Merge remote-tracking branch 'upstream/dev' into 20260218-zigbee-proxy

# Conflicts:
#	esphome/components/api/api.proto
#	esphome/components/api/api_pb2.cpp
#	esphome/components/api/api_pb2.h
#	esphome/components/api/api_pb2_dump.cpp
#	esphome/components/api/api_pb2_service.cpp
#	esphome/components/api/api_pb2_service.h
#	esphome/components/serial_proxy/serial_proxy.h

esphome/components/api/api.proto

@@ -76,6 +76,7 @@ service APIConnection {
   rpc serial_proxy_write(SerialProxyWriteRequest) returns (void) {}
   rpc serial_proxy_set_modem_pins(SerialProxySetModemPinsRequest) returns (void) {}
   rpc serial_proxy_get_modem_pins(SerialProxyGetModemPinsRequest) returns (void) {}
+  rpc serial_proxy_get_usb_info(SerialProxyGetUsbInfoRequest) returns (void) {}
   rpc serial_proxy_request(SerialProxyRequest) returns (void) {}
   rpc serial_proxy_set_mode(SerialProxySetModeRequest) returns (void) {}
 }
@@ -228,6 +229,11 @@ enum SerialProxyPortType {
   SERIAL_PROXY_PORT_TYPE_TTL = 0;
   SERIAL_PROXY_PORT_TYPE_RS232 = 1;
   SERIAL_PROXY_PORT_TYPE_RS485 = 2;
+  // A serial device attached through a USB bridge. Set by the device configuration, never
+  // by the user; identifies ports whose USB identity can be read with
+  // SerialProxyGetUsbInfoRequest. Deliberately not a USB endpoint type: serial_proxy
+  // carries serial devices only, whatever bridge chip connects them.
+  SERIAL_PROXY_PORT_TYPE_USB_SERIAL = 3;
 }
 
 message SerialProxyInfo {
@@ -2867,6 +2873,36 @@ message SerialProxySetModeRequest {
   SerialProxyMode mode = 2;
 }
 
+// Ask for the USB identity of the device behind a USB_SERIAL port. Read-only, so no
+// subscription is required -- a client typically uses this to decide which port to
+// subscribe to. Answered with NOT_SUPPORTED on ports that are not USB_SERIAL.
+message SerialProxyGetUsbInfoRequest {
+  option (id) = 153;
+  option (source) = SOURCE_CLIENT;
+  option (ifdef) = "USE_SERIAL_PROXY";
+
+  uint32 instance = 1;
+}
+
+// The USB identity of the device currently behind a port, read live from the cached
+// USB descriptors. Fields are zero/empty while no device is connected.
+message SerialProxyGetUsbInfoResponse {
+  option (id) = 154;
+  option (source) = SOURCE_SERVER;
+  option (ifdef) = "USE_SERIAL_PROXY";
+
+  uint32 instance = 1;
+  SerialProxyStatus status = 2;   // NOT_SUPPORTED when the port is not USB_SERIAL
+  bool connected = 3;             // True when a USB device is currently attached
+  uint32 vendor_id = 4;
+  uint32 product_id = 5;
+  uint32 bcd_device = 6;
+  uint32 interface_number = 7;    // Channel index on multi-port bridges
+  string manufacturer = 8;
+  string product = 9;
+  string serial_number = 10;
+}
+
 // ==================== BLUETOOTH CONNECTION PARAMS ====================
 message BluetoothSetConnectionParamsRequest {
   option (id) = 145;

esphome/components/api/api_connection.cpp

@@ -48,6 +48,9 @@
 #ifdef USE_ZWAVE_PROXY
 #include "esphome/components/zwave_proxy/zwave_proxy.h"
 #endif
+#ifdef USE_SERIAL_PROXY_USB_INFO
+#include "esphome/components/usb_host/usb_host.h"
+#endif
 #ifdef USE_WATER_HEATER
 #include "esphome/components/water_heater/water_heater.h"
 #endif
@@ -1642,6 +1645,27 @@ void APIConnection::on_serial_proxy_get_modem_pins_request(const SerialProxyGetM
   }
 }
 
+void APIConnection::on_serial_proxy_get_usb_info_request(const SerialProxyGetUsbInfoRequest &msg) {
+  auto &proxies = App.get_serial_proxies();
+  SerialProxyGetUsbInfoResponse resp{};
+  resp.instance = msg.instance;
+  if (msg.instance >= proxies.size()) {
+    ESP_LOGW(TAG, "Serial proxy instance %" PRIu32 " out of range", msg.instance);
+    resp.status = enums::SERIAL_PROXY_STATUS_INVALID_ARGUMENT;
+  } else {
+#ifdef USE_SERIAL_PROXY_USB_INFO
+    // The response's strings are views into this buffer, which outlives the send below
+    usb_host::UsbDeviceInfo info;
+    proxies[msg.instance]->get_usb_info(info, resp);
+#else
+    resp.status = enums::SERIAL_PROXY_STATUS_NOT_SUPPORTED;
+#endif
+  }
+  if (!this->send_message(resp)) {
+    API_LOG_MSG_DROPPED(TAG, "Serial proxy response");
+  }
+}
+
 void APIConnection::on_serial_proxy_request(const SerialProxyRequest &msg) {
   auto &proxies = App.get_serial_proxies();
   if (msg.instance >= proxies.size()) {

esphome/components/api/api_connection.h

@@ -243,6 +243,7 @@ class APIConnection final : public APIServerConnectionBase {
   void on_serial_proxy_write_request(const SerialProxyWriteRequest &msg);
   void on_serial_proxy_set_modem_pins_request(const SerialProxySetModemPinsRequest &msg);
   void on_serial_proxy_get_modem_pins_request(const SerialProxyGetModemPinsRequest &msg);
+  void on_serial_proxy_get_usb_info_request(const SerialProxyGetUsbInfoRequest &msg);
   void on_serial_proxy_request(const SerialProxyRequest &msg);
   void on_serial_proxy_set_mode_request(const SerialProxySetModeRequest &msg);
   void send_serial_proxy_data(const SerialProxyDataReceived &msg);

esphome/components/api/api_pb2.cpp

@@ -4266,6 +4266,44 @@ bool SerialProxySetModeRequest::decode_varint(uint32_t field_id, proto_varint_va
   }
   return true;
 }
+bool SerialProxyGetUsbInfoRequest::decode_varint(uint32_t field_id, proto_varint_value_t value) {
+  switch (field_id) {
+    case 1:
+      this->instance = value;
+      break;
+    default:
+      return false;
+  }
+  return true;
+}
+uint8_t *SerialProxyGetUsbInfoResponse::encode(ProtoWriteBuffer &buffer PROTO_ENCODE_DEBUG_PARAM) const {
+  uint8_t *__restrict__ pos = buffer.get_pos();
+  ProtoEncode::encode_uint32(pos PROTO_ENCODE_DEBUG_ARG, 1, this->instance);
+  ProtoEncode::encode_uint32(pos PROTO_ENCODE_DEBUG_ARG, 2, static_cast<uint32_t>(this->status));
+  ProtoEncode::encode_bool(pos PROTO_ENCODE_DEBUG_ARG, 3, this->connected);
+  ProtoEncode::encode_uint32(pos PROTO_ENCODE_DEBUG_ARG, 4, this->vendor_id);
+  ProtoEncode::encode_uint32(pos PROTO_ENCODE_DEBUG_ARG, 5, this->product_id);
+  ProtoEncode::encode_uint32(pos PROTO_ENCODE_DEBUG_ARG, 6, this->bcd_device);
+  ProtoEncode::encode_uint32(pos PROTO_ENCODE_DEBUG_ARG, 7, this->interface_number);
+  ProtoEncode::encode_string(pos PROTO_ENCODE_DEBUG_ARG, 8, this->manufacturer);
+  ProtoEncode::encode_string(pos PROTO_ENCODE_DEBUG_ARG, 9, this->product);
+  ProtoEncode::encode_string(pos PROTO_ENCODE_DEBUG_ARG, 10, this->serial_number);
+  return pos;
+}
+uint32_t SerialProxyGetUsbInfoResponse::calculate_size() const {
+  uint32_t size = 0;
+  size += ProtoSize::calc_uint32(1, this->instance);
+  size += this->status ? 2 : 0;
+  size += ProtoSize::calc_bool(1, this->connected);
+  size += ProtoSize::calc_uint32(1, this->vendor_id);
+  size += ProtoSize::calc_uint32(1, this->product_id);
+  size += ProtoSize::calc_uint32(1, this->bcd_device);
+  size += ProtoSize::calc_uint32(1, this->interface_number);
+  size += ProtoSize::calc_length(1, this->manufacturer.size());
+  size += ProtoSize::calc_length(1, this->product.size());
+  size += ProtoSize::calc_length(1, this->serial_number.size());
+  return size;
+}
 #endif
 #ifdef USE_BLUETOOTH_PROXY_CONNECTIONS
 bool BluetoothSetConnectionParamsRequest::decode_varint(uint32_t field_id, proto_varint_value_t value) {

esphome/components/api/api_pb2.h

@@ -23,6 +23,7 @@ enum SerialProxyPortType : uint32_t {
   SERIAL_PROXY_PORT_TYPE_TTL = 0,
   SERIAL_PROXY_PORT_TYPE_RS232 = 1,
   SERIAL_PROXY_PORT_TYPE_RS485 = 2,
+  SERIAL_PROXY_PORT_TYPE_USB_SERIAL = 3,
 };
 enum EntityCategory : uint32_t {
   ENTITY_CATEGORY_NONE = 0,
@@ -3424,6 +3425,46 @@ class SerialProxySetModeRequest final : public ProtoDecodableMessage {
  protected:
   bool decode_varint(uint32_t field_id, proto_varint_value_t value) override;
 };
+class SerialProxyGetUsbInfoRequest final : public ProtoDecodableMessage {
+ public:
+  static constexpr uint16_t MESSAGE_TYPE = 153;
+  static constexpr uint8_t ESTIMATED_SIZE = 4;
+#ifdef HAS_PROTO_MESSAGE_DUMP
+  const LogString *message_name() const override { return LOG_STR("serial_proxy_get_usb_info_request"); }
+#endif
+  uint32_t instance{0};
+#ifdef HAS_PROTO_MESSAGE_DUMP
+  const char *dump_to(DumpBuffer &out) const override;
+#endif
+
+ protected:
+  bool decode_varint(uint32_t field_id, proto_varint_value_t value) override;
+};
+class SerialProxyGetUsbInfoResponse final : public ProtoMessage {
+ public:
+  static constexpr uint16_t MESSAGE_TYPE = 154;
+  static constexpr uint8_t ESTIMATED_SIZE = 51;
+#ifdef HAS_PROTO_MESSAGE_DUMP
+  const LogString *message_name() const override { return LOG_STR("serial_proxy_get_usb_info_response"); }
+#endif
+  uint32_t instance{0};
+  enums::SerialProxyStatus status{};
+  bool connected{false};
+  uint32_t vendor_id{0};
+  uint32_t product_id{0};
+  uint32_t bcd_device{0};
+  uint32_t interface_number{0};
+  StringRef manufacturer{};
+  StringRef product{};
+  StringRef serial_number{};
+  uint8_t *encode(ProtoWriteBuffer &buffer PROTO_ENCODE_DEBUG_PARAM) const;
+  uint32_t calculate_size() const;
+#ifdef HAS_PROTO_MESSAGE_DUMP
+  const char *dump_to(DumpBuffer &out) const override;
+#endif
+
+ protected:
+};
 #endif
 #ifdef USE_BLUETOOTH_PROXY_CONNECTIONS
 class BluetoothSetConnectionParamsRequest final : public ProtoDecodableMessage {

