Covan 0.4.0

The fourth tagged release: 203 commits and 12 migrations (0066–0077). The agent can drive a real browser now, routines can start from a template and finish on their own, and the chat screen reads as a transcript.

git clone https://github.com/covan-ai/covan
cd covan
cp .env.docker.example .env     # set OPENAI_API_KEY
docker compose pull
docker compose up

Upgrading from 0.3.0 takes the same two commands: docker compose pull, then docker compose up. The migrate service applies the twelve new migrations on the way up. It keeps a ledger, so running it a second time changes nothing.

Both images are published for linux/amd64 and linux/arm64:

• ghcr.io/covan-ai/covan-api:0.4.0
• ghcr.io/covan-ai/covan-web:0.4.0

latest and 0.4 point here too, and edge follows main. To pin this release, set COVAN_VERSION=0.4.0 in .env.

Read this before upgrading

The Supabase account connection is gone (#224). In 0.3.0 you could paste a Supabase Management API token and pick projects from a list. That token opens every project in the account, and there is no way to narrow it. Any connection made that way stops working after this upgrade. A hosted Supabase project can still be connected the same way as any other Postgres: install the covan_query function and connect through PostgREST.

Two new optional variables. BROWSER_USE_API_KEY and BROWSER_USE_BASE_URL turn on the browser tool, and COMPOSIO_API_KEY and COMPOSIO_BASE_URL are now passed through to covan-api. Leave them empty and those features stay off. Nothing else is affected.

What is in this one

A browser the agent can drive (#275, #278, #280). The new browse tool takes one plain-language instruction and runs it in a real browser, for pages http_request cannot reach. The turn ends as soon as the task is handed off and the answer arrives when the task finishes, so waiting on a browser task does not use up the turn's step budget. If a task stops at a login page, Covan gives the person a live browser session to sign in at the site itself, in their own tab, and then runs the task once more at no extra cost. Covan never sees or stores the credential.

Routines you start from a template, and routines that end (#241, #242, #279). A new routine can start from one of three templates instead of an empty form. A routine can finish after a set number of delivered runs, and it then shows as Finished rather than Paused. A routine can also read its own workspace. The first report built on that is a weekly coverage-gap report: the topics the team asked about that no document covered, without naming who asked. Running a routine by hand no longer collides with its scheduled run. Scheduled runs are also told the date and the time zone they run in.

More connected apps (#252, #254, #256, #262, #263, #264). An app that needs only a key you supply can now be connected. Thirty-four apps that need no credential at all, which used to fail on every attempt, now connect. Before asking for a connection, the card says what the app is. Operations the connected account does not have are no longer offered to the agent.

The chat screen as a transcript (#232, #271). Questions and answers now look the way most chat products show them. Each exchange is grouped, and you can see where one ends and the next begins.

Cheaper and better-behaved turns (#226, #227, #233, #234, #244, #246, #247). Six defects behind one $0.58 turn are fixed. The 5,588-token search tool is no longer attached to agents that never search. Every prompt records what it was made of, and every turn is priced by the model that actually answered. Model IDs are defined in one list, and an ID that is not on it is refused.

A turn that sees its limit coming (#223). Before each pass, a chat turn checks how much of the subrequest limit it has left. When it is about to run out, it finishes with a final answer instead of failing partway through with a Connection error.

Smaller fixes. The Slack handler now says when an answer was cut off (#235). A resumed turn is given the same context as a fresh one (#236). Each scheduled run records which model it used and how it ended (#238). An uploaded document is now served with a content type the server works out from the file name, instead of the one the uploader claimed. Before, a file claiming to be text/html could run in the preview on the app's own origin (#273). The README has been rewritten around what the agent can do (#265, #266, #267).

Full changelog: v0.3.0...v0.4.0