CODEOWNERS

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

.github/actions/build-image/action.yaml

@@ -47,7 +47,7 @@ runs:
 
     - name: Build and push to ghcr by digest
       id: build-ghcr
-      uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
+      uses: docker/build-push-action@601a80b39c9405e50806ae38af30926f9d957c47 # v6.19.1
       env:
         DOCKER_BUILD_SUMMARY: false
         DOCKER_BUILD_RECORD_UPLOAD: false
@@ -73,7 +73,7 @@ runs:
 
     - name: Build and push to dockerhub by digest
       id: build-dockerhub
-      uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
+      uses: docker/build-push-action@601a80b39c9405e50806ae38af30926f9d957c47 # v6.19.1
       env:
         DOCKER_BUILD_SUMMARY: false
         DOCKER_BUILD_RECORD_UPLOAD: false

CODEOWNERS

@@ -429,6 +429,7 @@ esphome/components/sen21231/* @shreyaskarnik
 esphome/components/sen5x/* @martgras
 esphome/components/sensirion_common/* @martgras
 esphome/components/sensor/* @esphome/core
+esphome/components/serial_proxy/* @kbx81
 esphome/components/sfa30/* @ghsensdev
 esphome/components/sgp40/* @SenexCrenshaw
 esphome/components/sgp4x/* @martgras @SenexCrenshaw

esphome/components/api/api.proto

@@ -69,6 +69,12 @@ service APIConnection {
   rpc zwave_proxy_request(ZWaveProxyRequest) returns (void) {}
 
   rpc infrared_rf_transmit_raw_timings(InfraredRFTransmitRawTimingsRequest) returns (void) {}
+
+  rpc serial_proxy_configure(SerialProxyConfigureRequest) returns (void) {}
+  rpc serial_proxy_write(SerialProxyWriteRequest) returns (void) {}
+  rpc serial_proxy_set_modem_pins(SerialProxySetModemPinsRequest) returns (void) {}
+  rpc serial_proxy_get_modem_pins(SerialProxyGetModemPinsRequest) returns (void) {}
+  rpc serial_proxy_flush(SerialProxyFlushRequest) returns (void) {}
 }
 
 
@@ -260,6 +266,9 @@ message DeviceInfoResponse {
   // Indicates if Z-Wave proxy support is available and features supported
   uint32 zwave_proxy_feature_flags = 23 [(field_ifdef) = "USE_ZWAVE_PROXY"];
   uint32 zwave_home_id = 24 [(field_ifdef) = "USE_ZWAVE_PROXY"];
+
+  // Number of serial proxy instances available on the device
+  uint32 serial_proxy_count = 25 [(field_ifdef) = "USE_SERIAL_PROXY"];
 }
 
 message ListEntitiesRequest {
@@ -2488,3 +2497,87 @@ message InfraredRFReceiveEvent {
   fixed32 key = 2;                                    // Key identifying the receiver instance
   repeated sint32 timings = 3 [packed = true, (container_pointer_no_template) = "std::vector<int32_t>"];  // Raw timings in microseconds (zigzag-encoded): alternating mark/space periods
 }
+
+// ==================== SERIAL PROXY ====================
+
+enum SerialProxyParity {
+  SERIAL_PROXY_PARITY_NONE = 0;
+  SERIAL_PROXY_PARITY_EVEN = 1;
+  SERIAL_PROXY_PARITY_ODD = 2;
+}
+
+// Configure UART parameters for a serial proxy instance
+message SerialProxyConfigureRequest {
+  option (id) = 138;
+  option (source) = SOURCE_CLIENT;
+  option (ifdef) = "USE_SERIAL_PROXY";
+
+  uint32 instance = 1;          // Instance index (0-based)
+  uint32 baudrate = 2;          // Baud rate in bits per second
+  bool flow_control = 3;        // Enable hardware flow control
+  SerialProxyParity parity = 4; // Parity setting
+  uint32 stop_bits = 5;         // Number of stop bits (1 or 2)
+  uint32 data_size = 6;         // Number of data bits (5-8)
+}
+
+// Data received from a serial device, forwarded to clients
+message SerialProxyDataReceived {
+  option (id) = 139;
+  option (source) = SOURCE_SERVER;
+  option (ifdef) = "USE_SERIAL_PROXY";
+  option (no_delay) = true;
+
+  uint32 instance = 1;          // Instance index (0-based)
+  bytes data = 2;               // Raw data received from the serial device
+}
+
+// Write data to a serial device
+message SerialProxyWriteRequest {
+  option (id) = 140;
+  option (source) = SOURCE_CLIENT;
+  option (ifdef) = "USE_SERIAL_PROXY";
+  option (no_delay) = true;
+
+  uint32 instance = 1;          // Instance index (0-based)
+  bytes data = 2;               // Raw data to write to the serial device
+}
+
+// Set modem control pin states (RTS and DTR)
+message SerialProxySetModemPinsRequest {
+  option (id) = 141;
+  option (source) = SOURCE_CLIENT;
+  option (ifdef) = "USE_SERIAL_PROXY";
+
+  uint32 instance = 1;          // Instance index (0-based)
+  bool rts = 2;                 // Desired RTS pin state
+  bool dtr = 3;                 // Desired DTR pin state
+}
+
+// Request current modem control pin states
+message SerialProxyGetModemPinsRequest {
+  option (id) = 142;
+  option (source) = SOURCE_CLIENT;
+  option (ifdef) = "USE_SERIAL_PROXY";
+
+  uint32 instance = 1;          // Instance index (0-based)
+}
+
+// Response with current modem control pin states
+message SerialProxyGetModemPinsResponse {
+  option (id) = 143;
+  option (source) = SOURCE_SERVER;
+  option (ifdef) = "USE_SERIAL_PROXY";
+
+  uint32 instance = 1;          // Instance index (0-based)
+  bool rts = 2;                 // Current RTS pin state
+  bool dtr = 3;                 // Current DTR pin state
+}
+
+// Flush the serial port (block until all TX data is sent)
+message SerialProxyFlushRequest {
+  option (id) = 144;
+  option (source) = SOURCE_CLIENT;
+  option (ifdef) = "USE_SERIAL_PROXY";
+
+  uint32 instance = 1;          // Instance index (0-based)
+}

esphome/components/api/api_connection.cpp

@@ -1413,6 +1413,66 @@ void APIConnection::send_infrared_rf_receive_event(const InfraredRFReceiveEvent
 }
 #endif
 
+#ifdef USE_SERIAL_PROXY
+void APIConnection::on_serial_proxy_configure_request(const SerialProxyConfigureRequest &msg) {
+  auto &proxies = App.get_serial_proxies();
+  if (msg.instance >= proxies.size()) {
+    ESP_LOGW(TAG, "Serial proxy instance %u out of range (max %u)", msg.instance,
+             static_cast<uint32_t>(proxies.size()));
+    return;
+  }
+  proxies[msg.instance]->configure(msg.baudrate, msg.flow_control, static_cast<uint8_t>(msg.parity), msg.stop_bits,
+                                   msg.data_size);
+}
+
+void APIConnection::on_serial_proxy_write_request(const SerialProxyWriteRequest &msg) {
+  auto &proxies = App.get_serial_proxies();
+  if (msg.instance >= proxies.size()) {
+    ESP_LOGW(TAG, "Serial proxy instance %u out of range", msg.instance);
+    return;
+  }
+  proxies[msg.instance]->write(msg.data, msg.data_len);
+}
+
+void APIConnection::on_serial_proxy_set_modem_pins_request(const SerialProxySetModemPinsRequest &msg) {
+  auto &proxies = App.get_serial_proxies();
+  if (msg.instance >= proxies.size()) {
+    ESP_LOGW(TAG, "Serial proxy instance %u out of range", msg.instance);
+    return;
+  }
+  proxies[msg.instance]->set_modem_pins(msg.rts, msg.dtr);
+}
+
+void APIConnection::on_serial_proxy_get_modem_pins_request(const SerialProxyGetModemPinsRequest &msg) {
+  auto &proxies = App.get_serial_proxies();
+  if (msg.instance >= proxies.size()) {
+    ESP_LOGW(TAG, "Serial proxy instance %u out of range", msg.instance);
+    return;
+  }
+  bool rts, dtr;
+  proxies[msg.instance]->get_modem_pins(rts, dtr);
+
+  SerialProxyGetModemPinsResponse resp{};
+  resp.instance = msg.instance;
+  resp.rts = rts;
+  resp.dtr = dtr;
+  this->send_message(resp, SerialProxyGetModemPinsResponse::MESSAGE_TYPE);
+}
+
+void APIConnection::on_serial_proxy_flush_request(const SerialProxyFlushRequest &msg) {
+  auto &proxies = App.get_serial_proxies();
+  if (msg.instance >= proxies.size()) {
+    ESP_LOGW(TAG, "Serial proxy instance %u out of range", msg.instance);
+    return;
+  }
+  proxies[msg.instance]->flush_port();
+}
+
+void APIConnection::send_serial_proxy_data(const SerialProxyDataReceived &msg) {
+  this->send_message(msg, SerialProxyDataReceived::MESSAGE_TYPE);
+}
+#endif
+
 #ifdef USE_INFRARED
 uint16_t APIConnection::try_send_infrared_info(EntityBase *entity, APIConnection *conn, uint32_t remaining_size) {
   auto *infrared = static_cast<infrared::Infrared *>(entity);
@@ -1627,6 +1687,9 @@ bool APIConnection::send_device_info_response_() {
   resp.zwave_proxy_feature_flags = zwave_proxy::global_zwave_proxy->get_feature_flags();
   resp.zwave_home_id = zwave_proxy::global_zwave_proxy->get_home_id();
 #endif
+#ifdef USE_SERIAL_PROXY
+  resp.serial_proxy_count = App.get_serial_proxies().size();
+#endif
 #ifdef USE_API_NOISE
   resp.api_encryption_supported = true;
 #endif

esphome/components/api/api_connection.h

@@ -182,6 +182,15 @@ class APIConnection final : public APIServerConnectionBase {
   void send_infrared_rf_receive_event(const InfraredRFReceiveEvent &msg);
 #endif
 
+#ifdef USE_SERIAL_PROXY
+  void on_serial_proxy_configure_request(const SerialProxyConfigureRequest &msg) override;
+  void on_serial_proxy_write_request(const SerialProxyWriteRequest &msg) override;
+  void on_serial_proxy_set_modem_pins_request(const SerialProxySetModemPinsRequest &msg) override;
+  void on_serial_proxy_get_modem_pins_request(const SerialProxyGetModemPinsRequest &msg) override;
+  void on_serial_proxy_flush_request(const SerialProxyFlushRequest &msg) override;
+  void send_serial_proxy_data(const SerialProxyDataReceived &msg);
+#endif
+
 #ifdef USE_EVENT
   void send_event(event::Event *event);
 #endif

esphome/components/api/api_frame_helper_plaintext.cpp

@@ -295,9 +295,8 @@ APIError APIPlaintextFrameHelper::write_protobuf_messages(ProtoWriteBuffer buffe
     buf_start[header_offset] = 0x00;  // indicator
 
     // Encode varints directly into buffer
-    ProtoVarInt(msg.payload_size).encode_to_buffer_unchecked(buf_start + header_offset + 1, size_varint_len);
-    ProtoVarInt(msg.message_type)
-        .encode_to_buffer_unchecked(buf_start + header_offset + 1 + size_varint_len, type_varint_len);
+    encode_varint_to_buffer(msg.payload_size, buf_start + header_offset + 1);
+    encode_varint_to_buffer(msg.message_type, buf_start + header_offset + 1 + size_varint_len);
 
     // Add iovec for this message (header + payload)
     size_t msg_len = static_cast<size_t>(total_header_len + msg.payload_size);

esphome/components/api/api_pb2.cpp

@@ -119,6 +119,9 @@ void DeviceInfoResponse::encode(ProtoWriteBuffer buffer) const {
 #ifdef USE_ZWAVE_PROXY
   buffer.encode_uint32(24, this->zwave_home_id);
 #endif
+#ifdef USE_SERIAL_PROXY
+  buffer.encode_uint32(25, this->serial_proxy_count);
+#endif
 }
 void DeviceInfoResponse::calculate_size(ProtoSize &size) const {
   size.add_length(1, this->name.size());
@@ -174,6 +177,9 @@ void DeviceInfoResponse::calculate_size(ProtoSize &size) const {
 #ifdef USE_ZWAVE_PROXY
   size.add_uint32(2, this->zwave_home_id);
 #endif
+#ifdef USE_SERIAL_PROXY
+  size.add_uint32(2, this->serial_proxy_count);
+#endif
 }
 #ifdef USE_BINARY_SENSOR
 void ListEntitiesBinarySensorResponse::encode(ProtoWriteBuffer buffer) const {
@@ -3440,5 +3446,108 @@ void InfraredRFReceiveEvent::calculate_size(ProtoSize &size) const {
   }
 }
 #endif
+#ifdef USE_SERIAL_PROXY
+bool SerialProxyConfigureRequest::decode_varint(uint32_t field_id, ProtoVarInt value) {
+  switch (field_id) {
+    case 1:
+      this->instance = value.as_uint32();
+      break;
+    case 2:
+      this->baudrate = value.as_uint32();
+      break;
+    case 3:
+      this->flow_control = value.as_bool();
+      break;
+    case 4:
+      this->parity = static_cast<enums::SerialProxyParity>(value.as_uint32());
+      break;
+    case 5:
+      this->stop_bits = value.as_uint32();
+      break;
+    case 6:
+      this->data_size = value.as_uint32();
+      break;
+    default:
+      return false;
+  }
+  return true;
+}
+void SerialProxyDataReceived::encode(ProtoWriteBuffer buffer) const {
+  buffer.encode_uint32(1, this->instance);
+  buffer.encode_bytes(2, this->data_ptr_, this->data_len_);
+}
+void SerialProxyDataReceived::calculate_size(ProtoSize &size) const {
+  size.add_uint32(1, this->instance);
+  size.add_length(1, this->data_len_);
+}
+bool SerialProxyWriteRequest::decode_varint(uint32_t field_id, ProtoVarInt value) {
+  switch (field_id) {
+    case 1:
+      this->instance = value.as_uint32();
+      break;
+    default:
+      return false;
+  }
+  return true;
+}
+bool SerialProxyWriteRequest::decode_length(uint32_t field_id, ProtoLengthDelimited value) {
+  switch (field_id) {
+    case 2: {
+      this->data = value.data();
+      this->data_len = value.size();
+      break;
+    }
+    default:
+      return false;
+  }
+  return true;
+}
+bool SerialProxySetModemPinsRequest::decode_varint(uint32_t field_id, ProtoVarInt value) {
+  switch (field_id) {
+    case 1:
+      this->instance = value.as_uint32();
+      break;
+    case 2:
+      this->rts = value.as_bool();
+      break;
+    case 3:
+      this->dtr = value.as_bool();
+      break;
+    default:
+      return false;
+  }
+  return true;
+}
+bool SerialProxyGetModemPinsRequest::decode_varint(uint32_t field_id, ProtoVarInt value) {
+  switch (field_id) {
+    case 1:
+      this->instance = value.as_uint32();
+      break;
+    default:
+      return false;
+  }
+  return true;
+}
+void SerialProxyGetModemPinsResponse::encode(ProtoWriteBuffer buffer) const {
+  buffer.encode_uint32(1, this->instance);
+  buffer.encode_bool(2, this->rts);
+  buffer.encode_bool(3, this->dtr);
+}
+void SerialProxyGetModemPinsResponse::calculate_size(ProtoSize &size) const {
+  size.add_uint32(1, this->instance);
+  size.add_bool(1, this->rts);
+  size.add_bool(1, this->dtr);
+}
+bool SerialProxyFlushRequest::decode_varint(uint32_t field_id, ProtoVarInt value) {
+  switch (field_id) {
+    case 1:
+      this->instance = value.as_uint32();
+      break;
+    default:
+      return false;
+  }
+  return true;
+}
+#endif
 
