->extended_proto_) {
     // Read ota type, 1 byte
-    if (!this->data_readall_(buf, 1)) {
+    if (!this->readall_(buf, 1)) {
       this->log_read_error_(LOG_STR("OTA type"));
       goto error;  // NOLINT(cppcoreguidelines-avoid-goto)
     }
@@ -423,7 +377,7 @@ void ESPHomeOTAComponent::handle_data_() {
   ESP_LOGV(TAG, "OTA type is 0x%02x", ota_type);
 
   // Read size, 4 bytes MSB first
-  if (!this->data_readall_(buf, 4)) {
+  if (!this->readall_(buf, 4)) {
     this->log_read_error_(LOG_STR("size"));
     goto error;  // NOLINT(cppcoreguidelines-avoid-goto)
   }
@@ -454,12 +408,11 @@ void ESPHomeOTAComponent::handle_data_() {
     goto error;  // NOLINT(cppcoreguidelines-avoid-goto)
 
   // Acknowledge prepare OK - 1 byte
-  this->data_write_byte_(ota::OTA_RESPONSE_UPDATE_PREPARE_OK);
+  this->write_byte_(ota::OTA_RESPONSE_UPDATE_PREPARE_OK);
 
   // Read binary MD5, 32 bytes
-  if (!this->data_readall_(buf, 32)) {
+  if (!this->readall_(buf, 32)) {
     this->log_read_error_(LOG_STR("MD5 checksum"));
-    error_code = ota::OTA_RESPONSE_ERROR_UNKNOWN;
     goto error;  // NOLINT(cppcoreguidelines-avoid-goto)
   }
   sbuf[32] = '\0';
@@ -467,7 +420,7 @@ void ESPHomeOTAComponent::handle_data_() {
   this->backend_->set_update_md5(sbuf);
 
   // Acknowledge MD5 OK - 1 byte
-  this->data_write_byte_(ota::OTA_RESPONSE_BIN_MD5_OK);
+  this->write_byte_(ota::OTA_RESPONSE_BIN_MD5_OK);
 
   // Track when we last received data so a silently-vanished peer (no FIN/RST
   // delivered, e.g. uploader killed mid-transfer or NAT/router dropped state)
@@ -483,35 +436,19 @@ void ESPHomeOTAComponent::handle_data_() {
     }
     size_t remaining = ota_size - total;
     size_t requested = remaining < OTA_BUFFER_SIZE ? remaining : OTA_BUFFER_SIZE;
-    ssize_t read;
-#ifdef USE_OTA_ENCRYPTION
-    if (this->noise_ != nullptr) {
-      // One frame per call; noise_read_data_ waits internally (readall_), so
-      // there is no would-block retry here and failures are already logged.
-      read = this->noise_read_data_(buf, requested);
-      if (read <= 0) {
-        error_code = ota::OTA_RESPONSE_ERROR_UNKNOWN;
-        goto error;  // NOLINT(cppcoreguidelines-avoid-goto)
-      }
-    } else
-#endif
-    {
-      read = this->client_->read(buf, requested);
-      if (read == -1) {
-        const int err = errno;
-        if (this->would_block_(err)) {
-          // read() already waited up to SO_RCVTIMEO for data, just feed WDT
-          App.feed_wdt();
-          continue;
-        }
-        ESP_LOGW(TAG, "Read err %d", err);
-        error_code = ota::OTA_RESPONSE_ERROR_UNKNOWN;
-        goto error;  // NOLINT(cppcoreguidelines-avoid-goto)
-      } else if (read == 0) {
-        ESP_LOGW(TAG, "Remote closed");
-        error_code = ota::OTA_RESPONSE_ERROR_UNKNOWN;
-        goto error;  // NOLINT(cppcoreguidelines-avoid-goto)
+    ssize_t read = this->client_->read(buf, requested);
+    if (read == -1) {
+      const int err = errno;
+      if (this->would_block_(err)) {
+        // read() already waited up to SO_RCVTIMEO for data, just feed WDT
+        App.feed_wdt();
+        continue;
       }
+      ESP_LOGW(TAG, "Read err %d", err);
+      goto error;  // NOLINT(cppcoreguidelines-avoid-goto)
+    } else if (read == 0) {
+      ESP_LOGW(TAG, "Remote closed");
+      goto error;  // NOLINT(cppcoreguidelines-avoid-goto)
     }
 
     last_data_ms = millis();
@@ -523,7 +460,7 @@ void ESPHomeOTAComponent::handle_data_() {
     total += read;
 #if USE_OTA_VERSION == 2
     while (size_acknowledged + OTA_BLOCK_SIZE <= total || (total == ota_size && size_acknowledged < ota_size)) {
-      this->data_write_byte_(ota::OTA_RESPONSE_CHUNK_OK);
+      this->write_byte_(ota::OTA_RESPONSE_CHUNK_OK);
       size_acknowledged += OTA_BLOCK_SIZE;
     }
 #endif
@@ -542,7 +479,7 @@ void ESPHomeOTAComponent::handle_data_() {
   }
 
   // Acknowledge receive OK - 1 byte
-  this->data_write_byte_(ota::OTA_RESPONSE_RECEIVE_OK);
+  this->write_byte_(ota::OTA_RESPONSE_RECEIVE_OK);
 
   error_code = this->backend_->end();
   if (error_code != ota::OTA_RESPONSE_OK) {
@@ -551,10 +488,10 @@ void ESPHomeOTAComponent::handle_data_() {
   }
 
   // Acknowledge Update end OK - 1 byte
-  this->data_write_byte_(ota::OTA_RESPONSE_UPDATE_END_OK);
+  this->write_byte_(ota::OTA_RESPONSE_UPDATE_END_OK);
 
   // Read ACK
-  if (!this->data_readall_(buf, 1) || buf[0] != ota::OTA_RESPONSE_OK) {
+  if (!this->readall_(buf, 1) || buf[0] != ota::OTA_RESPONSE_OK) {
     this->log_read_error_(LOG_STR("ack"));
     // do not go to error, this is not fatal
   }
@@ -577,7 +514,7 @@ void ESPHomeOTAComponent::handle_data_() {
   App.safe_reboot();
 
 error:
-  this->data_write_byte_(static_cast<uint8_t>(error_code));
+  this->write_byte_(static_cast<uint8_t>(error_code));
 
   // Abort backend before cleanup - cleanup_connection_() destroys the backend.
   // Always call abort() unconditionally: backends register external partitions before
@@ -744,9 +681,6 @@ void ESPHomeOTAComponent::cleanup_connection_() {
   this->backend_ = nullptr;
 #ifdef USE_OTA_PASSWORD
   this->cleanup_auth_();
-#endif
-#ifdef USE_OTA_ENCRYPTION
-  this->noise_ = nullptr;
 #endif
   // Intentionally no disable_loop() — letting loop() run one more iteration catches
   // any connection that queued on the listener mid-session (otherwise the wake flag,

esphome/components/esphome/ota/ota_esphome.h

@@ -4,9 +4,6 @@
 #ifdef USE_OTA
 #include "esphome/components/ota/ota_backend_factory.h"
 #include "esphome/components/socket/socket.h"
-#ifdef USE_OTA_ENCRYPTION
-#include "esphome/components/noise/noise_handshake.h"
-#endif
 #include "esphome/core/helpers.h"
 #include "esphome/core/log.h"
 #include "esphome/core/preferences.h"
@@ -27,10 +24,7 @@ class ESPHomeOTAComponent final : public ota::OTAComponent {
     AUTH_SEND,  // Sending authentication request
     AUTH_READ,  // Reading authentication data
 #endif          // USE_OTA_PASSWORD
-#ifdef USE_OTA_ENCRYPTION
-    NOISE_HANDSHAKE,  // Exchanging Noise handshake frames
-#endif
-    DATA,  // BLOCKING! Processing OTA data (update, etc.)
+    DATA,       // BLOCKING! Processing OTA data (update, etc.)
   };
 #ifdef USE_OTA_PASSWORD
   void set_auth_password(const std::string &password) { password_ = password; }
@@ -44,10 +38,6 @@ class ESPHomeOTAComponent final : public ota::OTAComponent {
   }
 #endif  // USE_OTA_PASSWORD
 
-#ifdef USE_OTA_ENCRYPTION
-  void set_noise_psk(noise::psk_t psk) { this->noise_ctx_.set_psk(psk); }
-#endif
-
   /// Manually set the port OTA should listen on
   void set_port(uint16_t port) { this->port_ = port; }
 
@@ -73,48 +63,6 @@ class ESPHomeOTAComponent final : public ota::OTAComponent {
   bool writeall_(const uint8_t *buf, size_t len);
   inline bool write_byte_(uint8_t byte) { return this->writeall_(&byte, 1); }
 
-#ifdef USE_OTA_ENCRYPTION
-  // Heap-allocated only while an encrypted OTA session is active.
-  struct NoiseSession {
-    ~NoiseSession();
-    noise::NoiseResponderHandshake handshake;
-    NoiseCipherState *send_cipher{nullptr};
-    NoiseCipherState *recv_cipher{nullptr};
-    uint16_t frame_len{0};  // total frame size once the header is parsed, 0 until then
-    uint16_t frame_pos{0};  // bytes read or written so far
-    bool writing{false};    // a produced handshake frame is still being flushed
-    uint8_t frame_buf[noise::FRAME_HEADER_SIZE + 1 + noise::MAX_HANDSHAKE_SIZE];
-  };
-  bool noise_start_session_(uint8_t server_feature_flags);
-  bool handle_noise_handshake_();
-  bool noise_try_read_frame_();
-  bool noise_try_write_frame_();
-  void noise_send_reject_(const LogString *reason);
-  ssize_t noise_decrypt_(uint8_t *buf, size_t len);
-  ssize_t noise_read_frame_blocking_(uint8_t *buf, size_t min_ciphertext, size_t max_ciphertext);
-  bool noise_readall_(uint8_t *buf, size_t len);
-  ssize_t noise_read_data_(uint8_t *buf, size_t capacity);
-  bool noise_write_byte_(uint8_t byte);
-#endif  // USE_OTA_ENCRYPTION
-
-  // Data-phase I/O dispatch: through the noise transport when a session is
-  // active, straight to the socket otherwise.
-  inline bool data_write_byte_(uint8_t byte) {
-#ifdef USE_OTA_ENCRYPTION
-    if (this->noise_ != nullptr)
-      return this->noise_write_byte_(byte);
-#endif
-    return this->write_byte_(byte);
-  }
-  // When encrypted, buf must have room for len + noise::MAC_SIZE bytes.
-  inline bool data_readall_(uint8_t *buf, size_t len) {
-#ifdef USE_OTA_ENCRYPTION
-    if (this->noise_ != nullptr)
-      return this->noise_readall_(buf, len);
-#endif
-    return this->readall_(buf, len);
-  }
-
   bool try_read_(size_t to_read, const LogString *desc);
   bool try_write_(size_t to_write, const LogString *desc);
 
@@ -143,10 +91,6 @@ class ESPHomeOTAComponent final : public ota::OTAComponent {
   std::string password_;
   std::unique_ptr<uint8_t[]> auth_buf_;
 #endif  // USE_OTA_PASSWORD
-#ifdef USE_OTA_ENCRYPTION
-  noise::NoiseContext noise_ctx_;
-  std::unique_ptr<NoiseSession> noise_;
-#endif  // USE_OTA_ENCRYPTION
 
   socket::ListenSocket *server_{nullptr};
   std::unique_ptr<socket::Socket> client_;
@@ -154,18 +98,6 @@ class ESPHomeOTAComponent final : public ota::OTAComponent {
 
   uint32_t client_connect_time_{0};
   static constexpr size_t HANDSHAKE_BUF_SIZE = 5;
-  // Buffer size for OTA data transfer. The upload client derives its maximum
-  // encrypted frame plaintext from this (espota2.NOISE_MAX_PLAINTEXT is this
-  // minus the 16-byte MAC); both must change together.
-  static constexpr size_t OTA_BUFFER_SIZE = 1040;
-#ifdef USE_OTA_ENCRYPTION
-  // espota2.NOISE_MAX_PLAINTEXT; shrinking the buffer would reject every
-  // frame a current CLI sends
-  static constexpr size_t NOISE_CLIENT_MAX_PLAINTEXT = 1024;
-  static_assert(OTA_BUFFER_SIZE >= NOISE_CLIENT_MAX_PLAINTEXT + noise::MAC_SIZE,
-                "OTA_BUFFER_SIZE must fit a full encrypted data frame");
-#endif
-  static constexpr uint8_t MAGIC_BYTES[5] = {0x6C, 0x26, 0xF7, 0x5C, 0x45};
 #ifdef USE_OTA_PARTITIONS
   uint32_t running_app_offset_{0};
   size_t running_app_size_{0};