esphome/components/api/api_pb2_dump.cpp

@@ -143,6 +143,8 @@ template<> const char *proto_enum_to_string<enums::SerialProxyPortType>(enums::S
       return ESPHOME_PSTR("SERIAL_PROXY_PORT_TYPE_RS232");
     case enums::SERIAL_PROXY_PORT_TYPE_RS485:
       return ESPHOME_PSTR("SERIAL_PROXY_PORT_TYPE_RS485");
+    case enums::SERIAL_PROXY_PORT_TYPE_USB_SERIAL:
+      return ESPHOME_PSTR("SERIAL_PROXY_PORT_TYPE_USB_SERIAL");
     default:
       return ESPHOME_PSTR("UNKNOWN");
   }
@@ -2823,6 +2825,25 @@ const char *SerialProxySetModeRequest::dump_to(DumpBuffer &out) const {
   dump_field(out, ESPHOME_PSTR("mode"), static_cast<enums::SerialProxyMode>(this->mode));
   return out.c_str();
 }
+const char *SerialProxyGetUsbInfoRequest::dump_to(DumpBuffer &out) const {
+  MessageDumpHelper helper(out, ESPHOME_PSTR("SerialProxyGetUsbInfoRequest"));
+  dump_field(out, ESPHOME_PSTR("instance"), this->instance);
+  return out.c_str();
+}
+const char *SerialProxyGetUsbInfoResponse::dump_to(DumpBuffer &out) const {
+  MessageDumpHelper helper(out, ESPHOME_PSTR("SerialProxyGetUsbInfoResponse"));
+  dump_field(out, ESPHOME_PSTR("instance"), this->instance);
+  dump_field(out, ESPHOME_PSTR("status"), static_cast<enums::SerialProxyStatus>(this->status));
+  dump_field(out, ESPHOME_PSTR("connected"), this->connected);
+  dump_field(out, ESPHOME_PSTR("vendor_id"), this->vendor_id);
+  dump_field(out, ESPHOME_PSTR("product_id"), this->product_id);
+  dump_field(out, ESPHOME_PSTR("bcd_device"), this->bcd_device);
+  dump_field(out, ESPHOME_PSTR("interface_number"), this->interface_number);
+  dump_field(out, ESPHOME_PSTR("manufacturer"), this->manufacturer);
+  dump_field(out, ESPHOME_PSTR("product"), this->product);
+  dump_field(out, ESPHOME_PSTR("serial_number"), this->serial_number);
+  return out.c_str();
+}
 #endif
 #ifdef USE_BLUETOOTH_PROXY_CONNECTIONS
 const char *BluetoothSetConnectionParamsRequest::dump_to(DumpBuffer &out) const {

esphome/components/api/api_pb2_service.cpp

@@ -722,6 +722,17 @@ void APIConnection::read_message_(uint32_t msg_size, uint32_t msg_type, const ui
       this->on_serial_proxy_set_mode_request(msg);
       break;
     }
+#endif
+#ifdef USE_SERIAL_PROXY
+    case SerialProxyGetUsbInfoRequest::MESSAGE_TYPE: {
+      SerialProxyGetUsbInfoRequest msg;
+      msg.decode(msg_data, msg_size);
+#ifdef HAS_PROTO_MESSAGE_DUMP
+      this->log_receive_message_(LOG_STR("on_serial_proxy_get_usb_info_request"), msg);
+#endif
+      this->on_serial_proxy_get_usb_info_request(msg);
+      break;
+    }
 #endif
     default:
       break;

esphome/components/api/api_pb2_service.h

@@ -238,6 +238,10 @@ class APIServerConnectionBase {
 #ifdef USE_SERIAL_PROXY
   void on_serial_proxy_set_mode_request(const SerialProxySetModeRequest &value){};
 #endif
+#ifdef USE_SERIAL_PROXY
+  void on_serial_proxy_get_usb_info_request(const SerialProxyGetUsbInfoRequest &value){};
+#endif
+
 #ifdef USE_BLUETOOTH_PROXY_CONNECTIONS
   void on_bluetooth_set_connection_params_request(const BluetoothSetConnectionParamsRequest &value){};
 #endif

esphome/components/serial_proxy/__init__.py

@@ -18,9 +18,10 @@ from esphome import pins
 import esphome.codegen as cg
 from esphome.components import uart
 import esphome.config_validation as cv
-from esphome.const import CONF_ID, CONF_NAME
+from esphome.const import CONF_ID, CONF_NAME, CONF_UART_ID
 from esphome.core import CORE, coroutine_with_priority
 from esphome.coroutine import CoroPriority
+import esphome.final_validate as fv
 from esphome.types import ConfigType
 
 CODEOWNERS = ["@kbx81"]
@@ -34,11 +35,14 @@ SerialProxyTap = serial_proxy_ns.class_("SerialProxyTap")
 
 api_enums_ns = cg.esphome_ns.namespace("api").namespace("enums")
 SerialProxyPortType = api_enums_ns.enum("SerialProxyPortType")
+# User-selectable electrical types. USB_SERIAL is deliberately absent: it is derived
+# from the uart_id pointing at a usb_uart channel, never set by the user.
 SERIAL_PROXY_PORT_TYPES = {
     "TTL": SerialProxyPortType.SERIAL_PROXY_PORT_TYPE_TTL,
     "RS232": SerialProxyPortType.SERIAL_PROXY_PORT_TYPE_RS232,
     "RS485": SerialProxyPortType.SERIAL_PROXY_PORT_TYPE_RS485,
 }
+PORT_TYPE_USB_SERIAL = SerialProxyPortType.SERIAL_PROXY_PORT_TYPE_USB_SERIAL
 
 CONF_DTR_PIN = "dtr_pin"
 CONF_PORT_TYPE = "port_type"
@@ -63,7 +67,7 @@ CONFIG_SCHEMA = (
         {
             cv.GenerateID(): cv.declare_id(SerialProxy),
             cv.Required(CONF_NAME): cv.string_strict,
-            cv.Required(CONF_PORT_TYPE): cv.enum(SERIAL_PROXY_PORT_TYPES, upper=True),
+            cv.Optional(CONF_PORT_TYPE): cv.enum(SERIAL_PROXY_PORT_TYPES, upper=True),
             cv.Optional(CONF_RTS_PIN): pins.gpio_output_pin_schema,
             cv.Optional(CONF_DTR_PIN): pins.gpio_output_pin_schema,
         }
@@ -73,6 +77,26 @@ CONFIG_SCHEMA = (
 )
 
 
+def _uses_usb_uart(config: ConfigType, full_config: ConfigType) -> bool:
+    from esphome.components.usb_uart import is_usb_uart_channel
+
+    return is_usb_uart_channel(config[CONF_UART_ID], full_config)
+
+
+def _final_validate(config: ConfigType) -> ConfigType:
+    if _uses_usb_uart(config, fv.full_config.get()):
+        if CONF_PORT_TYPE in config:
+            raise cv.Invalid(
+                f"{CONF_PORT_TYPE} is set automatically for USB serial ports"
+            )
+    elif CONF_PORT_TYPE not in config:
+        raise cv.Invalid(f"{CONF_PORT_TYPE} is required")
+    return config
+
+
+FINAL_VALIDATE_SCHEMA = _final_validate
+
+
 @coroutine_with_priority(CoroPriority.FINAL)
 async def _add_serial_proxy_count_define() -> None:
     """Emit the SERIAL_PROXY_COUNT define once with the final instance count."""
@@ -87,7 +111,13 @@ async def to_code(config: ConfigType) -> None:
     await uart.register_uart_device(var, config)
     cg.add(cg.App.register_serial_proxy(var))
     cg.add(var.set_name(config[CONF_NAME]))
-    cg.add(var.set_port_type(config[CONF_PORT_TYPE]))
+    if _uses_usb_uart(config, CORE.config):
+        cg.add(var.set_port_type(PORT_TYPE_USB_SERIAL))
+        channel = await cg.get_variable(config[CONF_UART_ID])
+        cg.add(var.set_usb_channel(channel))
+        cg.add_define("USE_SERIAL_PROXY_USB_INFO")
+    else:
+        cg.add(var.set_port_type(config[CONF_PORT_TYPE]))
     cg.add_define("USE_SERIAL_PROXY")
 
     # Track instance count for the FINAL priority define

esphome/components/serial_proxy/serial_proxy.cpp

@@ -12,6 +12,10 @@
 #include "esphome/components/api/api_server.h"
 #endif
 
+#ifdef USE_SERIAL_PROXY_USB_INFO
+#include "esphome/components/usb_uart/usb_uart.h"
+#endif
+
 namespace esphome::serial_proxy {
 
 static const char *const TAG = "serial_proxy";
@@ -156,9 +160,10 @@ void SerialProxy::dump_config() {
                 "  RTS Pin: %s\n"
                 "  DTR Pin: %s",
                 this->instance_index_, this->name_ != nullptr ? this->name_ : "",
-                this->port_type_ == api::enums::SERIAL_PROXY_PORT_TYPE_RS485   ? LOG_STR_LITERAL("RS485")
-                : this->port_type_ == api::enums::SERIAL_PROXY_PORT_TYPE_RS232 ? LOG_STR_LITERAL("RS232")
-                                                                               : LOG_STR_LITERAL("TTL"),
+                this->port_type_ == api::enums::SERIAL_PROXY_PORT_TYPE_RS485        ? LOG_STR_LITERAL("RS485")
+                : this->port_type_ == api::enums::SERIAL_PROXY_PORT_TYPE_RS232      ? LOG_STR_LITERAL("RS232")
+                : this->port_type_ == api::enums::SERIAL_PROXY_PORT_TYPE_USB_SERIAL ? LOG_STR_LITERAL("USB_SERIAL")
+                                                                                    : LOG_STR_LITERAL("TTL"),
                 this->rts_pin_ != nullptr ? LOG_STR_LITERAL("configured") : LOG_STR_LITERAL("not configured"),
                 this->dtr_pin_ != nullptr ? LOG_STR_LITERAL("configured") : LOG_STR_LITERAL("not configured"));
 }
@@ -333,6 +338,27 @@ SerialProxyResult SerialProxy::set_modem_pins(api::APIConnection *api_connection
   return SerialProxyResult::SERIAL_PROXY_RESULT_OK;
 }
 
+#if defined(USE_SERIAL_PROXY_USB_INFO) && defined(USE_API)
+void SerialProxy::get_usb_info(usb_host::UsbDeviceInfo &info, api::SerialProxyGetUsbInfoResponse &resp) const {
+  if (this->usb_channel_ == nullptr) {
+    resp.status = api::enums::SERIAL_PROXY_STATUS_NOT_SUPPORTED;
+    return;
+  }
+  resp.interface_number = this->usb_channel_->get_index();
+  if (!this->usb_channel_->get_parent()->get_device_info(info)) {
+    // No device attached right now; not an error
+    return;
+  }
+  resp.connected = true;
+  resp.vendor_id = info.vendor_id;
+  resp.product_id = info.product_id;
+  resp.bcd_device = info.bcd_device;
+  resp.manufacturer = StringRef(info.manufacturer);
+  resp.product = StringRef(info.product);
+  resp.serial_number = StringRef(info.serial_number);
+}
+#endif
+
 uint32_t SerialProxy::get_modem_pins() const {
   return (this->rts_state_ ? static_cast<uint32_t>(SERIAL_PROXY_LINE_STATE_FLAG_RTS) : 0u) |
          (this->dtr_state_ ? static_cast<uint32_t>(SERIAL_PROXY_LINE_STATE_FLAG_DTR) : 0u);

esphome/components/serial_proxy/serial_proxy.h

@@ -20,6 +20,15 @@
 #include "esphome/components/api/api_pb2.h"
 #endif
 
+#ifdef USE_SERIAL_PROXY_USB_INFO
+namespace esphome::usb_uart {
+class USBUartChannel;
+}  // namespace esphome::usb_uart
+namespace esphome::usb_host {
+struct UsbDeviceInfo;
+}  // namespace esphome::usb_host
+#endif
+
 // Forward-declare types needed outside the USE_API guard.
 namespace esphome::api {
 class APIConnection;
@@ -155,6 +164,17 @@ class SerialProxy final : public uart::UARTDevice, public Component {
   /// Set the DTR GPIO pin (from YAML configuration)
   void set_dtr_pin(GPIOPin *pin) { this->dtr_pin_ = pin; }
 
+#ifdef USE_SERIAL_PROXY_USB_INFO
+  /// Attach the USB UART channel behind this port (from code generation)
+  void set_usb_channel(usb_uart::USBUartChannel *channel) { this->usb_channel_ = channel; }
+
+#ifdef USE_API
+  /// Fill a USB info response for this port. The response's strings are views into
+  /// info, so info must outlive the send.
+  void get_usb_info(usb_host::UsbDeviceInfo &info, api::SerialProxyGetUsbInfoResponse &resp) const;
+#endif
+#endif
+
 #ifdef USE_SERIAL_PROXY_TAP
   /// Attach a traffic observer. At most one, set once at setup time.
   void set_tap(SerialProxyTap *tap) { this->tap_ = tap; }
@@ -251,6 +271,11 @@ class SerialProxy final : public uart::UARTDevice, public Component {
 #ifdef USE_SERIAL_PROXY_TAP
   SerialProxyTap *tap_{nullptr};
 #endif
+
+#ifdef USE_SERIAL_PROXY_USB_INFO
+  /// The USB UART channel behind this port; nullptr on non-USB ports
+  usb_uart::USBUartChannel *usb_channel_{nullptr};
+#endif
 };
 