 }  // namespace esphome::api

esphome/components/api/api_pb2.h

@@ -311,6 +311,13 @@ enum ZWaveProxyRequestType : uint32_t {
   ZWAVE_PROXY_REQUEST_TYPE_HOME_ID_CHANGE = 2,
 };
 #endif
+#ifdef USE_SERIAL_PROXY
+enum SerialProxyParity : uint32_t {
+  SERIAL_PROXY_PARITY_NONE = 0,
+  SERIAL_PROXY_PARITY_EVEN = 1,
+  SERIAL_PROXY_PARITY_ODD = 2,
+};
+#endif
 
 }  // namespace enums
 
@@ -474,7 +481,7 @@ class DeviceInfo final : public ProtoMessage {
 class DeviceInfoResponse final : public ProtoMessage {
  public:
   static constexpr uint8_t MESSAGE_TYPE = 10;
-  static constexpr uint8_t ESTIMATED_SIZE = 255;
+  static constexpr uint16_t ESTIMATED_SIZE = 260;
 #ifdef HAS_PROTO_MESSAGE_DUMP
   const char *message_name() const override { return "device_info_response"; }
 #endif
@@ -526,6 +533,9 @@ class DeviceInfoResponse final : public ProtoMessage {
 #endif
 #ifdef USE_ZWAVE_PROXY
   uint32_t zwave_home_id{0};
+#endif
+#ifdef USE_SERIAL_PROXY
+  uint32_t serial_proxy_count{0};
 #endif
   void encode(ProtoWriteBuffer buffer) const override;
   void calculate_size(ProtoSize &size) const override;
@@ -3025,5 +3035,132 @@ class InfraredRFReceiveEvent final : public ProtoMessage {
  protected:
 };
 #endif
+#ifdef USE_SERIAL_PROXY
+class SerialProxyConfigureRequest final : public ProtoDecodableMessage {
+ public:
+  static constexpr uint8_t MESSAGE_TYPE = 138;
+  static constexpr uint8_t ESTIMATED_SIZE = 20;
+#ifdef HAS_PROTO_MESSAGE_DUMP
+  const char *message_name() const override { return "serial_proxy_configure_request"; }
+#endif
+  uint32_t instance{0};
+  uint32_t baudrate{0};
+  bool flow_control{false};
+  enums::SerialProxyParity parity{};
+  uint32_t stop_bits{0};
+  uint32_t data_size{0};
+#ifdef HAS_PROTO_MESSAGE_DUMP
+  const char *dump_to(DumpBuffer &out) const override;
+#endif
+
+ protected:
+  bool decode_varint(uint32_t field_id, ProtoVarInt value) override;
+};
+class SerialProxyDataReceived final : public ProtoMessage {
+ public:
+  static constexpr uint8_t MESSAGE_TYPE = 139;
+  static constexpr uint8_t ESTIMATED_SIZE = 23;
+#ifdef HAS_PROTO_MESSAGE_DUMP
+  const char *message_name() const override { return "serial_proxy_data_received"; }
+#endif
+  uint32_t instance{0};
+  const uint8_t *data_ptr_{nullptr};
+  size_t data_len_{0};
+  void set_data(const uint8_t *data, size_t len) {
+    this->data_ptr_ = data;
+    this->data_len_ = len;
+  }
+  void encode(ProtoWriteBuffer buffer) const override;
+  void calculate_size(ProtoSize &size) const override;
+#ifdef HAS_PROTO_MESSAGE_DUMP
+  const char *dump_to(DumpBuffer &out) const override;
+#endif
+
+ protected:
+};
+class SerialProxyWriteRequest final : public ProtoDecodableMessage {
+ public:
+  static constexpr uint8_t MESSAGE_TYPE = 140;
+  static constexpr uint8_t ESTIMATED_SIZE = 23;
+#ifdef HAS_PROTO_MESSAGE_DUMP
+  const char *message_name() const override { return "serial_proxy_write_request"; }
+#endif
+  uint32_t instance{0};
+  const uint8_t *data{nullptr};
+  uint16_t data_len{0};
+#ifdef HAS_PROTO_MESSAGE_DUMP
+  const char *dump_to(DumpBuffer &out) const override;
+#endif
+
+ protected:
+  bool decode_length(uint32_t field_id, ProtoLengthDelimited value) override;
+  bool decode_varint(uint32_t field_id, ProtoVarInt value) override;
+};
+class SerialProxySetModemPinsRequest final : public ProtoDecodableMessage {
+ public:
+  static constexpr uint8_t MESSAGE_TYPE = 141;
+  static constexpr uint8_t ESTIMATED_SIZE = 8;
+#ifdef HAS_PROTO_MESSAGE_DUMP
+  const char *message_name() const override { return "serial_proxy_set_modem_pins_request"; }
+#endif
+  uint32_t instance{0};
+  bool rts{false};
+  bool dtr{false};
+#ifdef HAS_PROTO_MESSAGE_DUMP
+  const char *dump_to(DumpBuffer &out) const override;
+#endif
+
+ protected:
+  bool decode_varint(uint32_t field_id, ProtoVarInt value) override;
+};
+class SerialProxyGetModemPinsRequest final : public ProtoDecodableMessage {
+ public:
+  static constexpr uint8_t MESSAGE_TYPE = 142;
+  static constexpr uint8_t ESTIMATED_SIZE = 4;
+#ifdef HAS_PROTO_MESSAGE_DUMP
+  const char *message_name() const override { return "serial_proxy_get_modem_pins_request"; }
+#endif
+  uint32_t instance{0};
+#ifdef HAS_PROTO_MESSAGE_DUMP
+  const char *dump_to(DumpBuffer &out) const override;
+#endif
+
+ protected:
+  bool decode_varint(uint32_t field_id, ProtoVarInt value) override;
+};
+class SerialProxyGetModemPinsResponse final : public ProtoMessage {
+ public:
+  static constexpr uint8_t MESSAGE_TYPE = 143;
+  static constexpr uint8_t ESTIMATED_SIZE = 8;
+#ifdef HAS_PROTO_MESSAGE_DUMP
+  const char *message_name() const override { return "serial_proxy_get_modem_pins_response"; }
+#endif
+  uint32_t instance{0};
+  bool rts{false};
+  bool dtr{false};
+  void encode(ProtoWriteBuffer buffer) const override;
+  void calculate_size(ProtoSize &size) const override;
+#ifdef HAS_PROTO_MESSAGE_DUMP
+  const char *dump_to(DumpBuffer &out) const override;
+#endif
+
+ protected:
+};
+class SerialProxyFlushRequest final : public ProtoDecodableMessage {
+ public:
+  static constexpr uint8_t MESSAGE_TYPE = 144;
+  static constexpr uint8_t ESTIMATED_SIZE = 4;
+#ifdef HAS_PROTO_MESSAGE_DUMP
+  const char *message_name() const override { return "serial_proxy_flush_request"; }
+#endif
+  uint32_t instance{0};
+#ifdef HAS_PROTO_MESSAGE_DUMP
+  const char *dump_to(DumpBuffer &out) const override;
+#endif
+
+ protected:
+  bool decode_varint(uint32_t field_id, ProtoVarInt value) override;
+};
+#endif
 
 }  // namespace esphome::api

esphome/components/api/api_pb2_dump.cpp

@@ -736,6 +736,20 @@ template<> const char *proto_enum_to_string<enums::ZWaveProxyRequestType>(enums:
   }
 }
 #endif
+#ifdef USE_SERIAL_PROXY
+template<> const char *proto_enum_to_string<enums::SerialProxyParity>(enums::SerialProxyParity value) {
+  switch (value) {
+    case enums::SERIAL_PROXY_PARITY_NONE:
+      return "SERIAL_PROXY_PARITY_NONE";
+    case enums::SERIAL_PROXY_PARITY_EVEN:
+      return "SERIAL_PROXY_PARITY_EVEN";
+    case enums::SERIAL_PROXY_PARITY_ODD:
+      return "SERIAL_PROXY_PARITY_ODD";
+    default:
+      return "UNKNOWN";
+  }
+}
+#endif
 
 const char *HelloRequest::dump_to(DumpBuffer &out) const {
   MessageDumpHelper helper(out, "HelloRequest");
@@ -845,6 +859,9 @@ const char *DeviceInfoResponse::dump_to(DumpBuffer &out) const {
 #endif
 #ifdef USE_ZWAVE_PROXY
   dump_field(out, "zwave_home_id", this->zwave_home_id);
+#endif
+#ifdef USE_SERIAL_PROXY
+  dump_field(out, "serial_proxy_count", this->serial_proxy_count);
 #endif
   return out.c_str();
 }
@@ -2469,6 +2486,54 @@ const char *InfraredRFReceiveEvent::dump_to(DumpBuffer &out) const {
   return out.c_str();
 }
 #endif
+#ifdef USE_SERIAL_PROXY
+const char *SerialProxyConfigureRequest::dump_to(DumpBuffer &out) const {
+  MessageDumpHelper helper(out, "SerialProxyConfigureRequest");
+  dump_field(out, "instance", this->instance);
+  dump_field(out, "baudrate", this->baudrate);
+  dump_field(out, "flow_control", this->flow_control);
+  dump_field(out, "parity", static_cast<enums::SerialProxyParity>(this->parity));
+  dump_field(out, "stop_bits", this->stop_bits);
+  dump_field(out, "data_size", this->data_size);
+  return out.c_str();
+}
+const char *SerialProxyDataReceived::dump_to(DumpBuffer &out) const {
+  MessageDumpHelper helper(out, "SerialProxyDataReceived");
+  dump_field(out, "instance", this->instance);
+  dump_bytes_field(out, "data", this->data_ptr_, this->data_len_);
+  return out.c_str();
+}
+const char *SerialProxyWriteRequest::dump_to(DumpBuffer &out) const {
+  MessageDumpHelper helper(out, "SerialProxyWriteRequest");
+  dump_field(out, "instance", this->instance);
+  dump_bytes_field(out, "data", this->data, this->data_len);
+  return out.c_str();
+}
+const char *SerialProxySetModemPinsRequest::dump_to(DumpBuffer &out) const {
+  MessageDumpHelper helper(out, "SerialProxySetModemPinsRequest");
+  dump_field(out, "instance", this->instance);
+  dump_field(out, "rts", this->rts);
+  dump_field(out, "dtr", this->dtr);
+  return out.c_str();
+}
+const char *SerialProxyGetModemPinsRequest::dump_to(DumpBuffer &out) const {
+  MessageDumpHelper helper(out, "SerialProxyGetModemPinsRequest");
+  dump_field(out, "instance", this->instance);
+  return out.c_str();
+}
+const char *SerialProxyGetModemPinsResponse::dump_to(DumpBuffer &out) const {
+  MessageDumpHelper helper(out, "SerialProxyGetModemPinsResponse");
+  dump_field(out, "instance", this->instance);
+  dump_field(out, "rts", this->rts);
+  dump_field(out, "dtr", this->dtr);
+  return out.c_str();
+}
+const char *SerialProxyFlushRequest::dump_to(DumpBuffer &out) const {
+  MessageDumpHelper helper(out, "SerialProxyFlushRequest");
+  dump_field(out, "instance", this->instance);
+  return out.c_str();
+}
+#endif
 
 }  // namespace esphome::api
 

esphome/components/api/api_pb2_service.cpp

@@ -634,6 +634,61 @@ void APIServerConnectionBase::read_message(uint32_t msg_size, uint32_t msg_type,
       this->on_infrared_rf_transmit_raw_timings_request(msg);
       break;
     }
+#endif
+#ifdef USE_SERIAL_PROXY
+    case SerialProxyConfigureRequest::MESSAGE_TYPE: {
+      SerialProxyConfigureRequest msg;
+      msg.decode(msg_data, msg_size);
+#ifdef HAS_PROTO_MESSAGE_DUMP
+      this->log_receive_message_(LOG_STR("on_serial_proxy_configure_request"), msg);
+#endif
+      this->on_serial_proxy_configure_request(msg);
+      break;
+    }
+#endif
+#ifdef USE_SERIAL_PROXY
+    case SerialProxyWriteRequest::MESSAGE_TYPE: {
+      SerialProxyWriteRequest msg;
+      msg.decode(msg_data, msg_size);
+#ifdef HAS_PROTO_MESSAGE_DUMP
+      this->log_receive_message_(LOG_STR("on_serial_proxy_write_request"), msg);
+#endif
+      this->on_serial_proxy_write_request(msg);
+      break;
+    }
+#endif
+#ifdef USE_SERIAL_PROXY
+    case SerialProxySetModemPinsRequest::MESSAGE_TYPE: {
+      SerialProxySetModemPinsRequest msg;
+      msg.decode(msg_data, msg_size);
+#ifdef HAS_PROTO_MESSAGE_DUMP
+      this->log_receive_message_(LOG_STR("on_serial_proxy_set_modem_pins_request"), msg);
+#endif
+      this->on_serial_proxy_set_modem_pins_request(msg);
+      break;
+    }
+#endif
+#ifdef USE_SERIAL_PROXY
+    case SerialProxyGetModemPinsRequest::MESSAGE_TYPE: {
+      SerialProxyGetModemPinsRequest msg;
+      msg.decode(msg_data, msg_size);
+#ifdef HAS_PROTO_MESSAGE_DUMP
+      this->log_receive_message_(LOG_STR("on_serial_proxy_get_modem_pins_request"), msg);
+#endif
+      this->on_serial_proxy_get_modem_pins_request(msg);
+      break;
+    }
+#endif
+#ifdef USE_SERIAL_PROXY
+    case SerialProxyFlushRequest::MESSAGE_TYPE: {
+      SerialProxyFlushRequest msg;
+      msg.decode(msg_data, msg_size);
+#ifdef HAS_PROTO_MESSAGE_DUMP
+      this->log_receive_message_(LOG_STR("on_serial_proxy_flush_request"), msg);
+#endif
+      this->on_serial_proxy_flush_request(msg);
+      break;
+    }
 #endif
     default:
       break;

esphome/components/api/api_pb2_service.h

@@ -224,6 +224,23 @@ class APIServerConnectionBase : public ProtoService {
   virtual void on_infrared_rf_transmit_raw_timings_request(const InfraredRFTransmitRawTimingsRequest &value){};
 #endif
 
