Bypass the cache when the resolved config enables secure options the snapshot cannot see

Co-authored-by: n-IA-hane <n-IA-hane@users.noreply.github.com>

.agents/skills/code-review/SKILL.md

@@ -0,0 +1,116 @@
+---
+name: code-review
+description: Review guidance for ESPHome pull requests. Use this when reviewing a pull request that changes ESPHome Python, C++, or component code, to check it against the project's coding conventions, embedded-systems memory rules, testing requirements, and breaking-change policy.
+---
+
+# Reviewing ESPHome pull requests
+
+ESPHome parses YAML into C++ firmware for memory-constrained microcontrollers
+(ESP32, ESP8266, RP2040, LibreTiny). Review changes with that in mind: RAM and
+flash are scarce, and code runs unattended for months.
+
+`AGENTS.md` in the repository root is the full contributor guide and the
+authority when it disagrees with this summary. The developer documentation at
+https://developers.esphome.io explains the component lifecycle and the reasoning
+behind these rules. This skill lists the concrete things worth flagging in a
+review; read `AGENTS.md` for the detail behind any item.
+
+Only raise findings that the diff actually introduces or changes. Do not ask for
+drive-by cleanup of pre-existing code the PR did not touch.
+
+## Memory and embedded constraints (highest value)
+
+Heap allocation after `setup()` is treated as a reliability bug, not a
+performance nit, because it fragments a small shared heap. Flag:
+
+- New heap allocation on a hot path or after setup that could be avoided.
+- `std::vector` where the size is known at compile time (use `std::array`, or
+  `StaticVector<T, N>` when a `push_back` API is needed) or fixed at runtime
+  init (use `FixedVector<T>`).
+- Listener / child-entity registration lists stored as `std::vector`; these have
+  a compile-time-known count and should use `cg.slot_counter()` plus
+  `StaticVector`.
+- `std::vector<uint8_t>` for a byte buffer that never grows: prefer
+  `std::unique_ptr<uint8_t[]>` or `std::array`.
+- `std::map` / `std::set` / `std::unordered_map` for small datasets (1-16
+  elements): a `std::vector` of a small struct with linear search is lighter.
+- `std::deque` anywhere: it allocates 512-byte blocks and should be avoided.
+- `std::string` storing a value set once from config: prefer `StringRef` (the
+  literal already lives in flash).
+- `std::string` / `std::to_string` / string-returning helpers on hot paths where
+  a buffer or view API exists.
+
+## C++ conventions
+
+- Include what you use: a file referencing a symbol must include the header that
+  declares it, even if it currently arrives transitively. New or changed uses of
+  a symbol need the matching include.
+- Prefix all member access with `this->`.
+- Naming: `lower_snake_case` for functions/methods/variables, `UpperCamelCase`
+  for classes/structs/enums, `UPPER_SNAKE_CASE` for namespace-scope constants,
+  trailing underscore on protected/private fields.
+- `enum class` values must be prefixed with the enum name in `UPPER_SNAKE_CASE`
+  (e.g. `UARTFlushResult::UART_FLUSH_RESULT_SUCCESS`). Bare names like `SUCCESS`,
+  `FAIL`, or `OK` collide with SDK macros on some platforms and break the build.
+- Prefer `const`/`enum` over `#define`; `#define` is only for conditional
+  compilation and code-generation sizes.
+- Never call `millis()` in a `loop()` body; use
+  `App.get_loop_component_start_time()`. A rate-limit gate below ~16 ms (the loop
+  period) does nothing.
+- Pick the timing primitive by cadence: gated `loop()` under 250 ms,
+  `set_interval` at 500 ms and above.
+- Do not override a base method to return the value it already returns (e.g.
+  `get_setup_priority()` returning `setup_priority::DATA`).
+- Wrap string literals passed as printf `%s` args in `LOG_STR_LITERAL()`.
+- Required, invariant dependencies should be constructor parameters, not setters.
+- Callback registration methods must be templated (`template<typename F>`), not
+  typed as `std::function`, so lightweight forwarders avoid a heap allocation.
+- Two-space indent, `using` over `typedef`, wrap at 120 columns.
+
+## Python conventions
+
+- Type-annotate every new function signature (params and return), new dataclass
+  fields, and new module-level variables. Import `ConfigType` from
+  `esphome.types`.
+- Use the walrus operator to avoid a double lookup, e.g.
+  `if (blah := config.get(CONF_BLAH)) is not None:`.
+- Reuse existing validators from `config_validation.py` (`cv.rename_key`,
+  `cv.has_exactly_one_key`, etc.) via `cv.All(...)` instead of hand-rolling.
+- `esphome/const.py` is frozen: no new `CONF_` constants there. Define them in
+  the component's own `.py`, or in `esphome/components/const/__init__.py` when
+  shared. The same constant defined in three or more component files fails CI.
+- State that must persist during code generation goes in `CORE.data` namespaced
+  under the component `DOMAIN` (a `@dataclass`), not module-level mutable globals.
+- Prefer callback-based triggers via `build_callback_automation()`; only use a
+  `Trigger<Ts...>` subclass when the forwarder needs mutable state.
+
+## Testing and coverage
+
+- New and changed lines and branches need test coverage, including defensive
+  early-returns, error paths, and no-op guards. A mocked-out function is not
+  covered; exercise the real call path too.
+- Component YAML tests live in `tests/components/<component>/`. Never define
+  buses (uart, i2c, spi, modbus) directly in a test file: pull them from
+  `tests/test_build_components/common/` through dict-style `packages:` so CI can
+  group builds. List-style packages or top-level merge keys block grouping.
+- Config-only checks use the `validate.*.yaml` prefix; compiled checks use
+  `test.*.yaml`.
+
+## Breaking changes and public API
+
+- Base classes under `esphome/core/` and documented config options are public
+  API. Undocumented `public` members of a component are internal.
+- A breaking change needs justification, a migration path in the PR description,
+  and a deprecation window where feasible (`ESPDEPRECATED` in C++,
+  `cv.rename_key(..., removed_in=...)` in Python). Changing a codegen-injected
+  lambda signature is not a breaking change.
+
+## Process and PR hygiene
+
+- PR titles start with a `[tag]` prefix: the component name (e.g. `[uart] ...`)
+  or `[core]` for shared code.
+- Prose in docs, comments, and commit messages should be plain English. Keep
+  inline comments short and only where the code is not self-explanatory; do not
+  restate what the code says.
+- Verify the PR fills out `.github/PULL_REQUEST_TEMPLATE.md` and adds
+  `CODEOWNERS` entries for a new component.

.claude/settings.json

@@ -0,0 +1,16 @@
+{
+  "hooks": {
+    "SessionStart": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "d=\"${CLAUDE_PROJECT_DIR:-.}\"; [ -x \"$d/venv/bin/python\" ] || { mkdir -p \"$d/.temp\"; env -u VIRTUAL_ENV \"$d/script/setup\" >\"$d/.temp/setup.log\" 2>&1 || echo '{\"systemMessage\":\"script/setup failed; see .temp/setup.log\"}'; }",
+            "statusMessage": "Setting up dev environment (script/setup)...",
+            "timeout": 900
+          }
+        ]
+      }
+    ]
+  }
+}

.claude/skills

@@ -0,0 +1 @@
+../.agents/skills

.devcontainer/Dockerfile

@@ -31,7 +31,4 @@ RUN \
     platformio settings set enable_telemetry No \
     && platformio settings set check_platformio_interval 1000000
 
-COPY script/platformio_install_deps.py platformio.ini ./
-RUN ./platformio_install_deps.py platformio.ini --libraries --platforms --tools
-
 WORKDIR /workspaces

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -9,6 +9,29 @@ body:
         If you have a feature request or enhancement, please [request them here instead][fr].
 
         [fr]: https://github.com/orgs/esphome/discussions
+  - type: markdown
+    attributes:
+      value: |
+        ## Use of AI in bug reports
+
+        AI tools are good at carrying out well-defined tasks, but they are not good at troubleshooting.
+        Please do NOT paste an AI-generated wall of text into the issue template - if the AI hasn't solved
+        your problem, its wild guesses are not likely to help.
+
+        Please DO include your own words and observations, compile/boot logs, and
+        especially a minimal reproducible example of your YAML configuration that demonstrates the problem.
+
+        It is however quite acceptable to use AI to translate your *own* report,
+        if you aren't a competent English speaker.
+
+        If you really think it will be useful to include an AI's analysis, preferably wrap it in a `<details>` block which will be collapsed by default.
+
+        If you are using AI to help solve a problem, rather than asking it to speculate about what the problem is,
+        it can be more useful to ask it to create a step-by-step troubleshooting procedure.
+        AI is also useful for generating boilerplate code, such as a minimal reproducible example of your YAML
+        configuration that demonstrates the problem.
+
+        Used properly, AI can be a useful tool to help you solve your problem, but don't let it get in the way.
   - type: textarea
     validations:
       required: true

.github/actions/build-image/action.yaml

@@ -42,7 +42,7 @@ runs:
 
     - name: Build and push to ghcr by digest
       id: build-ghcr
-      uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
+      uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
       env:
         DOCKER_BUILD_SUMMARY: false
         DOCKER_BUILD_RECORD_UPLOAD: false
@@ -67,7 +67,7 @@ runs:
 
     - name: Build and push to dockerhub by digest
       id: build-dockerhub
-      uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
+      uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
       env:
         DOCKER_BUILD_SUMMARY: false
         DOCKER_BUILD_RECORD_UPLOAD: false

.github/actions/cache-arduino8266/action.yml

@@ -0,0 +1,39 @@
+name: Cache Arduino ESP8266
+description: >
+  Resolve the pinned Arduino core and xtensa toolchain versions and cache the
+  native ESP8266 install (~110 MB framework + toolchain; no ccache store, the
+  seed job saves before any compile runs). Exports
+  ESPHOME_ARDUINO8266_PREFIX to the job so every later step installs into
+  the cached path; the Python venv must already be restored. Mirrors
+  cache-esp-idf: only dev-branch pushes write the shared cache, everything
+  else restores.
+runs:
+  using: composite
+  steps:
+    - name: Resolve the native toolchain cache key
+      # Versions are pinned in code, not a hashable file; resolve them so a
+      # bump changes the cache key. Assignment form so errexit catches a
+      # resolver failure.
+      id: version
+      shell: bash
+      run: |
+        # One owner for the install prefix: exported here and referenced by
+        # the cache steps below via env, so the caller's install and the
+        # cached path cannot diverge.
+        echo "ESPHOME_ARDUINO8266_PREFIX=$HOME/.esphome-arduino8266" >> "$GITHUB_ENV"
+        . venv/bin/activate
+        key=$(python -c 'from esphome.components.esp8266 import RECOMMENDED_ARDUINO_FRAMEWORK_VERSION as f; from esphome.arduino8266.framework import FRAMEWORK_RELEASES, TOOLCHAIN_VERSION as t; print(f"{FRAMEWORK_RELEASES[f].tag}-{t}")')
+        [ -n "$key" ] || exit 1
+        echo "key=$key" >> "$GITHUB_OUTPUT"
+    - name: Cache the native toolchain (write on dev)
+      if: github.ref == 'refs/heads/dev'
+      uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+      with:
+        path: ${{ env.ESPHOME_ARDUINO8266_PREFIX }}
+        key: ${{ runner.os }}-esp8266-native-${{ steps.version.outputs.key }}
+    - name: Restore the native toolchain (off dev)
+      if: github.ref != 'refs/heads/dev'
+      uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+      with:
+        path: ${{ env.ESPHOME_ARDUINO8266_PREFIX }}
+        key: ${{ runner.os }}-esp8266-native-${{ steps.version.outputs.key }}

.github/actions/cache-clang-tidy-idedata/action.yml

@@ -0,0 +1,50 @@
+name: Cache clang-tidy idedata
+description: >
+  Cache the clang-tidy idedata and the headers it references under .temp
+  (headers only, about 30MB per env). Run after restore-python and cache-esp-idf.
+inputs:
+  environment:
+    description: 'clang-tidy environment (e.g. esp32-idf-tidy).'
+    required: true
+runs:
+  using: composite
+  steps:
+    - name: Compute cache key
+      id: key
+      shell: bash
+      run: |
+        . venv/bin/activate
+        [ -n "${{ inputs.environment }}" ] || { echo "::error::cache-clang-tidy-idedata: 'environment' input is empty"; exit 1; }
+        hash=$(python -c 'import sys; sys.path.insert(0, "script"); from clang_tidy_hash import idedata_cache_hash; print(idedata_cache_hash("${{ inputs.environment }}"))')
+        pyver=$(python -c 'import platform; print(platform.python_version())')
+        # Generating idedata is what installs ESP-IDF; never skip it over a missing
+        # install. This also skips the save, so a dev run that installs ESP-IDF
+        # warms the idedata cache on the next run.
+        if [ -d ~/.esphome-idf/frameworks ]; then
+          echo "skip=false" >> "$GITHUB_OUTPUT"
+        else
+          echo "ESP-IDF install missing, not using the clang-tidy idedata cache"
+          echo "skip=true" >> "$GITHUB_OUTPUT"
+        fi
+        echo "key=${{ runner.os }}-tidy-idedata-${{ inputs.environment }}-$hash-py$pyver" >> "$GITHUB_OUTPUT"
+        {
+          echo "path<<EOF"
+          printf '%s\n' '.temp/idedata-*.json' '.temp/idedata-*.hash'
+          printf '.temp/**/*.%s\n' h hpp hh hxx inc inl ipp tpp
+          echo "EOF"
+        } >> "$GITHUB_OUTPUT"
+    # Mirror cache-esp-idf: write on dev, restore-only on PRs. The post-step
+    # save only runs when the job succeeded, so a failed generation is never saved.
+    # Extend the extension list if a component ships extensionless headers.
+    - name: Cache clang-tidy idedata (write on dev)
+      if: (github.ref == 'refs/heads/dev' || contains(github.event.pull_request.labels.*.name, 'ci-cache-write')) && steps.key.outputs.skip != 'true'
+      uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+      with:
+        path: ${{ steps.key.outputs.path }}
+        key: ${{ steps.key.outputs.key }}
+    - name: Cache clang-tidy idedata (restore-only off dev)
+      if: github.ref != 'refs/heads/dev' && !contains(github.event.pull_request.labels.*.name, 'ci-cache-write') && steps.key.outputs.skip != 'true'
+      uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+      with:
+        path: ${{ steps.key.outputs.path }}
+        key: ${{ steps.key.outputs.key }}

.github/actions/cache-esp-idf/action.yml

@@ -26,6 +26,9 @@ runs:
       # The native-IDF version is pinned in code, not in any file that feeds the
       # other cache keys, so resolve it explicitly. Keying on it means the cache
       # invalidates on a version bump (actions/cache never overwrites a key).
+      # Also key on the Python version: the cached IDF venv links to the
+      # runner's toolcache interpreter and is reinstalled every run after a
+      # runner image bump.
       id: version
       shell: bash
       run: |
@@ -36,19 +39,32 @@ runs:
           version=$(python -c 'from esphome.components.esp32 import ESP_IDF_FRAMEWORK_VERSION_LOOKUP as L; print(L["recommended"])')
         fi
         echo "version=$version" >> "$GITHUB_OUTPUT"
+        echo "python-version=$(python -c 'import platform; print(platform.python_version())')" >> "$GITHUB_OUTPUT"
     # Mirror the adjacent PlatformIO cache: only dev-branch runs write the
     # shared cache (so it lives in the default-branch scope readable by all
     # PRs), and PRs are restore-only -- they never push multi-GB artifacts into
-    # their own scope / the repo quota (e.g. on a version-bump PR).
+    # their own scope / the repo quota (e.g. on a version-bump PR). The
+    # ci-cache-write label lets a PR write into its own scope to test the hit path;
+    # that costs about 1GB of the repo cache quota per run, so remove it when done.
+    # -slim: bump when prune-esp-idf changes what it removes; a key is never overwritten.
     - name: Cache ESP-IDF install (write on dev)
-      if: github.ref == 'refs/heads/dev' && inputs.restore-only != 'true'
+      if: (github.ref == 'refs/heads/dev' || contains(github.event.pull_request.labels.*.name, 'ci-cache-write')) && inputs.restore-only != 'true'
       uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
       with:
         path: ~/.esphome-idf
-        key: ${{ runner.os }}-esphome-idf-${{ steps.version.outputs.version }}
+        key: ${{ runner.os }}-esphome-idf-${{ steps.version.outputs.version }}-py${{ steps.version.outputs.python-version }}-slim
     - name: Cache ESP-IDF install (restore-only off dev)
-      if: github.ref != 'refs/heads/dev' || inputs.restore-only == 'true'
+      if: github.ref != 'refs/heads/dev' && !contains(github.event.pull_request.labels.*.name, 'ci-cache-write') || inputs.restore-only == 'true'
       uses: actions/cache/restore@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
       with:
         path: ~/.esphome-idf
-        key: ${{ runner.os }}-esphome-idf-${{ steps.version.outputs.version }}
+        key: ${{ runner.os }}-esphome-idf-${{ steps.version.outputs.version }}-py${{ steps.version.outputs.python-version }}-slim
+    # Install explicitly so the prune below sees the toolchains on a cache miss
+    # too, instead of the install happening inside the first build step.
+    - name: Install ESP-IDF
+      shell: bash
+      run: |
+        . venv/bin/activate
+        python -c 'from esphome.espidf.framework import check_esp_idf_install; check_esp_idf_install("${{ steps.version.outputs.version }}")'
+    - name: Prune ESP-IDF install
+      uses: ./.github/actions/prune-esp-idf

.github/actions/prune-esp-idf/action.yml

@@ -0,0 +1,34 @@
+name: Prune ESP-IDF install
+description: >
+  Remove the picolibc sysroots (1.1GB of the 3.9GB install) from the native
+  ESP-IDF toolchains; IDF 5.x links newlib. Skipped when an IDF 6 install is
+  present, which links picolibc (see esp32/__init__.py).
+runs:
+  using: composite
+  steps:
+    - name: Prune picolibc
+      shell: bash
+      run: |
+        shopt -s nullglob
+        prefix="${ESPHOME_ESP_IDF_PREFIX:-$HOME/.esphome-idf}"
+        prefix="${prefix/#\~/$HOME}"
+        for fw in "$prefix"/frameworks/*/; do
+          case "$(basename "$fw")" in
+            [6-9].*) echo "IDF $(basename "$fw") installed, keeping picolibc"; exit 0 ;;
+          esac
+        done
+        n=0
+        for dir in "$prefix"/tools/*-esp-elf/*/*-esp-elf/picolibc; do
+          echo "Removing $dir ($(du -sh "$dir" | cut -f1))"
+          rm -rf "$dir"
+          n=$((n + 1))
+        done
+        # The marker rides along in the cache entry so a restored slim tree stays quiet.
+        if [ "$n" -gt 0 ]; then
+          touch "$prefix/.picolibc-pruned"
+        elif [ -d "$prefix/tools" ] && [ ! -f "$prefix/.picolibc-pruned" ]; then
+          echo "::warning::no picolibc sysroots matched under $prefix/tools"
+        fi
+        if [ -d "$prefix" ]; then
+          du -sh "$prefix"
+        fi

.github/actions/restore-python/action.yml

@@ -32,7 +32,7 @@ runs:
       # detects the activated venv via ``VIRTUAL_ENV`` so the venv layout
       # downstream jobs rely on is preserved.
       if: steps.cache-venv.outputs.cache-hit != 'true'
-      uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
+      uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
       with:
         enable-cache: true
         # Pull request saves land in per-PR scopes nothing else can
@@ -49,7 +49,7 @@ runs:
         python -m venv venv
         source venv/bin/activate
         python --version
-        uv pip install -r requirements.txt -r requirements_test.txt
+        uv pip install -r requirements.txt -r requirements_dev.txt -r requirements_test.txt
         uv pip install -e .
     - name: Create Python virtual environment
       if: steps.cache-venv.outputs.cache-hit != 'true' && runner.os == 'Windows'
@@ -58,5 +58,5 @@ runs:
         python -m venv venv
         source ./venv/Scripts/activate
         python --version
-        uv pip install -r requirements.txt -r requirements_test.txt
+        uv pip install -r requirements.txt -r requirements_dev.txt -r requirements_test.txt
         uv pip install -e .

.github/skills

@@ -0,0 +1 @@
+../.agents/skills

.github/workflows/ci-api-proto.yml

@@ -29,7 +29,7 @@ jobs:
       - name: Set up uv
         # ``--system`` (below) installs into the setup-python interpreter;
         # no venv is created or restored by this workflow.
-        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
+        uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
         with:
           enable-cache: true
           # Pull-request-only workflow: a save could never be shared and
@@ -41,10 +41,32 @@ jobs:
           version: "0.11.15"
 
       - name: Install apt dependencies
+        # PR-only workflow, so nothing on dev could seed a shared apt cache
+        # entry; the cached apt action would save one copy per PR. Plain apt
+        # with every call bounded: the apt.conf.d timeouts make a dead
+        # mirror fail over in seconds, and timeout runs under sudo so it can
+        # kill apt-get itself. Install without update first: image lists are
+        # fresh, and the index refresh is what a congested mirror makes slow.
+        timeout-minutes: 15
         run: |
-          sudo apt update
-          sudo apt-cache show protobuf-compiler
-          sudo apt install -y protobuf-compiler
+          sudo tee /etc/apt/apt.conf.d/99ci-acquire-timeouts >/dev/null <<'EOF'
+          Acquire::Retries "1";
+          Acquire::http::Timeout "15";
+          Acquire::https::Timeout "15";
+          EOF
+          # Common path: the image's package lists are fresh enough.
+          if sudo DEBIAN_FRONTEND=noninteractive timeout -k 15 90 \
+              apt-get install -y protobuf-compiler; then
+            protoc --version
+            exit 0
+          fi
+          # Rescue path: refresh the lists once with a generous bound; the
+          # apt config already fails a stalled mirror over quickly.
+          sudo DEBIAN_FRONTEND=noninteractive timeout -k 10 30 \
+            dpkg --configure -a || true
+          sudo timeout -k 15 300 apt-get update
+          sudo DEBIAN_FRONTEND=noninteractive timeout -k 15 300 \
+            apt-get install -y protobuf-compiler
           protoc --version
       - name: Install python dependencies
         run: uv pip install --system aioesphomeapi -c requirements.txt -r requirements_dev.txt

.github/workflows/ci-docker.yml

@@ -12,15 +12,14 @@ on:
       - ".github/workflows/ci-docker.yml"
       - "requirements*.txt"
       - "pyproject.toml"
-      - "platformio.ini"
       - "esphome/idf_component.yml"
-      - "script/platformio_install_deps.py"
       # Core, build pipeline, toolchain, and target-platform changes can change
       # how a toolchain is set up or built, so re-run the per-toolchain compile
       # smoke test when they change.
       - "esphome/core/**"
       - "esphome/writer.py"
       - "esphome/build_gen/**"
+      - "esphome/build_helpers/**"
       - "esphome/espidf/**"
       - "esphome/platformio/**"
       - "esphome/components/bk72xx/**"
@@ -67,7 +66,7 @@ jobs:
         with:
           python-version: "3.12"
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
+        uses: docker/setup-buildx-action@594f3bf4285d9ea8dc53c9a0c9c4092420091003 # v4.4.0
 
       - name: Determine tag and whether to push
         id: tag
@@ -119,16 +118,22 @@ jobs:
       # pushed image) keeps it working for fork PRs, which never push to ghcr.io.
       - name: Export image for compile-test
         if: matrix.os == 'ubuntu-24.04' && matrix.build_type == 'docker'
-        run: docker save "ghcr.io/esphome/esphome-amd64:${{ steps.tag.outputs.tag }}" | gzip > compile-test-image.tar.gz
+        # zstd over gzip: docker save is on the critical path for every
+        # compile-test job, and zstd -T0 is multithreaded (export 50s -> 9s).
+        # docker load auto-detects the format; its time is layer extraction,
+        # not decompression, so it is unchanged. shell: bash adds pipefail so
+        # a failed docker save cannot upload a truncated artifact.
+        shell: bash
+        run: docker save "ghcr.io/esphome/esphome-amd64:${{ steps.tag.outputs.tag }}" | zstd -T0 -3 > compile-test-image.tar.zst
 
       - name: Upload compile-test image artifact
         if: matrix.os == 'ubuntu-24.04' && matrix.build_type == 'docker'
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
-          # The tar is already gzipped, so upload it as-is. archive: false skips
-          # the redundant zip and makes the file name the artifact name (the
-          # `name` input is ignored in that mode).
-          path: compile-test-image.tar.gz
+          # The tar is already compressed, so upload it as-is. archive: false
+          # skips the redundant zip and makes the file name the artifact name
+          # (the `name` input is ignored in that mode).
+          path: compile-test-image.tar.zst
           retention-days: 1
           archive: false
 
@@ -153,7 +158,7 @@ jobs:
         with:
           python-version: "3.12"
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
+        uses: docker/setup-buildx-action@594f3bf4285d9ea8dc53c9a0c9c4092420091003 # v4.4.0
 
       - name: Log in to the GitHub container registry
         uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
@@ -182,8 +187,6 @@ jobs:
       contents: read  # actions/checkout to load the test configs
     strategy:
       fail-fast: false
-      # Modest cap so this smoke test leaves room on the shared runner pool.
-      max-parallel: 8
       matrix:
         # One entry per distinct toolchain. ESP32 variants (c3/c6/s2/s3/p4)
         # share a toolchain bundle, so esp32 is exercised on the base variant
@@ -193,6 +196,7 @@ jobs:
         # the default.
         id:
           - esp8266-arduino
+          - esp8266-arduino-native
           - esp32-arduino-platformio
           - esp32-arduino-esp-idf
           - esp32-idf-platformio
@@ -208,9 +212,9 @@ jobs:
       - name: Download image artifact
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
-          name: compile-test-image.tar.gz
+          name: compile-test-image.tar.zst
       - name: Load image
-        run: docker load --input compile-test-image.tar.gz
+        run: docker load --input compile-test-image.tar.zst
       - name: Compile ${{ matrix.id }}
         run: |
           docker run --rm \

.github/workflows/ci.yml

@@ -49,7 +49,7 @@ jobs:
         # detects the activated venv via ``VIRTUAL_ENV`` so downstream jobs
         # that ``. venv/bin/activate`` see an identical layout.
         if: steps.cache-venv.outputs.cache-hit != 'true'
-        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
+        uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
         with:
           enable-cache: true
           # Pull request saves land in per-PR scopes nothing else can
@@ -68,6 +68,22 @@ jobs:
           uv pip install -r requirements.txt -r requirements_dev.txt -r requirements_test.txt
           uv pip install -e .
 
+  seed-apt-cache:
+    name: Seed apt package cache
+    runs-on: ubuntu-24.04
+    # PR-branch cache saves are invisible to other PRs, so dev/beta/release
+    # pushes seed the one shared entry PR jobs restore. The key is derived
+    # only from the package list and version; keep both identical in every
+    # step that restores it. In ci-status needs so a broken seed fails dev.
+    if: github.event_name == 'push'
+    timeout-minutes: 10
+    steps:
+      - name: Install apt packages (cached)
+        uses: awalsh128/cache-apt-pkgs-action@553a35bb8ebd9fcabcb1c9451aa4c98e1b4ca8a9 # v1.6.3
+        with:
+          packages: libsdl2-dev ccache
+          version: 1.1
+
   determine-jobs:
     name: Determine which jobs to run
     runs-on: ubuntu-24.04
@@ -76,6 +92,7 @@ jobs:
     outputs:
       core-ci: ${{ steps.determine.outputs.core-ci }}
       integration-tests: ${{ steps.determine.outputs.integration-tests }}
+      integration-run-all: ${{ steps.determine.outputs.integration-run-all }}
       integration-test-buckets: ${{ steps.determine.outputs.integration-test-buckets }}
       clang-tidy: ${{ steps.determine.outputs.clang-tidy }}
       clang-tidy-mode: ${{ steps.determine.outputs.clang-tidy-mode }}
@@ -85,6 +102,8 @@ jobs:
       device-builder: ${{ steps.determine.outputs.device-builder }}
       esp32-platformio: ${{ steps.determine.outputs.esp32-platformio }}
       esp32-platformio-components: ${{ steps.determine.outputs.esp32-platformio-components }}
+      esp8266-native: ${{ steps.determine.outputs.esp8266-native }}
+      esp8266-native-components: ${{ steps.determine.outputs.esp8266-native-components }}
       changed-components: ${{ steps.determine.outputs.changed-components }}
       changed-components-with-tests: ${{ steps.determine.outputs.changed-components-with-tests }}
       directly-changed-components-with-tests: ${{ steps.determine.outputs.directly-changed-components-with-tests }}
@@ -96,6 +115,12 @@ jobs:
       component-test-batches: ${{ steps.determine.outputs.component-test-batches }}
       validate-only-components: ${{ steps.determine.outputs.validate-only-components }}
       benchmarks: ${{ steps.determine.outputs.benchmarks }}
+      # "true" when this run is a pull request into one of the release
+      # branches. Those pull requests are batches of changes already tested on
+      # their original dev pull requests, so several jobs below trade coverage
+      # for turnaround time on them. Matched exactly, not by prefix, so an
+      # ordinary branch named e.g. "release-notes" is not caught by it.
+      release-pr: ${{ github.base_ref == 'beta' || github.base_ref == 'release' }}
     steps:
       - name: Check out code from GitHub
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -130,6 +155,9 @@ jobs:
           # Extract individual fields
           echo "core-ci=$(echo "$output" | jq -r '.core_ci')" >> $GITHUB_OUTPUT
           echo "integration-tests=$(echo "$output" | jq -r '.integration_tests')" >> $GITHUB_OUTPUT
+          # A missing key must fail here, not silently disable the junit upload
+          run_all=$(echo "$output" | jq -r 'if has("integration_run_all") then .integration_run_all else error("integration_run_all missing") end')
+          echo "integration-run-all=${run_all}" >> $GITHUB_OUTPUT
           echo "integration-test-buckets=$(echo "$output" | jq -c '.integration_test_buckets')" >> $GITHUB_OUTPUT
           echo "clang-tidy=$(echo "$output" | jq -r '.clang_tidy')" >> $GITHUB_OUTPUT
           echo "clang-tidy-mode=$(echo "$output" | jq -r '.clang_tidy_mode')" >> $GITHUB_OUTPUT
@@ -139,6 +167,8 @@ jobs:
           echo "device-builder=$(echo "$output" | jq -r '.device_builder')" >> $GITHUB_OUTPUT
           echo "esp32-platformio=$(echo "$output" | jq -r '.esp32_platformio')" >> $GITHUB_OUTPUT
           echo "esp32-platformio-components=$(echo "$output" | jq -r '.esp32_platformio_components')" >> $GITHUB_OUTPUT
+          echo "esp8266-native=$(echo "$output" | jq -r '.esp8266_native')" >> $GITHUB_OUTPUT
+          echo "esp8266-native-components=$(echo "$output" | jq -r '.esp8266_native_components')" >> $GITHUB_OUTPUT
           echo "changed-components=$(echo "$output" | jq -c '.changed_components')" >> $GITHUB_OUTPUT
           echo "changed-components-with-tests=$(echo "$output" | jq -c '.changed_components_with_tests')" >> $GITHUB_OUTPUT
           echo "directly-changed-components-with-tests=$(echo "$output" | jq -c '.directly_changed_components_with_tests')" >> $GITHUB_OUTPUT
@@ -157,6 +187,33 @@ jobs:
           path: .temp/components_graph.json
           key: components-graph-${{ hashFiles('esphome/components/**/*.py') }}
 
+  seed-esp8266-native-cache:
+    name: Seed the esp8266 native toolchain cache
+    runs-on: ubuntu-24.04
+    needs:
+      - common
+    # PR-branch cache saves are invisible to other PRs, so dev pushes seed
+    # the shared entry the component matrix, the memory impact jobs and
+    # test-esp8266-native restore. Only dev: the composite action saves
+    # nowhere else, so a beta/release push would download the toolchain and
+    # discard it.
+    if: github.event_name == 'push' && github.ref == 'refs/heads/dev'
+    timeout-minutes: 15
+    steps:
+      - name: Check out code from GitHub
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Restore Python
+        uses: ./.github/actions/restore-python
+        with:
+          python-version: ${{ env.DEFAULT_PYTHON }}
+          cache-key: ${{ needs.common.outputs.cache-key }}
+      - name: Cache the native toolchain
+        uses: ./.github/actions/cache-arduino8266
+      - name: Install the native toolchain
+        run: |
+          . venv/bin/activate
+          python -c "from esphome.arduino8266.framework import check_and_install; from esphome.components.esp8266 import RECOMMENDED_ARDUINO_FRAMEWORK_VERSION; check_and_install(RECOMMENDED_ARDUINO_FRAMEWORK_VERSION)"
+
   ci-custom:
     name: Run script/ci-custom
     runs-on: ubuntu-24.04
@@ -214,15 +271,24 @@ jobs:
     runs-on: ubuntu-latest
     needs:
       - determine-jobs
-    if: github.event_name == 'pull_request' && !startsWith(github.base_ref, 'beta') && !startsWith(github.base_ref, 'release') && needs.determine-jobs.outputs.core-ci == 'true'
+    if: github.event_name == 'pull_request' && needs.determine-jobs.outputs.release-pr == 'false' && needs.determine-jobs.outputs.core-ci == 'true'
     steps:
       - name: Check out code from GitHub
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Read prek version from requirements_test.txt
+        id: prek
+        # requirements_test.txt is the only place the version is pinned, so a
+        # Dependabot bump there is picked up here without a second edit.
+        run: |
+          if ! version=$(sed -nE 's/^prek==([^[:space:]#]+).*/\1/p' requirements_test.txt) || [ -z "$version" ]; then
+            echo "::error::No prek== pin found in requirements_test.txt."
+            exit 1
+          fi
+          echo "version=$version" >> "$GITHUB_OUTPUT"
       - name: Run prek
         uses: j178/prek-action@4e14d07f9231acabce116ccfca13b13dd9755ece # v3.0.0
         with:
-          # Keep in sync with requirements_test.txt.
-          prek-version: "0.4.11"
+          prek-version: ${{ steps.prek.outputs.version }}
           # This job only runs on pull requests, so nothing ever populates
           # the cache on dev. Every run would miss and then write a per-pull
           # request copy, which is what the old seed-cache job existed to
@@ -286,7 +352,7 @@ jobs:
           . venv/bin/activate
           pytest -vv --cov-report=xml --tb=native --durations=30 -n auto tests --ignore=tests/integration/
       - name: Upload coverage to Codecov
-        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
+        uses: codecov/codecov-action@303a32d7a59b442fa8d48b6a1cc6825c09c847a5 # v7.1.1
       - name: Save Python virtual environment cache
         if: github.ref == 'refs/heads/dev'
         uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
@@ -315,7 +381,7 @@ jobs:
       - name: Check out code from GitHub
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Report empty upload to Codecov
-        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
+        uses: codecov/codecov-action@303a32d7a59b442fa8d48b6a1cc6825c09c847a5 # v7.1.1
         with:
           run_command: empty-upload
           force: true
@@ -323,7 +389,8 @@ jobs:
 
   integration-tests:
     name: Run integration tests (${{ matrix.bucket.name }})
-    runs-on: ubuntu-latest
+    # Must match seed-apt-cache's image: the apt cache key has no OS in it.
+    runs-on: ubuntu-24.04
     needs:
       - common
       - determine-jobs
@@ -332,32 +399,36 @@ jobs:
       fail-fast: false
       matrix:
         bucket: ${{ fromJson(needs.determine-jobs.outputs.integration-test-buckets) }}
+    env:
+      # Registry libraries (noise-c, libsodium, ArduinoJson, lvgl) the host builds
+      # download, shared per xdist worker by tests/integration/conftest.py
+      INTEGRATION_LIBRARY_CACHE_PATH: ~/.esphome-integration-tests/pio_components
     steps:
       - name: Check out code from GitHub
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - name: Install ccache
-        # Speeds up the host compiles: tests in a bucket compile overlapping
-        # component sets, so later tests reuse earlier tests' objects.
-        run: |
-          sudo apt-get update -qq
-          sudo apt-get install -y --no-install-recommends ccache
-      - name: Restore ccache (restore-only)
-        # esphome stores the PlatformIO ccache under the machine-global cache
-        # dir (see _ccache_env() in esphome/platformio/toolchain.py). The
-        # bucket-name prefix prefers a same-bucket seed; the bare prefix falls
-        # back to any seed when the bucket layout differs from dev.
-        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+      - name: Install apt packages (cached)
+        # ccache speeds up the host compiles. A cache hit never touches apt
+        # (mirror outages cannot hang the job); the timeout bounds the cold
+        # path. Packages and version must match seed-apt-cache exactly.
+        # libsdl2-dev is needed by the headless display tests, which capture
+        # screenshots.
+        timeout-minutes: 10
+        uses: awalsh128/cache-apt-pkgs-action@553a35bb8ebd9fcabcb1c9451aa4c98e1b4ca8a9 # v1.6.3
         with:
-          path: ~/.cache/esphome/platformio-ccache
-          key: integration-ccache-${{ matrix.bucket.name }}-${{ github.sha }}
-          restore-keys: |
-            integration-ccache-${{ matrix.bucket.name }}-
-            integration-ccache-
+          packages: libsdl2-dev ccache
+          version: 1.1
       - name: Set up Python 3.13
         id: python
         uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.13"
+      - name: Restore integration library cache
+        # A miss or a changed pin self-heals with a download, so no restore-keys
+        id: library-cache
+        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: ${{ env.INTEGRATION_LIBRARY_CACHE_PATH }}
+          key: integration-libraries-v1-${{ runner.os }}-${{ hashFiles('esphome/components/json/__init__.py', 'esphome/components/noise/__init__.py', 'esphome/components/lvgl/__init__.py', 'esphome/components/improv_base/__init__.py') }}
       - name: Restore Python virtual environment
         id: cache-venv
         uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
@@ -367,7 +438,7 @@ jobs:
       - name: Set up uv
         # Only needed on cache miss to populate the venv.
         if: steps.cache-venv.outputs.cache-hit != 'true'
-        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
+        uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
         with:
           enable-cache: true
           # Pull request saves land in per-PR scopes nothing else can
@@ -395,20 +466,46 @@ jobs:
         run: |
           . venv/bin/activate
           mapfile -t test_files < <(echo "$BUCKET_TESTS" | jq -r '.[]')
+          if [ "${#test_files[@]}" -eq 0 ]; then
+            echo "::error::Empty integration test bucket; pytest would collect the whole tree"
+            exit 1
+          fi
           echo "Bucket ${{ matrix.bucket.name }}: running ${#test_files[@]} integration tests"
-          pytest -vv --no-cov --tb=native --durations=30 -n auto "${test_files[@]}"
+          pytest -vv --no-cov --tb=native --durations=30 -n auto --dist worksteal \
+            --junitxml=junit-integration.xml "${test_files[@]}"
+      - name: Upload test artifacts
+        # Tests that compare rendered output write the image they actually got here, so a
+        # failure can be looked at without reproducing the whole build locally.
+        if: failure()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: integration-test-artifacts-${{ matrix.bucket.name }}
+          path: test_artifacts/
+          if-no-files-found: ignore
+          retention-days: 7
+      - name: Upload junit timings
+        # Consumed by sync-integration-durations.yml through
+        # script/update_integration_test_durations.py; only full matrix dev
+        # runs produce usable data.
+        if: github.ref == 'refs/heads/dev' && needs.determine-jobs.outputs.integration-run-all == 'true'
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: junit-integration-${{ strategy.job-index }}
+          path: junit-integration.xml
+          if-no-files-found: error
+          # A full cron period of margin for the weekly refresh
+          retention-days: 14
       - name: Print ccache statistics
-        # esphome stores the PlatformIO ccache under the machine-global cache
-        # dir (see _ccache_env() in esphome/platformio/toolchain.py).
-        run: CCACHE_DIR="$HOME/.cache/esphome/platformio-ccache" ccache -s
-      - name: Save ccache
-        # Pull request saves land in per-PR scopes nothing else can reuse;
-        # dev pushes seed the shared copy instead.
-        if: github.event_name != 'pull_request'
+        # esphome stores the host build's ccache under the machine-global
+        # cache dir (see get_build_env() in esphome/host/toolchain.py).
+        run: CCACHE_DIR="$HOME/.cache/esphome/host/ccache" ccache -s
+      - name: Save integration library cache
+        # Bucket 0 only; the others would race the same immutable key.
+        if: success() && (github.ref == 'refs/heads/dev' || contains(github.event.pull_request.labels.*.name, 'ci-cache-write')) && strategy.job-index == 0 && steps.library-cache.outputs.cache-hit != 'true'
         uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
-          path: ~/.cache/esphome/platformio-ccache
-          key: integration-ccache-${{ matrix.bucket.name }}-${{ github.sha }}
+          path: ${{ env.INTEGRATION_LIBRARY_CACHE_PATH }}
+          key: ${{ steps.library-cache.outputs.cache-primary-key }}
 
   import-time:
     name: Check import esphome.__main__ time
@@ -441,16 +538,28 @@ jobs:
   benchmarks:
     name: Run CodSpeed benchmarks
     runs-on: ubuntu-24.04
+    timeout-minutes: 30
     needs:
       - common
       - determine-jobs
     if: >-
       github.repository == 'esphome/esphome' && (
         (github.event_name == 'push' && github.ref_name == 'dev') ||
-        (github.event_name == 'pull_request' && needs.determine-jobs.outputs.benchmarks == 'true')
+        (
+          github.event_name == 'pull_request' &&
+          needs.determine-jobs.outputs.release-pr == 'false' &&
+          needs.determine-jobs.outputs.benchmarks == 'true'
+        )
       )
     # CodSpeed benchmarks require a CodSpeed account linked to the repository to run
     # (https://codspeed.io) -- disabled on forks that aren't esphome/esphome itself.
+    #
+    # Pull requests into beta and release are skipped as well. CodSpeed compares a
+    # pull request against the newest commit of its base branch that has a benchmark
+    # run of its own, and only dev is benchmarked. A release pull request therefore
+    # falls back to dev's latest run, so every speed-up merged into dev since the
+    # release branched is reported as a regression in the release. The changes there
+    # have already been benchmarked on their original dev pull requests.
     steps:
       - name: Check out code from GitHub
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -464,14 +573,60 @@ jobs:
       - name: Build benchmarks
         id: build
         run: |
+          # pipefail: without it a failed build is masked by the grep/cut
+          # pipeline below, leaving BINARY empty and silently dropping every
+          # C++ benchmark from the run while the job still reports success.
+          set -o pipefail
           . venv/bin/activate
-          export BENCHMARK_LIB_CONFIG=$(python script/setup_codspeed_lib.py)
-          # --build-only prints BUILD_BINARY=<path> to stdout
-          BINARY=$(script/cpp_benchmark.py --all --build-only | grep '^BUILD_BINARY=' | tail -1 | cut -d= -f2-)
+          BENCHMARK_LIB_CONFIG=$(python script/setup_codspeed_lib.py)
+          export BENCHMARK_LIB_CONFIG
+          # --build-only prints BUILD_BINARY=<path> to stdout; the grep is
+          # non-fatal so a missing marker reaches the check below instead of
+          # tripping errexit at this assignment
+          BINARY=$(script/cpp_benchmark.py --all --build-only | { grep '^BUILD_BINARY=' || true; } | tail -1 | cut -d= -f2-)
+          if [ -z "$BINARY" ]; then
+            echo "::error::Benchmark build did not report a binary path"
+            exit 1
+          fi
           echo "binary=$BINARY" >> $GITHUB_OUTPUT
 
