Covan 0.4.0

The fourth tagged release: 203 commits and 12 migrations (0066–0077). The agent can drive a real browser now, routines can start from a template and finish on their own, and the chat screen reads as a transcript.

git clone https://github.com/covan-ai/covan
cd covan
cp .env.docker.example .env     # set OPENAI_API_KEY
docker compose pull
docker compose up

Upgrading from 0.3.0 takes the same two commands: docker compose pull, then docker compose up. The migrate service applies the twelve new migrations on the way up. It keeps a ledger, so running it a second time changes nothing.

Both images are published for linux/amd64 and linux/arm64:

• ghcr.io/covan-ai/covan-api:0.4.0
• ghcr.io/covan-ai/covan-web:0.4.0

latest and 0.4 point here too, and edge follows main. To pin this release, set COVAN_VERSION=0.4.0 in .env.

Read this before upgrading

The Supabase account connection is gone (#224). In 0.3.0 you could paste a Supabase Management API token and pick projects from a list. That token opens every project in the account, and there is no way to narrow it. Any connection made that way stops working after this upgrade. A hosted Supabase project can still be connected the same way as any other Postgres: install the covan_query function and connect through PostgREST.

Two new optional variables. BROWSER_USE_API_KEY and BROWSER_USE_BASE_URL turn on the browser tool, and COMPOSIO_API_KEY and COMPOSIO_BASE_URL are now passed through to covan-api. Leave them empty and those features stay off. Nothing else is affected.

What is in this one

A browser the agent can drive (#275, #278, #280). The new browse tool takes one plain-language instruction and runs it in a real browser, for pages http_request cannot reach. The turn ends as soon as the task is handed off and the answer arrives when the task finishes, so waiting on a browser task does not use up the turn's step budget. If a task stops at a login page, Covan gives the person a live browser session to sign in at the site itself, in their own tab, and then runs the task once more at no extra cost. Covan never sees or stores the credential.

Routines you start from a template, and routines that end (#241, #242, #279). A new routine can start from one of three templates instead of an empty form. A routine can finish after a set number of delivered runs, and it then shows as Finished rather than Paused. A routine can also read its own workspace. The first report built on that is a weekly coverage-gap report: the topics the team asked about that no document covered, without naming who asked. Running a routine by hand no longer collides with its scheduled run. Scheduled runs are also told the date and the time zone they run in.

More connected apps (#252, #254, #256, #262, #263, #264). An app that needs only a key you supply can now be connected. Thirty-four apps that need no credential at all, which used to fail on every attempt, now connect. Before asking for a connection, the card says what the app is. Operations the connected account does not have are no longer offered to the agent.

The chat screen as a transcript (#232, #271). Questions and answers now look the way most chat products show them. Each exchange is grouped, and you can see where one ends and the next begins.

Cheaper and better-behaved turns (#226, #227, #233, #234, #244, #246, #247). Six defects behind one $0.58 turn are fixed. The 5,588-token search tool is no longer attached to agents that never search. Every prompt records what it was made of, and every turn is priced by the model that actually answered. Model IDs are defined in one list, and an ID that is not on it is refused.

A turn that sees its limit coming (#223). Before each pass, a chat turn checks how much of the subrequest limit it has left. When it is about to run out, it finishes with a final answer instead of failing partway through with a Connection error.

Smaller fixes. The Slack handler now says when an answer was cut off (#235). A resumed turn is given the same context as a fresh one (#236). Each scheduled run records which model it used and how it ended (#238). An uploaded document is now served with a content type the server works out from the file name, instead of the one the uploader claimed. Before, a file claiming to be text/html could run in the preview on the app's own origin (#273). The README has been rewritten around what the agent can do (#265, #266, #267).

Full changelog: v0.3.0...v0.4.0

Covan 0.3.0

The third tagged release: 181 commits, 18 migrations, agents that can call tools and reach connected apps, retrieval that reads words as well as meaning, a measured 49% cut in what a chat turn costs — and a new licence.

git clone https://github.com/covan-ai/covan
cd covan
cp .env.docker.example .env     # set OPENAI_API_KEY
docker compose pull
docker compose up

Upgrading from 0.2.0 is the same two lines — docker compose pull then docker compose up. The migrate service runs on the way up and applies all eighteen new migrations; it keeps a ledger, so running it again does nothing.