 }  // namespace esphome::serial_proxy

esphome/components/usb_host/__init__.py

@@ -26,6 +26,8 @@ USBClient = usb_host_ns.class_("USBClient", Component)
 DOMAIN = "usb_host"
 CONF_VID = "vid"
 CONF_PID = "pid"
+CONF_MANUFACTURER = "manufacturer"
+CONF_PRODUCT = "product"
 CONF_ENABLE_HUBS = "enable_hubs"
 CONF_MAX_TRANSFER_REQUESTS = "max_transfer_requests"
 CONF_MAX_PACKET_SIZE = "max_packet_size"
@@ -47,7 +49,48 @@ def usb_device_schema(
         schema = schema.extend({cv.Optional(CONF_PID, default=pid): cv.hex_uint16_t})
     else:
         schema = schema.extend({cv.Required(CONF_PID): cv.hex_uint16_t})
-    return schema
+
+    return schema.extend(
+        {
+            cv.Optional(CONF_MANUFACTURER): cv.string_strict,
+            cv.Optional(CONF_PRODUCT): cv.string_strict,
+        }
+    )
+
+
+_validate_filters_complete = cv.has_none_or_all_keys(CONF_MANUFACTURER, CONF_PRODUCT)
+
+
+def validate_usb_clients(configs: list[ConfigType]) -> list[ConfigType]:
+    """Reject invalid USB configuration."""
+    for config in configs:
+        _validate_filters_complete(config)
+    for index, first in enumerate(configs):
+        # Ensure matching logic does not overlap between entries
+        for second in configs[index + 1 :]:
+            if (
+                not (first[CONF_VID] == 0 and first[CONF_PID] == 0)
+                and not (second[CONF_VID] == 0 and second[CONF_PID] == 0)
+                and (
+                    first[CONF_VID] != second[CONF_VID]
+                    or first[CONF_PID] != second[CONF_PID]
+                )
+            ):
+                continue
+
+            # An unset filter constrains nothing, so only a differing value separates them
+            if not all(
+                (a := first.get(key)) is None
+                or (b := second.get(key)) is None
+                or a == b
+                for key in (CONF_MANUFACTURER, CONF_PRODUCT)
+            ):
+                continue
+
+            raise cv.Invalid(
+                f"USB configs overlap: {first[CONF_ID]!r}, {second[CONF_ID]!r}"
+            )
+    return configs
 
 
 def _set_max_packet_size(config: dict) -> dict:
@@ -72,7 +115,9 @@ CONFIG_SCHEMA = cv.All(
             cv.Optional(CONF_MAX_PACKET_SIZE, default=64): cv.one_of(
                 64, 128, 256, 512, 1024, int=True
             ),
-            cv.Optional(CONF_DEVICES): cv.ensure_list(usb_device_schema()),
+            cv.Optional(CONF_DEVICES): cv.All(
+                cv.ensure_list(usb_device_schema()), validate_usb_clients
+            ),
         }
     ),
     only_on_variant(
@@ -91,6 +136,10 @@ CONFIG_SCHEMA = cv.All(
 async def register_usb_client(config: ConfigType) -> MockObj:
     var = cg.new_Pvariable(config[CONF_ID], config[CONF_VID], config[CONF_PID])
     await cg.register_component(var, config)
+    if (manufacturer := config.get(CONF_MANUFACTURER)) is not None:
+        cg.add(var.set_manufacturer_filter(manufacturer))
+    if (product := config.get(CONF_PRODUCT)) is not None:
+        cg.add(var.set_product_filter(product))
     return var
 
 

esphome/components/usb_host/usb_host.h

@@ -117,6 +117,20 @@ struct UsbEvent {
 
 // callback function type.
 
+// USB string descriptors hold at most 126 characters; one more for the terminator
+static constexpr size_t DESC_STRING_BUF_SIZE = 128;
+
+/// Identity of a connected USB device, copied out of the descriptors the USB host
+/// stack caches for the lifetime of the connection
+struct UsbDeviceInfo {
+  uint16_t vendor_id;
+  uint16_t product_id;
+  uint16_t bcd_device;
+  char manufacturer[DESC_STRING_BUF_SIZE];
+  char product[DESC_STRING_BUF_SIZE];
+  char serial_number[DESC_STRING_BUF_SIZE];
+};
+
 enum ClientState {
   USB_CLIENT_INIT = 0,
   USB_CLIENT_OPEN,
@@ -144,6 +158,15 @@ class USBClient : public Component {
   bool control_transfer(uint8_t type, uint8_t request, uint16_t value, uint16_t index, const transfer_cb_t &callback,
                         const std::vector<uint8_t> &data = {});
 
+  /// Copy the connected device's identity out of the cached USB descriptors.
+  /// Returns false when no device is connected.
+  bool get_device_info(UsbDeviceInfo &info) const;
+
+  /// Narrow which device this client claims, beyond the VID/PID it was constructed
+  /// with, by requiring a descriptor string to match exactly.
+  void set_manufacturer_filter(const char *manufacturer) { this->manufacturer_filter_ = manufacturer; }
+  void set_product_filter(const char *product) { this->product_filter_ = product; }
+
   // Lock-free event queue and pool for USB task to main loop communication
   // Must be public for access from static callbacks
   LockFreeQueue<UsbEvent, USB_EVENT_QUEUE_SIZE> event_queue;
@@ -161,6 +184,9 @@ class USBClient : public Component {
   TransferRequest *get_trq_();  // Lock-free allocation using atomic bitmask (multi-consumer safe)
   virtual void disconnect();
   virtual void on_connected() {}
+
+  /// Whether the device's descriptor strings satisfy every filter that is set.
+  bool descriptor_strings_match_(const usb_device_info_t &dev_info) const;
   virtual void on_disconnected() {
     // Reset all requests to available (all bits to 0)
     this->trq_in_use_.store(0);
@@ -181,6 +207,9 @@ class USBClient : public Component {
   // Bit i = 1: requests_[i] is in use, Bit i = 0: requests_[i] is available
   // Supports multiple concurrent consumers and producers (both threads can allocate/deallocate)
   std::atomic<trq_bitmask_t> trq_in_use_;
+  // Descriptor strings a device must report to be claimed; nullptr means no constraint
+  const char *manufacturer_filter_{nullptr};
+  const char *product_filter_{nullptr};
   uint16_t vid_{};
   uint16_t pid_{};
 };

esphome/components/usb_host/usb_host_client.cpp

@@ -143,10 +143,8 @@ static void usb_client_print_config_descriptor(const usb_config_desc_t *cfg_desc
   } while (next_desc != NULL);
 }
 #endif
-// USB string descriptors: bLength (uint8_t, max 255) includes the 2-byte header (bLength and bDescriptorType).
-// Character count = (bLength - 2) / 2, max 126 chars + null terminator.
-static constexpr size_t DESC_STRING_BUF_SIZE = 128;
-
+// bLength (uint8_t, max 255) includes the 2-byte header (bLength and bDescriptorType),
+// so character count = (bLength - 2) / 2.
 static const char *get_descriptor_string(const usb_str_desc_t *desc, std::span<char, DESC_STRING_BUF_SIZE> buffer) {
   if (desc == nullptr || desc->bLength < 2)
     return "(unspecified)";
@@ -162,6 +160,61 @@ static const char *get_descriptor_string(const usb_str_desc_t *desc, std::span<c
   return buffer.data();
 }
 
+// A missing descriptor copies as an empty string, unlike the "(unspecified)"
+// placeholder the logging helper above uses
+static void copy_descriptor_string(const usb_str_desc_t *desc, std::span<char, DESC_STRING_BUF_SIZE> buffer) {
+  buffer[0] = '\0';
+  if (desc == nullptr || desc->bLength < 2)
+    return;
+  int char_count = (desc->bLength - 2) / 2;
+  char *p = buffer.data();
+  char *end = p + buffer.size() - 1;
+  for (int i = 0; i != char_count && p < end; i++) {
+    auto c = desc->wData[i];
+    if (c < 0x100)
+      *p++ = static_cast<char>(c);
+  }
+  *p = '\0';
+}
+
+// Descriptor strings are UTF-16, so a character above Latin-1 can never match.
+static bool descriptor_string_equals(const usb_str_desc_t *desc, const char *expected) {
+  const int char_count = (desc == nullptr || desc->bLength < 2) ? 0 : (desc->bLength - 2) / 2;
+  for (int i = 0; i != char_count; i++) {
+    const uint16_t c = desc->wData[i];
+    if (c >= 0x100 || expected[i] == '\0' || static_cast<char>(c) != expected[i])
+      return false;
+  }
+  return expected[char_count] == '\0';
+}
+
+bool USBClient::descriptor_strings_match_(const usb_device_info_t &dev_info) const {
+  if (this->manufacturer_filter_ != nullptr &&
+      !descriptor_string_equals(dev_info.str_desc_manufacturer, this->manufacturer_filter_))
+    return false;
+  if (this->product_filter_ != nullptr && !descriptor_string_equals(dev_info.str_desc_product, this->product_filter_))
+    return false;
+  return true;
+}
+
+bool USBClient::get_device_info(UsbDeviceInfo &info) const {
+  if (this->state_ != USB_CLIENT_CONNECTED)
+    return false;
+  const usb_device_desc_t *desc;
+  if (usb_host_get_device_descriptor(this->device_handle_, &desc) != ESP_OK)
+    return false;
+  info.vendor_id = desc->idVendor;
+  info.product_id = desc->idProduct;
+  info.bcd_device = desc->bcdDevice;
+  usb_device_info_t dev_info;
+  if (usb_host_device_info(this->device_handle_, &dev_info) != ESP_OK)
+    return false;
+  copy_descriptor_string(dev_info.str_desc_manufacturer, info.manufacturer);
+  copy_descriptor_string(dev_info.str_desc_product, info.product);
+  copy_descriptor_string(dev_info.str_desc_serial_num, info.serial_number);
+  return true;
+}
+
 // CALLBACK CONTEXT: USB task (called from usb_host_client_handle_events in USB task)
 static void client_event_cb(const usb_host_client_event_msg_t *event_msg, void *ptr) {
   auto *client = static_cast<USBClient *>(ptr);
@@ -316,6 +369,16 @@ void USBClient::handle_open_state_() {
     this->disconnect();
     return;
   }
+  // Scoped so the buffers do not outlive this cold branch
+  if (!this->descriptor_strings_match_(dev_info)) {
+    char buf_manuf[DESC_STRING_BUF_SIZE];
+    char buf_product[DESC_STRING_BUF_SIZE];
+    ESP_LOGD(TAG, "Device does not match filter, closing. Manuf: %s; Prod: %s",
+             get_descriptor_string(dev_info.str_desc_manufacturer, buf_manuf),
+             get_descriptor_string(dev_info.str_desc_product, buf_product));
+    this->disconnect();
+    return;
+  }
   this->state_ = USB_CLIENT_CONNECTED;
   char buf_manuf[DESC_STRING_BUF_SIZE];
   char buf_product[DESC_STRING_BUF_SIZE];
@@ -557,6 +620,12 @@ void USBClient::dump_config() {
                 "  Vendor id %04X\n"
                 "  Product id %04X",
                 this->vid_, this->pid_);
+  if (this->manufacturer_filter_ != nullptr) {
+    ESP_LOGCONFIG(TAG, "  Manufacturer %s", this->manufacturer_filter_);
+  }
+  if (this->product_filter_ != nullptr) {
+    ESP_LOGCONFIG(TAG, "  Product %s", this->product_filter_);
+  }
 }
 // THREAD CONTEXT: Called from both USB task and main loop threads
 // - USB task: Immediately after transfer callback completes

esphome/components/usb_uart/__init__.py

@@ -6,6 +6,7 @@ from esphome.components.usb_host import (
     get_max_packet_size,
     register_usb_client,
     usb_device_schema,
+    validate_usb_clients,
 )
 import esphome.config_validation as cv
 from esphome.const import (
@@ -16,7 +17,7 @@ from esphome.const import (
     CONF_DUMMY_RECEIVER,
     CONF_ID,
 )
-from esphome.core import CORE
+from esphome.core import CORE, ID
 from esphome.cpp_types import Component
 from esphome.types import ConfigType
 
@@ -27,6 +28,16 @@ usb_uart_ns = cg.esphome_ns.namespace("usb_uart")
 USBUartComponent = usb_uart_ns.class_("USBUartComponent", Component)
 USBUartChannel = usb_uart_ns.class_("USBUartChannel", UARTComponent)
 
+
+def is_usb_uart_channel(uart_id: ID, full_config: ConfigType) -> bool:
+    """Return True if the given ID refers to a channel of a configured usb_uart device."""
+    return any(
+        channel[CONF_ID] == uart_id
+        for device in full_config.get("usb_uart") or []
+        for channel in device[CONF_CHANNELS]
+    )
+
+
 UARTParityOptions = usb_uart_ns.enum("UARTParityOptions")
 UART_PARITY_OPTIONS = {
     "NONE": UARTParityOptions.UART_CONFIG_PARITY_NONE,
@@ -144,16 +155,19 @@ def channel_schema(type_: "Type") -> cv.Schema:
     )
 