+      - name: Bound apt fetches and pre-install libc6-dbg
+        # The CodSpeed runner installs valgrind + libc6-dbg via its own
+        # unbounded apt-get update; per-invocation apt options cannot reach
+        # it. The apt.conf.d timeouts below bound every later apt call in
+        # this job, the runner's included. Pre-installing libc6-dbg lets the
+        # runner skip apt once its valgrind cache is restored (it checks
+        # ``dpkg -s libc6-dbg``, so the cache action's unregistered restores
+        # would not count). Install without update first: image lists are
+        # fresh, and the index refresh is what a congested mirror makes
+        # slow. Best effort; the job timeout is the last backstop.
+        timeout-minutes: 15
+        continue-on-error: true
+        run: |
+          sudo tee /etc/apt/apt.conf.d/99ci-acquire-timeouts >/dev/null <<'EOF'
+          Acquire::Retries "1";
+          Acquire::http::Timeout "15";
+          Acquire::https::Timeout "15";
+          EOF
+          if dpkg -s libc6-dbg >/dev/null 2>&1; then
+            echo "libc6-dbg already installed"
+            exit 0
+          fi
+          # Common path: the image's package lists are fresh enough.
+          if sudo DEBIAN_FRONTEND=noninteractive timeout -k 15 90 \
+              apt-get install -y libc6-dbg; then
+            exit 0
+          fi
+          # Rescue path: refresh the lists once with a generous bound; the
+          # apt config already fails a stalled mirror over quickly.
+          sudo DEBIAN_FRONTEND=noninteractive timeout -k 10 30 \
+            dpkg --configure -a || true
+          sudo timeout -k 15 300 apt-get update
+          sudo DEBIAN_FRONTEND=noninteractive timeout -k 15 300 \
+            apt-get install -y libc6-dbg
+
       - name: Run CodSpeed benchmarks
-        uses: CodSpeedHQ/action@4296e51e7041e24dadb86d1d6e8b9320d223dbe8 # v5.0.3
+        uses: CodSpeedHQ/action@373d6868929f444bc08d901fd0eb0ad52a8875ea # v5.2.1
         with:
           run: |
             . venv/bin/activate
@@ -554,24 +709,29 @@ jobs:
           fetch-depth: 2
 
       - name: Restore Python
+        id: restore-python
         uses: ./.github/actions/restore-python
         with:
           python-version: ${{ env.DEFAULT_PYTHON }}
           cache-key: ${{ needs.common.outputs.cache-key }}
 
+      # Key on the exact Python version as well: LibreTiny creates a venv under
+      # ~/.platformio/penv whose interpreter is a symlink into the runner's
+      # hosted toolcache, so a cache saved on an older runner image breaks once
+      # a new image ships a newer patch release and drops the old interpreter.
       - name: Cache platformio
         if: github.ref == 'refs/heads/dev' && matrix.pio_cache_key
         uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: ~/.platformio
-          key: platformio-${{ matrix.pio_cache_key }}-${{ hashFiles('platformio.ini') }}
+          key: platformio-${{ matrix.pio_cache_key }}-${{ steps.restore-python.outputs.python-version }}-${{ hashFiles('platformio.ini') }}
 
       - name: Cache platformio
         if: github.ref != 'refs/heads/dev' && matrix.pio_cache_key
         uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: ~/.platformio
-          key: platformio-${{ matrix.pio_cache_key }}-${{ hashFiles('platformio.ini') }}
+          key: platformio-${{ matrix.pio_cache_key }}-${{ steps.restore-python.outputs.python-version }}-${{ hashFiles('platformio.ini') }}
 
       - name: Cache ESP-IDF install
         if: matrix.cache_idf
@@ -579,6 +739,12 @@ jobs:
         with:
           framework: arduino
 
+      - name: Cache clang-tidy idedata
+        if: matrix.cache_idf
+        uses: ./.github/actions/cache-clang-tidy-idedata
+        with:
+          environment: esp32-arduino-tidy
+
       - name: Cache nRF Connect SDK install
         if: matrix.cache_sdk_nrf
         uses: ./.github/actions/cache-sdk-nrf
@@ -628,6 +794,10 @@ jobs:
           # Also cache libdeps, store them in a ~/.platformio subfolder
           PLATFORMIO_LIBDEPS_DIR: ~/.platformio/libdeps
 
+      - name: Prune ESP-IDF install before cache save
+        if: matrix.cache_idf && (github.ref == 'refs/heads/dev' || contains(github.event.pull_request.labels.*.name, 'ci-cache-write'))
+        uses: ./.github/actions/prune-esp-idf
+
       - name: Suggested changes
         run: script/ci-suggest-changes ${{ matrix.ignore_errors && '|| true' || '' }}
         # yamllint disable-line rule:line-length
@@ -660,6 +830,11 @@ jobs:
       - name: Cache ESP-IDF install
         uses: ./.github/actions/cache-esp-idf
 
+      - name: Cache clang-tidy idedata
+        uses: ./.github/actions/cache-clang-tidy-idedata
+        with:
+          environment: esp32-idf-tidy
+
       - name: Register problem matchers
         run: |
           echo "::add-matcher::.github/workflows/matchers/gcc.json"
@@ -694,6 +869,10 @@ jobs:
           # Also cache libdeps, store them in a ~/.platformio subfolder
           PLATFORMIO_LIBDEPS_DIR: ~/.platformio/libdeps
 
+      - name: Prune ESP-IDF install before cache save
+        if: (github.ref == 'refs/heads/dev' || contains(github.event.pull_request.labels.*.name, 'ci-cache-write'))
+        uses: ./.github/actions/prune-esp-idf
+
       - name: Suggested changes
         run: script/ci-suggest-changes
         if: always()
@@ -739,6 +918,11 @@ jobs:
       - name: Cache ESP-IDF install
         uses: ./.github/actions/cache-esp-idf
 
+      - name: Cache clang-tidy idedata
+        uses: ./.github/actions/cache-clang-tidy-idedata
+        with:
+          environment: esp32-idf-tidy
+
       - name: Register problem matchers
         run: |
           echo "::add-matcher::.github/workflows/matchers/gcc.json"
@@ -773,6 +957,10 @@ jobs:
           # Also cache libdeps, store them in a ~/.platformio subfolder
           PLATFORMIO_LIBDEPS_DIR: ~/.platformio/libdeps
 
+      - name: Prune ESP-IDF install before cache save
+        if: (github.ref == 'refs/heads/dev' || contains(github.event.pull_request.labels.*.name, 'ci-cache-write'))
+        uses: ./.github/actions/prune-esp-idf
+
       - name: Suggested changes
         run: script/ci-suggest-changes
         if: always()
@@ -796,16 +984,19 @@ jobs:
             name: Run script/clang-tidy for ESP32 S3
             # yamllint disable-line rule:line-length
             options: --environment esp32s3-idf-tidy --grep SOC_TEMP_SENSOR_SUPPORTED --grep USE_ESP32_VARIANT_ESP32S3 --grep USE_LOGGER_USB_CDC
+            tidy_environment: esp32s3-idf-tidy
           - id: clang-tidy
             name: Run script/clang-tidy for ESP32 P4
             # P4 has no native Wi-Fi/BLE; those run over the hosted co-processor,
             # so their code paths differ -- lint them under the P4 build too.
             # yamllint disable-line rule:line-length
             options: --environment esp32p4-idf-tidy --grep USE_ESP32_VARIANT_ESP32P4 --grep USE_ESP32_HOSTED --grep USE_WIFI --grep USE_BLE
+            tidy_environment: esp32p4-idf-tidy
           - id: clang-tidy
             name: Run script/clang-tidy for ESP32 C6
             # yamllint disable-line rule:line-length
             options: --environment esp32c6-idf-tidy --grep SOC_LP_I2C_SUPPORTED --grep USE_ESP32_VARIANT_ESP32C6 --grep USE_OPENTHREAD --grep USE_ZIGBEE
+            tidy_environment: esp32c6-idf-tidy
 
     steps:
       - name: Check out code from GitHub
@@ -823,6 +1014,11 @@ jobs:
       - name: Cache ESP-IDF install
         uses: ./.github/actions/cache-esp-idf
 
+      - name: Cache clang-tidy idedata
+        uses: ./.github/actions/cache-clang-tidy-idedata
+        with:
+          environment: ${{ matrix.tidy_environment }}
+
       - name: Register problem matchers
         run: |
           echo "::add-matcher::.github/workflows/matchers/gcc.json"
@@ -856,6 +1052,10 @@ jobs:
             script/clang-tidy --fix --changed ${{ matrix.options }}
           fi
 
+      - name: Prune ESP-IDF install before cache save
+        if: (github.ref == 'refs/heads/dev' || contains(github.event.pull_request.labels.*.name, 'ci-cache-write'))
+        uses: ./.github/actions/prune-esp-idf
+
       - name: Suggested changes
         run: script/ci-suggest-changes
         if: always()
@@ -876,7 +1076,6 @@ jobs:
       ESPHOME_SDK_NRF_PREFIX: ~/.esphome-sdk-nrf
     strategy:
       fail-fast: false
-      max-parallel: ${{ (startsWith(github.base_ref, 'beta') || startsWith(github.base_ref, 'release')) && 32 || 16 }}
       matrix:
         batch: ${{ fromJson(needs.determine-jobs.outputs.component-test-batches) }}
     steps:
@@ -888,12 +1087,17 @@ jobs:
       - name: List components
         run: echo ${{ matrix.batch.components }}
 
-      - name: Install apt packages
-        # Not cached: this job is pull-request-only, so a cache save could
-        # never be shared and would only consume quota.
-        run: |
-          sudo apt-get update -qq
-          sudo apt-get install -y --no-install-recommends libsdl2-dev ccache
+      - name: Install apt packages (cached)
+        # A cache hit (seeded on dev by seed-apt-cache) never touches apt,
+        # so mirror outages cannot hang this PR-only job; the timeout bounds
+        # the cold path. Packages and version must match seed-apt-cache
+        # exactly. The action has no --no-install-recommends; same package
+        # set this job used before #17463.
+        timeout-minutes: 10
+        uses: awalsh128/cache-apt-pkgs-action@553a35bb8ebd9fcabcb1c9451aa4c98e1b4ca8a9 # v1.6.3
+        with:
+          packages: libsdl2-dev ccache
+          version: 1.1
 
       - name: Check out code from GitHub
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -918,6 +1122,11 @@ jobs:
         uses: ./.github/actions/cache-sdk-nrf
         with:
           restore-only: true
+      - name: Cache the native ESP8266 toolchain
+        # Only batches whose test platforms include esp8266; never saves
+        # here, it reuses the install the dev seed job cached.
+        if: matrix.batch.needs_arduino8266
+        uses: ./.github/actions/cache-arduino8266
       - name: Validate and compile components with intelligent grouping
         run: |
           . venv/bin/activate
@@ -958,7 +1167,7 @@ jobs:
           # - This catches pin conflicts and other issues in directly changed code
           # - Grouped tests use --testing-mode to allow config merging (disables some checks)
           # - Dependencies are safe to group since they weren't modified in this PR
-          if [[ "${{ github.base_ref }}" == beta* ]] || [[ "${{ github.base_ref }}" == release* ]]; then
+          if [[ "${{ needs.determine-jobs.outputs.release-pr }}" == "true" ]]; then
             directly_changed_csv=""
             echo "Testing components: $components_csv"
             echo "Target branch: ${{ github.base_ref }} - grouping all components"
@@ -1017,8 +1226,20 @@ jobs:
           if [ -n "$compile_csv" ]; then
             # Run compilation with grouping and isolation
             python3 script/test_build_components.py -e compile -c "$compile_csv" -f --isolate "$directly_changed_csv"
+            if [[ "${{ matrix.batch.check_idf_py }}" == "true" ]]; then
+              # The real idf.py must find nothing to configure or build in a
+              # tree built above; catches drift on ESP-IDF bumps.
+              echo "Checking the native ESP-IDF build matches idf.py"
+              python3 script/check_idf_py_equivalence.py --require-cached-bootloader
+            fi
           else
             echo "All components in this batch are validate-only -- skipping compile stage."
+            if [[ "${{ matrix.batch.check_idf_py }}" == "true" ]]; then
+              # determine-jobs and this step disagree on what compiles; fail
+              # rather than let the check run nowhere.
+              echo "::error::This batch was picked for the idf.py check but compiled nothing"
+              exit 1
+            fi
           fi
 
       - name: Print ccache statistics
@@ -1058,7 +1279,7 @@ jobs:
 
           # compile validates config first, so a separate config pass is
           # redundant for this smoke test. ESP-IDF framework via PlatformIO:
-          python3 script/test_build_components.py -e compile -t esp32-idf -c "$TEST_COMPONENTS" -f --toolchain platformio
+          python3 script/test_build_components.py -e compile -t esp32-idf -c "$TEST_COMPONENTS" -f --toolchain platformio --fail-on-no-tests
 
           echo ""
           echo "ESP-IDF-via-PlatformIO build passed! Starting Arduino smoke test..."
@@ -1067,6 +1288,40 @@ jobs:
           # Arduino framework via PlatformIO (only components with an esp32-ard test are built):
           python3 script/test_build_components.py -e compile -t esp32-ard -c "$TEST_COMPONENTS" -f --toolchain platformio
 
+  test-esp8266-native:
+    name: Test esp8266 components with the native toolchain
+    runs-on: ubuntu-24.04
+    needs:
+      - common
+      - determine-jobs
+    if: github.event_name == 'pull_request' && needs.determine-jobs.outputs.esp8266-native == 'true'
+    env:
+      # Computed by script/determine-jobs.py (ESP8266_NATIVE_TEST_COMPONENTS)
+      TEST_COMPONENTS: ${{ needs.determine-jobs.outputs.esp8266-native-components }}
+    steps:
+      - name: Check out code from GitHub
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Restore Python
+        uses: ./.github/actions/restore-python
+        with:
+          python-version: ${{ env.DEFAULT_PYTHON }}
+          cache-key: ${{ needs.common.outputs.cache-key }}
+
+      - name: Cache the native toolchain
+        uses: ./.github/actions/cache-arduino8266
+
+      - name: Run native toolchain compile test
+        run: |
+          . venv/bin/activate
+
+          echo "Testing components: $TEST_COMPONENTS"
+          echo ""
+
+          # ESP8266 Arduino built directly (no PlatformIO); compile validates
+          # config first, so a separate config pass is redundant.
+          python3 script/test_build_components.py -e compile -t esp8266-ard -c "$TEST_COMPONENTS" -f --toolchain arduino --fail-on-no-tests
+
   device-builder:
     name: Test downstream esphome/device-builder
     runs-on: ubuntu-24.04
@@ -1095,7 +1350,7 @@ jobs:
         # install step (order-of-magnitude faster on cold boots,
         # with its own wheel cache). actions/setup-python still
         # provides the interpreter.
-        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
+        uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
         with:
           enable-cache: true
           # Pull request saves land in per-PR scopes nothing else can
@@ -1236,12 +1491,9 @@ jobs:
           python-version: ${{ env.DEFAULT_PYTHON }}
           cache-key: ${{ needs.common.outputs.cache-key }}
 
-      - name: Cache platformio
-        if: steps.check-script.outputs.skip != 'true' && steps.check-tests.outputs.skip != 'true' && steps.cache-memory-analysis.outputs.cache-hit != 'true'
-        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
-        with:
-          path: ~/.platformio
-          key: platformio-memory-${{ fromJSON(needs.determine-jobs.outputs.memory_impact).platform }}-${{ hashFiles('platformio.ini') }}
+      - name: Cache the native ESP8266 toolchain
+        if: steps.check-script.outputs.skip != 'true' && steps.check-tests.outputs.skip != 'true' && steps.cache-memory-analysis.outputs.cache-hit != 'true' && fromJSON(needs.determine-jobs.outputs.memory_impact).needs_arduino8266
+        uses: ./.github/actions/cache-arduino8266
 
       - name: Build, compile, and analyze memory
         if: steps.check-script.outputs.skip != 'true' && steps.check-tests.outputs.skip != 'true' && steps.cache-memory-analysis.outputs.cache-hit != 'true'
@@ -1326,11 +1578,9 @@ jobs:
         with:
           python-version: ${{ env.DEFAULT_PYTHON }}
           cache-key: ${{ needs.common.outputs.cache-key }}
-      - name: Cache platformio
-        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
-        with:
-          path: ~/.platformio
-          key: platformio-memory-${{ fromJSON(needs.determine-jobs.outputs.memory_impact).platform }}-${{ hashFiles('platformio.ini') }}
+      - name: Cache the native ESP8266 toolchain
+        if: fromJSON(needs.determine-jobs.outputs.memory_impact).needs_arduino8266
+        uses: ./.github/actions/cache-arduino8266
       - name: Build, compile, and analyze memory
         id: extract
         run: |
@@ -1428,6 +1678,8 @@ jobs:
     # this check.
     needs:
       - common
+      - seed-apt-cache
+      - seed-esp8266-native-cache
       - determine-jobs
       - ci-custom
       - pylint
@@ -1443,6 +1695,7 @@ jobs:
       - clang-tidy-esp32-variants
       - test-build-components-split
       - test-esp32-platformio
+      - test-esp8266-native
       - device-builder
       - memory-impact-target-branch
       - memory-impact-pr-branch

.github/workflows/codeql.yml

@@ -56,7 +56,7 @@ jobs:
 
       # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7
+        uses: github/codeql-action/init@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
         with:
           languages: ${{ matrix.language }}
           build-mode: ${{ matrix.build-mode }}
@@ -84,6 +84,6 @@ jobs:
           exit 1
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7
+        uses: github/codeql-action/analyze@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
         with:
           category: "/language:${{matrix.language}}"

.github/workflows/lock.yml

@@ -14,4 +14,4 @@ jobs:
     permissions:
       issues: write         # issues.lock on closed issues
       pull-requests: write  # issues.lock on closed pull requests
-    uses: esphome/workflows/.github/workflows/lock.yml@0fdd5e311b7e744069166696072a1a9cbc5fbeb6  # 2026.8.1
+    uses: esphome/workflows/.github/workflows/lock.yml@cc3e76de337dc59bc1cba8da58d963cd23b873f1  # 2026.9.0

.github/workflows/release.yml

@@ -123,7 +123,7 @@ jobs:
           python-version: "3.12"
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
+        uses: docker/setup-buildx-action@594f3bf4285d9ea8dc53c9a0c9c4092420091003 # v4.4.0
 
       - name: Log in to docker hub
         uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
@@ -202,7 +202,7 @@ jobs:
           merge-multiple: true
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
+        uses: docker/setup-buildx-action@594f3bf4285d9ea8dc53c9a0c9c4092420091003 # v4.4.0
 
       - name: Log in to docker hub
         if: matrix.registry == 'dockerhub'

.github/workflows/stale.yml

@@ -16,7 +16,7 @@ jobs:
     # No GITHUB_TOKEN permissions: the reusable workflow mints an ESPHome
     # GitHub App token so the labels, comments and closures come from
     # esphome[bot] instead of github-actions[bot].
-    uses: esphome/workflows/.github/workflows/stale.yml@a1c1485ab46ef41a84a6a9d8abd7fa4b7628fd70  # main
+    uses: esphome/workflows/.github/workflows/stale.yml@cc3e76de337dc59bc1cba8da58d963cd23b873f1  # main
     secrets:
       ESPHOME_GITHUB_APP_PRIVATE_KEY: ${{ secrets.ESPHOME_GITHUB_APP_PRIVATE_KEY }}
     with:
@@ -33,7 +33,7 @@ jobs:
         and will be closed if no further activity occurs within 7 days.
 
         If you are the author of this PR, please leave a comment if you want
-        to keep it open. Also, please rebase your PR onto the latest dev
+        to keep it open. Also, please merge the latest dev branch into your
         branch to ensure that it's up to date with the latest changes.
 
         Thank you for your contribution!

.github/workflows/sync-dependency-versions.yml

@@ -0,0 +1,94 @@
+# Keeps pre-commit hook revs in sync with the requirements files.
+#
+# Dependabot only bumps the pins in requirements*.txt. Some of those tools
+# are pinned again as hook revs in .pre-commit-config.yaml. This workflow
+# runs script/sync_dependency_versions.py against the pull request branch
+# and pushes a commit with the revs updated.
+
+name: Sync dependency versions
+
+on:
+  # pull_request_target rather than pull_request so the App secret is
+  # available on Dependabot pull requests (pull_request runs opened by
+  # Dependabot only see Dependabot secrets). The job below only touches
+  # branches in this repository and only ever executes the script from the
+  # base branch checkout, so fork code never runs with the token.
+  pull_request_target:
+    types: [opened, synchronize, reopened]
+    paths:
+      - requirements_dev.txt
+      - requirements_test.txt
+      - .pre-commit-config.yaml
+      - script/sync_dependency_versions.py
+
+# The push to the pull request branch uses the App token minted below, so
+# the workflow's GITHUB_TOKEN does not need any scopes.
+permissions: {}
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
+jobs:
+  sync:
+    name: Sync pinned versions
+    runs-on: ubuntu-latest
+    # Same-repository branches only: a push to a fork is not possible with
+    # this token, and it keeps untrusted heads out of a privileged job.
+    if: >-
+      github.repository == 'esphome/esphome'
+      && github.event.pull_request.head.repo.full_name == github.repository
+    steps:
+      - name: Generate a token
+        id: generate-token
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        with:
+          client-id: ${{ vars.ESPHOME_GITHUB_APP_CLIENT_ID }}
+          private-key: ${{ secrets.ESPHOME_GITHUB_APP_PRIVATE_KEY }}
+          # A push made with the workflow's own GITHUB_TOKEN would not start
+          # CI on the new commit; a push with the App token does.
+          permission-contents: write  # git push of the sync commit to the pull request branch
+
+      - name: Check out base branch
+        # Provides the script that runs below. Deliberately the base branch
+        # so the pull request cannot change what executes here.
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ github.event.pull_request.base.sha }}
+          persist-credentials: false
+
+      - name: Check out pull request branch
+        # No allow-unsafe-pr-checkout here on purpose: checkout v7 only
+        # refuses heads that live in a different repository, and the job
+        # condition above already limits runs to same-repository branches.
+        # Leaving it off keeps that refusal as a backstop for fork heads.
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ github.event.pull_request.head.ref }}
+          path: pull-request
+          token: ${{ steps.generate-token.outputs.token }}
+
+      - name: Set up Python
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: "3.12"
+
+      - name: Install yamlrocks
+        # The script edits YAML through yamlrocks. Take the pin from the
+        # base branch requirements so this workflow has no copy of its own.
+        run: pip install "$(grep -E '^yamlrocks==' requirements_test.txt | cut -d'#' -f1)"
+
+      - name: Sync pinned versions
+        run: python script/sync_dependency_versions.py --root pull-request
+
+      - name: Push changes
+        working-directory: pull-request
+        run: |
+          if git diff --quiet; then
+            echo "All pinned versions already match the requirements files."
+            exit 0
+          fi
+          git config user.name "esphome[bot]"
+          git config user.email "115708604+esphome[bot]@users.noreply.github.com"
+          git commit -am "Sync pinned tool versions with requirements files"
+          git push

.github/workflows/sync-device-classes.yml

@@ -47,7 +47,7 @@ jobs:
         # setup-python interpreter so subsequent ``prek`` /
         # ``script/run-in-env.py`` steps find the deps without a
         # ``uv run`` prefix.
-        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
+        uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
         with:
           enable-cache: true
           # Pin uv version so the action does not have to fetch the

.github/workflows/sync-integration-durations.yml

@@ -0,0 +1,98 @@
+---
+name: Refresh integration test durations
+
+on:
+  workflow_dispatch:
+  schedule:
+    - cron: "45 5 * * 1"
+
+# Repo writes (branch push, PR open) happen via the App token minted below,
+# so the workflow's GITHUB_TOKEN does not need any write scopes.
+permissions:
+  contents: read
+  actions: read  # gh api / gh run download for the CI junit artifacts
+
+jobs:
+  sync:
+    name: Refresh integration test durations
+    runs-on: ubuntu-latest
+    if: github.repository == 'esphome/esphome'
+    steps:
+      - name: Generate a token
+        id: generate-token
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        with:
+          client-id: ${{ vars.ESPHOME_GITHUB_APP_CLIENT_ID }}
+          private-key: ${{ secrets.ESPHOME_GITHUB_APP_PRIVATE_KEY }}
+          permission-contents: write       # push the sync branch
+          permission-pull-requests: write  # open or refresh the sync PR
+
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Setup Python
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: "3.13"
+
+      - name: Refresh from the newest usable dev run
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          # Only full matrix dev runs upload junit-integration-* artifacts
+          # (see the integration-tests job); the merge script re-checks
+          # coverage regardless.
+          # Newest-first candidates via their bucket-0 artifact. Fork PRs run
+          # their own ci.yml, so name and branch are spoofable; require
+          # same-repo. Assignment failures trip set -e and fail loudly.
+          candidates=$(
+            gh api "repos/${GITHUB_REPOSITORY}/actions/artifacts?name=junit-integration-0&per_page=100" \
+              --jq '.artifacts[] | select(.expired | not) | .workflow_run
+                    | select(.head_branch == "dev" and .head_repository_id != null
+                             and .head_repository_id == .repository_id)
+                    | .id'
+          )
+          # Green runs first, then the rest newest first; a run missing a
+          # bucket fails the coverage check and the next one is tried
+          green=""
+          rest=""
+          for id in ${candidates}; do
+            conclusion=$(gh api "repos/${GITHUB_REPOSITORY}/actions/runs/${id}" --jq '.conclusion // ""')
+            if [ "${conclusion}" = "success" ]; then
+              green="${green} ${id}"
+            elif [ -n "${conclusion}" ]; then
+              rest="${rest} ${id}"
+            fi
+          done
+          # helpers.py imports colorama; the script needs nothing else
+          pip install colorama
+          for id in ${green} ${rest}; do
+            rm -rf /tmp/junit
+            if ! gh run download "${id}" --repo "${GITHUB_REPOSITORY}" -p "junit-integration-*" -D /tmp/junit; then
+              echo "::warning::Could not download artifacts for run ${id}; trying the next"
+              continue
+            fi
+            status=0
+            python script/update_integration_test_durations.py /tmp/junit || status=$?
+            if [ "${status}" -eq 0 ]; then
+              echo "Refreshed from run ${id}"
+              exit 0
+            fi
+            # Only EXIT_LOW_COVERAGE (3) from the script advances to the next run
+            [ "${status}" -eq 3 ] || exit 1
+            echo "::warning::Run ${id} covers too few test files; trying the next"
+          done
+          echo "::error::No dev CI run with usable junit artifacts in range; the feed is starved"
+          exit 1
+
+      - name: Commit changes
+        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
+        with:
+          commit-message: "[ci] Refresh integration test durations"
+          committer: esphome[bot] <115708604+esphome[bot]@users.noreply.github.com>
+          author: esphome[bot] <115708604+esphome[bot]@users.noreply.github.com>
+          branch: sync/integration-durations
+          delete-branch: true
+          title: "[ci] Refresh integration test durations"
+          body-path: .github/PULL_REQUEST_TEMPLATE.md
+          token: ${{ steps.generate-token.outputs.token }}

.gitignore

@@ -137,6 +137,8 @@ config/
 !tests/component_tests/**/config/
 tests/build/
 tests/.esphome/
+# Output kept by failing tests for inspection; uploaded by CI
+test_artifacts/
 /.temp-clang-tidy.cpp
 /.temp/
 .pio/

.pre-commit-config.yaml

@@ -1,7 +1,6 @@
 ---
 # See https://pre-commit.com for more information
 # See https://pre-commit.com/hooks.html for more hooks
-
 ci:
   autoupdate_commit_msg: 'pre-commit: autoupdate'
   autoupdate_schedule: off  # Disabled until ruff versions are synced between deps and pre-commit
@@ -11,7 +10,7 @@ ci:
 repos:
   - repo: https://github.com/astral-sh/ruff-pre-commit
     # Ruff version.
-    rev: v0.16.3
+    rev: v0.16.9
     hooks:
       # Run the linter.
       - id: ruff
@@ -19,7 +18,7 @@ repos:
       # Run the formatter.
       - id: ruff-format
   - repo: https://github.com/PyCQA/flake8
-    rev: 7.3.0
+    rev: 7.4.1
     hooks:
       - id: flake8
         additional_dependencies:
@@ -42,7 +41,7 @@ repos:
       - id: pyupgrade
         args: [--py312-plus]
   - repo: https://github.com/adrienverge/yamllint.git
-    rev: v1.37.1
+    rev: v1.38.0
     hooks:
       - id: yamllint
         exclude: ^(\.clang-format|\.clang-tidy)$

AGENTS.md

@@ -44,6 +44,16 @@ This document provides essential context for AI models interacting with this pro
 
 ## 4. Coding Conventions & Style Guide
 
+**Read the developer documentation before writing a component.** https://developers.esphome.io covers the
+component lifecycle, the main loop, and the reasoning behind the rules below in far more depth than this
+file does, and it is the authority when they disagree. The most useful starting points:
+
+*   https://developers.esphome.io/architecture/components/ - component lifecycle, `setup()`, `loop()`,
+    setup priorities, and how a component is registered.
+*   https://developers.esphome.io/architecture/components/advanced/ - choosing between `loop()`,
+    `set_interval`, `set_timeout` and `defer`; waking the loop from another thread; the RAM cost of each.
+*   https://developers.esphome.io/contributing/code/ - contribution rules, public API and breaking changes.
+
 *   **Formatting:**
     *   **Python:** Uses `ruff` and `flake8` for linting and formatting. Configuration is in `pyproject.toml`.
     *   **C++:** Uses `clang-format` for formatting. Configuration is in `.clang-format`.
@@ -142,6 +152,47 @@ This document provides essential context for AI models interacting with this pro
     *   **Indentation:** Use spaces (two per indentation level), not tabs
     *   **Type aliases:** Prefer `using type_t = int;` over `typedef int type_t;`
     *   **Line length:** Wrap lines at no more than 120 characters
+    *   **Timing in `loop()`:** Never call `millis()` in a `loop()` body. The current tick's timestamp is
+        already cached - use `App.get_loop_component_start_time()` (from `esphome/core/application.h`).
+        Only reach for `millis()` when you genuinely need sub-tick resolution inside a long operation.
+    *   **The main loop runs every 16 ms.** A rate-limit gate shorter than that does nothing: the check
+        passes on essentially every pass of the loop, so it costs a comparison and buys nothing. Pick an
+        interval comfortably coarser than 16 ms, or drop the gate entirely and accept running every loop.
+        ```cpp
+        // Bad - a 10ms gate against a 16ms loop never holds anything back
+        static constexpr uint32_t POLL_INTERVAL_MS = 10;
+        const uint32_t now = millis();
+        if (now - this->last_poll_ < POLL_INTERVAL_MS)
+          return;
+        this->last_poll_ = now;
+        ```
+        ```cpp
+        // Good - an interval that actually rate limits, off the cached timestamp
+        static constexpr uint32_t POLL_INTERVAL_MS = 100;
+        const uint32_t now = App.get_loop_component_start_time();
+        if (now - this->last_poll_ < POLL_INTERVAL_MS)
+          return;
+        this->last_poll_ = now;
+        ```
+        Pick the primitive by cadence: under 250 ms use a gated `loop()`; 500 ms and above use
+        `set_interval`. Full reasoning, including why `set_interval` costs more below 500 ms:
+        https://developers.esphome.io/architecture/components/advanced/#quick-rule-of-thumb
+    *   **Don't override a default with the same value:** if a base class method already returns what you
+        want, do not override it. `Component::get_setup_priority()` returns `setup_priority::DATA`, so a
+        component that wants `DATA` should simply leave it alone.
+        ```cpp
+        // Bad - this is exactly what the base class already does
+        float get_setup_priority() const override { return setup_priority::DATA; }
+        ```
+    *   **Logging string literals:** wrap literals passed as `%s` arguments in `LOG_STR_LITERAL()` so they
+        can be stored in flash rather than RAM.
+        ```cpp
+        // Bad
+        ESP_LOGV(TAG, "Key %u %s", key, pressed ? "pressed" : "released");
+
+        // Good
+        ESP_LOGV(TAG, "Key %u %s", key, pressed ? LOG_STR_LITERAL("pressed") : LOG_STR_LITERAL("released"));
+        ```
     *   **Constructor parameters vs setters:** Component properties that are both **required** and **invariant**
         (never change after construction) should be constructor parameters rather than set via setter methods.
         This makes the dependency explicit and prevents use of the object in an incompletely-initialized state.
@@ -271,6 +322,25 @@ This document provides essential context for AI models interacting with this pro
               var = await switch.new_switch(config)
           ```
 
+        - **Optional child entities of a hub:** bind the config once with `sensor.sub_sensors(config)` (or
+          `sub_binary_sensors`, `sub_text_sensors`, `sub_buttons`, `sub_switches`, `sub_numbers`,
+          `sub_selects` in their domains), adding `parent=hub` for entities that derive from `Parented<T>`,
+          then make one call per key, even when there is only one. A call creates the entity only when its key
+          is configured, passes it to the setter and returns it (or `None`); extra arguments such as
+          `min_value` or `options` go on the call. Always name the setter explicitly on the object that owns
+          it, never with `getattr` and an f-string, and keep that variable short (`var` for the component
+          itself, `hub` for one fetched with `cg.get_variable`) so the calls fit on one line. Loops whose
+          setter also takes an index, such as `set_gate_threshold(x, n)`, stay as they are.
+          ```python
+          async def to_code(config):
+              var = cg.new_Pvariable(config[CONF_ID])
+              sensors = sensor.sub_sensors(config)
+              await sensors(CONF_TEMPERATURE, var.set_temperature_sensor)
+              await sensors(CONF_HUMIDITY, var.set_humidity_sensor)
+              buttons = button.sub_buttons(config, parent=var)
+              await buttons(CONF_RESTART, var.set_restart_button)
+          ```
+
 *   **Automations (Triggers, Actions, Conditions):**
 
     Automations have three building blocks: **Triggers** (fire when something happens), **Actions** (do something), and **Conditions** (check if something is true).
@@ -380,7 +450,31 @@ This document provides essential context for AI models interacting with this pro
           MyComponent *parent_;
         };
         ```
-        Register with `@automation.register_action("my_component.do_something", MyAction, schema, synchronous=True)`. Use `synchronous=True` for actions that run to completion inside `play()` without deferring. Use `synchronous=False` if the action may suspend/defer execution (e.g. `delay`, `wait_until`, `script.wait`) or store trigger arguments for later use.
+        Register it without writing a builder:
+        ```python
+        automation.register_simple_action(
+            "my_component.do_something", MyAction, schema, synchronous=True
+        )
+        ```
+        The constructor receives the object named by `config[CONF_ID]`. Use `register_bare_action` for a
+        no-argument constructor, `register_parented_action` for a class deriving from `Parented<T>`, and
+        the `@automation.register_action(...)` decorator only when the builder must also set fields.
+
+        Use `synchronous=True` for actions that run to completion inside `play()` without deferring. Use `synchronous=False` if the action may suspend/defer execution (e.g. `delay`, `wait_until`, `script.wait`) or store trigger arguments for later use.
+
+        **Actions that only forward templatable values to their parent need no C++ class.** Register them
+        with `register_apply_action`; do not write a `TEMPLATABLE_VALUE` class or a builder for this shape.
+        ```python
+        automation.register_apply_action(
+            "my_component.set_gains",
+            schema,
+            automation.ApplyField(CONF_KP, "set_kp", cg.float_),
+            automation.ApplyField(CONF_KI, "set_ki", cg.float_),
+        )
+        ```
+        The `ApplyField`, `ApplyCall` and `register_apply_action` docstrings in `esphome/automation.py` cover
+        the rest; `cover.control` and `cover.template.publish` are in-tree examples. `TEMPLATABLE_VALUE` with
+        `cg.templatable` stays for actions whose `play()` has real logic beyond forwarding values.
 
     *   **Conditions:**
         ```cpp
@@ -392,7 +486,21 @@ This document provides essential context for AI models interacting with this pro
           MyComponent *parent_;
         };
         ```
-        Register with `@automation.register_condition("my_component.is_active", MyCondition, schema)`.
+        Register with `automation.register_simple_condition("my_component.is_active", MyCondition, schema)`;
+        `register_bare_condition`, `register_parented_condition` and the decorator follow the action rules.
+
+        **Conditions that only test their parent need no C++ class either.** Register them with
+        `register_apply_condition`; the expression is applied to the parent, and an `ApplyCall` compares
+        against config values.
+        ```python
+        automation.register_apply_condition("my_component.is_active", schema, "is_active()")
+        automation.register_apply_condition(
+            "my_component.state_is",
+            schema,
+            automation.ApplyCall("state == {}", ((CONF_STATE, cg.bool_),)),
+        )
+        ```
+        `cover.is_open`, `rtttl.is_playing` and `component.is_idle` are in-tree examples.
 
 *   **Type Hints:** Type-hint all function signatures, including test functions and config validators (e.g. `def validate_x(config: ConfigType) -> ConfigType:`, `def test_x() -> None:`). Import `ConfigType` from `esphome.types`.
 
@@ -502,6 +610,7 @@ This document provides essential context for AI models interacting with this pro
     4.  **Lint:** Run `prek` to ensure code is compliant.
     5.  **Commit:** Commit your changes. There is no strict format for commit messages.
     6.  **Pull Request:** Submit a PR against the `dev` branch. The Pull Request title must start with a `[tag]` prefix. For component work, use the component name (e.g., `[display] Fix bug`, `[abc123] Add new component`); for changes to shared/core code that isn't tied to a single component, use `[core]` (e.g., `[core] Add validator`). Update documentation, examples, and add `CODEOWNERS` entries as needed. Pull requests should always be made using the `.github/PULL_REQUEST_TEMPLATE.md` template - fill out all sections completely without removing any parts of the template.
+    7.  **Comments:** When commenting on GitHub PRs or issues, don't tag contributors, especially bots. Avoid referring to list items (e.g. from reviews) with the form #nn - this will be interpreted by GitHub as a reference to issue or PR nn. Keep comments short and exclude irrelevant details, backstories, restatement of previous comments and anything that is already obvious to the reader.
 
 *   **Documentation Contributions:**
     *   Documentation is hosted in the separate `esphome/esphome.io` repository.
@@ -562,6 +671,36 @@ This document provides essential context for AI models interacting with this pro
            Use `cg.add_define("MAX_SERVICES", count)` to set the size from Python configuration.
            Like `std::array` but with vector-like API (`push_back()`, `size()`) and no STL reallocation code.
 
+           **Listener and child-entity registration lists are the most common case, and the most commonly
+           missed.** A `register_*()` method called once per child at code generation time has a count that
+           is known at compile time, so it should never be a `std::vector`. Use `cg.slot_counter()`: it
+           returns a function that each consumer calls once per slot it will occupy, and after every
+           `to_code` has run it emits the define with the final count. When nothing registers, no define is
+           emitted and the storage plus its registration method compile out entirely.
+           ```python
+           # hub component's __init__.py
+           _request_listener_slot = cg.slot_counter("MY_COMPONENT_LISTENER_COUNT")
+
+
+           async def register_listener(hub: MockObj, var: MockObj) -> None:
+               _request_listener_slot()
+               cg.add(hub.register_listener(var))
+           ```
+           When several instances each own a list declared at the same size (one per hub of a
+           `MULTI_CONF` component), pass the owning object as the key, `_request_listener_slot(str(hub))`;
+           the define is then the largest count any one key requested instead of the total.
+           ```cpp
+           #ifdef MY_COMPONENT_LISTENER_COUNT
+             void register_listener(MyComponentListener *listener);
+           #endif
+            protected:
+           #ifdef MY_COMPONENT_LISTENER_COUNT
+             StaticVector<MyComponentListener *, MY_COMPONENT_LISTENER_COUNT> listeners_;
+           #endif
+           ```
+           Request slots from `to_code`, not from a job that runs after `CoroPriority.FINAL` - a late
+           request raises rather than silently undercounting.
+
         3. **Runtime-known sizes:** Use `FixedVector` from `esphome/core/helpers.h` when the size is only known at runtime initialization.
            ```cpp
            // Bad - generates STL realloc code (_M_realloc_insert)
@@ -599,9 +738,27 @@ This document provides essential context for AI models interacting with this pro
            ```
            Linear search on small datasets (1-16 elements) is often faster than hashing/tree overhead, but this depends on lookup frequency and access patterns. For frequent lookups in hot code paths, the O(1) vs O(n) complexity difference may still matter even for small datasets. `std::vector` with simple structs is usually fine—it's the heavy containers (`map`, `set`, `unordered_map`) that should be avoided for small datasets unless profiling shows otherwise.
 