esphome/components/esphome/ota/ota_esphome_noise.cpp

@@ -1,279 +0,0 @@
-#include "ota_esphome.h"
-#ifdef USE_OTA
-#ifdef USE_OTA_ENCRYPTION
-#include "esphome/components/noise/noise.h"
-#include "esphome/components/ota/ota_backend.h"
-#include "esphome/core/log.h"
-
-#include <cstring>
-#include <new>
-
-#ifdef USE_ESP8266
-#include <pgmspace.h>
-#endif
-
-namespace esphome {
-
-static const char *const TAG = "esphome.ota";
-
-#ifdef USE_ESP8266
-static constexpr char OTA_NOISE_PROLOGUE_INIT[] PROGMEM = "NoiseOTAInit";
-#else
-static constexpr char OTA_NOISE_PROLOGUE_INIT[] = "NoiseOTAInit";
-#endif
-static constexpr size_t OTA_NOISE_PROLOGUE_INIT_LEN = sizeof(OTA_NOISE_PROLOGUE_INIT) - 1;
-
-ESPHomeOTAComponent::NoiseSession::~NoiseSession() {
-  if (this->send_cipher != nullptr) {
-    noise_cipherstate_free(this->send_cipher);
-  }
-  if (this->recv_cipher != nullptr) {
-    noise_cipherstate_free(this->recv_cipher);
-  }
-}
-
-/** Allocate the session and start the responder handshake.
- *
- * The prologue binds the whole plaintext preamble, so any tampering with the
- * negotiation (a stripped feature flag, a changed version) breaks the first
- * handshake MAC on either side:
- *   "NoiseOTAInit" | magic(5) | OK,version | client_features | FEATURE_FLAGS,server_flags
- */
-bool ESPHomeOTAComponent::noise_start_session_(uint8_t server_feature_flags) {
-  // NOLINTNEXTLINE(clang-analyzer-cplusplus.NewDeleteLeaks)
-  this->noise_ = std::unique_ptr<NoiseSession>(new (std::nothrow) NoiseSession());
-  if (this->noise_ == nullptr) {
-    ESP_LOGW(TAG, "Session allocation failed");
-    this->cleanup_connection_();
-    return false;
-  }
-
-  static constexpr size_t PROLOGUE_ACK_LEN = 2;  // OTA_RESPONSE_OK + version
-  static constexpr size_t PROLOGUE_CLIENT_FEATURES_LEN = 1;
-  static constexpr size_t PROLOGUE_FEATURE_ACK_LEN = 2;  // OTA_RESPONSE_FEATURE_FLAGS + server flags
-  uint8_t prologue[OTA_NOISE_PROLOGUE_INIT_LEN + sizeof(MAGIC_BYTES) + PROLOGUE_ACK_LEN + PROLOGUE_CLIENT_FEATURES_LEN +
-                   PROLOGUE_FEATURE_ACK_LEN];
-#ifdef USE_ESP8266
-  memcpy_P(prologue, OTA_NOISE_PROLOGUE_INIT, OTA_NOISE_PROLOGUE_INIT_LEN);
-#else
-  std::memcpy(prologue, OTA_NOISE_PROLOGUE_INIT, OTA_NOISE_PROLOGUE_INIT_LEN);
-#endif
-  uint8_t *p = prologue + OTA_NOISE_PROLOGUE_INIT_LEN;
-  // Magic bytes, already validated in MAGIC_READ
-  std::memcpy(p, MAGIC_BYTES, sizeof(MAGIC_BYTES));
-  p += sizeof(MAGIC_BYTES);
-  // Our magic ack
-  *p++ = ota::OTA_RESPONSE_OK;
-  *p++ = USE_OTA_VERSION;
-  // The feature byte the client sent
-  *p++ = this->ota_features_;
-  // The feature ack we sent (noise requires the extended protocol)
-  *p++ = ota::OTA_RESPONSE_FEATURE_FLAGS;
-  *p++ = server_feature_flags;
-
-  int err = this->noise_->handshake.init(this->noise_ctx_.get_psk(), prologue, sizeof(prologue));
-  if (err != 0) {
-    ESP_LOGW(TAG, "Handshake init: %s", LOG_STR_ARG(noise::noise_err_to_logstr(err)));
-    this->cleanup_connection_();
-    return false;
-  }
-  return true;
-}
-
-/** Drive the non-blocking handshake from loop(); returns true once the
- * transport ciphers are ready. A would-block returns false and the next
- * loop() resumes from the NoiseSession cursors; on failure the connection
- * is cleaned up.
- */
-bool ESPHomeOTAComponent::handle_noise_handshake_() {
-  NoiseSession &s = *this->noise_;
-  while (true) {
-    if (s.writing) {
-      if (!this->noise_try_write_frame_()) {
-        return false;  // would block, or errored and cleaned up
-      }
-      s.writing = false;
-      s.frame_pos = 0;
-      s.frame_len = 0;
-    }
-    switch (s.handshake.action()) {
-      case noise::NoiseResponderHandshake::Action::ACTION_READ: {
-        if (!this->noise_try_read_frame_()) {
-          return false;
-        }
-        const uint16_t payload_len = s.frame_len - noise::FRAME_HEADER_SIZE;
-        s.frame_pos = 0;
-        s.frame_len = 0;
-        if (s.frame_buf[noise::FRAME_HEADER_SIZE] != noise::HANDSHAKE_STATUS_OK) {
-          ESP_LOGW(TAG, "Bad handshake error byte: %u", s.frame_buf[noise::FRAME_HEADER_SIZE]);
-          this->cleanup_connection_();
-          return false;
-        }
-        int err = s.handshake.read_message(s.frame_buf + noise::FRAME_HEADER_SIZE + 1, payload_len - 1);
-        if (err != 0) {
-          ESP_LOGW(TAG, "Handshake read: %s", LOG_STR_ARG(noise::noise_err_to_logstr(err)));
-          this->noise_send_reject_(noise::reject_reason_for(err));
-          this->cleanup_connection_();
-          return false;
-        }
-        break;
-      }
-      case noise::NoiseResponderHandshake::Action::ACTION_WRITE: {
-        size_t msg_len = 0;
-        int err =
-            s.handshake.write_message(s.frame_buf + noise::FRAME_HEADER_SIZE + 1, noise::MAX_HANDSHAKE_SIZE, msg_len);
-        if (err != 0) {
-          ESP_LOGW(TAG, "Handshake write: %s", LOG_STR_ARG(noise::noise_err_to_logstr(err)));
-          this->cleanup_connection_();
-          return false;
-        }
-        const uint16_t payload_len = msg_len + 1;
-        noise::write_frame_header(s.frame_buf, payload_len);
-        s.frame_buf[noise::FRAME_HEADER_SIZE] = noise::HANDSHAKE_STATUS_OK;
-        s.frame_len = noise::FRAME_HEADER_SIZE + payload_len;
-        s.frame_pos = 0;
-        s.writing = true;
-        break;
-      }
-      case noise::NoiseResponderHandshake::Action::ACTION_SPLIT: {
-        int err = s.handshake.split(s.send_cipher, s.recv_cipher);
-        if (err != 0) {
-          ESP_LOGW(TAG, "Handshake split: %s", LOG_STR_ARG(noise::noise_err_to_logstr(err)));
-          this->cleanup_connection_();
-          return false;
-        }
-        ESP_LOGD(TAG, "Noise handshake complete");
-        return true;
-      }
-      default: {
-        ESP_LOGW(TAG, "Bad handshake state");
-        this->cleanup_connection_();
-        return false;
-      }
-    }
-  }
-}
-
-/// Non-blocking read of one handshake frame into the session buffer.
-bool ESPHomeOTAComponent::noise_try_read_frame_() {
-  NoiseSession &s = *this->noise_;
-  while (s.frame_pos < noise::FRAME_HEADER_SIZE) {
-    ssize_t read = this->client_->read(s.frame_buf + s.frame_pos, noise::FRAME_HEADER_SIZE - s.frame_pos);
-    if (!this->handle_read_error_(read, LOG_STR("read noise header"))) {
-      return false;
-    }
-    s.frame_pos += read;
-  }
-  if (s.frame_len == 0) {
-    const uint16_t payload_len = encode_uint16(s.frame_buf[1], s.frame_buf[2]);
-    if (s.frame_buf[0] != noise::FRAME_INDICATOR || payload_len < 1 || payload_len > 1 + noise::MAX_HANDSHAKE_SIZE) {
-      ESP_LOGW(TAG, "Bad handshake frame: 0x%02X, %u bytes", s.frame_buf[0], payload_len);
-      this->cleanup_connection_();
-      return false;
-    }
-    s.frame_len = noise::FRAME_HEADER_SIZE + payload_len;
-  }
-  while (s.frame_pos < s.frame_len) {
-    ssize_t read = this->client_->read(s.frame_buf + s.frame_pos, s.frame_len - s.frame_pos);
-    if (!this->handle_read_error_(read, LOG_STR("read noise frame"))) {
-      return false;
-    }
-    s.frame_pos += read;
-  }
-  return true;
-}
-
-/// Non-blocking write of the pending session-buffer frame.
-bool ESPHomeOTAComponent::noise_try_write_frame_() {
-  NoiseSession &s = *this->noise_;
-  while (s.frame_pos < s.frame_len) {
-    ssize_t written = this->client_->write(s.frame_buf + s.frame_pos, s.frame_len - s.frame_pos);
-    if (!this->handle_write_error_(written, LOG_STR("write noise frame"))) {
-      return false;
-    }
-    s.frame_pos += written;
-  }
-  return true;
-}
-
-/// Best-effort explicit reject frame so the client can log a readable reason.
-void ESPHomeOTAComponent::noise_send_reject_(const LogString *reason) {
-  // Every reason here comes from noise::reject_reason_for(), so the exported
-  // floor is the exact capacity needed
-  uint8_t data[noise::FRAME_HEADER_SIZE + noise::MAC_FAILURE_PAYLOAD_SIZE];
-  const size_t payload_len =
-      noise::format_reject_payload(data + noise::FRAME_HEADER_SIZE, sizeof(data) - noise::FRAME_HEADER_SIZE, reason);
-  noise::write_frame_header(data, payload_len);
-  this->client_->write(data, noise::FRAME_HEADER_SIZE + payload_len);  // Best effort, non-blocking
-}
-
-/// Decrypt a ciphertext in place; returns the plaintext size or -1.
-ssize_t ESPHomeOTAComponent::noise_decrypt_(uint8_t *buf, size_t len) {
-  NoiseBuffer mbuf;
-  noise_buffer_init(mbuf);
-  noise_buffer_set_inout(mbuf, buf, len, len);
-  int err = noise_cipherstate_decrypt(this->noise_->recv_cipher, &mbuf);
-  if (err != 0) {
-    ESP_LOGW(TAG, "Decrypt: %s", LOG_STR_ARG(noise::noise_err_to_logstr(err)));
-    return -1;
-  }
-  return mbuf.size;
-}
-
-/** Blocking read of one frame whose ciphertext size must be within the given
- * bounds, decrypted in place; returns the plaintext size, or -1 on error.
- * buf needs max_ciphertext capacity.
- */
-ssize_t ESPHomeOTAComponent::noise_read_frame_blocking_(uint8_t *buf, size_t min_ciphertext, size_t max_ciphertext) {
-  uint8_t header[noise::FRAME_HEADER_SIZE];
-  if (!this->readall_(header, sizeof(header))) {
-    return -1;
-  }
-  const size_t ciphertext_len = encode_uint16(header[1], header[2]);
-  if (header[0] != noise::FRAME_INDICATOR || ciphertext_len < min_ciphertext || ciphertext_len > max_ciphertext) {
-    ESP_LOGW(TAG, "Bad frame: 0x%02X, %zu bytes", header[0], ciphertext_len);
-    return -1;
-  }
-  if (!this->readall_(buf, ciphertext_len)) {
-    return -1;
-  }
-  return this->noise_decrypt_(buf, ciphertext_len);
-}
-
-/** Blocking read of one frame whose plaintext must be exactly len bytes
- * (control units are one unit per frame). buf needs len + noise::MAC_SIZE
- * capacity; the plaintext lands at buf[0..len).
- */
-bool ESPHomeOTAComponent::noise_readall_(uint8_t *buf, size_t len) {
-  return this->noise_read_frame_blocking_(buf, len + noise::MAC_SIZE, len + noise::MAC_SIZE) == (ssize_t) len;
-}
-
-/** Blocking read of one data-phase frame, decrypted in place; returns the
- * plaintext size, or -1 on error. buf is the OTA_BUFFER_SIZE data buffer.
- * The ciphertext must fit that buffer and its plaintext must fit what the
- * caller accepts (the remaining image bytes).
- */
-ssize_t ESPHomeOTAComponent::noise_read_data_(uint8_t *buf, size_t capacity) {
-  const size_t max_ciphertext = std::min(capacity + noise::MAC_SIZE, OTA_BUFFER_SIZE);
-  return this->noise_read_frame_blocking_(buf, noise::MAC_SIZE + 1, max_ciphertext);
-}
-
-/// Blocking write of one response byte as an encrypted frame.
-bool ESPHomeOTAComponent::noise_write_byte_(uint8_t byte) {
-  uint8_t frame[noise::FRAME_HEADER_SIZE + 1 + noise::MAC_SIZE];
-  frame[noise::FRAME_HEADER_SIZE] = byte;
-  NoiseBuffer mbuf;
-  noise_buffer_init(mbuf);
-  noise_buffer_set_inout(mbuf, frame + noise::FRAME_HEADER_SIZE, 1, 1 + noise::MAC_SIZE);
-  int err = noise_cipherstate_encrypt(this->noise_->send_cipher, &mbuf);
-  if (err != 0) {
-    ESP_LOGW(TAG, "Encrypt: %s", LOG_STR_ARG(noise::noise_err_to_logstr(err)));
-    return false;
-  }
-  noise::write_frame_header(frame, mbuf.size);
-  return this->writeall_(frame, noise::FRAME_HEADER_SIZE + mbuf.size);
-}
-
-}  // namespace esphome
-#endif  // USE_OTA_ENCRYPTION
-#endif  // USE_OTA

esphome/components/fan/fan.cpp

@@ -334,9 +334,8 @@ void Fan::dump_traits_(const char *tag, const char *prefix) {
   }
   if (traits.supports_preset_modes()) {
     ESP_LOGCONFIG(tag, "%s  Supported presets:", prefix);
-    for (const char *s : traits.supported_preset_modes()) {
+    for (const char *s : traits.supported_preset_modes())
       ESP_LOGCONFIG(tag, "%s    - %s", prefix, s);
-    }
   }
 }
 

esphome/components/hbridge/switch/hbridge_switch.cpp

@@ -29,9 +29,8 @@ void HBridgeSwitch::dump_config() {
   LOG_PIN("  On Pin: ", this->on_pin_);
   LOG_PIN("  Off Pin: ", this->off_pin_);
   ESP_LOGCONFIG(TAG, "  Pulse length: %" PRId32 " ms", this->pulse_length_);
-  if (this->wait_time_) {
+  if (this->wait_time_)
     ESP_LOGCONFIG(TAG, "  Wait time %" PRId32 " ms", this->wait_time_);
-  }
 }
 
 void HBridgeSwitch::write_state(bool state) {

esphome/components/he60r/he60r.cpp

@@ -44,9 +44,8 @@ void HE60rCover::dump_config() {
                 "  Close Duration: %.1fs",
                 this->open_duration_ / 1e3f, this->close_duration_ / 1e3f);
   auto restore = this->restore_state_();
-  if (restore.has_value()) {
+  if (restore.has_value())
     ESP_LOGCONFIG(TAG, "  Saved position %d%%", (int) (restore->position * 100.f));
-  }
 }
 
 void HE60rCover::endstop_reached_(CoverOperation operation) {
@@ -78,9 +77,8 @@ void HE60rCover::process_rx_(uint8_t data) {
   ESP_LOGV(TAG, "Process RX data %X", data);
   if (!this->query_seen_) {
     this->query_seen_ = data == QUERY_BYTE;
-    if (!this->query_seen_) {
+    if (!this->query_seen_)
       ESP_LOGD(TAG, "RX Byte %02X", data);
-    }
     return;
   }
   switch (data) {

esphome/components/hoermann_hcp/hoermann_hcp.cpp

@@ -257,9 +257,8 @@ void HoermannHcp::on_state_reg_(uint16_t value) {
     }
   }
   // The low byte can change on its own, so only report a state we cannot decode once.
-  if (state != (previous >> 8)) {
+  if (state != (previous >> 8))
     ESP_LOGW(TAG, "Unknown door state 0x%02X", state);
-  }
 }
 