+#ifdef USE_SERIAL_PROXY
+  virtual void on_serial_proxy_configure_request(const SerialProxyConfigureRequest &value){};
+#endif
+
+#ifdef USE_SERIAL_PROXY
+  virtual void on_serial_proxy_write_request(const SerialProxyWriteRequest &value){};
+#endif
+#ifdef USE_SERIAL_PROXY
+  virtual void on_serial_proxy_set_modem_pins_request(const SerialProxySetModemPinsRequest &value){};
+#endif
+#ifdef USE_SERIAL_PROXY
+  virtual void on_serial_proxy_get_modem_pins_request(const SerialProxyGetModemPinsRequest &value){};
+#endif
+
+#ifdef USE_SERIAL_PROXY
+  virtual void on_serial_proxy_flush_request(const SerialProxyFlushRequest &value){};
+#endif
  protected:
   void read_message(uint32_t msg_size, uint32_t msg_type, const uint8_t *msg_data) override;
 };

esphome/components/api/api_server.cpp

@@ -370,6 +370,17 @@ void APIServer::send_infrared_rf_receive_event([[maybe_unused]] uint32_t device_
 }
 #endif
 
+#ifdef USE_SERIAL_PROXY
+void APIServer::send_serial_proxy_data(uint32_t instance, const uint8_t *data, size_t len) {
+  SerialProxyDataReceived msg{};
+  msg.instance = instance;
+  msg.set_data(data, len);
+
+  for (auto &c : this->clients_)
+    c->send_serial_proxy_data(msg);
+}
+#endif
+
 #ifdef USE_ALARM_CONTROL_PANEL
 API_DISPATCH_UPDATE(alarm_control_panel::AlarmControlPanel, alarm_control_panel)
 #endif

esphome/components/api/api_server.h

@@ -189,6 +189,10 @@ class APIServer : public Component,
   void send_infrared_rf_receive_event(uint32_t device_id, uint32_t key, const std::vector<int32_t> *timings);
 #endif
 
+#ifdef USE_SERIAL_PROXY
+  void send_serial_proxy_data(uint32_t instance, const uint8_t *data, size_t len);
+#endif
+
   bool is_connected(bool state_subscription_only = false) const;
 
 #ifdef USE_API_HOMEASSISTANT_STATES

esphome/components/api/proto.h

@@ -57,6 +57,16 @@ inline uint16_t count_packed_varints(const uint8_t *data, size_t len) {
   return count;
 }
 
+/// Encode a varint directly into a pre-allocated buffer.
+/// Caller must ensure buffer has space (use ProtoSize::varint() to calculate).
+inline void encode_varint_to_buffer(uint32_t val, uint8_t *buffer) {
+  while (val > 0x7F) {
+    *buffer++ = static_cast<uint8_t>(val | 0x80);
+    val >>= 7;
+  }
+  *buffer = static_cast<uint8_t>(val);
+}
+
 /*
  * StringRef Ownership Model for API Protocol Messages
  * ===================================================
@@ -93,17 +103,17 @@ class ProtoVarInt {
   ProtoVarInt() : value_(0) {}
   explicit ProtoVarInt(uint64_t value) : value_(value) {}
 
+  /// Parse a varint from buffer. consumed must be a valid pointer (not null).
   static optional<ProtoVarInt> parse(const uint8_t *buffer, uint32_t len, uint32_t *consumed) {
-    if (len == 0) {
-      if (consumed != nullptr)
-        *consumed = 0;
+#ifdef ESPHOME_DEBUG_API
+    assert(consumed != nullptr);
+#endif
+    if (len == 0)
       return {};
-    }
 
     // Most common case: single-byte varint (values 0-127)
     if ((buffer[0] & 0x80) == 0) {
-      if (consumed != nullptr)
-        *consumed = 1;
+      *consumed = 1;
       return ProtoVarInt(buffer[0]);
     }
 
@@ -122,14 +132,11 @@ class ProtoVarInt {
       result |= uint64_t(val & 0x7F) << uint64_t(bitpos);
       bitpos += 7;
       if ((val & 0x80) == 0) {
-        if (consumed != nullptr)
-          *consumed = i + 1;
+        *consumed = i + 1;
         return ProtoVarInt(result);
       }
     }
 
-    if (consumed != nullptr)
-      *consumed = 0;
     return {};  // Incomplete or invalid varint
   }
 
@@ -153,50 +160,6 @@ class ProtoVarInt {
     // with ZigZag encoding
     return decode_zigzag64(this->value_);
   }
-  /**
-   * Encode the varint value to a pre-allocated buffer without bounds checking.
-   *
-   * @param buffer The pre-allocated buffer to write the encoded varint to
-   * @param len The size of the buffer in bytes
-   *
-   * @note The caller is responsible for ensuring the buffer is large enough
-   *       to hold the encoded value. Use ProtoSize::varint() to calculate
-   *       the exact size needed before calling this method.
-   * @note No bounds checking is performed for performance reasons.
-   */
-  void encode_to_buffer_unchecked(uint8_t *buffer, size_t len) {
-    uint64_t val = this->value_;
-    if (val <= 0x7F) {
-      buffer[0] = val;
-      return;
-    }
-    size_t i = 0;
-    while (val && i < len) {
-      uint8_t temp = val & 0x7F;
-      val >>= 7;
-      if (val) {
-        buffer[i++] = temp | 0x80;
-      } else {
-        buffer[i++] = temp;
-      }
-    }
-  }
-  void encode(std::vector<uint8_t> &out) {
-    uint64_t val = this->value_;
-    if (val <= 0x7F) {
-      out.push_back(val);
-      return;
-    }
-    while (val) {
-      uint8_t temp = val & 0x7F;
-      val >>= 7;
-      if (val) {
-        out.push_back(temp | 0x80);
-      } else {
-        out.push_back(temp);
-      }
-    }
-  }
 
  protected:
   uint64_t value_;
@@ -256,8 +219,20 @@ class ProtoWriteBuffer {
  public:
   ProtoWriteBuffer(std::vector<uint8_t> *buffer) : buffer_(buffer) {}
   void write(uint8_t value) { this->buffer_->push_back(value); }
-  void encode_varint_raw(ProtoVarInt value) { value.encode(*this->buffer_); }
-  void encode_varint_raw(uint32_t value) { this->encode_varint_raw(ProtoVarInt(value)); }
+  void encode_varint_raw(uint32_t value) {
+    while (value > 0x7F) {
+      this->buffer_->push_back(static_cast<uint8_t>(value | 0x80));
+      value >>= 7;
+    }
+    this->buffer_->push_back(static_cast<uint8_t>(value));
+  }
+  void encode_varint_raw_64(uint64_t value) {
+    while (value > 0x7F) {
+      this->buffer_->push_back(static_cast<uint8_t>(value | 0x80));
+      value >>= 7;
+    }
+    this->buffer_->push_back(static_cast<uint8_t>(value));
+  }
   /**
    * Encode a field key (tag/wire type combination).
    *
@@ -307,13 +282,13 @@ class ProtoWriteBuffer {
     if (value == 0 && !force)
       return;
     this->encode_field_raw(field_id, 0);  // type 0: Varint - uint64
-    this->encode_varint_raw(ProtoVarInt(value));
+    this->encode_varint_raw_64(value);
   }
   void encode_bool(uint32_t field_id, bool value, bool force = false) {
     if (!value && !force)
       return;
     this->encode_field_raw(field_id, 0);  // type 0: Varint - bool
-    this->write(0x01);
+    this->buffer_->push_back(value ? 0x01 : 0x00);
   }
   void encode_fixed32(uint32_t field_id, uint32_t value, bool force = false) {
     if (value == 0 && !force)
@@ -938,13 +913,15 @@ inline void ProtoWriteBuffer::encode_message(uint32_t field_id, const ProtoMessa
   this->buffer_->resize(this->buffer_->size() + varint_length_bytes);
 
   // Write the length varint directly
-  ProtoVarInt(msg_length_bytes).encode_to_buffer_unchecked(this->buffer_->data() + begin, varint_length_bytes);
+  encode_varint_to_buffer(msg_length_bytes, this->buffer_->data() + begin);
 
   // Now encode the message content - it will append to the buffer
   value.encode(*this);
 
+#ifdef ESPHOME_DEBUG_API
   // Verify that the encoded size matches what we calculated
   assert(this->buffer_->size() == begin + varint_length_bytes + msg_length_bytes);
+#endif
 }
 
 // Implementation of decode_to_message - must be after ProtoDecodableMessage is defined

esphome/components/esp32_improv/esp32_improv_component.cpp

@@ -338,8 +338,8 @@ void ESP32ImprovComponent::process_incoming_data_() {
           return;
         }
         wifi::WiFiAP sta{};
-        sta.set_ssid(command.ssid);
-        sta.set_password(command.password);
+        sta.set_ssid(command.ssid.c_str());
+        sta.set_password(command.password.c_str());
         this->connecting_sta_ = sta;
 
         wifi::global_wifi_component->set_sta(sta);

esphome/components/improv_serial/improv_serial_component.cpp

@@ -235,8 +235,8 @@ bool ImprovSerialComponent::parse_improv_payload_(improv::ImprovCommand &command
   switch (command.command) {
     case improv::WIFI_SETTINGS: {
       wifi::WiFiAP sta{};
-      sta.set_ssid(command.ssid);
-      sta.set_password(command.password);
+      sta.set_ssid(command.ssid.c_str());
+      sta.set_password(command.password.c_str());
       this->connecting_sta_ = sta;
 
       wifi::global_wifi_component->set_sta(sta);
@@ -267,16 +267,26 @@ bool ImprovSerialComponent::parse_improv_payload_(improv::ImprovCommand &command
       for (auto &scan : results) {
         if (scan.get_is_hidden())
           continue;
-        const std::string &ssid = scan.get_ssid();
-        if (std::find(networks.begin(), networks.end(), ssid) != networks.end())
+        const char *ssid_cstr = scan.get_ssid().c_str();
+        // Check if we've already sent this SSID
+        bool duplicate = false;
+        for (const auto &seen : networks) {
+          if (strcmp(seen.c_str(), ssid_cstr) == 0) {
+            duplicate = true;
+            break;
+          }
+        }
+        if (duplicate)
           continue;
+        // Only allocate std::string after confirming it's not a duplicate
+        std::string ssid(ssid_cstr);
         // Send each ssid separately to avoid overflowing the buffer
         char rssi_buf[5];  // int8_t: -128 to 127, max 4 chars + null
         *int8_to_str(rssi_buf, scan.get_rssi()) = '\0';
         std::vector<uint8_t> data =
             improv::build_rpc_response(improv::GET_WIFI_NETWORKS, {ssid, rssi_buf, YESNO(scan.get_with_auth())}, false);
         this->send_response_(data);
-        networks.push_back(ssid);
+        networks.push_back(std::move(ssid));
       }
       // Send empty response to signify the end of the list.
       std::vector<uint8_t> data =

esphome/components/openthread/openthread_esp.cpp

@@ -104,7 +104,7 @@ void OpenThreadComponent::ot_main() {
   esp_cli_custom_command_init();
 #endif  // CONFIG_OPENTHREAD_CLI_ESP_EXTENSION
 
-  otLinkModeConfig link_mode_config = {0};
+  otLinkModeConfig link_mode_config{};
 #if CONFIG_OPENTHREAD_FTD
   link_mode_config.mRxOnWhenIdle = true;
   link_mode_config.mDeviceType = true;

esphome/components/serial_proxy/__init__.py

@@ -0,0 +1,62 @@
+"""
+Serial Proxy component for ESPHome.
+
+WARNING: This component is EXPERIMENTAL. The API (both Python configuration
+and C++ interfaces) may change at any time without following the normal
+breaking changes policy. Use at your own risk.
+
+Once the API is considered stable, this warning will be removed.
+
+Provides a proxy to/from a serial interface on the ESPHome device, allowing
+Home Assistant to connect to the serial port and send/receive data to/from
+an arbitrary serial device.
+"""
+
+from esphome import pins
+import esphome.codegen as cg
+from esphome.components import uart
+import esphome.config_validation as cv
+from esphome.const import CONF_ID
+
+CODEOWNERS = ["@kbx81"]
+DEPENDENCIES = ["api", "uart"]
+
+MULTI_CONF = True
+
+serial_proxy_ns = cg.esphome_ns.namespace("serial_proxy")
+SerialProxy = serial_proxy_ns.class_("SerialProxy", cg.Component, uart.UARTDevice)
+
+CONF_RTS_PIN = "rts_pin"
+CONF_DTR_PIN = "dtr_pin"
+
+
+CONFIG_SCHEMA = (
+    cv.Schema(
+        {
+            cv.GenerateID(): cv.declare_id(SerialProxy),
+            cv.Optional(CONF_RTS_PIN): pins.gpio_output_pin_schema,
+            cv.Optional(CONF_DTR_PIN): pins.gpio_output_pin_schema,
+        }
+    )
+    .extend(cv.COMPONENT_SCHEMA)
+    .extend(uart.UART_DEVICE_SCHEMA)
+)
+
+
+async def to_code(config):
+    var = cg.new_Pvariable(config[CONF_ID])
+    await cg.register_component(var, config)
+    await uart.register_uart_device(var, config)
+    cg.add(cg.App.register_serial_proxy(var))
+    cg.add_define("USE_SERIAL_PROXY")
+
+    if CONF_RTS_PIN in config:
+        rts_pin = await cg.gpio_pin_expression(config[CONF_RTS_PIN])
+        cg.add(var.set_rts_pin(rts_pin))
+
+    if CONF_DTR_PIN in config:
+        dtr_pin = await cg.gpio_pin_expression(config[CONF_DTR_PIN])
+        cg.add(var.set_dtr_pin(dtr_pin))
+
+    # Request UART to wake the main loop when data arrives for low-latency processing
+    uart.request_wake_loop_on_rx()

