[dsmr] Avoid std::string allocation for decryption key

Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>

esphome/__main__.py

@@ -1,5 +1,6 @@
 # PYTHON_ARGCOMPLETE_OK
 import argparse
+from collections.abc import Callable
 from datetime import datetime
 import functools
 import getpass
@@ -936,11 +937,21 @@ def command_dashboard(args: ArgsProtocol) -> int | None:
     return dashboard.start_dashboard(args)
 
 
-def command_update_all(args: ArgsProtocol) -> int | None:
+def run_multiple_configs(
+    files: list, command_builder: Callable[[str], list[str]]
+) -> int:
+    """Run a command for each configuration file in a subprocess.
+
+    Args:
+        files: List of configuration files to process.
+        command_builder: Callable that takes a file path and returns a command list.
+
+    Returns:
+        Number of failed files.
+    """
     import click
 
     success = {}
-    files = list_yaml_files(args.configuration)
     twidth = 60
 
     def print_bar(middle_text):
@@ -950,17 +961,19 @@ def command_update_all(args: ArgsProtocol) -> int | None:
         safe_print(f"{half_line}{middle_text}{half_line}")
 
     for f in files:
-        safe_print(f"Updating {color(AnsiFore.CYAN, str(f))}")
+        f_path = Path(f) if not isinstance(f, Path) else f
+
+        if any(f_path.name == x for x in SECRETS_FILES):
+            _LOGGER.warning("Skipping secrets file %s", f_path)
+            continue
+
+        safe_print(f"Processing {color(AnsiFore.CYAN, str(f))}")
         safe_print("-" * twidth)
         safe_print()
-        if CORE.dashboard:
-            rc = run_external_process(
-                "esphome", "--dashboard", "run", f, "--no-logs", "--device", "OTA"
-            )
-        else:
-            rc = run_external_process(
-                "esphome", "run", f, "--no-logs", "--device", "OTA"
-            )
+
+        cmd = command_builder(f)
+        rc = run_external_process(*cmd)
+
         if rc == 0:
             print_bar(f"[{color(AnsiFore.BOLD_GREEN, 'SUCCESS')}] {str(f)}")
             success[f] = True
@@ -975,6 +988,8 @@ def command_update_all(args: ArgsProtocol) -> int | None:
     print_bar(f"[{color(AnsiFore.BOLD_WHITE, 'SUMMARY')}]")
     failed = 0
     for f in files:
+        if f not in success:
+            continue  # Skipped file
         if success[f]:
             safe_print(f"  - {str(f)}: {color(AnsiFore.GREEN, 'SUCCESS')}")
         else:
@@ -983,6 +998,17 @@ def command_update_all(args: ArgsProtocol) -> int | None:
     return failed
 
 
+def command_update_all(args: ArgsProtocol) -> int | None:
+    files = list_yaml_files(args.configuration)
+
+    def build_command(f):
+        if CORE.dashboard:
+            return ["esphome", "--dashboard", "run", f, "--no-logs", "--device", "OTA"]
+        return ["esphome", "run", f, "--no-logs", "--device", "OTA"]
+
+    return run_multiple_configs(files, build_command)
+
+
 def command_idedata(args: ArgsProtocol, config: ConfigType) -> int:
     import json
 
@@ -1533,38 +1559,48 @@ def run_esphome(argv):
 
     _LOGGER.info("ESPHome %s", const.__version__)
 
-    for conf_path in args.configuration:
-        conf_path = Path(conf_path)
-        if any(conf_path.name == x for x in SECRETS_FILES):
-            _LOGGER.warning("Skipping secrets file %s", conf_path)
-            continue
+    # Multiple configurations: use subprocesses to avoid state leakage
+    # between compilations (e.g., LVGL touchscreen state in module globals)
+    if len(args.configuration) > 1:
+        # Build command by reusing argv, replacing all configs with single file
+        # argv[0] is the program path, skip it since we prefix with "esphome"
+        def build_command(f):
+            return (
+                ["esphome"]
+                + [arg for arg in argv[1:] if arg not in args.configuration]
+                + [str(f)]
+            )
 