 // Low byte of register 6: bit 0x10 is the lamp, bit 0x04 the relay. The reference implementation records

esphome/components/key_collector/key_collector.cpp

@@ -16,33 +16,26 @@ void KeyCollector::loop() {
 void KeyCollector::dump_config() {
 #if ESPHOME_LOG_LEVEL >= ESPHOME_LOG_LEVEL_CONFIG
   ESP_LOGCONFIG(TAG, "Key Collector:");
-  if (this->min_length_ > 0) {
+  if (this->min_length_ > 0)
     ESP_LOGCONFIG(TAG, "  min length: %d", this->min_length_);
-  }
-  if (this->max_length_ > 0) {
+  if (this->max_length_ > 0)
     ESP_LOGCONFIG(TAG, "  max length: %d", this->max_length_);
-  }
-  if (!this->back_keys_.empty()) {
+  if (!this->back_keys_.empty())
     ESP_LOGCONFIG(TAG, "  erase keys '%s'", this->back_keys_.c_str());
-  }
-  if (!this->clear_keys_.empty()) {
+  if (!this->clear_keys_.empty())
     ESP_LOGCONFIG(TAG, "  clear keys '%s'", this->clear_keys_.c_str());
-  }
-  if (!this->start_keys_.empty()) {
+  if (!this->start_keys_.empty())
     ESP_LOGCONFIG(TAG, "  start keys '%s'", this->start_keys_.c_str());
-  }
   if (!this->end_keys_.empty()) {
     ESP_LOGCONFIG(TAG,
                   "  end keys '%s'\n"
                   "  end key is required: %s",
                   this->end_keys_.c_str(), ONOFF(this->end_key_required_));
   }
-  if (!this->allowed_keys_.empty()) {
+  if (!this->allowed_keys_.empty())
     ESP_LOGCONFIG(TAG, "  allowed keys '%s'", this->allowed_keys_.c_str());
-  }
-  if (this->timeout_ > 0) {
+  if (this->timeout_ > 0)
     ESP_LOGCONFIG(TAG, "  entry timeout: %0.1f", this->timeout_ / 1000.0);
-  }
 #endif
 }
 

esphome/components/ln882h_ble/ln882h_ble.cpp

@@ -333,9 +333,8 @@ void LN882HBLE::loop() {
   // the queue empty — from the very first report on. Checking here keeps that
   // failure visible instead of producing a scanner that is silently dead.
   uint16_t dropped = this->report_queue_.get_and_reset_dropped_count();
-  if (dropped > 0) {
+  if (dropped > 0)
     ESP_LOGW(TAG, "Dropped %u scan reports (queue full or out of memory for a report slot)", dropped);
-  }
   // Drain the lock-free ring filled by the rw task; all per-report work runs
   // here on the main task, then the report returns to the pool.
   BLEScanReport *report = this->report_queue_.pop();

esphome/components/lvgl/lvgl_esphome.cpp

@@ -1059,9 +1059,8 @@ static void *lv_alloc_draw_buf(size_t size, bool internal) {
   void *buffer;
   size = LV_ROUND_UP(size, LV_DRAW_BUF_ALIGN);
   buffer = heap_caps_aligned_alloc(LV_DRAW_BUF_ALIGN, size, internal ? MALLOC_CAP_8BIT : cap_bits);  // NOLINT
-  if (buffer == nullptr) {
+  if (buffer == nullptr)
     ESP_LOGW(esphome::lvgl::TAG, "Failed to allocate %zu bytes for %sdraw buffer", size, internal ? "internal " : "");
-  }
   return buffer;
 }
 

esphome/components/lvgl/widgets/table.py

@@ -2,7 +2,7 @@ from contextlib import ExitStack
 
 from esphome import automation
 import esphome.codegen as cg
-from esphome.components.const import CONF_COLUMNS, CONF_ROWS
+from esphome.components.const import CONF_ROWS
 import esphome.config_validation as cv
 from esphome.const import CONF_ID, CONF_ITEMS, CONF_ROW, CONF_TEXT, CONF_WIDTH
 from esphome.core import ID
@@ -20,6 +20,7 @@ from .label import CONF_LABEL
 
 CONF_TABLE = "table"
 CONF_CELLS = "cells"
+CONF_COLUMNS = "columns"
 CONF_ROW_COUNT = "row_count"
 CONF_COLUMN_COUNT = "column_count"
 CONF_MERGE_RIGHT = "merge_right"

esphome/components/matrix_keypad/__init__.py

@@ -1,7 +1,7 @@
 from esphome import automation, pins
 import esphome.codegen as cg
 from esphome.components import key_provider
-from esphome.components.const import CONF_COLUMNS, CONF_KEYS, CONF_ROWS
+from esphome.components.const import CONF_ROWS
 import esphome.config_validation as cv
 from esphome.const import CONF_ID, CONF_ON_KEY, CONF_PIN, CONF_TRIGGER_ID
 from esphome.types import ConfigType
@@ -21,6 +21,8 @@ MatrixKeyTrigger = matrix_keypad_ns.class_(
 )
 
 CONF_KEYPAD_ID = "keypad_id"
+CONF_COLUMNS = "columns"
+CONF_KEYS = "keys"
 CONF_DEBOUNCE_TIME = "debounce_time"
 CONF_HAS_DIODES = "has_diodes"
 CONF_HAS_PULLDOWNS = "has_pulldowns"

esphome/components/mipi_dsi/mipi_dsi.cpp

@@ -237,9 +237,8 @@ void MipiDsi::write_to_display_(int x_start, int y_start, int w, int h, const ui
       xSemaphoreTake(this->io_lock_, portMAX_DELAY);
     }
   }
-  if (err != ESP_OK) {
+  if (err != ESP_OK)
     ESP_LOGE(TAG, "lcd_lcd_panel_draw_bitmap failed: %s", esp_err_to_name(err));
-  }
 }
 
 bool MipiDsi::check_buffer_() {

esphome/components/mipi_rgb/mipi_rgb.cpp

@@ -5,7 +5,7 @@
 #include "esphome/core/helpers.h"
 #include "esphome/core/log.h"
 #include <driver/gpio.h>
-#include <esp_lcd_panel_ops.h>
+#include <esp_lcd_panel_rgb.h>
 #include <span>
 
 namespace esphome::mipi_rgb {
@@ -177,6 +177,11 @@ void MipiRgb::common_setup_() {
   ESP_LOGCONFIG(TAG, "MipiRgb setup complete");
 }
 
+void MipiRgb::loop() {
+  if (this->handle_ != nullptr)
+    esp_lcd_rgb_panel_restart(this->handle_);
+}
+
 void MipiRgb::update() {
   if (this->is_failed())
     return;
@@ -238,9 +243,8 @@ void MipiRgb::write_to_display_(int x_start, int y_start, int w, int h, const ui
       ptr += stride;  // next line
     }
   }
-  if (err != ESP_OK) {
+  if (err != ESP_OK)
     ESP_LOGE(TAG, "lcd_lcd_panel_draw_bitmap failed: %s", esp_err_to_name(err));
-  }
 }
 
 bool MipiRgb::check_buffer_() {

esphome/components/mipi_rgb/mipi_rgb.h

@@ -3,7 +3,7 @@
 #if defined(USE_ESP32_VARIANT_ESP32S3) || defined(USE_ESP32_VARIANT_ESP32P4) || defined(USE_ESP32_VARIANT_ESP32S31)
 #include "esphome/core/gpio.h"
 #include "esphome/components/display/display.h"
-#include <esp_lcd_panel_rgb.h>
+#include "esp_lcd_panel_ops.h"
 #ifdef USE_SPI
 #include "esphome/components/spi/spi.h"
 #endif
@@ -25,12 +25,7 @@ class MipiRgb : public display::Display {
  public:
   MipiRgb(int width, int height) : width_(width), height_(height) {}
   void setup() override;
-#ifdef USE_ESP32_VARIANT_ESP32S3
-  void loop() override {
-    if (this->handle_ != nullptr)
-      esp_lcd_rgb_panel_restart(this->handle_);
-  }
-#endif
+  void loop() override;
   void update() override;
   void fill(Color color) override;
   void draw_pixels_at(int x_start, int y_start, int w, int h, const uint8_t *ptr, display::ColorOrder order,

esphome/components/mipi_spi/mipi_spi.cpp

@@ -31,15 +31,12 @@ void internal_dump_config(const char *model, int width, int height, int offset_w
   LOG_PIN("  CS Pin: ", cs);
   LOG_PIN("  Reset Pin: ", reset);
   LOG_PIN("  DC Pin: ", dc);
-  if (offset_width != 0) {
+  if (offset_width != 0)
     ESP_LOGCONFIG(TAG, "  Offset width: %d", offset_width);
-  }
-  if (offset_height != 0) {
+  if (offset_height != 0)
     ESP_LOGCONFIG(TAG, "  Offset height: %d", offset_height);
-  }
-  if (brightness.has_value()) {
+  if (brightness.has_value())
     ESP_LOGCONFIG(TAG, "  Brightness: %u", brightness.value());
-  }
 }
 
 }  // namespace esphome::mipi_spi

esphome/components/modbus/modbus.cpp

@@ -1199,17 +1199,15 @@ void ModbusServerHub::send_raw_(const uint8_t *payload, uint16_t len) {
     this->set_timeout("deferred_send", (this->tx_delay_remaining() + US_PER_MS - 1) / US_PER_MS, [this]() {
       ModbusFrame frame(this->deferred_payload_[0], this->deferred_payload_.data() + 1,
                         this->deferred_payload_len_ - 1);
-      if (!this->send_frame_(frame)) {
+      if (!this->send_frame_(frame))
         ESP_LOGE(TAG, "Deferred server reply dropped: transmission still blocked");
-      }
     });
     return;
   }
 
   ModbusFrame frame(payload[0], payload + 1, len - 1);
-  if (!this->send_frame_(frame)) {
+  if (!this->send_frame_(frame))
     ESP_LOGE(TAG, "Server reply dropped: a frame arrived during the send delay");
-  }
 }
 
 void Modbus::clear_rx_buffer_(const LogString *reason, bool warn, size_t bytes_to_clear) {

esphome/components/mqtt/mqtt_component.cpp

@@ -39,12 +39,10 @@ inline char *append_char(char *p, char c) {
 // Function implementation of LOG_MQTT_COMPONENT macro to reduce code size
 void log_mqtt_component(const char *tag, MQTTComponent *obj, bool state_topic, bool command_topic) {
   char buf[MQTT_DEFAULT_TOPIC_MAX_LEN];
-  if (state_topic) {
+  if (state_topic)
     ESP_LOGCONFIG(tag, "  State Topic: '%s'", obj->get_state_topic_to_(buf).c_str());
-  }
-  if (command_topic) {
+  if (command_topic)
     ESP_LOGCONFIG(tag, "  Command Topic: '%s'", obj->get_command_topic_to_(buf).c_str());
-  }
 }
 
 void MQTTComponent::set_qos(uint8_t qos) { this->qos_ = qos; }

esphome/components/noise/__init__.py

@@ -45,15 +45,6 @@ def decode_encryption_key(value: str) -> bytes:
     return decoded
 
 
-def is_reserved_key(value: str) -> bool:
-    """Whether the key is the reserved all-zeros provisioning sentinel.
-
-    The device treats it as no key configured, so consumers that require a
-    real key must reject it.
-    """
-    return not any(decode_encryption_key(value))
-
-
 ENCRYPTION_SCHEMA = cv.Schema(
     {
         cv.Optional(CONF_KEY): cv.sensitive(validate_encryption_key),

esphome/components/noise/noise.h

@@ -6,8 +6,6 @@
 #include <cstdint>
 #include "esphome/core/log.h"
 
-#include "noise_resume.h"
-
 namespace esphome::noise {
 
 using psk_t = std::array<uint8_t, 32>;
@@ -28,16 +26,12 @@ class NoiseContext {
   void set_psk(psk_t psk) {
     this->psk_ = psk;
     this->has_psk_ = !is_all_zeros(psk);
-    // Resume tickets were minted under the old key; forget them
-    this->resume_cache_.clear();
   }
   const psk_t &get_psk() const { return this->psk_; }
   bool has_psk() const { return this->has_psk_; }
-  ResumeTicketCache &resume_cache() { return this->resume_cache_; }
 
  protected:
   psk_t psk_{};
-  ResumeTicketCache resume_cache_;
   bool has_psk_{false};
 };
 

esphome/components/noise/noise_resume.cpp

@@ -1,127 +0,0 @@
-#include "noise_resume.h"
-#ifdef USE_NOISE
-#include <cstring>
-
-#include <noise/protocol.h>
-
-#include "esphome/core/hal.h"
-#include "esphome/core/helpers.h"
-
-namespace esphome::noise {
-
-const char RESUME_LABEL_OFFER[6] PROGMEM = "offer";
-const char RESUME_LABEL_CONFIRM[8] PROGMEM = "confirm";
-const char RESUME_LABEL_KEYS[5] PROGMEM = "keys";
-bool resume_kdf(const uint8_t *secret, const char *label, size_t label_len, const uint8_t *a, size_t a_len,
-                const uint8_t *b, size_t b_len, const uint8_t *hash_in, size_t hash_in_len, uint8_t *out1,
-                size_t out1_len, uint8_t *out2) {
-  uint8_t data[RESUME_KDF_MAX_DATA];
-  uint8_t scratch[32];
-  size_t len = label_len + a_len + b_len;
-  progmem_memcpy(data, label, label_len);
-  std::memcpy(data + label_len, a, a_len);
-  std::memcpy(data + label_len + a_len, b, b_len);
-  NoiseHashState *hash = nullptr;
-  if (noise_hashstate_new_by_id(&hash, NOISE_HASH_SHA256) != NOISE_ERROR_NONE) {
-    return false;
-  }
-  int err = NOISE_ERROR_NONE;
-  if (hash_in != nullptr) {
-    err = noise_hashstate_hash_one(hash, hash_in, hash_in_len, data + len, 32);
-    len += 32;
-  }
-  if (err == NOISE_ERROR_NONE) {
-    err = noise_hashstate_hkdf(hash, secret, RESUME_SECRET_SIZE, data, len, out1, out1_len,
-                               out2 != nullptr ? out2 : scratch, 32);
-  }
-  noise_hashstate_free(hash);
-  noise_clean(data, sizeof(data));
-  noise_clean(scratch, sizeof(scratch));
-  return err == NOISE_ERROR_NONE;
-}
-
-bool ResumeTicketCache::issue(ResumeTicket &out) {
-  if (!random_bytes(reinterpret_cast<uint8_t *>(&out), sizeof(out))) {
-    return false;
-  }
-  uint8_t slot = this->next_;
-  this->next_ = static_cast<uint8_t>((slot + 1) % SLOTS);
-  this->slots_[slot] = out;
-  this->used_mask_ |= static_cast<uint8_t>(1u << slot);
-  return true;
-}
-
-size_t ResumeTicketCache::try_accept(const uint8_t *offer, size_t offer_len, const uint8_t *prologue,
-                                     size_t prologue_len, uint8_t *out_ext, size_t out_capacity,
-                                     NoiseCipherState *&send_cipher, NoiseCipherState *&recv_cipher) {
-  if (offer_len != RESUME_OFFER_SIZE || offer[0] != RESUME_OFFER_VERSION || out_capacity < RESUME_ACCEPT_SIZE) {
-    return 0;
-  }
-  const uint8_t *session_id = offer + RESUME_OFFER_SESSION_ID_OFFSET;
-  const uint8_t *client_nonce = offer + RESUME_OFFER_NONCE_OFFSET;
-  ResumeTicket *ticket = nullptr;
-  for (uint8_t i = 0; i < SLOTS; i++) {
-    if ((this->used_mask_ & (1u << i)) &&
-        std::memcmp(this->slots_[i].session_id, session_id, RESUME_SESSION_ID_SIZE) == 0) {
-      ticket = &this->slots_[i];
-      this->used_mask_ &= static_cast<uint8_t>(~(1u << i));
-      break;
-    }
-  }
-  if (ticket == nullptr) {
-    return 0;
-  }
-  uint8_t expected[RESUME_MAC_SIZE];
-  bool ok = resume_compute_offer_mac(ticket->secret, session_id, client_nonce, expected) &&
-            noise_is_equal(expected, offer + RESUME_OFFER_MAC_OFFSET, RESUME_MAC_SIZE);
-  noise_clean(expected, sizeof(expected));
-  if (!ok) {
-    // Bad MAC: keep the ticket so a forger cannot burn it
-    this->used_mask_ |= static_cast<uint8_t>(1u << static_cast<uint8_t>(ticket - this->slots_));
-    return 0;
-  }
-  // The ticket is spent from here; any later failure falls back to the full
-  // handshake and the client gets a fresh one.
-  uint8_t *server_nonce = out_ext + 1;
-  uint8_t k_c2d[32];
-  uint8_t k_d2c[32];
-  out_ext[0] = RESUME_ACCEPT_VERSION;
-  ok = random_bytes(server_nonce, RESUME_NONCE_SIZE) &&
-       resume_compute_confirm_mac(ticket->secret, client_nonce, server_nonce, out_ext + 1 + RESUME_NONCE_SIZE) &&
-       resume_derive_keys(ticket->secret, client_nonce, server_nonce, prologue, prologue_len, k_c2d, k_d2c);
-  noise_clean(ticket, sizeof(*ticket));
-  if (ok) {
-    recv_cipher = resume_make_cipher(k_c2d);
-    send_cipher = resume_make_cipher(k_d2c);
-    ok = recv_cipher != nullptr && send_cipher != nullptr;
-    if (!ok) {
-      noise_cipherstate_free(recv_cipher);
-      noise_cipherstate_free(send_cipher);
-      recv_cipher = nullptr;
-      send_cipher = nullptr;
-    }
-  }
-  noise_clean(k_c2d, sizeof(k_c2d));
-  noise_clean(k_d2c, sizeof(k_d2c));
-  return ok ? RESUME_ACCEPT_SIZE : 0;
-}
-
-void ResumeTicketCache::clear() {
-  noise_clean(this->slots_, sizeof(this->slots_));
-  this->used_mask_ = 0;
-}
-
-NoiseCipherState *resume_make_cipher(const uint8_t *key) {
-  NoiseCipherState *cipher = nullptr;
-  if (noise_cipherstate_new_by_id(&cipher, NOISE_CIPHER_CHACHAPOLY) != NOISE_ERROR_NONE) {
-    return nullptr;
-  }
-  if (noise_cipherstate_init_key(cipher, key, 32) != NOISE_ERROR_NONE) {
-    noise_cipherstate_free(cipher);
-    return nullptr;
-  }
-  return cipher;
-}
-
-}  // namespace esphome::noise
-#endif  // USE_NOISE