Both images are published for linux/amd64 and linux/arm64:

• ghcr.io/covan-ai/covan-api:0.3.0
• ghcr.io/covan-ai/covan-web:0.3.0

latest and 0.3 point here too; edge follows main. Pin with COVAN_VERSION=0.3.0 in .env.

Read this first: the licence changed

Covan is now FSL-1.1-ALv2 — the Functional Source License, with Apache 2.0 as the future licence. v0.1.0 and v0.2.0 were AGPL-3.0 and stay AGPL-3.0 permanently; that grant is irrevocable and nothing here takes it back. This release and everything after it is FSL.

If you run Covan for your own team, you gained ground rather than lost it. Internal use is now a named permitted purpose: run it, modify it, host it for as many people as you like, commercially, and publish nothing — ever. Under the AGPL that last point depended on reading §13 and reasoning about whether your own employees counted as remote network users. It is written down now instead of inferred.

Paid professional services around somebody else's Covan are also permitted by name, so implementation partners and consultancies are unaffected.

One use is reserved: making Covan available to others in a commercial product or service that substitutes for it — reselling it as hosting. That is the only thing the licence forbids.

Why: the AGPL did not do the job it was chosen for. §13 begins "if you modify the Program", so anyone could host an unmodified Covan commercially and owe nothing at all — no source offer, no notice, not even a link back. The FSF says as much about the AGPL and Service as a Software Substitute. The licence page sets out what changed, and this post walks the cases.

Two-year clock to Apache 2.0. Each version becomes available under the Apache License 2.0 two years after it is published, granted irrevocably and in advance. So the answer to "what happens if the people behind this stop" is a date, not a promise.

Honest cost: this is not an open-source licence. The OSI has not approved the FSL and does not treat a competing-use restriction as open source, so Covan is source-available. GitHub's sidebar will read "Other" rather than a licence badge. Nothing about the repository changed otherwise: still one tree, still every feature, still no ee/ directory, no licence key, no phone-home, no separate self-host build.

If you need to host Covan for other people, a commercial licence exists for exactly that — efe@covan.app.

What is in this one

Agents that can call tools. A turn can now decide to do something rather than only answer: look something up, run a search, read a service. The harness has a per-turn budget, records what the agent actually did, and prices the whole turn — what one turn was and what it all cost is a table now, not a guess.

Connected apps. A workspace can attach third-party services through Composio and let an agent reach them, with the connection belonging to the workspace rather than to whoever made it. One column is the tenant boundary and the row-level-security suite tests it directly: no row means no.

Retrieval that reads the words as well as the meaning. Vector search now runs alongside full-text search with reciprocal-rank fusion over both, so an exact term that embeddings would smear finds its document. Embeddings moved to halfvec with an HNSW index — half the memory for the same answer — and a coverage report says plainly when nothing the team wrote was close to the question.

Dials the agent owns. Temperature, reasoning effort and web search are per-agent now rather than per-deployment, set by whoever chose that agent's model. Reasoning models can show what they thought before answering.

Reports. A question can produce something you keep — with the passages it stood on attached, so a report can be checked rather than believed.

Routines in both directions. A routine can deliver to a webhook, and something outside can poke a routine to run. Output retention is configurable per routine, 1 to 520 weeks.

A chat that survives the tab. An answer no longer dies with the session that asked for it.

A knowledge explorer, LaTeX and maths rendering, finer-grained syntax highlighting, and an integrations page that catalogues what you can connect.

49% less per chat turn, measured on real traffic. Four places a turn was paying twice, found by measuring rather than reading — including a cache being written that nobody read back, and a default that reached for a flagship model when it did not need to. The monthly token allowance on the hosted build moved to 1M tokens on the back of it.