-        CORE.config_path = conf_path
-        CORE.dashboard = args.dashboard
+        return run_multiple_configs(args.configuration, build_command)
 
-        # For logs command, skip updating external components
-        skip_external = args.command == "logs"
-        config = read_config(
-            dict(args.substitution) if args.substitution else {},
-            skip_external_update=skip_external,
-        )
-        if config is None:
-            return 2
-        CORE.config = config
+    # Single configuration
+    conf_path = Path(args.configuration[0])
+    if any(conf_path.name == x for x in SECRETS_FILES):
+        _LOGGER.warning("Skipping secrets file %s", conf_path)
+        return 0
 
-        if args.command not in POST_CONFIG_ACTIONS:
-            safe_print(f"Unknown command {args.command}")
+    CORE.config_path = conf_path
+    CORE.dashboard = args.dashboard
 
-        try:
-            rc = POST_CONFIG_ACTIONS[args.command](args, config)
-        except EsphomeError as e:
-            _LOGGER.error(e, exc_info=args.verbose)
-            return 1
-        if rc != 0:
-            return rc
+    # For logs command, skip updating external components
+    skip_external = args.command == "logs"
+    config = read_config(
+        dict(args.substitution) if args.substitution else {},
+        skip_external_update=skip_external,
+    )
+    if config is None:
+        return 2
+    CORE.config = config
 
-        CORE.reset()
-    return 0
+    if args.command not in POST_CONFIG_ACTIONS:
+        safe_print(f"Unknown command {args.command}")
+        return 1
+
+    try:
+        return POST_CONFIG_ACTIONS[args.command](args, config)
+    except EsphomeError as e:
+        _LOGGER.error(e, exc_info=args.verbose)
+        return 1
 
 
 def main():

esphome/components/am43/am43_base.cpp

@@ -1,6 +1,6 @@
 #include "am43_base.h"
-#include "esphome/core/helpers.h"
 #include <cstring>
+#include <cstdio>
 
 namespace esphome {
 namespace am43 {
@@ -8,9 +8,12 @@ namespace am43 {
 const uint8_t START_PACKET[5] = {0x00, 0xff, 0x00, 0x00, 0x9a};
 
 std::string pkt_to_hex(const uint8_t *data, uint16_t len) {
-  char buf[64];  // format_hex_size(31) = 63, fits 31 bytes of hex data
-  format_hex_to(buf, sizeof(buf), data, len);
-  return buf;
+  char buf[64];
+  memset(buf, 0, 64);
+  for (int i = 0; i < len; i++)
+    sprintf(&buf[i * 2], "%02x", data[i]);
+  std::string ret = buf;
+  return ret;
 }
 
 Am43Packet *Am43Encoder::get_battery_level_request() {

esphome/components/anova/anova_base.cpp

@@ -18,31 +18,31 @@ AnovaPacket *AnovaCodec::clean_packet_() {
 
 AnovaPacket *AnovaCodec::get_read_device_status_request() {
   this->current_query_ = READ_DEVICE_STATUS;
-  sprintf((char *) this->packet_.data, "%s", CMD_READ_DEVICE_STATUS);
+  snprintf((char *) this->packet_.data, sizeof(this->packet_.data), "%s", CMD_READ_DEVICE_STATUS);
   return this->clean_packet_();
 }
 
 AnovaPacket *AnovaCodec::get_read_target_temp_request() {
   this->current_query_ = READ_TARGET_TEMPERATURE;
-  sprintf((char *) this->packet_.data, "%s", CMD_READ_TARGET_TEMP);
+  snprintf((char *) this->packet_.data, sizeof(this->packet_.data), "%s", CMD_READ_TARGET_TEMP);
   return this->clean_packet_();
 }
 
 AnovaPacket *AnovaCodec::get_read_current_temp_request() {
   this->current_query_ = READ_CURRENT_TEMPERATURE;
-  sprintf((char *) this->packet_.data, "%s", CMD_READ_CURRENT_TEMP);
+  snprintf((char *) this->packet_.data, sizeof(this->packet_.data), "%s", CMD_READ_CURRENT_TEMP);
   return this->clean_packet_();
 }
 