esphome/components/noise/noise_resume.h

@@ -1,132 +0,0 @@
-#pragma once
-#include "esphome/core/defines.h"
-#ifdef USE_NOISE
-#include <cstddef>
-#include <cstdint>
-
-// Forward declaration matching <noise/protocol/cipherstate.h>; keeps noise-c
-// headers out of everything that includes noise.h.
-extern "C" {
-typedef struct NoiseCipherState_s NoiseCipherState;  // NOLINT(modernize-use-using)
-}
-
-namespace esphome::noise {
-
-/** Session resume for the noise transports.
- *
- * After a full handshake the responder issues a single-use ticket over the
- * encrypted channel. A client presents it in its next ClientHello and both
- * sides derive the transport keys with HKDF-SHA256 alone, skipping the two
- * curve25519 operations. Old peers ignore the extension bytes on both
- * sides, so every mismatch degrades to a normal full handshake.
- *
- * HKDF is the Noise construction (noise_hashstate_hkdf). Derivations:
- *   offer_mac   = HKDF(secret, "offer"   || session_id || client_nonce).out1[:16]
- *   confirm_mac = HKDF(secret, "confirm" || client_nonce || server_nonce).out1[:16]
- *   k_c2d, k_d2c = HKDF(secret, "keys" || client_nonce || server_nonce || SHA256(prologue))
- *
- * An offering client sends handshake message 1 only after a decline.
- * Resumed sessions have no ephemeral DH; the ticket is wiped on use.
- */
-
-static constexpr uint8_t RESUME_OFFER_VERSION = 0x01;
-static constexpr uint8_t RESUME_ACCEPT_VERSION = 0x01;
-static constexpr size_t RESUME_SESSION_ID_SIZE = 8;
-static constexpr size_t RESUME_NONCE_SIZE = 16;
-static constexpr size_t RESUME_MAC_SIZE = 16;
-static constexpr size_t RESUME_SECRET_SIZE = 32;
-
-// ClientHello body: version | session_id | client_nonce | offer_mac
-static constexpr size_t RESUME_OFFER_SIZE = 1 + RESUME_SESSION_ID_SIZE + RESUME_NONCE_SIZE + RESUME_MAC_SIZE;  // 41
-static constexpr size_t RESUME_OFFER_SESSION_ID_OFFSET = 1;
-static constexpr size_t RESUME_OFFER_NONCE_OFFSET = RESUME_OFFER_SESSION_ID_OFFSET + RESUME_SESSION_ID_SIZE;
-static constexpr size_t RESUME_OFFER_MAC_OFFSET = RESUME_OFFER_NONCE_OFFSET + RESUME_NONCE_SIZE;
-
-// ServerHello trailing extension: version | server_nonce | confirm_mac
-static constexpr size_t RESUME_ACCEPT_SIZE = 1 + RESUME_NONCE_SIZE + RESUME_MAC_SIZE;  // 33
-
-struct ResumeTicket {
-  uint8_t session_id[RESUME_SESSION_ID_SIZE];
-  uint8_t secret[RESUME_SECRET_SIZE];
-};
-// Sent on the wire as one blob: session_id || secret
-static_assert(sizeof(ResumeTicket) == RESUME_SESSION_ID_SIZE + RESUME_SECRET_SIZE, "ticket must be packed");
-
-/// Fixed-slot RAM cache of single-use resume tickets. Lost on reboot by
-/// design: clients fall back to a full handshake.
-class ResumeTicketCache {
- public:
-  /// Generate a fresh ticket into out and store it, evicting the oldest
-  /// slot. Returns false (and stores nothing) if the RNG fails.
-  bool issue(ResumeTicket &out);
-  /// Accept a resume offer: verify and consume the ticket (single use; a
-  /// forged MAC never burns one), build both transport ciphers, and write
-  /// the ServerHello accept extension into out_ext. Returns the extension
-  /// length, or 0 (nothing allocated) on any miss, failure, or when
-  /// out_capacity is too small. Secrets are wiped internally.
-  size_t try_accept(const uint8_t *offer, size_t offer_len, const uint8_t *prologue, size_t prologue_len,
-                    uint8_t *out_ext, size_t out_capacity, NoiseCipherState *&send_cipher,
-                    NoiseCipherState *&recv_cipher);
-  /// Forget every ticket (PSK change).
-  void clear();
-
-  // Round robin; more clients than slots thrash and fall back to full handshakes
-  static constexpr uint8_t SLOTS = 2;
-  static_assert(SLOTS <= 8, "used_mask_ is uint8_t");
-
- protected:
-  ResumeTicket slots_[SLOTS];
-  uint8_t used_mask_{0};
-  uint8_t next_{0};
-};
-
-/// HKDF labels, PROGMEM on ESP8266.
-extern const char RESUME_LABEL_OFFER[6];
-extern const char RESUME_LABEL_CONFIRM[8];
-extern const char RESUME_LABEL_KEYS[5];
-
-// Largest KDF input: "keys" || client_nonce || server_nonce || SHA256(prologue)
-static constexpr size_t RESUME_KDF_MAX_DATA =
-    sizeof(RESUME_LABEL_KEYS) - 1 + RESUME_NONCE_SIZE + RESUME_NONCE_SIZE + 32;
-
-/// Noise-construction HKDF-SHA256 keyed with the ticket secret over
-/// label || a || b [|| SHA256(hash_in)], at most RESUME_KDF_MAX_DATA. out2 == nullptr means MAC only.
-bool resume_kdf(const uint8_t *secret, const char *label, size_t label_len, const uint8_t *a, size_t a_len,
-                const uint8_t *b, size_t b_len, const uint8_t *hash_in, size_t hash_in_len, uint8_t *out1,
-                size_t out1_len, uint8_t *out2);
-
-/// offer_mac for the ClientHello resume offer (what a client computes and
-/// try_accept checks).
-inline bool resume_compute_offer_mac(const uint8_t *secret, const uint8_t *session_id, const uint8_t *client_nonce,
-                                     uint8_t *out_mac) {
-  static_assert(sizeof(RESUME_LABEL_OFFER) - 1 + RESUME_SESSION_ID_SIZE + RESUME_NONCE_SIZE <= RESUME_KDF_MAX_DATA,
-                "KDF buffer");
-  return resume_kdf(secret, RESUME_LABEL_OFFER, sizeof(RESUME_LABEL_OFFER) - 1, session_id, RESUME_SESSION_ID_SIZE,
-                    client_nonce, RESUME_NONCE_SIZE, nullptr, 0, out_mac, RESUME_MAC_SIZE, nullptr);
-}
-
-/// confirm_mac for the ServerHello extension.
-inline bool resume_compute_confirm_mac(const uint8_t *secret, const uint8_t *client_nonce, const uint8_t *server_nonce,
-                                       uint8_t *out_mac) {
-  static_assert(sizeof(RESUME_LABEL_CONFIRM) - 1 + RESUME_NONCE_SIZE + RESUME_NONCE_SIZE <= RESUME_KDF_MAX_DATA,
-                "KDF buffer");
-  return resume_kdf(secret, RESUME_LABEL_CONFIRM, sizeof(RESUME_LABEL_CONFIRM) - 1, client_nonce, RESUME_NONCE_SIZE,
-                    server_nonce, RESUME_NONCE_SIZE, nullptr, 0, out_mac, RESUME_MAC_SIZE, nullptr);
-}
-
-/// Derive the transport keys. k_c2d encrypts client-to-device traffic,
-/// k_d2c device-to-client.
-inline bool resume_derive_keys(const uint8_t *secret, const uint8_t *client_nonce, const uint8_t *server_nonce,
-                               const uint8_t *prologue, size_t prologue_len, uint8_t *k_c2d, uint8_t *k_d2c) {
-  static_assert(sizeof(RESUME_LABEL_KEYS) - 1 + RESUME_NONCE_SIZE + RESUME_NONCE_SIZE + 32 <= RESUME_KDF_MAX_DATA,
-                "KDF buffer");
-  return resume_kdf(secret, RESUME_LABEL_KEYS, sizeof(RESUME_LABEL_KEYS) - 1, client_nonce, RESUME_NONCE_SIZE,
-                    server_nonce, RESUME_NONCE_SIZE, prologue, prologue_len, k_c2d, 32, k_d2c);
-}
-
-/// Build a ChaChaPoly cipher state keyed with key (32 bytes); nullptr on
-/// failure. Nonce counter starts at 0, exactly like a post-split cipher.
-NoiseCipherState *resume_make_cipher(const uint8_t *key);
-
-}  // namespace esphome::noise
-#endif  // USE_NOISE

esphome/components/one_wire/one_wire_bus.cpp

@@ -18,9 +18,8 @@ const std::vector<uint64_t> &OneWireBus::get_devices() { return this->devices_;
 
 bool OneWireBus::reset_() {
   int res = this->reset_int();
-  if (res == -1) {
+  if (res == -1)
     ESP_LOGE(TAG, "1-wire bus is held low");
-  }
   return res == 1;
 }
 

esphome/components/ota/ota_backend.h

@@ -49,7 +49,6 @@ enum OTAResponseTypes {
   OTA_RESPONSE_ERROR_BOOTLOADER_VERIFY = 0x91,
   OTA_RESPONSE_ERROR_BOOTLOADER_UPDATE = 0x92,
   OTA_RESPONSE_ERROR_VERSION_DOWNGRADE = 0x93,
-  OTA_RESPONSE_ERROR_ENCRYPTION_REQUIRED = 0x94,
   OTA_RESPONSE_ERROR_UNKNOWN = 0xFF,
 };
 

esphome/components/packet_transport/packet_transport.cpp

@@ -551,14 +551,12 @@ void PacketTransport::dump_config() {
                 "  Ping-pong: %s",
                 this->platform_name_, YESNO(this->is_encrypted_()), YESNO(this->ping_pong_enable_));
 #ifdef USE_SENSOR
-  for (const auto &sensor : this->sensors_) {
+  for (const auto &sensor : this->sensors_)
     ESP_LOGCONFIG(TAG, "  Sensor: %s", sensor.id);
-  }
 #endif
 #ifdef USE_BINARY_SENSOR
-  for (const auto &sensor : this->binary_sensors_) {
+  for (const auto &sensor : this->binary_sensors_)
     ESP_LOGCONFIG(TAG, "  Binary Sensor: %s", sensor.id);
-  }
 #endif
   for (const auto &host : this->providers_) {
     ESP_LOGCONFIG(TAG, "  Remote host: %s", host.first.c_str());
@@ -566,17 +564,15 @@ void PacketTransport::dump_config() {
 #ifdef USE_SENSOR
     auto rs = this->remote_sensors_.find(host.first.c_str());
     if (rs != this->remote_sensors_.end()) {
-      for (const auto &key : rs->second | std::views::keys) {
+      for (const auto &key : rs->second | std::views::keys)
         ESP_LOGCONFIG(TAG, "    Sensor: %s", key.c_str());
-      }
     }
 #endif
 #ifdef USE_BINARY_SENSOR
     auto rbs = this->remote_binary_sensors_.find(host.first.c_str());
     if (rbs != this->remote_binary_sensors_.end()) {
-      for (const auto &key : rbs->second | std::views::keys) {
+      for (const auto &key : rbs->second | std::views::keys)
         ESP_LOGCONFIG(TAG, "    Binary Sensor: %s", key.c_str());
-      }
     }
 #endif
   }

esphome/components/qwiic_pir/qwiic_pir.cpp

@@ -124,9 +124,8 @@ void QwiicPIRComponent::dump_config() {
 
 void QwiicPIRComponent::clear_events_() {
   // Clear event status register
-  if (!this->write_byte(QWIIC_PIR_EVENT_STATUS, 0x00)) {
+  if (!this->write_byte(QWIIC_PIR_EVENT_STATUS, 0x00))
     ESP_LOGW(TAG, "Failed to clear events");
-  }
 }
 