Also: a workspace usage breakdown that reports by agent and by month and deliberately never by person; API keys that carry their own limit; SQL export carrier limits; and a long tail of edges closed in the tool-output path.

2,827 unit tests across 230 files, plus the row-level-security suite, run against a real Postgres with the policies applied.

What is not promised

The API is unversioned and nothing is promised about compatibility between commits, or between this release and the next. Read docs/self-hosting.md before putting it in front of anyone outside your team — in particular the sections on what to change before the stack faces a network, and the two honest limitations of the built-in rate limiter.

Covan 0.2.0

The second tagged release: 147 commits, 22 migrations, a second model provider, sources that keep themselves current, and a fix for the build that made every recent edge image unbootable.

git clone https://github.com/covan-ai/covan
cd covan
cp .env.docker.example .env     # set OPENAI_API_KEY
docker compose pull
docker compose up

Upgrading from 0.1.0 is the same two lines — docker compose pull then docker compose up. The migrate service runs on the way up and applies all twenty-two new migrations; it keeps a ledger, so running it again does nothing.

Both images are published for linux/amd64 and linux/arm64:

• ghcr.io/covan-ai/covan-api:0.2.0
• ghcr.io/covan-ai/covan-web:0.2.0

latest and 0.2 point here too; edge follows main. Pin with COVAN_VERSION=0.2.0 in .env.

Read this first if you track edge

v0.1.0 was never affected. Builds of main after 2 September were. #101 had the web container answering 500 on every route it had, and this release is the fix.

The cause was not in any source file. Nitro re-chunks Vite's SSR output, and that pass merged Rolldown's own runtime helper into a chunk that also re-exported the server entry — so the two chunks imported each other, and __exportAll was read during module evaluation while it was still undefined. Rolldown's runtime now gets a chunk with nothing else in it, which is a chunk that cannot import anything, so the cycle has nowhere to attach.

It bisected to a commit about session handling that touches no build configuration whatsoever. Worth saying plainly: nothing was wrong with the code, lint, types, 1,647 unit tests and the row-level-security suite were green the whole time, and no amount of any of them would have found it. CI now builds that exact artifact and serves four pages from it. That job did not exist before, which is the entire reason this went nine days unnoticed.

What is in this one

Connected sources. A workspace can point a knowledge bundle at Notion or a Google Drive folder, and it keeps itself current — a reconciler that re-reads on a schedule, not a one-off import. A page removed at the source stops grounding answers. On Docker this needs no extra service: the Node entry point runs the schedule itself, on ROUTINE_TICK_MS (default 60s), and the same tick drives routines.

Both need OAuth client credentials you create yourself. Drive has a cost with a lead time attached, and docs/integrations.md says so rather than leaving it to be discovered: drive.readonly is one of Google's restricted scopes, so an unverified client works for about a hundred users, each of whom sees a full-page "Google hasn't verified this app" warning first. Going past that — or wanting the warning gone — means Google's verification, which for a restricted scope includes a CASA Tier 2 security assessment and annual re-certification.

A second model provider. Set ANTHROPIC_API_KEY and Claude models appear in the same per-agent picker. Which company answers you is decided per agent, by whoever chose its model. Documents are still indexed and dictation still transcribed at OpenAI whichever model an agent answers on — docs/self-hosting.md is explicit about that, because it is the kind of thing that is easy to assume the other way.

Ask an agent from Slack. A Slack app can put a question to an agent in a channel and get the answer there, formatted the way Slack writes rather than the way Markdown does. Routines could already deliver to Slack; this is the other direction.

Deletion you can undo. Deleting an agent, a bundle or a document now puts it in the workspace's trash for thirty days. It stops being readable everywhere at once — no answer is grounded on it again — and anyone who can write in that workspace can put it back. After thirty days a sweeper deletes the rows and the stored file for real.

A record of who did what. When something is deleted or restored, or somebody is invited, has their role changed or is removed, the workspace keeps a line saying who, to what, and when. Written by the database rather than the API, so it records the action even when the action did not come through the interface. Readable by admins and nobody else.