 AnovaPacket *AnovaCodec::get_read_unit_request() {
   this->current_query_ = READ_UNIT;
-  sprintf((char *) this->packet_.data, "%s", CMD_READ_UNIT);
+  snprintf((char *) this->packet_.data, sizeof(this->packet_.data), "%s", CMD_READ_UNIT);
   return this->clean_packet_();
 }
 
 AnovaPacket *AnovaCodec::get_read_data_request() {
   this->current_query_ = READ_DATA;
-  sprintf((char *) this->packet_.data, "%s", CMD_READ_DATA);
+  snprintf((char *) this->packet_.data, sizeof(this->packet_.data), "%s", CMD_READ_DATA);
   return this->clean_packet_();
 }
 
@@ -50,25 +50,25 @@ AnovaPacket *AnovaCodec::get_set_target_temp_request(float temperature) {
   this->current_query_ = SET_TARGET_TEMPERATURE;
   if (this->fahrenheit_)
     temperature = ctof(temperature);
-  sprintf((char *) this->packet_.data, CMD_SET_TARGET_TEMP, temperature);
+  snprintf((char *) this->packet_.data, sizeof(this->packet_.data), CMD_SET_TARGET_TEMP, temperature);
   return this->clean_packet_();
 }
 
 AnovaPacket *AnovaCodec::get_set_unit_request(char unit) {
   this->current_query_ = SET_UNIT;
-  sprintf((char *) this->packet_.data, CMD_SET_TEMP_UNIT, unit);
+  snprintf((char *) this->packet_.data, sizeof(this->packet_.data), CMD_SET_TEMP_UNIT, unit);
   return this->clean_packet_();
 }
 
 AnovaPacket *AnovaCodec::get_start_request() {
   this->current_query_ = START;
-  sprintf((char *) this->packet_.data, CMD_START);
+  snprintf((char *) this->packet_.data, sizeof(this->packet_.data), "%s", CMD_START);
   return this->clean_packet_();
 }
 
 AnovaPacket *AnovaCodec::get_stop_request() {
   this->current_query_ = STOP;
-  sprintf((char *) this->packet_.data, CMD_STOP);
+  snprintf((char *) this->packet_.data, sizeof(this->packet_.data), "%s", CMD_STOP);
   return this->clean_packet_();
 }
 

esphome/components/api/api_connection.cpp

@@ -1715,7 +1715,7 @@ void APIConnection::on_home_assistant_state_response(const HomeAssistantStateRes
     // HA state max length is 255 characters, but attributes can be much longer
     // Use stack buffer for common case (states), heap fallback for large attributes
     size_t state_len = msg.state.size();
-    SmallBufferWithHeapFallback<256> state_buf_alloc(state_len + 1);
+    SmallBufferWithHeapFallback<MAX_STATE_LEN + 1> state_buf_alloc(state_len + 1);
     char *state_buf = reinterpret_cast<char *>(state_buf_alloc.get());
     if (state_len > 0) {
       memcpy(state_buf, msg.state.c_str(), state_len);

esphome/components/dsmr/dsmr.cpp

@@ -1,4 +1,5 @@
 #include "dsmr.h"
+#include "esphome/core/helpers.h"
 #include "esphome/core/log.h"
 
 #include <AES.h>
@@ -294,8 +295,8 @@ void Dsmr::dump_config() {
   DSMR_TEXT_SENSOR_LIST(DSMR_LOG_TEXT_SENSOR, )
 }
 
-void Dsmr::set_decryption_key(const std::string &decryption_key) {
-  if (decryption_key.empty()) {
+void Dsmr::set_decryption_key(const char *decryption_key) {
+  if (decryption_key == nullptr || decryption_key[0] == '\0') {
     ESP_LOGI(TAG, "Disabling decryption");
     this->decryption_key_.clear();
     if (this->crypt_telegram_ != nullptr) {
@@ -305,21 +306,14 @@ void Dsmr::set_decryption_key(const std::string &decryption_key) {
     return;
   }
 