esphome/components/serial_proxy/serial_proxy.cpp

@@ -0,0 +1,131 @@
+#include "serial_proxy.h"
+
+#ifdef USE_SERIAL_PROXY
+
+#include "esphome/core/log.h"
+
+#ifdef USE_API
+#include "esphome/components/api/api_server.h"
+#endif
+
+namespace esphome::serial_proxy {
+
+static const char *const TAG = "serial_proxy";
+
+void SerialProxy::setup() {
+  // Set up modem control pins if configured
+  if (this->rts_pin_ != nullptr) {
+    this->rts_pin_->setup();
+    this->rts_pin_->digital_write(this->rts_state_);
+  }
+  if (this->dtr_pin_ != nullptr) {
+    this->dtr_pin_->setup();
+    this->dtr_pin_->digital_write(this->dtr_state_);
+  }
+}
+
+void SerialProxy::loop() {
+  // Read available data from UART and forward to API clients
+  size_t available = this->available();
+  if (available == 0)
+    return;
+
+  // Read in chunks up to SERIAL_PROXY_MAX_READ_SIZE
+  uint8_t buffer[SERIAL_PROXY_MAX_READ_SIZE];
+  size_t to_read = std::min(available, sizeof(buffer));
+
+  if (!this->read_array(buffer, to_read))
+    return;
+
+#ifdef USE_API
+  if (api::global_api_server != nullptr) {
+    api::global_api_server->send_serial_proxy_data(this->instance_index_, buffer, to_read);
+  }
+#endif
+}
+
+void SerialProxy::dump_config() {
+  ESP_LOGCONFIG(TAG,
+                "Serial Proxy [%u]:\n"
+                "  RTS Pin: %s\n"
+                "  DTR Pin: %s",
+                this->instance_index_, this->rts_pin_ != nullptr ? "configured" : "not configured",
+                this->dtr_pin_ != nullptr ? "configured" : "not configured");
+}
+
+void SerialProxy::configure(uint32_t baudrate, bool flow_control, uint8_t parity, uint8_t stop_bits,
+                            uint8_t data_size) {
+  ESP_LOGD(TAG, "Configuring serial proxy [%u]: baud=%u, flow_ctrl=%s, parity=%u, stop=%u, data=%u",
+           this->instance_index_, baudrate, YESNO(flow_control), parity, stop_bits, data_size);
+
+  auto *uart_comp = this->parent_;
+  if (uart_comp == nullptr) {
+    ESP_LOGE(TAG, "UART component not available");
+    return;
+  }
+
+  // Apply UART parameters
+  uart_comp->set_baud_rate(baudrate);
+  uart_comp->set_stop_bits(stop_bits);
+  uart_comp->set_data_bits(data_size);
+
+  // Map parity enum to UARTParityOptions
+  switch (parity) {
+    case 0:
+      uart_comp->set_parity(uart::UART_CONFIG_PARITY_NONE);
+      break;
+    case 1:
+      uart_comp->set_parity(uart::UART_CONFIG_PARITY_EVEN);
+      break;
+    case 2:
+      uart_comp->set_parity(uart::UART_CONFIG_PARITY_ODD);
+      break;
+    default:
+      ESP_LOGW(TAG, "Unknown parity value: %u, using NONE", parity);
+      uart_comp->set_parity(uart::UART_CONFIG_PARITY_NONE);
+      break;
+  }
+
+    // Apply the new settings
+    // load_settings() is available on ESP8266 and ESP32 platforms
+#if defined(USE_ESP8266) || defined(USE_ESP32)
+  uart_comp->load_settings(true);
+#endif
+
+  // Note: Hardware flow control configuration is stored but not yet applied
+  // to the UART hardware - this requires additional platform support
+  (void) flow_control;
+}
+
+void SerialProxy::write(const uint8_t *data, size_t len) {
+  if (data == nullptr || len == 0)
+    return;
+  this->write_array(data, len);
+}
+
+void SerialProxy::set_modem_pins(bool rts, bool dtr) {
+  ESP_LOGV(TAG, "Setting modem pins [%u]: RTS=%s, DTR=%s", this->instance_index_, ONOFF(rts), ONOFF(dtr));
+
+  if (this->rts_pin_ != nullptr) {
+    this->rts_state_ = rts;
+    this->rts_pin_->digital_write(rts);
+  }
+  if (this->dtr_pin_ != nullptr) {
+    this->dtr_state_ = dtr;
+    this->dtr_pin_->digital_write(dtr);
+  }
+}
+
+void SerialProxy::get_modem_pins(bool &rts, bool &dtr) const {
+  rts = this->rts_state_;
+  dtr = this->dtr_state_;
+}
+
+void SerialProxy::flush_port() {
+  ESP_LOGV(TAG, "Flushing serial proxy [%u]", this->instance_index_);
+  this->flush();
+}
+
+}  // namespace esphome::serial_proxy
+
+#endif  // USE_SERIAL_PROXY

esphome/components/serial_proxy/serial_proxy.h

@@ -0,0 +1,80 @@
+#pragma once
+
+// WARNING: This component is EXPERIMENTAL. The API may change at any time
+// without following the normal breaking changes policy. Use at your own risk.
+// Once the API is considered stable, this warning will be removed.
+
+#include "esphome/core/defines.h"
+
+#ifdef USE_SERIAL_PROXY
+
+#include "esphome/core/component.h"
+#include "esphome/core/hal.h"
+#include "esphome/components/uart/uart.h"
+
+namespace esphome::serial_proxy {
+
+/// Maximum bytes to read from UART in a single loop iteration
+static constexpr size_t SERIAL_PROXY_MAX_READ_SIZE = 256;
+
+class SerialProxy : public uart::UARTDevice, public Component {
+ public:
+  void setup() override;
+  void loop() override;
+  void dump_config() override;
+  float get_setup_priority() const override { return setup_priority::AFTER_CONNECTION; }
+
+  /// Get the instance index (position in Application's serial_proxies_ vector)
+  uint32_t get_instance_index() const { return this->instance_index_; }
+
+  /// Set the instance index (called by Application::register_serial_proxy)
+  void set_instance_index(uint32_t index) { this->instance_index_ = index; }
+
+  /// Configure UART parameters and apply them
+  /// @param baudrate Baud rate in bits per second
+  /// @param flow_control True to enable hardware flow control
+  /// @param parity Parity setting (0=none, 1=even, 2=odd)
+  /// @param stop_bits Number of stop bits (1 or 2)
+  /// @param data_size Number of data bits (5-8)
+  void configure(uint32_t baudrate, bool flow_control, uint8_t parity, uint8_t stop_bits, uint8_t data_size);
+
+  /// Write data to the serial device
+  /// @param data Pointer to data buffer
+  /// @param len Number of bytes to write
+  void write(const uint8_t *data, size_t len);
+
+  /// Set modem pin states (RTS and DTR)
+  /// @param rts Desired RTS pin state
+  /// @param dtr Desired DTR pin state
+  void set_modem_pins(bool rts, bool dtr);
+
+  /// Get current modem pin states
+  /// @param[out] rts Current RTS pin state
+  /// @param[out] dtr Current DTR pin state
+  void get_modem_pins(bool &rts, bool &dtr) const;
+
+  /// Flush the serial port (block until all TX data is sent)
+  void flush_port();
+
+  /// Set the RTS GPIO pin (from YAML configuration)
+  void set_rts_pin(GPIOPin *pin) { this->rts_pin_ = pin; }
+
+  /// Set the DTR GPIO pin (from YAML configuration)
+  void set_dtr_pin(GPIOPin *pin) { this->dtr_pin_ = pin; }
+
+ protected:
+  /// Instance index for identifying this proxy in API messages
+  uint32_t instance_index_{0};
+
+  /// Optional GPIO pins for modem control
+  GPIOPin *rts_pin_{nullptr};
+  GPIOPin *dtr_pin_{nullptr};
+
+  /// Current modem pin states
+  bool rts_state_{false};
+  bool dtr_state_{false};
+};
+
+}  // namespace esphome::serial_proxy
+
+#endif  // USE_SERIAL_PROXY

esphome/components/socket/bsd_sockets_impl.cpp

@@ -16,19 +16,13 @@ namespace esphome::socket {
 
 class BSDSocketImpl final : public Socket {
  public:
-  BSDSocketImpl(int fd, bool monitor_loop = false) : fd_(fd) {
-#ifdef USE_SOCKET_SELECT_SUPPORT
+  BSDSocketImpl(int fd, bool monitor_loop = false) {
+    this->fd_ = fd;
     // Register new socket with the application for select() if monitoring requested
     if (monitor_loop && this->fd_ >= 0) {
       // Only set loop_monitored_ to true if registration succeeds
       this->loop_monitored_ = App.register_socket_fd(this->fd_);
-    } else {
-      this->loop_monitored_ = false;
     }
-#else
-    // Without select support, ignore monitor_loop parameter
-    (void) monitor_loop;
-#endif
   }
   ~BSDSocketImpl() override {
     if (!this->closed_) {
@@ -52,12 +46,10 @@ class BSDSocketImpl final : public Socket {
   int bind(const struct sockaddr *addr, socklen_t addrlen) override { return ::bind(this->fd_, addr, addrlen); }
   int close() override {
     if (!this->closed_) {
-#ifdef USE_SOCKET_SELECT_SUPPORT
       // Unregister from select() before closing if monitored
       if (this->loop_monitored_) {
         App.unregister_socket_fd(this->fd_);
       }
-#endif
       int ret = ::close(this->fd_);
       this->closed_ = true;
       return ret;
@@ -130,23 +122,6 @@ class BSDSocketImpl final : public Socket {
     ::fcntl(this->fd_, F_SETFL, fl);
     return 0;
   }
-
-  int get_fd() const override { return this->fd_; }
-
-#ifdef USE_SOCKET_SELECT_SUPPORT
-  bool ready() const override {
-    if (!this->loop_monitored_)
-      return true;
-    return App.is_socket_ready(this->fd_);
-  }
-#endif
-
- protected:
-  int fd_;
-  bool closed_{false};
-#ifdef USE_SOCKET_SELECT_SUPPORT
-  bool loop_monitored_{false};
-#endif
 };
 
 // Helper to create a socket with optional monitoring

esphome/components/socket/lwip_raw_tcp_impl.cpp

@@ -452,6 +452,8 @@ class LWIPRawImpl : public Socket {
     errno = ENOSYS;
     return -1;
   }
+  bool ready() const override { return this->rx_buf_ != nullptr || this->rx_closed_ || this->pcb_ == nullptr; }
+
   int setblocking(bool blocking) final {
     if (pcb_ == nullptr) {
       errno = ECONNRESET;
@@ -576,6 +578,8 @@ class LWIPRawListenImpl final : public LWIPRawImpl {
     tcp_err(pcb_, LWIPRawImpl::s_err_fn);  // Use base class error handler
   }
 
+  bool ready() const override { return this->accepted_socket_count_ > 0; }
+
   std::unique_ptr<Socket> accept(struct sockaddr *addr, socklen_t *addrlen) override {
     if (pcb_ == nullptr) {
       errno = EBADF;

esphome/components/socket/lwip_sockets_impl.cpp

@@ -11,19 +11,13 @@ namespace esphome::socket {
 
 class LwIPSocketImpl final : public Socket {
  public:
-  LwIPSocketImpl(int fd, bool monitor_loop = false) : fd_(fd) {
-#ifdef USE_SOCKET_SELECT_SUPPORT
+  LwIPSocketImpl(int fd, bool monitor_loop = false) {
+    this->fd_ = fd;
     // Register new socket with the application for select() if monitoring requested
     if (monitor_loop && this->fd_ >= 0) {
       // Only set loop_monitored_ to true if registration succeeds
       this->loop_monitored_ = App.register_socket_fd(this->fd_);
-    } else {
-      this->loop_monitored_ = false;
     }
-#else
-    // Without select support, ignore monitor_loop parameter
-    (void) monitor_loop;
-#endif
   }
   ~LwIPSocketImpl() override {
     if (!this->closed_) {
@@ -49,12 +43,10 @@ class LwIPSocketImpl final : public Socket {
   int bind(const struct sockaddr *addr, socklen_t addrlen) override { return lwip_bind(this->fd_, addr, addrlen); }
   int close() override {
     if (!this->closed_) {
-#ifdef USE_SOCKET_SELECT_SUPPORT
       // Unregister from select() before closing if monitored
       if (this->loop_monitored_) {
         App.unregister_socket_fd(this->fd_);
       }
-#endif
       int ret = lwip_close(this->fd_);
       this->closed_ = true;
       return ret;
@@ -97,23 +89,6 @@ class LwIPSocketImpl final : public Socket {
     lwip_fcntl(this->fd_, F_SETFL, fl);
     return 0;
   }
-
-  int get_fd() const override { return this->fd_; }
-
-#ifdef USE_SOCKET_SELECT_SUPPORT
-  bool ready() const override {
-    if (!this->loop_monitored_)
-      return true;
-    return App.is_socket_ready(this->fd_);
-  }
-#endif
-
- protected:
-  int fd_;
-  bool closed_{false};
-#ifdef USE_SOCKET_SELECT_SUPPORT
-  bool loop_monitored_{false};
-#endif
 };
 
 // Helper to create a socket with optional monitoring

esphome/components/socket/socket.cpp

@@ -10,6 +10,10 @@ namespace esphome::socket {
 
 Socket::~Socket() {}
 
+#ifdef USE_SOCKET_SELECT_SUPPORT
+bool Socket::ready() const { return !this->loop_monitored_ || App.is_socket_ready_(this->fd_); }
+#endif
+
 // Platform-specific inet_ntop wrappers
 #if defined(USE_SOCKET_IMPL_LWIP_TCP)
 // LWIP raw TCP (ESP8266) uses inet_ntoa_r which takes struct by value

esphome/components/socket/socket.h

@@ -63,13 +63,29 @@ class Socket {
   virtual int setblocking(bool blocking) = 0;
   virtual int loop() { return 0; };
 
-  /// Get the underlying file descriptor (returns -1 if not supported)
-  virtual int get_fd() const { return -1; }
+    /// Get the underlying file descriptor (returns -1 if not supported)
+    /// Non-virtual: only one socket implementation is active per build.
+#ifdef USE_SOCKET_SELECT_SUPPORT
+  int get_fd() const { return this->fd_; }
+#else
+  int get_fd() const { return -1; }
+#endif
 
   /// Check if socket has data ready to read
-  /// For loop-monitored sockets, checks with the Application's select() results
-  /// For non-monitored sockets, always returns true (assumes data may be available)
+  /// For select()-based sockets: non-virtual, checks Application's select() results
+  /// For LWIP raw TCP sockets: virtual, checks internal buffer state
+#ifdef USE_SOCKET_SELECT_SUPPORT
+  bool ready() const;
+#else
   virtual bool ready() const { return true; }
+#endif
+
+ protected:
+#ifdef USE_SOCKET_SELECT_SUPPORT
+  int fd_{-1};
+  bool closed_{false};
+  bool loop_monitored_{false};
+#endif
 };
 
 /// Create a socket of the given domain, type and protocol.

esphome/components/web_server_idf/multipart.cpp

@@ -54,14 +54,15 @@ size_t MultipartReader::parse(const char *data, size_t len) {
 
 void MultipartReader::process_header_(const char *value, size_t length) {
   // Process the completed header (field + value pair)
-  std::string value_str(value, length);
+  const char *field = current_header_field_.c_str();
+  size_t field_len = current_header_field_.length();
 