 }  // namespace esphome::qwiic_pir

esphome/components/rpi_dpi_rgb/rpi_dpi_rgb.cpp

@@ -75,9 +75,8 @@ void RpiDpiRgb::draw_pixels_at(int x_start, int y_start, int w, int h, const uin
         break;
     }
   }
-  if (err != ESP_OK) {
+  if (err != ESP_OK)
     ESP_LOGE(TAG, "lcd_lcd_panel_draw_bitmap failed: %s", esp_err_to_name(err));
-  }
 }
 
 int RpiDpiRgb::get_width() {

esphome/components/safe_mode/safe_mode.cpp

@@ -255,17 +255,12 @@ bool SafeModeComponent::should_enter_safe_mode(uint8_t num_attempts, uint32_t en
 }
 
 void SafeModeComponent::write_rtc_(uint32_t val) {
-  if (!this->rtc_.save(&val)) {
-    ESP_LOGE(TAG, "Failed to set rtc value (%" PRIu32 ")", val);
-    return;
-  }
-  if (!global_preferences->sync()) {
-    ESP_LOGE(TAG, "Failed to persist rtc value (%" PRIu32 ")", val);
-  }
+  this->rtc_.save(&val);
+  global_preferences->sync();
 }
 
 uint32_t SafeModeComponent::read_rtc_() {
-  uint32_t val = 0;
+  uint32_t val;
   if (!this->rtc_.load(&val))
     return 0;
   return val;
@@ -277,9 +272,7 @@ void SafeModeComponent::clean_rtc() {
   // before sync, the boot wasn't really successful anyway and the counter should
   // remain incremented.
   uint32_t val = 0;
-  if (!this->rtc_.save(&val)) {
-    ESP_LOGE(TAG, "Failed to clear boot loop counter");
-  }
+  this->rtc_.save(&val);
 }
 
 void SafeModeComponent::on_safe_shutdown() {

esphome/components/shelly_dimmer/stm32flash.cpp

@@ -629,9 +629,8 @@ stm32_unique_ptr stm32_init(uart::UARTDevice *stream, const uint8_t flags, const
   stm->pid = (buf[1] << 8) | buf[2];
   if (returned > 2) {
     ESP_LOGD(TAG, "This bootloader returns %d extra bytes in PID:", returned);
-    for (auto i = 2; i <= returned; i++) {
+    for (auto i = 2; i <= returned; i++)
       ESP_LOGD(TAG, " %02x", buf[i]);
-    }
   }
   if (stm32_get_ack(stm) != STM32_ERR_OK) {
     return make_stm32_with_deletor(nullptr);

esphome/components/socket/__init__.py

@@ -17,6 +17,8 @@ CONF_IMPLEMENTATION = "implementation"
 IMPLEMENTATION_LWIP_TCP = "lwip_tcp"
 IMPLEMENTATION_LWIP_SOCKETS = "lwip_sockets"
 IMPLEMENTATION_BSD_SOCKETS = "bsd_sockets"
+# Implementations whose sockets cannot make outgoing connections
+IMPLEMENTATIONS_WITHOUT_CONNECT = frozenset({IMPLEMENTATION_LWIP_TCP})
 
 # Socket tracking infrastructure
 # Components register their socket needs and platforms read this to configure appropriately

esphome/components/socket/bsd_sockets_impl.cpp

@@ -59,13 +59,15 @@ int BSDSocketImpl::close() {
 
 int BSDSocketImpl::setblocking(bool blocking) {
   int fl = ::fcntl(this->fd_, F_GETFL, 0);
+  if (fl < 0) {
+    return fl;
+  }
   if (blocking) {
     fl &= ~O_NONBLOCK;
   } else {
     fl |= O_NONBLOCK;
   }
-  ::fcntl(this->fd_, F_SETFL, fl);
-  return 0;
+  return ::fcntl(this->fd_, F_SETFL, fl);
 }
 
 size_t BSDSocketImpl::getpeername_to(std::span<char, SOCKADDR_STR_LEN> buf) {

esphome/components/socket/lwip_sockets_impl.cpp

@@ -49,13 +49,15 @@ int LwIPSocketImpl::close() {
 
 int LwIPSocketImpl::setblocking(bool blocking) {
   int fl = lwip_fcntl(this->fd_, F_GETFL, 0);
+  if (fl < 0) {
+    return fl;
+  }
   if (blocking) {
     fl &= ~O_NONBLOCK;
   } else {
     fl |= O_NONBLOCK;
   }
-  lwip_fcntl(this->fd_, F_SETFL, fl);
-  return 0;
+  return lwip_fcntl(this->fd_, F_SETFL, fl);
 }
 
 size_t LwIPSocketImpl::getpeername_to(std::span<char, SOCKADDR_STR_LEN> buf) {

esphome/components/socket/socket.cpp

@@ -2,6 +2,9 @@
 #if defined(USE_SOCKET_IMPL_LWIP_TCP) || defined(USE_SOCKET_IMPL_LWIP_SOCKETS) || defined(USE_SOCKET_IMPL_BSD_SOCKETS)
 #include <cerrno>
 #include <cstring>
+#ifdef USE_SOCKET_IMPL_BSD_SOCKETS
+#include <sys/select.h>
+#endif
 #include <string>
 #include "esphome/core/log.h"
 #include "esphome/core/application.h"
@@ -165,7 +168,10 @@ socklen_t set_sockaddr(struct sockaddr *addr, socklen_t addrlen, const char *ip_
 #else
     // Use LWIP-specific functions
     ip6_addr_t ip6;
-    inet6_aton(ip_address, &ip6);
+    if (inet6_aton(ip_address, &ip6) == 0) {
+      errno = EINVAL;
+      return 0;
+    }
     memcpy(server->sin6_addr.un.u32_addr, ip6.addr, sizeof(ip6.addr));
 #endif
     return sizeof(sockaddr_in6);
@@ -185,12 +191,58 @@ socklen_t set_sockaddr(struct sockaddr *addr, socklen_t addrlen, const char *ip_
     return 0;
   }
 #else
-  server->sin_addr.s_addr = inet_addr(ip_address);
+  // Unlike inet_addr(), inet_aton() can signal failure while still
+  // accepting the broadcast address 255.255.255.255
+  if (inet_aton(ip_address, &server->sin_addr) == 0) {
+    errno = EINVAL;
+    return 0;
+  }
 #endif
   server->sin_port = htons(port);
   return sizeof(sockaddr_in);
 }
 
+#if defined(USE_SOCKET_IMPL_BSD_SOCKETS) || defined(USE_SOCKET_IMPL_LWIP_SOCKETS)
+ConnectPollResult poll_connect(Socket &sock, int &err_out) {
+  int fd = sock.get_fd();
+  if (fd < 0 || fd >= FD_SETSIZE) {
+    // FD_SET on either is undefined behavior
+    err_out = EBADF;
+    return ConnectPollResult::CONNECT_POLL_ERROR;
+  }
+  // Connect completion is a write event; the main loop only selects on reads
+  fd_set writefds;
+  FD_ZERO(&writefds);
+  FD_SET(fd, &writefds);
+  struct timeval tv = {0, 0};
+#ifdef USE_SOCKET_IMPL_LWIP_SOCKETS
+  // LWIP_COMPAT_SOCKETS may be off (LibreTiny), so use the lwip symbol directly
+  int ret = lwip_select(fd + 1, nullptr, &writefds, nullptr, &tv);
+#else
+  // Global-scope select: the entity namespace esphome::select shadows it here
+  int ret = ::select(fd + 1, nullptr, &writefds, nullptr, &tv);
+#endif
+  if (ret < 0) {
+    err_out = errno;
+    return ConnectPollResult::CONNECT_POLL_ERROR;
+  }
+  if (ret == 0 || !FD_ISSET(fd, &writefds)) {
+    return ConnectPollResult::CONNECT_POLL_PENDING;
+  }
+  int error = 0;
+  socklen_t len = sizeof(error);
+  if (sock.getsockopt(SOL_SOCKET, SO_ERROR, &error, &len) != 0) {
+    err_out = errno;
+    return ConnectPollResult::CONNECT_POLL_ERROR;
+  }
+  if (error != 0) {
+    err_out = error;
+    return ConnectPollResult::CONNECT_POLL_ERROR;
+  }
+  return ConnectPollResult::CONNECT_POLL_CONNECTED;
+}
+#endif
+
 socklen_t set_sockaddr_any(struct sockaddr *addr, socklen_t addrlen, uint16_t port) {
 #if USE_NETWORK_IPV6
   if (addrlen < sizeof(sockaddr_in6)) {

esphome/components/socket/socket.h

@@ -145,6 +145,19 @@ inline socklen_t set_sockaddr(struct sockaddr *addr, socklen_t addrlen, const st
 /// Set a sockaddr to the any address and specified port for the IP version used by socket_ip().
 socklen_t set_sockaddr_any(struct sockaddr *addr, socklen_t addrlen, uint16_t port);
 
+#if defined(USE_SOCKET_IMPL_BSD_SOCKETS) || defined(USE_SOCKET_IMPL_LWIP_SOCKETS)
+enum class ConnectPollResult : uint8_t {
+  CONNECT_POLL_PENDING,
+  CONNECT_POLL_CONNECTED,
+  CONNECT_POLL_ERROR,
+};
+
+/// Check a non-blocking connect() for completion without blocking. On
+/// CONNECT_POLL_ERROR, err_out holds the socket's SO_ERROR, or errno when the
+/// poll itself failed.
+ConnectPollResult poll_connect(Socket &sock, int &err_out);
+#endif
+
 /// Format sockaddr into caller-provided buffer, returns length written (excluding null)
 size_t format_sockaddr_to(const struct sockaddr *addr_ptr, socklen_t len, std::span<char, SOCKADDR_STR_LEN> buf);
 

esphome/components/spi/spi.h

@@ -406,9 +406,8 @@ class SPIClient {
                                                      this->release_device_, this->write_only_);
 #ifdef USE_SPI_PSRAM_DMA
     this->delegate_->set_psram_dma(this->psram_dma_);
-    if (this->psram_dma_) {
+    if (this->psram_dma_)
       esph_log_config("spi_device", "PSRAM DMA: enabled");
-    }
 #endif
   }
 

esphome/components/spi/spi_esp_idf.cpp

@@ -42,9 +42,8 @@ class SPIDelegateHw : public SPIDelegate {
     if (this->release_device_)
       this->add_device_();
     if (this->is_ready()) {
-      if (spi_device_acquire_bus(this->handle_, portMAX_DELAY) != ESP_OK) {
+      if (spi_device_acquire_bus(this->handle_, portMAX_DELAY) != ESP_OK)
         ESP_LOGE(TAG, "Failed to acquire SPI bus");
-      }
       SPIDelegate::begin_transaction();
     } else {
       ESP_LOGW(TAG, "SPI device not ready, cannot begin transaction");
@@ -64,9 +63,8 @@ class SPIDelegateHw : public SPIDelegate {
 
   ~SPIDelegateHw() override {
     esp_err_t const err = spi_bus_remove_device(this->handle_);
-    if (err != ESP_OK) {
+    if (err != ESP_OK)
       ESP_LOGE(TAG, "Remove device failed - err %X", err);
-    }
   }
 
   // do a transfer. either txbuf or rxbuf (but not both) may be null.
@@ -286,9 +284,8 @@ class SPIBusHw : public SPIBus {
     }
     buscfg.max_transfer_sz = MAX_TRANSFER_SIZE;
     auto err = spi_bus_initialize(channel, &buscfg, SPI_DMA_CH_AUTO);
-    if (err != ESP_OK) {
+    if (err != ESP_OK)
       ESP_LOGE(TAG, "Bus init failed - err %X", err);
-    }
   }
 
   SPIDelegate *get_delegate(uint32_t data_rate, SPIBitOrder bit_order, SPIMode mode, GPIOPin *cs_pin,

esphome/components/st7701s/st7701s.cpp

@@ -78,9 +78,8 @@ void ST7701S::draw_pixels_at(int x_start, int y_start, int w, int h, const uint8
         break;
     }
   }
-  if (err != ESP_OK) {
+  if (err != ESP_OK)
     esph_log_e(TAG, "lcd_lcd_panel_draw_bitmap failed: %s", esp_err_to_name(err));
-  }
 }
 
 void ST7701S::draw_pixel_at(int x, int y, Color color) {

esphome/components/statsd/__init__.py

@@ -1,5 +1,6 @@
 import esphome.codegen as cg
 from esphome.components import binary_sensor, sensor
+from esphome.components.const import CONF_HOST
 import esphome.config_validation as cv
 from esphome.const import (
     CONF_BINARY_SENSORS,
@@ -14,7 +15,6 @@ AUTO_LOAD = ["socket"]
 CODEOWNERS = ["@Links2004"]
 DEPENDENCIES = ["network"]
 
-CONF_HOST = "host"
 CONF_PREFIX = "prefix"
 
 statsd_component_ns = cg.esphome_ns.namespace("statsd")

esphome/components/sx1509/__init__.py

@@ -1,7 +1,6 @@
 from esphome import automation, pins
 import esphome.codegen as cg
 from esphome.components import i2c, key_provider
-from esphome.components.const import CONF_KEYS
 import esphome.config_validation as cv
 from esphome.const import (
     CONF_ID,
@@ -20,6 +19,7 @@ from esphome.cpp_generator import MockObj
 from esphome.types import ConfigType
 
 CONF_KEYPAD = "keypad"
+CONF_KEYS = "keys"
 CONF_KEY_ROWS = "key_rows"
 CONF_KEY_COLUMNS = "key_columns"
 CONF_SLEEP_TIME = "sleep_time"

esphome/components/tuya/water_heater/tuya_water_heater.cpp

@@ -177,18 +177,14 @@ water_heater::WaterHeaterMode TuyaWaterHeater::default_on_mode_() const {
 
 void TuyaWaterHeater::dump_config() {
   LOG_WATER_HEATER("", "Tuya Water Heater", this);
-  if (this->switch_id_.has_value()) {
+  if (this->switch_id_.has_value())
     ESP_LOGCONFIG(TAG, "  Switch has datapoint ID %u", *this->switch_id_);
-  }
-  if (this->mode_id_.has_value()) {
+  if (this->mode_id_.has_value())
     ESP_LOGCONFIG(TAG, "  Mode has datapoint ID %u", *this->mode_id_);
-  }
-  if (this->target_temperature_id_.has_value()) {
+  if (this->target_temperature_id_.has_value())
     ESP_LOGCONFIG(TAG, "  Target Temperature has datapoint ID %u", *this->target_temperature_id_);
-  }
-  if (this->current_temperature_id_.has_value()) {
+  if (this->current_temperature_id_.has_value())
     ESP_LOGCONFIG(TAG, "  Current Temperature has datapoint ID %u", *this->current_temperature_id_);
-  }
 }
 