 
-CONFIG_SCHEMA = cv.ensure_list(
-    cv.typed_schema(
-        {
-            it.name: usb_device_schema(it.cls, it.vid, it.pid).extend(
-                channel_schema(it)
-            )
-            for it in uart_types
-        },
-        upper=True,
-    )
+CONFIG_SCHEMA = cv.All(
+    cv.ensure_list(
+        cv.typed_schema(
+            {
+                it.name: usb_device_schema(it.cls, it.vid, it.pid).extend(
+                    channel_schema(it)
+                )
+                for it in uart_types
+            },
+            upper=True,
+        )
+    ),
+    validate_usb_clients,
 )
 
 

esphome/components/usb_uart/usb_uart.cpp

@@ -242,7 +242,7 @@ void USBUartComponent::loop() {
     this->chunk_pool_.release(chunk);
 
     // Invoke the RX callback (if registered) immediately after data lands in the
-    // ring buffer.  This lets consumers such as ZigbeeProxy process incoming bytes
+    // ring buffer.  This lets consumers such as ZigbeeProxyTap process incoming bytes
     // in the same loop iteration they are delivered, avoiding an extra wakeup cycle.
     if (channel->rx_callback_) {
       channel->rx_callback_();

esphome/components/usb_uart/usb_uart.h

@@ -163,10 +163,13 @@ class USBUartChannelBase : public uart::UARTComponent, public Parented<USBUartCo
 
   /// Register a callback invoked immediately after data is pushed to the input ring buffer.
   /// Called from USBUartComponent::loop() in the main loop context.
-  /// Allows consumers (e.g. ZigbeeProxy) to process bytes in the same loop iteration
+  /// Allows consumers (e.g. ZigbeeProxyTap) to process bytes in the same loop iteration
   /// they arrive, eliminating one full main-loop-wakeup cycle of latency.
   void set_rx_callback(std::function<void()> cb) { this->rx_callback_ = std::move(cb); }
 
+  /// Channel index on the bridge (interface number on multi-port bridges)
+  uint8_t get_index() const { return this->index_; }
+
  protected:
   // Not directly instantiable; construct a concrete channel type instead.
   USBUartChannelBase(uint8_t index, uint16_t buffer_size) : input_buffer_(RingBuffer(buffer_size)), index_(index) {}

esphome/components/zigbee_proxy_tap/__init__.py

@@ -0,0 +1,47 @@
+import esphome.codegen as cg
+from esphome.components import serial_proxy
+import esphome.config_validation as cv
+from esphome.const import CONF_ID, CONF_POWER_SAVE_MODE, CONF_WIFI
+import esphome.final_validate as fv
+from esphome.types import ConfigType
+
+CODEOWNERS = ["@kbx81"]
+DEPENDENCIES = ["serial_proxy"]
+
+CONF_SERIAL_PROXY_ID = "serial_proxy_id"
+
+zigbee_proxy_tap_ns = cg.esphome_ns.namespace("zigbee_proxy_tap")
+ZigbeeProxyTap = zigbee_proxy_tap_ns.class_(
+    "ZigbeeProxyTap", cg.Component, serial_proxy.SerialProxyTap
+)
+
+
+def _final_validate(config: ConfigType) -> ConfigType:
+    full_config = fv.full_config.get()
+    if (wifi_conf := full_config.get(CONF_WIFI)) and (
+        wifi_conf.get(CONF_POWER_SAVE_MODE, "").lower() != "none"
+    ):
+        raise cv.Invalid(
+            f"{CONF_WIFI} {CONF_POWER_SAVE_MODE} must be set to 'none' when using Zigbee proxy"
+        )
+    return config
+
+
+CONFIG_SCHEMA = cv.Schema(
+    {
+        cv.GenerateID(): cv.declare_id(ZigbeeProxyTap),
+        cv.Required(CONF_SERIAL_PROXY_ID): cv.use_id(serial_proxy.SerialProxy),
+    }
+).extend(cv.COMPONENT_SCHEMA)
+
+FINAL_VALIDATE_SCHEMA = _final_validate
+
+
+async def to_code(config: ConfigType) -> None:
+    sp = await cg.get_variable(config[CONF_SERIAL_PROXY_ID])
+    var = cg.new_Pvariable(config[CONF_ID], sp)
+    await cg.register_component(var, config)
+
+    cg.add_define("USE_ZIGBEE_PROXY_TAP")
+    # Compiles the tap interface into serial_proxy; without it the port is a plain byte pipe
+    cg.add_define("USE_SERIAL_PROXY_TAP")

esphome/components/zigbee_proxy_tap/ash_detector.cpp

@@ -0,0 +1,250 @@
+#include "ash_detector.h"
+
+#ifdef USE_ZIGBEE_PROXY_TAP
+
+namespace esphome::zigbee_proxy_tap {
+
+// Control byte of an RSTACK, and the only ASH version byte that can follow it
+static constexpr uint8_t ASH_RSTACK_CONTROL = 0xC1;
+static constexpr uint8_t ASH_PROTOCOL_VERSION = 0x02;
+static constexpr size_t ASH_RSTACK_BODY_SIZE = 3;  // control, version, reset code
+static constexpr size_t ASH_CRC_SIZE = 2;
+// Smallest legal frame on the wire: a bare control byte plus its CRC
+static constexpr size_t ASH_MIN_FRAME_SIZE = 1 + ASH_CRC_SIZE;
+
+// The opening EZSP version command is a constant: control 0x00 (frmNum 0, ackNum 0)
+// followed by [seq=0][frameControl=0][frameId=0] randomized by 0x42 0x21 0xA8. Only the
+// trailing requested-version byte varies, so the first four bytes pin the frame exactly.
+static constexpr uint8_t EZSP_VERSION_CMD_PREFIX[] = {0x00, 0x42, 0x21, 0xA8};
+static constexpr size_t EZSP_VERSION_CMD_SIZE = 5;
+
+// Consecutive frames we could not accept, with neither a good frame nor a retransmission
+// in between, before concluding the peer is no longer speaking ASH. A real ASH peer must
+// retransmit an unacknowledged frame, so the absence of one is the positive evidence
+// here -- garbage on the line is not, since noise proves nothing either way.
+static constexpr uint8_t MAX_UNCONFIRMED_REJECTS = 4;
+
+static bool ash_reset_code_is_known(uint8_t code) {
+  switch (code) {
+    case 0x00:  // RESET_UNKNOWN
+    case 0x01:  // RESET_EXTERNAL
+    case 0x02:  // RESET_POWER_ON
+    case 0x03:  // RESET_WATCHDOG
+    case 0x06:  // RESET_ASSERT
+    case 0x09:  // RESET_BOOTLOADER
+    case 0x0B:  // RESET_SOFTWARE
+    case 0x51:  // ERROR_EXCEEDED_MAXIMUM_ACK_TIMEOUT_COUNT
+    case 0x80:  // ERROR_CHIP_SPECIFIC
+    case 0x81:  // RESET_CHIP_SPECIFIC
+      return true;
+    default:
+      return false;
+  }
+}
+
+void AshFrameScanner::begin_frame_() {
+  this->index_ = 0;
+  this->crc_ = ASH_CRC_INIT;
+  this->escaped_ = false;
+  this->poisoned_ = false;
+}
+
+void AshFrameScanner::reset() {
+  this->begin_frame_();
+  this->frame_length_ = 0;
+  this->discarding_ = false;
+}
+
+ScanResult AshFrameScanner::feed(uint8_t byte) {
+  if (byte == ASH_FLAG_BYTE) {
+    // Snapshot everything the verdict depends on: begin_frame_() clears all of it.
+    const bool discarding = this->discarding_;
+    const bool poisoned = this->poisoned_;
+    const bool escaped = this->escaped_;
+    const size_t index = this->index_;
+    const uint16_t crc = this->crc_;
+    // A FLAG always starts the next frame afresh, whatever preceded it
+    this->begin_frame_();
+    this->discarding_ = false;
+
+    if (discarding || index == 0) {
+      // Consecutive delimiters carry no frame at all, so there is nothing to judge
+      this->frame_length_ = 0;
+      return ScanResult::NONE;
+    }
+    // Running the CRC over the body *and* its trailing CRC bytes leaves zero when
+    // correct, so validity needs no second pass over the frame.
+    if (poisoned || escaped || index < ASH_MIN_FRAME_SIZE || crc != 0) {
+      this->frame_length_ = 0;
+      return ScanResult::INVALID;
+    }
+    this->frame_length_ = index - ASH_CRC_SIZE;
+    return ScanResult::FRAME;
+  }
+
+  if (this->discarding_) {
+    return ScanResult::NONE;
+  }
+
+  switch (byte) {
+    case ASH_CANCEL_BYTE:
+      // Everything received since the last FLAG is to be ignored
+      this->begin_frame_();
+      return ScanResult::NONE;
+
+    case ASH_SUBSTITUTE_BYTE:
+      // A low-level error was flagged; ignore everything up to the next FLAG
+      this->discarding_ = true;
+      return ScanResult::NONE;
+
+    case ASH_XON_BYTE:
+    case ASH_XOFF_BYTE:
+      // Transport flow control, not frame content: skip it without disturbing the frame
+      return ScanResult::NONE;
+
+    case ASH_ESCAPE_BYTE:
+      this->escaped_ = true;
+      return ScanResult::NONE;
+
+    default:
+      break;
+  }
+
+  uint8_t value = byte;
+  if (this->escaped_) {
+    this->escaped_ = false;
+    value = byte ^ ASH_XOR_BYTE;
+    // An escape must decode to a reserved byte; anything else is not ASH framing at all
+    if (!ash_is_reserved(value)) {
+      this->poisoned_ = true;
+      return ScanResult::NONE;
+    }
+  }
+
+  if (this->index_ >= sizeof(this->buffer_)) {
+    this->poisoned_ = true;
+    return ScanResult::NONE;
+  }
+
+  this->buffer_[this->index_++] = value;
+  this->crc_ = ash_crc16(&value, 1, this->crc_);
+  return ScanResult::NONE;
+}
+
+void AshDetector::reset() {
+  this->ncp_scanner_.reset();
+  this->host_scanner_.reset();
+  this->state_ = AshDetectState::IDLE;
+  this->rx_sequence_ = 0;
+  this->ack_owed_ = false;
+  this->unconfirmed_rejects_ = 0;
+}
+
+void AshDetector::from_ncp(uint8_t byte) {
+  switch (this->ncp_scanner_.feed(byte)) {
+    case ScanResult::FRAME:
+      this->handle_ncp_frame_();
+      break;
+    case ScanResult::INVALID:
+      // A delimited chunk that is not a frame. While armed this may be a corrupted ASH
+      // frame, which the peer will retransmit, or a sign the peer stopped speaking ASH.
+      // reject_() distinguishes the two by whether a retransmission ever arrives.
+      this->reject_();
+      break;
+    case ScanResult::NONE:
+      break;
+  }
+}
+
+void AshDetector::handle_ncp_frame_() {
+  const uint8_t *body = this->ncp_scanner_.frame();
+  const size_t length = this->ncp_scanner_.length();
+  const uint8_t control = body[0];
+
+  // RSTACK is the only way into the handshake, and the only way back after a firmware
+  // swap: a Spinel or bootloader NCP never emits one, so those stay unarmed forever.
+  if (control == ASH_RSTACK_CONTROL) {
+    if (length == ASH_RSTACK_BODY_SIZE && body[1] == ASH_PROTOCOL_VERSION && ash_reset_code_is_known(body[2])) {
+      this->state_ = AshDetectState::SAW_RSTACK;
+      this->rx_sequence_ = 0;
+      this->ack_owed_ = false;
+      this->unconfirmed_rejects_ = 0;
+    }
+    return;
+  }
+
+  if (this->state_ != AshDetectState::ARMED) {
+    return;
+  }
+
+  if ((control & 0x80) != 0) {
+    return;  // ACK/NAK/RST/ERROR: nothing is owed for these
+  }
+
+  const uint8_t frame_num = (control >> 4) & ASH_MAX_SEQUENCE;
+  const bool re_tx = (control & 0x08) != 0;
+
+  if (frame_num != this->rx_sequence_) {
+    // A retransmission still proves the peer is speaking ASH even though we cannot use
+    // this copy, so it clears the suspicion without being acknowledged.
+    if (re_tx) {
+      this->unconfirmed_rejects_ = 0;
+    } else {
+      this->reject_();
+    }
+    return;
+  }
+
+  this->rx_sequence_ = (this->rx_sequence_ + 1) & ASH_MAX_SEQUENCE;
+  this->pending_ack_ = this->rx_sequence_;
+  this->ack_owed_ = true;
+  this->unconfirmed_rejects_ = 0;
+}
+
+void AshDetector::reject_() {
+  if (this->state_ != AshDetectState::ARMED) {
+    return;
+  }
+  if (++this->unconfirmed_rejects_ >= MAX_UNCONFIRMED_REJECTS) {
+    this->state_ = AshDetectState::IDLE;
+    this->unconfirmed_rejects_ = 0;
+  }
+}
+
+void AshDetector::from_host(uint8_t byte) {
+  if (this->host_scanner_.feed(byte) != ScanResult::FRAME) {
+    return;
+  }
+
+  if (this->state_ != AshDetectState::SAW_RSTACK) {
+    return;
+  }
+
+  const uint8_t *body = this->host_scanner_.frame();
+  if (this->host_scanner_.length() != EZSP_VERSION_CMD_SIZE) {
+    return;
+  }
+  for (size_t i = 0; i < sizeof(EZSP_VERSION_CMD_PREFIX); i++) {
+    if (body[i] != EZSP_VERSION_CMD_PREFIX[i]) {
+      return;
+    }
+  }
+
+  this->state_ = AshDetectState::ARMED;
+  this->rx_sequence_ = 0;
+  this->ack_owed_ = false;
+  this->unconfirmed_rejects_ = 0;
+}
+
+bool AshDetector::take_pending_ack(uint8_t &ack_num) {
+  if (!this->ack_owed_) {
+    return false;
+  }
+  this->ack_owed_ = false;
+  ack_num = this->pending_ack_;
+  return true;
+}
+
+}  // namespace esphome::zigbee_proxy_tap
+
+#endif  // USE_ZIGBEE_PROXY_TAP