-  if (str_startswith_case_insensitive(current_header_field_, "content-disposition")) {
+  if (str_startswith_case_insensitive(field, field_len, "content-disposition")) {
     // Parse name and filename from Content-Disposition
-    current_part_.name = extract_header_param(value_str, "name");
-    current_part_.filename = extract_header_param(value_str, "filename");
-  } else if (str_startswith_case_insensitive(current_header_field_, "content-type")) {
-    current_part_.content_type = str_trim(value_str);
+    extract_header_param(value, length, "name", current_part_.name);
+    extract_header_param(value, length, "filename", current_part_.filename);
+  } else if (str_startswith_case_insensitive(field, field_len, "content-type")) {
+    str_trim(value, length, current_part_.content_type);
   }
 
   // Clear field for next header
@@ -107,25 +108,29 @@ int MultipartReader::on_part_data_end(multipart_parser *parser) {
 // ========== Utility Functions ==========
 
 // Case-insensitive string prefix check
-bool str_startswith_case_insensitive(const std::string &str, const std::string &prefix) {
-  if (str.length() < prefix.length()) {
+bool str_startswith_case_insensitive(const char *str, size_t str_len, const char *prefix) {
+  size_t prefix_len = strlen(prefix);
+  if (str_len < prefix_len) {
     return false;
   }
-  return str_ncmp_ci(str.c_str(), prefix.c_str(), prefix.length());
+  return str_ncmp_ci(str, prefix, prefix_len);
 }
 
 // Extract a parameter value from a header line
 // Handles both quoted and unquoted values
-std::string extract_header_param(const std::string &header, const std::string &param) {
+// Assigns to out if found, clears out otherwise
+void extract_header_param(const char *header, size_t header_len, const char *param, std::string &out) {
+  size_t param_len = strlen(param);
   size_t search_pos = 0;
 
-  while (search_pos < header.length()) {
+  while (search_pos < header_len) {
     // Look for param name
-    const char *found = stristr(header.c_str() + search_pos, param.c_str());
+    const char *found = strcasestr_n(header + search_pos, header_len - search_pos, param);
     if (!found) {
-      return "";
+      out.clear();
+      return;
     }
-    size_t pos = found - header.c_str();
+    size_t pos = found - header;
 
     // Check if this is a word boundary (not part of another parameter)
     if (pos > 0 && header[pos - 1] != ' ' && header[pos - 1] != ';' && header[pos - 1] != '\t') {
@@ -134,14 +139,14 @@ std::string extract_header_param(const std::string &header, const std::string &p
     }
 
     // Move past param name
-    pos += param.length();
+    pos += param_len;
 
     // Skip whitespace and find '='
-    while (pos < header.length() && (header[pos] == ' ' || header[pos] == '\t')) {
+    while (pos < header_len && (header[pos] == ' ' || header[pos] == '\t')) {
       pos++;
     }
 
-    if (pos >= header.length() || header[pos] != '=') {
+    if (pos >= header_len || header[pos] != '=') {
       search_pos = pos;
       continue;
     }
@@ -149,36 +154,39 @@ std::string extract_header_param(const std::string &header, const std::string &p
     pos++;  // Skip '='
 
     // Skip whitespace after '='
-    while (pos < header.length() && (header[pos] == ' ' || header[pos] == '\t')) {
+    while (pos < header_len && (header[pos] == ' ' || header[pos] == '\t')) {
       pos++;
     }
 
-    if (pos >= header.length()) {
-      return "";
+    if (pos >= header_len) {
+      out.clear();
+      return;
     }
 
     // Check if value is quoted
     if (header[pos] == '"') {
       pos++;
-      size_t end = header.find('"', pos);
-      if (end != std::string::npos) {
-        return header.substr(pos, end - pos);
+      const char *end = static_cast<const char *>(memchr(header + pos, '"', header_len - pos));
+      if (end) {
+        out.assign(header + pos, end - (header + pos));
+        return;
       }
       // Malformed - no closing quote
-      return "";
+      out.clear();
+      return;
     }
 
     // Unquoted value - find the end (semicolon, comma, or end of string)
     size_t end = pos;
-    while (end < header.length() && header[end] != ';' && header[end] != ',' && header[end] != ' ' &&
-           header[end] != '\t') {
+    while (end < header_len && header[end] != ';' && header[end] != ',' && header[end] != ' ' && header[end] != '\t') {
       end++;
     }
 
-    return header.substr(pos, end - pos);
+    out.assign(header + pos, end - pos);
+    return;
   }
 
-  return "";
+  out.clear();
 }
 
 // Parse boundary from Content-Type header
@@ -189,13 +197,15 @@ bool parse_multipart_boundary(const char *content_type, const char **boundary_st
     return false;
   }
 
+  size_t content_type_len = strlen(content_type);
+
   // Check for multipart/form-data (case-insensitive)
-  if (!stristr(content_type, "multipart/form-data")) {
+  if (!strcasestr_n(content_type, content_type_len, "multipart/form-data")) {
     return false;
   }
 
   // Look for boundary parameter
-  const char *b = stristr(content_type, "boundary=");
+  const char *b = strcasestr_n(content_type, content_type_len, "boundary=");
   if (!b) {
     return false;
   }
@@ -238,14 +248,15 @@ bool parse_multipart_boundary(const char *content_type, const char **boundary_st
   return true;
 }
 
-// Trim whitespace from both ends of a string
-std::string str_trim(const std::string &str) {
-  size_t start = str.find_first_not_of(" \t\r\n");
-  if (start == std::string::npos) {
-    return "";
-  }
-  size_t end = str.find_last_not_of(" \t\r\n");
-  return str.substr(start, end - start + 1);
+// Trim whitespace from both ends, assign result to out
+void str_trim(const char *str, size_t len, std::string &out) {
+  const char *start = str;
+  const char *end = str + len;
+  while (start < end && (*start == ' ' || *start == '\t' || *start == '\r' || *start == '\n'))
+    start++;
+  while (end > start && (end[-1] == ' ' || end[-1] == '\t' || end[-1] == '\r' || end[-1] == '\n'))
+    end--;
+  out.assign(start, end - start);
 }
 
 }  // namespace esphome::web_server_idf

esphome/components/web_server_idf/multipart.h

@@ -66,19 +66,20 @@ class MultipartReader {
 // ========== Utility Functions ==========
 
 // Case-insensitive string prefix check
-bool str_startswith_case_insensitive(const std::string &str, const std::string &prefix);
+bool str_startswith_case_insensitive(const char *str, size_t str_len, const char *prefix);
 
 // Extract a parameter value from a header line
 // Handles both quoted and unquoted values
-std::string extract_header_param(const std::string &header, const std::string &param);
+// Assigns to out if found, clears out otherwise
+void extract_header_param(const char *header, size_t header_len, const char *param, std::string &out);
 
 // Parse boundary from Content-Type header
 // Returns true if boundary found, false otherwise
 // boundary_start and boundary_len will point to the boundary value
 bool parse_multipart_boundary(const char *content_type, const char **boundary_start, size_t *boundary_len);
 
-// Trim whitespace from both ends of a string
-std::string str_trim(const std::string &str);
+// Trim whitespace from both ends, assign result to out
+void str_trim(const char *str, size_t len, std::string &out);
 
 }  // namespace esphome::web_server_idf
 #endif  // defined(USE_ESP32) && defined(USE_WEBSERVER_OTA)

esphome/components/web_server_idf/utils.cpp

@@ -98,8 +98,8 @@ bool str_ncmp_ci(const char *s1, const char *s2, size_t n) {
   return true;
 }
 
-// Case-insensitive string search (like strstr but case-insensitive)
-const char *stristr(const char *haystack, const char *needle) {
+// Bounded case-insensitive string search (like strcasestr but length-bounded)
+const char *strcasestr_n(const char *haystack, size_t haystack_len, const char *needle) {
   if (!haystack) {
     return nullptr;
   }
@@ -109,7 +109,12 @@ const char *stristr(const char *haystack, const char *needle) {
     return haystack;
   }
 
-  for (const char *p = haystack; *p; p++) {
+  if (haystack_len < needle_len) {
+    return nullptr;
+  }
+
+  const char *end = haystack + haystack_len - needle_len + 1;
+  for (const char *p = haystack; p < end; p++) {
     if (str_ncmp_ci(p, needle, needle_len)) {
       return p;
     }

esphome/components/web_server_idf/utils.h

@@ -25,8 +25,8 @@ inline bool char_equals_ci(char a, char b) { return ::tolower(a) == ::tolower(b)
 // Helper function for case-insensitive string region comparison
 bool str_ncmp_ci(const char *s1, const char *s2, size_t n);
 
-// Case-insensitive string search (like strstr but case-insensitive)
-const char *stristr(const char *haystack, const char *needle);
+// Bounded case-insensitive string search (like strcasestr but length-bounded)
+const char *strcasestr_n(const char *haystack, size_t haystack_len, const char *needle);
 
 }  // namespace esphome::web_server_idf
 #endif  // USE_ESP32

esphome/components/web_server_idf/web_server_idf.cpp

@@ -171,10 +171,11 @@ esp_err_t AsyncWebServer::request_post_handler(httpd_req_t *r) {
     const char *content_type_char = content_type.value().c_str();
 
     // Check most common case first
-    if (stristr(content_type_char, "application/x-www-form-urlencoded") != nullptr) {
+    size_t content_type_len = strlen(content_type_char);
+    if (strcasestr_n(content_type_char, content_type_len, "application/x-www-form-urlencoded") != nullptr) {
       // Normal form data - proceed with regular handling
 #ifdef USE_WEBSERVER_OTA
-    } else if (stristr(content_type_char, "multipart/form-data") != nullptr) {
+    } else if (strcasestr_n(content_type_char, content_type_len, "multipart/form-data") != nullptr) {
       auto *server = static_cast<AsyncWebServer *>(r->user_ctx);
       return server->handle_multipart_upload_(r, content_type_char);
 #endif
@@ -881,12 +882,12 @@ esp_err_t AsyncWebServer::handle_multipart_upload_(httpd_req_t *r, const char *c
     }
   });
 
-  // Process data - use stack buffer to avoid heap allocation
-  char buffer[MULTIPART_CHUNK_SIZE];
+  // Use heap buffer - 1460 bytes is too large for the httpd task stack
+  auto buffer = std::make_unique<char[]>(MULTIPART_CHUNK_SIZE);
   size_t bytes_since_yield = 0;
 
   for (size_t remaining = r->content_len; remaining > 0;) {
-    int recv_len = httpd_req_recv(r, buffer, std::min(remaining, MULTIPART_CHUNK_SIZE));
+    int recv_len = httpd_req_recv(r, buffer.get(), std::min(remaining, MULTIPART_CHUNK_SIZE));
 
     if (recv_len <= 0) {
       httpd_resp_send_err(r, recv_len == HTTPD_SOCK_ERR_TIMEOUT ? HTTPD_408_REQ_TIMEOUT : HTTPD_400_BAD_REQUEST,
@@ -894,7 +895,7 @@ esp_err_t AsyncWebServer::handle_multipart_upload_(httpd_req_t *r, const char *c
       return recv_len == HTTPD_SOCK_ERR_TIMEOUT ? ESP_ERR_TIMEOUT : ESP_FAIL;
     }
 
-    if (reader->parse(buffer, recv_len) != static_cast<size_t>(recv_len)) {
+    if (reader->parse(buffer.get(), recv_len) != static_cast<size_t>(recv_len)) {
       ESP_LOGW(TAG, "Multipart parser error");
       httpd_resp_send_err(r, HTTPD_400_BAD_REQUEST, nullptr);
       return ESP_FAIL;

esphome/components/wifi/wifi_component.cpp

@@ -20,6 +20,7 @@
 #endif
 
 #include <algorithm>
+#include <new>
 #include <utility>
 #include "lwip/dns.h"
 #include "lwip/err.h"
@@ -47,6 +48,69 @@ namespace esphome::wifi {
 
 static const char *const TAG = "wifi";
 
+// CompactString implementation
+CompactString::CompactString(const char *str, size_t len) {
+  if (len > MAX_LENGTH) {
+    len = MAX_LENGTH;  // Clamp to max valid length
+  }
+
+  this->length_ = len;
+  if (len <= INLINE_CAPACITY) {
+    // Store inline with null terminator
+    this->is_heap_ = 0;
+    if (len > 0) {
+      std::memcpy(this->storage_, str, len);
+    }
+    this->storage_[len] = '\0';
+  } else {
+    // Heap allocate with null terminator
+    this->is_heap_ = 1;
+    char *heap_data = new char[len + 1];  // NOLINT(cppcoreguidelines-owning-memory)
+    std::memcpy(heap_data, str, len);
+    heap_data[len] = '\0';
+    this->set_heap_ptr_(heap_data);
+  }
+}
+
+CompactString::CompactString(const CompactString &other) : CompactString(other.data(), other.size()) {}
+
+CompactString &CompactString::operator=(const CompactString &other) {
+  if (this != &other) {
+    this->~CompactString();
+    new (this) CompactString(other);
+  }
+  return *this;
+}
+
+CompactString::CompactString(CompactString &&other) noexcept : length_(other.length_), is_heap_(other.is_heap_) {
+  // Copy full storage (includes null terminator for inline, or pointer for heap)
+  std::memcpy(this->storage_, other.storage_, INLINE_CAPACITY + 1);
+  other.length_ = 0;
+  other.is_heap_ = 0;
+  other.storage_[0] = '\0';
+}
+
+CompactString &CompactString::operator=(CompactString &&other) noexcept {
+  if (this != &other) {
+    this->~CompactString();
+    new (this) CompactString(std::move(other));
+  }
+  return *this;
+}
+
+CompactString::~CompactString() {
+  if (this->is_heap_) {
+    delete[] this->get_heap_ptr_();  // NOLINT(cppcoreguidelines-owning-memory)
+  }
+}
+
+bool CompactString::operator==(const CompactString &other) const {
+  return this->size() == other.size() && std::memcmp(this->data(), other.data(), this->size()) == 0;
+}
+bool CompactString::operator==(const StringRef &other) const {
+  return this->size() == other.size() && std::memcmp(this->data(), other.c_str(), this->size()) == 0;
+}
+
 /// WiFi Retry Logic - Priority-Based BSSID Selection
 ///
 /// The WiFi component uses a state machine with priority degradation to handle connection failures
@@ -349,18 +413,18 @@ bool WiFiComponent::needs_scan_results_() const {
   return this->scan_result_.empty() || !this->scan_result_[0].get_matches();
 }
 