-  if (decryption_key.length() != 32) {
-    ESP_LOGE(TAG, "Error, decryption key must be 32 character long");
+  if (!parse_hex(decryption_key, this->decryption_key_, 16)) {
+    ESP_LOGE(TAG, "Error, decryption key must be 32 hex characters");
     return;
   }
-  this->decryption_key_.clear();
 
   ESP_LOGI(TAG, "Decryption key is set");
   // Verbose level prints decryption key
-  ESP_LOGV(TAG, "Using decryption key: %s", decryption_key.c_str());
-
-  char temp[3] = {0};
-  for (int i = 0; i < 16; i++) {
-    strncpy(temp, &(decryption_key.c_str()[i * 2]), 2);
-    this->decryption_key_.push_back(std::strtoul(temp, nullptr, 16));
-  }
+  ESP_LOGV(TAG, "Using decryption key: %s", decryption_key);
 
   if (this->crypt_telegram_ == nullptr) {
     this->crypt_telegram_ = new uint8_t[this->max_telegram_len_];  // NOLINT

esphome/components/dsmr/dsmr.h

@@ -63,7 +63,7 @@ class Dsmr : public Component, public uart::UARTDevice {
 
   void dump_config() override;
 
-  void set_decryption_key(const std::string &decryption_key);
+  void set_decryption_key(const char *decryption_key);
   void set_max_telegram_length(size_t length) { this->max_telegram_len_ = length; }
   void set_request_pin(GPIOPin *request_pin) { this->request_pin_ = request_pin; }
   void set_request_interval(uint32_t interval) { this->request_interval_ = interval; }

esphome/components/lightwaverf/lightwaverf.cpp

@@ -1,4 +1,3 @@
-#include "esphome/core/helpers.h"
 #include "esphome/core/log.h"
 
 #ifdef USE_ESP8266
@@ -45,16 +44,13 @@ void LightWaveRF::send_rx(const std::vector<uint8_t> &msg, uint8_t repeats, bool
 }
 
 void LightWaveRF::print_msg_(uint8_t *msg, uint8_t len) {
-#if ESPHOME_LOG_LEVEL >= ESPHOME_LOG_LEVEL_DEBUG
-  char buffer[65];  // max 10 entries * 6 chars + null
+  char buffer[65];
   ESP_LOGD(TAG, " Received code (len:%i): ", len);
 
-  size_t pos = 0;
   for (int i = 0; i < len; i++) {
-    pos = buf_append_printf(buffer, sizeof(buffer), pos, "0x%02x, ", msg[i]);
+    sprintf(&buffer[i * 6], "0x%02x, ", msg[i]);
   }
   ESP_LOGD(TAG, "[%s]", buffer);
-#endif
 }
 
 void LightWaveRF::dump_config() {

esphome/components/mipi_spi/mipi_spi.h

@@ -224,12 +224,9 @@ class MipiSpi : public display::Display,
                     this->madctl_ & MADCTL_BGR ? "BGR" : "RGB", DISPLAYPIXEL * 8, IS_BIG_ENDIAN ? "Big" : "Little");
     if (this->brightness_.has_value())
       esph_log_config(TAG, "  Brightness: %u", this->brightness_.value());
-    if (this->cs_ != nullptr)
-      esph_log_config(TAG, "  CS Pin: %s", this->cs_->dump_summary().c_str());
-    if (this->reset_pin_ != nullptr)
-      esph_log_config(TAG, "  Reset Pin: %s", this->reset_pin_->dump_summary().c_str());
-    if (this->dc_pin_ != nullptr)
-      esph_log_config(TAG, "  DC Pin: %s", this->dc_pin_->dump_summary().c_str());
+    log_pin(TAG, "  CS Pin: ", this->cs_);
+    log_pin(TAG, "  Reset Pin: ", this->reset_pin_);
+    log_pin(TAG, "  DC Pin: ", this->dc_pin_);
     esph_log_config(TAG,
                     "  SPI Mode: %d\n"
                     "  SPI Data rate: %dMHz\n"