 }  // namespace esphome::tuya

esphome/components/udp/udp_component.cpp

@@ -13,9 +13,16 @@ void UDPComponent::setup() {
 #if defined(USE_SOCKET_IMPL_BSD_SOCKETS) || defined(USE_SOCKET_IMPL_LWIP_SOCKETS)
   for (const auto &address : this->addresses_) {
     struct sockaddr saddr {};
-    socket::set_sockaddr(&saddr, sizeof(saddr), address, this->broadcast_port_);
+    if (socket::set_sockaddr(&saddr, sizeof(saddr), address, this->broadcast_port_) == 0) {
+      ESP_LOGW(TAG, "Invalid address %s", address);
+      continue;
+    }
     this->sockaddrs_.push_back(saddr);
   }
+  if (!this->addresses_.empty() && this->sockaddrs_.empty()) {
+    // Sending would be a silent no-op; surface the misconfiguration
+    this->status_set_warning(LOG_STR("no valid addresses"));
+  }
   // set up broadcast socket
   if (this->should_broadcast_) {
     this->broadcast_socket_ = socket::socket(AF_INET, SOCK_DGRAM, IPPROTO_IP);
@@ -129,9 +136,8 @@ void UDPComponent::dump_config() {
                 "  Listen Port: %u\n"
                 "  Broadcast Port: %u",
                 this->listen_port_, this->broadcast_port_);
-  for (const char *address : this->addresses_) {
+  for (const char *address : this->addresses_)
     ESP_LOGCONFIG(TAG, "  Address: %s", address);
-  }
   if (this->listen_address_.has_value()) {
     char addr_buf[network::IP_ADDRESS_BUFFER_SIZE];
     ESP_LOGCONFIG(TAG, "  Listen address: %s", this->listen_address_.value().str_to(addr_buf));
@@ -146,9 +152,8 @@ void UDPComponent::send_packet(const uint8_t *data, size_t size) {
 #if defined(USE_SOCKET_IMPL_BSD_SOCKETS) || defined(USE_SOCKET_IMPL_LWIP_SOCKETS)
   for (const auto &saddr : this->sockaddrs_) {
     auto result = this->broadcast_socket_->sendto(data, size, 0, &saddr, sizeof(saddr));
-    if (result < 0) {
+    if (result < 0)
       ESP_LOGW(TAG, "sendto() error %d", errno);
-    }
   }
 #endif
 #ifdef USE_SOCKET_IMPL_LWIP_TCP
@@ -157,9 +162,8 @@ void UDPComponent::send_packet(const uint8_t *data, size_t size) {
     if (this->udp_client_.beginPacketMulticast(saddr, this->broadcast_port_, iface, 128) != 0) {
       this->udp_client_.write(data, size);
       auto result = this->udp_client_.endPacket();
-      if (result == 0) {
+      if (result == 0)
         ESP_LOGW(TAG, "udp.write() error");
-      }
     }
   }
 #endif

esphome/components/uponor_smatrix/uponor_smatrix.cpp

@@ -110,9 +110,8 @@ bool UponorSmatrixComponent::parse_byte_(uint8_t byte) {
   // Handle packet
   size_t data_len = (packet_len - 6) / 3;
   if (data_len == 0) {
-    if (packet[4] == UPONOR_ID_REQUEST) {
+    if (packet[4] == UPONOR_ID_REQUEST)
       ESP_LOGVV(TAG, "Ignoring request packet for device 0x%08" PRIX32 "", device_address);
-    }
     return true;
   }
 

esphome/components/usb_uart/pl2303.cpp

@@ -194,9 +194,8 @@ std::vector<CdcEps> USBUartTypePL2303::parse_descriptors(usb_device_handle_t dev
     }
   }
 
-  if (cdc_devs.empty()) {
+  if (cdc_devs.empty())
     ESP_LOGE(TAG, "PL2303: failed to find bulk IN+OUT endpoints");
-  }
 
   return cdc_devs;
 }

esphome/components/wake_on_lan/wake_on_lan.cpp

@@ -34,15 +34,18 @@ void WakeOnLanButton::press_action() {
   struct sockaddr_storage saddr {};
   auto addr_len =
       socket::set_sockaddr(reinterpret_cast<sockaddr *>(&saddr), sizeof(saddr), "255.255.255.255", this->port_);
+  if (addr_len == 0) {
+    ESP_LOGW(TAG, "Invalid broadcast address");
+    return;
+  }
   uint8_t buffer[6 + sizeof this->macaddr_ * 16];
   memcpy(buffer, PREFIX, sizeof(PREFIX));
   for (size_t i = 0; i != 16; i++) {
     memcpy(buffer + i * sizeof(this->macaddr_) + sizeof(PREFIX), this->macaddr_, sizeof(this->macaddr_));
   }
   if (this->broadcast_socket_->sendto(buffer, sizeof(buffer), 0, reinterpret_cast<const sockaddr *>(&saddr),
-                                      addr_len) <= 0) {
+                                      addr_len) <= 0)
     ESP_LOGW(TAG, "sendto() error %d", errno);
-  }
 #else
   IPAddress broadcast = IPAddress(255, 255, 255, 255);
   for (auto ip : esphome::network::get_ip_addresses()) {

esphome/components/weikai/weikai.cpp

@@ -348,18 +348,14 @@ size_t WeikaiChannel::rx_in_fifo_() {
   uint8_t const fsr = this->reg(WKREG_FSR);
   if (fsr & (FSR_RFOE | FSR_RFLB | FSR_RFFE | FSR_RFPE)) {
     char bin_buf[9];
-    if (fsr & FSR_RFOE) {
+    if (fsr & FSR_RFOE)
       ESP_LOGE(TAG, "Receive data overflow FSR=%s", format_bin_to(bin_buf, fsr));
-    }
-    if (fsr & FSR_RFLB) {
+    if (fsr & FSR_RFLB)
       ESP_LOGE(TAG, "Receive line break FSR=%s", format_bin_to(bin_buf, fsr));
-    }
-    if (fsr & FSR_RFFE) {
+    if (fsr & FSR_RFFE)
       ESP_LOGE(TAG, "Receive frame error FSR=%s", format_bin_to(bin_buf, fsr));
-    }
-    if (fsr & FSR_RFPE) {
+    if (fsr & FSR_RFPE)
       ESP_LOGE(TAG, "Receive parity error FSR=%s", format_bin_to(bin_buf, fsr));
-    }
   }
   if ((available == 0) && (fsr & FSR_RFDAT)) {
     // here we should be very careful because we can have something like this:
@@ -499,9 +495,8 @@ void print_buffer(std::vector<uint8_t> buffer) {
   hex_buffer[(3 * 32) + 1] = 0;
   for (size_t i = 0; i < buffer.size(); i++) {
     snprintf(&hex_buffer[3 * (i % 32)], sizeof(hex_buffer), "%02X ", buffer[i]);
-    if (i % 32 == 31) {
+    if (i % 32 == 31)
       ESP_LOGI(TAG, "   %s", hex_buffer);
-    }
   }
   if (buffer.size() % 32) {
     // null terminate if incomplete line

esphome/core/defines.h

@@ -214,6 +214,11 @@
 #define USE_API_HOMEASSISTANT_SERVICES
 #define USE_API_HOMEASSISTANT_STATES
 #define USE_API_NOISE
+#if !defined(USE_ESP8266) && !defined(USE_RP2)  // raw-lwip sockets cannot make outgoing connections
+#define USE_API_OUTGOING_CONNECTION
+#define API_OUTGOING_CONNECTION_PORT 6054
+#define API_OUTGOING_CONNECTION_DELAY 60000
+#endif
 #define USE_API_VARINT64
 #define USE_API_PLAINTEXT
 #define USE_API_USER_DEFINED_ACTIONS
@@ -242,7 +247,6 @@
 #define USE_RUNTIME_IMAGE_QOI
 #define USE_RUNTIME_STATS
 #define USE_OTA
-#define USE_OTA_ENCRYPTION
 #define USE_OTA_PASSWORD
 #define USE_OTA_VERSION 2
 #define USE_TIME_TIMEZONE

esphome/espota2.py

@@ -53,7 +53,6 @@ RESPONSE_ERROR_PARTITION_TABLE_UPDATE = 0x90
 RESPONSE_ERROR_BOOTLOADER_VERIFY = 0x91
 RESPONSE_ERROR_BOOTLOADER_UPDATE = 0x92
 RESPONSE_ERROR_VERSION_DOWNGRADE = 0x93
-RESPONSE_ERROR_ENCRYPTION_REQUIRED = 0x94
 RESPONSE_ERROR_UNKNOWN = 0xFF
 
 OTA_VERSION_1_0 = 1
@@ -64,20 +63,8 @@ MAGIC_BYTES = [0x6C, 0x26, 0xF7, 0x5C, 0x45]
 CLIENT_FEATURE_SUPPORTS_COMPRESSION = 0x01
 CLIENT_FEATURE_SUPPORTS_SHA256_AUTH = 0x02
 CLIENT_FEATURE_SUPPORTS_EXTENDED_PROTOCOL = 0x04
-CLIENT_FEATURE_SUPPORTS_NOISE = 0x08
 SERVER_FEATURE_SUPPORTS_COMPRESSION = 0x01
 SERVER_FEATURE_SUPPORTS_PARTITION_ACCESS = 0x02
-SERVER_FEATURE_SUPPORTS_NOISE = 0x04
-
-NOISE_FRAME_INDICATOR = 0x01
-NOISE_HANDSHAKE_OK = 0x00
-# The device decrypts frames in its transfer buffer (OTA_BUFFER_SIZE, sized
-# as this plus the 16-byte ChaCha20-Poly1305 MAC). 1024 divides the 8192-byte
-# upload block exactly, so blocks tile into full frames with no runt.
-NOISE_MAX_PLAINTEXT = 1024
-# Wire contract: the device sends exactly this reject reason for a bad MAC
-NOISE_MAC_FAILURE_REASON = "Handshake MAC failure"
-NOISE_PROLOGUE_INIT = b"NoiseOTAInit"
 
 # OTA types this client knows how to send. Future PRs that add bootloader/partition
 # updates extend this set. Anything outside the set is rejected up front so callers
@@ -184,12 +171,6 @@ _ERROR_MESSAGES: dict[int, str] = {
         "enabled: the new firmware's version must be newer than the version the "
         "device is currently running."
     ),
-    RESPONSE_ERROR_ENCRYPTION_REQUIRED: (
-        "The device requires an encrypted OTA connection but this upload has no "
-        "encryption key. Add 'encryption:' to the 'ota: platform: esphome' section "
-        "of the YAML this upload uses, or update your esphome installation if it "
-        "predates OTA encryption."
-    ),
     RESPONSE_ERROR_UNKNOWN: "Unknown error from ESP",
 }
 
@@ -324,149 +305,16 @@ def send_check(
         raise OTANetworkError(f"sending {msg}: {err}") from err
 
 
-class NoiseSocketWrapper:
-    """Runs the OTA session inside a Noise (ChaCha20-Poly1305) transport.
-
-    Exposes the socket subset perform_ota uses. Frames are indicator 0x01,
-    16-bit big-endian length, ciphertext; recv() drains one decrypted frame
-    at a time, sendall() keeps control units in one frame and splits data
-    at NOISE_MAX_PLAINTEXT.
-    """
-
-    def __init__(self, sock: socket.socket, psk: str, prologue: bytes) -> None:
-        # Deliberately lazy: the noise stack (noiseprotocol, cryptography) is
-        # only imported when an encrypted upload actually runs.
-        try:
-            from aioesphomeapi.noise import NoiseHandshake
-        except ImportError as err:
-            raise OTAError(
-                "OTA encryption requires a newer aioesphomeapi; update your "
-                "esphome installation (pip install -U esphome) and retry"
-            ) from err
-        # The aioesphomeapi import above already loaded cryptography; bind
-        # the exception once so recv() pays no per-frame import lookup
-        from cryptography.exceptions import InvalidTag
-
-        self._invalid_tag = InvalidTag
-        self._sock = sock
-        try:
-            self._handshake = NoiseHandshake(psk, prologue)
-        except ValueError as err:
-            raise OTAError(f"Invalid OTA encryption key: {err}") from err
-        self._encrypt = None
-        self._decrypt = None
-        self._buffer = b""
-
-    # Only harmless socket controls pass through; byte-moving methods are
-    # deliberately absent so plaintext cannot leak past the transport.
-    def settimeout(self, timeout: float | None) -> None:
-        self._sock.settimeout(timeout)
-
-    def setsockopt(self, level: int, optname: int, value: int) -> None:
-        self._sock.setsockopt(level, optname, value)
-
-    def close(self) -> None:
-        self._sock.close()
-
-    def do_handshake(self) -> None:
-        """Run the two-message NNpsk0 handshake and set up the transport ciphers."""
-        try:
-            self._send_frame(
-                bytes([NOISE_HANDSHAKE_OK]) + self._handshake.write_message()
-            )
-            payload = self._recv_frame()
-        except OSError as err:
-            raise OTANetworkError(f"noise handshake: {err}") from err
-        if not payload:
-            raise OTANetworkError("Device closed connection during the noise handshake")
-        if payload[0] != NOISE_HANDSHAKE_OK:
-            reason = payload[1:].decode("utf-8", "replace")
-            if reason == NOISE_MAC_FAILURE_REASON:
-                raise OTAError(
-                    "Device rejected the handshake; is the OTA encryption key correct?"
-                )
-            raise OTAError(f"Device rejected the noise handshake: {reason}")
-        try:
-            self._handshake.read_message(payload[1:])
-        except (ValueError, self._invalid_tag) as err:
-            # InvalidTag is a wrong key; ValueError covers a device sending an
-            # invalid curve point, which cryptography rejects during the DH
-            raise OTAError(
-                "Noise handshake failed; is the OTA encryption key correct?"
-            ) from err
-        self._encrypt, self._decrypt = self._handshake.get_ciphers()
-
-    def sendall(self, data: bytes) -> None:
-        frames: list[bytes] = []
-        for offset in range(0, len(data), NOISE_MAX_PLAINTEXT):
-            ciphertext = self._encrypt.encrypt(
-                data[offset : offset + NOISE_MAX_PLAINTEXT]
-            )
-            frames.append(self._frame_header(len(ciphertext)))
-            frames.append(ciphertext)
-        self._sock.sendall(b"".join(frames))
-
-    def recv(self, amount: int) -> bytes:
-        if not self._buffer:
-            ciphertext = self._recv_frame()
-            if not ciphertext:
-                return b""  # connection closed at a frame boundary
-            try:
-                self._buffer = self._decrypt.decrypt(ciphertext)
-            except self._invalid_tag as err:
-                # Retryable: a fresh connection renegotiates the session
-                raise OTANetworkError(
-                    "Noise decryption failed (MAC mismatch); frame corrupted or tampered"
-                ) from err
-            if not self._buffer:
-                # Reject MAC-only frames so b"" always means the peer closed
-                raise OTANetworkError("Device sent an empty noise frame")
-        data = self._buffer[:amount]
-        self._buffer = self._buffer[amount:]
-        return data
-
-    @staticmethod
-    def _frame_header(length: int) -> bytes:
-        return bytes([NOISE_FRAME_INDICATOR, (length >> 8) & 0xFF, length & 0xFF])
-
-    def _send_frame(self, payload: bytes) -> None:
-        self._sock.sendall(self._frame_header(len(payload)) + payload)
-
-    def _recv_frame(self) -> bytes:
-        header = self._recv_exact(3, closed_ok=True)
-        if not header:
-            return b""  # connection closed at a frame boundary
-        # A malformed frame is a broken transport, not a device error;
-        # retryable so a fresh session is tried
-        if header[0] != NOISE_FRAME_INDICATOR:
-            raise OTANetworkError(f"Bad noise frame indicator 0x{header[0]:02X}")
-        length = (header[1] << 8) | header[2]
-        if length == 0:
-            raise OTANetworkError("Device sent an empty noise frame")
-        return self._recv_exact(length)
-
-    def _recv_exact(self, amount: int, closed_ok: bool = False) -> bytes:
-        data = b""
-        while len(data) < amount:
-            chunk = self._sock.recv(amount - len(data))
-            if not chunk:
-                if closed_ok and not data:
-                    return b""
-                raise OSError("connection closed inside a noise frame")
-            data += chunk
-        return data
-
-
 def perform_ota(
     sock: socket.socket,
     password: str | None,
     file_handle: io.IOBase,
     filename: Path,
     ota_type: int = OTA_TYPE_UPDATE_APP,
-    noise_psk: str | None = None,
 ) -> None:
-    # Validate up front; an out-of-range value would only surface as a
-    # ValueError deep inside send_check, bypassing OTAError handling
+    # Validate ota_type up front. It travels as a single byte on the wire, and
+    # passing an out-of-range value would only surface as a ValueError from
+    # bytes([ota_type]) deep inside send_check, bypassing OTAError handling.
     if not isinstance(ota_type, int) or not 0 <= ota_type <= 0xFF:
         raise OTAError(
             f"Invalid ota_type {ota_type!r}; expected an integer in range 0-255"
@@ -477,11 +325,6 @@ def perform_ota(
             f"Unsupported OTA type 0x{ota_type:02X}; this ESPHome supports: {supported}"
         )
 