-bool WiFiComponent::ssid_was_seen_in_scan_(const std::string &ssid) const {
+bool WiFiComponent::ssid_was_seen_in_scan_(const CompactString &ssid) const {
   // Check if this SSID is configured as hidden
   // If explicitly marked hidden, we should always try hidden mode regardless of scan results
   for (const auto &conf : this->sta_) {
-    if (conf.get_ssid() == ssid && conf.get_hidden()) {
+    if (conf.ssid_ == ssid && conf.get_hidden()) {
       return false;  // Treat as not seen - force hidden mode attempt
     }
   }
 
   // Otherwise, check if we saw it in scan results
   for (const auto &scan : this->scan_result_) {
-    if (scan.get_ssid() == ssid) {
+    if (scan.ssid_ == ssid) {
       return true;
     }
   }
@@ -409,14 +473,14 @@ bool WiFiComponent::matches_configured_network_(const char *ssid, const uint8_t
       continue;
     }
     // For BSSID-only configs (empty SSID), match by BSSID
-    if (sta.get_ssid().empty()) {
+    if (sta.ssid_.empty()) {
       if (sta.has_bssid() && std::memcmp(sta.get_bssid().data(), bssid, 6) == 0) {
         return true;
       }
       continue;
     }
     // Match by SSID
-    if (sta.get_ssid() == ssid) {
+    if (sta.ssid_ == ssid) {
       return true;
     }
   }
@@ -465,18 +529,18 @@ int8_t WiFiComponent::find_next_hidden_sta_(int8_t start_index) {
     if (!include_explicit_hidden && sta.get_hidden()) {
       int8_t first_non_hidden_idx = this->find_first_non_hidden_index_();
       if (first_non_hidden_idx < 0 || static_cast<int8_t>(i) < first_non_hidden_idx) {
-        ESP_LOGD(TAG, "Skipping " LOG_SECRET("'%s'") " (explicit hidden, already tried)", sta.get_ssid().c_str());
+        ESP_LOGD(TAG, "Skipping " LOG_SECRET("'%s'") " (explicit hidden, already tried)", sta.ssid_.c_str());
         continue;
       }
     }
 
     // In BLIND_RETRY mode, treat all networks as candidates
     // In SCAN_BASED mode, only retry networks that weren't seen in the scan
-    if (this->retry_hidden_mode_ == RetryHiddenMode::BLIND_RETRY || !this->ssid_was_seen_in_scan_(sta.get_ssid())) {
-      ESP_LOGD(TAG, "Hidden candidate " LOG_SECRET("'%s'") " at index %d", sta.get_ssid().c_str(), static_cast<int>(i));
+    if (this->retry_hidden_mode_ == RetryHiddenMode::BLIND_RETRY || !this->ssid_was_seen_in_scan_(sta.ssid_)) {
+      ESP_LOGD(TAG, "Hidden candidate " LOG_SECRET("'%s'") " at index %d", sta.ssid_.c_str(), static_cast<int>(i));
       return static_cast<int8_t>(i);
     }
-    ESP_LOGD(TAG, "Skipping hidden retry for visible network " LOG_SECRET("'%s'"), sta.get_ssid().c_str());
+    ESP_LOGD(TAG, "Skipping hidden retry for visible network " LOG_SECRET("'%s'"), sta.ssid_.c_str());
   }
   // No hidden SSIDs found
   return -1;
@@ -593,11 +657,11 @@ void WiFiComponent::start() {
     // Fast connect optimization: only use when we have saved BSSID+channel data
     // Without saved data, try first configured network or use normal flow
     if (loaded_fast_connect) {
-      ESP_LOGI(TAG, "Starting fast_connect (saved) " LOG_SECRET("'%s'"), params.get_ssid().c_str());
+      ESP_LOGI(TAG, "Starting fast_connect (saved) " LOG_SECRET("'%s'"), params.ssid_.c_str());
       this->start_connecting(params);
     } else if (!this->sta_.empty() && !this->sta_[0].get_hidden()) {
       // No saved data, but have configured networks - try first non-hidden network
-      ESP_LOGI(TAG, "Starting fast_connect (config) " LOG_SECRET("'%s'"), this->sta_[0].get_ssid().c_str());
+      ESP_LOGI(TAG, "Starting fast_connect (config) " LOG_SECRET("'%s'"), this->sta_[0].ssid_.c_str());
       this->selected_sta_index_ = 0;
       params = this->build_params_for_current_phase_();
       this->start_connecting(params);
@@ -827,7 +891,7 @@ void WiFiComponent::setup_ap_config_() {
   if (this->ap_setup_)
     return;
 
-  if (this->ap_.get_ssid().empty()) {
+  if (this->ap_.ssid_.empty()) {
     // Build AP SSID from app name without heap allocation
     // WiFi SSID max is 32 bytes, with MAC suffix we keep first 25 + last 7
     static constexpr size_t AP_SSID_MAX_LEN = 32;
@@ -863,7 +927,7 @@ void WiFiComponent::setup_ap_config_() {
                 "  AP SSID: '%s'\n"
                 "  AP Password: '%s'\n"
                 "  IP Address: %s",
-                this->ap_.get_ssid().c_str(), this->ap_.get_password().c_str(), this->wifi_soft_ap_ip().str_to(ip_buf));
+                this->ap_.ssid_.c_str(), this->ap_.password_.c_str(), this->wifi_soft_ap_ip().str_to(ip_buf));
 
 #ifdef USE_WIFI_MANUAL_IP
   auto manual_ip = this->ap_.get_manual_ip();
@@ -960,9 +1024,12 @@ WiFiAP WiFiComponent::get_sta() const {
   return config ? *config : WiFiAP{};
 }
 void WiFiComponent::save_wifi_sta(const std::string &ssid, const std::string &password) {
+  this->save_wifi_sta(ssid.c_str(), password.c_str());
+}
+void WiFiComponent::save_wifi_sta(const char *ssid, const char *password) {
   SavedWifiSettings save{};  // zero-initialized - all bytes set to \0, guaranteeing null termination
-  strncpy(save.ssid, ssid.c_str(), sizeof(save.ssid) - 1);              // max 32 chars, byte 32 remains \0
-  strncpy(save.password, password.c_str(), sizeof(save.password) - 1);  // max 64 chars, byte 64 remains \0
+  strncpy(save.ssid, ssid, sizeof(save.ssid) - 1);              // max 32 chars, byte 32 remains \0
+  strncpy(save.password, password, sizeof(save.password) - 1);  // max 64 chars, byte 64 remains \0
   this->pref_.save(&save);
   // ensure it's written immediately
   global_preferences->sync();
@@ -996,14 +1063,14 @@ void WiFiComponent::start_connecting(const WiFiAP &ap) {
 
   ESP_LOGI(TAG,
            "Connecting to " LOG_SECRET("'%s'") " " LOG_SECRET("(%s)") " (priority %d, attempt %u/%u in phase %s)...",
-           ap.get_ssid().c_str(), ap.has_bssid() ? bssid_s : LOG_STR_LITERAL("any"), priority, this->num_retried_ + 1,
+           ap.ssid_.c_str(), ap.has_bssid() ? bssid_s : LOG_STR_LITERAL("any"), priority, this->num_retried_ + 1,
            get_max_retries_for_phase(this->retry_phase_), LOG_STR_ARG(retry_phase_to_log_string(this->retry_phase_)));
 
 #ifdef ESPHOME_LOG_HAS_VERBOSE
   ESP_LOGV(TAG,
            "Connection Params:\n"
            "  SSID: '%s'",
-           ap.get_ssid().c_str());
+           ap.ssid_.c_str());
   if (ap.has_bssid()) {
     ESP_LOGV(TAG, "  BSSID: %s", bssid_s);
   } else {
@@ -1036,7 +1103,7 @@ void WiFiComponent::start_connecting(const WiFiAP &ap) {
              client_key_present ? "present" : "not present");
   } else {
 #endif
-    ESP_LOGV(TAG, "  Password: " LOG_SECRET("'%s'"), ap.get_password().c_str());
+    ESP_LOGV(TAG, "  Password: " LOG_SECRET("'%s'"), ap.password_.c_str());
 #ifdef USE_WIFI_WPA2_EAP
   }
 #endif
@@ -1411,7 +1478,7 @@ void WiFiComponent::check_connecting_finished(uint32_t now) {
     if (const WiFiAP *config = this->get_selected_sta_(); this->retry_phase_ == WiFiRetryPhase::RETRY_HIDDEN &&
                                                           config && !config->get_hidden() &&
                                                           this->scan_result_.empty()) {
-      ESP_LOGW(TAG, LOG_SECRET("'%s'") " should be marked hidden", config->get_ssid().c_str());
+      ESP_LOGW(TAG, LOG_SECRET("'%s'") " should be marked hidden", config->ssid_.c_str());
     }
     // Reset to initial phase on successful connection (don't log transition, just reset state)
     this->retry_phase_ = WiFiRetryPhase::INITIAL_CONNECT;
@@ -1825,11 +1892,11 @@ void WiFiComponent::log_and_adjust_priority_for_failed_connect_() {
   }
 
   // Get SSID for logging (use pointer to avoid copy)
-  const std::string *ssid = nullptr;
+  const char *ssid = nullptr;
   if (this->retry_phase_ == WiFiRetryPhase::SCAN_CONNECTING && !this->scan_result_.empty()) {
-    ssid = &this->scan_result_[0].get_ssid();
+    ssid = this->scan_result_[0].ssid_.c_str();
   } else if (const WiFiAP *config = this->get_selected_sta_()) {
-    ssid = &config->get_ssid();
+    ssid = config->ssid_.c_str();
   }
 
   // Only decrease priority on the last attempt for this phase
@@ -1849,8 +1916,8 @@ void WiFiComponent::log_and_adjust_priority_for_failed_connect_() {
   }
   char bssid_s[18];
   format_mac_addr_upper(failed_bssid.value().data(), bssid_s);
-  ESP_LOGD(TAG, "Failed " LOG_SECRET("'%s'") " " LOG_SECRET("(%s)") ", priority %d → %d",
-           ssid != nullptr ? ssid->c_str() : "", bssid_s, old_priority, new_priority);
+  ESP_LOGD(TAG, "Failed " LOG_SECRET("'%s'") " " LOG_SECRET("(%s)") ", priority %d → %d", ssid != nullptr ? ssid : "",
+           bssid_s, old_priority, new_priority);
 
   // After adjusting priority, check if all priorities are now at minimum
   // If so, clear the vector to save memory and reset for fresh start
@@ -2098,10 +2165,14 @@ void WiFiComponent::save_fast_connect_settings_() {
 }
 #endif
 
-void WiFiAP::set_ssid(const std::string &ssid) { this->ssid_ = ssid; }
+void WiFiAP::set_ssid(const std::string &ssid) { this->ssid_ = CompactString(ssid.c_str(), ssid.size()); }
+void WiFiAP::set_ssid(const char *ssid) { this->ssid_ = CompactString(ssid, strlen(ssid)); }
 void WiFiAP::set_bssid(const bssid_t &bssid) { this->bssid_ = bssid; }
 void WiFiAP::clear_bssid() { this->bssid_ = {}; }
-void WiFiAP::set_password(const std::string &password) { this->password_ = password; }
+void WiFiAP::set_password(const std::string &password) {
+  this->password_ = CompactString(password.c_str(), password.size());
+}
+void WiFiAP::set_password(const char *password) { this->password_ = CompactString(password, strlen(password)); }
 #ifdef USE_WIFI_WPA2_EAP
 void WiFiAP::set_eap(optional<EAPAuth> eap_auth) { this->eap_ = std::move(eap_auth); }
 #endif
@@ -2111,10 +2182,8 @@ void WiFiAP::clear_channel() { this->channel_ = 0; }
 void WiFiAP::set_manual_ip(optional<ManualIP> manual_ip) { this->manual_ip_ = manual_ip; }
 #endif
 void WiFiAP::set_hidden(bool hidden) { this->hidden_ = hidden; }
-const std::string &WiFiAP::get_ssid() const { return this->ssid_; }
 const bssid_t &WiFiAP::get_bssid() const { return this->bssid_; }
 bool WiFiAP::has_bssid() const { return this->bssid_ != bssid_t{}; }
-const std::string &WiFiAP::get_password() const { return this->password_; }
 #ifdef USE_WIFI_WPA2_EAP
 const optional<EAPAuth> &WiFiAP::get_eap() const { return this->eap_; }
 #endif
@@ -2125,12 +2194,12 @@ const optional<ManualIP> &WiFiAP::get_manual_ip() const { return this->manual_ip
 #endif
 bool WiFiAP::get_hidden() const { return this->hidden_; }
 
-WiFiScanResult::WiFiScanResult(const bssid_t &bssid, std::string ssid, uint8_t channel, int8_t rssi, bool with_auth,
-                               bool is_hidden)
+WiFiScanResult::WiFiScanResult(const bssid_t &bssid, const char *ssid, size_t ssid_len, uint8_t channel, int8_t rssi,
+                               bool with_auth, bool is_hidden)
     : bssid_(bssid),
       channel_(channel),
       rssi_(rssi),
-      ssid_(std::move(ssid)),
+      ssid_(ssid, ssid_len),
       with_auth_(with_auth),
       is_hidden_(is_hidden) {}
 bool WiFiScanResult::matches(const WiFiAP &config) const {
@@ -2139,9 +2208,9 @@ bool WiFiScanResult::matches(const WiFiAP &config) const {
     // don't match SSID
     if (!this->is_hidden_)
       return false;
-  } else if (!config.get_ssid().empty()) {
+  } else if (!config.ssid_.empty()) {
     // check if SSID matches
-    if (config.get_ssid() != this->ssid_)
+    if (this->ssid_ != config.ssid_)
       return false;
   } else {
     // network is configured without SSID - match other settings
@@ -2152,15 +2221,15 @@ bool WiFiScanResult::matches(const WiFiAP &config) const {
 
 #ifdef USE_WIFI_WPA2_EAP
   // BSSID requires auth but no PSK or EAP credentials given
-  if (this->with_auth_ && (config.get_password().empty() && !config.get_eap().has_value()))
+  if (this->with_auth_ && (config.password_.empty() && !config.get_eap().has_value()))
     return false;
 
   // BSSID does not require auth, but PSK or EAP credentials given
-  if (!this->with_auth_ && (!config.get_password().empty() || config.get_eap().has_value()))
+  if (!this->with_auth_ && (!config.password_.empty() || config.get_eap().has_value()))
     return false;
 #else
   // If PSK given, only match for networks with auth (and vice versa)
-  if (config.get_password().empty() == this->with_auth_)
+  if (config.password_.empty() == this->with_auth_)
     return false;
 #endif
 