esphome/components/zigbee_proxy_tap/ash_detector.h

@@ -0,0 +1,104 @@
+#pragma once
+
+#include "esphome/core/defines.h"
+#ifdef USE_ZIGBEE_PROXY_TAP
+
+#include "ash_protocol.h"
+
+#include <cstddef>
+#include <cstdint>
+
+namespace esphome::zigbee_proxy_tap {
+
+// Decides when it is safe to acknowledge NCP frames on a client's behalf.
+//
+// The client suppresses its own ACKs, so nobody else will send them, and injecting ASH
+// bytes into a stream that is not ASH would corrupt it. Detection is therefore one-sided:
+// arm only on the session handshake, which is a fixed byte string, and never on frame
+// validity, which non-ASH traffic can satisfy by luck.
+//
+//   RSTACK  (NCP -> host)   c1 02 <reset_code> <crc> 7e
+//   version (host -> NCP)   00 42 21 a8 <version^0x54> <crc> 7e
+//
+// Requiring both, in that order, in opposite directions cannot be satisfied by a
+// unidirectional byte stream whatever it contains -- which is exactly the situation
+// during a firmware upload. Verified against real .gbl images and real Spinel traffic:
+// zero false arms, and neither pattern occurs even as a substring.
+//
+// Getting it wrong in the other direction is cheap: a frame we decline to acknowledge is
+// retransmitted by the NCP, so we see a clean copy and lose only the ack timeout. That
+// asymmetry is why this errs towards silence everywhere.
+
+enum class AshDetectState : uint8_t {
+  IDLE,        // Not ASH, or not yet proven to be
+  SAW_RSTACK,  // Handshake half-complete; watching for the version command
+  ARMED,       // Session confirmed; acknowledging on the client's behalf
+};
+
+enum class ScanResult : uint8_t {
+  NONE,     // Mid-frame, or a delimiter that carried nothing
+  FRAME,    // frame()/length() hold a complete body with a verified CRC
+  INVALID,  // A delimited chunk arrived but was not a well-formed ASH frame
+};
+
+// Reassembles one direction of the byte stream into unstuffed, CRC-checked frames.
+// Mirrors bellows' AshProtocol.data_received: FLAG ends a frame, CANCEL discards what
+// precedes it, SUBSTITUTE poisons everything up to the next FLAG, and XON/XOFF are
+// transport flow control removed without disturbing the frame around them.
+class AshFrameScanner {
+ public:
+  ScanResult feed(uint8_t byte);
+  void reset();
+
+  // Valid only until the next feed() call, which begins overwriting the buffer.
+  const uint8_t *frame() const { return this->buffer_; }
+  size_t length() const { return this->frame_length_; }
+
+ private:
+  void begin_frame_();
+
+  // Frames are bounded by the ASH maximum, so a stream carrying no delimiters cannot
+  // grow the buffer without limit; it just keeps failing.
+  uint8_t buffer_[MAX_ASH_FRAME_SIZE];
+  size_t index_{0};         // accumulation position for the frame being read
+  size_t frame_length_{0};  // body length of the last completed frame
+  uint16_t crc_{ASH_CRC_INIT};
+  bool escaped_{false};
+  bool discarding_{false};
+  bool poisoned_{false};
+};
+
+class AshDetector {
+ public:
+  void reset();
+
+  // Feed observed traffic. Neither call gates forwarding: the detector only watches.
+  void from_ncp(uint8_t byte);
+  void from_host(uint8_t byte);
+
+  bool armed() const { return this->state_ == AshDetectState::ARMED; }
+
+  // True only while the host direction can affect the state machine, i.e. while waiting
+  // for the version command. Lets the caller skip scanning that direction entirely the
+  // rest of the time -- it is the one carrying firmware uploads.
+  bool needs_host_scan() const { return this->state_ == AshDetectState::SAW_RSTACK; }
+
+  // An acknowledgement became owed after the last from_ncp() call. Clears the flag.
+  bool take_pending_ack(uint8_t &ack_num);
+
+ protected:
+  void handle_ncp_frame_();
+  void reject_();
+
+  AshFrameScanner ncp_scanner_;
+  AshFrameScanner host_scanner_;
+  AshDetectState state_{AshDetectState::IDLE};
+  uint8_t rx_sequence_{0};
+  uint8_t pending_ack_{0};
+  uint8_t unconfirmed_rejects_{0};
+  bool ack_owed_{false};
+};
+
+}  // namespace esphome::zigbee_proxy_tap
+
+#endif  // USE_ZIGBEE_PROXY_TAP

esphome/components/zigbee_proxy_tap/ash_protocol.cpp

@@ -0,0 +1,41 @@
+#include "ash_protocol.h"
+
+namespace esphome::zigbee_proxy_tap {
+
+static const uint16_t CRC_NIBBLE_TABLE[16] = {0x0000, 0x1021, 0x2042, 0x3063, 0x4084, 0x50A5, 0x60C6, 0x70E7,
+                                              0x8108, 0x9129, 0xA14A, 0xB16B, 0xC18C, 0xD1AD, 0xE1CE, 0xF1EF};
+
+uint16_t ash_crc16(const uint8_t *data, size_t length, uint16_t init) {
+  uint16_t crc = init;
+  for (size_t i = 0; i < length; i++) {
+    crc = static_cast<uint16_t>(crc << 4) ^ CRC_NIBBLE_TABLE[(crc >> 12) ^ (data[i] >> 4)];
+    crc = static_cast<uint16_t>(crc << 4) ^ CRC_NIBBLE_TABLE[(crc >> 12) ^ (data[i] & 0x0F)];
+  }
+  return crc;
+}
+
+// Appends a byte with ASH stuffing; the caller sized `output` for the worst case.
+static void append_byte_stuffed(uint8_t *output, size_t &pos, uint8_t byte) {
+  if (ash_is_reserved(byte)) {
+    output[pos++] = ASH_ESCAPE_BYTE;
+    output[pos++] = byte ^ ASH_XOR_BYTE;
+  } else {
+    output[pos++] = byte;
+  }
+}
+
+size_t ash_build_ack_frame(uint8_t *output, uint8_t ack_num) {
+  // ACK control byte: 100nrPPP, where PPP is the next frame number expected
+  const uint8_t control = 0x80 | (ack_num & ASH_MAX_SEQUENCE);
+  const uint16_t crc = ash_crc16(&control, 1);
+
+  size_t pos = 0;
+  output[pos++] = ASH_FLAG_BYTE;
+  append_byte_stuffed(output, pos, control);
+  append_byte_stuffed(output, pos, (crc >> 8) & 0xFF);
+  append_byte_stuffed(output, pos, crc & 0xFF);
+  output[pos++] = ASH_FLAG_BYTE;
+  return pos;
+}
+
+}  // namespace esphome::zigbee_proxy_tap

esphome/components/zigbee_proxy_tap/ash_protocol.h

@@ -0,0 +1,51 @@
+#pragma once
+
+#include <cstddef>
+#include <cstdint>
+
+namespace esphome::zigbee_proxy_tap {
+
+// ASH Protocol Constants
+static constexpr uint8_t ASH_FLAG_BYTE = 0x7E;        // Frame delimiter
+static constexpr uint8_t ASH_ESCAPE_BYTE = 0x7D;      // Escape/substitution byte
+static constexpr uint8_t ASH_XOR_BYTE = 0x20;         // XOR mask for escaped bytes
+static constexpr uint8_t ASH_SUBSTITUTE_BYTE = 0x18;  // Substitution for invalid bytes
+
+static constexpr uint8_t ASH_XON_BYTE = 0x11;     // Resume transmission
+static constexpr uint8_t ASH_XOFF_BYTE = 0x13;    // Pause transmission
+static constexpr uint8_t ASH_CANCEL_BYTE = 0x1A;  // Discards the partial frame before it
+
+// A reserved byte can never appear literally inside a frame; it is escaped as
+// ESCAPE followed by the byte XOR 0x20. Rejecting frames that contain one is what
+// eliminates most non-ASH traffic before its CRC is ever computed: real firmware
+// images and Spinel payloads are dense in 0x11/0x13/0x18/0x1A.
+inline bool ash_is_reserved(uint8_t byte) {
+  return byte == ASH_FLAG_BYTE || byte == ASH_ESCAPE_BYTE || byte == ASH_XON_BYTE || byte == ASH_XOFF_BYTE ||
+         byte == ASH_SUBSTITUTE_BYTE || byte == ASH_CANCEL_BYTE;
+}
+
+// CRC-CCITT (init 0xFFFF, polynomial 0x1021, transmitted big-endian). Note this is a
+// different variant from the Kermit FCS that Spinel/HDLC-lite uses over the same
+// 0x7E framing, so Spinel frames systematically fail this check.
+uint16_t ash_crc16(const uint8_t *data, size_t length, uint16_t init = 0xFFFF);
+
+// ASH bounds a frame's Data Field at 128 bytes, so the largest body a scanner has to
+// hold is that field plus the control byte and the two CRC bytes ahead of the closing
+// delimiter. Byte stuffing happens on the wire only and is undone as bytes arrive, so it
+// does not enlarge this.
+static constexpr size_t ASH_MAX_DATA_FIELD_SIZE = 128;
+static constexpr size_t MAX_ASH_FRAME_SIZE = 1 + ASH_MAX_DATA_FIELD_SIZE + 2;
+
+// Protocol limits
+static constexpr uint8_t ASH_MAX_SEQUENCE = 7;    // 3-bit sequence number (0-7)
+static constexpr uint16_t ASH_CRC_INIT = 0xFFFF;  // CRC-CCITT initial value
+
+// An ACK is FLAG, control byte, two CRC bytes, FLAG. Every byte but the delimiters may
+// need escaping, so the worst case is 2 + 3 * 2 = 8.
+static constexpr size_t ASH_ACK_FRAME_MAX_SIZE = 8;
+
+// Writes an ACK frame for `ack_num` into `output`, which must hold at least
+// ASH_ACK_FRAME_MAX_SIZE bytes, and returns its length.
+size_t ash_build_ack_frame(uint8_t *output, uint8_t ack_num);
+
+}  // namespace esphome::zigbee_proxy_tap