-        5. **Avoid `std::deque`:** It allocates in 512-byte blocks regardless of element size, guaranteeing at least 512 bytes of RAM usage immediately. This is a major source of crashes on memory-constrained devices.
+        5. **Strings set once from configuration:** Use `StringRef` (`esphome/core/string_ref.h`) rather than
+           `std::string`. Code generation passes a string literal that lives in flash for the life of the
+           program, so storing a `std::string` copies it onto the heap for nothing. `StringRef` is a
+           non-owning pointer plus length; it does not copy, and it must only ever refer to storage that
+           outlives it (a string literal, or a buffer owned elsewhere).
+           ```cpp
+           // Bad - heap copy of a literal that is already in flash
+           void set_keys(std::string keys) { this->keys_ = std::move(keys); }
+           std::string keys_;
+           ```
+           ```cpp
+           // Good - no allocation
+           void set_keys(const char *keys) { this->keys_ = StringRef(keys); }
+           StringRef keys_;
+           ```
 
-        6. **Detection:** Look for these patterns in compiler output:
+        6. **Avoid `std::deque`:** It allocates in 512-byte blocks regardless of element size, guaranteeing at least 512 bytes of RAM usage immediately. This is a major source of crashes on memory-constrained devices.
+
+        7. **Never use `new (std::nothrow)`:** On ESP-IDF exceptions are disabled, so a failed nothrow allocation aborts instead of returning `nullptr`. Use `RAMAllocator` from `esphome/core/helpers.h`; CI rejects `std::nothrow`.
+
+        8. **Detection:** Look for these patterns in compiler output:
            - Large code sections with STL symbols (vector, map, set)
            - `alloc`, `realloc`, `dealloc` in symbol names
            - `_M_realloc_insert`, `_M_default_append` (vector reallocation)
@@ -745,7 +902,7 @@ This document provides essential context for AI models interacting with this pro
         cv.rename_key(
             CONF_OLD_KEY, CONF_NEW_KEY, removed_in="2026.6.0", component="my_component"
         ),
-        cv.Schema({ ... }),
+        cv.Schema({...}),
     )
     ```
     For other deprecations, warn manually during validation:
@@ -763,3 +920,13 @@ The project uses English for non-code content. When drafting documentation, code
 PR descriptions, and similar text, avoid technical jargon. Instead, express concepts in plain English,
 using standard technical terms only when required. Ensure the text is readily comprehensible to a wide
 audience, including non-native English speakers.
+
+## 10. Code Comments
+
+Code comments on individual lines should be used only where necessary to flag issues that may not be obvious
+on a simple reading of the code. Keep them short (e.g. 1 or 2 lines).
+
+Function and method comment blocks may include more detail as required to make
+calling contracts clear and document parameter usage, but should still be kept concise.
+
+Avoid redundancy and repetition; comments should never simply restate what the code already says.

CODEOWNERS

@@ -100,6 +100,7 @@ esphome/components/bmp581_i2c/* @danielkent-net @kahrendt
 esphome/components/bmp581_spi/* @danielkent-net @kahrendt
 esphome/components/bp1658cj/* @Cossid
 esphome/components/bp5758d/* @Cossid
+esphome/components/bridge/* @kbx81
 esphome/components/bthome_mithermometer/* @nagyrobi
 esphome/components/button/* @esphome/core
 esphome/components/bytebuffer/* @clydebarrow
@@ -111,6 +112,8 @@ esphome/components/captive_portal/* @esphome/core
 esphome/components/cc1101/* @gabest11 @lygris
 esphome/components/ccs811/* @habbie
 esphome/components/cd74hc4067/* @asoehlke
+esphome/components/cdc_acm_uart/* @kbx81
+esphome/components/cdc_acm_uart/bridge/* @kbx81
 esphome/components/ch422g/* @clydebarrow @jesterret
 esphome/components/ch423/* @dwmw2
 esphome/components/chsc6x/* @kkosik20
@@ -122,6 +125,7 @@ esphome/components/combination/* @Cat-Ion @kahrendt
 esphome/components/const/* @esphome/core
 esphome/components/coolix/* @glmnet
 esphome/components/copy/* @OttoWinter
+esphome/components/counter/* @clydebarrow
 esphome/components/cover/* @esphome/core
 esphome/components/cs5460a/* @balrog-kun
 esphome/components/cse7761/* @berfenger
@@ -131,6 +135,7 @@ esphome/components/cst816/* @clydebarrow
 esphome/components/cst9220/* @clydebarrow
 esphome/components/ct_clamp/* @jesserockz
 esphome/components/current_based/* @djwmarcx
+esphome/components/d01/* @ch604
 esphome/components/dac7678/* @NickB1
 esphome/components/daikin_arc/* @MagicBear
 esphome/components/daikin_brc/* @hagak
@@ -148,6 +153,7 @@ esphome/components/display_menu_base/* @numo68
 esphome/components/dlms_meter/* @latonita @PolarGoose @SimonFischer04 @Tomer27cz
 esphome/components/dps310/* @kbx81
 esphome/components/ds1307/* @badbadc0ffee
+esphome/components/ds1603l/* @JakeLC15
 esphome/components/ds2484/* @mrk-its
 esphome/components/ds248x/* @tomwellnitz
 esphome/components/dsmr/* @glmnet @PolarGoose
@@ -177,7 +183,6 @@ esphome/components/esp32_camera_web_server/* @ayufan
 esphome/components/esp32_can/* @Sympatron
 esphome/components/esp32_hosted/* @swoboda1337
 esphome/components/esp32_hosted/update/* @swoboda1337
-esphome/components/esp32_improv/* @jesserockz
 esphome/components/esp32_rmt/* @jesserockz
 esphome/components/esp32_rmt_led_strip/* @jesserockz
 esphome/components/esp8266/* @esphome/core
@@ -261,8 +266,10 @@ esphome/components/i2s_audio/* @jesserockz
 esphome/components/i2s_audio/microphone/* @jesserockz
 esphome/components/i2s_audio/speaker/* @jesserockz @kahrendt
 esphome/components/iaqcore/* @yozik04
+esphome/components/icnt86/* @danepowell
 esphome/components/ili9xxx/* @clydebarrow @nielsnl68
 esphome/components/improv_base/* @esphome/core
+esphome/components/improv_ble/* @jesserockz
 esphome/components/improv_serial/* @esphome/core
 esphome/components/ina226/* @latonita @Sergio303
 esphome/components/ina260/* @mreditor97
@@ -350,6 +357,7 @@ esphome/components/mipi_spi/* @clydebarrow
 esphome/components/mitsubishi/* @RubyBailey
 esphome/components/mitsubishi_cn105/* @crnjan
 esphome/components/mixer/speaker/* @kahrendt
+esphome/components/mk2pvrouter/* @FredM67
 esphome/components/mlx90393/* @functionpointer
 esphome/components/mlx90614/* @jesserockz
 esphome/components/mmc5603/* @benhoff
@@ -381,6 +389,7 @@ esphome/components/nextion/switch/* @senexcrenshaw
 esphome/components/nextion/text_sensor/* @senexcrenshaw
 esphome/components/nfc/* @jesserockz @kbx81
 esphome/components/noblex/* @AGalfra
+esphome/components/noise/* @esphome/core
 esphome/components/npi19/* @bakerkj
 esphome/components/nrf52/* @tomaszduda23
 esphome/components/number/* @esphome/core
@@ -414,6 +423,7 @@ esphome/components/pn7150_i2c/* @jesserockz @kbx81
 esphome/components/pn7160/* @jesserockz @kbx81
 esphome/components/pn7160_i2c/* @jesserockz @kbx81
 esphome/components/pn7160_spi/* @jesserockz @kbx81
+esphome/components/pn71xx/* @jesserockz @kbx81
 esphome/components/power_supply/* @esphome/core
 esphome/components/preferences/* @esphome/core
 esphome/components/provisioning/* @esphome/core
@@ -421,6 +431,7 @@ esphome/components/psram/* @esphome/core
 esphome/components/pulse_meter/* @cstaahl @stevebaxter @TrentHouliston
 esphome/components/pvvx_mithermometer/* @pasiz
 esphome/components/pylontech/* @functionpointer
+esphome/components/pzem6l24/* @nuttytree
 esphome/components/qmi8658/* @clydebarrow
 esphome/components/qmp6988/* @andrewpc
 esphome/components/qr_code/* @wjtje
@@ -449,6 +460,7 @@ esphome/components/rtl87xx/* @kuba2k2
 esphome/components/rtttl/* @glmnet @ximex
 esphome/components/runtime_image/* @clydebarrow @guillempages @kahrendt
 esphome/components/runtime_stats/* @bdraco
+esphome/components/rx8025t/* @remcom
 esphome/components/rx8130/* @beormund
 esphome/components/safe_mode/* @jsuanet @kbx81 @paulmonigatti
 esphome/components/scd4x/* @martgras @sjtrny
@@ -470,11 +482,13 @@ esphome/components/sendspin/image/* @kahrendt
 esphome/components/sendspin/media_player/* @kahrendt
 esphome/components/sendspin/media_source/* @kahrendt
 esphome/components/sendspin/sensor/* @kahrendt
+esphome/components/sendspin/switch/* @kahrendt
 esphome/components/sendspin/text_sensor/* @kahrendt
 esphome/components/sensirion_common/* @martgras
 esphome/components/sensor/* @esphome/core
 esphome/components/serial_proxy/* @kbx81
 esphome/components/sfa30/* @ghsensdev
+esphome/components/sfa40/* @NoQuarrel
 esphome/components/sgp40/* @SenexCrenshaw
 esphome/components/sgp4x/* @martgras @SenexCrenshaw
 esphome/components/sha256/* @esphome/core
@@ -491,6 +505,7 @@ esphome/components/sm2335/* @Cossid
 esphome/components/sml/* @alengwenus
 esphome/components/smt100/* @piechade
 esphome/components/sn74hc165/* @jesserockz
+esphome/components/snapshot/* @clydebarrow
 esphome/components/socket/* @esphome/core
 esphome/components/sonoff_d1/* @anatoly-savchenkov
 esphome/components/sound_level/* @kahrendt
@@ -536,7 +551,9 @@ esphome/components/sx126x/* @swoboda1337
 esphome/components/sx127x/* @swoboda1337
 esphome/components/sy6970/* @linkedupbits
 esphome/components/syslog/* @clydebarrow
+esphome/components/systa_bus/* @Mat931
 esphome/components/t6615/* @tylermenezes
+esphome/components/tas2780/* @remcom
 esphome/components/tc74/* @sethgirvan
 esphome/components/tca9548a/* @andreashergert1984
 esphome/components/tca9555/* @mobrembski
@@ -549,6 +566,7 @@ esphome/components/template/datetime/* @rfdarter
 esphome/components/template/event/* @nohat
 esphome/components/template/fan/* @ssieb
 esphome/components/text/* @mauritskorse
+esphome/components/tfluna/* @candrews
 esphome/components/thermopro_ble/* @sittner
 esphome/components/thermostat/* @kbx81
 esphome/components/time/* @esphome/core
@@ -575,10 +593,12 @@ esphome/components/tuya/select/* @bearpawmaxim
 esphome/components/tuya/sensor/* @jesserockz
 esphome/components/tuya/switch/* @jesserockz
 esphome/components/tuya/text_sensor/* @dentra
+esphome/components/tuya/water_heater/* @iago-veiga
 esphome/components/uart/* @esphome/core
 esphome/components/uart/button/* @ssieb
 esphome/components/uart/event/* @eoasmxd
 esphome/components/uart/packet_transport/* @clydebarrow
+esphome/components/uart_mux/* @kbx81
 esphome/components/udp/* @clydebarrow
 esphome/components/ufire_ec/* @pvizeli
 esphome/components/ufire_ise/* @pvizeli
@@ -623,6 +643,7 @@ esphome/components/wts01/* @alepee
 esphome/components/x9c/* @EtienneMD
 esphome/components/xdb401/* @RT530
 esphome/components/xgzp68xx/* @gcormier
+esphome/components/xiaomi_body_scale/* @dckiller51
 esphome/components/xiaomi_hhccjcy10/* @fariouche
 esphome/components/xiaomi_lywsd02mmc/* @juanluss31
 esphome/components/xiaomi_lywsd03mmc/* @ahpohl

Doxyfile

@@ -48,7 +48,7 @@ PROJECT_NAME           = ESPHome
 # could be handy for archiving the generated documentation or if some version
 # control system is used.
 
-PROJECT_NUMBER         = 2026.9.0-dev
+PROJECT_NUMBER         = 2026.10.0-dev
 
 # Using the PROJECT_BRIEF tag one can provide an optional one line description
 # for a project that appears at the top of each page and should give viewer a

THREAT_MODEL.md

@@ -23,7 +23,8 @@ For this repository there are two trusted inputs by design:
 1. **The configuration.** Anyone who can supply or edit a YAML config is trusted
    (see below).
 2. **Authenticated peers of a running device** — clients holding the device's
-   API encryption key / password, OTA password, or web server credentials.
+   API/OTA encryption key, API password, OTA password, or web server
+   credentials.
 
 The security boundary is therefore **unauthenticated network traffic vs. those
 trusted inputs.** A bug that lets an unauthenticated attacker cross it is a
@@ -76,8 +77,8 @@ These *are* security bugs in this repo, and we want to hear about them privately
   captive portal, etc.) **without** valid credentials.
 - Authentication or encryption bypass on the device — reaching API calls, OTA
   updates, or the web server without the configured key/password.
-- Flaws that weaken the device's API encryption (Noise), OTA, or web server auth
-  below their documented guarantees.
+- Flaws that weaken the device's API or OTA encryption (Noise), OTA auth, or
+  web server auth below their documented guarantees.
 
 ## The web server is an open HTTP API by design
 
@@ -121,6 +122,54 @@ and any memory-safety or protocol bug in the server reachable without credential
 This section documents the current design and scope; it is not a judgment that the
 design is optimal or that it will not change.
 
+## OTA update encryption
+
+The `esphome` OTA platform optionally encrypts updates with the same Noise
+`NNpsk0` pattern the native API uses; one key protects the device. A device
+whose `api:` block has an encryption key, static in the YAML or provisioned at
+runtime, compiles in the transport and offers it on every OTA connection once
+it holds a key, so an uploader presenting that key gets the guarantees below
+even without an `ota: encryption:` block; only that block makes the device
+require encryption. The guarantees are: the firmware image is confidential in
+transit, the uploader is authenticated by the pre-shared key, and the plaintext
+negotiation preceding the handshake is bound into the handshake prologue, so
+stripping or tampering with it fails the first MAC. With `ota: encryption:`
+configured both ends fail closed with no override: the device refuses
+plaintext uploads, and the CLI refuses to send plaintext when a key is
+configured. Without that block the CLI tries a static api key when the device
+offers and, until 2027.3.0, falls back to plaintext with a warning when the
+offer is missing or the handshake fails; a runtime provisioned key never
+reaches the CLI, so those uploads stay plaintext.
+
+Defeating any of that without the key is in scope: a device that requires
+encryption accepting a plaintext or downgraded upload, getting past the MAC,
+or recovering image contents from captured traffic.
+
+The following are **not** vulnerabilities, by design:
+
+- Plaintext OTA on a device with no `ota: encryption:` block, including one
+  that offers encryption because it has an api key. That is the documented
+  default, authenticated (if at all) by the OTA password. An uploader that
+  takes the offer skips the password; the key authenticates it. With a
+  runtime provisioned key and no `provisioning:` window, whoever provisions
+  the key gains that upload path too; validation warns about the pair.
+- The CLI plaintext fallback until 2027.3.0: without `ota: encryption:` an
+  active attacker who strips the offer or breaks the handshake can make a
+  keyed CLI upload plaintext, with the pre-existing plaintext exposure. A
+  device that requires encryption still refuses that upload.
+- The enablement window: firmware built with a static api key already offers
+  encryption, so turning on `ota: encryption:` is itself an encrypted upload.
+  Older firmware needs one last plaintext upload of an offering build, with
+  the pre-existing plaintext exposure.
+- The web OTA `/update` endpoint alongside encryption. With the `web_server`
+  or `prometheus` component the shared listener is always up, so the endpoint
+  stays reachable and validation warns about that combination;
+  `captive_portal:` alone brings the listener up only for the fallback AP
+  window, which is the intended recovery path, so that is not warned about.
+- CLI retry behavior on transport or MAC failures; every attempt renegotiates
+  a fresh handshake with fresh ephemerals, so retrying does not weaken
+  authentication.
+
 ## Explicitly out of scope
 
 - Local attackers who already have shell access on the host that runs `esphome`.

docker/Dockerfile

@@ -22,16 +22,13 @@ RUN \
     -r /requirements.txt
 
 # Install the ESPHome Device Builder dashboard.
-RUN uv pip install --no-cache-dir esphome-device-builder==1.11.0
+RUN uv pip install --no-cache-dir esphome-device-builder==1.17.2
 
 RUN \
     platformio settings set enable_telemetry No \
     && platformio settings set check_platformio_interval 1000000 \
     && mkdir -p /piolibs
 
-COPY script/platformio_install_deps.py platformio.ini /
-RUN /platformio_install_deps.py /platformio.ini --libraries
-
 ARG BUILD_VERSION
 
 LABEL \

docker/docker_entrypoint.sh

@@ -21,10 +21,14 @@ export PLATFORMIO_PLATFORMS_DIR="${pio_cache_base}/platforms"
 export PLATFORMIO_PACKAGES_DIR="${pio_cache_base}/packages"
 export PLATFORMIO_CACHE_DIR="${pio_cache_base}/cache"
 
-# Keep the native toolchain installs on the persistent cache root, not the
-# container's ephemeral user cache dir (re-downloaded on every restart).
+# Keep the native toolchain installs and compiler caches on the persistent
+# cache root, not the container's user cache dir: it is lost on every
+# restart, and not writable when the container runs as a non-root user.
 export ESPHOME_ESP_IDF_PREFIX="$(dirname "${pio_cache_base}")/idf"
 export ESPHOME_SDK_NRF_PREFIX="$(dirname "${pio_cache_base}")/sdk-nrf"
+export ESPHOME_ARDUINO8266_PREFIX="$(dirname "${pio_cache_base}")/arduino8266"
+export ESPHOME_HOST_PREFIX="$(dirname "${pio_cache_base}")/host"
+export ESPHOME_PLATFORMIO_CCACHE_DIR="$(dirname "${pio_cache_base}")/platformio-ccache"
 
 # If /build is mounted, use that as the build path
 # otherwise use path in /config (so that builds aren't lost on container restart)

docker/generate_tags.py

@@ -1,5 +1,6 @@
 #!/usr/bin/env python3
 import argparse
+import os
 import re
 
 CHANNEL_DEV = "dev"
@@ -64,7 +65,10 @@ def main():
 
     suffix = f"-{args.suffix}" if args.suffix else ""
 
-    image_name = f"esphome/esphome{suffix}"
+    repository = (
+        (os.environ.get("GITHUB_REPOSITORY") or "esphome/esphome").strip().lower()
+    )
+    image_name = f"{repository}{suffix}"
 
     print(f"channel={channel}")
 

docker/ha-addon-rootfs/etc/s6-overlay/s6-rc.d/discovery/run

@@ -4,7 +4,6 @@
 # Home Assistant Add-on: ESPHome
 # Sends discovery information to Home Assistant.
 # ==============================================================================
-declare config
 declare port
 
 # We only disable it when disabled explicitly
@@ -19,14 +18,17 @@ port=$(bashio::addon.ingress_port)
 # Wait for the ESPHome Device Builder to become available
 bashio::net.wait_for "${port}" "127.0.0.1" 300
 
-config=$(\
-    bashio::var.json \
-        host "127.0.0.1" \
-        port "^${port}" \
-)
+# Send one discovery message; the config is a JSON string built with bashio::var.json.
+send_discovery() {
+    local service=$1
+    local config=$2
+    if bashio::discovery "${service}" "${config}" > /dev/null; then
+        bashio::log.info "Successfully send ${service} discovery information to Home Assistant."
+    else
+        bashio::log.error "${service} discovery message to Home Assistant failed!"
+    fi
+}
 
-if bashio::discovery "esphome" "${config}" > /dev/null; then
-    bashio::log.info "Successfully send discovery information to Home Assistant."
-else
-    bashio::log.error "Discovery message to Home Assistant failed!"
-fi
+send_discovery "esphome" "$(bashio::var.json host "127.0.0.1" port "^${port}")"
+# The Device Builder MCP server, consumed by Home Assistant's mcp integration.
+send_discovery "mcp" "$(bashio::var.json url "http://127.0.0.1:${port}/api/mcp")"

docker/ha-addon-rootfs/etc/s6-overlay/s6-rc.d/esphome/run

@@ -15,10 +15,14 @@ export PLATFORMIO_PLATFORMS_DIR="${pio_cache_base}/platforms"
 export PLATFORMIO_PACKAGES_DIR="${pio_cache_base}/packages"
 export PLATFORMIO_CACHE_DIR="${pio_cache_base}/cache"
 
-# Keep the native toolchain installs on the persistent /data volume, not the
-# container's ephemeral user cache dir (wiped on every add-on update/restart).
+# Keep the native toolchain installs and compiler caches on the persistent
+# /data volume, not the container's ephemeral user cache dir (wiped on every
+# add-on update/restart).
 export ESPHOME_ESP_IDF_PREFIX=/data/cache/idf
 export ESPHOME_SDK_NRF_PREFIX=/data/cache/sdk-nrf
+export ESPHOME_ARDUINO8266_PREFIX=/data/cache/arduino8266
+export ESPHOME_HOST_PREFIX=/data/cache/host
+export ESPHOME_PLATFORMIO_CCACHE_DIR=/data/cache/platformio-ccache
 
 if bashio::config.true 'leave_front_door_open'; then
     export DISABLE_HA_AUTHENTICATION=true

docker/test_configs/bk72xx-arduino.yaml

@@ -5,3 +5,15 @@ bk72xx:
   board: generic-bk7231n-qfn32-tuya
 
 logger:
+
+wifi:
+  ssid: MySSID
+  password: password1
+  ap:
+
+# mqtt and captive_portal together pull in AsyncTCP and ESPAsyncWebServer;
+# a stray ESP32 AsyncTCP copy on the library search path breaks this build
+captive_portal:
+
+mqtt:
+  broker: 192.168.178.84

docker/test_configs/esp8266-arduino-native.yaml

@@ -0,0 +1,8 @@
+esphome:
+  name: docker-test-esp8266-native
+
+esp8266:
+  board: d1_mini
+  toolchain: arduino
+
+logger:

docker/test_configs/esp8266-arduino.yaml

@@ -3,5 +3,7 @@ esphome:
 
 esp8266:
   board: d1_mini
+  # The PlatformIO path stays covered whatever the default is
+  toolchain: platformio
 
 logger:

esphome/__main__.py

@@ -16,6 +16,7 @@ from typing import TYPE_CHECKING, Protocol
 # cause them to be loaded before external components are processed, resulting
 # in the built-in version being used instead of the external component one.
 from esphome import const, platform_hooks
+from esphome.build_helpers.native import analysis_backend, native_backend
 from esphome.const import (
     ALLOWED_NAME_CHARS,
     ARGUMENT_HELP_DEVICE,
@@ -26,7 +27,9 @@ from esphome.const import (
     CONF_DEASSERT_RTS_DTR,
     CONF_DISABLED,
     CONF_DISCOVER_IP,
+    CONF_ENCRYPTION,
     CONF_ESPHOME,
+    CONF_KEY,
     CONF_LEVEL,
     CONF_LOG,
     CONF_LOG_TOPIC,
@@ -762,9 +765,11 @@ def _wrap_to_code(name, comp, yaml_util):
     async def wrapped(conf):
         cg.add(cg.LineComment(f"{name}:"))
         if comp.config_schema is not None:
-            conf_str = yaml_util.dump(conf)
+            # sort_keys: voluptuous fills defaults in set order, so an
+            # unsorted dump would churn main.cpp and relink every run
+            conf_str = yaml_util.dump(conf, sort_keys=True)
             conf_str = conf_str.replace("//", "")
-            # remove tailing \ to avoid multi-line comment warning
+            # remove trailing \ to avoid multi-line comment warning
             conf_str = conf_str.replace("\\\n", "\n")
             cg.add(cg.LineComment(indent(conf_str)))
         await coro(conf)
@@ -813,7 +818,9 @@ def write_cpp_file() -> int:
         from esphome.build_gen import espidf
 
         espidf.write_project()
-    else:
+    elif not CORE.using_native_toolchain:
+        # Other native builds generate their project at compile time;
+        # never write a platformio.ini for them
         from esphome.build_gen import platformio
 
         platformio.write_project()
@@ -831,7 +838,7 @@ def compile_program(args: ArgsProtocol, config: ConfigType) -> int:
 
     # Keep this here, NOT in codegen: config-hash and --only-generate must keep
     # working on machines that cannot run the toolchain.
-    if CORE.is_esp8266:
+    if CORE.is_esp8266 and CORE.using_toolchain_platformio:
         from esphome.components.esp8266 import check_rosetta
 
         check_rosetta()
@@ -855,7 +862,14 @@ def compile_program(args: ArgsProtocol, config: ConfigType) -> int:
         toolchain.create_factory_bin()
         toolchain.create_ota_bin()
         toolchain.create_elf_copy()
-        toolchain.get_idedata()
+        from esphome.build_helpers.idedata import warn_if_idedata_missing
+
+        warn_if_idedata_missing(toolchain.get_idedata)
+    elif CORE.using_native_toolchain:
+        raise EsphomeError(
+            f"Toolchain '{CORE.toolchain.value}' resolved but no platform "
+            "backend claimed the build"
+        )
     else:
         from esphome.platformio import toolchain
 
@@ -910,14 +924,11 @@ def _check_and_emit_build_info() -> None:
 
 def _get_configured_xtal_freq() -> int | None:
     """Read the configured crystal frequency from the sdkconfig file."""
+    from esphome.espidf import parse_sdkconfig
+
     sdkconfig_path = CORE.relative_build_path(f"sdkconfig.{CORE.name}")
-    if not sdkconfig_path.is_file():
-        return None
-    with suppress(OSError, ValueError):
-        content = sdkconfig_path.read_text()
-        for line in content.splitlines():
-            if line.startswith("CONFIG_XTAL_FREQ="):
-                return int(line.split("=", 1)[1])
+    with suppress(OSError, ValueError, KeyError):
+        return int(parse_sdkconfig(sdkconfig_path)["CONFIG_XTAL_FREQ"])
     return None
 
 
@@ -958,12 +969,15 @@ def upload_using_esptool(
 
     if file is not None:
         flash_images = [FlashImage(path=file, offset="0x0")]
-    elif CORE.using_toolchain_esp_idf:
-        from esphome.espidf import toolchain
-
-        flash_images = [
-            FlashImage(path=toolchain.get_factory_firmware_path(), offset="0x0")
-        ]
+    elif (native := native_backend()) is not None:
+        # Every native backend supplies its own 0x0 flash image (bootloader
+        # and partitions included where the target needs them)
+        image = native.get_factory_firmware_path()
+        if not image.is_file():
+            raise EsphomeError(
+                f"{image} does not exist; compile the configuration first"
+            )
+        flash_images = [FlashImage(path=image, offset="0x0")]
     else:
         from esphome.platformio import toolchain
 
@@ -1318,9 +1332,32 @@ def _upload_via_native_api(
             break
 
     from esphome import espota2
+    from esphome.components.noise import static_encryption_key
 
     remote_port = int(ota_conf[CONF_PORT])
     password = ota_conf.get(CONF_PASSWORD)
+    # Fail closed: an encryption block whose key did not resolve must never
+    # fall back to a plaintext upload
+    noise_psk = None
+    plaintext_fallback = False
+    allow_plaintext_upload = False
+    if (encryption_conf := ota_conf.get(CONF_ENCRYPTION)) is not None:
+        noise_psk = encryption_conf.get(CONF_KEY)
+        allow_plaintext_upload = bool(
+            encryption_conf.get(espota2.CONF_ALLOW_PLAINTEXT_UPLOAD)
+        )
+        if not noise_psk:
+            raise EsphomeError(
+                "OTA encryption is configured but no key was resolved; "
+                "set the key under 'ota: encryption:' or 'api: encryption:'"
+            )
+        # Ensure the key is a string, as required by the underlying OTA implementation.
+        # It arrives here as a SensitiveStr which aioesphomeapi rejects.
+        noise_psk = str(noise_psk)
+    elif api_key := static_encryption_key(config.get(CONF_API) or {}):
+        # Remove before 2027.3.0: the api key is tried, falling back to plaintext
+        noise_psk = str(api_key)
+        plaintext_fallback = True
 
     def check_partition_access(option_string: str) -> None:
         if not ota_conf.get("allow_partition_access"):
@@ -1351,7 +1388,16 @@ def _upload_via_native_api(
     if ota_type == espota2.OTA_TYPE_UPDATE_BOOTLOADER:
         _validate_bootloader_binary(binary)
 
-    return espota2.run_ota(network_devices, remote_port, password, binary, ota_type)
+    return espota2.run_ota(
+        network_devices,
+        remote_port,
+        password,
+        binary,
+        ota_type,
+        noise_psk,
+        plaintext_fallback=plaintext_fallback,
+        allow_plaintext_upload=allow_plaintext_upload,
+    )
 
 
 def _upload_via_web_server(
@@ -1360,6 +1406,16 @@ def _upload_via_web_server(
     from esphome import web_server_ota
     from esphome.web_server_helpers import get_web_server_connection
 
+    if any(
+        ota_item.get(CONF_PLATFORM) == CONF_ESPHOME
+        and ota_item.get(CONF_ENCRYPTION) is not None
+        for ota_item in config.get(CONF_OTA, [])
+    ):
+        _LOGGER.warning(
+            "This config has OTA encryption, but the web_server OTA path sends "
+            "the image over plaintext HTTP; use the esphome OTA platform to "
+            "keep it confidential"
+        )
     remote_port, username, password = get_web_server_connection(config)
     return web_server_ota.run_ota(
         network_devices, remote_port, username, password, binary
@@ -1655,15 +1711,7 @@ def command_compile(args: ArgsProtocol, config: ConfigType) -> int | None:
     if exit_code != 0:
         return exit_code
     if CORE.is_host:
-        if CORE.using_toolchain_esp_idf:
-            from esphome.espidf import toolchain
-
-            program_path = str(toolchain.get_elf_path())
-        else:
-            from esphome.platformio.toolchain import get_idedata
-
-            program_path = str(get_idedata(config).firmware_elf_path)
-        _LOGGER.info("Successfully compiled program to path '%s'", program_path)
+        _LOGGER.info("Successfully compiled program to path '%s'", CORE.firmware_bin)
     else:
         _LOGGER.info("Successfully compiled program.")
     return 0
@@ -1713,14 +1761,7 @@ def command_run(args: ArgsProtocol, config: ConfigType) -> int | None:
         return exit_code
     _LOGGER.info("Successfully compiled program.")
     if CORE.is_host:
-        if CORE.using_toolchain_esp_idf:
-            from esphome.espidf import toolchain
-
-            program_path = str(toolchain.get_elf_path())
-        else:
-            from esphome.platformio.toolchain import get_idedata
-
-            program_path = str(get_idedata(config).firmware_elf_path)
+        program_path = str(CORE.firmware_bin)
         _LOGGER.info("Running program from path '%s'", program_path)
         return run_external_process(program_path)
 
@@ -1912,12 +1953,12 @@ def command_update_all(args: ArgsProtocol) -> int | None:
 def command_idedata(args: ArgsProtocol, config: ConfigType) -> int:
     import json
 
-    if CORE.using_toolchain_esp_idf:
-        # Native ESP-IDF derives idedata from the build's compile_commands.json,
-        # so the configuration must already be compiled.
-        from esphome.espidf import toolchain as espidf_toolchain
+    native_toolchain = native_backend()
 
-        idedata = espidf_toolchain.get_idedata()
+    if native_toolchain is not None:
+        # Native toolchains derive idedata from the build's
+        # compile_commands.json, so the configuration must already be compiled.
+        idedata = native_toolchain.get_idedata()
         if idedata is None:
             _LOGGER.error(
                 "No idedata available; compile the configuration first",
@@ -1956,6 +1997,22 @@ def command_analyze_memory(args: ArgsProtocol, config: ConfigType) -> int:
     from esphome.analyze_memory.cli import MemoryAnalyzerCLI
     from esphome.analyze_memory.ram_strings import RamStringsAnalyzer
 
+    # Refuse an unsupported toolchain before paying for a full compile
+    analysis_toolchain = analysis_backend()
+    if analysis_toolchain is None and not CORE.using_toolchain_platformio:
+        _LOGGER.error(
+            "analyze-memory is not supported with the '%s' toolchain on %s; "
+            "re-run with --toolchain platformio",
+            CORE.toolchain.value if CORE.toolchain else "unresolved",
+            CORE.target_platform,
+        )
+        return 1
+    if (
+        check_supported := getattr(analysis_toolchain, "check_analysis_supported", None)
+    ) is not None:
+        # Raises with the reason; before the compile, not after it
+        check_supported()
+
     # Always compile to ensure fresh data (fast if no changes - just relinks)
     exit_code = write_cpp(config)
     if exit_code != 0:
@@ -1967,13 +2024,30 @@ def command_analyze_memory(args: ArgsProtocol, config: ConfigType) -> int:
 
     # Get idedata for analysis
     idedata = None
-    if CORE.using_toolchain_esp_idf:
-        from esphome.espidf import toolchain
+    if analysis_toolchain is not None:
+        objdump = analysis_toolchain.get_objdump_path()
+        readelf = analysis_toolchain.get_readelf_path()
+        for tool in (objdump, readelf):
+            if not tool.is_file():
+                # The analyzer would silently fall back to host
+                # binutils, which cannot read the target ELF
+                _LOGGER.error(
+                    "%s is missing; the toolchain install may be incomplete "
+                    "(recompile, or run 'esphome clean-all' if it persists)",
+                    tool,
+                )
+                return 1
+        objdump_path = str(objdump)
+        readelf_path = str(readelf)
 
-        objdump_path = str(toolchain.get_objdump_path())
-        readelf_path = str(toolchain.get_readelf_path())
-
-        firmware_elf = toolchain.get_elf_path()
+        firmware_elf = analysis_toolchain.get_elf_path()
+        if not firmware_elf.is_file():
+            # The analyzer swallows tool failures, so a missing ELF would
+            # produce an exit-0 zeroed report
+            _LOGGER.error(
+                "%s is missing; compile the configuration first", firmware_elf
+            )
+            return 1
     else:
         from esphome.platformio import toolchain
 
@@ -2290,7 +2364,8 @@ def parse_args(argv):
         metavar="{" + ",".join(t.value for t in Toolchain) + "}",
         help=(
             "Select toolchain for compiling. Overrides '<platform>.toolchain' in YAML. "
-            f"Default: {Toolchain.PLATFORMIO.value}."
+            "Default: the platform's native toolchain where it has one, else "
+            f"{Toolchain.PLATFORMIO.value}."
         ),
     )
 
@@ -2719,10 +2794,14 @@ def run_esphome(argv):
     # Skipped when -s overrides are passed, since the cache was written
     # against the previous substitution set.
     config: ConfigType | None = None
-    cache_eligible = (
+    cache_write_eligible = (
         args.command in ("upload", "logs") and not command_line_substitutions
     )
-    if cache_eligible:
+    # An explicit --toolchain must re-run the per-platform validators, so
+    # gate only the cache read; the refresh below saves the result unless
+    # the sidecar records a different toolchain.
+    cache_read_eligible = cache_write_eligible and args.toolchain is None
+    if cache_read_eligible:
         from esphome.compiled_config import load_compiled_config
 
         config = load_compiled_config(conf_path)
@@ -2746,17 +2825,14 @@ def run_esphome(argv):
             return 2
     CORE.config = config
 
-    # Fallback for platforms whose validators didn't set the toolchain
-    # (only the esp32 component reads esp32.framework.toolchain). All
-    # other platforms only support PlatformIO today. Must run before the
-    # cache refresh below so its sidecar records the same toolchain a
-    # compile would.
+    # The cache fast path skips validation, and legacy sidecars lack the
+    # toolchain field. Must run before the cache refresh below.
     if CORE.toolchain is None:
         CORE.toolchain = Toolchain.PLATFORMIO
 
     # Refresh the cache so the next upload/logs hits the fast path
     # instead of re-running read_config.
-    if cache_eligible and cache_missed:
+    if cache_write_eligible and cache_missed:
         from esphome.compiled_config import save_compiled_config_and_sidecar
 
         save_compiled_config_and_sidecar(config)

esphome/analyze_memory/toolchain.py

@@ -37,7 +37,7 @@ def find_elf_path(build_path: Path) -> Path | None:
     """
     name = build_path.name
     for candidate in (
-        # Native ESP-IDF: idf.py writes build/<name>.elf, which ESPHome copies
+        # Native ESP-IDF: the build writes build/<name>.elf, which ESPHome copies
         # to build/firmware.elf (see espidf.toolchain.create_elf_copy)
         build_path / "build" / "firmware.elf",
         # PlatformIO
@@ -68,12 +68,16 @@ def idedata_candidates(build_path: Path) -> list[Path]:
         The candidate idedata JSON paths, most specific first
     """
     name = build_path.name
+    data_dir = build_path.parent.parent / "idedata"
+    # Native backends suffix the cache by toolchain (<name>.arduino.json)
+    suffixed = sorted(data_dir.glob(f"{name}.*.json")) if data_dir.is_dir() else []
     return [
         # In .pioenvs for test builds
         build_path / ".pioenvs" / name / "idedata.json",
         # Both toolchains cache it in the data dir, which holds this build dir:
         # <data_dir>/idedata/<name>.json next to <data_dir>/build/<name>
         build_path.parent.parent / "idedata" / f"{name}.json",
+        *suffixed,
         # Regular builds, invoked from the config dir or from anywhere
         Path.cwd() / ".esphome" / "idedata" / f"{name}.json",
         Path.home() / ".esphome" / "idedata" / f"{name}.json",

esphome/api_client.py

@@ -23,9 +23,7 @@ from esphome.util import safe_print
 if TYPE_CHECKING:
     from collections.abc import Callable
 
-    from aioesphomeapi.api_pb2 import (
-        SubscribeLogsResponse,  # pylint: disable=no-name-in-module
-    )
+    from aioesphomeapi.api_pb2 import SubscribeLogsResponse  # pylint: disable=no-name-in-module
 
