dmellok/tesserae v0.364.4

on GitHub

Fixed

• The colour-calibration buttons on a device card did nothing. Send and the answer buttons
  sat inside the card's combined-save form, and a browser drops a nested form start tag while
  another form is open, so those buttons submitted the save instead and no calibration card was
  ever pushed to the panel. The combined form is now an empty element above the tabs, with its
  inputs and the calibration buttons attached to it by name, so no form on the page nests inside
  another.

[0.364.2], 2026-08-25

Fixed

• A calendar test failed depending on what time of day CI ran. calendar_day shows only
  events on the current date, and its fixtures placed them at "now plus one to five hours", so
  a run late in the evening pushed most of them past midnight and the day view correctly
  dropped them. Anchored to midday in the app's own timezone instead, which is the same date
  whatever the hour.

[0.364.1], 2026-08-25

Fixed

• A saved secret that can no longer be decrypted now says so, instead of looking like it was
  never entered. Tesserae encrypts secrets at rest. If the encryption key changes, which is
  what a recreated container or a restored data folder does when TESSERAE_SECRET_KEY isn't
  pinned, the stored value can't be read and every runtime read gets an empty string. That is
  deliberate, so one stale value can't take a whole settings section down with it, but the
  admin UI still showed the field masked as though a working secret were saved, and widgets
  reported "Home Assistant is not configured" to people who had configured it.

  The settings form now leaves such a field empty, marks it "Re-enter to repair", and explains
  what happened. Home Assistant widgets say the token can no longer be decrypted and where to
  fix it, rather than claiming nothing was set up. A missing token is also now distinguished
  from a completely unconfigured install.

  Nothing else is affected by the key change: URLs, dashboards and every non-secret setting are
  stored in the clear and survive. Re-entering the secret repairs it.

[0.364.0], 2026-08-25

Added

• You can talk back to the agent from the editor. The rail narrated what the agent was
  doing and gave you no way to answer it, so noticing a build going the wrong way meant
  switching to wherever the agent was running and typing there.

  The rail's header now carries a reply button. Type a note, press Enter, and it reaches the
  agent on its very next call, which during a build is a second or two. There is no way to do
  better than that and it is worth knowing why: MCP is driven entirely by the client, so a
  server can never push anything into a model's context. The only channel is the return value
  of a call the agent was going to make anyway, which is exactly what this rides on.

  Off unless you open it, and the choice sticks per browser. The button only appears when the
  mcp experiment is on, so an install with no agent shows no dead control. Notes are queued
  in memory, capped at eight, and delivered once each: a note repeated back to a model reads
  as you saying it twice. Posting one needs an admin session, since the MCP token authorises
  the agent and this is the human going the other way.