@@ -2173,7 +2242,6 @@ bool WiFiScanResult::matches(const WiFiAP &config) const {
 bool WiFiScanResult::get_matches() const { return this->matches_; }
 void WiFiScanResult::set_matches(bool matches) { this->matches_ = matches; }
 const bssid_t &WiFiScanResult::get_bssid() const { return this->bssid_; }
-const std::string &WiFiScanResult::get_ssid() const { return this->ssid_; }
 uint8_t WiFiScanResult::get_channel() const { return this->channel_; }
 int8_t WiFiScanResult::get_rssi() const { return this->rssi_; }
 bool WiFiScanResult::get_with_auth() const { return this->with_auth_; }
@@ -2284,7 +2352,7 @@ void WiFiComponent::process_roaming_scan_() {
 
   for (const auto &result : this->scan_result_) {
     // Must be same SSID, different BSSID
-    if (current_ssid != result.get_ssid() || result.get_bssid() == current_bssid)
+    if (result.ssid_ != current_ssid || result.get_bssid() == current_bssid)
       continue;
 
 #if ESPHOME_LOG_LEVEL >= ESPHOME_LOG_LEVEL_VERBOSE

esphome/components/wifi/wifi_component.h

@@ -172,12 +172,67 @@ template<typename T> using wifi_scan_vector_t = std::vector<T>;
 template<typename T> using wifi_scan_vector_t = FixedVector<T>;
 #endif
 
+/// 20-byte string: 18 chars inline + null, heap for longer. Always null-terminated.
+/// Used internally for WiFi SSID/password storage to reduce heap fragmentation.
+class CompactString {
+ public:
+  static constexpr uint8_t MAX_LENGTH = 127;
+  static constexpr uint8_t INLINE_CAPACITY = 18;  // 18 chars + null terminator fits in 19 bytes
+
+  CompactString() : length_(0), is_heap_(0) { this->storage_[0] = '\0'; }
+  CompactString(const char *str, size_t len);
+  CompactString(const CompactString &other);
+  CompactString(CompactString &&other) noexcept;
+  CompactString &operator=(const CompactString &other);
+  CompactString &operator=(CompactString &&other) noexcept;
+  ~CompactString();
+
+  const char *data() const { return this->is_heap_ ? this->get_heap_ptr_() : this->storage_; }
+  const char *c_str() const { return this->data(); }  // Always null-terminated
+  size_t size() const { return this->length_; }
+  bool empty() const { return this->length_ == 0; }
+
+  /// Return a StringRef view of this string (zero-copy)
+  StringRef ref() const { return StringRef(this->data(), this->size()); }
+
+  bool operator==(const CompactString &other) const;
+  bool operator!=(const CompactString &other) const { return !(*this == other); }
+  bool operator==(const StringRef &other) const;
+  bool operator!=(const StringRef &other) const { return !(*this == other); }
+  bool operator==(const char *other) const { return *this == StringRef(other); }
+  bool operator!=(const char *other) const { return !(*this == other); }
+
+ protected:
+  char *get_heap_ptr_() const {
+    char *ptr;
+    std::memcpy(&ptr, this->storage_, sizeof(ptr));
+    return ptr;
+  }
+  void set_heap_ptr_(char *ptr) { std::memcpy(this->storage_, &ptr, sizeof(ptr)); }
+
+  // Storage for string data. When is_heap_=0, contains the string directly (null-terminated).
+  // When is_heap_=1, first sizeof(char*) bytes contain pointer to heap allocation.
+  char storage_[INLINE_CAPACITY + 1];  // 19 bytes: 18 chars + null terminator
+  uint8_t length_ : 7;                 // String length (0-127)
+  uint8_t is_heap_ : 1;                // 1 if using heap pointer, 0 if using inline storage
+  // Total size: 20 bytes (19 bytes storage + 1 byte bitfields)
+};
+
+static_assert(sizeof(CompactString) == 20, "CompactString must be exactly 20 bytes");
+
 class WiFiAP {
+  friend class WiFiComponent;
+  friend class WiFiScanResult;
+
  public:
   void set_ssid(const std::string &ssid);
+  void set_ssid(const char *ssid);
+  void set_ssid(StringRef ssid) { this->ssid_ = CompactString(ssid.c_str(), ssid.size()); }
   void set_bssid(const bssid_t &bssid);
   void clear_bssid();
   void set_password(const std::string &password);
+  void set_password(const char *password);
+  void set_password(StringRef password) { this->password_ = CompactString(password.c_str(), password.size()); }
 #ifdef USE_WIFI_WPA2_EAP
   void set_eap(optional<EAPAuth> eap_auth);
 #endif  // USE_WIFI_WPA2_EAP
@@ -188,10 +243,10 @@ class WiFiAP {
   void set_manual_ip(optional<ManualIP> manual_ip);
 #endif
   void set_hidden(bool hidden);
-  const std::string &get_ssid() const;
+  StringRef get_ssid() const { return this->ssid_.ref(); }
+  StringRef get_password() const { return this->password_.ref(); }
   const bssid_t &get_bssid() const;
   bool has_bssid() const;
-  const std::string &get_password() const;
 #ifdef USE_WIFI_WPA2_EAP
   const optional<EAPAuth> &get_eap() const;
 #endif  // USE_WIFI_WPA2_EAP
@@ -204,8 +259,8 @@ class WiFiAP {
   bool get_hidden() const;
 
  protected:
-  std::string ssid_;
-  std::string password_;
+  CompactString ssid_;
+  CompactString password_;
 #ifdef USE_WIFI_WPA2_EAP
   optional<EAPAuth> eap_;
 #endif  // USE_WIFI_WPA2_EAP
@@ -220,15 +275,18 @@ class WiFiAP {
 };
 
 class WiFiScanResult {
+  friend class WiFiComponent;
+
  public:
-  WiFiScanResult(const bssid_t &bssid, std::string ssid, uint8_t channel, int8_t rssi, bool with_auth, bool is_hidden);
+  WiFiScanResult(const bssid_t &bssid, const char *ssid, size_t ssid_len, uint8_t channel, int8_t rssi, bool with_auth,
+                 bool is_hidden);
 
   bool matches(const WiFiAP &config) const;
 
   bool get_matches() const;
   void set_matches(bool matches);
   const bssid_t &get_bssid() const;
-  const std::string &get_ssid() const;
+  StringRef get_ssid() const { return this->ssid_.ref(); }
   uint8_t get_channel() const;
   int8_t get_rssi() const;
   bool get_with_auth() const;
@@ -242,7 +300,7 @@ class WiFiScanResult {
   bssid_t bssid_;
   uint8_t channel_;
   int8_t rssi_;
-  std::string ssid_;
+  CompactString ssid_;
   int8_t priority_{0};
   bool matches_{false};
   bool with_auth_;
@@ -381,6 +439,8 @@ class WiFiComponent : public Component {
   void set_passive_scan(bool passive);
 
   void save_wifi_sta(const std::string &ssid, const std::string &password);
+  void save_wifi_sta(const char *ssid, const char *password);
+  void save_wifi_sta(StringRef ssid, StringRef password) { this->save_wifi_sta(ssid.c_str(), password.c_str()); }
 
   // ========== INTERNAL METHODS ==========
   // (In most use cases you won't need these)
@@ -545,7 +605,7 @@ class WiFiComponent : public Component {
   int8_t find_first_non_hidden_index_() const;
   /// Check if an SSID was seen in the most recent scan results
   /// Used to skip hidden mode for SSIDs we know are visible
-  bool ssid_was_seen_in_scan_(const std::string &ssid) const;
+  bool ssid_was_seen_in_scan_(const CompactString &ssid) const;
   /// Check if full scan results are needed (captive portal active, improv, listeners)
   bool needs_full_scan_results_() const;
   /// Check if network matches any configured network (for scan result filtering)

esphome/components/wifi/wifi_component_esp8266.cpp

@@ -247,16 +247,16 @@ bool WiFiComponent::wifi_sta_connect_(const WiFiAP &ap) {
 
   struct station_config conf {};
   memset(&conf, 0, sizeof(conf));
-  if (ap.get_ssid().size() > sizeof(conf.ssid)) {
+  if (ap.ssid_.size() > sizeof(conf.ssid)) {
     ESP_LOGE(TAG, "SSID too long");
     return false;
   }
-  if (ap.get_password().size() > sizeof(conf.password)) {
+  if (ap.password_.size() > sizeof(conf.password)) {
     ESP_LOGE(TAG, "Password too long");
     return false;
   }
-  memcpy(reinterpret_cast<char *>(conf.ssid), ap.get_ssid().c_str(), ap.get_ssid().size());
-  memcpy(reinterpret_cast<char *>(conf.password), ap.get_password().c_str(), ap.get_password().size());
+  memcpy(reinterpret_cast<char *>(conf.ssid), ap.ssid_.c_str(), ap.ssid_.size());
+  memcpy(reinterpret_cast<char *>(conf.password), ap.password_.c_str(), ap.password_.size());
 
   if (ap.has_bssid()) {
     conf.bssid_set = 1;
@@ -266,7 +266,7 @@ bool WiFiComponent::wifi_sta_connect_(const WiFiAP &ap) {
   }
 
 #if USE_ARDUINO_VERSION_CODE >= VERSION_CODE(2, 4, 0)
-  if (ap.get_password().empty()) {
+  if (ap.password_.empty()) {
     conf.threshold.authmode = AUTH_OPEN;
   } else {
     // Set threshold based on configured minimum auth mode
@@ -738,8 +738,8 @@ void WiFiComponent::wifi_scan_done_callback_(void *arg, STATUS status) {
     const char *ssid_cstr = reinterpret_cast<const char *>(it->ssid);
     if (needs_full || this->matches_configured_network_(ssid_cstr, it->bssid)) {
       this->scan_result_.emplace_back(
-          bssid_t{it->bssid[0], it->bssid[1], it->bssid[2], it->bssid[3], it->bssid[4], it->bssid[5]},
-          std::string(ssid_cstr, it->ssid_len), it->channel, it->rssi, it->authmode != AUTH_OPEN, it->is_hidden != 0);
+          bssid_t{it->bssid[0], it->bssid[1], it->bssid[2], it->bssid[3], it->bssid[4], it->bssid[5]}, ssid_cstr,
+          it->ssid_len, it->channel, it->rssi, it->authmode != AUTH_OPEN, it->is_hidden != 0);
     } else {
       this->log_discarded_scan_result_(ssid_cstr, it->bssid, it->rssi, it->channel);
     }
@@ -832,27 +832,27 @@ bool WiFiComponent::wifi_start_ap_(const WiFiAP &ap) {
     return false;
 
   struct softap_config conf {};
-  if (ap.get_ssid().size() > sizeof(conf.ssid)) {
+  if (ap.ssid_.size() > sizeof(conf.ssid)) {
     ESP_LOGE(TAG, "AP SSID too long");
     return false;
   }
-  memcpy(reinterpret_cast<char *>(conf.ssid), ap.get_ssid().c_str(), ap.get_ssid().size());
-  conf.ssid_len = static_cast<uint8>(ap.get_ssid().size());
+  memcpy(reinterpret_cast<char *>(conf.ssid), ap.ssid_.c_str(), ap.ssid_.size());
+  conf.ssid_len = static_cast<uint8>(ap.ssid_.size());
   conf.channel = ap.has_channel() ? ap.get_channel() : 1;
   conf.ssid_hidden = ap.get_hidden();
   conf.max_connection = 5;
   conf.beacon_interval = 100;
 
-  if (ap.get_password().empty()) {
+  if (ap.password_.empty()) {
     conf.authmode = AUTH_OPEN;
     *conf.password = 0;
   } else {
     conf.authmode = AUTH_WPA2_PSK;
-    if (ap.get_password().size() > sizeof(conf.password)) {
+    if (ap.password_.size() > sizeof(conf.password)) {
       ESP_LOGE(TAG, "AP password too long");
       return false;
     }
-    memcpy(reinterpret_cast<char *>(conf.password), ap.get_password().c_str(), ap.get_password().size());
+    memcpy(reinterpret_cast<char *>(conf.password), ap.password_.c_str(), ap.password_.size());
   }
 
   ETS_UART_INTR_DISABLE();

esphome/components/wifi/wifi_component_esp_idf.cpp

@@ -300,19 +300,19 @@ bool WiFiComponent::wifi_sta_connect_(const WiFiAP &ap) {
   // https://docs.espressif.com/projects/esp-idf/en/latest/esp32/api-reference/network/esp_wifi.html#_CPPv417wifi_sta_config_t
   wifi_config_t conf;
   memset(&conf, 0, sizeof(conf));
-  if (ap.get_ssid().size() > sizeof(conf.sta.ssid)) {
+  if (ap.ssid_.size() > sizeof(conf.sta.ssid)) {
     ESP_LOGE(TAG, "SSID too long");
     return false;
   }
-  if (ap.get_password().size() > sizeof(conf.sta.password)) {
+  if (ap.password_.size() > sizeof(conf.sta.password)) {
     ESP_LOGE(TAG, "Password too long");
     return false;
   }
-  memcpy(reinterpret_cast<char *>(conf.sta.ssid), ap.get_ssid().c_str(), ap.get_ssid().size());
-  memcpy(reinterpret_cast<char *>(conf.sta.password), ap.get_password().c_str(), ap.get_password().size());
+  memcpy(reinterpret_cast<char *>(conf.sta.ssid), ap.ssid_.c_str(), ap.ssid_.size());
+  memcpy(reinterpret_cast<char *>(conf.sta.password), ap.password_.c_str(), ap.password_.size());
 
   // The weakest authmode to accept in the fast scan mode
-  if (ap.get_password().empty()) {
+  if (ap.password_.empty()) {
     conf.sta.threshold.authmode = WIFI_AUTH_OPEN;
   } else {
     // Set threshold based on configured minimum auth mode
@@ -864,8 +864,7 @@ void WiFiComponent::wifi_process_event_(IDFWiFiEvent *data) {
       if (needs_full || this->matches_configured_network_(ssid_cstr, record.bssid)) {
         bssid_t bssid;
         std::copy(record.bssid, record.bssid + 6, bssid.begin());
-        std::string ssid(ssid_cstr);
-        this->scan_result_.emplace_back(bssid, std::move(ssid), record.primary, record.rssi,
+        this->scan_result_.emplace_back(bssid, ssid_cstr, strlen(ssid_cstr), record.primary, record.rssi,
                                         record.authmode != WIFI_AUTH_OPEN, ssid_cstr[0] == '\0');
       } else {
         this->log_discarded_scan_result_(ssid_cstr, record.bssid, record.rssi, record.primary);
@@ -1055,26 +1054,26 @@ bool WiFiComponent::wifi_start_ap_(const WiFiAP &ap) {
 
   wifi_config_t conf;
   memset(&conf, 0, sizeof(conf));
-  if (ap.get_ssid().size() > sizeof(conf.ap.ssid)) {
+  if (ap.ssid_.size() > sizeof(conf.ap.ssid)) {
     ESP_LOGE(TAG, "AP SSID too long");
     return false;
   }
-  memcpy(reinterpret_cast<char *>(conf.ap.ssid), ap.get_ssid().c_str(), ap.get_ssid().size());
+  memcpy(reinterpret_cast<char *>(conf.ap.ssid), ap.ssid_.c_str(), ap.ssid_.size());
   conf.ap.channel = ap.has_channel() ? ap.get_channel() : 1;
-  conf.ap.ssid_hidden = ap.get_ssid().size();
+  conf.ap.ssid_hidden = ap.get_hidden();
   conf.ap.max_connection = 5;
   conf.ap.beacon_interval = 100;
 