-    if noise_psk is not None and not noise_psk:
-        raise OTAError(
-            "An empty OTA encryption key was provided; refusing to upload in plaintext"
-        )
-
     file_contents = file_handle.read()
     file_size = len(file_contents)
     _LOGGER.info("Uploading %s (%s bytes)", filename, file_size)
@@ -504,8 +347,6 @@ def perform_ota(
         | CLIENT_FEATURE_SUPPORTS_SHA256_AUTH
         | CLIENT_FEATURE_SUPPORTS_EXTENDED_PROTOCOL
     )
-    if noise_psk:
-        features_to_send |= CLIENT_FEATURE_SUPPORTS_NOISE
     send_check(sock, features_to_send, "features")
     features = receive_exactly(
         sock,
@@ -528,31 +369,6 @@ def perform_ota(
     else:
         features = 0
 
-    if noise_psk:
-        # Fail closed: never fall back to a plaintext upload when an
-        # encryption key is configured, an active attacker could otherwise
-        # strip the feature flag and capture the image (it contains the wifi
-        # credentials and the api encryption key).
-        if not (extended_proto and features & SERVER_FEATURE_SUPPORTS_NOISE):
-            raise OTAError(
-                "An OTA encryption key is configured but the device did not "
-                "offer encryption; refusing to send the image in plaintext. "
-                "If the running firmware predates OTA encryption, first update "
-                "it without the 'ota: encryption:' block (over a trusted "
-                "network or via USB), then restore the block and upload again."
-            )
-        # The prologue binds every negotiation byte both sides saw, so any
-        # tampering with the plaintext preamble breaks the handshake.
-        prologue = (
-            NOISE_PROLOGUE_INIT
-            + bytes(MAGIC_BYTES)
-            + bytes([RESPONSE_OK, version, features_to_send])
-            + bytes([RESPONSE_FEATURE_FLAGS, features])
-        )
-        sock = NoiseSocketWrapper(sock, noise_psk, prologue)
-        sock.do_handshake()
-        _LOGGER.info("Encrypted connection established")
-
     if ota_type != OTA_TYPE_UPDATE_APP:
         # Any non-app OTA type requires the extended protocol and the
         # partition-access server feature. Reject up front so the user gets
@@ -756,7 +572,6 @@ def run_ota_impl_(
     password: str | None,
     filename: Path,
     ota_type: int = OTA_TYPE_UPDATE_APP,
-    noise_psk: str | None = None,
 ) -> tuple[int, str | None]:
     from esphome.core import CORE
 
@@ -821,7 +636,7 @@ def run_ota_impl_(
         reached_device = True
         with contextlib.closing(sock), Path(filename).open("rb") as file_handle:
             try:
-                perform_ota(sock, password, file_handle, filename, ota_type, noise_psk)
+                perform_ota(sock, password, file_handle, filename, ota_type)
             except OTANetworkError as err:
                 # Transient network failure; retry
                 last_error = str(err)
@@ -846,12 +661,9 @@ def run_ota(
     password: str | None,
     filename: Path,
     ota_type: int = OTA_TYPE_UPDATE_APP,
-    noise_psk: str | None = None,
 ) -> tuple[int, str | None]:
     try:
-        return run_ota_impl_(
-            remote_host, remote_port, password, filename, ota_type, noise_psk
-        )
+        return run_ota_impl_(remote_host, remote_port, password, filename, ota_type)
     except OTAError as err:
         _LOGGER.error(err)
         return 1, None

esphome/git.py

@@ -457,15 +457,6 @@ def _clone_complete_marker_path(repo_dir: Path) -> Path:
     return repo_dir / ".git" / _CLONE_COMPLETE_MARKER
 
 
-def has_complete_clone(
-    url: str, ref: str | None, domain: str, subpath: Path | None = None
-) -> bool:
-    """Lock-free probe for a complete clone; can go stale immediately, so
-    best-effort decisions only, never a substitute for ``clone_or_update``."""
-    repo_dir = _repo_entry_dir(_cache_key(url, ref), domain, subpath)
-    return _clone_complete_marker_path(repo_dir).is_file()
-
-
 def _clear_clone_complete_marker(repo_dir: Path) -> None:
     """Best-effort removal of the completion marker.
 

esphome/platformio/library.py

@@ -13,7 +13,7 @@ regardless of which toolchain consumes the result.
 """
 
 from collections import deque
-from collections.abc import Callable, Hashable, Iterable
+from collections.abc import Callable, Iterable
 from dataclasses import dataclass, field
 from functools import partial
 import glob
@@ -99,17 +99,6 @@ class Source:
     ) -> Path:
         raise NotImplementedError
 
-    def prefetch_key(self, dir_suffix: str) -> Hashable | None:
-        """Prefetch dedup identity; None = not prefetchable. Sources that
-        could write one cache dir must return equal keys (workers must never
-        share a dir); a coarser key only skips a prefetch."""
-        return None
-
-    def is_cached(self, dir_suffix: str, salt: str = "", namespace: str = "") -> bool:
-        """Whether a completed fetch exists; only consulted when
-        ``prefetch_key()`` is not None, True is the safe default."""
-        return True
-
     def source_root(self, build_path: Path) -> Path:
         """Directory holding the library's own files (manifest + sources).
 
@@ -138,9 +127,6 @@ class URLSource(Source):
             h.update(salt.encode())
         return base_dir / h.hexdigest()[:8] / dir_suffix
 
-    def prefetch_key(self, dir_suffix: str) -> Hashable | None:
-        return self.url if self.size else None
-
     def is_cached(self, dir_suffix: str, salt: str = "", namespace: str = "") -> bool:
         """Whether a completed extraction already exists for this source."""
         return (
@@ -191,29 +177,14 @@ class GitSource(Source):
         self.url = url
         self.ref = ref
 
-    @staticmethod
-    def _domain(salt: str, namespace: str) -> str:
+    def download(
+        self, dir_suffix: str, force: bool = False, salt: str = "", namespace: str = ""
+    ) -> Path:
         domain = DOMAIN
         if namespace:
             domain = f"{domain}/{namespace}"
         if salt:
             domain = f"{domain}/{salt}"
-        return domain
-
-    def prefetch_key(self, dir_suffix: str) -> Hashable | None:
-        # The clone target dir is hash(url@ref)/<dir_suffix>
-        return (self.url, self.ref, dir_suffix)
-
-    def is_cached(self, dir_suffix: str, salt: str = "", namespace: str = "") -> bool:
-        """Whether a completed clone already exists for this source."""
-        return git.has_complete_clone(
-            self.url, self.ref, self._domain(salt, namespace), Path(dir_suffix)
-        )
-
-    def download(
-        self, dir_suffix: str, force: bool = False, salt: str = "", namespace: str = ""
-    ) -> Path:
-        domain = self._domain(salt, namespace)
         path, _ = git.clone_or_update(
             url=self.url,
             ref=self.ref,
@@ -1017,78 +988,56 @@ def _fetch_source(
     )
 
 
-def _clone_source(
-    component: ConvertedLibrary,
-    salt: str,
-    namespace: str,
-    tracker: Callable[[int], None],
-) -> None:
-    # No byte progress from git; one tick so a cancelled batch stops here
-    tracker(0)
-    component.source.download(
-        component.get_sanitized_name(), salt=salt, namespace=namespace
-    )
-
-
 def _prefetch_wave(
     wave: list[tuple[str, ConvertedLibrary]], salt: str, namespace: str
 ) -> None:
-    """Best-effort parallel fetch of a wave's registry archives and git clones.
+    """Best-effort parallel download of a wave's registry archives.
 
-    The walk's own ``download()`` stays authoritative; duplicate sources
+    The walk's own ``download()`` stays authoritative; duplicate URLs
     prefetch once so two threads never share a cache directory. Archives
     whose size the registry did not report are left to the sequential
     loop, whose per-file bars don't interleave. A node a sibling in the
-    same wave supersedes has its source fetched in vain (knowing better
+    same wave supersedes has its archive fetched in vain (knowing better
     would need the manifests being downloaded).
     """
     try:
-        archives: list[ConvertedLibrary] = []
-        clones: list[ConvertedLibrary] = []
-        seen: set[Hashable] = set()
+        components: list[ConvertedLibrary] = []
+        seen: set[str] = set()
         for _key, component in wave:
             source = component.source
-            name = component.get_sanitized_name()
-            dedup_key = source.prefetch_key(name)
-            if dedup_key is None or dedup_key in seen:
+            if not isinstance(source, URLSource) or not source.size:
                 continue
-            seen.add(dedup_key)
+            if source.url in seen:
+                continue
+            seen.add(source.url)
             try:
-                cached = source.is_cached(name, salt=salt, namespace=namespace)
+                cached = source.is_cached(
+                    component.get_sanitized_name(), salt=salt, namespace=namespace
+                )
             except OSError as err:
                 # Best-effort, but visibly: a systematic probe failure makes
-                # every warm build re-fetch every source
+                # every warm build re-download every archive
                 _LOGGER.warning("Cache probe for %s failed: %s", component.name, err)
                 cached = False
             if cached:
                 # A warm build must stay silent
                 continue
-            (archives if isinstance(source, URLSource) else clones).append(component)
-        if not archives and not clones:
+            components.append(component)
+        if not components:
             return
         # Single-item waves (a dependency chain discovers one archive per
         # wave) go through the same runner: one download method, one bar
-        if archives:
-            _LOGGER.info(
-                "Downloading %d library archive(s): %s",
-                len(archives),
-                ", ".join(c.name for c in archives),
-            )
-        if clones:
-            _LOGGER.info(
-                "Cloning %d library repo(s): %s",
-                len(clones),
-                ", ".join(c.name for c in clones),
-            )
+        _LOGGER.info(
+            "Downloading %d library archive(s): %s",
+            len(components),
+            ", ".join(c.name for c in components),
+        )
         failures = run_batch_downloads(
             "Downloading libraries",
             [
                 (c.name, c.source.size, partial(_fetch_source, c, salt, namespace))
-                for c in archives
-            ]
-            # Size 0: clones share the worker pool without skewing the
-            # byte bar, whose total stays the archive sum
-            + [(c.name, 0, partial(_clone_source, c, salt, namespace)) for c in clones],
+                for c in components
+            ],
         )
         # The sequential call below retries and raises the real error
         warn_prefetch_failures(

esphome/platformio/prefetch.py

@@ -832,16 +832,16 @@ def _prefetch(build_dir: Path, env: str) -> None:
         for name, opts in p.packages.items()
         if not opts.get("optional")
     ]
-    # PIO's build engine installs tool-scons by its own registry spec at build
-    # start; a platform URL copy has no owner to match it, so prefetch that spec
-    specs = [s for s in specs if s.name != "tool-scons"]
-    specs.append(
-        PackageSpec(
-            owner="platformio",
-            name="tool-scons",
-            requirements=get_core_dependencies()["tool-scons"],
+    # PIO's build engine installs outside the platform package list;
+    # skipped when the platform lists it itself
+    if not any(s.name == "tool-scons" for s in specs):
+        specs.append(
+            PackageSpec(
+                owner="platformio",
+                name="tool-scons",
+                requirements=get_core_dependencies()["tool-scons"],
+            )
         )
-    )
     lib_deps = config.get(f"env:{env}", "lib_deps", [])
     # pio run's storage dir for this env, with its compatibility
     # qualifiers: an unqualified library install could land a different

requirements.txt

@@ -14,7 +14,7 @@ esptool==5.3.1
 click==8.3.3
 aioesphomeapi==46.3.0
 aiohappyeyeballs==2.7.1  # Happy Eyeballs for requests downloads; already pulled in by aioesphomeapi
-zeroconf==0.151.2
+zeroconf==0.150.4
 puremagic==2.2.0
 ruamel.yaml==0.19.1 # dashboard_import
 ruamel.yaml.clib==0.2.15 # dashboard_import

requirements_test.txt

@@ -1,4 +1,4 @@
-pylint==4.0.8
+pylint==4.0.7
 flake8==7.3.0  # also change in .pre-commit-config.yaml when updating
 ruff==0.16.5  # also change in .pre-commit-config.yaml when updating
 pyupgrade==3.21.2  # also change in .pre-commit-config.yaml when updating

script/api_protobuf/api_protobuf.py

@@ -2531,11 +2531,6 @@ def calculate_message_max_size(desc: descriptor.DescriptorProto) -> int | None:
     return total_size
 
 
-# Contents must never reach the log: dump_to prints only the name
-SENSITIVE_MESSAGES = {"NoiseResumeTicket"}
-SENSITIVE_MESSAGES_SEEN: set[str] = set()
-
-
 def build_message_type(
     desc: descriptor.DescriptorProto,
     base_class_fields: dict[str, list[descriptor.FieldDescriptorProto]],
@@ -2813,10 +2808,6 @@ def build_message_type(
         public_content.append(prot)
     # If no fields to calculate size for or message doesn't need encoding, the default implementation in ProtoMessage will be used
 