esphome/components/mipi_spi/models/adafruit.py

@@ -26,5 +26,3 @@ ST7789V.extend(
     reset_pin=40,
     invert_colors=True,
 )
-
-models = {}

esphome/components/mipi_spi/models/amoled.py

@@ -105,6 +105,3 @@ CO5300 = DriverChip(
         (WCE, 0x00),
     ),
 )
-
-
-models = {}

esphome/components/mipi_spi/models/cyd.py

@@ -1,10 +1,45 @@
-from .ili import ILI9341
+from .ili import ILI9341, ILI9342, ST7789V
 
 ILI9341.extend(
+    # ESP32-2432S028 CYD board with Micro USB, has ILI9341 controller
     "ESP32-2432S028",
     data_rate="40MHz",
-    cs_pin=15,
-    dc_pin=2,
+    cs_pin={"number": 15, "ignore_strapping_warning": True},
+    dc_pin={"number": 2, "ignore_strapping_warning": True},
 )
 
-models = {}
+ST7789V.extend(
+    # ESP32-2432S028 CYD board with USB C + Micro USB, has ST7789V controller
+    "ESP32-2432S028-7789",
+    data_rate="40MHz",
+    cs_pin={"number": 15, "ignore_strapping_warning": True},
+    dc_pin={"number": 2, "ignore_strapping_warning": True},
+)
+
+# fmt: off
+
+ILI9342.extend(
+    # ESP32-2432S028 CYD board with USB C + Micro USB, has ILI9342 controller
+    "ESP32-2432S028-9342",
+    data_rate="40MHz",
+    cs_pin={"number": 15, "ignore_strapping_warning": True},
+    dc_pin={"number": 2, "ignore_strapping_warning": True},
+    initsequence=(
+        (0xCB, 0x39, 0x2C, 0x00, 0x34, 0x02),  # Power Control A
+        (0xCF, 0x00, 0xC1, 0x30),  # Power Control B
+        (0xE8, 0x85, 0x00, 0x78),  # Driver timing control A
+        (0xEA, 0x00, 0x00),  # Driver timing control B
+        (0xED, 0x64, 0x03, 0x12, 0x81),  # Power on sequence control
+        (0xF7, 0x20),  # Pump ratio control
+        (0xC0, 0x23),  # Power Control 1
+        (0xC1, 0x10),  # Power Control 2
+        (0xC5, 0x3E, 0x28),  # VCOM Control 1
+        (0xC7, 0x86),  # VCOM Control 2
+        (0xB1, 0x00, 0x1B),  # Frame Rate Control
+        (0xB6, 0x0A, 0xA2, 0x27, 0x00),  # Display Function Control
+        (0xF2, 0x00),  # Enable 3G
+        (0x26, 0x01),  # Gamma Set
+        (0xE0, 0x00, 0x0C, 0x11, 0x04, 0x11, 0x08, 0x37, 0x89, 0x4C, 0x06, 0x0C, 0x0A, 0x2E, 0x34, 0x0F),  # Positive Gamma Correction
+        (0xE1, 0x00, 0x0B, 0x11, 0x05, 0x13, 0x09, 0x33, 0x67, 0x48, 0x07, 0x0E, 0x0B, 0x23, 0x33, 0x0F),  # Negative Gamma Correction
+    )
+)