esphome/components/zigbee_proxy_tap/zigbee_proxy_tap.cpp

@@ -0,0 +1,61 @@
+#include "zigbee_proxy_tap.h"
+
+#ifdef USE_ZIGBEE_PROXY_TAP
+
+#include "esphome/core/log.h"
+
+namespace esphome::zigbee_proxy_tap {
+
+static const char *const TAG = "zigbee_proxy_tap";
+
+void ZigbeeProxyTap::setup() { this->parent_->set_tap(this); }
+
+void ZigbeeProxyTap::dump_config() { ESP_LOGCONFIG(TAG, "Zigbee Proxy Tap:\n  Port: %s", this->parent_->get_name()); }
+
+void ZigbeeProxyTap::on_device_rx(const uint8_t *data, size_t len) {
+  for (size_t i = 0; i < len; i++) {
+    // Observation only: the detector never gates forwarding, so it adds no latency and a
+    // frame it cannot parse still reaches the client, which judges it for itself.
+    this->detector_.from_ncp(data[i]);
+
+    uint8_t ack_num;
+    if (this->detector_.take_pending_ack(ack_num)) {
+      // The client suppresses its own ACKs, so this is the only acknowledgement the NCP
+      // will see. Only ever sent for a frame that passed CRC and arrived in sequence.
+      uint8_t frame[ASH_ACK_FRAME_MAX_SIZE];
+      this->parent_->write_from_tap(frame, ash_build_ack_frame(frame, ack_num));
+      ESP_LOGV(TAG, "Sent ACK for frame %u", ack_num);
+    }
+  }
+
+  const bool armed = this->detector_.armed();
+  if (armed != this->was_armed_) {
+    this->was_armed_ = armed;
+    ESP_LOGD(TAG, "ASH session %s",
+             armed ? LOG_STR_LITERAL("detected, acknowledging frames")
+                   : LOG_STR_LITERAL("lost, no longer acknowledging frames"));
+  }
+}
+
+void ZigbeeProxyTap::on_client_tx(const uint8_t *data, size_t len) {
+  // Scanning this direction only matters while waiting for the version command that
+  // completes the handshake. Outside that window it is skipped entirely -- which is what
+  // makes a firmware upload, all of which flows this way, essentially free.
+  if (!this->detector_.needs_host_scan()) {
+    return;
+  }
+  for (size_t i = 0; i < len; i++) {
+    this->detector_.from_host(data[i]);
+  }
+}
+
+void ZigbeeProxyTap::on_protocol_disabled() {
+  // A client turning protocol handling off is usually about to reflash the radio, so the
+  // handshake we saw says nothing about what will be on the wire next. Forget it: a real
+  // ASH session announces itself again with an RSTACK.
+  this->detector_.reset();
+}
+
+}  // namespace esphome::zigbee_proxy_tap
+
+#endif  // USE_ZIGBEE_PROXY_TAP

esphome/components/zigbee_proxy_tap/zigbee_proxy_tap.h

@@ -0,0 +1,50 @@
+#pragma once
+
+#include "esphome/core/defines.h"
+#ifdef USE_ZIGBEE_PROXY_TAP
+
+#include "esphome/components/serial_proxy/serial_proxy.h"
+#include "esphome/core/component.h"
+#include "ash_detector.h"
+
+namespace esphome::zigbee_proxy_tap {
+
+// Acknowledges the ASH frames of an EZSP NCP on behalf of a remote client, so the NCP's
+// ack timeout is measured against this device rather than against the network round trip
+// to the client. The client suppresses its own acknowledgements, making these the only
+// ones the NCP sees.
+//
+// It never carries client traffic: the serial proxy owns the port and the bytes, and this
+// component only observes them. The sole exception is the acknowledgement itself, and it
+// is sent only once the handshake has proven the port really is carrying ASH.
+class ZigbeeProxyTap : public serial_proxy::SerialProxyTap, public Component {
+ public:
+  explicit ZigbeeProxyTap(serial_proxy::SerialProxy *parent) : parent_(parent) {}
+
+  void setup() override;
+  void dump_config() override;
+
+  // SerialProxyTap
+  void on_device_rx(const uint8_t *data, size_t len) override;
+  void on_client_tx(const uint8_t *data, size_t len) override;
+  // Acknowledging is only ever useful on a client's behalf, so with nobody subscribed
+  // there is nothing to do and the port need not be read.
+  bool tap_needs_port() const override { return false; }
+  void on_protocol_disabled() override;
+
+ protected:
+  // The port this component observes. Owns the UART and the bytes; every write we make
+  // goes through it.
+  serial_proxy::SerialProxy *parent_;
+
+  // Decides when acknowledging on the client's behalf is safe. Armed only by the ASH
+  // session handshake, so a bootloader or Thread NCP never triggers it.
+  AshDetector detector_;
+
+  // Previous armed state, for logging the transitions
+  bool was_armed_{false};
+};
+
+}  // namespace esphome::zigbee_proxy_tap
+
+#endif  // USE_ZIGBEE_PROXY_TAP

esphome/components/zwave_proxy_tap/__init__.py

@@ -0,0 +1,47 @@
+import esphome.codegen as cg
+from esphome.components import serial_proxy
+import esphome.config_validation as cv
+from esphome.const import CONF_ID, CONF_POWER_SAVE_MODE, CONF_WIFI
+import esphome.final_validate as fv
+from esphome.types import ConfigType
+
+CODEOWNERS = ["@kbx81"]
+DEPENDENCIES = ["serial_proxy"]
+
+CONF_SERIAL_PROXY_ID = "serial_proxy_id"
+
+zwave_proxy_tap_ns = cg.esphome_ns.namespace("zwave_proxy_tap")
+ZWaveProxyTap = zwave_proxy_tap_ns.class_(
+    "ZWaveProxyTap", cg.Component, serial_proxy.SerialProxyTap
+)
+
+
+def _final_validate(config: ConfigType) -> ConfigType:
+    full_config = fv.full_config.get()
+    if (wifi_conf := full_config.get(CONF_WIFI)) and (
+        wifi_conf.get(CONF_POWER_SAVE_MODE, "").lower() != "none"
+    ):
+        raise cv.Invalid(
+            f"{CONF_WIFI} {CONF_POWER_SAVE_MODE} must be set to 'none' when using Z-Wave proxy"
+        )
+    return config
+
+
+CONFIG_SCHEMA = cv.Schema(
+    {
+        cv.GenerateID(): cv.declare_id(ZWaveProxyTap),
+        cv.Required(CONF_SERIAL_PROXY_ID): cv.use_id(serial_proxy.SerialProxy),
+    }
+).extend(cv.COMPONENT_SCHEMA)
+
+FINAL_VALIDATE_SCHEMA = _final_validate
+
+
+async def to_code(config: ConfigType) -> None:
+    sp = await cg.get_variable(config[CONF_SERIAL_PROXY_ID])
+    var = cg.new_Pvariable(config[CONF_ID], sp)
+    await cg.register_component(var, config)
+
+    cg.add_define("USE_ZWAVE_PROXY_TAP")
+    # Compiles the tap interface into serial_proxy; without it the port is a plain byte pipe
+    cg.add_define("USE_SERIAL_PROXY_TAP")

esphome/components/zwave_proxy_tap/zwave_detector.cpp

@@ -0,0 +1,166 @@
+#include "zwave_detector.h"
+
+#ifdef USE_ZWAVE_PROXY_TAP
+
+namespace esphome::zwave_proxy_tap {
+
+// Consecutive malformed frames, with no well-formed one in between, before concluding the
+// controller is no longer speaking the Serial API. Repeated checksum failures mean our
+// idea of where frames begin is wrong, and acknowledging frames we are misreading is
+// worse than acknowledging none, so the safe move is to stop and wait to be convinced
+// again. A well-formed frame is the evidence that clears the suspicion; garbage is not,
+// since noise proves nothing either way.
+static constexpr uint8_t MAX_UNCONFIRMED_REJECTS = 4;
+
+// Abandons a frame that stalled part-received, and time-stamps the batch about to be fed.
+static void expire_stalled_frame(ZWaveFrameScanner &scanner, uint32_t &frame_start, uint32_t now) {
+  if (scanner.in_frame()) {
+    if (now - frame_start <= ZWAVE_FRAME_TIMEOUT_MS) {
+      return;  // Still within its window; keep the start time it already has
+    }
+    scanner.reset();
+  }
+  frame_start = now;
+}
+
+ScanResult ZWaveFrameScanner::feed(uint8_t byte) {
+  switch (this->state_) {
+    case ScanState::WAIT_SOF:
+      // ACK/NAK/CAN and anything else carry no framing, so there is nothing to reassemble
+      if (byte == ZWAVE_SOF_BYTE) {
+        this->state_ = ScanState::WAIT_LENGTH;
+      }
+      return ScanResult::NONE;
+
+    case ScanState::WAIT_LENGTH:
+      if (byte < ZWAVE_MIN_LENGTH) {
+        // Not a length the protocol can produce. A 0x01 in this position is far more
+        // likely to be the real start of a frame than a length, so treat it as one.
+        this->state_ = byte == ZWAVE_SOF_BYTE ? ScanState::WAIT_LENGTH : ScanState::WAIT_SOF;
+        return ScanResult::INVALID;
+      }
+      this->remaining_ = byte;
+      this->checksum_ = ZWAVE_CHECKSUM_INIT ^ byte;
+      this->state_ = ScanState::WAIT_TYPE;
+      return ScanResult::NONE;
+
+    case ScanState::WAIT_TYPE:
+      this->type_ = byte;
+      this->checksum_ ^= byte;
+      this->remaining_--;
+      this->state_ = ScanState::WAIT_COMMAND;
+      return ScanResult::NONE;
+
+    case ScanState::WAIT_COMMAND:
+      this->command_ = byte;
+      this->checksum_ ^= byte;
+      this->remaining_--;
+      this->state_ = ScanState::WAIT_BODY;
+      return ScanResult::NONE;
+
+    case ScanState::WAIT_BODY:
+      break;
+  }
+
+  if (this->remaining_ > 1) {
+    this->checksum_ ^= byte;
+    this->remaining_--;
+    return ScanResult::NONE;
+  }
+  // The frame's last byte is its checksum, which the accumulator can be compared against
+  // directly -- everything it covers has already been folded in.
+  this->state_ = ScanState::WAIT_SOF;
+  return byte == this->checksum_ ? ScanResult::FRAME : ScanResult::INVALID;
+}
+
+void ZWaveDetector::reset() {
+  this->device_scanner_.reset();
+  this->host_scanner_.reset();
+  this->state_ = ZWaveDetectState::IDLE;
+  this->pending_command_ = 0;
+  this->ack_owed_ = false;
+  this->unconfirmed_rejects_ = 0;
+}
+
+void ZWaveDetector::begin_batch(uint32_t now) {
+  // Both directions, from either caller: a frame stalled in the quiet direction still has
+  // to expire, and the direction being fed is by definition not stalled.
+  expire_stalled_frame(this->device_scanner_, this->device_frame_start_, now);
+  expire_stalled_frame(this->host_scanner_, this->host_frame_start_, now);
+}
+
+void ZWaveDetector::from_device(uint8_t byte) {
+  switch (this->device_scanner_.feed(byte)) {
+    case ScanResult::FRAME:
+      this->handle_device_frame_();
+      break;
+    case ScanResult::INVALID:
+      // While armed this may be a corrupted frame, which the controller will retransmit,
+      // or a sign it stopped speaking the Serial API. reject_() distinguishes the two by
+      // whether a well-formed frame ever follows.
+      this->reject_();
+      break;
+    case ScanResult::NONE:
+      break;
+  }
+}
+
+void ZWaveDetector::handle_device_frame_() {
+  if (this->state_ == ZWaveDetectState::SAW_REQUEST) {
+    // An unsolicited request from the controller can arrive before the response we are
+    // waiting for; it is not the other half of the exchange, so it proves nothing.
+    if (this->device_scanner_.type() != ZWAVE_FRAME_TYPE_RESPONSE ||
+        this->device_scanner_.command() != this->pending_command_) {
+      return;
+    }
+    this->state_ = ZWaveDetectState::ARMED;
+    // The host direction stops being scanned from here, so leave nothing part-read behind
+    this->host_scanner_.reset();
+  } else if (this->state_ != ZWaveDetectState::ARMED) {
+    return;
+  }
+
+  // Every well-formed frame is acknowledged, the one that armed us included: the
+  // controller is already waiting on that one, so answering now saves a retransmit.
+  this->ack_owed_ = true;
+  this->unconfirmed_rejects_ = 0;
+}
+
+void ZWaveDetector::reject_() {
+  if (this->state_ != ZWaveDetectState::ARMED) {
+    return;
+  }
+  if (++this->unconfirmed_rejects_ >= MAX_UNCONFIRMED_REJECTS) {
+    this->state_ = ZWaveDetectState::IDLE;
+    this->unconfirmed_rejects_ = 0;
+    this->ack_owed_ = false;
+  }
+}
+
+void ZWaveDetector::from_host(uint8_t byte) {
+  if (this->host_scanner_.feed(byte) != ScanResult::FRAME) {
+    return;
+  }
+  if (this->state_ == ZWaveDetectState::ARMED) {
+    return;
+  }
+  // Only a request opens an exchange. A later request replaces the one being waited on:
+  // the host does not repeat a command it has given up on.
+  if (this->host_scanner_.type() != ZWAVE_FRAME_TYPE_REQUEST) {
+    return;
+  }
+  this->pending_command_ = this->host_scanner_.command();
+  this->state_ = ZWaveDetectState::SAW_REQUEST;
+}
+
+bool ZWaveDetector::take_pending_ack() {
+  if (!this->ack_owed_) {
+    return false;
+  }
+  this->ack_owed_ = false;
+  return true;
+}
+
+}  // namespace esphome::zwave_proxy_tap
+
+#endif  // USE_ZWAVE_PROXY_TAP