 
 _LOGGER = logging.getLogger(__name__)

esphome/arduino/library.py

@@ -0,0 +1,549 @@
+"""Arduino-core backend for the shared PlatformIO library converter.
+
+Bundled names build straight from the framework tree; everything else goes
+through ``esphome.platformio.library``. Mirrors ``lib_ldf_mode=off``: each
+library builds its own archive; all include dirs join one global path. The
+host build reuses it without a framework tree: nothing is bundled there and
+every name resolves from the registry.
+
+Deviations from PlatformIO: flat-layout libraries get the recursive default
+source filter; ``dot_a_linkage`` is honored; bundled libraries never run a
+manifest ``extraScript``; manifest ``-I`` flags join the global include path;
+``precompiled``/``ldflags`` properties are refused by name.
+"""
+
+from __future__ import annotations
+
+from dataclasses import dataclass, field
+import logging
+from pathlib import Path
+import re
+
+from esphome.core import CORE, EsphomeError, Library
+from esphome.helpers import walk_files
+from esphome.platformio.extra_script import apply_extra_script
+from esphome.platformio.library import (
+    DEFAULT_BUILD_INCLUDE_DIR,
+    DEFAULT_BUILD_SRC_FILTER,
+    ESPHOME_DATA_KEY,
+    ESPHOME_DATA_LINK_FLAGS_KEY,
+    LIBRARY_HEADER_SUFFIXES,
+    SRC_FILE_EXTENSIONS,
+    ConvertedLibrary,
+    IncompatiblePlatform,
+    InvalidLibrary,
+    LibraryBackend,
+    _url_or_none,
+    check_library_data,
+    collect_filtered_files,
+    convert_libraries,
+    ensure_list,
+    is_lib_ignored,
+    lex_build_flags,
+    lib_ignore_set,
+    normalize_dependencies,
+    parse_library_json,
+    parse_library_properties,
+    warn_properties_depends,
+)
+
+_LOGGER = logging.getLogger(__name__)
+
+
+@dataclass
+class ArduinoLibrary:
+    """One resolved library, ready for the ninja generator."""
+
+    name: str
+    sources: list[Path] = field(default_factory=list)
+    include_dirs: list[Path] = field(default_factory=list)
+    # Extra compile flags private to this library's own sources
+    flags: list[str] = field(default_factory=list)
+    # PlatformIO's build.libArchive / Arduino's dot_a_linkage: when False the
+    # objects go to the linker directly (symbols nothing references survive)
+    lib_archive: bool = True
+    # Link inputs the library contributes (-L dirs / -l libs, e.g. from
+    # precompiled vendor blobs) and -Wl, options for the firmware link
+    link_dirs: list[Path] = field(default_factory=list)
+    link_libs: list[str] = field(default_factory=list)
+    link_flags: list[str] = field(default_factory=list)
+
+
+# Source-like suffixes the case-sensitive suffix map rejects
+_UNMAPPED_SOURCE_SUFFIXES = frozenset(
+    {s.lower() for s in SRC_FILE_EXTENSIONS} | {".ino"}
+)
+
+# Filename-plain names: an allowlist excludes separators, drive colons,
+# and dot-only names by shape
+_SAFE_LIBRARY_NAME_RE = re.compile(r"[A-Za-z0-9_][A-Za-z0-9_. +-]*\Z")
+
+
+def _is_safe_library_name(name: object) -> bool:
+    """Whether a name may be joined under the framework's libraries dir."""
+    return isinstance(name, str) and _SAFE_LIBRARY_NAME_RE.fullmatch(name) is not None
+
+
+def _manifest_build(name: str, data: object) -> dict:
+    """The manifest's ``build`` section; malformed manifests fail by name."""
+    build = data.get("build", {}) if isinstance(data, dict) else None
+    if not isinstance(build, dict):
+        raise EsphomeError(f"Library {name} has a malformed manifest")
+    return build
+
+
+def _resolve_src_dir(name: str, read_path: Path, build: dict) -> str:
+    """Resolve PIO's source dir: manifest srcDir, else src/Src, else the root."""
+    if "srcDir" not in build:
+        return next((d for d in ("src", "Src") if (read_path / d).is_dir()), ".")
+    # A declared srcDir (falsy included) that does not resolve is a manifest error
+    src_dir = build["srcDir"]
+    if not (isinstance(src_dir, str) and src_dir and (read_path / src_dir).is_dir()):
+        raise EsphomeError(
+            f"Library {name} declares srcDir {src_dir!r} which does not exist"
+        )
+    return src_dir
+
+
+def _reject_unsupported_link_fields(name: str, data: dict) -> None:
+    # PIO honors these; ignoring them would fail at link with no stated
+    # cause. Property values are strings, so "false" is not a declaration.
+    precompiled = data.get("precompiled")
+    if precompiled and str(precompiled).strip().lower() != "false":
+        raise EsphomeError(
+            f"Library {name} declares precompiled, which this backend does not support"
+        )
+    if data.get("ldflags"):
+        raise EsphomeError(
+            f"Library {name} declares ldflags, which this backend does not support"
+        )
+
+
+def _resolve_lib_archive(name: str, data: dict, build: dict) -> bool:
+    """build.libArchive, else dot_a_linkage (an Arduino IDE property PIO
+    ignores; a deliberate extra), else archive."""
+
+    # Strict parse: bool("false") is True
+    def _parse(key: str, raw: object) -> bool:
+        if isinstance(raw, bool):
+            return raw
+        value = str(raw).strip().lower()
+        if value in ("true", "false"):
+            return value == "true"
+        raise EsphomeError(f"Library {name} has a malformed {key} value {raw!r}")
+
+    if "libArchive" in build:
+        return _parse("libArchive", build["libArchive"])
+    if "dot_a_linkage" in data:
+        return _parse("dot_a_linkage", data["dot_a_linkage"])
+    return True
+
+
+def _classify_build_flags(
+    name: str, read_path: Path, lib: ArduinoLibrary, flag_tokens: list[str]
+) -> list[str]:
+    """Route the lexed build.flags into the library's flag lists.
+
+    Returns the ``-I`` arguments for the include-dir resolution.
+    """
+    include_flags: list[str] = []
+    for tok in flag_tokens:
+        if tok.startswith("-I"):
+            include_flags.append(tok[2:])
+        elif tok.startswith("-L"):
+            link_dir = (read_path / tok[2:]).resolve()
+            if not link_dir.is_dir():
+                # Kept (the linker ignores missing -L dirs); the warning
+                # names the culprit before a bare "cannot find -lfoo"
+                _LOGGER.warning(
+                    "Library %s declares library dir %s which does not exist",
+                    name,
+                    tok[2:],
+                )
+            lib.link_dirs.append(link_dir)
+        elif tok.startswith("-l"):
+            lib.link_libs.append(tok[2:])
+        elif tok.startswith("-Wl,"):
+            lib.link_flags.append(tok)
+        else:
+            lib.flags.append(tok)
+    return include_flags
+
+
+def _resolve_include_dirs(
+    name: str,
+    read_path: Path,
+    lib: ArduinoLibrary,
+    build: dict,
+    src_dir: str,
+    include_flags: list[str],
+) -> None:
+    include_dir = build.get("includeDir", DEFAULT_BUILD_INCLUDE_DIR)
+    if not isinstance(include_dir, str):
+        raise EsphomeError(f"Library {name} has a malformed includeDir")
+    for d, explicit in [
+        (include_dir, "includeDir" in build),
+        (src_dir, False),  # _resolve_src_dir already validated it
+        *((flag, True) for flag in include_flags),
+    ]:
+        if (path := (read_path / d)).is_dir():
+            lib.include_dirs.append(path.resolve())
+        elif explicit:
+            # Warn-and-drop (unlike srcDir): a missing include dir is
+            # harmless until a header is needed, and the compile names it
+            _LOGGER.warning(
+                "Library %s declares include dir %s which does not exist", name, d
+            )
+
+
+def _collect_lib_sources(
+    name: str,
+    read_path: Path,
+    lib: ArduinoLibrary,
+    src_dir: str,
+    src_filter: list[str],
+) -> None:
+    sources: list[Path] = []
+    dropped: list[str] = []
+    saw_header = False
+    for f in collect_filtered_files(read_path / src_dir, src_filter):
+        path = Path(f)
+        suffix = path.suffix
+        if suffix in SRC_FILE_EXTENSIONS:
+            # resolve() per file: srcFilter patterns may escape src_dir
+            sources.append(path.resolve())
+        elif suffix.lower() in _UNMAPPED_SOURCE_SUFFIXES:
+            # A source-like suffix the case-sensitive map rejects (.CPP,
+            # .ino) is a dropped compilation unit; headers fall through
+            dropped.append(path.name)
+        elif suffix.lower() in LIBRARY_HEADER_SUFFIXES:
+            saw_header = True
+    lib.sources = sorted(sources)
+    if dropped:
+        _LOGGER.warning(
+            "Library %s: %d file(s) with unmapped source suffixes are not compiled: %s",
+            name,
+            len(dropped),
+            ", ".join(sorted(dropped)),
+        )
+    if not lib.sources and not saw_header:
+        # Matched headers mean header-only; a filter matching nothing is
+        # a manifest/tree problem (a truly empty tree raises elsewhere)
+        _LOGGER.warning("Library %s: no source files matched", name)
+
+
+def _library_info(name: str, read_path: Path, data: dict) -> ArduinoLibrary:
+    """Resolve one library's sources, include dirs, and flags (PIO semantics)."""
+    build = _manifest_build(name, data)
+    _reject_unsupported_link_fields(name, data)
+    src_dir = _resolve_src_dir(name, read_path, build)
+    src_filter = ensure_list(build.get("srcFilter", DEFAULT_BUILD_SRC_FILTER))
+    if not all(isinstance(entry, str) for entry in src_filter):
+        raise EsphomeError(f"Library {name} has a malformed srcFilter")
+    lib = ArduinoLibrary(name=name, lib_archive=_resolve_lib_archive(name, data, build))
+    # PlatformIO shell-lexes each build.flags entry
+    include_flags = _classify_build_flags(
+        name, read_path, lib, lex_build_flags(build.get("flags", []), f"library {name}")
+    )
+    _resolve_include_dirs(name, read_path, lib, build, src_dir, include_flags)
+    _collect_lib_sources(name, read_path, lib, src_dir, src_filter)
+    return lib
+
+
+def _bundled_library(framework_path: Path, name: str) -> ArduinoLibrary:
+    """A library bundled with the Arduino core, read from the framework tree.
+
+    ``library.json`` wins over ``library.properties`` when both exist, as in
+    PlatformIO's LibBuilderFactory; only the JSON manifest can carry a
+    ``build`` section (srcDir, srcFilter, flags).
+    """
+    lib_dir = framework_path / "libraries" / name
+    manifest_json = lib_dir / "library.json"
+    if manifest_json.is_file():
+        try:
+            data = parse_library_json(manifest_json)
+        except ValueError as err:  # JSONDecodeError
+            raise EsphomeError(
+                f"Bundled library {name} has a corrupt library.json ({err}); "
+                "the framework install may be incomplete (run 'esphome clean-all')"
+            ) from err
+    elif (manifest := lib_dir / "library.properties").is_file():
+        data = parse_library_properties(manifest)
+    else:
+        # Debug, not warning: the legacy manifest-less layout is legal and
+        # the 3.1.2 core ships one such library (FSTools), so a warning
+        # would be unactionable noise on every build using it
+        _LOGGER.debug("Bundled library %s has no manifest; using defaults", name)
+        data = {}
+    if isinstance(data, dict):
+        # Bundled manifest deps are never walked; make the skip visible
+        if data.get("dependencies"):
+            _LOGGER.warning(
+                "Bundled library %s declares dependencies, which are not "
+                "resolved automatically; add them with add_library() if needed",
+                name,
+            )
+        warn_properties_depends(name, data)
+        build = data.get("build")
+        if isinstance(build, dict) and build.get("extraScript"):
+            # Scripts only run on the converted path; building without
+            # the script's flags would miscompile
+            raise EsphomeError(
+                f"Bundled library {name} declares an extraScript, which is "
+                "not run for bundled libraries"
+            )
+    lib = _library_info(name, lib_dir, data)
+    _assert_tree_has_code(
+        name,
+        lib_dir,
+        "the framework install may be incomplete (run 'esphome clean-all')",
+    )
+    return lib
+
+
+def _assert_tree_has_code(name: str, root: Path, hint: str) -> None:
+    """An empty or half-extracted tree can never link; fail by name (a
+    warning would scroll away and resurface as undefined symbols)."""
+    if not any(
+        Path(p).suffix in SRC_FILE_EXTENSIONS
+        or Path(p).suffix.lower() in LIBRARY_HEADER_SUFFIXES
+        for p in walk_files(root)
+    ):
+        raise EsphomeError(f"Library {name} has no sources or headers; {hint}")
+
+
+def _external_short_name(name: str) -> str:
+    """The short library name of a requested spec.
+
+    "owner/Name" and plain names take the last path segment; "Name=<url>"
+    takes the declared name. Git tails (".git", "#ref") are stripped like
+    the walk's URL normalization; the comparand is a manifest dependency
+    name, never a spec.
+    """
+    head, sep, tail = name.partition("=")
+    if sep and "://" in tail:
+        return head
+    short = name.rsplit("/", maxsplit=1)[-1]
+    return short.partition("#")[0].removesuffix(".git")
+
+
+def _check_unfulfilled_provides(
+    provided_requests: set[str], satisfied: set[str], still_requested: set[str]
+) -> None:
+    """Fail by name when a walk-skipped dependency was never added.
+
+    An unfulfilled provides() promise only surfaces as undefined symbols
+    at link. The walk records across re-resolutions, so a name no final
+    manifest still requests is stale state, never a failure.
+    """
+    if missing := sorted((provided_requests & still_requested) - satisfied):
+        raise EsphomeError(
+            "provides() skipped these dependencies but nothing added them: "
+            f"{', '.join(missing)}; the build is missing libraries"
+        )
+
+
+def resolve_libraries(
+    framework_path: Path | None,
+    *,
+    pio_platform: str,
+    board_mcu: str,
+    cache_key: str,
+    framework: str | None = "arduino",
+    manifest_optional: bool = False,
+) -> list[ArduinoLibrary]:
+    """Resolve every ``cg.add_library()`` entry into an :class:`ArduinoLibrary`.
+
+    ``pio_platform``/``board_mcu`` filter manifests the way PlatformIO would
+    for that core (e.g. ``espressif8266``/``esp8266``); ``cache_key`` keys the
+    shared converter's download cache. ``framework`` is the manifest
+    framework token the compatibility check warns about; None skips it.
+    A None ``framework_path`` means no core-bundled libraries exist (the
+    host build): every name resolves from the registry.
+    ``manifest_optional`` accepts libraries without a manifest, built with
+    PlatformIO's default layout.
+
+    The returned list is not topologically sorted, so the caller must link
+    the archives inside one ``--start-group``/``--end-group`` pair (the
+    bundled-first grouping is incidental).
+    """
+    bundled: list[ArduinoLibrary] = []
+    external: list[Library] = []
+    # PlatformIO's lib_ignore covers framework-bundled libraries too; the
+    # shared converter only filters the registry/git ones.
+    lib_ignore = lib_ignore_set()
+    bundled_dir_names: frozenset[str] = frozenset()
+    if framework_path is not None:
+        # Exact directory names keep membership case-sensitive everywhere
+        # (an is_dir() probe would match "wire" on macOS/Windows and build
+        # the bundled Wire twice)
+        libraries_dir = framework_path / "libraries"
+        if not libraries_dir.is_dir():
+            # A registry fallback would fail later with a misleading
+            # package-not-found error per bundled name
+            raise EsphomeError(
+                f"{libraries_dir} is missing; the framework install may be "
+                "incomplete (run 'esphome clean-all')"
+            )
+        bundled_dir_names = frozenset(
+            p.name for p in libraries_dir.iterdir() if p.is_dir()
+        )
+
+    def _provided(name: object) -> bool:
+        return _is_safe_library_name(name) and name in bundled_dir_names
+
+    for library in CORE.platformio_libraries.values():
+        if is_lib_ignored(library.name, lib_ignore):
+            continue
+        # Bundled only for a bare name with a matching framework dir; pinned
+        # or unmatched names resolve from the registry, as under PlatformIO.
+        if not library.repository and not library.version and _provided(library.name):
+            # Bundled manifest deps are not walked; _bundled_library warns
+            bundled.append(_bundled_library(framework_path, library.name))
+        else:
+            external.append(library)
+
+    converted: list[ArduinoLibrary] = []
+    bundled_names = {lib.name for lib in bundled}
+    converted_manifest_names: set[str] = set()
+    # Bundled candidates skipped on purpose (platform filter); the
+    # provides() reconciliation must count them as satisfied
+    knowingly_skipped: set[str] = set()
+    # Dependency names of the manifests actually emitted; a walk recording
+    # for a since-re-resolved manifest must not fail the reconciliation
+    final_dep_names: set[str] = set()
+    # Ordered set of bundled dependency names to add once conversion is done
+    pending_bundled: dict[str, None] = {}
+    # Deps matching a separately-requested external are already in the build
+    # (a duplicate archive means duplicate-symbol link errors)
+    external_short_names = {
+        _external_short_name(lib.name) for lib in external if lib.name
+    }
+
+    def _add_bundled_dependencies(component: ConvertedLibrary) -> None:
+        # A version-less bare name ("Hash") is a core-bundled library the
+        # shared converter cannot resolve from the registry
+        for dep in normalize_dependencies(
+            component.data.get("dependencies"), component.name
+        ):
+            # normalize_dependencies guarantees a non-empty str name
+            name = dep["name"]
+            final_dep_names.add(name)
+            if "/" in name:
+                owner, _, pkg = name.partition("/")
+                if _is_safe_library_name(owner) and _is_safe_library_name(pkg):
+                    # Owner-qualified; the converter resolves it from the registry
+                    continue
+            if not _is_safe_library_name(name):
+                # The name becomes a path component; never join a traversal
+                _LOGGER.warning(
+                    "Ignoring malformed dependency entry %r of library %s",
+                    dep,
+                    component.name,
+                )
+                continue
+            if name in external_short_names:
+                if _provided(name):
+                    # A bundled copy is suppressed; a coincidental name
+                    # collision would surface as link errors
+                    _LOGGER.warning(
+                        "Dependency %s of %s is assumed satisfied by a "
+                        "requested external library; the bundled copy is "
+                        "not added",
+                        name,
+                        component.name,
+                    )
+                else:
+                    _LOGGER.debug(
+                        "Dependency %s of %s assumed satisfied by a requested "
+                        "external library",
+                        name,
+                        component.name,
+                    )
+                continue
+            if name in bundled_names or is_lib_ignored(name, lib_ignore):
+                continue
+            if _url_or_none(dep.get("version")) is not None:
+                # A URL names one specific source; never add the bundled copy
+                continue
+            if dep.get("owner") or not _provided(name):
+                # Only owner-less framework-tree names take the bundled
+                # copy (PIO's process_dependencies); the walk reports drops
+                continue
+            try:
+                # framework=None: the walk already warned for non-platform
+                # causes; debug keeps one fault from warning twice (pinned
+                # by test_nonplatform_rejection_warns_once_through_real_converter)
+                check_library_data(dep, pio_platform, None)
+            except IncompatiblePlatform as err:
+                # A knowing skip (platform filter), not a broken promise
+                knowingly_skipped.add(name)
+                _LOGGER.debug("Skip bundled candidate %s: %s", name, err)
+                continue
+            except InvalidLibrary as err:
+                # Malformed manifest data never counts as satisfied; the
+                # walk owns the warning (see the warns-once test above)
+                _LOGGER.debug("Skip malformed bundled candidate %s: %s", name, err)
+                continue
+            # Deferred: a later manifest name may satisfy this
+            pending_bundled.setdefault(name)
+
+    def _emit(component: ConvertedLibrary) -> None:
+        apply_extra_script(
+            component, board_mcu=lambda: board_mcu, pio_platform=pio_platform
+        )
+        _assert_tree_has_code(
+            component.get_require_name(),
+            component.source_dir,
+            "the download may be incomplete (run 'esphome clean-all')",
+        )
+        if isinstance(manifest_name := component.data.get("name"), str):
+            converted_manifest_names.add(manifest_name)
+        lib = _library_info(
+            component.get_require_name(), component.source_dir, component.data
+        )
+        # Extra-script LINKFLAGS travel outside build.flags; dropping
+        # them would link wrong with no stated cause
+        lib.link_flags.extend(
+            component.data.get(ESPHOME_DATA_KEY, {}).get(
+                ESPHOME_DATA_LINK_FLAGS_KEY, []
+            )
+        )
+        converted.append(lib)
+        _add_bundled_dependencies(component)
+
+    backend = LibraryBackend(
+        platform=pio_platform,
+        framework=framework,
+        emit=_emit,
+        cache_key=cache_key,
+        # The walk must not resolve bundled names from the registry;
+        # _add_bundled_dependencies adds them after emit
+        provides=_provided,
+        manifest_optional=manifest_optional,
+    )
+    if external:
+        convert_libraries(external, backend)
+    for name in pending_bundled:
+        if name in converted_manifest_names:
+            # The converted library is this one; the bundled copy would
+            # double the archive. Warn like the external_short_names twin.
+            _LOGGER.warning(
+                "Dependency %s is assumed satisfied by a converted library's "
+                "manifest name; the bundled copy is not added",
+                name,
+            )
+            continue
+        bundled_names.add(name)
+        bundled.append(_bundled_library(framework_path, name))
+
+    _check_unfulfilled_provides(
+        backend.provided_requests,
+        bundled_names
+        | converted_manifest_names
+        | external_short_names
+        | knowingly_skipped,
+        final_dep_names,
+    )
+
+    return bundled + converted

esphome/arduino8266/__init__.py

@@ -0,0 +1,9 @@
+"""Native (PlatformIO-free) build support for the ESP8266 Arduino core.
+
+This package downloads the Arduino ESP8266 core and the xtensa-lx106
+toolchain, generates a ninja build for them plus the ESPHome sources, and
+drives the build directly — the ESP8266 equivalent of ``esphome.espidf``.
+
+Deliberately importable without the esp8266 component to avoid circular
+imports; the component wires these modules in via lazy imports.
+"""

esphome/arduino8266/framework.py

@@ -0,0 +1,214 @@
+"""Download and install the Arduino ESP8266 core, toolchain, and ninja.
+
+Artifacts land in a machine-global cache (shared across projects, like the
+ESP-IDF install in ``esphome.espidf.framework``):
+
+    <cache>/arduino8266/frameworks/<tag>/   the Arduino core
+    <cache>/arduino8266/toolchains/<tag>/   xtensa-lx106-elf gcc 10.3
+
+Both come from esphome-libs releases pinned below;
+``ESPHOME_ARDUINO8266_*_MIRRORS`` overrides the URLs, with ``{VERSION}``
+standing for the release tag. ninja comes from PATH or the ninja PyPI wheel.
+"""
+
+from __future__ import annotations
+
+import os
+from pathlib import Path
+from typing import NamedTuple
+
+from esphome.build_helpers.ccache import ccache_env
+from esphome.build_helpers.ninja import find_ninja
+from esphome.build_helpers.tools_cache import ARDUINO8266_TOOLS_CACHE, tools_cache_path
+from esphome.core import EsphomeError, Version
+from esphome.framework_helpers import str_to_lst_of_str
+from esphome.platformio.registry import (
+    Download,
+    Resolver,
+    get_systype,
+    install_package,
+    prefetch_packages,
+)
+
+FRAMEWORK_PACKAGE = "arduino-esp8266"
+_FRAMEWORK_RELEASES = "https://github.com/esphome-libs/arduino-esp8266/releases/"
+
+
+class FrameworkRelease(NamedTuple):
+    tag: str
+    sha256: str
+    size: int
+
+    def download(self) -> Download:
+        archive = f"{FRAMEWORK_PACKAGE}-{self.tag}.tar.gz"
+        url = f"{_FRAMEWORK_RELEASES}download/{self.tag}/{archive}"
+        return Download(url, self.sha256, self.size)
+
+
+# Arduino core version -> its build in esphome-libs/arduino-esp8266
+FRAMEWORK_RELEASES: dict[Version, FrameworkRelease] = {
+    Version(3, 1, 2): FrameworkRelease(
+        "3.1.2-esphome.1",
+        "e80751e3123676b967143e39c61f2d8693946db4c7806f2a83dcaaf797ecd582",
+        37189311,
+    ),
+}
+
+TOOLCHAIN_PACKAGE = "toolchain-xtensa-lx106-elf"
+# gcc 10.3, the toolchain Arduino core 3.x builds with; the build
+# generator's compile flags are tuned to it.
+TOOLCHAIN_VERSION = "10.3.0-esphome.2"
+_TOOLCHAIN_RELEASES = (
+    "https://github.com/esphome-libs/xtensa-lx106-elf-toolchain/releases/"
+)
+# Registry system tag -> (sha256, size) of that host's archive
+TOOLCHAIN_BUILDS: dict[str, tuple[str, int]] = {
+    "darwin_arm64": (
+        "849cede44d4d5c6ea0f14099783239f559f46327bea314281814f2652b486201",
+        60830321,
+    ),
+    "darwin_x86_64": (
+        "ca69904daabf0c5983b372423e5e62f49182a793e992c052e94666852470c897",
+        64149487,
+    ),
+    "linux_aarch64": (
+        "60a49a4f082bf246544bd409a9517dbbcab19bb30ac9decbee544b896aaccbd6",
+        67573397,
+    ),
+    "linux_x86_64": (
+        "1fba33ca1494ec79f2776e0e37eca93282d30f8bb9992f5f4f9a655d6fff1db4",
+        68431336,
+    ),
+    "windows_amd64": (
+        "af9066b0e5bf036f04f2bd9d08b89b81a7f183c57dac0abcaff71dd861cf5f3b",
+        67664137,
+    ),
+}
+
+ESPHOME_ARDUINO8266_FRAMEWORK_MIRRORS = str_to_lst_of_str(
+    os.environ.get("ESPHOME_ARDUINO8266_FRAMEWORK_MIRRORS", "")
+)
+ESPHOME_ARDUINO8266_TOOLCHAIN_MIRRORS = str_to_lst_of_str(
+    os.environ.get("ESPHOME_ARDUINO8266_TOOLCHAIN_MIRRORS", "")
+)
+
+
+def get_arduino8266_tools_path() -> Path:
+    # Machine-global so all projects share one install; see
+    # espidf.framework.get_idf_tools_path for the location rationale.
+    return tools_cache_path(*ARDUINO8266_TOOLS_CACHE)
+
+
+def framework_release(version: Version) -> FrameworkRelease:
+    if (release := FRAMEWORK_RELEASES.get(version)) is None:
+        raise EsphomeError(
+            f"'toolchain: arduino' has no build of Arduino core {version}; "
+            f"available: {', '.join(str(v) for v in FRAMEWORK_RELEASES)}. "
+            "Use one of those or 'toolchain: platformio'"
+        )
+    return release
+
+
+def get_framework_path(tag: str) -> Path:
+    return get_arduino8266_tools_path() / "frameworks" / tag
+
+
+def get_toolchain_path() -> Path:
+    return get_arduino8266_tools_path() / "toolchains" / TOOLCHAIN_VERSION
+
+
+def toolchain_download() -> Download:
+    """The toolchain archive for the current host."""
+    systype = get_systype()
+    if (build := TOOLCHAIN_BUILDS.get(systype)) is None:
+        raise EsphomeError(
+            f"There is no ESP8266 toolchain for this system ({systype}); "
+            f"supported systems are {', '.join(sorted(TOOLCHAIN_BUILDS))}. "
+            "Either set 'toolchain: platformio' under 'esp8266:', or point "
+            "ESPHOME_ARDUINO8266_TOOLCHAIN_MIRRORS at a toolchain archive"
+        )
+    sha256, size = build
+    archive = f"{TOOLCHAIN_PACKAGE}-{TOOLCHAIN_VERSION}-{systype}.tar.gz"
+    url = f"{_TOOLCHAIN_RELEASES}download/{TOOLCHAIN_VERSION}/{archive}"
+    return Download(url, sha256, size)
+
+
+class InstalledPaths(NamedTuple):
+    """Locations of the installed framework, toolchain, and ninja binary."""
+
+    framework: Path
+    toolchain: Path
+    ninja: Path
+
+
+def check_and_install(framework_version: Version) -> InstalledPaths:
+    """Ensure framework, toolchain, and ninja are installed; return their paths."""
+    release = framework_release(framework_version)
+    # Probe the cheap local dependency before ~110 MB of downloads
+    ninja_path = find_ninja()
+    framework_path = get_framework_path(release.tag)
+    downloads_dir = get_arduino8266_tools_path() / "downloads"
+    toolchain_path = get_toolchain_path()
+    # One spec per package: the prefetch and the installs must agree
+    specs = (
+        (
+            FRAMEWORK_PACKAGE,
+            release.tag,
+            framework_path,
+            ESPHOME_ARDUINO8266_FRAMEWORK_MIRRORS,
+            ("cores/esp8266", "tools/sdk", "libraries"),
+        ),
+        (
+            TOOLCHAIN_PACKAGE,
+            TOOLCHAIN_VERSION,
+            toolchain_path,
+            ESPHOME_ARDUINO8266_TOOLCHAIN_MIRRORS,
+            # xtensa-lx106-elf pins the target: every gcc package has a bin/
+            ("bin", "xtensa-lx106-elf"),
+        ),
+    )
+    # Resolved only when a download is needed, so an installed toolchain
+    # keeps working on a host without a build; a mirror override wins
+    resolvers: dict[str, Resolver] = {}
+    if not ESPHOME_ARDUINO8266_FRAMEWORK_MIRRORS:
+        resolvers[FRAMEWORK_PACKAGE] = release.download
+    if not ESPHOME_ARDUINO8266_TOOLCHAIN_MIRRORS:
+        resolvers[TOOLCHAIN_PACKAGE] = toolchain_download
+    # Fetch both archives at once; the installs below verify and extract
+    prefetch_packages([spec[:4] for spec in specs], downloads_dir, resolvers)
+    for name, version, dest, mirrors, expect in specs:
+        install_package(
+            name,
+            version,
+            dest,
+            mirrors,
+            downloads_dir,
+            expect=expect,
+            resolve=resolvers.get(name),
+        )
+    return InstalledPaths(
+        framework=framework_path, toolchain=toolchain_path, ninja=ninja_path
+    )
+
+
+def toolchain_tool(toolchain_path: Path, name: str) -> Path:
+    """Path to one toolchain tool (gcc, g++, ar, size, addr2line, ...).
+
+    The single owner of the ``bin/xtensa-lx106-elf-<name>`` layout and the
+    Windows suffix, so a toolchain package bump touches one spot.
+    """
+    suffix = ".exe" if os.name == "nt" else ""
+    return toolchain_path / "bin" / f"xtensa-lx106-elf-{name}{suffix}"
+
+
+def get_build_env(toolchain_path: Path, ccache: str | None) -> dict[str, str]:
+    env = os.environ.copy()
+    # Drop empty entries: a trailing separator from an absent PATH would
+    # make the shell search the current directory for tools
+    parts = [
+        str(toolchain_path / "bin"),
+        *filter(None, env.get("PATH", "").split(os.pathsep)),
+    ]
+    env["PATH"] = os.pathsep.join(parts)
+    env.update(ccache_env(ccache, ARDUINO8266_TOOLS_CACHE))
+    return env

esphome/arduino8266/toolchain.py

@@ -0,0 +1,212 @@
+"""Native Arduino ESP8266 build driver (the PlatformIO ``run`` equivalent)."""
+
+from __future__ import annotations
+
+import logging
+from pathlib import Path
+import subprocess
+from typing import TYPE_CHECKING
+
+from esphome.build_helpers.ccache import resolve_absolute_ccache_path
+from esphome.build_helpers.native import warn_ignored_platformio_options
+from esphome.build_helpers.ninja import refresh_compile_commands
+from esphome.const import (
+    CONF_COMPILE_PROCESS_LIMIT,
+    CONF_ESPHOME,
+    KEY_CORE,
+    KEY_FRAMEWORK_VERSION,
+)
+from esphome.core import CORE
+from esphome.types import ConfigType
+
+if TYPE_CHECKING:
+    from esphome.arduino8266.framework import InstalledPaths
+
+_LOGGER = logging.getLogger(__name__)
+
+# ESP8266 user RAM (matches upload.maximum_ram_size in every board manifest)
+_MAX_RAM_SIZE = 81920
+
+
+_RAM_SECTIONS = (".data", ".rodata", ".bss")
+_FLASH_SECTIONS = (".irom0.text", ".text", ".text1", ".data", ".rodata")
+
+
+def get_build_dir() -> Path:
+    return CORE.relative_pioenvs_path(CORE.name)
+
+
+def get_elf_path() -> Path:
+    return get_build_dir() / "firmware.elf"
+
+
+def _toolchain_tool(name: str) -> Path:
+    # Imported here, not at module scope: the serial upload/logs fast path
+    # resolves this module for its artifact paths alone, and framework
+    # pulls in the whole package-download stack
+    from esphome.arduino8266 import framework
+
+    return framework.toolchain_tool(framework.get_toolchain_path(), name)
+
+
+def get_factory_firmware_path() -> Path:
+    """The image to serial-flash at 0x0 (same bytes as firmware.bin: the
+    8266 factory copy exists for artifact-contract parity, not content)."""
+    return get_build_dir() / "firmware.factory.bin"
+
+
+def get_addr2line_path() -> Path:
+    return _toolchain_tool("addr2line")
+
+
+def get_objdump_path() -> Path:
+    return _toolchain_tool("objdump")
+
+
+def get_readelf_path() -> Path:
+    return _toolchain_tool("readelf")
+
+
+def run_compile(config: ConfigType, verbose: bool) -> int:
+    from esphome.arduino8266 import framework
+    from esphome.build_gen import arduino8266 as build_gen
+    from esphome.core.config import NATIVE_ARDUINO_CONSUMED_PIO_OPTIONS
+
+    warn_ignored_platformio_options(NATIVE_ARDUINO_CONSUMED_PIO_OPTIONS)
+    paths = framework.check_and_install(CORE.data[KEY_CORE][KEY_FRAMEWORK_VERSION])
+    # Resolved once: the probe is not free and three consumers need it
+    ccache = resolve_absolute_ccache_path()
+    ninja_changed = build_gen.write_project(paths, ccache)
+
+    build_dir = get_build_dir()
+    env = framework.get_build_env(paths.toolchain, ccache)
+    refresh_compile_commands(paths.ninja, build_dir, env, ninja_changed)
+
+    cmd = [str(paths.ninja)]
+    if verbose:
+        cmd.append("-v")
+    if jobs := config[CONF_ESPHOME].get(CONF_COMPILE_PROCESS_LIMIT):
+        cmd += ["-j", str(jobs)]
+    # Explicit targets: a generator defect that drops them fails loudly
+    # instead of a green no-op run leaving stale artifacts in place
+    targets = ["firmware.factory.bin", "firmware.ota.bin"]
+    cmd += targets
+
+    # cwd, not -C: drops ninja's "Entering directory" banner
+    _LOGGER.debug("Running: %s", " ".join(cmd))
+    rc = subprocess.run(
+        cmd, cwd=build_dir, env=env, check=False, close_fds=False
+    ).returncode
+    if rc != 0:
+        return rc
+
+    # ninja already refused missing targets; existence covers a rule that
+    # ran but wrote elsewhere
+    build_dir_artifacts = (
+        get_elf_path(),
+        build_dir / "firmware.bin",
+        get_factory_firmware_path(),
+        build_dir / "firmware.ota.bin",
+    )
+    for artifact in build_dir_artifacts:
+        if not artifact.is_file():
+            _LOGGER.error("Build produced no %s", artifact)
+            return 1
+
+    if not _print_size_summary(build_dir, paths):
+        # Cause already warned; name the consequence for CI harnesses
+        _LOGGER.warning("Firmware size summary unavailable for this build")
+    from esphome.build_helpers.idedata import warn_if_idedata_missing
+
+    warn_if_idedata_missing(lambda: get_idedata(ccache))
+    return 0
+
+
+def _parse_app_size(build_dir: Path, paths: InstalledPaths) -> int | None:
+    """Read the app flash budget (irom0_0_seg length) from the linker script."""
+    from esphome.build_gen.arduino8266 import get_flash_ld_path
+    from esphome.components.esp8266.build_surgery import segment_length
+
+    # Warnings, not debug: without the app size the Flash summary line is
+    # dropped and CI's memory-impact extraction loses its flash metric.
+    ld_path = get_flash_ld_path(build_dir, paths)
+    try:
+        ld_text = ld_path.read_text(encoding="utf-8")
+    except (OSError, UnicodeDecodeError) as err:
+        # A corrupt script degrades the same way, never aborts the build
+        _LOGGER.warning("Cannot read linker script for the Flash summary: %s", err)
+        return None
+    if not (app_size := segment_length(ld_text, "irom0_0_seg")):
+        _LOGGER.warning("No usable irom0_0_seg in %s; skipping Flash summary", ld_path)
+        return None
+    return app_size
+
+
+def _print_size_summary(build_dir: Path, paths: InstalledPaths) -> bool:
+    """Print the RAM/Flash lines ``ci_memory_impact_extract.py`` parses;
+    False when skipped."""
+    from esphome.arduino8266.framework import toolchain_tool
+    from esphome.build_helpers.size_summary import print_size_line
+
+    try:
+        result = subprocess.run(
+            [
+                str(toolchain_tool(paths.toolchain, "size")),
+                "-A",
+                "-d",
+                str(build_dir / "firmware.elf"),
+            ],
+            capture_output=True,
+            text=True,
+            check=True,
+            close_fds=False,
+        )
+    except (OSError, subprocess.CalledProcessError) as err:
+        # The summary is a bonus artifact like idedata; a truncated
+        # toolchain extraction must not discard an already-linked build
+        _LOGGER.warning("Could not summarize firmware size: %s", err)
+        return False
+    # -d prints decimal sizes; anything else trips the missing-sections guard
+    sections = {
+        parts[0]: int(parts[1])
+        for line in result.stdout.splitlines()
+        if (parts := line.split())[:1] and parts[0].startswith(".") and len(parts) >= 2
+        if parts[1].isdigit()
+    }
+    if missing := set(_RAM_SECTIONS + _FLASH_SECTIONS) - set(sections):
+        # A defaulted 0 would print a confidently wrong total for CI's metric
+        _LOGGER.warning(
+            "Size output is missing section(s) %s; skipping the size summary",
+            ", ".join(sorted(missing)),
+        )
+        return False
+    # Resolve the flash budget before printing: a RAM line without its
+    # Flash line would skew CI's memory-impact extraction
+    app_size = _parse_app_size(build_dir, paths)
+    if not app_size:
+        return False
+    ram = sum(sections[s] for s in _RAM_SECTIONS)
+    flash = sum(sections[s] for s in _FLASH_SECTIONS)
+    print_size_line("RAM", ram, _MAX_RAM_SIZE)
+    print_size_line("Flash", flash, app_size)
+    return True
+
+
+def get_idedata(ccache: str | None = None) -> dict | None:
+    """Derive idedata from the build's compile_commands.json (same
+    contract as ``espidf.toolchain.get_idedata``)."""
+    from esphome.build_helpers.idedata import load_or_build_idedata
+
+    # A disabled ccache resolves to None without spawning anything, so
+    # re-resolving here costs nothing when the caller has no answer
+    launcher = ccache or resolve_absolute_ccache_path()
+    return load_or_build_idedata(
+        get_build_dir() / "compile_commands.json",
+        get_elf_path(),
+        # Suffixed so a platformio->arduino->platformio round trip on one
+        # config never serves the other toolchain's cache shape
+        CORE.relative_internal_path("idedata", f"{CORE.name}.arduino.json"),
+        # The compile DB's commands carry the same ccache prefix the ninja
+        # rules were generated with
+        launcher=str(launcher) if launcher else None,
+    )

esphome/automation.py

@@ -1,5 +1,8 @@
+from collections.abc import Callable
 from dataclasses import dataclass, field
 import logging
+import string
+from typing import Any
 
 import esphome.codegen as cg
 import esphome.config_validation as cv
@@ -18,15 +21,17 @@ from esphome.const import (
     CONF_TYPE_ID,
     CONF_UPDATE_INTERVAL,
 )
-from esphome.core import ID, Lambda
+from esphome.core import CORE, ID, EsphomeError, Lambda
 from esphome.cpp_generator import (
+    FlashStringLiteral,
     LambdaExpression,
     MockObj,
     MockObjClass,
     TemplateArgsType,
+    call_lambda,
 )
 from esphome.schema_extractors import SCHEMA_EXTRACT, schema_extractor
-from esphome.types import ConfigType
+from esphome.types import ConfigType, SafeExpType
 from esphome.util import Registry
 
 
@@ -57,6 +62,7 @@ def maybe_conf(conf, *validators):
         with cv.remove_prepend_path([conf]):
             return validator({conf: value})
 
+    validate.inner_schema = validator
     return validate
 
 
@@ -102,6 +108,101 @@ def register_condition(name: str, condition_type: MockObjClass, schema: cv.Schem
     return CONDITION_REGISTRY.register(name, condition_type, schema)
 
 
+async def _build_with_parent(
+    config: ConfigType,
+    automation_id: ID,
+    template_arg: cg.TemplateArguments,
+    args: TemplateArgsType,
+) -> MockObj:
+    parent = await cg.get_variable(config[CONF_ID])
+    return cg.new_Pvariable(automation_id, template_arg, parent)
+
+
+async def _build_without_parent(
+    config: ConfigType,
+    automation_id: ID,
+    template_arg: cg.TemplateArguments,
+    args: TemplateArgsType,
+) -> MockObj:
+    return cg.new_Pvariable(automation_id, template_arg)
+
+
+async def _build_parented(
+    config: ConfigType,
+    automation_id: ID,
+    template_arg: cg.TemplateArguments,
+    args: TemplateArgsType,
+) -> MockObj:
+    var = cg.new_Pvariable(automation_id, template_arg)
+    await cg.register_parented(var, config[CONF_ID])
+    return var
+
+
+def register_simple_action(
+    name: str,
+    action_type: MockObjClass,
+    schema: cv.Schema,
+    *,
+    synchronous: bool,
+) -> None:
+    """Register an action whose constructor takes the object named by ``config[CONF_ID]``.
+
+    Use the ``register_action`` decorator instead when the builder must also set fields.
+    """
+    register_action(name, action_type, schema, synchronous=synchronous)(
+        _build_with_parent
+    )
+
+
+def register_simple_condition(
+    name: str, condition_type: MockObjClass, schema: cv.Schema
+) -> None:
+    """Condition counterpart of ``register_simple_action``."""
+    register_condition(name, condition_type, schema)(_build_with_parent)
+
+
+def register_bare_action(
+    name: str,
+    action_type: MockObjClass,
+    schema: cv.Schema,
+    *,
+    synchronous: bool,
+) -> None:
+    """Register an action whose constructor takes no arguments."""
+    register_action(name, action_type, schema, synchronous=synchronous)(
+        _build_without_parent
+    )
+
+
+def register_bare_condition(
+    name: str, condition_type: MockObjClass, schema: cv.Schema
+) -> None:
+    """Condition counterpart of ``register_bare_action``."""
+    register_condition(name, condition_type, schema)(_build_without_parent)
+
+
+def register_parented_action(
+    name: str,
+    action_type: MockObjClass,
+    schema: cv.Schema,
+    *,
+    synchronous: bool,
+) -> None:
+    """Register an action deriving from ``Parented<T>``.
+
+    The object is constructed without arguments and ``set_parent()`` receives the object
+    named by ``config[CONF_ID]``.
+    """
+    register_action(name, action_type, schema, synchronous=synchronous)(_build_parented)
+
+
+def register_parented_condition(
+    name: str, condition_type: MockObjClass, schema: cv.Schema
+) -> None:
+    """Condition counterpart of ``register_parented_action``."""
+    register_condition(name, condition_type, schema)(_build_parented)
+
+
 Action = cg.esphome_ns.class_("Action")
 Trigger = cg.esphome_ns.class_("Trigger")
 ACTION_REGISTRY = Registry()
@@ -112,6 +213,308 @@ validate_action_list = cv.validate_registry("action", ACTION_REGISTRY)
 validate_condition = cv.validate_registry_entry("condition", CONDITION_REGISTRY)
 validate_condition_list = cv.validate_registry("condition", CONDITION_REGISTRY)
 