esphome/components/mipi_spi/models/ili.py

@@ -148,6 +148,34 @@ ILI9341 = DriverChip(
         ),
     ),
 )
+
+# fmt: off
+
+ILI9342 = DriverChip(
+    "ILI9342",
+    width=320,
+    height=240,
+    mirror_x=True,
+    initsequence=(
+        (0xCB, 0x39, 0x2C, 0x00, 0x34, 0x02),  # Power Control A
+        (0xCF, 0x00, 0xC1, 0x30),  # Power Control B
+        (0xE8, 0x85, 0x00, 0x78),  # Driver timing control A
+        (0xEA, 0x00, 0x00),  # Driver timing control B
+        (0xED, 0x64, 0x03, 0x12, 0x81),  # Power on sequence control
+        (0xF7, 0x20),  # Pump ratio control
+        (0xC0, 0x23),  # Power Control 1
+        (0xC1, 0x10),  # Power Control 2
+        (0xC5, 0x3E, 0x28),  # VCOM Control 1
+        (0xC7, 0x86),  # VCOM Control 2
+        (0xB1, 0x00, 0x1B),  # Frame Rate Control
+        (0xB6, 0x0A, 0xA2, 0x27, 0x00),  # Display Function Control
+        (0xF2, 0x00),  # Enable 3G
+        (0x26, 0x01),  # Gamma Set
+        (0xE0, 0x0F, 0x1F, 0x1C, 0x0C, 0x0F, 0x08, 0x48, 0x98, 0x37, 0x0A, 0x13, 0x04, 0x11, 0x0D, 0x00),  # Positive Gamma
+        (0xE1, 0x0F, 0x32, 0x2E, 0x0B, 0x0D, 0x05, 0x47, 0x75, 0x37, 0x06, 0x10, 0x03, 0x24, 0x20, 0x00),  # Negative Gamma
+    ),
+)
+
 # M5Stack Core2 uses ILI9341 chip - mirror_x disabled for correct orientation
 ILI9341.extend(
     "M5CORE2",
@@ -758,5 +786,3 @@ ST7796.extend(
     dc_pin=0,
     invert_colors=True,
 )
-
-models = {}

esphome/components/mipi_spi/models/jc.py

@@ -588,5 +588,3 @@ DriverChip(
         (0x29, 0x00),
     ),
 )
-
-models = {}

esphome/components/mipi_spi/models/lanbon.py

@@ -11,5 +11,3 @@ ST7789V.extend(
     dc_pin=21,
     reset_pin=18,
 )
-
-models = {}

esphome/components/mipi_spi/models/lilygo.py

@@ -56,5 +56,3 @@ ST7796.extend(
     backlight_pin=48,
     invert_colors=True,
 )
-
-models = {}

esphome/components/rf_bridge/rf_bridge.cpp

@@ -1,7 +1,6 @@
 #include "rf_bridge.h"
-#include "esphome/core/application.h"
-#include "esphome/core/helpers.h"
 #include "esphome/core/log.h"
+#include "esphome/core/application.h"
 #include <cinttypes>
 #include <cstring>
 
@@ -73,9 +72,9 @@ bool RFBridgeComponent::parse_bridge_byte_(uint8_t byte) {
 
       data.length = raw[2];
       data.protocol = raw[3];
-      char next_byte[3];  // 2 hex chars + null
+      char next_byte[3];
       for (uint8_t i = 0; i < data.length - 1; i++) {
-        buf_append_printf(next_byte, sizeof(next_byte), 0, "%02X", raw[4 + i]);
+        sprintf(next_byte, "%02X", raw[4 + i]);
         data.code += next_byte;
       }
 
@@ -91,10 +90,10 @@ bool RFBridgeComponent::parse_bridge_byte_(uint8_t byte) {
 
       uint8_t buckets = raw[2] << 1;
       std::string str;
-      char next_byte[3];  // 2 hex chars + null
+      char next_byte[3];
 
       for (uint32_t i = 0; i <= at; i++) {
-        buf_append_printf(next_byte, sizeof(next_byte), 0, "%02X", raw[i]);
+        sprintf(next_byte, "%02X", raw[i]);
         str += next_byte;
         if ((i > 3) && buckets) {
           buckets--;

esphome/components/spi_led_strip/spi_led_strip.cpp

@@ -1,5 +1,4 @@
 #include "spi_led_strip.h"
-#include "esphome/core/helpers.h"
 