-  if (ap.get_password().empty()) {
+  if (ap.password_.empty()) {
     conf.ap.authmode = WIFI_AUTH_OPEN;
     *conf.ap.password = 0;
   } else {
     conf.ap.authmode = WIFI_AUTH_WPA2_PSK;
-    if (ap.get_password().size() > sizeof(conf.ap.password)) {
+    if (ap.password_.size() > sizeof(conf.ap.password)) {
       ESP_LOGE(TAG, "AP password too long");
       return false;
     }
-    memcpy(reinterpret_cast<char *>(conf.ap.password), ap.get_password().c_str(), ap.get_password().size());
+    memcpy(reinterpret_cast<char *>(conf.ap.password), ap.password_.c_str(), ap.password_.size());
   }
 
   // pairwise cipher of SoftAP, group cipher will be derived using this.

esphome/components/wifi/wifi_component_libretiny.cpp

@@ -193,7 +193,7 @@ bool WiFiComponent::wifi_sta_connect_(const WiFiAP &ap) {
     return false;
 
   String ssid = WiFi.SSID();
-  if (ssid && strcmp(ssid.c_str(), ap.get_ssid().c_str()) != 0) {
+  if (ssid && strcmp(ssid.c_str(), ap.ssid_.c_str()) != 0) {
     WiFi.disconnect();
   }
 
@@ -213,7 +213,7 @@ bool WiFiComponent::wifi_sta_connect_(const WiFiAP &ap) {
   s_sta_state = LTWiFiSTAState::CONNECTING;
   s_ignored_disconnect_count = 0;
 
-  WiFiStatus status = WiFi.begin(ap.get_ssid().c_str(), ap.get_password().empty() ? NULL : ap.get_password().c_str(),
+  WiFiStatus status = WiFi.begin(ap.ssid_.c_str(), ap.password_.empty() ? NULL : ap.password_.c_str(),
                                  ap.get_channel(),  // 0 = auto
                                  ap.has_bssid() ? ap.get_bssid().data() : NULL);
   if (status != WL_CONNECTED) {
@@ -688,7 +688,7 @@ void WiFiComponent::wifi_scan_done_callback_() {
       auto &ap = scan->ap[i];
       this->scan_result_.emplace_back(bssid_t{ap.bssid.addr[0], ap.bssid.addr[1], ap.bssid.addr[2], ap.bssid.addr[3],
                                               ap.bssid.addr[4], ap.bssid.addr[5]},
-                                      std::string(ssid_cstr), ap.channel, ap.rssi, ap.auth != WIFI_AUTH_OPEN,
+                                      ssid_cstr, strlen(ssid_cstr), ap.channel, ap.rssi, ap.auth != WIFI_AUTH_OPEN,
                                       ssid_cstr[0] == '\0');
     } else {
       auto &ap = scan->ap[i];
@@ -735,7 +735,7 @@ bool WiFiComponent::wifi_start_ap_(const WiFiAP &ap) {
 
   yield();
 
-  return WiFi.softAP(ap.get_ssid().c_str(), ap.get_password().empty() ? NULL : ap.get_password().c_str(),
+  return WiFi.softAP(ap.ssid_.c_str(), ap.password_.empty() ? NULL : ap.password_.c_str(),
                      ap.has_channel() ? ap.get_channel() : 1, ap.get_hidden());
 }
 

esphome/components/wifi/wifi_component_pico_w.cpp

@@ -78,7 +78,7 @@ bool WiFiComponent::wifi_sta_connect_(const WiFiAP &ap) {
     return false;
 #endif
 
-  auto ret = WiFi.begin(ap.get_ssid().c_str(), ap.get_password().c_str());
+  auto ret = WiFi.begin(ap.ssid_.c_str(), ap.password_.c_str());
   if (ret != WL_CONNECTED)
     return false;
 
@@ -149,9 +149,8 @@ void WiFiComponent::wifi_scan_result(void *env, const cyw43_ev_scan_result_t *re
 
   bssid_t bssid;
   std::copy(result->bssid, result->bssid + 6, bssid.begin());
-  std::string ssid(ssid_cstr);
-  WiFiScanResult res(bssid, std::move(ssid), result->channel, result->rssi, result->auth_mode != CYW43_AUTH_OPEN,
-                     ssid_cstr[0] == '\0');
+  WiFiScanResult res(bssid, ssid_cstr, strlen(ssid_cstr), result->channel, result->rssi,
+                     result->auth_mode != CYW43_AUTH_OPEN, ssid_cstr[0] == '\0');
   if (std::find(this->scan_result_.begin(), this->scan_result_.end(), res) == this->scan_result_.end()) {
     this->scan_result_.push_back(res);
   }
@@ -204,7 +203,7 @@ bool WiFiComponent::wifi_start_ap_(const WiFiAP &ap) {
   }
 #endif
 
-  WiFi.beginAP(ap.get_ssid().c_str(), ap.get_password().c_str(), ap.has_channel() ? ap.get_channel() : 1);
+  WiFi.beginAP(ap.ssid_.c_str(), ap.password_.c_str(), ap.has_channel() ? ap.get_channel() : 1);
 
   return true;
 }

esphome/components/wifi_info/wifi_info_text_sensor.cpp

@@ -89,7 +89,7 @@ void ScanResultsWiFiInfo::on_wifi_scan_results(const wifi::wifi_scan_vector_t<wi
   for (const auto &scan : results) {
     if (scan.get_is_hidden())
       continue;
-    const std::string &ssid = scan.get_ssid();
+    const auto &ssid = scan.get_ssid();
     // Max space: ssid + ": " (2) + "-128" (4) + "dB\n" (3) = ssid + 9
     if (ptr + ssid.size() + 9 > end)
       break;

esphome/components/zigbee/zigbee_zephyr.cpp

@@ -61,11 +61,19 @@ void ZigbeeComponent::zboss_signal_handler_esphome(zb_bufid_t bufid) {
       break;
   }
 
+  auto before = millis();
   auto err = zigbee_default_signal_handler(bufid);
   if (err != RET_OK) {
     ESP_LOGE(TAG, "Zigbee_default_signal_handler ERROR %u [%s]", err, zb_error_to_string_get(err));
   }
 
+  if (sig == ZB_COMMON_SIGNAL_CAN_SLEEP) {
+    this->sleep_remainder_ += millis() - before;
+    uint32_t seconds = this->sleep_remainder_ / 1000;
+    this->sleep_remainder_ -= seconds * 1000;
+    this->sleep_time_ += seconds;
+  }
+
   switch (sig) {
     case ZB_BDB_SIGNAL_STEERING:
       ESP_LOGD(TAG, "ZB_BDB_SIGNAL_STEERING, status: %d", status);
@@ -213,6 +221,7 @@ void ZigbeeComponent::dump_config() {
                 "Zigbee\n"
                 "  Wipe on boot: %s\n"
                 "  Device is joined to the network: %s\n"
+                "  Sleep time: %us\n"
                 "  Current channel: %d\n"
                 "  Current page: %d\n"
                 "  Sleep threshold: %ums\n"
@@ -221,9 +230,9 @@ void ZigbeeComponent::dump_config() {
                 "  Short addr: 0x%04X\n"
                 "  Long pan id: 0x%s\n"
                 "  Short pan id: 0x%04X",
-                get_wipe_on_boot(), YESNO(zb_zdo_joined()), zb_get_current_channel(), zb_get_current_page(),
-                zb_get_sleep_threshold(), role(), ieee_addr_buf, zb_get_short_address(), extended_pan_id_buf,
-                zb_get_pan_id());
+                get_wipe_on_boot(), YESNO(zb_zdo_joined()), this->sleep_time_, zb_get_current_channel(),
+                zb_get_current_page(), zb_get_sleep_threshold(), role(), ieee_addr_buf, zb_get_short_address(),
+                extended_pan_id_buf, zb_get_pan_id());
   dump_reporting_();
 }
 

esphome/components/zigbee/zigbee_zephyr.h

@@ -92,6 +92,8 @@ class ZigbeeComponent : public Component {
   CallbackManager<void()> join_cb_;
   Trigger<> join_trigger_;
   bool force_report_{false};
+  uint32_t sleep_time_{};
+  uint32_t sleep_remainder_{};
 };
 
 class ZigbeeEntity {

esphome/core/application.cpp

@@ -609,15 +609,6 @@ void Application::unregister_socket_fd(int fd) {
   }
 }
 
-bool Application::is_socket_ready(int fd) const {
-  // This function is thread-safe for reading the result of select()
-  // However, it should only be called after select() has been executed in the main loop
-  // The read_fds_ is only modified by select() in the main loop
-  if (fd < 0 || fd >= FD_SETSIZE)
-    return false;
-
-  return FD_ISSET(fd, &this->read_fds_);
-}
 #endif
 
 void Application::yield_with_select_(uint32_t delay_ms) {

esphome/core/application.h

@@ -94,6 +94,9 @@
 #ifdef USE_INFRARED
 #include "esphome/components/infrared/infrared.h"
 #endif
+#ifdef USE_SERIAL_PROXY
+#include "esphome/components/serial_proxy/serial_proxy.h"
+#endif
 #ifdef USE_EVENT
 #include "esphome/components/event/event.h"
 #endif
@@ -101,6 +104,10 @@
 #include "esphome/components/update/update_entity.h"
 #endif
 
+namespace esphome::socket {
+class Socket;
+}  // namespace esphome::socket
+
 namespace esphome {
 
 // Teardown timeout constant (in milliseconds)
@@ -230,6 +237,13 @@ class Application {
   void register_infrared(infrared::Infrared *infrared) { this->infrareds_.push_back(infrared); }
 #endif
 
+#ifdef USE_SERIAL_PROXY
+  void register_serial_proxy(serial_proxy::SerialProxy *proxy) {
+    proxy->set_instance_index(this->serial_proxies_.size());
+    this->serial_proxies_.push_back(proxy);
+  }
+#endif
+
 #ifdef USE_EVENT
   void register_event(event::Event *event) { this->events_.push_back(event); }
 #endif
@@ -469,6 +483,10 @@ class Application {
   GET_ENTITY_METHOD(infrared::Infrared, infrared, infrareds)
 #endif
 
+#ifdef USE_SERIAL_PROXY
+  auto &get_serial_proxies() const { return this->serial_proxies_; }
+#endif
+
 #ifdef USE_EVENT
   auto &get_events() const { return this->events_; }
   GET_ENTITY_METHOD(event::Event, event, events)
@@ -491,7 +509,8 @@ class Application {
   void unregister_socket_fd(int fd);
   /// Check if there's data available on a socket without blocking
   /// This function is thread-safe for reading, but should be called after select() has run
-  bool is_socket_ready(int fd) const;
+  /// The read_fds_ is only modified by select() in the main loop
+  bool is_socket_ready(int fd) const { return fd >= 0 && this->is_socket_ready_(fd); }
 
 #ifdef USE_WAKE_LOOP_THREADSAFE
   /// Wake the main event loop from a FreeRTOS task
@@ -503,6 +522,15 @@ class Application {
 
  protected:
   friend Component;
+  friend class socket::Socket;
+
+#ifdef USE_SOCKET_SELECT_SUPPORT
+  /// Fast path for Socket::ready() via friendship - skips negative fd check.
+  /// Safe because: fd was validated in register_socket_fd() at registration time,
+  /// and Socket::ready() only calls this when loop_monitored_ is true (registration succeeded).
+  /// FD_ISSET may include its own upper bounds check depending on platform.
+  bool is_socket_ready_(int fd) const { return FD_ISSET(fd, &this->read_fds_); }
+#endif
 
   void register_component_(Component *comp);
 
@@ -676,6 +704,9 @@ class Application {
 #ifdef USE_INFRARED
   StaticVector<infrared::Infrared *, ESPHOME_ENTITY_INFRARED_COUNT> infrareds_{};
 #endif
+#ifdef USE_SERIAL_PROXY
+  std::vector<serial_proxy::SerialProxy *> serial_proxies_{};
+#endif
 #ifdef USE_UPDATE
   StaticVector<update::UpdateEntity *, ESPHOME_ENTITY_UPDATE_COUNT> updates_{};
 #endif

esphome/core/defines.h

@@ -14,6 +14,7 @@
 #define ESPHOME_PROJECT_VERSION_30 "v2"
 #define ESPHOME_VARIANT "ESP32"
 #define ESPHOME_DEBUG_SCHEDULER
+#define ESPHOME_DEBUG_API
 
 // Default threading model for static analysis (ESP32 is multi-threaded with atomics)
 #define ESPHOME_THREAD_MULTI_ATOMICS
@@ -108,6 +109,7 @@
 #define USE_SAFE_MODE_CALLBACK
 #define USE_SELECT
 #define USE_SENSOR
+#define USE_SERIAL_PROXY
 #define USE_STATUS_LED
 #define USE_STATUS_SENSOR
 #define USE_SWITCH

tests/components/serial_proxy/common.yaml

@@ -0,0 +1,8 @@
+wifi:
+  ssid: MySSID
+  password: password1
+
+api:
+
+serial_proxy:
+  - id: serial_proxy_1

tests/components/serial_proxy/test.esp32-idf.yaml

@@ -0,0 +1,8 @@
+substitutions:
+  tx_pin: GPIO4
+  rx_pin: GPIO5
+
+packages:
+  uart: !include ../../test_build_components/common/uart/esp32-idf.yaml
+
+<<: !include common.yaml

tests/components/serial_proxy/test.esp8266-ard.yaml

@@ -0,0 +1,8 @@
+substitutions:
+  tx_pin: GPIO0
+  rx_pin: GPIO2
+
+packages:
+  uart: !include ../../test_build_components/common/uart/esp8266-ard.yaml
+
+<<: !include common.yaml

tests/components/serial_proxy/test.rp2040-ard.yaml

@@ -0,0 +1,8 @@
+substitutions:
+  tx_pin: GPIO4
+  rx_pin: GPIO5
+
+packages:
+  uart: !include ../../test_build_components/common/uart/rp2040-ard.yaml
+
+<<: !include common.yaml

tests/integration/conftest.py

@@ -197,6 +197,7 @@ async def yaml_config(request: pytest.FixtureRequest, unused_tcp_port: int) -> s
             "  platformio_options:\n"
             "    build_flags:\n"
             '      - "-DDEBUG"  # Enable assert() statements\n'
+            '      - "-DESPHOME_DEBUG_API"  # Enable API protocol asserts\n'
             '      - "-g"       # Add debug symbols',
         )