+ApplyAction = cg.esphome_ns.class_("ApplyAction", Action)
+ApplyCondition = cg.esphome_ns.class_("ApplyCondition", Condition)
+
+
+def flash_string(config: ConfigType, value: str) -> str:
+    """Default renderer for ``std::string`` constants; copies the literal out of flash on ESP8266."""
+    if CORE.is_esp8266:
+        return f"progmem_string({FlashStringLiteral(value)})"
+    return str(cg.safe_exp(value))
+
+
+def literal_with_length(config: ConfigType, value: str) -> str:
+    """Renderer for a ``(const char *, size_t)`` target: a plain literal plus its byte length.
+
+    The target compares or copies the bytes in place, so it needs the RAM literal rather than
+    the PROGMEM rendering on ESP8266, and the length saves a strlen.
+    """
+    return f"{cg.safe_exp(value)}, {len(value.encode('utf-8'))}"
+
+
+@dataclass(frozen=True)
+class ApplyCall:
+    """One statement from config keys, e.g. ``"set_range({}, {})"`` with ``((CONF_LOW, cg.float_), ...)``.
+
+    Each arg is ``(conf_key, type_)`` or ``(conf_key, type_, const_fn)``. A ``conf_key`` may be a
+    path into nested sections. A plain ``str`` ``type_`` is raw C++ type text and may use
+    ``{parent}``. ``const_fn(config, value)`` renders a constant's argument text; a lambda or an
+    id bypasses it. The statement is skipped when none of its keys is set, always emitted when it
+    has no keys, and a partial set is a config error.
+    """
+
+    target: str
+    args: tuple[tuple[Any, ...], ...] = ()
+
+    def __post_init__(self) -> None:
+        fields = [
+            f for _, f, _, _ in string.Formatter().parse(self.target) if f is not None
+        ]
+        if any(fields):
+            raise ValueError(
+                f"apply target {self.target!r}: only bare {{}} placeholders"
+            )
+        if len(fields) != len(self.args):
+            raise ValueError(
+                f"apply target {self.target!r} has {len(fields)} "
+                f"placeholder(s) for {len(self.args)} config key(s)"
+            )
+        if any(len(arg) not in (2, 3) for arg in self.args):
+            raise ValueError(
+                f"apply target {self.target!r}: each arg is (conf_key, type_[, const_fn])"
+            )
+
+    @property
+    def members(self) -> list[tuple[Any, Any, Any]]:
+        """Each arg as ``(conf_key, type_, const_fn or None)``."""
+        return [
+            (arg[0], arg[1], arg[2] if len(arg) == 3 else None) for arg in self.args
+        ]
+
+
+@dataclass(frozen=True)
+class ApplyField:
+    """One config key forwarded as ``target(value)``, or as statement ``target`` when it has ``{}``.
+
+    Double a literal brace in a template. ``conf_key`` may be a path into nested sections.
+    ``type_`` may be a C++ type string using ``{parent}`` when the type is only known per
+    instance. ``const_fn(config, value)`` renders a constant's argument text when ``cg.safe_exp``
+    is not the right spelling (unit conversion belongs in the validator); a lambda or an id
+    bypasses it, so the target must also take a plain ``type_``. An absent key emits nothing.
+    """
+
+    conf_key: str | tuple[str, ...]
+    target: str
+    type_: SafeExpType
+    const_fn: Callable[[ConfigType, Any], str] | None = None
+
+    def call(self) -> ApplyCall:
+        target = self.target if "{}" in self.target else f"{self.target}({{}})"
+        return ApplyCall(target, ((self.conf_key, self.type_, self.const_fn),))
+
+
+def _config_lookup(config: ConfigType, key: str | tuple[str, ...]) -> Any:
+    if isinstance(key, str):
+        return config.get(key)
+    for part in key:
+        if (config := config.get(part)) is None:
+            return None
+    return config
+
+
+def _dict_schema(schema: Any) -> Any:
+    """The dict-backed cv.Schema inside cv.All and maybe_* wrappers, or None; cv.Any is not inspected."""
+    if isinstance(schema, dict):
+        return cv.Schema(schema)
+    if isinstance(getattr(schema, "schema", None), dict):
+        return schema
+    if isinstance(schema, cv.All):
+        inner = schema.validators
+    else:
+        inner = (
+            getattr(schema, "inner_schema", None),
+        )  # maybe_conf / maybe_simple_value
+    for candidate in inner:
+        if candidate is not None and (found := _dict_schema(candidate)) is not None:
+            return found
+    return None
+
+
+def _check_key_in_schema(
+    name: str, schema: Any, conf_key: str | tuple[str, ...]
+) -> None:
+    """Reject a key path the schema does not have; a typo would otherwise be a silent no-op.
+
+    Only dict-backed schemas, also inside cv.All and maybe_* wrappers, can be checked.
+    """
+    for part in (conf_key,) if isinstance(conf_key, str) else conf_key:
+        if (schema := _dict_schema(schema)) is None:
+            return
+        markers = {
+            getattr(marker, "schema", marker): marker for marker in schema.schema
+        }
+        if part not in markers:
+            raise ValueError(f"{name}: config key {part!r} is not in the schema")
+        schema = schema.schema[markers[part]]
+
+
+async def _apply_parent(config: ConfigType, id_key: str = CONF_ID) -> str:
+    # Global-scope qualified so a trigger arg named like the id cannot shadow it.
+    return f"::{await cg.get_variable(config[id_key])}"
+
+
+def _apply_lambda_args(args: TemplateArgsType) -> TemplateArgsType:
+    # The generated function's parameters; a std::string arg is never copied.
+    return [
+        (cg.RawExpression(f"const std::remove_cvref_t<{cg.safe_exp(t)}> &"), arg)
+        for t, arg in args
+    ]
+
+
+def _apply_function(
+    id_: ID,
+    return_type: SafeExpType,
+    template_arg: cg.TemplateArguments,
+    lambda_args: TemplateArgsType,
+    statements: list[str],
+) -> MockObj:
+    """Emit the generated function and declare ``id_`` as the ``ApplyAction`` or
+    ``ApplyCondition`` templated on it, so ``play()`` calls it directly."""
+    fn = cg.static_function(
+        f"esphome__{id_.id}__fn", return_type, lambda_args, statements
+    )
+    return cg.new_Pvariable(id_, cg.TemplateArguments(fn, *template_arg))
+
+
+async def _render_values(
+    name: str,
+    target: str,
+    members: list[tuple[Any, Any, Any]],
+    values: list[Any],
+    config: ConfigType,
+    parent: str,
+    lambda_args: TemplateArgsType,
+    compare: bool = False,
+) -> list[str]:
+    """Render the argument text of one statement; every key must be present.
+
+    ``compare``: an inlined lambda expression is parenthesized so it binds as a whole
+    beside an operator.
+    """
+    if any(value is None for value in values):
+        keys = [key for key, _, _ in members]
+        raise EsphomeError(f"{name}: {target!r} needs all of {keys}")
+    exprs: list[str] = []
+    for (_, type_, const_fn), value in zip(members, values, strict=True):
+        if isinstance(value, Lambda):
+            if isinstance(type_, str):
+                type_ = cg.RawExpression(type_.format(parent=parent))
+            inner = await cg.process_lambda(value, lambda_args, return_type=type_)
+            expr = call_lambda(inner)
+            bare = compare and isinstance(expr, cg.RawExpression)
+            exprs.append(f"({expr})" if bare else str(expr))
+        elif isinstance(value, ID):
+            # Qualified like the parent, so a trigger arg named like the id cannot shadow it.
+            exprs.append(f"::{await cg.get_variable(value)}")
+        elif const_fn is not None:
+            exprs.append(const_fn(config, value))
+        else:
+            exprs.append(str(cg.safe_exp(value)))
+    return exprs
+
+
+def _apply_values(config: ConfigType, members: list[tuple[Any, Any, Any]]) -> list[Any]:
+    return [_config_lookup(config, key) for key, _, _ in members]
+
+
+def register_apply_action(
+    name: str,
+    schema: cv.Schema,
+    *fields: ApplyField | ApplyCall,
+    call: str | None = None,
+    id_key: str = CONF_ID,
+) -> None:
+    """Register an action that only forwards config values to its parent, with no C++ class.
+
+    Generates one static function with the parent (read from ``id_key``) and constants baked
+    in, lambdas called inline with the trigger args, and an ``ApplyAction`` templated on it.
+    A constant that is an id (``cv.use_id`` under ``cv.templatable``) is the object it names.
+    With ``call`` every statement targets the call object ``auto apply_call = parent->call()``,
+    and ``apply_call.perform()`` is appended.
+    """
+    # An action stores the value, so a std::string constant stays in flash on ESP8266.
+    statements_spec = [
+        (
+            c.target,
+            [
+                (key, t, fn or (flash_string if t is cg.std_string else None))
+                for key, t, fn in c.members
+            ],
+        )
+        for c in (f if isinstance(f, ApplyCall) else f.call() for f in fields)
+    ]
+    _check_key_in_schema(name, schema, id_key)
+    for _, members in statements_spec:
+        for conf_key, _, _ in members:
+            _check_key_in_schema(name, schema, conf_key)
+
+    async def builder(
+        config: ConfigType,
+        action_id: ID,
+        template_arg: cg.TemplateArguments,
+        args: TemplateArgsType,
+    ) -> MockObj:
+        parent = await _apply_parent(config, id_key)
+        lambda_args = _apply_lambda_args(args)
+        receiver = "apply_call." if call else f"{parent}->"
+        statements: list[str] = []
+        for target, members in statements_spec:
+            values = _apply_values(config, members)
+            if members and all(value is None for value in values):
+                continue
+            exprs = await _render_values(
+                name, target, members, values, config, parent, lambda_args
+            )
+            statements.append(f"{receiver}{target.format(*exprs)};")
+        if call:
+            statements = [
+                f"auto apply_call = {parent}->{call}();",
+                *statements,
+                "apply_call.perform();",
+            ]
+        return _apply_function(
+            action_id, cg.void, template_arg, lambda_args, statements
+        )
+
+    register_action(name, ApplyAction, schema, synchronous=True)(builder)
+
+
+def register_apply_condition(
+    name: str, schema: cv.Schema, check: str | ApplyCall, id_key: str = CONF_ID
+) -> None:
+    """Register a condition that is one expression on its parent, with no C++ class.
+
+    ``check`` is applied to the parent: ``"is_playing()"`` becomes ``parent->is_playing()``; an
+    ``ApplyCall`` such as ``ApplyCall("state == {}", ((CONF_STATE, cg.bool_),))`` compares
+    against config values, all of which must be present. Write ``== false`` to negate.
+    String constants are plain literals, so compare a ``std::string`` or ``StringRef`` member.
+    Generates one static predicate and an ``ApplyCondition`` templated on it.
+    """
+    call = check if isinstance(check, ApplyCall) else ApplyCall(check)
+    members = call.members
+    _check_key_in_schema(name, schema, id_key)
+    for conf_key, _, _ in members:
+        _check_key_in_schema(name, schema, conf_key)
+
+    async def builder(
+        config: ConfigType,
+        condition_id: ID,
+        template_arg: cg.TemplateArguments,
+        args: TemplateArgsType,
+    ) -> MockObj:
+        parent = await _apply_parent(config, id_key)
+        lambda_args = _apply_lambda_args(args)
+        exprs = await _render_values(
+            name,
+            call.target,
+            members,
+            _apply_values(config, members),
+            config,
+            parent,
+            lambda_args,
+            compare=True,
+        )
+        return _apply_function(
+            condition_id,
+            cg.bool_,
+            template_arg,
+            lambda_args,
+            [f"return {parent}->{call.target.format(*exprs)};"],
+        )
+
+    register_condition(name, ApplyCondition, schema)(builder)
+
 
 def validate_potentially_and_condition(value):
     if isinstance(value, list):
@@ -359,28 +762,15 @@ async def for_condition_to_code(
     return var
 
 
-@register_condition(
+register_apply_condition(
     "component.is_idle",
-    LambdaCondition,
     maybe_simple_id(
         {
             cv.Required(CONF_ID): cv.use_id(cg.Component),
         }
     ),
+    "is_idle()",
 )
-async def component_is_idle_condition_to_code(
-    config: ConfigType,
-    condition_id: ID,
-    template_arg: cg.TemplateArguments,
-    args: TemplateArgsType,
-) -> MockObj:
-    comp = await cg.get_variable(config[CONF_ID])
-    lambda_ = await cg.process_lambda(
-        Lambda(f"return {comp}->is_idle();"), args, return_type=bool
-    )
-    return new_lambda_pvariable(
-        condition_id, lambda_, StatelessLambdaCondition, template_arg
-    )
 
 
 @register_action(
@@ -534,44 +924,20 @@ async def lambda_action_to_code(
     return new_lambda_pvariable(action_id, lambda_, StatelessLambdaAction, template_arg)
 
 
-@register_action(
+register_simple_action(
     "component.update",
     UpdateComponentAction,
-    maybe_simple_id(
-        {
-            cv.Required(CONF_ID): cv.use_id(cg.PollingComponent),
-        }
-    ),
+    maybe_simple_id({cv.Required(CONF_ID): cv.use_id(cg.PollingComponent)}),
     synchronous=True,
 )
-async def component_update_action_to_code(
-    config: ConfigType,
-    action_id: ID,
-    template_arg: cg.TemplateArguments,
-    args: TemplateArgsType,
-) -> MockObj:
-    comp = await cg.get_variable(config[CONF_ID])
-    return cg.new_Pvariable(action_id, template_arg, comp)
 
 
-@register_action(
+register_simple_action(
     "component.suspend",
     SuspendComponentAction,
-    maybe_simple_id(
-        {
-            cv.Required(CONF_ID): cv.use_id(cg.PollingComponent),
-        }
-    ),
+    maybe_simple_id({cv.Required(CONF_ID): cv.use_id(cg.PollingComponent)}),
     synchronous=True,
 )
-async def component_suspend_action_to_code(
-    config: ConfigType,
-    action_id: ID,
-    template_arg: cg.TemplateArguments,
-    args: TemplateArgsType,
-) -> MockObj:
-    comp = await cg.get_variable(config[CONF_ID])
-    return cg.new_Pvariable(action_id, template_arg, comp)
 
 
 @register_action(

esphome/build_gen/build_tool.py

@@ -0,0 +1,108 @@
+"""Tiny cross-platform build steps invoked from the generated ninja file.
+
+Plain script (not ``python -m``): it runs from ninja with whatever Python
+started esphome and must not depend on the package being importable.
+
+Subcommands:
+    ar <ar-binary> <archive> <rspfile>   remove stale archive, then ``ar rcs``
+    copy <src> <dst>                     copy a file
+
+The ar rspfile carries one object path per line (the generating rule must
+use ``$in_newline``, never ``$in``).
+"""
+
+from pathlib import Path
+import shutil
+import subprocess
+import sys
+
+
+def _read_rspfile(rspfile: str) -> list[str]:
+    r"""The object paths listed in ``rspfile``, unquoted.
+
+    GNU ar treats backslashes in response files as escapes (corrupts
+    Windows paths), so the caller expands the list into argv; strip the
+    simple surrounding quote ninja adds to special paths, then undo
+    ninja's POSIX escape for an embedded quote ('a'\\''b.o' -> a'b.o).
+    """
+    return [
+        line[1:-1].replace("'\\''", "'")
+        if len(line) >= 2 and line[0] == line[-1] and line[0] in "'\""
+        else line
+        for line in Path(rspfile).read_text(encoding="utf-8").splitlines()
+        if line
+    ]
+
+
+def _run_ar(ar: str, archive: str, rspfile: str) -> int:
+    # Remove first: ``ar rcs`` replaces members but never drops ones whose
+    # source was removed from the build, which would leak stale objects.
+    Path(archive).unlink(missing_ok=True)
+    objects = _read_rspfile(rspfile)
+    if not objects:
+        # An empty archive would "succeed" here and fail far away at link
+        print(f"ar: no objects listed in {rspfile} for {archive}", file=sys.stderr)
+        return 1
+    # Batch by argv length: expanding the rspfile gives back the Windows
+    # 32767-char command-line limit it existed to avoid. "rcs" creates,
+    # "qs" appends; the s keeps the symbol index explicit on every ar.
+    op = "rcs"
+    ok = False
+    try:
+        while objects:
+            batch = [objects.pop(0)]
+            batch_len = len(batch[0])
+            while objects and batch_len + len(objects[0]) < 25000:
+                batch_len += len(objects[0]) + 1
+                batch.append(objects.pop(0))
+            rc = subprocess.run(
+                [ar, op, archive, *batch], check=False, close_fds=False
+            ).returncode
+            if rc != 0:
+                return rc
+            op = "qs"
+        ok = True
+        return 0
+    finally:
+        if not ok:
+            # Any failure (bad exit, missing ar binary, interrupt) must not
+            # leave a truncated archive behind
+            Path(archive).unlink(missing_ok=True)
+
+
+def _run_copy(src: str, dst: str) -> int:
+    try:
+        shutil.copyfile(src, dst)
+    except OSError as err:
+        # Never leave a partially written output (e.g. a firmware image);
+        # SameFileError means dst IS src, where unlinking destroys the input
+        if not isinstance(err, shutil.SameFileError):
+            Path(dst).unlink(missing_ok=True)
+        print(f"copy: {src} -> {dst} failed: {err}", file=sys.stderr)
+        return 1
+    return 0
+
+
+# mode -> (handler, expected operand count); surplus argv means a
+# mis-specified ninja rule and must error, not silently drop operands
+_MODES = {"ar": (_run_ar, 3), "copy": (_run_copy, 2)}
+
+
+def main() -> int:
+    mode = sys.argv[1] if len(sys.argv) > 1 else ""
+    if entry := _MODES.get(mode):
+        handler, argc = entry
+        args = sys.argv[2:]
+        if len(args) != argc:
+            print(
+                f"build_tool {mode}: expected {argc} arguments, got {len(args)}",
+                file=sys.stderr,
+            )
+            return 1
+        return handler(*args)
+    print(f"unknown build_tool mode: {mode}", file=sys.stderr)
+    return 1
+
+
+if __name__ == "__main__":  # pragma: no cover
+    sys.exit(main())

esphome/build_gen/espidf.py

@@ -1,11 +1,21 @@
 """ESP-IDF direct build generator for ESPHome."""
 
 import json
+import logging
 from pathlib import Path
+import re
+import textwrap
 
-from esphome.components.esp32 import get_esp32_variant, idf_version
+from esphome.build_helpers import pch
+from esphome.components.esp32 import (
+    get_esp32_variant,
+    get_excluded_builtin_components,
+    get_managed_component_require_names,
+    idf_version,
+)
 import esphome.config_validation as cv
 from esphome.core import CORE
+from esphome.espidf import variant_to_idf_target
 from esphome.framework_helpers import (
     get_project_compile_flags,
     get_project_cxx_compile_flags,
@@ -13,6 +23,8 @@ from esphome.framework_helpers import (
 )
 from esphome.helpers import mkdir_p, write_file_if_changed
 
+_LOGGER = logging.getLogger(__name__)
+
 # Replaces the IDF default C++ standard (-std=gnu++2b appended to
 # CXX_COMPILE_OPTIONS by project.cmake's __build_init) with the one set via
 # cg.set_cpp_standard(). Emitted between include(project.cmake) and project(),
@@ -26,11 +38,12 @@ idf_build_set_property(CXX_COMPILE_OPTIONS "${{esphome_cxx_compile_options}}")""
 
 
 def get_available_components() -> list[str] | None:
-    """Get list of built-in ESP-IDF components from project_description.json.
+    """List the built-in ESP-IDF components from ``project_description.json``.
 
-    Excludes ``src``, IDF-managed components (``managed_components/``), and
-    converted PIO libs (``pio_components/``). Returns ``None`` if the build
-    dir or ``project_description.json`` isn't ready yet.
+    Only components below its ``idf_path/components`` count, which leaves out
+    ``src``, IDF-managed components, converted PIO libs and project local
+    ones such as the Arduino ``component_stubs``. Returns ``None`` if the
+    build dir or ``project_description.json`` isn't ready yet.
     """
     if CORE.build_path is None:
         return None
@@ -41,45 +54,124 @@ def get_available_components() -> list[str] | None:
     try:
         with project_desc.open(encoding="utf-8") as f:
             data = json.load(f)
-
-        component_info = data.get("build_component_info", {})
-
-        result = []
-        for name, info in component_info.items():
-            # Exclude our own src component
-            if name == "src":
-                continue
-
-            # Exclude IDF-managed and converted-PIO components (external).
-            comp_dir = info.get("dir", "")
-            if "managed_components" in comp_dir or "pio_components" in comp_dir:
-                continue
-
-            result.append(name)
-
-        return result
-    except (json.JSONDecodeError, OSError):
+        root = (Path(data["idf_path"]) / "components").resolve()
+        result = [
+            name
+            for name, info in data.get("build_component_info", {}).items()
+            if (comp_dir := info.get("dir"))
+            and Path(comp_dir).resolve().is_relative_to(root)
+        ]
+    except (json.JSONDecodeError, KeyError, OSError) as err:
+        _LOGGER.debug("Could not read %s: %s", project_desc, err)
         return None
+    if not result:
+        _LOGGER.warning("No ESP-IDF components found under %s", root)
+    return result
 
 
 def has_discovered_components() -> bool:
-    """Check if we have discovered components from a previous configure."""
-    return get_available_components() is not None
+    """Check if a previous configure discovered any built-in components."""
+    return bool(get_available_components())
 
 
-def get_project_cmakelists(minimal: bool = False) -> str:
+def _cmake_quote(value: str) -> str:
+    """Quote a cmake arg value for a set() line. add_cmake_arg rejects
+    whitespace, quotes, and '$', so only backslashes need escaping."""
+    escaped = value.replace("\\", "\\\\")
+    return f'"{escaped}"'
+
+
+# CONFIG_APP_BUILD_BOOTLOADER is hidden and force-selected, so it can only be
+# cleared at the CMake level (the same state IDF's RAM-app build type uses).
+# The macro is IDF's __build_process_project_includes plus two added lines;
+# esphome.espidf.bootloader falls back to in-tree if an IDF update changes it.
+IDF_BOOTLOADER_OVERRIDE = """\
+# ESPHome cached bootloader switch; see esphome/espidf/bootloader.py.
+if(ESPHOME_USE_CACHED_BOOTLOADER)
+    macro(__build_process_project_includes)
+        idf_build_get_property(sdkconfig_cmake SDKCONFIG_CMAKE)
+        include(${sdkconfig_cmake})
+        set(CONFIG_APP_BUILD_BOOTLOADER "")
+        # bt's CMakeLists reads the lowercase idf_target that the (now
+        # skipped) bootloader project_include leaks; keep it defined, or
+        # its empty TARGET_SRC_NAME sends file(GLOB_RECURSE) across /.
+        idf_build_get_property(idf_target IDF_TARGET)
+        idf_build_get_property(build_properties __BUILD_PROPERTIES)
+        foreach(build_property ${build_properties})
+            idf_build_get_property(val ${build_property})
+            set(${build_property} "${val}")
+        endforeach()
+        idf_build_get_property(build_component_targets __BUILD_COMPONENT_TARGETS)
+        foreach(component_target ${build_component_targets})
+            __component_get_property(dir ${component_target} COMPONENT_DIR)
+            __component_get_property(_name ${component_target} COMPONENT_NAME)
+            set(COMPONENT_NAME ${_name})
+            set(COMPONENT_DIR ${dir})
+            set(COMPONENT_PATH ${dir})
+            if(EXISTS ${COMPONENT_DIR}/project_include.cmake)
+                include(${COMPONENT_DIR}/project_include.cmake)
+            endif()
+        endforeach()
+    endmacro()
+endif()
+"""
+
+# The lines the override adds to IDF's macro; the staleness tripwire in
+# esphome.espidf.bootloader strips them before comparing with the live macro.
+BOOTLOADER_OVERRIDE_ADDED_LINES = (
+    'set(CONFIG_APP_BUILD_BOOTLOADER "")',
+    "idf_build_get_property(idf_target IDF_TARGET)",
+)
+
+_MACRO = re.compile(
+    r"macro\(__build_process_project_includes\)(.*?)endmacro\(\)", re.DOTALL
+)
+
+
+def _normalized_macro(text: str) -> list[str] | None:
+    """The macro body as comment-free, whitespace-collapsed lines."""
+    if (match := _MACRO.search(text)) is None:
+        return None
+    return [
+        re.sub(r"\s+", " ", line)
+        for raw in match.group(1).splitlines()
+        if (line := raw.split("#", 1)[0].strip())
+    ]
+
+
+_EXPECTED_MACRO = [
+    line
+    for line in _normalized_macro(IDF_BOOTLOADER_OVERRIDE)
+    if line not in BOOTLOADER_OVERRIDE_ADDED_LINES
+]
+
+
+def idf_macro_matches() -> bool:
+    """Whether IDF's macro still matches the copy the override replays."""
+    from esphome.espidf import toolchain
+
+    # pylint: disable-next=protected-access
+    build_cmake = toolchain._get_idf_path() / "tools" / "cmake" / "build.cmake"
+    live = _normalized_macro(build_cmake.read_text(encoding="utf-8"))
+    return live == _EXPECTED_MACRO
+
+
+def get_project_cmakelists(
+    minimal: bool = False, builtin_components: list[str] | None = None
+) -> str:
     """Generate the top-level CMakeLists.txt for ESP-IDF project.
 
     When ``minimal`` is true, omit ``ESPHOME_PROJECT_BUILTIN_COMPONENTS``
     since ``project_description.json`` may be stale on the first write.
+    ``builtin_components`` supplies the discovered list (from the cache)
+    instead of reading it from ``project_description.json``.
     """
-    # Get IDF target from ESP32 variant (e.g., ESP32S3 -> esp32s3)
-    variant = get_esp32_variant()
-    idf_target = variant.lower().replace("-", "")
+    idf_target = variant_to_idf_target(get_esp32_variant())
 
-    # esp_idf_size 2.x (bundled with IDF >=6.0) made NG the default and
-    # removed the --ng flag; on 1.x (IDF 5.5) --ng is required to get
-    # --format=raw because the legacy mode doesn't support it.
+    # esp_idf_size 2.x (IDF >=6.0) made NG the default and removed --ng;
+    # 1.x (IDF 5.5) needs --ng for --format=json2. 1.x json2 also lacks
+    # total_size, hence the ELF fallback in espidf/size_summary.py; both
+    # go away together when 1.x support is dropped.
     size_ng_flag = "--ng" if idf_version() < cv.Version(6, 0, 0) else ""
 
     # Project-wide compile options: -D defines and -W warning flags (skip
@@ -109,6 +201,15 @@ def get_project_cmakelists(minimal: bool = False) -> str:
         else ""
     )
 
+    # CMake variables registered via cg.add_cmake_arg(). Emitted before
+    # include(project.cmake) so values like EXCLUDE_COMPONENTS are already
+    # set when project.cmake seeds the component list, and on minimal
+    # (discovery) writes too so excluded components never register.
+    cmake_args = "\n".join(
+        f"set({name} {_cmake_quote(value)})"
+        for name, value in sorted(CORE.cmake_args.items())
+    )
+
     # Per-project list exposed as a CMake variable so converted PIO libs
     # can reference ${ESPHOME_PROJECT_MANAGED_COMPONENTS} without baking
     # project-specific names into their cached CMakeLists.
@@ -119,8 +220,6 @@ def get_project_cmakelists(minimal: bool = False) -> str:
     # runs as a separate CMake script invocation that doesn't load the
     # project's top-level CMakeLists; without this, ${ESPHOME_PROJECT_
     # MANAGED_COMPONENTS} in a converted-lib REQUIRES expands to empty).
-    from esphome.components.esp32 import get_managed_component_require_names
-
     managed_components_property = "\n".join(
         f"idf_build_set_property(ESPHOME_PROJECT_MANAGED_COMPONENTS {name} APPEND)"
         for name in get_managed_component_require_names()
@@ -131,12 +230,24 @@ def get_project_cmakelists(minimal: bool = False) -> str:
     # component's REQUIRES including real IDF components). Referenced by
     # src/CMakeLists and by each converted PIO lib's CMakeLists. Skipped
     # on minimal writes because project_description.json may be stale.
+    # Excluded components are dropped here as well: a stale
+    # project_description.json from a build without exclusions may still
+    # list them, and requiring an excluded component pulls it back into
+    # the build (IDF requirement expansion overrides EXCLUDE_COMPONENTS).
+    # Derived from the EXCLUDE_COMPONENTS cmake arg emitted above so the
+    # two can never disagree within one generated file.
     builtin_components_property = (
         ""
         if minimal
         else "\n".join(
             f"idf_build_set_property(ESPHOME_PROJECT_BUILTIN_COMPONENTS {name} APPEND)"
-            for name in sorted(get_available_components() or [])
+            for name in sorted(
+                set(
+                    builtin_components
+                    if builtin_components is not None
+                    else get_available_components() or []
+                ).difference(CORE.cmake_args.get("EXCLUDE_COMPONENTS", "").split(";"))
+            )
         )
     )
 
@@ -163,8 +274,11 @@ set(CMAKE_NINJA_FORCE_RESPONSE_FILE 1)
 set(IDF_TARGET {idf_target})
 set(EXTRA_COMPONENT_DIRS ${{CMAKE_SOURCE_DIR}}/src)
 
+{cmake_args}
+
 include($ENV{{IDF_PATH}}/tools/cmake/project.cmake)
 
+{IDF_BOOTLOADER_OVERRIDE}
 {cpp_standard_options}
 
 {cxx_compile_options}
@@ -177,10 +291,19 @@ include($ENV{{IDF_PATH}}/tools/cmake/project.cmake)
 
 project({CORE.name})
 
-# Emit raw JSON size data for ESPHome to read post-build.
+# Record the bootloader customization channels the cache cannot replay;
+# esphome.espidf.bootloader bypasses the cache when any is non-empty.
+idf_build_get_property(esphome_bl_dirs BOOTLOADER_EXTRA_COMPONENT_DIRS)
+idf_build_get_property(esphome_bl_args EXTRA_CMAKE_ARGS)
+file(WRITE ${{CMAKE_BINARY_DIR}}/esphome_bootloader_hooks.txt
+     "${{esphome_bl_dirs}}${{BOOTLOADER_IGNORE_EXTRA_COMPONENT}}${{esphome_bl_args}}")
+
+# Emit per-memory-type JSON size data for ESPHome to read post-build.
+# json2 stays small; raw dumps every symbol (~2s on a large map) and
+# this command runs inside the link edge, blocking everything downstream.
 add_custom_command(
     TARGET ${{CMAKE_PROJECT_NAME}}.elf POST_BUILD
-    COMMAND ${{PYTHON}} -m esp_idf_size {size_ng_flag} --format=raw
+    COMMAND ${{PYTHON}} -m esp_idf_size {size_ng_flag} --format=json2
             -o ${{CMAKE_BINARY_DIR}}/esp_idf_size.json
             ${{CMAKE_PROJECT_NAME}}.map
     WORKING_DIRECTORY ${{CMAKE_BINARY_DIR}}
@@ -245,10 +368,75 @@ idf_component_register(
 target_link_options(${{COMPONENT_LIB}} PUBLIC
     {link_opts_str}
 )
+{_pch_cmake_block()}"""
+
+
+# Where CMake puts the .gch of the src component; ccache reads the checksum
+# next to it in place of the .gch
+_PCH_SUM_PATH = "build/esp-idf/src/CMakeFiles/__idf_src.dir/cmake_pch.hxx.gch.sum"
+# Where the Windows gate records its choice
+_PCH_CHOICE_VAR = "ESPHOME_PCH"
+
+
+def _pch_cmake_block() -> str:
+    """The CMake block that precompiles the core headers for the C++ sources
+    of the src component; empty when disabled."""
+    if not pch.pch_enabled():
+        return ""
+    headers = "\n".join(
+        f'    "$<$<COMPILE_LANGUAGE:CXX>:${{CMAKE_CURRENT_SOURCE_DIR}}/{header}>"'
+        for header in pch.PCH_DEFAULT_HEADERS
+    )
+    block = f"""target_precompile_headers(${{COMPONENT_LIB}} PRIVATE
+{headers}
+)"""
+    if not pch.pch_needs_gcc_check():
+        return f"\n# ESPHome precompiled header\n{block}\n"
+    # Before the first configure only CMake knows the compiler version
+    return f"""
+# ESPHome precompiled header, unless GCC bug 14940 keeps it from loading
+if(CMAKE_CXX_COMPILER_ID STREQUAL "GNU" AND ({pch.PCH_WINDOWS_CMAKE_OLD_GCC}))
+  message(STATUS "ESPHome: GCC ${{CMAKE_CXX_COMPILER_VERSION}} cannot load a precompiled header on Windows; compiling without it")
+  set({_PCH_CHOICE_VAR} OFF CACHE BOOL "ESPHome precompiled header in use" FORCE)
+else()
+  set({_PCH_CHOICE_VAR} ON CACHE BOOL "ESPHome precompiled header in use" FORCE)
+{textwrap.indent(block, "  ")}
+endif()
 """
 
 
-def write_project(minimal: bool = False) -> None:
+def _read_if_exists(path: Path) -> str:
+    return path.read_text(encoding="utf-8") if path.is_file() else ""
+
+
+def write_pch_checksum() -> None:
+    """Write the checksum ccache uses in place of the .gch: the core headers,
+    the framework version, the sdkconfig and the managed component versions."""
+    from esphome.espidf.toolchain import get_cmake_cache_value
+
+    if not pch.pch_enabled():
+        return
+    # The gate's choice, cached by configure
+    if pch.pch_needs_gcc_check() and get_cmake_cache_value(_PCH_CHOICE_VAR) != "ON":
+        return
+    pch.log_pch_in_use()
+    checksum = pch.pch_checksum(
+        CORE.relative_src_path(),
+        pch.PCH_DEFAULT_HEADERS,
+        (
+            str(idf_version()),
+            _read_if_exists(CORE.relative_build_path(f"sdkconfig.{CORE.name}")),
+            _read_if_exists(CORE.relative_build_path("dependencies.lock")),
+        ),
+    )
+    path = CORE.relative_build_path(_PCH_SUM_PATH)
+    path.parent.mkdir(parents=True, exist_ok=True)
+    write_file_if_changed(path, checksum + "\n")
+
+
+def write_project(
+    minimal: bool = False, builtin_components: list[str] | None = None
+) -> None:
     """Write ESP-IDF project files."""
     mkdir_p(CORE.build_path)
     mkdir_p(CORE.relative_src_path())
@@ -256,7 +444,7 @@ def write_project(minimal: bool = False) -> None:
     # Write top-level CMakeLists.txt
     write_file_if_changed(
         CORE.relative_build_path("CMakeLists.txt"),
-        get_project_cmakelists(minimal=minimal),
+        get_project_cmakelists(minimal=minimal, builtin_components=builtin_components),
     )
 
     # Write component CMakeLists.txt in src/
@@ -264,3 +452,13 @@ def write_project(minimal: bool = False) -> None:
         CORE.relative_src_path("CMakeLists.txt"),
         get_component_cmakelists(),
     )
+
+    # Snapshot the exclusion set so has_outdated_files() can trigger a
+    # discovery reconfigure when it changes. Excluded components never
+    # register in project_description.json, so re-including one (e.g. a
+    # config gains mqtt) requires a fresh discovery pass before the
+    # ESPHOME_PROJECT_BUILTIN_COMPONENTS property can list it.
+    write_file_if_changed(
+        CORE.relative_build_path("exclude_components.esphomeinternal"),
+        ";".join(get_excluded_builtin_components()),
+    )

esphome/build_gen/host.py

@@ -0,0 +1,303 @@
+"""Native ninja build generator for the host platform.
+
+Emits ``build.ninja`` under ``.pioenvs/<name>/``: every source in the
+generated ``src/`` tree plus the resolved registry libraries compiles with
+the machine's compiler and links into ``program``, the name PlatformIO's
+native platform produced. Build flags route the way SCons's ``ParseFlags``
+did under PlatformIO: ``-D``/``-I``/``-std=``/``-W`` shapes reach the
+compile lines only, ``-l``/``-L``/``-Wl,`` the link line only, everything
+else both.
+"""
+
+from __future__ import annotations
+
+from collections.abc import Iterable
+import logging
+import os
+from pathlib import Path
+import subprocess
+import sys
+from typing import TYPE_CHECKING
+
+from esphome.build_helpers.ninja import escape as _e, quote_path as _q, shell_token
+from esphome.build_helpers.ninja_gen import (
+    PATH_ARG_FLAGS,
+    Flag,
+    anchor_path_flag,
+    ar_rule_lines,
+    collect_sources,
+    compile_edges,
+    compile_rule_lines,
+    library_edges,
+    pch_edges,
+    pch_rule_lines,
+    tool_lines,
+)
+from esphome.build_helpers.pch import PCH_DEFAULT_HEADERS, pch_enabled
+from esphome.core import CORE, EsphomeError
+from esphome.framework_helpers import get_project_cxx_compile_flags
+from esphome.helpers import mkdir_p, write_file_if_changed
+from esphome.host.toolchain import PROGRAM_NAME, HostCompilers, find_tool, get_build_dir
+from esphome.platformio.library import lex_build_flags
+
+if TYPE_CHECKING:
+    from esphome.arduino.library import ArduinoLibrary
+
+_LOGGER = logging.getLogger(__name__)
+
+# The PlatformIO platform the host built under; registry manifests declare
+# compatibility against it, as lib_compat_mode=strict checked before
+PIO_PLATFORM = "native"
+# Namespaces the shared library download cache (pio_components/host/)
+LIBRARY_CACHE_KEY = "host"
+
+# Flag shapes that only the compiler understands; dropped from the link line
+_COMPILE_ONLY_PREFIXES = ("-D", "-U", "-I", "-std=", "-W", *PATH_ARG_FLAGS)
+# Flag shapes that only the linker consumes; inert on a -c compile line
+_LINK_ONLY_PREFIXES = ("-l", "-L", "-Wl,")
+# Link-only flags whose argument is the next token
+_LINK_ONLY_ARG_FLAGS = ("-framework", "-Xlinker", "-z")
+
+
+def parse_flags(entries: Iterable[str], owner: str) -> list[Flag]:
+    """Lex build flag entries into flags, each with its argument.
+
+    Entries are a set, so their order is not the user's: a flag and the
+    argument it takes as the next token must share one entry.
+    """
+    flags: list[Flag] = []
+    for entry in entries:
+        it = iter(lex_build_flags(entry, owner))
+        for tok in it:
+            if tok not in PATH_ARG_FLAGS and tok not in _LINK_ONLY_ARG_FLAGS:
+                flags.append((tok,))
+                continue
+            arg = next(it, None)
+            # A path never starts with "-"; that is the next flag
+            if arg is None or (tok in PATH_ARG_FLAGS and arg.startswith("-")):
+                raise EsphomeError(
+                    f"{owner} build flags have '{tok}' with no argument; write "
+                    f"the flag and its argument as one entry"
+                )
+            flags.append((tok, arg))
+    return flags
+
+
+def split_flags(flags: list[Flag]) -> tuple[list[Flag], list[Flag]]:
+    """Route build flags to the compile and link lines."""
+    compile_flags: list[Flag] = []
+    link_flags: list[Flag] = []
+    for flag in flags:
+        name = flag[0]
+        if len(flag) > 1:
+            (compile_flags if name in PATH_ARG_FLAGS else link_flags).append(flag)
+        elif name.startswith(_LINK_ONLY_PREFIXES):
+            # Checked before the compile prefixes: -Wl, would match -W
+            link_flags.append(flag)
+        elif name.startswith(_COMPILE_ONLY_PREFIXES):
+            compile_flags.append(flag)
+        else:
+            # -g, -O, -f*, -m*, -pthread, --coverage: both lines, as SCons
+            compile_flags.append(flag)
+            link_flags.append(flag)
+    return compile_flags, link_flags
+
+
+def _is_std(flag: Flag) -> bool:
+    return flag[0].startswith("-std=")
+
+
+def _is_cxx_std(flag: Flag) -> bool:
+    return _is_std(flag) and "++" in flag[0]
+
+
+def _anchored_flags(entries: Iterable[str], owner: str) -> list[Flag]:
+    build_path = Path(CORE.build_path)
+    return [
+        anchor_path_flag(flag, build_path)
+        for flag in parse_flags(sorted(entries), owner)
+    ]
+
+
+def _flag_lists() -> tuple[list[str], list[str], list[str]]:
+    """The C, C++, and link flag lists (raw tokens), build_unflags applied.
+
+    ``cg.set_cpp_standard`` wins over any ``-std=`` in the build flags for
+    C++ compiles, as PlatformIO's unflag of every other standard did; C
+    compiles never see a C++ standard.
+    """
+    # The funnel warns and drops empty glued arguments (-D "") itself
+    compile_flags, link_flags = split_flags(
+        _anchored_flags(CORE.build_flags, "esphome")
+    )
+    cflags = [f for f in compile_flags if not _is_cxx_std(f)]
+    cxx_std = CORE.cpp_standard
+    cxxflags = [f for f in compile_flags if not (cxx_std and _is_std(f))]
+    if cxx_std:
+        cxxflags.insert(0, (f"-std={cxx_std}",))
+    cxxflags += [(tok,) for tok in get_project_cxx_compile_flags()]
+
+    # A flag is removed whole, with its argument, as PlatformIO did
+    unflags = set(_anchored_flags(CORE.build_unflags, "esphome build_unflags"))
+    # An unflag that hits nothing (a typo, or -DUSE_FOO against
+    # -DUSE_FOO=1) must be visible, since the user believes the flag is
+    # gone while it still drives the build
+    if unmatched := sorted(unflags - set(cflags) - set(cxxflags) - set(link_flags)):
+        _LOGGER.warning(
+            "build_unflags entries matched no build flag: %s",
+            ", ".join(" ".join(flag) for flag in unmatched),
+        )
+
+    def keep(flags: list[Flag]) -> list[str]:
+        return [tok for flag in flags if flag not in unflags for tok in flag]
+
+    return keep(cflags), keep(cxxflags), keep(link_flags)
+
+
+def _resolve_host_libraries() -> list[ArduinoLibrary]:
+    """Every ``cg.add_library()`` entry, fetched from the registry.
+
+    The host has no framework, so nothing is bundled and no framework
+    compatibility check applies; the platform check keeps the strict
+    manifest gate PlatformIO's native platform enforced. Manifest-less
+    libraries (a bare git checkout) build with PlatformIO's default
+    layout, as they did under its native platform.
+    """
+    if not CORE.platformio_libraries:
+        return []
+    from esphome.arduino.library import resolve_libraries
+
+    return resolve_libraries(
+        None,
+        pio_platform=PIO_PLATFORM,
+        board_mcu="host",
+        cache_key=LIBRARY_CACHE_KEY,
+        framework=None,
+        manifest_optional=True,
+    )
+
+
+def _file_macro_maps(build_dir: Path) -> list[str]:
+    """Flags that keep ``__FILE__`` relative to the build path.
+
+    PlatformIO compiled ``src/x.cpp`` from the build path, and tools name
+    things after that spelling (CodSpeed's benchmark ids). Here a source
+    reaches the compiler by its absolute path, or relative to the build
+    directory when ccache rewrites it.
+    """
+    build_path = Path(CORE.build_path)
+    prefixes = (build_path, Path(os.path.relpath(build_path, build_dir)))
+    return [
+        shell_token(f"-fmacro-prefix-map={prefix}{os.sep}=", force=True)
+        for prefix in prefixes
+    ]
+
+
+def _compiler_version(cxx: tuple[str, ...]) -> str:
+    """What the compiler says it is: its path can stay the same across an
+    update (the macOS shims in /usr/bin)."""
+    result = subprocess.run(
+        [*cxx, "--version"], capture_output=True, text=True, check=False
+    )
+    return result.stdout
+
+
+def write_project(compilers: HostCompilers, ccache: str | None) -> bool:
+    """Write the ninja build for the current configuration.
+
+    ``ccache`` is the caller's already-resolved binary (None when disabled).
+    Returns True when ``build.ninja`` changed, so the caller can skip work
+    derived purely from it (the compile database) on unchanged builds.
+    """
+    build_dir = get_build_dir()
+    mkdir_p(build_dir)
+    src_dir = CORE.relative_src_path()
+    if not src_dir.is_dir():
+        # Generated project state, not install state: clean-all would not help
+        raise EsphomeError(f"Generated source directory {src_dir} is missing")
+
+    cflags, cxxflags, link_flags = _flag_lists()
+    libraries = _resolve_host_libraries()
+
+    include_dirs = [src_dir]
+    for lib in libraries:
+        include_dirs += lib.include_dirs
+    includes = [f"-I{_q(d)}" for d in include_dirs]
+    includes += _file_macro_maps(build_dir)
+
+    # SCons's link line: $LINKFLAGS $SOURCES $_LIBDIRFLAGS $_LIBFLAGS, so
+    # -L and -l trail the objects while every other link token leads
+    lib_dirs = [Path(t[2:]) for t in link_flags if t.startswith("-L")]
+    libs = [t for t in link_flags if t.startswith("-l")]
+    linkflags = [shell_token(t) for t in link_flags if not t.startswith(("-L", "-l"))]
+    for lib in libraries:
+        lib_dirs += lib.link_dirs
+        libs += [f"-l{name}" for name in lib.link_libs]
+        linkflags += [shell_token(f) for f in lib.link_flags]
+
+    # PlatformIO's ASPPCOM passes only -D/-I user flags to assembly
+    asflags = [t for t in cflags if t.startswith(("-D", "-I"))]
+
+    lines = [
+        *tool_lines(compilers.cc, compilers.cxx, ccache),
+        *compile_rule_lines(),
+        *pch_rule_lines(),
+        "rule link",
+        "  command = $cxx -o $out $linkflags @$out.rsp $archives $libdirflags $libflags",
+        "  rspfile = $out.rsp",
+        "  rspfile_content = $in_newline",
+        "  description = LINK $out",
+    ]
+    if any(lib.sources and lib.lib_archive for lib in libraries):
+        # Resolved only when an archive is built, so a system without
+        # binutils still links a library-free configuration
+        lines += ar_rule_lines(find_tool("AR", ("ar",)))
+    lines += [
+        "",
+        f"cflags = {' '.join([*map(shell_token, cflags), *includes])}",
+        f"cxxflags = {' '.join([*map(shell_token, cxxflags), *includes])}",
+        f"asflags = {' '.join([*map(shell_token, asflags), *includes])}",
+        f"linkflags = {' '.join(linkflags)}",
+        f"libdirflags = {' '.join(f'-L{_q(d)}' for d in lib_dirs)}",
+        f"libflags = {' '.join(shell_token(lib) for lib in libs)}",
+        "",
+    ]
+
+    archives, direct_objs = library_edges(lines, libraries)
+
+    src_cxx_override = pch_edges(
+        lines,
+        build_dir,
+        src_dir,
+        PCH_DEFAULT_HEADERS,
+        # The arguments of a CXX override come before the flags
+        [*compilers.cxx[1:], *cxxflags],
+        (),
+        (compilers.cxx[0], _compiler_version(compilers.cxx)) if pch_enabled() else (),
+        compilers.cxx,
+    )
+    src_objs = compile_edges(
+        lines,
+        collect_sources(src_dir),
+        src_dir,
+        "src",
+        cxx_override=src_cxx_override,
+    )
+    if not src_objs:
+        raise EsphomeError(f"No source files found under {src_dir}")
+
+    # Archives are not topologically sorted; GNU ld needs the group to
+    # resolve references between them. ld64 loads archives iteratively and
+    # rejects the option, so macOS lists them bare.
+    archive_tokens = [shell_token(a) for a in archives]
+    if archive_tokens and sys.platform != "darwin":
+        archive_tokens = ["-Wl,--start-group", *archive_tokens, "-Wl,--end-group"]
+    lines.append(
+        f"build {PROGRAM_NAME}: link {' '.join(src_objs + direct_objs)} | "
+        f"{' '.join(_e(a) for a in archives)}"
+    )
+    lines.append(f"  archives = {' '.join(archive_tokens)}")
+    lines.append(f"default {PROGRAM_NAME}")
+    lines.append("")
+
+    return write_file_if_changed(build_dir / "build.ninja", "\n".join(lines))

esphome/build_gen/platformio.py

@@ -1,6 +1,8 @@
+from esphome.build_helpers.pch import pch_script_enabled
 from esphome.const import __version__
 from esphome.core import CORE
 from esphome.helpers import mkdir_p, read_file, write_file_if_changed
+from esphome.platformio.toolchain import copy_pch_script
 from esphome.writer import find_begin_end
 