esphome/components/zwave_proxy_tap/zwave_detector.h

@@ -0,0 +1,121 @@
+#pragma once
+
+#include "esphome/core/defines.h"
+#ifdef USE_ZWAVE_PROXY_TAP
+
+#include "zwave_protocol.h"
+
+#include <cstdint>
+
+namespace esphome::zwave_proxy_tap {
+
+// Decides when it is safe to acknowledge controller frames on a client's behalf.
+//
+// The client suppresses its own ACKs, so nobody else will send them, and injecting a
+// stray 0x06 into a stream that is not the Serial API would corrupt it. Detection is
+// therefore one-sided: arm only on evidence that cannot arise by accident, and never on
+// frame validity alone, which other traffic can satisfy by luck.
+//
+// The Serial API has no fixed opening handshake to key off, but every session is a
+// sequence of request/response exchanges, and one of those is evidence enough:
+//
+//   request   (host -> ctrl)   01 <len> 00 <cmd> <payload> <chk>
+//   response  (ctrl -> host)   01 <len> 01 <cmd> <payload> <chk>
+//
+// Requiring a well-formed request and then a well-formed response carrying the same
+// command, in opposite directions, cannot be satisfied by a unidirectional byte stream
+// whatever it contains -- which is exactly the situation during a firmware upload. It
+// also rules out the bootloader, which only ever emits single bytes and menu text and
+// never a 0x01-framed multi-byte reply. Keying on the exchange rather than on one
+// particular command means it does not matter which command the client opens with.
+//
+// Getting it wrong in the other direction is cheap: a frame we decline to acknowledge is
+// retransmitted by the controller once its ack timeout expires, so we see a clean copy
+// and lose only that delay. That asymmetry is why this errs towards silence everywhere,
+// including on a bad checksum -- where the zwave_proxy component answers with a NAK, this
+// says nothing and lets the timeout do the work.
+
+enum class ZWaveDetectState : uint8_t {
+  IDLE,         // Not the Serial API, or not yet proven to be
+  SAW_REQUEST,  // Exchange half-complete; watching for the matching response
+  ARMED,        // Session confirmed; acknowledging on the client's behalf
+};
+
+enum class ScanResult : uint8_t {
+  NONE,     // Mid-frame, or a byte that carried nothing
+  FRAME,    // type()/command() describe a complete frame with a verified checksum
+  INVALID,  // A frame started but was not well formed
+};
+
+// Reassembles one direction of the byte stream into checksum-verified frames.
+//
+// Because the framing is length-prefixed, the length is known before the payload
+// arrives, so the checksum can be folded in byte by byte and nothing needs to be
+// buffered. Only the two header fields the detector actually reads are kept, which is
+// what makes a scanner per direction cost a handful of bytes rather than 257 each.
+class ZWaveFrameScanner {
+ public:
+  ScanResult feed(uint8_t byte);
+  void reset() { this->state_ = ScanState::WAIT_SOF; }
+
+  /// True while a frame is part-received, so the caller can time it out.
+  bool in_frame() const { return this->state_ != ScanState::WAIT_SOF; }
+
+  // Valid only for the frame the last feed() reported.
+  uint8_t type() const { return this->type_; }
+  uint8_t command() const { return this->command_; }
+
+ private:
+  enum class ScanState : uint8_t {
+    WAIT_SOF,
+    WAIT_LENGTH,
+    WAIT_TYPE,
+    WAIT_COMMAND,
+    WAIT_BODY,  // Payload bytes, then the checksum that ends the frame
+  };
+
+  ScanState state_{ScanState::WAIT_SOF};
+  uint8_t remaining_{0};  // Bytes of the current frame still to come, checksum included
+  uint8_t checksum_{ZWAVE_CHECKSUM_INIT};
+  uint8_t type_{0};
+  uint8_t command_{0};
+};
+
+class ZWaveDetector {
+ public:
+  void reset();
+
+  /// Time-stamp a batch of observed bytes, before feeding them, so a frame left
+  /// part-received by an earlier batch is abandoned rather than swallowing this one.
+  void begin_batch(uint32_t now);
+
+  // Feed observed traffic. Neither call gates forwarding: the detector only watches.
+  void from_device(uint8_t byte);
+  void from_host(uint8_t byte);
+
+  bool armed() const { return this->state_ == ZWaveDetectState::ARMED; }
+
+  /// True only while the host direction can still affect the state machine. Lets the
+  /// caller skip scanning that direction once armed -- it is the busier of the two.
+  bool needs_host_scan() const { return this->state_ != ZWaveDetectState::ARMED; }
+
+  /// An acknowledgement became owed during the last from_device() call. Clears the flag.
+  bool take_pending_ack();
+
+ protected:
+  void handle_device_frame_();
+  void reject_();
+
+  ZWaveFrameScanner device_scanner_;
+  ZWaveFrameScanner host_scanner_;
+  uint32_t device_frame_start_{0};
+  uint32_t host_frame_start_{0};
+  ZWaveDetectState state_{ZWaveDetectState::IDLE};
+  uint8_t pending_command_{0};  // Command of the request awaiting its response
+  uint8_t unconfirmed_rejects_{0};
+  bool ack_owed_{false};
+};
+
+}  // namespace esphome::zwave_proxy_tap
+
+#endif  // USE_ZWAVE_PROXY_TAP

esphome/components/zwave_proxy_tap/zwave_protocol.h

@@ -0,0 +1,33 @@
+#pragma once
+
+#include <cstdint>
+
+namespace esphome::zwave_proxy_tap {
+
+// Z-Wave Serial API framing (INS12350). Unlike ASH, a data frame is length-prefixed
+// rather than delimited:
+//
+//   SOF  LEN  TYPE  CMD  payload...  CHK
+//
+// LEN counts every byte after itself, the checksum included, so a frame occupies LEN + 2
+// bytes on the wire. CHK is the XOR of LEN through the last payload byte, seeded with
+// 0xFF. ACK, NAK and CAN stand alone as single bytes and carry no framing of their own.
+
+static constexpr uint8_t ZWAVE_SOF_BYTE = 0x01;  // Start of a data frame
+static constexpr uint8_t ZWAVE_ACK_BYTE = 0x06;  // The only byte this component ever sends
+
+// TYPE field: which half of a request/response exchange the frame is
+static constexpr uint8_t ZWAVE_FRAME_TYPE_REQUEST = 0x00;
+static constexpr uint8_t ZWAVE_FRAME_TYPE_RESPONSE = 0x01;
+
+// Smallest LEN the protocol can produce: TYPE, CMD and CHK, with no payload
+static constexpr uint8_t ZWAVE_MIN_LENGTH = 3;
+
+static constexpr uint8_t ZWAVE_CHECKSUM_INIT = 0xFF;
+
+// The specification requires a receiver to abandon a data frame that has not completed
+// this long after its SOF byte. Nothing in the framing marks where a frame ends, so
+// without this a truncated frame would swallow the start of the next one.
+static constexpr uint32_t ZWAVE_FRAME_TIMEOUT_MS = 1500;
+
+}  // namespace esphome::zwave_proxy_tap

esphome/components/zwave_proxy_tap/zwave_proxy_tap.cpp

@@ -0,0 +1,62 @@
+#include "zwave_proxy_tap.h"
+
+#ifdef USE_ZWAVE_PROXY_TAP
+
+#include "esphome/core/application.h"
+#include "esphome/core/log.h"
+
+namespace esphome::zwave_proxy_tap {
+
+static const char *const TAG = "zwave_proxy_tap";
+
+void ZWaveProxyTap::setup() { this->parent_->set_tap(this); }
+
+void ZWaveProxyTap::dump_config() { ESP_LOGCONFIG(TAG, "Z-Wave Proxy Tap:\n  Port: %s", this->parent_->get_name()); }
+
+void ZWaveProxyTap::on_device_rx(const uint8_t *data, size_t len) {
+  this->detector_.begin_batch(App.get_loop_component_start_time());
+  for (size_t i = 0; i < len; i++) {
+    // Observation only: the detector never gates forwarding, so it adds no latency and a
+    // frame it cannot parse still reaches the client, which judges it for itself.
+    this->detector_.from_device(data[i]);
+
+    if (this->detector_.take_pending_ack()) {
+      // The client suppresses its own ACKs, so this is the only acknowledgement the
+      // controller will see. Only ever sent for a frame that passed its checksum.
+      this->parent_->write_from_tap(&ZWAVE_ACK_BYTE, 1);
+      ESP_LOGV(TAG, "Sent ACK");
+    }
+  }
+
+  const bool armed = this->detector_.armed();
+  if (armed != this->was_armed_) {
+    this->was_armed_ = armed;
+    ESP_LOGD(TAG, "Serial API session %s",
+             armed ? LOG_STR_LITERAL("detected, acknowledging frames")
+                   : LOG_STR_LITERAL("lost, no longer acknowledging frames"));
+  }
+}
+
+void ZWaveProxyTap::on_client_tx(const uint8_t *data, size_t len) {
+  // Scanning this direction only matters until an exchange completes. Once armed it is
+  // skipped entirely -- which is what makes a firmware upload, all of which flows this
+  // way, essentially free.
+  if (!this->detector_.needs_host_scan()) {
+    return;
+  }
+  this->detector_.begin_batch(App.get_loop_component_start_time());
+  for (size_t i = 0; i < len; i++) {
+    this->detector_.from_host(data[i]);
+  }
+}
+
+void ZWaveProxyTap::on_protocol_disabled() {
+  // A client turning protocol handling off is usually about to reflash the controller, so
+  // the exchange we saw says nothing about what will be on the wire next. Forget it: a
+  // real session proves itself again with another exchange.
+  this->detector_.reset();
+}
+
+}  // namespace esphome::zwave_proxy_tap
+
+#endif  // USE_ZWAVE_PROXY_TAP

esphome/components/zwave_proxy_tap/zwave_proxy_tap.h

@@ -0,0 +1,53 @@
+#pragma once
+
+#include "esphome/core/defines.h"
+#ifdef USE_ZWAVE_PROXY_TAP
+
+#include "esphome/components/serial_proxy/serial_proxy.h"
+#include "esphome/core/component.h"
+#include "zwave_detector.h"
+
+namespace esphome::zwave_proxy_tap {
+
+// Acknowledges the frames of a Z-Wave controller on behalf of a remote client, so the
+// controller's ack timeout is measured against this device rather than against the
+// network round trip to the client. The client suppresses its own acknowledgements,
+// making these the only ones the controller sees.
+//
+// This is the serial_proxy counterpart of the zwave_proxy component. Where that one owns
+// the UART, parses the Serial API in full and carries frames over its own API messages,
+// this one only observes: the serial proxy owns the port and the bytes, and carries them
+// like those of any other serial device. The sole exception is the acknowledgement
+// itself, and it is sent only once a completed request/response exchange has proven the
+// port really is carrying the Serial API.
+class ZWaveProxyTap : public serial_proxy::SerialProxyTap, public Component {
+ public:
+  explicit ZWaveProxyTap(serial_proxy::SerialProxy *parent) : parent_(parent) {}
+
+  void setup() override;
+  void dump_config() override;
+
+  // SerialProxyTap
+  void on_device_rx(const uint8_t *data, size_t len) override;
+  void on_client_tx(const uint8_t *data, size_t len) override;
+  // Acknowledging is only ever useful on a client's behalf, so with nobody subscribed
+  // there is nothing to do and the port need not be read.
+  bool tap_needs_port() const override { return false; }
+  void on_protocol_disabled() override;
+
+ protected:
+  // The port this component observes. Owns the UART and the bytes; every write we make
+  // goes through it.
+  serial_proxy::SerialProxy *parent_;
+
+  // Decides when acknowledging on the client's behalf is safe. Armed only by a completed
+  // request/response exchange, so a bootloader or a firmware upload never triggers it.
+  ZWaveDetector detector_;
+
+  // Previous armed state, for logging the transitions
+  bool was_armed_{false};
+};
+
+}  // namespace esphome::zwave_proxy_tap
+
+#endif  // USE_ZWAVE_PROXY_TAP

esphome/core/defines.h

@@ -199,7 +199,9 @@
 #define USE_VALVE
 #define USE_WATER_HEATER
 #define USE_WATER_HEATER_VISUAL_OVERRIDES
+#define USE_ZIGBEE_PROXY_TAP
 #define USE_ZWAVE_PROXY
+#define USE_ZWAVE_PROXY_TAP
 
