Covan 0.2.0

The second tagged release: 147 commits, 22 migrations, a second model provider, sources that keep themselves current, and a fix for the build that made every recent edge image unbootable.

git clone https://github.com/covan-ai/covan
cd covan
cp .env.docker.example .env     # set OPENAI_API_KEY
docker compose pull
docker compose up

Upgrading from 0.1.0 is the same two lines — docker compose pull then docker compose up. The migrate service runs on the way up and applies all twenty-two new migrations; it keeps a ledger, so running it again does nothing.

Both images are published for linux/amd64 and linux/arm64:

• ghcr.io/covan-ai/covan-api:0.2.0
• ghcr.io/covan-ai/covan-web:0.2.0

latest and 0.2 point here too; edge follows main. Pin with COVAN_VERSION=0.2.0 in .env.

Read this first if you track edge

v0.1.0 was never affected. Builds of main after 2 September were. #101 had the web container answering 500 on every route it had, and this release is the fix.

The cause was not in any source file. Nitro re-chunks Vite's SSR output, and that pass merged Rolldown's own runtime helper into a chunk that also re-exported the server entry — so the two chunks imported each other, and __exportAll was read during module evaluation while it was still undefined. Rolldown's runtime now gets a chunk with nothing else in it, which is a chunk that cannot import anything, so the cycle has nowhere to attach.

It bisected to a commit about session handling that touches no build configuration whatsoever. Worth saying plainly: nothing was wrong with the code, lint, types, 1,647 unit tests and the row-level-security suite were green the whole time, and no amount of any of them would have found it. CI now builds that exact artifact and serves four pages from it. That job did not exist before, which is the entire reason this went nine days unnoticed.

What is in this one

Connected sources. A workspace can point a knowledge bundle at Notion or a Google Drive folder, and it keeps itself current — a reconciler that re-reads on a schedule, not a one-off import. A page removed at the source stops grounding answers. On Docker this needs no extra service: the Node entry point runs the schedule itself, on ROUTINE_TICK_MS (default 60s), and the same tick drives routines.

Both need OAuth client credentials you create yourself. Drive has a cost with a lead time attached, and docs/integrations.md says so rather than leaving it to be discovered: drive.readonly is one of Google's restricted scopes, so an unverified client works for about a hundred users, each of whom sees a full-page "Google hasn't verified this app" warning first. Going past that — or wanting the warning gone — means Google's verification, which for a restricted scope includes a CASA Tier 2 security assessment and annual re-certification.

A second model provider. Set ANTHROPIC_API_KEY and Claude models appear in the same per-agent picker. Which company answers you is decided per agent, by whoever chose its model. Documents are still indexed and dictation still transcribed at OpenAI whichever model an agent answers on — docs/self-hosting.md is explicit about that, because it is the kind of thing that is easy to assume the other way.

Ask an agent from Slack. A Slack app can put a question to an agent in a channel and get the answer there, formatted the way Slack writes rather than the way Markdown does. Routines could already deliver to Slack; this is the other direction.

Deletion you can undo. Deleting an agent, a bundle or a document now puts it in the workspace's trash for thirty days. It stops being readable everywhere at once — no answer is grounded on it again — and anyone who can write in that workspace can put it back. After thirty days a sweeper deletes the rows and the stored file for real.

A record of who did what. When something is deleted or restored, or somebody is invited, has their role changed or is removed, the workspace keeps a line saying who, to what, and when. Written by the database rather than the API, so it records the action even when the action did not come through the interface. Readable by admins and nobody else.

Closing your own account, from Settings, taking your conversations, your API keys and any workspace you are the last person in. The one case that is refused is being a workspace's last admin — hand the role over first.

API keys. A credential that outlives a session, for reaching the API from something other than a browser.

Answers that say what they stood on, with an age on each citation, and retrieval that records whether anything the team wrote was actually close to the question — so "I don't know" is an answer it can give rather than a failure mode.

Routines that can say nothing. A routine with nothing worth reporting now says so instead of sending an empty digest, and reports what it read and what it left out.

Feedback from inside the thing. Two thumbs under every answer, and a dialog that names what it is about to send before it sends it.

A first run that resumes where it stopped rather than where it started, and answers "what do I upload?" with pages to fill in rather than an empty workspace.

No third-party request to paint a page. The two typefaces are served from your own install. Previously they came from Google's CDN, which told a third party the address of everyone who opened a page of your deployment — and on a machine with no route out, failed outright and rendered the whole interface in a fallback face. An air-gapped Covan now looks like Covan.

Also: conversations that can be named, workspace exports, transactional mail that looks like the product, a licence page, and encrypted per-workspace provider keys — that last one is schema and plumbing that only surfaces on a metered install, so it will not change anything about an ordinary self-host.

What is not promised

The API is unversioned and nothing is promised about compatibility between commits, or between this release and the next. Read docs/self-hosting.md before putting it in front of anyone outside your team — in particular the sections on what to change before the stack faces a network, and the two honest limitations of the built-in rate limiter.

Known and documented rather than discovered:

• A person removed from a workspace keeps their own chat sessions from it. docs/team.md covers that and the rest of what outlives a membership.
• A file you uploaded stays when you close your account, anonymised rather than deleted — the moment it was indexed it became the workspace's knowledge, and other people's answers cite it. Ask before closing the account, not after.
• There is no button that empties the trash early.

Licence

AGPL-3.0-only.