 INI_AUTO_GENERATE_BEGIN = "; ========== AUTO GENERATED CODE BEGIN ==========="
@@ -62,6 +64,19 @@ def get_ini_content():
 
     # Add extra script for C++ flags
     CORE.add_platformio_option("extra_scripts", [f"pre:{CXX_FLAGS_FILE_NAME}"])
+    if pch_script_enabled():
+        CORE.add_platformio_option("extra_scripts", ["post:pch.py"])
+
+    # Add CMake args. A user-supplied value (str or list) is deliberately
+    # replaced; this option was always overwritten at FINAL priority.
+    if CORE.cmake_args:
+        CORE.add_platformio_option(
+            "board_build.cmake_extra_args",
+            " ".join(
+                f"-D{name}={value}" for name, value in sorted(CORE.cmake_args.items())
+            ),
+            replace=True,
+        )
 
     content = "[platformio]\n"
     content += f"description = ESPHome {__version__}\n"
@@ -95,6 +110,8 @@ def write_project():
 
     # Write extra script for C++ specific flags
     write_cxx_flags_script()
+    if pch_script_enabled():
+        copy_pch_script()
 
 
 CXX_FLAGS_FILE_NAME = "cxx_flags.py"

esphome/build_helpers/__init__.py

@@ -0,0 +1 @@
+"""Build helpers shared by the native (non-PlatformIO) toolchains."""

esphome/build_helpers/ccache.py

@@ -0,0 +1,131 @@
+"""Shared ccache policy for build backends: env-knob parsing, binary
+resolution, and default ``CCACHE_*`` values."""
+
+from __future__ import annotations
+
+import logging
+import os
+from pathlib import Path
+
+from esphome.framework_helpers import strip_win_long_path_prefix, tool_version_runs
+from esphome.helpers import FALSY_ENV_STRINGS, TRUTHY_ENV_STRINGS
+
+_LOGGER = logging.getLogger(__name__)
+
+
+def _ccache_runs(ccache: str) -> bool:
+    """Return True when the ``ccache`` found on PATH actually runs."""
+    return tool_version_runs(
+        ccache,
+        "Ignoring ccache at %s because it failed to run; compiling without ccache",
+    )
+
+
+def parse_enable_env(name: str) -> bool | None:
+    """Strictly parse an on/off environment knob; None when unset or invalid.
+
+    ``bool(str)`` truthiness would flip ``no``/``off`` to enabled, so only
+    1/true/yes/on and 0/false/no/off count; anything else warns and reads
+    as unset so the caller's default policy applies.
+    """
+    raw = os.environ.get(name)
+    if raw is None:
+        return None
+    lowered = raw.strip().lower()
+    if not lowered:
+        # ENV KNOB= (Docker/CI) has always read as a disable
+        return False
+    if lowered in TRUTHY_ENV_STRINGS:
+        return True
+    if lowered in FALSY_ENV_STRINGS:
+        return False
+    _LOGGER.warning("Ignoring unrecognized %s=%r; use 1 or 0", name, raw)
+    return None
+
+
+def resolve_ccache_path() -> str | None:
+    """The ccache binary to wrap compiles with, or None when disabled.
+
+    An explicit ``ESPHOME_CCACHE_ENABLE=1`` skips the runnability probe; the
+    Windows extended-length prefix is stripped before probing (#18399).
+    """
+    import shutil
+
+    explicit = parse_enable_env("ESPHOME_CCACHE_ENABLE")
+    if explicit is False:
+        return None
+    ccache = shutil.which("ccache")
+    if ccache is None:
+        if explicit:
+            _LOGGER.warning(
+                "ESPHOME_CCACHE_ENABLE is set but no ccache binary is on PATH; "
+                "compiling without ccache"
+            )
+        return None
+    ccache = strip_win_long_path_prefix(ccache)
+    if not explicit and not _ccache_runs(ccache):
+        return None
+    return ccache
+
+
+def resolve_absolute_ccache_path() -> str | None:
+    """``resolve_ccache_path`` for the ninja backends, which run their
+    commands from the build directory, where a relative path is lost."""
+    from esphome.build_helpers.ninja import absolute_tool
+
+    ccache = resolve_ccache_path()
+    return absolute_tool(ccache) if ccache else None
+
+
+def ccache_defaults_env(cache_dir: Path) -> dict[str, str]:
+    """Default ``CCACHE_*`` values for a build subprocess (not os.environ).
+
+    Values the user already set in the environment are respected. Depend
+    mode is on: both native backends emit depfiles (-MMD / CMake), which
+    keeps cache-miss overhead low.
+    """
+    from esphome.core import CORE
+
+    # An unset build_path means the env was built before preload; fail loudly
+    # rather than silently drop CCACHE_BASEDIR.
+    if CORE.build_path is None:
+        raise ValueError(
+            "CORE.build_path must be set before constructing the build environment"
+        )
+    defaults = {
+        # ccache expands $VAR in its settings; $$ is a literal $
+        "CCACHE_DIR": str(cache_dir).replace("$", "$$"),
+        "CCACHE_NOHASHDIR": "true",
+        "CCACHE_DEPEND": "1",
+        "CCACHE_BASEDIR": str(Path(CORE.build_path).resolve()).replace("$", "$$"),
+    }
+    return {k: v for k, v in defaults.items() if k not in os.environ}
+
+
+def effective_ccache_basedir() -> str:
+    """The prefix ccache strips from hashed paths: a usable user
+    CCACHE_BASEDIR, else the resolved build path."""
+    from esphome.core import CORE
+
+    raw = os.environ.get("CCACHE_BASEDIR")
+    if raw is not None and Path(raw).is_absolute() and len(Path(raw).parts) > 1:
+        return raw
+    return str(Path(CORE.build_path).resolve())
+
+
+def ccache_env(ccache: str | None, tools_cache: tuple[str, str]) -> dict[str, str]:
+    """The ccache settings for a build subprocess (not os.environ).
+
+    ``ccache`` is the pre-resolved binary (resolve_ccache_path), or None when
+    disabled; ``tools_cache`` is the backend's tools cache spec, which holds
+    its ccache dir. The pch settings include ``time_macros``: a cached
+    object can keep an older ``__DATE__`` or ``__TIME__``.
+    """
+    if ccache is None:
+        return {}
+    from esphome.build_helpers.pch import ccache_pch_env
+    from esphome.build_helpers.tools_cache import tools_cache_path
+
+    env = ccache_defaults_env(tools_cache_path(*tools_cache) / "ccache")
+    env.update(ccache_pch_env())
+    return env

esphome/build_helpers/idedata.py

@@ -0,0 +1,406 @@
+"""Derive idedata from a native (non-PlatformIO) build's ``compile_commands.json``.
+
+PlatformIO exposes a curated ``pio run -t idedata`` JSON; the native
+toolchains have no such command, but each build produces a
+``compile_commands.json`` (CMAKE_EXPORT_COMPILE_COMMANDS for ESP-IDF, ninja's
+compdb tool otherwise). This module turns that file into the same fields
+consumers (IDE integration, clang-tidy) expect:
+
+    {cc_path, cxx_path, cxx_flags, defines, includes: {build, toolchain}}
+"""
+
+from __future__ import annotations
+
+from collections.abc import Callable
+import json
+import logging
+import os
+from pathlib import Path
+import shlex
+import subprocess
+
+from esphome.core import EsphomeError
+from esphome.helpers import write_file
+
+_LOGGER = logging.getLogger(__name__)
+
+# Everything idedata generation may raise after a successful link; idedata
+# is a bonus artifact, so consumers warn instead of failing the build
+IDEDATA_BEST_EFFORT_ERRORS = (
+    EsphomeError,
+    LookupError,
+    OSError,
+    RuntimeError,
+    ValueError,
+)
+
+
+def warn_if_idedata_missing(get_idedata: Callable[[], dict | None]) -> None:
+    """Run an idedata generator, downgrading any failure to a warning:
+    the firmware already built."""
+    try:
+        if get_idedata() is None:
+            _LOGGER.warning("No idedata was generated for this build")
+    except IDEDATA_BEST_EFFORT_ERRORS as err:
+        _LOGGER.warning(
+            "Could not generate idedata: %s (IDE, clang-tidy, and "
+            "memory-analysis data will be unavailable for this build)",
+            err,
+        )
+        _LOGGER.debug("Idedata failure detail", exc_info=True)
+
+
+# C++ translation-unit suffixes used to identify ESPHome source files.
+_CXX_SUFFIXES = (".cpp", ".cc")
+# Suffixes of input/output files that appear bare on the command line (and so
+# must not be mistaken for compiler flags).
+_INPUT_FILE_SUFFIXES = (*_CXX_SUFFIXES, ".c", ".o", ".S", ".s")
+# Path marker identifying an ESPHome source translation unit.
+_ESPHOME_SRC_MARKER = "/src/esphome/"
+
+
+def _is_esphome_src(file: str) -> bool:
+    """Whether ``file`` is an ESPHome C++ translation unit; normalized to
+    ``/`` first since Windows compile DBs use backslashes."""
+    return _ESPHOME_SRC_MARKER in file.replace("\\", "/") and file.endswith(
+        _CXX_SUFFIXES
+    )
+
+
+def _split_command(command: str) -> list[str]:
+    r"""Tokenize a compile_commands.json / response-file command string.
+
+    On Windows, tokenize per Windows ``argv`` rules via ``CommandLineToArgvW``.
+    ESP-IDF's compile_commands.json there mixes two backslash conventions in one
+    string: literal path separators in the compiler path (``C:\Users\...g++.exe``,
+    no quote follows) and shell quote-escaping in -D defines (``-DVER=\"1.2.3\"``).
+    Only the real Windows parser — where a backslash escapes solely a following
+    quote — handles both, and it is the exact tokenizer the compiler is launched
+    with. ``shlex`` cannot: POSIX mode eats the path separators, and disabling
+    its escape mangles the defines.
+    """
+    if os.name != "nt":
+        return shlex.split(command)
+
+    import ctypes
+    from ctypes import wintypes
+
+    # CommandLineToArgvW("") returns the current process name, not []; guard it
+    # so an empty response file tokenizes the same as it would via shlex.
+    if not command.strip():
+        return []
+
+    CommandLineToArgvW = ctypes.windll.shell32.CommandLineToArgvW
+    CommandLineToArgvW.argtypes = [wintypes.LPCWSTR, ctypes.POINTER(ctypes.c_int)]
+    CommandLineToArgvW.restype = ctypes.POINTER(wintypes.LPWSTR)
+    argc = ctypes.c_int()
+    argv = CommandLineToArgvW(command, ctypes.byref(argc))
+    if not argv:  # pragma: no cover
+        raise ctypes.WinError()
+    try:
+        return [argv[i] for i in range(argc.value)]
+    finally:
+        ctypes.windll.kernel32.LocalFree(argv)
+
+
+def _expand_response_files(tokens: list[str], directory: Path) -> list[str]:
+    """Inline any ``@response-file`` arguments (paths relative to ``directory``).
+
+    GCC response files embed flags that must be expanded so GCC-only flags
+    inside them (e.g. ``-mlongcalls``) can be filtered downstream; left as
+    ``@file`` clang would read them and choke.
+    """
+    out: list[str] = []
+    for tok in tokens:
+        if tok.startswith("@"):
+            rf = Path(tok[1:])
+            if not rf.is_absolute():
+                rf = directory / rf
+            try:
+                out.extend(
+                    _expand_response_files(
+                        _split_command(rf.read_text(encoding="utf-8")), directory
+                    )
+                )
+                continue
+            except OSError as err:
+                # Keep the literal token if the file can't be read, but log it
+                # so the (otherwise opaque) downstream clang failure is traceable.
+                _LOGGER.warning("Could not read response file %s: %s", rf, err)
+        out.append(tok)
+    return out
+
+
+def _pick_entry(entries: list[dict]) -> dict:
+    """Pick a representative ESPHome C++ TU; all share the same component
+    flags/defines."""
+    for entry in entries:
+        if _is_esphome_src(entry["file"]):
+            return entry
+    for entry in entries:
+        if entry["file"].endswith(_CXX_SUFFIXES):
+            return entry
+    raise ValueError("no C++ translation unit found in compile_commands.json")
+
+
+# Compiler launchers that may prefix a compile command; a closed launcher
+# denylist beats enumerating compiler names, an open set.
+_LAUNCHER_STEMS = frozenset({"ccache", "sccache", "distcc", "icecc", "buildcache"})
+
+
+def _is_launcher(token: str) -> bool:
+    return Path(token).stem.lower() in _LAUNCHER_STEMS
+
+
+def is_joined_include(tok: str) -> bool:
+    """The joined ``-includefoo.h`` spelling; excludes clang's -include-pch."""
+    return (
+        tok.startswith("-include")
+        and tok != "-include"
+        and not tok.startswith("-include-")
+    )
+
+
+def parse_entry(
+    entry: dict, launcher: str | None = None
+) -> tuple[str, list[str], list[str], list[str]]:
+    """Parse one compile_commands entry -> (cxx_path, defines, includes, cxx_flags)."""
+    directory = Path(entry["directory"])
+    tokens = _expand_response_files(_split_command(entry["command"]), directory)
+
+    def _include(raw: str) -> str:
+        # Resolve against the entry's ``directory`` so cached idedata works
+        # from any cwd; emit forward slashes to match the JSON's own entries
+        raw = raw.strip()
+        if raw and not Path(raw).is_absolute():
+            raw = os.path.normpath(directory / raw)
+        return raw.replace("\\", "/")
+
+    # A launcher-wrapped command ("ccache g++ ...") names the compiler second
+    if launcher is not None and tokens[:1] == [launcher]:
+        tokens = tokens[1:]
+    if not tokens:
+        # An empty command, or one that was only the launcher; fail by name
+        raise ValueError(f"empty compile command for {entry.get('file')}")
+    if _is_launcher(tokens[0]) and len(tokens) > 1 and not tokens[1].startswith("-"):
+        # Stale DB built with a launcher this run no longer configures; the
+        # real compiler is the next token
+        _LOGGER.warning("Stripping unconfigured launcher %s", tokens[0])
+        tokens = tokens[1:]
+    # token0 is the compiler path; the rest of the command already uses forward
+    # slashes on Windows, so normalize it too for a consistent idedata file.
+    cxx_path = tokens[0].replace("\\", "/")
+    # Enforced here so no caller can record ccache as the compiler
+    reject_launcher_compiler(cxx_path)
+    defines: list[str] = []
+    includes: list[str] = []
+    cxx_flags: list[str] = []
+
+    it = iter(tokens[1:])
+    for tok in it:
+        if tok in ("-c", "-o"):
+            next(it, None)  # drop the flag and its argument (input/output)
+        elif tok.startswith("-D"):
+            # ``.strip()`` handles tokens like ``-D CONFIGURED=1`` (a single
+            # quoted arg with a space after -D) that some flags arrive as.
+            defines.append(tok[2:].strip() if len(tok) > 2 else next(it, "").strip())
+        elif tok.startswith("-I"):
+            includes.append(_include(tok[2:] if len(tok) > 2 else next(it, "")))
+        elif tok == "-isystem":
+            includes.append(_include(next(it, "")))
+        elif tok.startswith("-isystem"):
+            includes.append(_include(tok[len("-isystem") :]))
+        elif tok in ("-MT", "-MF", "-MQ"):
+            next(it, None)  # dependency-file flag + its argument
+        elif tok.startswith(("-MD", "-MMD", "-MP", "-MM")):
+            pass  # dependency-generation flags, no argument
+        elif tok.endswith(_INPUT_FILE_SUFFIXES):
+            pass  # input/output files
+        else:
+            cxx_flags.append(tok)
+    return cxx_path, defines, includes, cxx_flags
+
+
+def get_toolchain_includes(cxx_path: str) -> list[str]:
+    """Query the compiler for its builtin ``#include <...>`` search dirs."""
+    result = subprocess.run(
+        [cxx_path, "-E", "-x", "c++", "-", "-v"],
+        input="",
+        text=True,
+        stdout=subprocess.DEVNULL,
+        stderr=subprocess.PIPE,
+        check=False,
+        close_fds=False,
+    )
+    includes: list[str] = []
+    capture = False
+    for line in result.stderr.splitlines():
+        if "#include <...> search starts here:" in line:
+            capture = True
+            continue
+        if "End of search list." in line:
+            break
+        if capture:
+            includes.append(line.strip())
+    if result.returncode != 0 or not includes:
+        raise RuntimeError(
+            f"Could not query builtin include dirs from {cxx_path} "
+            f"(return code {result.returncode}); stderr:\n{result.stderr.strip()}"
+        )
+    return includes
+
+
+def _cc_path_from_cxx(cxx_path: str) -> str:
+    """Derive the C compiler path from the C++ compiler path.
+
+    compile_commands.json only names the C++ compiler, but consumers reach the
+    rest of the toolchain (objdump, readelf, addr2line) by rewriting the tail of
+    ``cc_path``, so they need the ``gcc``-suffixed name.
+    """
+    stem, suffix = (
+        (cxx_path[: -len(".exe")], ".exe")
+        if cxx_path.endswith(".exe")
+        else (cxx_path, "")
+    )
+    # Rewrite the program name only when it is g++ itself, or a toolchain
+    # prefixed one such as xtensa-esp32-elf-g++ -> xtensa-esp32-elf-gcc.
+    # Requiring a separator before the "g++" keeps names that merely end in
+    # those three characters intact: "clang++" must not become "clangcc".
+    head = stem[: -len("g++")]
+    if stem.endswith("g++") and (not head or head.endswith(("-", "/", "\\"))):
+        stem = f"{head}gcc"
+    return f"{stem}{suffix}"
+
+
+def _cache_usable(cached: object) -> bool:
+    """Check a cached idedata dict against the guarantees of the write path.
+
+    Caches written by older versions predate the launcher rejection and the
+    include-union shape; serving one would bypass both. The dict check also
+    keeps "in" from substring-matching a bare JSON string.
+    """
+    if not isinstance(cached, dict) or "cc_path" not in cached:
+        return False
+    cxx_path = cached.get("cxx_path")
+    if not isinstance(cxx_path, str) or _is_launcher(cxx_path):
+        return False
+    includes = cached.get("includes")
+    return isinstance(includes, dict) and isinstance(includes.get("build"), list)
+
+
+def load_or_build_idedata(
+    compile_commands: Path,
+    elf_path: Path,
+    cache: Path,
+    launcher: str | None = None,
+) -> dict | None:
+    """Return idedata for a compile_commands.json build, cached on mtime.
+
+    Shared by the native ESP-IDF and ESP8266 Arduino toolchains. Returns None
+    when the compile DB doesn't exist yet (nothing was built). ``launcher``
+    is the compiler-launcher path (ccache) the build was generated with, if
+    any; commands in the compile DB are prefixed with it.
+    """
+    if not compile_commands.is_file():
+        _LOGGER.debug("No %s yet; skipping idedata generation", compile_commands)
+        return None
+
+    if cache.is_file() and cache.stat().st_mtime >= compile_commands.stat().st_mtime:
+        try:
+            cached = json.loads(cache.read_text(encoding="utf-8"))
+        except (ValueError, OSError) as err:
+            # A recurring cause (interrupted write, disk full) would otherwise
+            # look like unexplained slow builds
+            _LOGGER.warning("Discarding unreadable idedata cache %s: %s", cache, err)
+        else:
+            if _cache_usable(cached):
+                # Re-stamp so a relocated build dir cannot serve a stale ELF path
+                cached["prog_path"] = str(elf_path)
+                return cached
+            _LOGGER.debug("Regenerating idedata: cache %s fails validation", cache)
+
+    data = idedata_from_build(compile_commands, launcher)
+    data["prog_path"] = str(elf_path)
+    cache.parent.mkdir(parents=True, exist_ok=True)
+    # Atomic so a crash mid-write cannot leave a truncated cache
+    write_file(cache, json.dumps(data, indent=2) + "\n")
+    return data
+
+
+def reject_launcher_compiler(cxx_path: str) -> None:
+    """Reject a compile DB naming a launcher (ccache) as the compiler; it
+    must never be probed, cached, or consumed."""
+    if _is_launcher(cxx_path):
+        raise EsphomeError(
+            f"compile_commands.json names the launcher {cxx_path} as the "
+            "compiler; the compile database is unusable"
+        )
+
+
+def idedata_from_build(compile_commands: Path, launcher: str | None = None) -> dict:
+    """Parse compile_commands.json into the idedata fields consumers expect.
+
+    A single compile entry only carries the include set its own translation
+    unit was built with (per-component under ESP-IDF), but consumers
+    (clang-tidy) analyze ESPHome headers that transitively pull in other
+    components. So take cxx_path / cxx_flags / defines from a representative
+    ESPHome TU, but union the include dirs across all ESPHome TUs to get a
+    project-wide superset (as PlatformIO's idedata provides).
+    """
+    entries = json.loads(Path(compile_commands).read_text(encoding="utf-8"))
+    if not isinstance(entries, list) or not all(isinstance(e, dict) for e in entries):
+        # A TypeError here would escape IDEDATA_BEST_EFFORT_ERRORS
+        raise EsphomeError(f"{compile_commands} is not a compile-command list")
+
+    representative = _pick_entry(entries)
+    cxx_path, defines, rep_includes, cxx_flags = parse_entry(representative, launcher)
+
+    # Seed with the representative's includes so it is not parsed twice
+    has_esphome_tu = _is_esphome_src(representative["file"])
+    build_includes: dict[str, None] = dict.fromkeys(
+        rep_includes if has_esphome_tu else ()
+    )
+
+    def _shape(entry: dict) -> str:
+        # directory + command minus TU-specific paths: same shape means the
+        # same include set, so tokenize once per shape. Response-file
+        # commands never dedupe (the .rsp contents differ per object)
+        command = entry["command"]
+        directory = entry.get("directory", "")
+        if "@" in command:
+            return f"unique:{directory}|{entry.get('output') or command}"
+        stripped = command.replace(entry.get("file", ""), "").replace(
+            entry.get("output", ""), ""
+        )
+        return f"{directory}|{stripped}"
+
+    seen_shapes = {_shape(representative)}
+    for entry in entries:
+        if entry is representative or not _is_esphome_src(entry["file"]):
+            continue
+        has_esphome_tu = True
+        if (shape := _shape(entry)) in seen_shapes:
+            _LOGGER.debug("Include union: %s shares a command shape", entry["file"])
+            continue
+        seen_shapes.add(shape)
+        for inc in parse_entry(entry, launcher)[2]:
+            build_includes.setdefault(inc, None)
+
+    if not has_esphome_tu:
+        # An arbitrary fallback TU breaks clang-tidy/IDE consumers, and a
+        # warning would be cached into permanence; call sites downgrade this
+        raise EsphomeError(
+            f"No ESPHome translation unit found in {compile_commands}; "
+            "refusing to cache unusable idedata"
+        )
+
+    return {
+        "cc_path": _cc_path_from_cxx(cxx_path),
+        "cxx_path": cxx_path,
+        "cxx_flags": cxx_flags,
+        "defines": defines,
+        "includes": {
+            "build": list(build_includes),
+            "toolchain": get_toolchain_includes(cxx_path),
+        },
+    }

esphome/build_helpers/native.py

@@ -0,0 +1,74 @@
+"""Resolution of the native (non-PlatformIO) build backend for a config.
+
+Kept deliberately light: the serial upload and logs fast path resolves a
+backend for its artifact paths alone, so importing this must not pull in a
+platform component package or the backend itself.
+"""
+
+from __future__ import annotations
+
+from collections.abc import Collection
+import importlib
+import logging
+from types import ModuleType
+
+from esphome.const import Toolchain
+from esphome.core import CORE, EsphomeError
+
+_LOGGER = logging.getLogger(__name__)
+
+# Native build backend per (target platform, toolchain)
+NATIVE_TOOLCHAIN_MODULES = {
+    ("esp32", Toolchain.ESP_IDF): "esphome.espidf.toolchain",
+    ("esp8266", Toolchain.ARDUINO): "esphome.arduino8266.toolchain",
+    ("host", Toolchain.HOST): "esphome.host.toolchain",
+}
+
+
+def native_backend() -> ModuleType | None:
+    """The native build backend module for the resolved toolchain."""
+    if not CORE.using_native_toolchain:
+        return None
+    key = (CORE.target_platform, CORE.toolchain)
+    if (module_path := NATIVE_TOOLCHAIN_MODULES.get(key)) is None:
+        # Degrading to the PlatformIO path would build with the wrong backend
+        raise EsphomeError(
+            f"Toolchain '{CORE.toolchain.value}' has no native build backend "
+            f"module for platform {CORE.target_platform}"
+        )
+    return importlib.import_module(module_path)
+
+
+# Binutils and the linked image for memory analysis, for toolchains that build
+# without PlatformIO but have no native build backend (which supplies them)
+ANALYSIS_TOOLCHAIN_MODULES = {
+    ("nrf52", Toolchain.SDK_NRF): "esphome.components.nrf52.toolchain",
+}
+
+
+def analysis_backend() -> ModuleType | None:
+    """The module giving objdump, readelf and the ELF of a non-PlatformIO build.
+
+    None means PlatformIO's idedata supplies them (or nothing can).
+    """
+    if (native := native_backend()) is not None:
+        return native
+    module_path = ANALYSIS_TOOLCHAIN_MODULES.get((CORE.target_platform, CORE.toolchain))
+    return importlib.import_module(module_path) if module_path else None
+
+
+def warn_ignored_platformio_options(consumed: Collection[str]) -> None:
+    """Warn for component-added platformio options a native build drops.
+
+    User-supplied keys were already routed or warned about by
+    ``core/config.py``; what survives into ``CORE.platformio_options`` came
+    from ``cg.add_platformio_option`` calls in components.
+    """
+    for key in sorted(CORE.platformio_options or {}):
+        if key not in consumed:
+            _LOGGER.warning(
+                "platformio_options->%s is ignored when building with the "
+                "native '%s' toolchain",
+                key,
+                CORE.toolchain.value,
+            )

esphome/build_helpers/ninja.py

@@ -0,0 +1,182 @@
+"""Platform-neutral helpers for ninja-driven native builds."""
+
+from __future__ import annotations
+
+import json
+import logging
+import os
+from pathlib import Path
+import re
+import shutil
+import subprocess
+
+from esphome.core import EsphomeError
+from esphome.framework_helpers import strip_win_long_path_prefix, tool_version_runs
+from esphome.helpers import write_file_if_changed
+
+_LOGGER = logging.getLogger(__name__)
+
+
+def _ninja_runs(binary: str) -> bool:
+    """Whether the ninja found on PATH actually runs (see tool_version_runs)."""
+    return tool_version_runs(
+        binary,
+        "Ignoring ninja at %s because it failed to run; "
+        "falling back to the bundled wheel",
+    )
+
+
+# Compile rule names the generators emit; ninja's compdb tool is asked for
+# exactly these, so a renamed rule fails the build instead of stranding idedata
+COMPILE_RULES = ("c", "cxx", "aspp", "asm")
+
+
+def absolute_tool(tool: str | Path) -> str:
+    """A tool path that still resolves from the build directory.
+
+    ``shutil.which`` returns a relative path for a relative PATH entry, and
+    ninja runs the commands from ``.pioenvs/<name>``. Symlinks are kept:
+    ccache's compiler links depend on the name they are called by.
+    """
+    return strip_win_long_path_prefix(str(Path(tool).absolute()))
+
+
+def find_ninja() -> Path:
+    """Locate the ninja binary: a runnable PATH hit first, else the ninja
+    PyPI wheel."""
+    if binary := shutil.which("ninja"):
+        binary = absolute_tool(binary)
+        if _ninja_runs(binary):
+            return Path(binary)
+    import_error: ImportError | None = None
+    try:
+        import ninja
+    except ImportError as err:
+        import_error = err
+        wheel_binary = None
+    else:
+        wheel_binary = Path(ninja.BIN_DIR) / (
+            "ninja.exe" if os.name == "nt" else "ninja"
+        )
+    if wheel_binary is None or not wheel_binary.is_file():
+        raise EsphomeError(
+            "ninja not found on PATH or in the ninja package; reinstall the "
+            "esphome Python environment"
+        ) from import_error
+    return wheel_binary
+
+
+def escape(value: Path | str) -> str:
+    """Escape a path or token for a ninja file.
+
+    ninja has no escape for ``|`` or a line break in a path, so those fail
+    here by name instead of producing a build file ninja misreads.
+    """
+    text = str(value)
+    if bad := next((c for c in "|\r\n" if c in text), None):
+        raise EsphomeError(
+            f"Path {text!r} contains {bad!r}, which a ninja build file cannot "
+            "express; rename the file or directory"
+        )
+    return text.replace("$", "$$").replace(":", "$:").replace(" ", "$ ")
+
+
+def quote_arg(tok: str) -> str:
+    """Quote with the CreateProcess argv rule (as ``subprocess.list2cmdline``):
+    backslash runs double only before a quote. Windows-only; ``$`` must
+    already be doubled for ninja.
+    """
+    quoted = re.sub(r'(\\*)"', lambda m: m.group(1) * 2 + '\\"', tok)
+    quoted = re.sub(r"(\\+)\Z", lambda m: m.group(1) * 2, quoted)
+    return f'"{quoted}"'
+
+
+# Force-quote any token containing a character outside the shlex.quote-style
+# safe set: ninja hands POSIX commands to /bin/sh -c, so bare (, ;, <, *, `
+# and friends would be re-parsed as shell syntax.
+_NEEDS_QUOTE = re.compile(r"[^\w@%+=:,./-]")
+
+
+def shell_token(tok: str, force: bool = False) -> str:
+    """Re-quote a lexed token for the platform shell; ``force`` always quotes.
+
+    Single quotes on POSIX (/bin/sh), the argv rule on Windows
+    (CreateProcess). ``$`` is doubled first because ninja expands it before
+    the command reaches the shell.
+    """
+    tok = tok.replace("$", "$$")  # ninja would expand a bare $ to nothing
+    if not (force or not tok or _NEEDS_QUOTE.search(tok)):
+        return tok
+    # An empty token must become '' / "" or it vanishes from the argv
+    if os.name == "nt":
+        return quote_arg(tok)
+    # shlex.quote's rule; inlined because the $-doubled token must not be
+    # re-examined for safe characters
+    return "'" + tok.replace("'", "'\"'\"'") + "'"
+
+
+def quote_path(value: Path | str) -> str:
+    """Force-quote a path for the ninja command line (shell/CreateProcess)."""
+    return shell_token(str(value), force=True)
+
+
+def refresh_compile_commands(
+    ninja_path: Path, build_dir: Path, env: dict[str, str], ninja_changed: bool
+) -> None:
+    """Regenerate the compile DB (a pure function of build.ninja) when stale.
+
+    Freshness rides a stamp: the DB itself is written through
+    write_file_if_changed (its mtime feeds the idedata cache), so a
+    regeneration with identical content would stay "stale" forever. An
+    interrupted previous run may have rewritten the manifest without
+    regenerating the DB, hence the mtime comparison.
+    """
+    compdb = build_dir / "compile_commands.json"
+    compdb_stamp = build_dir / ".compile_commands.stamp"
+    ninja_file = build_dir / "build.ninja"
+    if (
+        ninja_changed
+        or not compdb.is_file()
+        or not compdb_stamp.is_file()
+        or compdb_stamp.stat().st_mtime < ninja_file.stat().st_mtime
+    ):
+        write_compile_commands(ninja_path, build_dir, env)
+        compdb_stamp.touch()
+
+
+def write_compile_commands(
+    ninja_path: Path, build_dir: Path, env: dict[str, str]
+) -> None:
+    compdb = build_dir / "compile_commands.json"
+    result = subprocess.run(
+        [str(ninja_path), "-C", str(build_dir), "-t", "compdb", *COMPILE_RULES],
+        env=env,
+        capture_output=True,
+        text=True,
+        check=False,
+        close_fds=False,
+    )
+    if result.returncode != 0:
+        # Drop any stale database so consumers (IDE integration, clang-tidy,
+        # the memory analyzer) can't silently read outdated data
+        compdb.unlink(missing_ok=True)
+        raise EsphomeError(f"Could not generate compile_commands.json: {result.stderr}")
+    try:
+        entries = json.loads(result.stdout)
+    except ValueError as err:
+        compdb.unlink(missing_ok=True)
+        raise EsphomeError(
+            f"ninja produced an unparsable compile database: {err} "
+            f"(output starts {result.stdout[:120]!r})"
+        ) from err
+    if not entries:
+        # compdb exits 0 with [] for unknown rule names; a renamed compile
+        # rule must fail the build, not silently strand every consumer
+        compdb.unlink(missing_ok=True)
+        raise EsphomeError(
+            "ninja produced an empty compile database; the generator's rule "
+            "names no longer match"
+        )
+    # write_file_if_changed keeps the mtime stable on no-op builds so the
+    # idedata cache stays valid
+    write_file_if_changed(compdb, result.stdout)