 // Feature flags which do not work for zephyr
 #ifndef USE_ZEPHYR
@@ -398,6 +400,10 @@
 #define USB_HOST_MAX_REQUESTS 16
 #define USB_HOST_MAX_PACKET_SIZE 64
 #define USB_UART_OUTPUT_CHUNK_COUNT 5
+// USB identity on serial proxy ports needs the usb_host stack
+#ifdef USE_ESP32
+#define USE_SERIAL_PROXY_USB_INFO
+#endif
 
 #ifdef USE_ARDUINO
 #define USE_ARDUINO_VERSION_CODE VERSION_CODE(3, 3, 7)

tests/components/serial_proxy/test-usb.esp32-s3-idf.yaml

@@ -0,0 +1,21 @@
+wifi:
+  ssid: MySSID
+  password: password1
+
+api:
+
+usb_host:
+
+# port_type is omitted deliberately: a port on a USB UART channel derives USB_SERIAL
+usb_uart:
+  - type: CDC_ACM
+    vid: 0x303A
+    pid: 0x831A
+    channels:
+      - id: usb_serial_channel
+        baud_rate: 460800
+
+serial_proxy:
+  - id: serial_proxy_usb
+    uart_id: usb_serial_channel
+    name: USB Serial Port

tests/components/usb_host/test.esp32-s3-idf.yaml

@@ -4,3 +4,8 @@ usb_host:
     - id: device_1
       vid: 0x1234
       pid: 0x1234
+    - id: device_2
+      vid: 0x1234
+      pid: 0x5678
+      manufacturer: Example Corp
+      product: Example Widget

tests/components/usb_uart/common.yaml

@@ -35,8 +35,10 @@ usb_uart:
         debug: true
         dummy_receiver: true
         debug_prefix: "[ESP_JTAG] "
+  # A CP2105, so it does not share 10C4:EA60 with uart_1 above
   - id: uart_5
     type: cp210x
+    pid: 0xEA70
     channels:
       - id: channel_5_1
         baud_rate: 9600
@@ -65,3 +67,20 @@ usb_uart:
         stop_bits: 2
         data_bits: 7
         parity: even
+  # A ZBT-2 and a ZWA-2 both enumerate as 303A:4001, so only iProduct separates them
+  - id: uart_9
+    type: cdc_acm
+    vid: 0x303A
+    pid: 0x4001
+    manufacturer: Nabu Casa
+    product: ZBT-2
+    channels:
+      - id: channel_9_1
+  - id: uart_10
+    type: cdc_acm
+    vid: 0x303A
+    pid: 0x4001
+    manufacturer: Nabu Casa
+    product: ZWA-2
+    channels:
+      - id: channel_10_1

tests/components/zigbee_proxy_tap/.gitignore

@@ -0,0 +1,5 @@
+# Gitignore settings for ESPHome
+# This is an example and may include too much for your use-case.
+# You can modify this file to suit your needs.
+/.esphome/
+/secrets.yaml

tests/components/zigbee_proxy_tap/common.yaml

@@ -0,0 +1,22 @@
+esphome:
+  name: test
+
+wifi:
+  ssid: test
+  password: password
+  power_save_mode: none
+
+api:
+
+uart:
+  - id: zigbee_uart
+    tx_pin: ${tx_pin}
+    rx_pin: ${rx_pin}
+    baud_rate: 115200
+
+# The port owns the UART and carries every byte; zigbee_proxy_tap only taps it
+serial_proxy:
+  - id: zigbee_serial
+    uart_id: zigbee_uart
+    name: Zigbee
+    port_type: TTL

tests/components/zigbee_proxy_tap/test-usb.esp32-s3-idf.yaml

@@ -0,0 +1,26 @@
+wifi:
+  ssid: test
+  password: password
+  power_save_mode: none
+
+api:
+
+usb_host:
+
+usb_uart:
+  - type: CDC_ACM
+    vid: 0x303A
+    pid: 0x831A
+    channels:
+      - id: zigbee_usb_channel
+        baud_rate: 460800
+
+# The tapped port may be a USB CDC ACM channel just as well as a hardware UART:
+# zigbee_proxy_tap never touches the UART itself, so it does not care which it is.
+serial_proxy:
+  - id: zigbee_usb_serial
+    uart_id: zigbee_usb_channel
+    name: Zigbee
+
+zigbee_proxy_tap:
+  serial_proxy_id: zigbee_usb_serial

tests/components/zigbee_proxy_tap/test.esp32-idf.yaml

@@ -0,0 +1,11 @@
+substitutions:
+  tx_pin: GPIO17
+  rx_pin: GPIO16
+
+esp32:
+  board: esp32dev
+
+<<: !include common.yaml
+
+zigbee_proxy_tap:
+  serial_proxy_id: zigbee_serial

tests/components/zigbee_proxy_tap/test.esp8266-ard.yaml

@@ -0,0 +1,11 @@
+substitutions:
+  tx_pin: GPIO1
+  rx_pin: GPIO3
+
+esp8266:
+  board: nodemcuv2
+
+<<: !include common.yaml
+
+zigbee_proxy_tap:
+  serial_proxy_id: zigbee_serial

tests/components/zigbee_proxy_tap/test.rp2040-ard.yaml

@@ -0,0 +1,8 @@
+substitutions:
+  tx_pin: GPIO0
+  rx_pin: GPIO1
+
+<<: !include common.yaml
+
+zigbee_proxy_tap:
+  serial_proxy_id: zigbee_serial

tests/components/zwave_proxy_tap/.gitignore

@@ -0,0 +1,5 @@
+# Gitignore settings for ESPHome
+# This is an example and may include too much for your use-case.
+# You can modify this file to suit your needs.
+/.esphome/
+/secrets.yaml

tests/components/zwave_proxy_tap/common.yaml

@@ -0,0 +1,16 @@
+wifi:
+  ssid: MySSID
+  password: password1
+  power_save_mode: none
+
+api:
+
+# The port owns the UART and carries every byte; zwave_proxy_tap only taps it
+serial_proxy:
+  - id: zwave_serial
+    uart_id: uart_bus
+    name: Z-Wave
+    port_type: TTL
+
+zwave_proxy_tap:
+  serial_proxy_id: zwave_serial

tests/components/zwave_proxy_tap/test-usb.esp32-s3-idf.yaml

@@ -0,0 +1,27 @@
+wifi:
+  ssid: MySSID
+  password: password1
+  power_save_mode: none
+
+api:
+
+usb_host:
+
+# port_type is omitted deliberately: a port on a USB UART channel derives USB_SERIAL
+usb_uart:
+  - type: CDC_ACM
+    vid: 0x0658
+    pid: 0x0200
+    channels:
+      - id: zwave_usb_channel
+        baud_rate: 115200
+
+# The tapped port may be a USB CDC ACM channel just as well as a hardware UART:
+# zwave_proxy_tap never touches the UART itself, so it does not care which it is.
+serial_proxy:
+  - id: zwave_usb_serial
+    uart_id: zwave_usb_channel
+    name: Z-Wave
+
+zwave_proxy_tap:
+  serial_proxy_id: zwave_usb_serial

tests/components/zwave_proxy_tap/test.esp32-idf.yaml

@@ -0,0 +1,3 @@
+packages:
+  uart: !include ../../test_build_components/common/uart/esp32-idf.yaml
+  zwave_proxy_tap: !include common.yaml

tests/components/zwave_proxy_tap/test.esp8266-ard.yaml

@@ -0,0 +1,3 @@
+packages:
+  uart: !include ../../test_build_components/common/uart/esp8266-ard.yaml
+  zwave_proxy_tap: !include common.yaml

tests/components/zwave_proxy_tap/test.rp2040-ard.yaml

@@ -0,0 +1,3 @@
+packages:
+  uart: !include ../../test_build_components/common/uart/rp2040-ard.yaml
+  zwave_proxy_tap: !include common.yaml

tests/unit_tests/components/test_usb_host.py

@@ -0,0 +1,199 @@
+"""Tests for usb_host device matching validation."""
+
+import pytest
+
+from esphome.components.usb_host import validate_usb_clients
+import esphome.config_validation as cv
+from esphome.types import ConfigType
+
+
+@pytest.mark.parametrize(
+    ("first", "second"),
+    [
+        pytest.param(
+            {
+                "id": "a",
+                "vid": 0x303A,
+                "pid": 0x4001,
+            },
+            {
+                "id": "b",
+                "vid": 0x303A,
+                "pid": 0x4002,
+            },
+            id="different_pid",
+        ),
+        pytest.param(
+            {
+                "id": "a",
+                "vid": 0x303A,
+                "pid": 0x4001,
+            },
+            {
+                "id": "b",
+                "vid": 0x1A86,
+                "pid": 0x4001,
+            },
+            id="different_vid",
+        ),
+        pytest.param(
+            {
+                "id": "a",
+                "vid": 0x303A,
+                "pid": 0x4001,
+                "manufacturer": "Nabu Casa",
+                "product": "ZBT-2",
+            },
+            {
+                "id": "b",
+                "vid": 0x303A,
+                "pid": 0x4001,
+                "manufacturer": "Nabu Casa",
+                "product": "ZWA-2",
+            },
+            id="different_product",
+        ),
+        pytest.param(
+            {
+                "id": "a",
+                "vid": 0x303A,
+                "pid": 0x4001,
+                "manufacturer": "Nabu Casa",
+                "product": "ZBT-2",
+            },
+            {
+                "id": "b",
+                "vid": 0x303A,
+                "pid": 0x4001,
+                "manufacturer": "Espressif",
+                "product": "ZBT-2",
+            },
+            id="different_manufacturer",
+        ),
+    ],
+)
+def test_disjoint_clients_are_accepted(first: ConfigType, second: ConfigType) -> None:
+    configs = [first, second]
+    assert validate_usb_clients(configs) is configs
+
+
+@pytest.mark.parametrize(
+    ("first", "second"),
+    [
+        pytest.param(
+            {
+                "id": "a",
+                "vid": 0x303A,
+                "pid": 0x4001,
+            },
+            {
+                "id": "b",
+                "vid": 0x303A,
+                "pid": 0x4001,
+            },
+            id="exact_duplicate",
+        ),
+        pytest.param(
+            {
+                "id": "a",
+                "vid": 0x303A,
+                "pid": 0x4001,
+            },
+            {
+                "id": "b",
+                "vid": 0x303A,
+                "pid": 0x4001,
+                "manufacturer": "Nabu Casa",
+                "product": "ZBT-2",
+            },
+            id="unfiltered_shadows_filtered",
+        ),
+        pytest.param(
+            {
+                "id": "a",
+                "vid": 0x303A,
+                "pid": 0x4001,
+                "manufacturer": "Nabu Casa",
+                "product": "ZBT-2",
+            },
+            {
+                "id": "b",
+                "vid": 0x303A,
+                "pid": 0x4001,
+                "manufacturer": "Nabu Casa",
+                "product": "ZBT-2",
+            },
+            id="identical_filters",
+        ),
+        pytest.param(
+            {
+                "id": "a",
+                "vid": 0,
+                "pid": 0,
+            },
+            {
+                "id": "b",
+                "vid": 0x303A,
+                "pid": 0x4001,
+                "manufacturer": "Nabu Casa",
+                "product": "ZBT-2",
+            },
+            id="zero_ids_match_every_device",
+        ),
+    ],
+)
+def test_overlapping_clients_are_rejected(
+    first: ConfigType, second: ConfigType
+) -> None:
+    with pytest.raises(cv.Invalid, match="overlap"):
+        validate_usb_clients([first, second])
+
+
+def test_every_pair_is_compared_not_just_neighbours() -> None:
+    configs = [
+        {
+            "id": "a",
+            "vid": 0x303A,
+            "pid": 0x4001,
+            "manufacturer": "Nabu Casa",
+            "product": "ZBT-2",
+        },
+        {
+            "id": "b",
+            "vid": 0x303A,
+            "pid": 0x4002,
+        },
+        {
+            "id": "c",
+            "vid": 0x303A,
+            "pid": 0x4001,
+            "manufacturer": "Nabu Casa",
+            "product": "ZBT-2",
+        },
+    ]
+    with pytest.raises(cv.Invalid, match="'a', 'c'"):
+        validate_usb_clients(configs)
+
+
+def test_incomplete_filter_is_rejected() -> None:
+    configs = [
+        {
+            "id": "a",
+            "vid": 0x303A,
+            "pid": 0x4001,
+            "product": "ZBT-2",
+        }
+    ]
+    with pytest.raises(cv.Invalid, match="none or all"):
+        validate_usb_clients(configs)
+
+
+def test_single_client_is_always_valid() -> None:
+    configs = [
+        {
+            "id": "a",
+            "vid": 0x303A,
+            "pid": 0x4001,
+        }
+    ]
+    assert validate_usb_clients(configs) is configs