-    if desc.name in SENSITIVE_MESSAGES:
-        dump = []
-        SENSITIVE_MESSAGES_SEEN.add(desc.name)
-
     # dump_to method declaration in header
     prot = "#ifdef HAS_PROTO_MESSAGE_DUMP\n"
     prot += "const char *dump_to(DumpBuffer &out) const override;\n"
@@ -3724,11 +3715,6 @@ static const char *const TAG = "api.service";
     except ImportError:
         pass
 
-    # A renamed message must fail the build, not silently start dumping secrets
-    missing = SENSITIVE_MESSAGES - SENSITIVE_MESSAGES_SEEN
-    if missing:
-        raise RuntimeError(f"SENSITIVE_MESSAGES not found in api.proto: {missing}")
-
 
 if __name__ == "__main__":
     sys.exit(main())

script/ci-custom.py

@@ -319,154 +319,6 @@ def lint_no_long_delays(fname, match):
     )
 
 
-# An if/else/for/while whose only body is an unbraced ESP_LOG*() call. When the build's compile-time
-# log level drops that macro, the body expands to nothing and the compiler warns (-Wempty-body).
-# clang-tidy's brace check does not catch these (ShortStatementLines allows short unbraced bodies), so
-# this fills that gap. Matched against comment/string-masked content, so commented-out or quoted code
-# is ignored. Both spellings are covered: core/log.h defines the uppercase ESP_LOG*() macros and
-# the lowercase esph_log_*() ones, and both expand to nothing below their log level.
-# 'for' allows ';' inside its parentheses (the classic C-style header); 'if'/'while' do not, so their
-# condition cannot run past the statement it guards. The 'for' header permits one level of nested
-# parens so it stays bounded to its own statement: without that, it can run past the loop body and
-# latch onto a later ')', mis-reporting the line and skipping the '#' preprocessor check below.
-ESP_LOG_NEEDS_BRACES_RE = re.compile(
-    r"(?:\bif\s*\([^{};]*\)|\bwhile\s*\([^{};]*\)|\bfor\s*\((?:[^{}()]|\([^{}()]*\))*\)|\belse\b)"
-    r"[ \t]*\n?[ \t]*(?:ESP_LOG[A-Z]*|esph_log_[a-z]+)\s*\(",
-    re.MULTILINE,
-)
-
-
-def _mask_cpp_comments_strings(s):
-    """Return s with // and /* */ comments and string/char/raw-string literals blanked to spaces
-    (length and newlines preserved) so a regex only matches real code. Parentheses in real code are
-    kept, so callers can still balance them on the masked text."""
-    out = list(s)
-    i = 0
-    n = len(s)
-    while i < n:
-        c = s[i]
-        # Raw string literal: an optional encoding prefix, then R"delim( ... )delim". The body may
-        # contain quotes, //, /* and unbalanced parens, so it must be consumed as one unit.
-        if c == "R" and i + 1 < n and s[i + 1] == '"':
-            j = i + 2
-            delim = ""
-            while j < n and s[j] not in "( \t\r\n\\" and len(delim) < 16:
-                delim += s[j]
-                j += 1
-            if j < n and s[j] == "(":
-                closing = ")" + delim + '"'
-                end = s.find(closing, j + 1)
-                end = n if end == -1 else end + len(closing)
-                for k in range(i, end):
-                    if s[k] != "\n":
-                        out[k] = " "
-                i = end
-                continue
-            i += 1
-        elif c == "/" and i + 1 < n and s[i + 1] == "/":
-            while i < n and s[i] != "\n":
-                out[i] = " "
-                i += 1
-        elif c == "/" and i + 1 < n and s[i + 1] == "*":
-            out[i] = out[i + 1] = " "
-            i += 2
-            while i < n and not (s[i] == "*" and i + 1 < n and s[i + 1] == "/"):
-                if s[i] != "\n":
-                    out[i] = " "
-                i += 1
-            if i < n:
-                out[i] = " "
-            if i + 1 < n:
-                out[i + 1] = " "
-            i += 2
-        # A "'" after an alphanumeric or '_' is a C++ digit separator (1'000), not a literal opener.
-        elif c == '"' or (
-            c == "'" and not (i and (s[i - 1].isalnum() or s[i - 1] == "_"))
-        ):
-            quote = c
-            out[i] = " "
-            i += 1
-            while i < n:
-                if s[i] == "\\":
-                    out[i] = " "
-                    if i + 1 < n:
-                        out[i + 1] = " "
-                    i += 2
-                    continue
-                if s[i] == quote:
-                    out[i] = " "
-                    i += 1
-                    break
-                if s[i] != "\n":
-                    out[i] = " "
-                i += 1
-        else:
-            i += 1
-    return "".join(out)
-
-
-def _log_statement_end(masked, open_paren):
-    """Index of the ';' ending the ESP_LOG call whose '(' is at open_paren, or None. Balanced on the
-    masked text so quotes/comments inside the arguments do not confuse the paren count."""
-    depth = 0
-    i = open_paren
-    n = len(masked)
-    while i < n:
-        ch = masked[i]
-        if ch == "(":
-            depth += 1
-        elif ch == ")":
-            depth -= 1
-            if depth == 0:
-                j = i + 1
-                while j < n and masked[j] != ";":
-                    if not masked[j].isspace():
-                        return None
-                    j += 1
-                return j if j < n else None
-        i += 1
-    return None
-
-
-@lint_content_check(include=cpp_include)
-def lint_esp_log_needs_braces(fname, content):
-    # Cheap bailout: no log call means nothing to flag, and skips masking the file entirely.
-    if "ESP_LOG" not in content and "esph_log_" not in content:
-        return []
-    masked = _mask_cpp_comments_strings(content)
-    errors = []
-    for match in ESP_LOG_NEEDS_BRACES_RE.finditer(masked):
-        pos = match.start()
-        line_start = content.rfind("\n", 0, pos) + 1
-        # Skip preprocessor conditionals (#if/#else/#elif): not C++ control statements.
-        if content[line_start:pos].lstrip().startswith("#"):
-            continue
-        # A '// NOLINT' may sit at the end of the log line (where the message says to put it) or on the
-        # control-statement line, so scan the whole statement rather than only up to the ESP_LOG token.
-        stmt_end = _log_statement_end(masked, match.end() - 1)
-        nolint_end = (
-            content.find("\n", stmt_end) if stmt_end is not None else match.end()
-        )
-        if nolint_end == -1:
-            nolint_end = len(content)
-        if "NOLINT" in content[pos:nolint_end]:
-            continue
-        snippet = content[pos : match.end()].replace("\n", " ").strip()
-        errors.append(
-            (
-                content.count("\n", 0, pos) + 1,
-                pos - line_start + 1,
-                (
-                    f"{highlight(snippet)} - an if/else/for/while body that is a single log "
-                    "call must be wrapped in braces. When the log level compiles the macro out, the "
-                    "body becomes empty and the compiler warns (-Wempty-body). Add { } around the "
-                    "log call (or a '// NOLINT' comment if this is genuinely intended)."
-                ),
-            )
-        )
-    return errors
-
-
 @lint_content_check(
     include=[
         "esphome/const.py",

tests/component_tests/api/test_outgoing_connection.py

@@ -0,0 +1,145 @@
+"""Tests for the api outgoing_connection option."""
+
+from collections.abc import Callable
+from pathlib import Path
+
+import pytest
+
+from esphome.components.api import (
+    CONFIG_SCHEMA,
+    _validate_outgoing_host_ipv6,
+    _validate_outgoing_socket_implementation,
+)
+from esphome.components.esp32 import KEY_BOARD, KEY_VARIANT, VARIANT_ESP32
+import esphome.config_validation as cv
+from esphome.const import PlatformFramework
+from esphome.core import CORE
+from esphome.types import ConfigType
+from tests.component_tests.types import SetCoreConfigCallable
+
+KEY = "bOFFzzvfpg5DB94DuBGLXD/hMnhpDKgP9UQyBulwWVU="
+ESP32_PLATFORM_DATA = {KEY_BOARD: "esp32dev", KEY_VARIANT: VARIANT_ESP32}
+
+
+def _api_config(outgoing: ConfigType, *, encryption: bool = True) -> ConfigType:
+    config: ConfigType = {"outgoing_connection": outgoing}
+    if encryption:
+        config["encryption"] = {"key": KEY}
+    return config
+
+
+def test_outgoing_connection_generates_defines(
+    generate_main: Callable[[str | Path], str],
+) -> None:
+    """A valid config emits the compile-time defines with defaults applied."""
+    generate_main("tests/component_tests/api/test_outgoing_connection.yaml")
+
+    defines = {define.name: define.value for define in CORE.defines}
+    assert "USE_API_OUTGOING_CONNECTION" in defines
+    assert str(defines["API_OUTGOING_CONNECTION_HOST"]) == '"192.168.1.2"'
+    assert str(defines["API_OUTGOING_CONNECTION_PORT"]) == "6054"
+    assert str(defines["API_OUTGOING_CONNECTION_DELAY"]) == "60000"
+
+
+def test_outgoing_connection_defaults(
+    set_core_config: SetCoreConfigCallable,
+) -> None:
+    set_core_config(PlatformFramework.ESP32_IDF, platform_data=ESP32_PLATFORM_DATA)
+    config = CONFIG_SCHEMA(_api_config({"host": "192.168.1.2"}))
+    outgoing = config["outgoing_connection"]
+    assert outgoing["port"] == 6054
+    assert outgoing["delay"].total_milliseconds == 60000
+
+
+def test_outgoing_connection_bare_block(
+    set_core_config: SetCoreConfigCallable,
+) -> None:
+    """A bare outgoing_connection: block is valid; the device dials the
+    remembered last dial-back client."""
+    set_core_config(PlatformFramework.ESP32_IDF, platform_data=ESP32_PLATFORM_DATA)
+    config = CONFIG_SCHEMA(_api_config(None))
+    outgoing = config["outgoing_connection"]
+    assert "host" not in outgoing
+    assert outgoing["port"] == 6054
+
+
+def test_outgoing_connection_delay_bounded(
+    set_core_config: SetCoreConfigCallable,
+) -> None:
+    """A delay past half the uint32 millisecond range is rejected, not wrapped."""
+    set_core_config(PlatformFramework.ESP32_IDF, platform_data=ESP32_PLATFORM_DATA)
+    with pytest.raises(cv.Invalid, match="value must be at most"):
+        CONFIG_SCHEMA(_api_config({"delay": "60d"}))
+
+
+def test_outgoing_connection_requires_encryption(
+    set_core_config: SetCoreConfigCallable,
+) -> None:
+    set_core_config(PlatformFramework.ESP32_IDF, platform_data=ESP32_PLATFORM_DATA)
+    with pytest.raises(cv.Invalid, match="requires 'encryption'"):
+        CONFIG_SCHEMA(_api_config({"host": "192.168.1.2"}, encryption=False))
+
+
+@pytest.mark.parametrize(
+    "platform_framework",
+    [PlatformFramework.ESP8266_ARDUINO, PlatformFramework.RP2040_ARDUINO],
+)
+def test_outgoing_connection_rejected_on_raw_lwip_platforms(
+    set_core_config: SetCoreConfigCallable,
+    platform_framework: PlatformFramework,
+) -> None:
+    set_core_config(platform_framework)
+    with pytest.raises(cv.Invalid, match="not supported on this platform"):
+        CONFIG_SCHEMA(_api_config({"host": "192.168.1.2"}))
+
+
+def test_outgoing_connection_rejects_lwip_tcp_selected_on_esp32(
+    set_core_config: SetCoreConfigCallable,
+) -> None:
+    """An explicit lwip_tcp selection is caught at final validate."""
+    set_core_config(
+        PlatformFramework.ESP32_IDF,
+        platform_data=ESP32_PLATFORM_DATA,
+        full_config={"socket": {"implementation": "lwip_tcp"}},
+    )
+    config = CONFIG_SCHEMA(_api_config({"host": "192.168.1.2"}))
+    with pytest.raises(cv.Invalid, match="lwip_tcp"):
+        _validate_outgoing_socket_implementation(config)
+
+
+def test_outgoing_connection_rejects_hostnames(
+    set_core_config: SetCoreConfigCallable,
+) -> None:
+    set_core_config(PlatformFramework.ESP32_IDF, platform_data=ESP32_PLATFORM_DATA)
+    with pytest.raises(cv.Invalid, match="not a valid IP address"):
+        CONFIG_SCHEMA(_api_config({"host": "homeassistant.local"}))
+
+
+def test_outgoing_connection_ipv6_host_requires_ipv6(
+    set_core_config: SetCoreConfigCallable,
+) -> None:
+    set_core_config(PlatformFramework.ESP32_IDF, platform_data=ESP32_PLATFORM_DATA)
+    config = CONFIG_SCHEMA(_api_config({"host": "fd00::1"}))
+    with pytest.raises(cv.Invalid, match="IPv6 is not"):
+        _validate_outgoing_host_ipv6(config)
+
+
+def test_outgoing_connection_ipv6_host_passes_with_ipv6_enabled(
+    set_core_config: SetCoreConfigCallable,
+) -> None:
+    set_core_config(
+        PlatformFramework.ESP32_IDF,
+        platform_data=ESP32_PLATFORM_DATA,
+        full_config={"network": {"enable_ipv6": True}},
+    )
+    config = CONFIG_SCHEMA(_api_config({"host": "fd00::1"}))
+    assert _validate_outgoing_host_ipv6(config) is config
+
+
+def test_outgoing_connection_ipv6_host_with_ipv6(
+    generate_main: Callable[[str | Path], str],
+) -> None:
+    generate_main("tests/component_tests/api/test_outgoing_connection_ipv6.yaml")
+
+    defines = {define.name: define.value for define in CORE.defines}
+    assert str(defines["API_OUTGOING_CONNECTION_HOST"]) == '"fd00::1"'

tests/component_tests/api/test_outgoing_connection.yaml

@@ -0,0 +1,17 @@
+esphome:
+  name: test
+
+esp32:
+  board: esp32dev
+
+wifi:
+  ssid: SomeNetwork
+  password: SomePassword
+
+logger:
+
+api:
+  encryption:
+    key: bOFFzzvfpg5DB94DuBGLXD/hMnhpDKgP9UQyBulwWVU=
+  outgoing_connection:
+    host: 192.168.1.2

tests/component_tests/api/test_outgoing_connection_ipv6.yaml

@@ -0,0 +1,20 @@
+esphome:
+  name: test
+
+esp32:
+  board: esp32dev
+
+wifi:
+  ssid: SomeNetwork
+  password: SomePassword
+
+network:
+  enable_ipv6: true
+
+logger:
+
+api:
+  encryption:
+    key: bOFFzzvfpg5DB94DuBGLXD/hMnhpDKgP9UQyBulwWVU=
+  outgoing_connection:
+    host: fd00::1

tests/component_tests/epaper_spi/config/uc8179_e1001_test.yaml

@@ -1,15 +0,0 @@
-esphome:
-  name: test
-
-esp32:
-  board: esp32-s3-devkitc-1
-  variant: esp32s3
-
-spi:
-  clk_pin: GPIO7
-  mosi_pin: GPIO9
-
-display:
-  - platform: epaper_spi
-    id: epaper_display
-    model: seeed-reterminal-e1001