esphome/build_helpers/ninja_gen.py

@@ -0,0 +1,279 @@
+"""The parts of a ``build.ninja`` every native backend emits the same way.
+
+Rule names match ``SOURCE_KIND_FOR_SUFFIX`` values (c, cxx, asm, aspp) and
+``ninja.COMPILE_RULES``, which the compile database is asked for.
+"""
+
+from __future__ import annotations
+
+from collections.abc import Collection, Sequence
+import logging
+import os
+from pathlib import Path
+import sys
+from typing import TYPE_CHECKING
+
+from esphome.build_helpers.idedata import is_joined_include
+from esphome.build_helpers.ninja import (
+    escape as _e,
+    quote_path as _q,
+    shell_token as _shell_token,
+)
+from esphome.build_helpers.pch import (
+    PCH_GCH_NAME,
+    PCH_SUM_NAME,
+    log_pch_in_use,
+    pch_consumer_flags,
+    pch_identity,
+    pch_usable,
+    write_pch_headers,
+)
+from esphome.framework_helpers import strip_win_long_path_prefix
+from esphome.helpers import write_file_if_changed
+from esphome.platformio.library import SOURCE_KIND_FOR_SUFFIX
+
+if TYPE_CHECKING:
+    from esphome.arduino.library import ArduinoLibrary
+
+_LOGGER = logging.getLogger(__name__)
+
+_BUILD_TOOL = Path(__file__).parent.parent / "build_gen" / "build_tool.py"
+
+
+def collect_sources(root: Path, exclude: Collection[str] = frozenset()) -> list[Path]:
+    return sorted(
+        p
+        for p in root.rglob("*")
+        if p.suffix in SOURCE_KIND_FOR_SUFFIX and p.name not in exclude
+    )
+
+
+def common_parent(paths: list[Path]) -> Path:
+    return Path(os.path.commonpath([str(p.parent) for p in paths]))
+
+
+def _command(words: Sequence[Path | str]) -> str:
+    program, *args = words
+    return " ".join([_q(program), *(_shell_token(str(a)) for a in args)])
+
+
+def tool_lines(
+    cc: Sequence[Path | str], cxx: Sequence[Path | str], ccache: str | None
+) -> list[str]:
+    """The file header: the compilers and the helper tools as variables.
+
+    A compiler is its program followed by any arguments it always takes.
+    """
+    return [
+        "# Auto-generated by ESPHome",
+        "ninja_required_version = 1.5",
+        f"cc = {_command(cc)}",
+        f"cxx = {_command(cxx)}",
+        # The NSIS launcher starts Python with a \\?\ extended-length path
+        # that cmd.exe cannot spawn; same strip every other emitted binary
+        # path gets
+        f"python = {_q(strip_win_long_path_prefix(sys.executable))}",
+        f"buildtool = {_q(_BUILD_TOOL)}",
+        f"ccache = {_q(ccache) if ccache else ''}",
+        "",
+    ]
+
+
+def compile_rule_lines() -> list[str]:
+    """The compile rules; ``$own_includes`` is empty unless an edge sets it."""
+    return [
+        "rule c",
+        "  command = $ccache $cc -MMD -MF $out.d $own_includes $cflags $flags -c $in -o $out",
+        "  depfile = $out.d",
+        "  deps = gcc",
+        "  description = CC $out",
+        "rule cxx",
+        "  command = $ccache $cxx -MMD -MF $out.d $own_includes $cxxflags $flags -c $in -o $out",
+        "  depfile = $out.d",
+        "  deps = gcc",
+        "  description = CXX $out",
+        "rule aspp",
+        "  command = $ccache $cc -MMD -MF $out.d -x assembler-with-cpp $own_includes $asflags $flags -c $in -o $out",
+        "  depfile = $out.d",
+        "  deps = gcc",
+        "  description = AS $out",
+        # Plain assembler, as SCons's ASCOM: no preprocessor, so no
+        # depfile and no $flags (defines/includes) either
+        "rule asm",
+        "  command = $ccache $cc -x assembler $asflags -c $in -o $out",
+        "  description = AS $out",
+    ]
+
+
+def pch_rule_lines() -> list[str]:
+    """The precompiled header rule, for a generator that emits one."""
+    return [
+        # No $ccache: the .gch embeds build dir paths
+        "rule pch",
+        "  command = $cxx -MMD -MF $out.d -x c++-header $cxxflags $flags -c $in -o $out",
+        "  depfile = $out.d",
+        "  deps = gcc",
+        "  description = PCH $out",
+    ]
+
+
+def pch_edges(
+    lines: list[str],
+    build_dir: Path,
+    src_dir: Path,
+    headers: Sequence[str],
+    cxxflags: Sequence[str],
+    src_flags: Sequence[str],
+    identity: Sequence[str],
+    cxx: Sequence[Path | str],
+) -> tuple[str, str] | None:
+    """Emit the precompiled header for the C++ src edges.
+
+    ``headers`` are folded into one prefix header, ``src_flags`` are the
+    flags every src edge carries, ``identity`` names what else the compile
+    depends on, the compiler included, and ``cxx`` is what the host rule
+    asks. Returns the ``cxx_override`` for ``compile_edges``, or None
+    without a pch.
+    """
+    if not pch_usable(cxx):
+        return None
+    if any(
+        tok == "-include" or tok.startswith("--include") or is_joined_include(tok)
+        for tok in cxxflags
+    ):
+        # $cxxflags expands first and GCC only loads a .gch for the first
+        # -include
+        _LOGGER.warning(
+            "A -include in the compiler flags prevents the precompiled header from "
+            "loading; compiling without it"
+        )
+        return None
+    log_pch_in_use()
+    source = write_pch_headers(build_dir, headers)
+    write_file_if_changed(
+        build_dir / PCH_SUM_NAME,
+        pch_identity([*cxxflags, *src_flags], src_dir, tuple(headers), identity) + "\n",
+    )
+    gch = _e(PCH_GCH_NAME)
+    # The checksum file changes with anything the .gch depends on
+    lines.append(f"build {gch}: pch {_e(source)} | {_e(PCH_SUM_NAME)}")
+    if src_flags:
+        lines.append(f"  flags = {' '.join(src_flags)}")
+    lines.append(f"srccxxflags = {' '.join([*src_flags, *pch_consumer_flags()])}")
+    return ("$srccxxflags", gch)
+
+
+def ar_rule_lines(ar: Path | str) -> list[str]:
+    return [
+        "rule ar",
+        f"  command = $python $buildtool ar {_q(ar)} $out $out.rsp",
+        "  rspfile = $out.rsp",
+        "  rspfile_content = $in_newline",
+        "  description = AR $out",
+    ]
+
+
+def compile_edges(
+    lines: list[str],
+    sources: list[Path],
+    root: Path,
+    group: str,
+    flags: str = "",
+    own_includes: str = "",
+    cxx_override: tuple[str, str] | None = None,
+) -> list[str]:
+    """Emit compile edges for ``sources``; return the object paths.
+
+    ``cxx_override`` is a (flags, implicit-dep) pair applied to C++ edges
+    only, replacing ``flags`` (used for the precompiled header).
+    """
+    objects = []
+    for src in sources:
+        rel = src.relative_to(root).as_posix()
+        obj = f"obj/{group}/{rel}.o"
+        escaped_obj = _e(obj)
+        kind = SOURCE_KIND_FOR_SUFFIX[src.suffix]
+        override = cxx_override if kind == "cxx" else None
+        implicit = f" | {override[1]}" if override else ""
+        lines.append(f"build {escaped_obj}: {kind} {_e(src)}{implicit}")
+        if own_includes:
+            lines.append(f"  own_includes = {own_includes}")
+        if edge_flags := override[0] if override else flags:
+            lines.append(f"  flags = {edge_flags}")
+        # Escaped once here: the returned paths only ever appear in build
+        # statements (archive/link inputs), which use ninja escaping
+        objects.append(escaped_obj)
+    return objects
+
+
+def library_edges(
+    lines: list[str], libraries: list[ArduinoLibrary]
+) -> tuple[list[str], list[str]]:
+    """Emit every library's compile and archive edges.
+
+    Returns the archive names and the objects that link directly. A
+    library's own include dirs lead its compile lines, as PlatformIO searched
+    them first: the include path is one global list, so another library's
+    header of the same name would shadow them.
+    """
+    archives: list[str] = []
+    direct_objs: list[str] = []
+    for lib in libraries:
+        if not lib.sources:
+            # Header-only libraries are legitimate; the log makes an empty
+            # srcFilter or broken tree traceable before link errors do
+            _LOGGER.debug(
+                "Library %s has no source files; contributing includes only",
+                lib.name,
+            )
+            continue
+        objs = compile_edges(
+            lines,
+            lib.sources,
+            common_parent(lib.sources),
+            f"lib/{lib.name}",
+            flags=" ".join(_shell_token(f) for f in lib.flags),
+            own_includes=" ".join(f"-I{_q(d)}" for d in lib.include_dirs),
+        )
+        if not lib.lib_archive:
+            # libArchive: false / dot_a_linkage=false: hand the objects to
+            # the linker directly so unreferenced-but-required symbols
+            # (exception handlers, weak overrides) survive
+            direct_objs.extend(objs)
+            continue
+        archive = f"lib{lib.name}.a"
+        lines.append(f"build {_e(archive)}: ar {' '.join(objs)}")
+        archives.append(archive)
+    return archives, direct_objs
+
+
+# One build flag: the flag, plus its argument when that is a separate token
+Flag = tuple[str, ...]
+
+# Flags whose path operand is the next token; gcc also takes it glued on
+PATH_ARG_FLAGS = ("-include", "-imacros", "-isystem", "-iquote", "-idirafter")
+# Flags whose path operand is glued on
+PATH_PREFIXES = ("-I", "-L", *PATH_ARG_FLAGS)
+
+
+def _anchor(path: str, base: Path) -> str:
+    if not path or Path(path).is_absolute():
+        return path
+    return str(base / path)
+
+
+def anchor_path_flag(flag: Flag, base: Path) -> Flag:
+    """Anchor a flag's relative path operand at ``base``.
+
+    PlatformIO ran the compiler from the build path; ninja runs it from
+    ``.pioenvs/<name>``, where a relative operand would point elsewhere.
+    """
+    name, *args = flag
+    if args:
+        if name in PATH_ARG_FLAGS:
+            return (name, _anchor(args[0], base))
+        return flag
+    for prefix in PATH_PREFIXES:
+        if name.startswith(prefix):
+            return (prefix + _anchor(name[len(prefix) :], base),)
+    return flag

esphome/build_helpers/pch.py

@@ -0,0 +1,248 @@
+"""Shared precompiled header policy for the build backends."""
+
+from __future__ import annotations
+
+from collections.abc import Iterable, Sequence
+import hashlib
+import logging
+import os
+from pathlib import Path
+import posixpath
+import re
+import subprocess
+import sys
+
+from esphome.build_helpers.ccache import effective_ccache_basedir, parse_enable_env
+from esphome.const import PLATFORM_NRF52
+from esphome.helpers import write_file_if_changed
+
+_LOGGER = logging.getLogger(__name__)
+
+# The header and its sidecars live in the build directory
+PCH_HEADER_NAME = "esphome_pch.h"
+PCH_GCH_NAME = f"{PCH_HEADER_NAME}.gch"
+# ccache hashes this instead of the .gch; also the freshness stamp
+PCH_SUM_NAME = f"{PCH_GCH_NAME}.sum"
+# The include list the .gch is compiled from
+PCH_SOURCE_NAME = "esphome_pch_src.h"
+
+# GCC can skip a .gch without a diagnostic and read the header of the same
+# name, so that header is an error. Other tools get the include list.
+PCH_GUARD_TEXT = f"""\
+#if defined(__GNUC__) && !defined(__clang__) && !defined(__INTELLISENSE__)
+#error "The precompiled header was not loaded"
+#else
+#include "{PCH_SOURCE_NAME}"
+#endif
+"""
+
+# The cc1plus wrapper the PlatformIO script writes on arm64 macOS
+PCH_CC1_DIR = "pch_cc1"
+
+# What the PlatformIO script leaves in the project root, for cleanup
+PCH_ARTIFACT_NAMES = (PCH_HEADER_NAME, PCH_GCH_NAME, PCH_SUM_NAME, PCH_SOURCE_NAME)
+PCH_ARTIFACT_DIRS = (PCH_CC1_DIR,)
+
+# The core headers every backend precompiles
+PCH_DEFAULT_HEADERS = ("esphome/core/pch_prefix.h",)
+
+# PlatformIO platforms that do not take the pch script
+PCH_SCRIPT_EXCLUDED_PLATFORMS = frozenset(
+    {
+        PLATFORM_NRF52,
+    }
+)
+
+# What ccache needs to cache compiles that load a .gch
+_CCACHE_PCH_SLOPPINESS = ("pch_defines", "time_macros")
+
+# Both include forms: an angle include resolving under src/ enters the digest
+_INCLUDE_RE = re.compile(rb'^\s*#\s*include\s+["<]([^">]+)[">]', re.MULTILINE)
+
+
+def pch_enabled() -> bool:
+    """Precompiled-header knob: default on, ``ESPHOME_PCH_ENABLE=0`` opts out."""
+    return parse_enable_env("ESPHOME_PCH_ENABLE") is not False
+
+
+def pch_forced() -> bool:
+    """``ESPHOME_PCH_ENABLE=1``: wanted even where the host rule says no."""
+    return parse_enable_env("ESPHOME_PCH_ENABLE") is True
+
+
+# GCC bug 14940: before these releases the Windows loader maps a .gch only
+# at its saved address. First fixed release per major, 16 on always fixed;
+# PCH_WINDOWS_CMAKE_OLD_GCC and the pch_usable message spell the same table
+PCH_WINDOWS_GCC_FIXED = {14: (14, 4), 15: (15, 3)}
+PCH_WINDOWS_GCC_FIXED_DEFAULT = (16, 0)
+# The same rule for CMake, which alone knows the version before configure
+PCH_WINDOWS_CMAKE_OLD_GCC = (
+    "CMAKE_CXX_COMPILER_VERSION VERSION_LESS 14.4 OR "
+    "(CMAKE_CXX_COMPILER_VERSION VERSION_GREATER_EQUAL 15 AND "
+    "CMAKE_CXX_COMPILER_VERSION VERSION_LESS 15.3)"
+)
+
+
+def gcc_relocates_pch_on_windows(version: Sequence[int]) -> bool:
+    """Whether a GCC of this version loads a .gch on Windows."""
+    if not version:
+        return False
+    fixed = PCH_WINDOWS_GCC_FIXED.get(version[0], PCH_WINDOWS_GCC_FIXED_DEFAULT)
+    return tuple(version[:2]) >= fixed
+
+
+# GCC ends the first --version line with its version; clang names itself
+_VERSION_RE = re.compile(r"\d+(?:\.\d+)+")
+
+
+def gcc_version(cxx: Sequence[Path | str]) -> tuple[int, ...] | None:
+    """The GCC version from ``--version``: () when it cannot be read, None
+    for a compiler that is not GCC."""
+    try:
+        result = subprocess.run(
+            [*cxx, "--version"], capture_output=True, text=True, check=False
+        )
+    except OSError as err:
+        _LOGGER.debug("Cannot run %s: %s", cxx[0], err)
+        return ()
+    banner = result.stdout.partition("\n")[0]
+    if "clang" in banner.lower():
+        return None
+    found = _VERSION_RE.findall(banner)
+    return tuple(int(part) for part in found[-1].split(".")) if found else ()
+
+
+def pch_needs_gcc_check() -> bool:
+    """Windows host with the knob unset: the compiler version decides."""
+    return sys.platform == "win32" and parse_enable_env("ESPHOME_PCH_ENABLE") is None
+
+
+def pch_usable(cxx: Sequence[Path | str]) -> bool:
+    """The knob plus the host rule; ``ESPHOME_PCH_ENABLE=1`` skips the rule."""
+    if not pch_enabled():
+        return False
+    if not pch_needs_gcc_check():
+        return True
+    version = gcc_version(cxx)
+    if version is None or gcc_relocates_pch_on_windows(version):
+        return True
+    _LOGGER.info(
+        "GCC %s cannot load a precompiled header on Windows (GCC bug 14940, "
+        "fixed in 14.4, 15.3 and 16); compiling without it "
+        "(set ESPHOME_PCH_ENABLE=1 to force)",
+        ".".join(map(str, version)) or "of unknown version",
+    )
+    return False
+
+
+def pch_consumer_flags() -> list[str]:
+    """Flags a C++ src compile loads the pch with. The -include stays
+    relative: an absolute path would enter the ccache key."""
+    return ["-Winvalid-pch", "-Werror=invalid-pch", "-include", PCH_HEADER_NAME]
+
+
+def ccache_pch_env() -> dict[str, str]:
+    """What ccache needs to cache compiles that load a .gch, added to what
+    the user already set."""
+    if not pch_enabled():
+        return {}
+    sloppiness = [
+        item.strip()
+        for item in os.environ.get("CCACHE_SLOPPINESS", "").split(",")
+        if item.strip()
+    ]
+    sloppiness += [item for item in _CCACHE_PCH_SLOPPINESS if item not in sloppiness]
+    env = {"CCACHE_SLOPPINESS": ",".join(sloppiness)}
+    if "CCACHE_PCH_EXTSUM" not in os.environ:
+        env["CCACHE_PCH_EXTSUM"] = "true"
+    return env
+
+
+def pch_script_enabled() -> bool:
+    """Whether this PlatformIO build takes the pch script."""
+    from esphome.core import CORE
+
+    return pch_enabled() and CORE.target_platform not in PCH_SCRIPT_EXCLUDED_PLATFORMS
+
+
+def pch_header_text(include_headers: Iterable[str]) -> str:
+    """The prefix-header source: exactly these includes, in order."""
+    return "".join(f'#include "{name}"\n' for name in include_headers)
+
+
+def write_pch_headers(build_dir: Path, include_headers: Iterable[str]) -> Path:
+    """Write the guard header and the include list; return the latter,
+    which is what the .gch compiles from."""
+    write_file_if_changed(build_dir / PCH_HEADER_NAME, PCH_GUARD_TEXT)
+    source = build_dir / PCH_SOURCE_NAME
+    write_file_if_changed(source, pch_header_text(include_headers))
+    return source
+
+
+def _include_closure(src_dir: Path, roots: Iterable[str]) -> dict[str, bytes]:
+    """Include closure of ``roots``: src-relative name -> contents.
+
+    Resolution mirrors the compiler (includer's dir, then src root). No
+    #ifdef evaluation: including too much is the safe direction. Headers
+    outside ``src_dir`` are covered by the version strings of the caller.
+    """
+    seen: dict[str, bytes] = {}
+    stack: list[tuple[str, str]] = [(name, "") for name in roots]
+    while stack:
+        name, from_dir = stack.pop()
+        for candidate in (f"{from_dir}/{name}" if from_dir else name, name):
+            rel = posixpath.normpath(candidate)
+            if not rel.startswith("..") and (src_dir / rel).is_file():
+                break
+        else:
+            continue
+        if rel in seen:
+            continue
+        data = seen[rel] = (src_dir / rel).read_bytes()
+        parent = posixpath.dirname(rel)
+        stack.extend((inc.decode(), parent) for inc in _INCLUDE_RE.findall(data))
+    return seen
+
+
+def pch_checksum(
+    src_dir: Path, include_headers: Iterable[str], extra: Iterable[str]
+) -> str:
+    """Digest of the prefix header's include closure plus ``extra``."""
+    digest = hashlib.sha256()
+    closure = _include_closure(src_dir, include_headers)
+    for name in sorted(closure):
+        digest.update(name.encode())
+        digest.update(closure[name])
+        digest.update(b"\0")
+    for item in extra:
+        digest.update(item.encode())
+        digest.update(b"\0")
+    return digest.hexdigest()
+
+
+def pch_identity(
+    tokens: Iterable[str],
+    src_dir: Path,
+    include_headers: tuple[str, ...],
+    extra: Iterable[str],
+) -> str:
+    """The .sum digest: include closure, header text, ``extra`` and the
+    compile flags with the build path stripped, as ccache does."""
+    from esphome.core import CORE
+
+    flags = (
+        " ".join(tokens)
+        .replace(str(CORE.build_path), "")
+        .replace(effective_ccache_basedir(), "")
+    )
+    # The closure is sorted, so header order only enters via the text
+    return pch_checksum(
+        src_dir, include_headers, (pch_header_text(include_headers), *extra, flags)
+    )
+
+
+_DISABLE_HINT = " (set ESPHOME_PCH_ENABLE=0 to disable)"
+
+
+def log_pch_in_use() -> None:
+    _LOGGER.info("Compiling with a precompiled header%s", _DISABLE_HINT)

esphome/build_helpers/size_summary.py

@@ -0,0 +1,24 @@
+"""The PlatformIO-format size bar shared by the native toolchains."""
+
+from __future__ import annotations
+
+
+def format_bar(used: int, total: int) -> str:
+    """Match PlatformIO's ``_format_availale_bytes`` (sic, pioupload.py) exactly."""
+    pct_raw = used / total if total else 0
+    blocks = 10
+    filled = min(int(round(blocks * pct_raw)), blocks)
+    progress = "=" * filled
+    return (
+        f"[{progress:<{blocks}}] {pct_raw: 6.1%} "
+        f"(used {used:d} bytes from {total:d} bytes)"
+    )
+
+
+def print_size_line(label: str, used: int, total: int) -> None:
+    """One PlatformIO-format summary line (``RAM``/``Flash``).
+
+    The label padding is part of the format: ``script/ci_memory_impact_extract.py``
+    matches these lines verbatim.
+    """
+    print(f"{label + ':':<7}{format_bar(used, total)}")

esphome/build_helpers/tool_runner.py

@@ -0,0 +1,180 @@
+"""Run a native build tool (cmake, ninja) and relay its output.
+
+Output is read from a pipe so it can be filtered here: a child that inherits
+our stdout writes straight to the file descriptor, past any Python wrapper.
+"""
+
+from __future__ import annotations
+
+import codecs
+from contextlib import suppress
+import logging
+import os
+from pathlib import Path
+import re
+import shutil
+import subprocess
+import sys
+from typing import Any, TextIO
+
+from esphome.util import ANSI_ESCAPE, RedirectText, shlex_quote
+
+_LOGGER = logging.getLogger(__name__)
+
+# Windows code page identifier for UTF-8, as used by ``chcp 65001``.
+UTF8_CODEPAGE = 65001
+
+# Same pattern idf.py uses to spot ninja status lines (``is_progression``).
+_PROGRESS = re.compile(r"^\[\d+/\d+\]|.*\(\d+ \%\)$")
+_READ_SIZE = 65536
+
+
+def _get_kernel32() -> Any | None:
+    """Return the Windows kernel32 module, or None on any other platform."""
+    if sys.platform != "win32":
+        return None
+    import ctypes
+
+    return ctypes.windll.kernel32
+
+
+class Utf8Console:
+    """Keep an attached Windows console on UTF-8 while a build tool runs.
+
+    esp_idf_size draws its table with Unicode box characters, and CMake
+    re-decodes a child's output with the console code page, which garbles the
+    table on any page but UTF-8. A console already on UTF-8 is left alone so
+    an overlapping build never records UTF-8 as the page to go back to.
+    """
+
+    def __init__(self, kernel32: Any | None) -> None:
+        self._kernel32 = kernel32
+        self._codepages: tuple[int, int] | None = None
+
+    def __enter__(self) -> None:
+        kernel32 = self._kernel32
+        if kernel32 is None:
+            return
+        old_in = kernel32.GetConsoleCP()
+        old_out = kernel32.GetConsoleOutputCP()
+        # Both calls return 0 when no console is attached.
+        if not old_in or not old_out:
+            return
+        if old_in == UTF8_CODEPAGE and old_out == UTF8_CODEPAGE:
+            return
+        # Record first so a switch that fails part way is still undone.
+        self._codepages = (old_in, old_out)
+        kernel32.SetConsoleCP(UTF8_CODEPAGE)
+        kernel32.SetConsoleOutputCP(UTF8_CODEPAGE)
+
+    def __exit__(self, *exc_info: object) -> None:
+        if self._codepages is None:
+            return
+        old_in, old_out = self._codepages
+        self._codepages = None
+        self._kernel32.SetConsoleCP(old_in)
+        self._kernel32.SetConsoleOutputCP(old_out)
+
+
+def _fit_terminal(text: str) -> str:
+    """Elide the middle of ``text`` to fit the terminal, as idf.py does.
+
+    A width of 0 (a pipe, the dashboard) leaves the text whole.
+    """
+    width = shutil.get_terminal_size((0, 0)).columns
+    if not width:
+        return text
+    if width <= 3:
+        return "." * width
+    if len(text) >= width:
+        keep = (width - 3) // 2
+        return f"{text[:keep]}...{text[len(text) - keep :]}"
+    return text
+
+
+class ToolOutput(RedirectText):
+    """RedirectText that can collapse ninja status lines into one line.
+
+    With ``progress`` each ``[n/m]`` line overwrites the previous one, the
+    way idf.py shows a build.
+    """
+
+    def __init__(
+        self, out: TextIO, filter_lines: list[str] | None, progress: bool
+    ) -> None:
+        super().__init__(out, filter_lines=filter_lines)
+        self._progress = progress
+        self._on_progress_line = False
+
+    def _splits_lines(self) -> bool:
+        return self._progress or super()._splits_lines()
+
+    def _emit_line(self, line: str) -> None:
+        if self._progress and _PROGRESS.match(line):
+            if not self._is_filtered(line):
+                text = _fit_terminal(line.strip("\r\n"))
+                self._write_color_replace(f"\r{text}\x1b[K")
+                self._on_progress_line = True
+            return
+        self._end_progress_line()
+        super()._emit_line(line)
+
+    def _end_progress_line(self) -> None:
+        if self._on_progress_line:
+            self._on_progress_line = False
+            self._write_color_replace(os.linesep)
+
+    def drain(self) -> None:
+        super().drain()
+        # Called from cleanup, so a broken stream must not hide the exit code.
+        with suppress(OSError, ValueError):
+            self._end_progress_line()
+            self._out.flush()
+
+
+def run_build_tool(
+    cmd: list[str],
+    *,
+    cwd: Path,
+    env: dict[str, str],
+    filter_lines: list[str] | None = None,
+    progress: bool = False,
+    log_path: Path | None = None,
+) -> int:
+    """Run ``cmd`` and relay stdout and stderr, merged, to our stdout.
+
+    ``log_path`` also gets the full, unfiltered output without color codes, as
+    idf.py wrote its logs (its hint patterns expect plain text). Returns the
+    exit code.
+    """
+    _LOGGER.debug("Running: %s", " ".join(shlex_quote(arg) for arg in cmd))
+    _LOGGER.debug("  in directory: %s", cwd)
+    output = ToolOutput(sys.stdout, filter_lines, progress)
+    decoder = codecs.getincrementaldecoder("utf-8")(errors="replace")
+    if log_path is not None:
+        log_path.parent.mkdir(parents=True, exist_ok=True)
+    with (
+        Path(log_path or os.devnull).open("w", encoding="utf-8", newline="") as log,
+        Utf8Console(_get_kernel32()),
+        subprocess.Popen(
+            cmd,
+            cwd=cwd,
+            env=env,
+            stdout=subprocess.PIPE,
+            stderr=subprocess.STDOUT,
+            close_fds=False,
+        ) as proc,
+    ):
+        try:
+            # read1 returns as soon as anything is available, so output
+            # streams while the tool runs.
+            while chunk := proc.stdout.read1(_READ_SIZE):
+                text = decoder.decode(chunk)
+                log.write(ANSI_ESCAPE.sub("", text))
+                output.write(text)
+            if tail := decoder.decode(b"", final=True):
+                log.write(ANSI_ESCAPE.sub("", tail))
+                output.write(tail)
+        finally:
+            output.drain()
+    return proc.returncode

esphome/build_helpers/tools_cache.py

@@ -0,0 +1,46 @@
+"""Machine-global tools cache location shared by the native backends."""
+
+from __future__ import annotations
+
+from pathlib import Path
+
+
+def tools_cache_path(env_var: str, subdir: str) -> Path:
+    """A backend's machine-global tools directory, with an env override.
+
+    A blank/whitespace override is treated as unset: ``Path("")`` resolves
+    to the CWD, which ``clean-all`` would then delete.
+    """
+    import platformdirs
+
+    from esphome.helpers import get_str_env
+
+    if prefix := get_str_env(env_var, "").strip():
+        # resolve(): a symlinked prefix would otherwise record a second
+        # spelling of the same paths in the build tree
+        return Path(prefix).expanduser().resolve()
+    # appauthor=False keeps the Windows path short (no vendor segment);
+    # deep IDF trees run into MAX_PATH otherwise
+    return (
+        Path(platformdirs.user_cache_dir("esphome", appauthor=False)) / subdir
+    ).resolve()
+
+
+# (env override, cache subdir) per native backend. writer.clean_all wipes
+# every entry via tools_cache_path, so listing a cache here is the single
+# step that registers it for removal; the backends' own path getters use
+# the same named pairs so the two cannot drift.
+IDF_TOOLS_CACHE = ("ESPHOME_ESP_IDF_PREFIX", "idf")
+SDK_NRF_TOOLS_CACHE = ("ESPHOME_SDK_NRF_PREFIX", "sdk-nrf")
+ARDUINO8266_TOOLS_CACHE = ("ESPHOME_ARDUINO8266_PREFIX", "arduino8266")
+# The host backend installs nothing; the entry only holds its ccache dir
+HOST_TOOLS_CACHE = ("ESPHOME_HOST_PREFIX", "host")
+# PlatformIO installs into its own dirs; the entry is its ccache dir itself
+PLATFORMIO_CCACHE = ("ESPHOME_PLATFORMIO_CCACHE_DIR", "platformio-ccache")
+TOOLS_CACHE_SPECS = (
+    IDF_TOOLS_CACHE,
+    SDK_NRF_TOOLS_CACHE,
+    ARDUINO8266_TOOLS_CACHE,
+    HOST_TOOLS_CACHE,
+    PLATFORMIO_CCACHE,
+)

esphome/codegen.py

@@ -25,6 +25,7 @@ from esphome.cpp_generator import (  # noqa: F401
     add,
     add_build_flag,
     add_build_unflag,
+    add_cmake_arg,
     add_cxx_build_flag,
     add_define,
     add_global,
@@ -41,6 +42,7 @@ from esphome.cpp_generator import (  # noqa: F401
     set_cpp_standard,
     statement,
     static_const_array,
+    static_function,
     templatable,
     variable,
     with_local_variable,
@@ -63,7 +65,6 @@ from esphome.cpp_types import (  # noqa: F401
     Application,
     Component,
     ComponentPtr,
-    Controller,
     EntityBase,
     EntityCategory,
     ESPTime,
@@ -77,6 +78,7 @@ from esphome.cpp_types import (  # noqa: F401
     StringRef,
     arduino_json_ns,
     bool_,
+    char,
     const_char_ptr,
     double,
     esphome_ns,

esphome/compiled_config.py

@@ -100,6 +100,21 @@ def _refresh_sidecar() -> bool:
             )
             return False
         if old is not None and old.can_apply_to_core():
+            if (
+                old.toolchain is not None
+                and CORE.toolchain is not None
+                and old.toolchain != CORE.toolchain.value
+            ):
+                # Platforms normalize toolchain-sensitive keys differently;
+                # never cache a config validated under a different toolchain
+                # than the compile's
+                _LOGGER.debug(
+                    "Not caching: config validated with toolchain %r but the "
+                    "last compile used %r",
+                    CORE.toolchain.value,
+                    old.toolchain,
+                )
+                return False
             # Compile-written; nothing to refresh.
             return True
         if CORE.build_path is not None and CORE.build_path.exists():

esphome/component_aliases.py

@@ -6,5 +6,6 @@ See the component-alias section of esphome/loader.py.
 
 # alias -> (canonical component, removal version or None)
 COMPONENT_ALIASES: dict[str, tuple[str, str | None]] = {
+    "esp32_improv": ("improv_ble", "2027.4.0"),
     "rp2040": ("rp2", "2027.7.0"),
 }

esphome/components/a01nyub/sensor.py

@@ -6,6 +6,7 @@ from esphome.const import (
     STATE_CLASS_MEASUREMENT,
     UNIT_METER,
 )
+from esphome.types import ConfigType
 
 CODEOWNERS = ["@MrSuicideParrot"]
 DEPENDENCIES = ["uart"]
@@ -35,7 +36,7 @@ FINAL_VALIDATE_SCHEMA = uart.final_validate_device_schema(
 )
 
 
-async def to_code(config):
+async def to_code(config: ConfigType) -> None:
     var = await sensor.new_sensor(config)
     await cg.register_component(var, config)
     await uart.register_uart_device(var, config)

esphome/components/a02yyuw/sensor.py

@@ -6,6 +6,7 @@ from esphome.const import (
     STATE_CLASS_MEASUREMENT,
     UNIT_MILLIMETER,
 )
+from esphome.types import ConfigType
 
 CODEOWNERS = ["@TH-Braemer"]
 DEPENDENCIES = ["uart"]
@@ -35,7 +36,7 @@ FINAL_VALIDATE_SCHEMA = uart.final_validate_device_schema(
 )
 
 
-async def to_code(config):
+async def to_code(config: ConfigType) -> None:
     var = await sensor.new_sensor(config)
     await cg.register_component(var, config)
     await uart.register_uart_device(var, config)

esphome/components/a4988/stepper.py

@@ -3,6 +3,7 @@ import esphome.codegen as cg
 from esphome.components import stepper
 import esphome.config_validation as cv
 from esphome.const import CONF_DIR_PIN, CONF_ID, CONF_SLEEP_PIN, CONF_STEP_PIN
+from esphome.types import ConfigType
 
 a4988_ns = cg.esphome_ns.namespace("a4988")
 A4988 = a4988_ns.class_("A4988", stepper.Stepper, cg.Component)
@@ -17,7 +18,7 @@ CONFIG_SCHEMA = stepper.STEPPER_SCHEMA.extend(
 ).extend(cv.COMPONENT_SCHEMA)
 
 
-async def to_code(config):
+async def to_code(config: ConfigType) -> None:
     var = cg.new_Pvariable(config[CONF_ID])
     await cg.register_component(var, config)
     await stepper.register_stepper(var, config)

esphome/components/absolute_humidity/sensor.py

@@ -9,6 +9,7 @@ from esphome.const import (
     STATE_CLASS_MEASUREMENT,
     UNIT_GRAMS_PER_CUBIC_METER,
 )
+from esphome.types import ConfigType
 
 absolute_humidity_ns = cg.esphome_ns.namespace("absolute_humidity")
 AbsoluteHumidityComponent = absolute_humidity_ns.class_(
@@ -43,7 +44,7 @@ CONFIG_SCHEMA = (
 )
 
 
-async def to_code(config):
+async def to_code(config: ConfigType) -> None:
     var = await sensor.new_sensor(config)
     await cg.register_component(var, config)
 

esphome/components/ac_dimmer/output.py

@@ -4,6 +4,7 @@ from esphome.components import output
 import esphome.config_validation as cv
 from esphome.const import CONF_ID, CONF_METHOD, CONF_MIN_POWER
 from esphome.core import CORE
+from esphome.types import ConfigType
 
 CODEOWNERS = ["@glmnet"]
 
@@ -48,7 +49,13 @@ CONFIG_SCHEMA = cv.All(
 )
 
 
-async def to_code(config):
+async def to_code(config: ConfigType) -> None:
+    if CORE.is_esp32:
+        from esphome.components.esp32 import include_builtin_idf_component
+
+        # Re-enable the gptimer driver (excluded by default to save compile time)
+        include_builtin_idf_component("esp_driver_gptimer")
+
     if CORE.is_esp8266:
         # ac_dimmer uses setTimer1Callback which requires the waveform generator
         from esphome.components.esp8266.const import require_waveform

esphome/components/adalight/__init__.py

@@ -4,6 +4,9 @@ from esphome.components.light.effects import register_addressable_effect
 from esphome.components.light.types import AddressableLightEffect
 import esphome.config_validation as cv
 from esphome.const import CONF_NAME, CONF_UART_ID
+from esphome.core import ID
+from esphome.cpp_generator import MockObj
+from esphome.types import ConfigType
 
 DEPENDENCIES = ["uart"]
 
@@ -21,7 +24,7 @@ CONFIG_SCHEMA = cv.Schema({})
     "Adalight",
     {cv.GenerateID(CONF_UART_ID): cv.use_id(uart.UARTComponent)},
 )
-async def adalight_light_effect_to_code(config, effect_id):
+async def adalight_light_effect_to_code(config: ConfigType, effect_id: ID) -> MockObj:
     effect = cg.new_Pvariable(effect_id, config[CONF_NAME])
     await uart.register_uart_device(effect, config)
     return effect

esphome/components/adc/__init__.py

@@ -1,3 +1,5 @@
+from typing import Any
+
 from esphome import pins
 import esphome.codegen as cg
 from esphome.components.esp32 import (
@@ -11,11 +13,13 @@ from esphome.components.esp32 import (
     VARIANT_ESP32P4,
     VARIANT_ESP32S2,
     VARIANT_ESP32S3,
+    VARIANT_ESP32S31,
     get_esp32_variant,
 )
 import esphome.config_validation as cv
 from esphome.const import CONF_ANALOG, CONF_INPUT, CONF_NUMBER, PLATFORM_ESP8266
 from esphome.core import CORE
+from esphome.types import ConfigType
 
 CODEOWNERS = ["@esphome/core"]
 
@@ -153,6 +157,17 @@ ESP32_VARIANT_ADC1_PIN_TO_CHANNEL = {
         9: adc_channel_t.ADC_CHANNEL_8,
         10: adc_channel_t.ADC_CHANNEL_9,
     },
+    # https://github.com/espressif/esp-idf/blob/master/components/soc/esp32s31/include/soc/adc_channel.h
+    VARIANT_ESP32S31: {
+        42: adc_channel_t.ADC_CHANNEL_0,
+        43: adc_channel_t.ADC_CHANNEL_1,
+        44: adc_channel_t.ADC_CHANNEL_2,
+        45: adc_channel_t.ADC_CHANNEL_3,
+        46: adc_channel_t.ADC_CHANNEL_4,
+        47: adc_channel_t.ADC_CHANNEL_5,
+        48: adc_channel_t.ADC_CHANNEL_6,
+        49: adc_channel_t.ADC_CHANNEL_7,
+    },
 }
 
 # pin to adc2 channel mapping
@@ -222,10 +237,21 @@ ESP32_VARIANT_ADC2_PIN_TO_CHANNEL = {
         19: adc_channel_t.ADC_CHANNEL_8,
         20: adc_channel_t.ADC_CHANNEL_9,
     },
+    # https://github.com/espressif/esp-idf/blob/master/components/soc/esp32s31/include/soc/adc_channel.h
+    VARIANT_ESP32S31: {
+        50: adc_channel_t.ADC_CHANNEL_0,
+        51: adc_channel_t.ADC_CHANNEL_1,
+        52: adc_channel_t.ADC_CHANNEL_2,
+        53: adc_channel_t.ADC_CHANNEL_3,
+        54: adc_channel_t.ADC_CHANNEL_4,
+        55: adc_channel_t.ADC_CHANNEL_5,
+        56: adc_channel_t.ADC_CHANNEL_6,
+        57: adc_channel_t.ADC_CHANNEL_7,
+    },
 }
 
 
-def validate_adc_pin(value):
+def validate_adc_pin(value: Any) -> ConfigType | str:
     if str(value).upper() == "VCC":
         if CORE.is_rp2:
             return pins.internal_gpio_input_pin_schema(29)

esphome/components/adc/adc_sensor.h

@@ -94,7 +94,7 @@ class ADCSensor final : public sensor::Sensor, public PollingComponent, public v
   ///   - SamplingMode::MIN: Use the lowest sample value
   ///   - SamplingMode::MAX: Use the highest sample value
   /// @param sampling_mode The desired sampling mode to use for aggregating ADC samples.
-  void set_sampling_mode(SamplingMode sampling_mode);
+  void set_sampling_mode(SamplingMode sampling_mode) { this->sampling_mode_ = sampling_mode; }
 
   /// Perform a single ADC sampling operation and return the measured value.
   /// This function handles raw readings, calibration, and averaging as needed.

esphome/components/adc/adc_sensor_common.cpp

@@ -76,6 +76,4 @@ void ADCSensor::set_sample_count(uint8_t sample_count) {
   }
 }
 
-void ADCSensor::set_sampling_mode(SamplingMode sampling_mode) { this->sampling_mode_ = sampling_mode; }
-
 }  // namespace esphome::adc

esphome/components/adc/adc_sensor_esp32.cpp

@@ -74,9 +74,7 @@ void ADCSensor::setup() {
   if (this->calibration_handle_ == nullptr) {
     adc_cali_handle_t handle = nullptr;
 
-#if USE_ESP32_VARIANT_ESP32C3 || USE_ESP32_VARIANT_ESP32C5 || USE_ESP32_VARIANT_ESP32C6 || \
-    USE_ESP32_VARIANT_ESP32C61 || USE_ESP32_VARIANT_ESP32H2 || USE_ESP32_VARIANT_ESP32P4 || USE_ESP32_VARIANT_ESP32S3
-    // RISC-V variants (except C2) and S3 use curve fitting calibration
+#if defined(ADC_CALI_SCHEME_CURVE_FITTING_SUPPORTED)
     adc_cali_curve_fitting_config_t cali_config = {};  // Zero initialize first
 #if ESP_IDF_VERSION >= ESP_IDF_VERSION_VAL(5, 3, 0)
     cali_config.chan = this->channel_;
@@ -94,7 +92,7 @@ void ADCSensor::setup() {
       ESP_LOGW(TAG, "Curve fitting calibration failed with error %d, will use uncalibrated readings", err);
       this->setup_flags_.calibration_complete = false;
     }
-#else  // ESP32, ESP32-S2, and ESP32-C2 use line fitting calibration
+#elif defined(ADC_CALI_SCHEME_LINE_FITTING_SUPPORTED)
     adc_cali_line_fitting_config_t cali_config = {
       .unit_id = this->adc_unit_,
       .atten = this->attenuation_,
@@ -112,7 +110,11 @@ void ADCSensor::setup() {
       ESP_LOGW(TAG, "Line fitting calibration failed with error %d, will use uncalibrated readings", err);
       this->setup_flags_.calibration_complete = false;
     }
-#endif  // ESP32C3 || ESP32C5 || ESP32C6 || ESP32C61 || ESP32H2 || ESP32P4 || ESP32S3
+#else   // No calibration scheme available
+    (void) handle;
+    ESP_LOGD(TAG, "No calibration scheme for this variant, readings are uncalibrated");
+    this->setup_flags_.calibration_complete = false;
+#endif
   }
 
   this->setup_flags_.init_complete = true;
@@ -121,23 +123,28 @@ void ADCSensor::setup() {
 void ADCSensor::dump_config() {
   LOG_SENSOR("", "ADC Sensor", this);
   LOG_PIN("  Pin: ", this->pin_);
-  ESP_LOGCONFIG(
-      TAG,
-      "  Channel:       %d\n"
-      "  Unit:          %s\n"
-      "  Attenuation:   %s\n"
-      "  Samples:       %i\n"
-      "  Sampling mode: %s\n"
-      "  Setup Status:\n"
-      "    Handle Init:  %s\n"
-      "    Config:       %s\n"
-      "    Calibration:  %s\n"
-      "    Overall Init: %s",
-      this->channel_, LOG_STR_ARG(adc_unit_to_str(this->adc_unit_)),
-      this->autorange_ ? "Auto" : LOG_STR_ARG(attenuation_to_str(this->attenuation_)), this->sample_count_,
-      LOG_STR_ARG(sampling_mode_to_str(this->sampling_mode_)),
-      this->setup_flags_.handle_init_complete ? "OK" : "FAILED", this->setup_flags_.config_complete ? "OK" : "FAILED",
-      this->setup_flags_.calibration_complete ? "OK" : "FAILED", this->setup_flags_.init_complete ? "OK" : "FAILED");
+#if defined(ADC_CALI_SCHEME_CURVE_FITTING_SUPPORTED) || defined(ADC_CALI_SCHEME_LINE_FITTING_SUPPORTED)
+  const char *calibration_status = this->setup_flags_.calibration_complete ? "OK" : "FAILED";
+#else
+  const char *calibration_status = "N/A";  // This variant has no calibration scheme
+#endif
+  ESP_LOGCONFIG(TAG,
+                "  Channel:       %d\n"
+                "  Unit:          %s\n"
+                "  Attenuation:   %s\n"
+                "  Samples:       %i\n"
+                "  Sampling mode: %s\n"
+                "  Setup Status:\n"
+                "    Handle Init:  %s\n"
+                "    Config:       %s\n"
+                "    Calibration:  %s\n"
+                "    Overall Init: %s",
+                this->channel_, LOG_STR_ARG(adc_unit_to_str(this->adc_unit_)),
+                this->autorange_ ? "Auto" : LOG_STR_ARG(attenuation_to_str(this->attenuation_)), this->sample_count_,
+                LOG_STR_ARG(sampling_mode_to_str(this->sampling_mode_)),
+                this->setup_flags_.handle_init_complete ? "OK" : "FAILED",
+                this->setup_flags_.config_complete ? "OK" : "FAILED", calibration_status,
+                this->setup_flags_.init_complete ? "OK" : "FAILED");
 
   LOG_UPDATE_INTERVAL(this);
 }
@@ -184,12 +191,11 @@ float ADCSensor::sample_fixed_attenuation_() {
     } else {
       ESP_LOGW(TAG, "ADC calibration conversion failed with error %d, disabling calibration", err);
       if (this->calibration_handle_ != nullptr) {
-#if USE_ESP32_VARIANT_ESP32C3 || USE_ESP32_VARIANT_ESP32C5 || USE_ESP32_VARIANT_ESP32C6 || \
-    USE_ESP32_VARIANT_ESP32C61 || USE_ESP32_VARIANT_ESP32H2 || USE_ESP32_VARIANT_ESP32P4 || USE_ESP32_VARIANT_ESP32S3
+#if defined(ADC_CALI_SCHEME_CURVE_FITTING_SUPPORTED)
         adc_cali_delete_scheme_curve_fitting(this->calibration_handle_);
-#else   // Other ESP32 variants use line fitting calibration
+#elif defined(ADC_CALI_SCHEME_LINE_FITTING_SUPPORTED)
         adc_cali_delete_scheme_line_fitting(this->calibration_handle_);
-#endif  // ESP32C3 || ESP32C5 || ESP32C6 || ESP32C61 || ESP32H2 || ESP32P4 || ESP32S3
+#endif
         this->calibration_handle_ = nullptr;
       }
     }
@@ -217,10 +223,9 @@ float ADCSensor::sample_autorange_() {
     // Need to recalibrate for the new attenuation
     if (this->calibration_handle_ != nullptr) {
       // Delete old calibration handle
-#if USE_ESP32_VARIANT_ESP32C3 || USE_ESP32_VARIANT_ESP32C5 || USE_ESP32_VARIANT_ESP32C6 || \
-    USE_ESP32_VARIANT_ESP32C61 || USE_ESP32_VARIANT_ESP32H2 || USE_ESP32_VARIANT_ESP32P4 || USE_ESP32_VARIANT_ESP32S3
+#if defined(ADC_CALI_SCHEME_CURVE_FITTING_SUPPORTED)
       adc_cali_delete_scheme_curve_fitting(this->calibration_handle_);
-#else
+#elif defined(ADC_CALI_SCHEME_LINE_FITTING_SUPPORTED)
       adc_cali_delete_scheme_line_fitting(this->calibration_handle_);
 #endif
       this->calibration_handle_ = nullptr;
@@ -229,8 +234,7 @@ float ADCSensor::sample_autorange_() {
     // Create new calibration handle for this attenuation
     adc_cali_handle_t handle = nullptr;
 