Closing your own account, from Settings, taking your conversations, your API keys and any workspace you are the last person in. The one case that is refused is being a workspace's last admin — hand the role over first.

API keys. A credential that outlives a session, for reaching the API from something other than a browser.

Answers that say what they stood on, with an age on each citation, and retrieval that records whether anything the team wrote was actually close to the question — so "I don't know" is an answer it can give rather than a failure mode.

Routines that can say nothing. A routine with nothing worth reporting now says so instead of sending an empty digest, and reports what it read and what it left out.

Feedback from inside the thing. Two thumbs under every answer, and a dialog that names what it is about to send before it sends it.

A first run that resumes where it stopped rather than where it started, and answers "what do I upload?" with pages to fill in rather than an empty workspace.

No third-party request to paint a page. The two typefaces are served from your own install. Previously they came from Google's CDN, which told a third party the address of everyone who opened a page of your deployment — and on a machine with no route out, failed outright and rendered the whole interface in a fallback face. An air-gapped Covan now looks like Covan.

Also: conversations that can be named, workspace exports, transactional mail that looks like the product, a licence page, and encrypted per-workspace provider keys — that last one is schema and plumbing that only surfaces on a metered install, so it will not change anything about an ordinary self-host.

What is not promised

The API is unversioned and nothing is promised about compatibility between commits, or between this release and the next. Read docs/self-hosting.md before putting it in front of anyone outside your team — in particular the sections on what to change before the stack faces a network, and the two honest limitations of the built-in rate limiter.

Known and documented rather than discovered:

• A person removed from a workspace keeps their own chat sessions from it. docs/team.md covers that and the rest of what outlives a membership.
• A file you uploaded stays when you close your account, anonymised rather than deleted — the moment it was indexed it became the workspace's knowledge, and other people's answers cite it. Ask before closing the account, not after.
• There is no button that empties the trash early.

Licence

AGPL-3.0-only.

Covan 0.1.0

The first tagged release, and the first one you can actually pull.

git clone https://github.com/covan-ai/covan
cd covan
cp .env.docker.example .env     # set OPENAI_API_KEY
docker compose pull
docker compose up

Both images are published for linux/amd64 and linux/arm64:

• ghcr.io/covan-ai/covan-api:0.1.0
• ghcr.io/covan-ai/covan-web:0.1.0

latest and 0.1 point here too; edge follows main. Pin with COVAN_VERSION=0.1.0 in .env.

What Covan is

One agent that knows what your team wrote down. Everyone trains it together and talks to it privately — conversations are isolated per person by Postgres row level security, not by a check in the API. Upload documents, group them into bundles, attach them to an agent, and ask; answers cite the documents they came from, and the citations survive a reload.

What is in this one

• A publishable web image. Vite inlines VITE_* at build time, which is why there was never an image worth publishing — the bundle carried whoever built it. It is now built against placeholders and configured when the container starts, so one image serves every deployment.
• Rate limiting in the API. Two tiers, on by default on both deployment paths, in front of every endpoint that spends money at OpenAI. Previously the only bound was on request size, which caps what one call costs rather than how many arrive.
• Bring your own endpoint. OPENAI_BASE_URL sends completions to Ollama, vLLM, LiteLLM or OpenRouter. Embeddings and transcription still go to OpenAI — docs/self-hosting.md says why, plainly, rather than leaving it to be discovered.
• Routines. Scheduled work that runs while nobody is watching, delivered by email or Slack.
• Two runtimes, one source. The same code runs on Cloudflare Workers with R2 and on Node with the filesystem under docker compose.

What is not promised

The API is unversioned and nothing is promised about compatibility between commits or between this release and the next. Read docs/self-hosting.md before putting it in front of anyone outside your team — in particular the sections on what to change before the stack faces a network, and the two honest limitations of the built-in rate limiter.

One known limitation, documented rather than discovered: a person removed from a workspace keeps their own chat sessions from it. docs/team.md covers that and the rest of what outlives a membership.

Licence

AGPL-3.0-only.