 namespace esphome {
 namespace spi_led_strip {
@@ -48,14 +47,15 @@ void SpiLedStrip::dump_config() {
 void SpiLedStrip::write_state(light::LightState *state) {
   if (this->is_failed())
     return;
-#if ESPHOME_LOG_LEVEL >= ESPHOME_LOG_LEVEL_VERBOSE
-  {
-    char strbuf[49];  // format_hex_pretty_size(16) = 48, fits 16 bytes
-    size_t len = std::min(this->buffer_size_, (size_t) 16);
-    format_hex_pretty_to(strbuf, sizeof(strbuf), this->buf_, len, ' ');
+  if (ESPHOME_LOG_LEVEL >= ESPHOME_LOG_LEVEL_VERBOSE) {
+    char strbuf[49];
+    size_t len = std::min(this->buffer_size_, (size_t) (sizeof(strbuf) - 1) / 3);
+    memset(strbuf, 0, sizeof(strbuf));
+    for (size_t i = 0; i != len; i++) {
+      sprintf(strbuf + i * 3, "%02X ", this->buf_[i]);
+    }
     esph_log_v(TAG, "write_state: buf = %s", strbuf);
   }
-#endif
   this->enable();
   this->write_array(this->buf_, this->buffer_size_);
   this->disable();

tests/unit_tests/test_main.py

@@ -34,6 +34,7 @@ from esphome.__main__ import (
     has_non_ip_address,
     has_resolvable_address,
     mqtt_get_ip,
+    run_esphome,
     run_miniterm,
     show_logs,
     upload_program,
@@ -1988,7 +1989,7 @@ esp32:
     clean_output = strip_ansi_codes(captured.out)
 
     assert "test-device_123.yaml" in clean_output
-    assert "Updating" in clean_output
+    assert "Processing" in clean_output
     assert "SUCCESS" in clean_output
     assert "SUMMARY" in clean_output
 
@@ -3172,3 +3173,66 @@ def test_run_miniterm_buffer_limit_prevents_unbounded_growth() -> None:
     x_count = printed_line.count("X")
     assert x_count < 150, f"Expected truncation but got {x_count} X's"
     assert x_count == 95, f"Expected 95 X's after truncation but got {x_count}"
+
+
+def test_run_esphome_multiple_configs_with_secrets(
+    tmp_path: Path,
+    mock_run_external_process: Mock,
+    capfd: CaptureFixture[str],
+    caplog: pytest.LogCaptureFixture,
+) -> None:
+    """Test run_esphome with multiple configs and secrets file.
+
+    Verifies:
+    - Multiple configs use subprocess isolation
+    - Secrets files are skipped with warning
+    - Secrets files don't appear in summary
+    """
+    # Create two config files and a secrets file
+    yaml_file1 = tmp_path / "device1.yaml"
+    yaml_file1.write_text("""
+esphome:
+  name: device1
+
+esp32:
+  board: nodemcu-32s
+""")
+    yaml_file2 = tmp_path / "device2.yaml"
+    yaml_file2.write_text("""
+esphome:
+  name: device2
+
+esp32:
+  board: nodemcu-32s
+""")
+    secrets_file = tmp_path / "secrets.yaml"
+    secrets_file.write_text("wifi_password: secret123\n")
+
+    setup_core(tmp_path=tmp_path)
+    mock_run_external_process.return_value = 0
+
+    # run_esphome expects argv[0] to be the program name (gets sliced off by parse_args)
+    with caplog.at_level(logging.WARNING):
+        result = run_esphome(
+            ["esphome", "compile", str(yaml_file1), str(secrets_file), str(yaml_file2)]
+        )
+
+    assert result == 0
+
+    # Check secrets file was skipped with warning
+    assert "Skipping secrets file" in caplog.text
+    assert "secrets.yaml" in caplog.text
+
+    captured = capfd.readouterr()
+    clean_output = strip_ansi_codes(captured.out)
+
+    # Both config files should be processed
+    assert "device1.yaml" in clean_output
+    assert "device2.yaml" in clean_output
+    assert "SUMMARY" in clean_output
+
+    # Secrets should not appear in summary
+    summary_section = (
+        clean_output.split("SUMMARY")[1] if "SUMMARY" in clean_output else ""
+    )
+    assert "secrets.yaml" not in summary_section