-#if USE_ESP32_VARIANT_ESP32C3 || USE_ESP32_VARIANT_ESP32C5 || USE_ESP32_VARIANT_ESP32C6 || \
-    USE_ESP32_VARIANT_ESP32C61 || USE_ESP32_VARIANT_ESP32H2 || USE_ESP32_VARIANT_ESP32P4 || USE_ESP32_VARIANT_ESP32S3
+#if defined(ADC_CALI_SCHEME_CURVE_FITTING_SUPPORTED)
     adc_cali_curve_fitting_config_t cali_config = {};
 #if ESP_IDF_VERSION >= ESP_IDF_VERSION_VAL(5, 3, 0)
     cali_config.chan = this->channel_;
@@ -242,7 +246,7 @@ float ADCSensor::sample_autorange_() {
     err = adc_cali_create_scheme_curve_fitting(&cali_config, &handle);
     ESP_LOGVV(TAG, "Autorange atten=%d: Calibration handle creation %s (err=%d)", atten,
               (err == ESP_OK) ? "SUCCESS" : "FAILED", err);
-#else
+#elif defined(ADC_CALI_SCHEME_LINE_FITTING_SUPPORTED)
     adc_cali_line_fitting_config_t cali_config = {
       .unit_id = this->adc_unit_,
       .atten = atten,
@@ -264,10 +268,9 @@ float ADCSensor::sample_autorange_() {
     if (err != ESP_OK) {
       ESP_LOGW(TAG, "ADC read failed in autorange with error %d", err);
       if (handle != nullptr) {
-#if USE_ESP32_VARIANT_ESP32C3 || USE_ESP32_VARIANT_ESP32C5 || USE_ESP32_VARIANT_ESP32C6 || \
-    USE_ESP32_VARIANT_ESP32C61 || USE_ESP32_VARIANT_ESP32H2 || USE_ESP32_VARIANT_ESP32P4 || USE_ESP32_VARIANT_ESP32S3
+#if defined(ADC_CALI_SCHEME_CURVE_FITTING_SUPPORTED)
         adc_cali_delete_scheme_curve_fitting(handle);
-#else
+#elif defined(ADC_CALI_SCHEME_LINE_FITTING_SUPPORTED)
         adc_cali_delete_scheme_line_fitting(handle);
 #endif
       }
@@ -286,10 +289,9 @@ float ADCSensor::sample_autorange_() {
         ESP_LOGVV(TAG, "Autorange atten=%d: UNCALIBRATED FALLBACK - raw=%d -> %.6fV (3.3V ref)", atten, raw, voltage);
       }
       // Clean up calibration handle
-#if USE_ESP32_VARIANT_ESP32C3 || USE_ESP32_VARIANT_ESP32C5 || USE_ESP32_VARIANT_ESP32C6 || \
-    USE_ESP32_VARIANT_ESP32C61 || USE_ESP32_VARIANT_ESP32H2 || USE_ESP32_VARIANT_ESP32P4 || USE_ESP32_VARIANT_ESP32S3
+#if defined(ADC_CALI_SCHEME_CURVE_FITTING_SUPPORTED)
       adc_cali_delete_scheme_curve_fitting(handle);
-#else
+#elif defined(ADC_CALI_SCHEME_LINE_FITTING_SUPPORTED)
       adc_cali_delete_scheme_line_fitting(handle);
 #endif
     } else {

esphome/components/adc/sensor.py

@@ -3,6 +3,7 @@ import logging
 import esphome.codegen as cg
 from esphome.components import sensor, voltage_sampler
 from esphome.components.esp32 import (
+    VARIANT_ESP32S31,
     get_esp32_variant,
     include_builtin_idf_component,
     require_adc_oneshot_iram,
@@ -52,10 +53,18 @@ _attenuation = cv.enum(ATTENUATION_MODES, lower=True)
 _sampling_mode = cv.enum(SAMPLING_MODES, lower=True)
 
 
-def validate_config(config):
+def validate_config(config: ConfigType) -> ConfigType:
     if config[CONF_RAW] and config.get(CONF_ATTENUATION, None) == "auto":
         raise cv.Invalid("Automatic attenuation cannot be used when raw output is set")
 
+    # The S31 ADC supports a single attenuation level (SOC_ADC_ATTEN_NUM is 1)
+    if (
+        CORE.is_esp32
+        and get_esp32_variant() == VARIANT_ESP32S31
+        and config.get(CONF_ATTENUATION, "0db") != "0db"
+    ):
+        raise cv.Invalid("ESP32-S31 only supports 'attenuation: 0db'")
+
     if config.get(CONF_ATTENUATION, None) == "auto" and config.get(CONF_SAMPLES, 1) > 1:
         raise cv.Invalid(
             "Automatic attenuation cannot be used when multisampling is set"
@@ -120,7 +129,7 @@ CONFIG_SCHEMA = cv.All(
 CONF_ADC_CHANNEL_ID = "adc_channel_id"
 
 
-def _overlay_io_channels():
+def _overlay_io_channels() -> str:
     channel_count = CORE.data[CONF_ADC_CHANNEL_ID]
     entries = ", ".join(f"<&adc {channel_id}>" for channel_id in range(channel_count))
     return f"""
@@ -132,7 +141,7 @@ def _overlay_io_channels():
             """
 
 
-async def to_code(config):
+async def to_code(config: ConfigType) -> None:
     var = cg.new_Pvariable(config[CONF_ID])
     await cg.register_component(var, config)
     await sensor.register_sensor(var, config)

esphome/components/adc128s102/__init__.py

@@ -2,6 +2,7 @@ import esphome.codegen as cg
 from esphome.components import spi
 import esphome.config_validation as cv
 from esphome.const import CONF_ID
+from esphome.types import ConfigType
 
 DEPENDENCIES = ["spi"]
 MULTI_CONF = True
@@ -17,7 +18,7 @@ CONFIG_SCHEMA = cv.Schema(
 ).extend(spi.spi_device_schema(cs_pin_required=True))
 
 
-async def to_code(config):
+async def to_code(config: ConfigType) -> None:
     var = cg.new_Pvariable(config[CONF_ID])
     await cg.register_component(var, config)
     await spi.register_spi_device(var, config)

esphome/components/adc128s102/sensor/__init__.py

@@ -2,6 +2,7 @@ import esphome.codegen as cg
 from esphome.components import sensor, voltage_sampler
 import esphome.config_validation as cv
 from esphome.const import CONF_CHANNEL, CONF_ID
+from esphome.types import ConfigType
 
 from .. import ADC128S102, adc128s102_ns
 
@@ -28,7 +29,7 @@ CONFIG_SCHEMA = (
 )
 
 
-async def to_code(config):
+async def to_code(config: ConfigType) -> None:
     var = cg.new_Pvariable(
         config[CONF_ID],
         config[CONF_CHANNEL],

esphome/components/addressable_light/display.py

@@ -11,6 +11,7 @@ from esphome.const import (
     CONF_UPDATE_INTERVAL,
     CONF_WIDTH,
 )
+from esphome.types import ConfigType
 
 CODEOWNERS = ["@justfalter"]
 
@@ -38,7 +39,7 @@ CONFIG_SCHEMA = cv.All(
 )
 
 
-async def to_code(config):
+async def to_code(config: ConfigType) -> None:
     var = cg.new_Pvariable(config[CONF_ID])
     wrapped_light = await cg.get_variable(config[CONF_ADDRESSABLE_LIGHT_ID])
     cg.add(var.set_width(config[CONF_WIDTH]))

esphome/components/ade7880/sensor.py

@@ -36,6 +36,7 @@ from esphome.const import (
     UNIT_WATT,
     UNIT_WATT_HOURS,
 )
+from esphome.cpp_generator import MockObj
 from esphome.types import ConfigType
 
 DEPENDENCIES = ["i2c"]
@@ -243,7 +244,7 @@ CONFIG_SCHEMA = cv.All(
 )
 
 
-async def neutral_channel(config):
+async def neutral_channel(config: ConfigType) -> MockObj:
     var = cg.new_Pvariable(config[CONF_ID])
 
     current = config[CONF_CURRENT]
@@ -257,7 +258,7 @@ async def neutral_channel(config):
     return var
 
 
-async def power_channel(config):
+async def power_channel(config: ConfigType) -> MockObj:
     var = cg.new_Pvariable(config[CONF_ID])
 
     for sensor_type in POWER_SENSOR_TYPES:
@@ -280,7 +281,7 @@ async def power_channel(config):
     return var
 
 
-async def to_code(config):
+async def to_code(config: ConfigType) -> None:
     var = cg.new_Pvariable(config[CONF_ID])
     await cg.register_component(var, config)
     await i2c.register_i2c_device(var, config)

esphome/components/ade7953_base/__init__.py

@@ -23,6 +23,8 @@ from esphome.const import (
     UNIT_VOLT_AMPS_REACTIVE,
     UNIT_WATT,
 )
+from esphome.cpp_generator import MockObj
+from esphome.types import ConfigType
 
 CODEOWNERS = ["@angelnu"]
 
@@ -163,7 +165,7 @@ ADE7953_CONFIG_SCHEMA = cv.Schema(
 ).extend(cv.polling_component_schema("60s"))
 
 
-async def register_ade7953(var, config):
+async def register_ade7953(var: MockObj, config: ConfigType) -> None:
     await cg.register_component(var, config)
 
     if irq_pin_config := config.get(CONF_IRQ_PIN):

esphome/components/ade7953_i2c/sensor.py

@@ -2,6 +2,7 @@ import esphome.codegen as cg
 from esphome.components import ade7953_base, i2c
 import esphome.config_validation as cv
 from esphome.const import CONF_ID
+from esphome.types import ConfigType
 
 DEPENDENCIES = ["i2c"]
 AUTO_LOAD = ["ade7953_base"]
@@ -20,7 +21,7 @@ CONFIG_SCHEMA = (
 )
 
 
-async def to_code(config):
+async def to_code(config: ConfigType) -> None:
     var = cg.new_Pvariable(config[CONF_ID])
     await i2c.register_i2c_device(var, config)
     await ade7953_base.register_ade7953(var, config)

esphome/components/ade7953_spi/sensor.py

@@ -2,6 +2,7 @@ import esphome.codegen as cg
 from esphome.components import ade7953_base, spi
 import esphome.config_validation as cv
 from esphome.const import CONF_ID
+from esphome.types import ConfigType
 
 DEPENDENCIES = ["spi"]
 AUTO_LOAD = ["ade7953_base"]
@@ -20,7 +21,7 @@ CONFIG_SCHEMA = (
 )
 
 
-async def to_code(config):
+async def to_code(config: ConfigType) -> None:
     var = cg.new_Pvariable(config[CONF_ID])
     await spi.register_spi_device(var, config)
     await ade7953_base.register_ade7953(var, config)

esphome/components/ads1115/__init__.py

@@ -2,6 +2,7 @@ import esphome.codegen as cg
 from esphome.components import i2c
 import esphome.config_validation as cv
 from esphome.const import CONF_ID
+from esphome.types import ConfigType
 
 DEPENDENCIES = ["i2c"]
 MULTI_CONF = True
@@ -24,7 +25,7 @@ CONFIG_SCHEMA = (
 )
 
 
-async def to_code(config):
+async def to_code(config: ConfigType) -> None:
     var = cg.new_Pvariable(config[CONF_ID])
     await cg.register_component(var, config)
     await i2c.register_i2c_device(var, config)

esphome/components/ads1115/sensor/__init__.py

@@ -11,6 +11,7 @@ from esphome.const import (
     STATE_CLASS_MEASUREMENT,
     UNIT_VOLT,
 )
+from esphome.types import ConfigType
 
 from .. import CONF_ADS1115_ID, ADS1115Component, ads1115_ns
 
@@ -86,7 +87,7 @@ CONFIG_SCHEMA = (
 )
 
 
-async def to_code(config):
+async def to_code(config: ConfigType) -> None:
     var = cg.new_Pvariable(config[CONF_ID])
     await sensor.register_sensor(var, config)
     await cg.register_component(var, config)

esphome/components/ads1118/__init__.py

@@ -2,6 +2,7 @@ import esphome.codegen as cg
 from esphome.components import spi
 import esphome.config_validation as cv
 from esphome.const import CONF_ID
+from esphome.types import ConfigType
 
 CODEOWNERS = ["@solomondg1"]
 DEPENDENCIES = ["spi"]
@@ -23,7 +24,7 @@ CONFIG_SCHEMA = (
 )
 
 
-async def to_code(config):
+async def to_code(config: ConfigType) -> None:
     var = cg.new_Pvariable(config[CONF_ID])
     await cg.register_component(var, config)
     await spi.register_spi_device(var, config)

esphome/components/ads1118/sensor/__init__.py

@@ -11,6 +11,7 @@ from esphome.const import (
     UNIT_CELSIUS,
     UNIT_VOLT,
 )
+from esphome.types import ConfigType
 
 from .. import ADS1118, CONF_ADS1118_ID, ads1118_ns
 
@@ -86,7 +87,7 @@ CONFIG_SCHEMA = cv.typed_schema(
 )
 
 
-async def to_code(config):
+async def to_code(config: ConfigType) -> None:
     var = await sensor.new_sensor(config)
     await cg.register_component(var, config)
     await cg.register_parented(var, config[CONF_ADS1118_ID])

esphome/components/ags10/ags10.cpp

@@ -106,6 +106,20 @@ bool AGS10Component::set_zero_point_with_factory_defaults() { return this->set_z
 
 bool AGS10Component::set_zero_point_with_current_resistance() { return this->set_zero_point_with(ZP_CURRENT); }
 
+void AGS10Component::set_zero_point(AGS10SetZeroPointActionMode mode, uint16_t value) {
+  switch (mode) {
+    case FACTORY_DEFAULT:
+      this->set_zero_point_with_factory_defaults();
+      break;
+    case CURRENT_VALUE:
+      this->set_zero_point_with_current_resistance();
+      break;
+    case CUSTOM_VALUE:
+      this->set_zero_point_with(value);
+      break;
+  }
+}
+
 bool AGS10Component::set_zero_point_with(uint16_t value) {
   std::array<uint8_t, 5> data{0x00, 0x0C, (uint8_t) ((value >> 8) & 0xFF), (uint8_t) (value & 0xFF), 0};
   data[4] = crc8(data.data(), 4, 0xFF, 0x31, true);

esphome/components/ags10/ags10.h

@@ -2,11 +2,19 @@
 
 #include "esphome/components/i2c/i2c.h"
 #include "esphome/components/sensor/sensor.h"
-#include "esphome/core/automation.h"
 #include "esphome/core/component.h"
 
 namespace esphome::ags10 {
 
+enum AGS10SetZeroPointActionMode {
+  // Zero-point reset.
+  FACTORY_DEFAULT,
+  // Zero-point calibration with current resistance.
+  CURRENT_VALUE,
+  // Zero-point calibration with custom resistance.
+  CUSTOM_VALUE,
+};
+
 class AGS10Component final : public PollingComponent, public i2c::I2CDevice {
  public:
   /**
@@ -47,6 +55,11 @@ class AGS10Component final : public PollingComponent, public i2c::I2CDevice {
    */
   bool set_zero_point_with_current_resistance();
 
+  /**
+   * Sets zero-point by mode; the value is only used for CUSTOM_VALUE.
+   */
+  void set_zero_point(AGS10SetZeroPointActionMode mode, uint16_t value);
+
   /**
    * Sets zero-point with the value.
    */
@@ -100,39 +113,4 @@ class AGS10Component final : public PollingComponent, public i2c::I2CDevice {
   template<size_t N> optional<std::array<uint8_t, N>> read_and_check_(uint8_t a_register);
 };
 
-template<typename... Ts> class AGS10NewI2cAddressAction final : public Action<Ts...>, public Parented<AGS10Component> {
- public:
-  TEMPLATABLE_VALUE(uint8_t, new_address)
-
-  void play(const Ts &...x) override { this->parent_->new_i2c_address(this->new_address_.value(x...)); }
-};
-
-enum AGS10SetZeroPointActionMode {
-  // Zero-point reset.
-  FACTORY_DEFAULT,
-  // Zero-point calibration with current resistance.
-  CURRENT_VALUE,
-  // Zero-point calibration with custom resistance.
-  CUSTOM_VALUE,
-};
-
-template<typename... Ts> class AGS10SetZeroPointAction final : public Action<Ts...>, public Parented<AGS10Component> {
- public:
-  TEMPLATABLE_VALUE(uint16_t, value)
-  TEMPLATABLE_VALUE(AGS10SetZeroPointActionMode, mode)
-
-  void play(const Ts &...x) override {
-    switch (this->mode_.value(x...)) {
-      case FACTORY_DEFAULT:
-        this->parent_->set_zero_point_with_factory_defaults();
-        break;
-      case CURRENT_VALUE:
-        this->parent_->set_zero_point_with_current_resistance();
-        break;
-      case CUSTOM_VALUE:
-        this->parent_->set_zero_point_with(this->value_.value(x...));
-        break;
-    }
-  }
-};
 }  // namespace esphome::ags10

esphome/components/ags10/sensor.py

@@ -17,6 +17,7 @@ from esphome.const import (
     UNIT_OHM,
     UNIT_PARTS_PER_BILLION,
 )
+from esphome.types import ConfigType
 
 CONF_RESISTANCE = "resistance"
 
@@ -25,12 +26,6 @@ DEPENDENCIES = ["i2c"]
 ags10_ns = cg.esphome_ns.namespace("ags10")
 AGS10Component = ags10_ns.class_("AGS10Component", cg.PollingComponent, i2c.I2CDevice)
 
-# Actions
-AGS10NewI2cAddressAction = ags10_ns.class_(
-    "AGS10NewI2cAddressAction", automation.Action
-)
-AGS10SetZeroPointAction = ags10_ns.class_("AGS10SetZeroPointAction", automation.Action)
-
 CONFIG_SCHEMA = (
     cv.Schema(
         {
@@ -62,7 +57,7 @@ CONFIG_SCHEMA = (
 FINAL_VALIDATE_SCHEMA = i2c.final_validate_device_schema("ags10", max_frequency="15khz")
 
 
-async def to_code(config):
+async def to_code(config: ConfigType) -> None:
     var = cg.new_Pvariable(config[CONF_ID])
     await cg.register_component(var, config)
     await i2c.register_i2c_device(var, config)
@@ -88,19 +83,11 @@ AGS10_NEW_I2C_ADDRESS_SCHEMA = cv.maybe_simple_value(
 )
 
 
-@automation.register_action(
+automation.register_apply_action(
     "ags10.new_i2c_address",
-    AGS10NewI2cAddressAction,
     AGS10_NEW_I2C_ADDRESS_SCHEMA,
-    synchronous=True,
+    automation.ApplyField(CONF_ADDRESS, "new_i2c_address", cg.uint8),
 )
-async def ags10newi2caddress_to_code(config, action_id, template_arg, args):
-    var = cg.new_Pvariable(action_id, template_arg)
-    await cg.register_parented(var, config[CONF_ID])
-    address = await cg.templatable(config[CONF_ADDRESS], args, cg.uint8)
-    cg.add(var.set_new_address(address))
-    return var
-
 
 AGS10SetZeroPointActionMode = ags10_ns.enum("AGS10SetZeroPointActionMode")
 AGS10_SET_ZERO_POINT_ACTION_MODE = {
@@ -120,19 +107,11 @@ AGS10_SET_ZERO_POINT_SCHEMA = cv.Schema(
 )
 
 
-@automation.register_action(
+automation.register_apply_action(
     "ags10.set_zero_point",
-    AGS10SetZeroPointAction,
     AGS10_SET_ZERO_POINT_SCHEMA,
-    synchronous=True,
+    automation.ApplyCall(
+        "set_zero_point({}, {})",
+        ((CONF_MODE, AGS10SetZeroPointActionMode), (CONF_VALUE, cg.uint16)),
+    ),
 )
-async def ags10setzeropoint_to_code(config, action_id, template_arg, args):
-    var = cg.new_Pvariable(action_id, template_arg)
-    await cg.register_parented(var, config[CONF_ID])
-    mode = await cg.templatable(
-        config.get(CONF_MODE), args, AGS10SetZeroPointActionMode
-    )
-    cg.add(var.set_mode(mode))
-    value = await cg.templatable(config[CONF_VALUE], args, cg.uint16)
-    cg.add(var.set_value(value))
-    return var

esphome/components/aht10/sensor.py

@@ -12,6 +12,7 @@ from esphome.const import (
     UNIT_CELSIUS,
     UNIT_PERCENT,
 )
+from esphome.types import ConfigType
 
 DEPENDENCIES = ["i2c"]
 
@@ -50,7 +51,7 @@ CONFIG_SCHEMA = (
 )
 
 
-async def to_code(config):
+async def to_code(config: ConfigType) -> None:
     var = cg.new_Pvariable(config[CONF_ID])
     await cg.register_component(var, config)
     await i2c.register_i2c_device(var, config)

esphome/components/aic3204/audio_dac.py

@@ -4,6 +4,7 @@ from esphome.components import i2c
 from esphome.components.audio_dac import AudioDac
 import esphome.config_validation as cv
 from esphome.const import CONF_ID, CONF_MODE
+from esphome.types import ConfigType
 
 CODEOWNERS = ["@kbx81"]
 DEPENDENCIES = ["i2c"]
@@ -11,7 +12,6 @@ DEPENDENCIES = ["i2c"]
 aic3204_ns = cg.esphome_ns.namespace("aic3204")
 AIC3204 = aic3204_ns.class_("AIC3204", AudioDac, cg.Component, i2c.I2CDevice)
 
-SetAutoMuteAction = aic3204_ns.class_("SetAutoMuteAction", automation.Action)
 
 CONFIG_SCHEMA = (
     cv.Schema(
@@ -33,23 +33,14 @@ SET_AUTO_MUTE_ACTION_SCHEMA = cv.maybe_simple_value(
 )
 
 
-@automation.register_action(
+automation.register_apply_action(
     "aic3204.set_auto_mute_mode",
-    SetAutoMuteAction,
     SET_AUTO_MUTE_ACTION_SCHEMA,
-    synchronous=True,
+    automation.ApplyField(CONF_MODE, "set_auto_mute_mode", cg.uint8),
 )
-async def aic3204_set_volume_to_code(config, action_id, template_arg, args):
-    paren = await cg.get_variable(config[CONF_ID])
-    var = cg.new_Pvariable(action_id, template_arg, paren)
-
-    template_ = await cg.templatable(config.get(CONF_MODE), args, cg.uint8)
-    cg.add(var.set_auto_mute_mode(template_))
-
-    return var
 
 
-async def to_code(config):
+async def to_code(config: ConfigType) -> None:
     var = cg.new_Pvariable(config[CONF_ID])
     await cg.register_component(var, config)
     await i2c.register_i2c_device(var, config)

esphome/components/aic3204/automation.h

@@ -1,21 +0,0 @@
-#pragma once
-
-#include "esphome/core/automation.h"
-#include "esphome/core/component.h"
-#include "aic3204.h"
-
-namespace esphome::aic3204 {
-
-template<typename... Ts> class SetAutoMuteAction final : public Action<Ts...> {
- public:
-  explicit SetAutoMuteAction(AIC3204 *aic3204) : aic3204_(aic3204) {}
-
-  TEMPLATABLE_VALUE(uint8_t, auto_mute_mode)
-
-  void play(const Ts &...x) override { this->aic3204_->set_auto_mute_mode(this->auto_mute_mode_.value(x...)); }
-
- protected:
-  AIC3204 *aic3204_;
-};
-
-}  // namespace esphome::aic3204

esphome/components/airthings_ble/__init__.py

@@ -2,6 +2,7 @@ import esphome.codegen as cg
 from esphome.components import ble_device_base
 import esphome.config_validation as cv
 from esphome.const import CONF_ID
+from esphome.types import ConfigType
 
 AUTO_LOAD = ["ble_device_base"]
 CODEOWNERS = ["@jeromelaban"]
@@ -21,6 +22,6 @@ CONFIG_SCHEMA = cv.All(
 )
 
 
-async def to_code(config):
+async def to_code(config: ConfigType) -> None:
     var = cg.new_Pvariable(config[CONF_ID])
     await ble_device_base.register_ble_device(var, config)

esphome/components/airthings_wave_base/__init__.py

@@ -20,6 +20,8 @@ from esphome.const import (
     UNIT_PERCENT,
     UNIT_VOLT,
 )
+from esphome.cpp_generator import MockObj
+from esphome.types import ConfigType
 
 CODEOWNERS = ["@ncareau", "@jeromelaban"]
 
@@ -78,25 +80,16 @@ BASE_SCHEMA = (
 )
 
 
-async def wave_base_to_code(var, config):
+async def wave_base_to_code(var: MockObj, config: ConfigType) -> None:
     await cg.register_component(var, config)
 
     await ble_client.register_ble_node(var, config)
 
-    if config_humidity := config.get(CONF_HUMIDITY):
-        sens = await sensor.new_sensor(config_humidity)
-        cg.add(var.set_humidity(sens))
-    if config_temperature := config.get(CONF_TEMPERATURE):
-        sens = await sensor.new_sensor(config_temperature)
-        cg.add(var.set_temperature(sens))
-    if config_pressure := config.get(CONF_PRESSURE):
-        sens = await sensor.new_sensor(config_pressure)
-        cg.add(var.set_pressure(sens))
-    if config_tvoc := config.get(CONF_TVOC):
-        sens = await sensor.new_sensor(config_tvoc)
-        cg.add(var.set_tvoc(sens))
-    if config_battery_voltage := config.get(CONF_BATTERY_VOLTAGE):
-        sens = await sensor.new_sensor(config_battery_voltage)
-        cg.add(var.set_battery_voltage(sens))
+    sensors = sensor.sub_sensors(config)
+    await sensors(CONF_HUMIDITY, var.set_humidity)
+    await sensors(CONF_TEMPERATURE, var.set_temperature)
+    await sensors(CONF_PRESSURE, var.set_pressure)
+    await sensors(CONF_TVOC, var.set_tvoc)
+    await sensors(CONF_BATTERY_VOLTAGE, var.set_battery_voltage)
     if config_battery_update_interval := config.get(CONF_BATTERY_UPDATE_INTERVAL):
         cg.add(var.set_battery_update_interval(config_battery_update_interval))

esphome/components/airthings_wave_mini/sensor.py

@@ -2,6 +2,7 @@ import esphome.codegen as cg
 from esphome.components import airthings_wave_base
 import esphome.config_validation as cv
 from esphome.const import CONF_ID
+from esphome.types import ConfigType
 
 DEPENDENCIES = airthings_wave_base.DEPENDENCIES
 
@@ -20,6 +21,6 @@ CONFIG_SCHEMA = airthings_wave_base.BASE_SCHEMA.extend(
 )
 
 
-async def to_code(config):
+async def to_code(config: ConfigType) -> None:
     var = cg.new_Pvariable(config[CONF_ID])
     await airthings_wave_base.wave_base_to_code(var, config)

esphome/components/airthings_wave_plus/sensor.py

@@ -83,20 +83,13 @@ CONFIG_SCHEMA = cv.All(
 )
 
 
-async def to_code(config):
+async def to_code(config: ConfigType) -> None:
     var = cg.new_Pvariable(config[CONF_ID])
     await airthings_wave_base.wave_base_to_code(var, config)
 
-    if config_radon := config.get(CONF_RADON):
-        sens = await sensor.new_sensor(config_radon)
-        cg.add(var.set_radon(sens))
-    if config_radon_long_term := config.get(CONF_RADON_LONG_TERM):
-        sens = await sensor.new_sensor(config_radon_long_term)
-        cg.add(var.set_radon_long_term(sens))
-    if config_co2 := config.get(CONF_CO2):
-        sens = await sensor.new_sensor(config_co2)
-        cg.add(var.set_co2(sens))
-    if config_illuminance := config.get(CONF_ILLUMINANCE):
-        sens = await sensor.new_sensor(config_illuminance)
-        cg.add(var.set_illuminance(sens))
+    sensors = sensor.sub_sensors(config)
+    await sensors(CONF_RADON, var.set_radon)
+    await sensors(CONF_RADON_LONG_TERM, var.set_radon_long_term)
+    await sensors(CONF_CO2, var.set_co2)
+    await sensors(CONF_ILLUMINANCE, var.set_illuminance)
     cg.add(var.set_device_type(config[CONF_DEVICE_TYPE]))

esphome/components/alarm_control_panel/__init__.py

@@ -41,18 +41,6 @@ StateAnyForwarder = alarm_control_panel_ns.class_("StateAnyForwarder")
 StateEnterForwarder = alarm_control_panel_ns.class_("StateEnterForwarder")
 AlarmControlPanelState = alarm_control_panel_ns.enum("AlarmControlPanelState")
 
-ArmAwayAction = alarm_control_panel_ns.class_("ArmAwayAction", automation.Action)
-ArmHomeAction = alarm_control_panel_ns.class_("ArmHomeAction", automation.Action)
-ArmNightAction = alarm_control_panel_ns.class_("ArmNightAction", automation.Action)
-DisarmAction = alarm_control_panel_ns.class_("DisarmAction", automation.Action)
-PendingAction = alarm_control_panel_ns.class_("PendingAction", automation.Action)
-TriggeredAction = alarm_control_panel_ns.class_("TriggeredAction", automation.Action)
-ChimeAction = alarm_control_panel_ns.class_("ChimeAction", automation.Action)
-ReadyAction = alarm_control_panel_ns.class_("ReadyAction", automation.Action)
-
-AlarmControlPanelCondition = alarm_control_panel_ns.class_(
-    "AlarmControlPanelCondition", automation.Condition
-)
 
 _ALARM_CONTROL_PANEL_SCHEMA = (
     cv.ENTITY_BASE_SCHEMA.extend(web_server.WEBSERVER_SORTING_SCHEMA)
@@ -196,125 +184,38 @@ async def new_alarm_control_panel(config, *args):
     return var
 
 
-@automation.register_action(
-    "alarm_control_panel.arm_away",
-    ArmAwayAction,
-    ALARM_CONTROL_PANEL_ACTION_SCHEMA,
-    synchronous=True,
-)
-async def alarm_action_arm_away_to_code(config, action_id, template_arg, args):
-    paren = await cg.get_variable(config[CONF_ID])
-    var = cg.new_Pvariable(action_id, template_arg, paren)
-    if code_config := config.get(CONF_CODE):
-        templatable_ = await cg.templatable(code_config, args, cg.std_string)
-        cg.add(var.set_code(templatable_))
-    return var
-
-
-@automation.register_action(
-    "alarm_control_panel.arm_home",
-    ArmHomeAction,
-    ALARM_CONTROL_PANEL_ACTION_SCHEMA,
-    synchronous=True,
-)
-async def alarm_action_arm_home_to_code(config, action_id, template_arg, args):
-    paren = await cg.get_variable(config[CONF_ID])
-    var = cg.new_Pvariable(action_id, template_arg, paren)
-    if code_config := config.get(CONF_CODE):
-        templatable_ = await cg.templatable(code_config, args, cg.std_string)
-        cg.add(var.set_code(templatable_))
-    return var
-
-
-@automation.register_action(
-    "alarm_control_panel.arm_night",
-    ArmNightAction,
-    ALARM_CONTROL_PANEL_ACTION_SCHEMA,
-    synchronous=True,
-)
-async def alarm_action_arm_night_to_code(config, action_id, template_arg, args):
-    paren = await cg.get_variable(config[CONF_ID])
-    var = cg.new_Pvariable(action_id, template_arg, paren)
-    if CONF_CODE in config:
-        templatable_ = await cg.templatable(config[CONF_CODE], args, cg.std_string)
-        cg.add(var.set_code(templatable_))
-    return var
-
-
-@automation.register_action(
-    "alarm_control_panel.disarm",
-    DisarmAction,
-    ALARM_CONTROL_PANEL_ACTION_SCHEMA,
-    synchronous=True,
-)
-async def alarm_action_disarm_to_code(config, action_id, template_arg, args):
-    paren = await cg.get_variable(config[CONF_ID])
-    var = cg.new_Pvariable(action_id, template_arg, paren)
-    if code_config := config.get(CONF_CODE):
-        templatable_ = await cg.templatable(code_config, args, cg.std_string)
-        cg.add(var.set_code(templatable_))
-    return var
-
-
-@automation.register_action(
-    "alarm_control_panel.pending",
-    PendingAction,
-    ALARM_CONTROL_PANEL_ACTION_SCHEMA,
-    synchronous=True,
-)
-async def alarm_action_pending_to_code(config, action_id, template_arg, args):
-    paren = await cg.get_variable(config[CONF_ID])
-    return cg.new_Pvariable(action_id, template_arg, paren)
-
-
-@automation.register_action(
-    "alarm_control_panel.triggered",
-    TriggeredAction,
-    ALARM_CONTROL_PANEL_ACTION_SCHEMA,
-    synchronous=True,
-)
-async def alarm_action_trigger_to_code(config, action_id, template_arg, args):
-    paren = await cg.get_variable(config[CONF_ID])
-    return cg.new_Pvariable(action_id, template_arg, paren)
-
-
-@automation.register_action(
-    "alarm_control_panel.chime",
-    ChimeAction,
-    ALARM_CONTROL_PANEL_ACTION_SCHEMA,
-    synchronous=True,
-)
-async def alarm_action_chime_to_code(config, action_id, template_arg, args):
-    paren = await cg.get_variable(config[CONF_ID])
-    return cg.new_Pvariable(action_id, template_arg, paren)
-
-
-@automation.register_action(
-    "alarm_control_panel.ready",
-    ReadyAction,
-    ALARM_CONTROL_PANEL_ACTION_SCHEMA,
-    synchronous=True,
-)
-@automation.register_condition(
-    "alarm_control_panel.ready",
-    AlarmControlPanelCondition,
-    ALARM_CONTROL_PANEL_CONDITION_SCHEMA,
-)
-async def alarm_action_ready_to_code(config, action_id, template_arg, args):
-    paren = await cg.get_variable(config[CONF_ID])
-    return cg.new_Pvariable(action_id, template_arg, paren)
-
-
-@automation.register_condition(
-    "alarm_control_panel.is_armed",
-    AlarmControlPanelCondition,
-    ALARM_CONTROL_PANEL_CONDITION_SCHEMA,
-)
-async def alarm_control_panel_is_armed_to_code(
-    config, condition_id, template_arg, args
+# Mirrors AlarmControlPanel::arm_with_code_: arm first, set the code only when given.
+for _name, _arm in (
+    ("alarm_control_panel.arm_away", "arm_away()"),
+    ("alarm_control_panel.arm_home", "arm_home()"),
+    ("alarm_control_panel.arm_night", "arm_night()"),
+    ("alarm_control_panel.disarm", "disarm()"),
 ):
-    paren = await cg.get_variable(config[CONF_ID])
-    return cg.new_Pvariable(condition_id, template_arg, paren)
+    automation.register_apply_action(
+        _name,
+        ALARM_CONTROL_PANEL_ACTION_SCHEMA,
+        automation.ApplyCall(_arm),
+        automation.ApplyField(CONF_CODE, "set_code", cg.std_string),
+        call="make_call",
+    )
+
+
+for _name, _call in (
+    ("alarm_control_panel.pending", "pending()"),
+    ("alarm_control_panel.triggered", "triggered()"),
+):
+    automation.register_apply_action(
+        _name,
+        ALARM_CONTROL_PANEL_ACTION_SCHEMA,
+        automation.ApplyCall(_call),
+        call="make_call",
+    )
+
+
+for _name in ("alarm_control_panel.ready", "alarm_control_panel.is_armed"):
+    automation.register_apply_condition(
+        _name, ALARM_CONTROL_PANEL_CONDITION_SCHEMA, "is_armed_pending_or_triggered()"
+    )
 
 
 @coroutine_with_priority(CoroPriority.CORE)

esphome/components/alarm_control_panel/alarm_control_panel.h

@@ -130,6 +130,12 @@ class AlarmControlPanel : public EntityBase {
 
   // is the state one of the armed states
   bool is_state_armed(AlarmControlPanelState state);
+  /// Armed, pending (entry delay) or triggered; not ARMING (exit delay). Backs the is_armed and ready
+  /// conditions.
+  bool is_armed_pending_or_triggered() {
+    auto state = this->get_state();
+    return this->is_state_armed(state) || state == ACP_STATE_PENDING || state == ACP_STATE_TRIGGERED;
+  }
 
  protected:
   friend AlarmControlPanelCall;
@@ -138,11 +144,11 @@ class AlarmControlPanel : public EntityBase {
   // in order to store last panel state in flash
   ESPPreferenceObject pref_;
   // current state
-  AlarmControlPanelState current_state_;
+  AlarmControlPanelState current_state_{ACP_STATE_DISARMED};
   // the desired (or previous) state
-  AlarmControlPanelState desired_state_;
+  AlarmControlPanelState desired_state_{ACP_STATE_DISARMED};
   // last time the state was updated
-  uint32_t last_update_;
+  uint32_t last_update_{0};
   // the call control function
   virtual void control(const AlarmControlPanelCall &call) = 0;
   // state callback - passes the new state to listeners

esphome/components/alarm_control_panel/automation.h

@@ -27,84 +27,4 @@ static_assert(std::is_trivially_copyable_v<StateAnyForwarder>);
 static_assert(sizeof(StateEnterForwarder<ACP_STATE_TRIGGERED>) <= sizeof(void *));
 static_assert(std::is_trivially_copyable_v<StateEnterForwarder<ACP_STATE_TRIGGERED>>);
 
-template<typename... Ts> class ArmAwayAction final : public Action<Ts...> {
- public:
-  explicit ArmAwayAction(AlarmControlPanel *alarm_control_panel) : alarm_control_panel_(alarm_control_panel) {}
-
-  TEMPLATABLE_VALUE(std::string, code)
-
-  void play(const Ts &...x) override { this->alarm_control_panel_->arm_away(this->code_.optional_value(x...)); }
-
- protected:
-  AlarmControlPanel *alarm_control_panel_;
-};
-
-template<typename... Ts> class ArmHomeAction final : public Action<Ts...> {
- public:
-  explicit ArmHomeAction(AlarmControlPanel *alarm_control_panel) : alarm_control_panel_(alarm_control_panel) {}
-
-  TEMPLATABLE_VALUE(std::string, code)
-
-  void play(const Ts &...x) override { this->alarm_control_panel_->arm_home(this->code_.optional_value(x...)); }
-
- protected:
-  AlarmControlPanel *alarm_control_panel_;
-};
-
-template<typename... Ts> class ArmNightAction final : public Action<Ts...> {
- public:
-  explicit ArmNightAction(AlarmControlPanel *alarm_control_panel) : alarm_control_panel_(alarm_control_panel) {}
-
-  TEMPLATABLE_VALUE(std::string, code)
-
-  void play(const Ts &...x) override { this->alarm_control_panel_->arm_night(this->code_.optional_value(x...)); }
-
- protected:
-  AlarmControlPanel *alarm_control_panel_;
-};
-
-template<typename... Ts> class DisarmAction final : public Action<Ts...> {
- public:
-  explicit DisarmAction(AlarmControlPanel *alarm_control_panel) : alarm_control_panel_(alarm_control_panel) {}
-
-  TEMPLATABLE_VALUE(std::string, code)
-
-  void play(const Ts &...x) override { this->alarm_control_panel_->disarm(this->code_.optional_value(x...)); }
-
- protected:
-  AlarmControlPanel *alarm_control_panel_;
-};
-
-template<typename... Ts> class PendingAction final : public Action<Ts...> {
- public:
-  explicit PendingAction(AlarmControlPanel *alarm_control_panel) : alarm_control_panel_(alarm_control_panel) {}
-
-  void play(const Ts &...x) override { this->alarm_control_panel_->make_call().pending().perform(); }
-
- protected:
-  AlarmControlPanel *alarm_control_panel_;
-};
-
-template<typename... Ts> class TriggeredAction final : public Action<Ts...> {
- public:
-  explicit TriggeredAction(AlarmControlPanel *alarm_control_panel) : alarm_control_panel_(alarm_control_panel) {}
-
-  void play(const Ts &...x) override { this->alarm_control_panel_->make_call().triggered().perform(); }
-
- protected:
-  AlarmControlPanel *alarm_control_panel_;
-};
-
-template<typename... Ts> class AlarmControlPanelCondition final : public Condition<Ts...> {
- public:
-  AlarmControlPanelCondition(AlarmControlPanel *parent) : parent_(parent) {}
-  bool check(const Ts &...x) override {
-    return this->parent_->is_state_armed(this->parent_->get_state()) ||
-           this->parent_->get_state() == ACP_STATE_PENDING || this->parent_->get_state() == ACP_STATE_TRIGGERED;
-  }
-
- protected:
-  AlarmControlPanel *parent_;
-};
-
 }  // namespace esphome::alarm_control_panel

esphome/components/alpha3/alpha3.cpp

@@ -162,8 +162,9 @@ void Alpha3::send_request_(uint8_t *request, size_t len) {
   auto status =
       esp_ble_gattc_write_char(this->parent_->get_gattc_if(), this->parent_->get_conn_id(), this->geni_handle_, len,
                                request, ESP_GATT_WRITE_TYPE_NO_RSP, ESP_GATT_AUTH_REQ_NONE);
-  if (status)
+  if (status) {
     ESP_LOGW(TAG, "[%s] esp_ble_gattc_write_char failed, status=%d", this->parent_->address_str(), status);
+  }
 }
 
 void Alpha3::update() {