Skip to content

Covan 0.5.0

Latest
Latest

Choose a tag to compare

View all tags
@github-actions github-actions released this 23 Oct 19:35
v0.5.0
2fa5587
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

The fifth tagged release: over 320 commits and sixty migrations (0078–0137) since v0.4.0. Routines can now start on something happening elsewhere (a Slack message, a GitHub push, a Gmail or Calendar event, a Notion page, a webhook). Knowledge takes 100 MB files and indexes them as a job. Sign-in can require a second step. The interface speaks Turkish as well as English.

git clone --branch v0.5.0 https://github.com/covan-ai/covan
cd covan
cp .env.docker.example .env     # set OPENAI_API_KEY
docker compose up

Upgrading from 0.4.0: check out v0.5.0 and run docker compose up. The migrate service applies the sixty new migrations on the way up. It keeps a ledger, so running it again changes nothing. Read the next section first: three changes can stop an existing stack from starting.

Both images are published for linux/amd64 and linux/arm64:

  • ghcr.io/covan-ai/covan-api:0.5.0
  • ghcr.io/covan-ai/covan-web:0.5.0

latest and 0.5 point here too, and edge follows main.

Read this before upgrading

docker compose up now builds the two Covan images from your checkout by default (COVAN_PULL=build). As a result, the app is always the same commit as the migrations migrate applies. A plain docker compose pull no longer fetches covan-api or covan-web. To run the published images instead, set COVAN_PULL=always and COVAN_VERSION=0.5.0 in .env, and check out the v0.5.0 tag as well. Running a release's images on a newer checkout's migrations puts a new schema under an old app. COVAN_VERSION now defaults to edge instead of latest.

A stack that faces a network refuses to start with MAILER_AUTOCONFIRM=true. docker/check-secrets.sh treats a stack as network-facing when ALLOWED_ORIGIN is not localhost or BIND_ADDR is not loopback. Such a stack now refuses to start while every sign-up is confirmed without proof of the address. Configure GOTRUE_SMTP_* and set MAILER_AUTOCONFIRM=false before upgrading. A laptop stack is unaffected.

WORKER_HOST is required when NOTION_CLIENT_ID, GOOGLE_CLIENT_ID or SLACK_CLIENT_ID is set. Set it to the API's public host, without the scheme, for example api.example.com. Without it, covan-api refuses to boot. Before this release, OAuth redirect URIs were built from the request's Host header, which the caller chooses.

Workspace model keys are gone (#295, migration 0081). PROVIDER_KEY_SECRET is no longer read. The workspace_provider_keys table is dropped, along with any keys stored in it. A self-hosted install never needed them, because the operator's own keys in the environment still answer every call.

New optional variables. Leave any of these empty and the feature stays off:

  • TRUST_PROXY: set it to the number of proxies in front of the API that append X-Forwarded-For, for example 1 for a single nginx, Caddy or Traefik. Empty means the connection's own address, with forwarded headers ignored.
  • SIGN_IN_GOOGLE_* and SIGN_IN_GITHUB_*: Continue with Google / GitHub.
  • WORKSPACE_MAX_PASSAGES: a ceiling on how much knowledge one workspace may hold.
  • INBOUND_EMAIL_DOMAIN and RESEND_INBOUND_WEBHOOK_SECRET: mail a routine at its own address.
  • COMPOSIO_WEBHOOK_SECRET and NOTION_WEBHOOK_VERIFICATION_TOKEN: start routines on app events.
  • BROWSER_USE_MODEL, BROWSER_USE_REASONING and BROWSER_USE_V4_BASE_URL: tune the browser tool.
  • FEEDBACK_EMAIL: where a note from the in-app feedback dialog is mailed. Notes are kept in the feedback table either way.

What is in this one

Routines that wait for something to happen (#326, #328, #329, #333, #335–#338). A routine can start on a Gmail, Outlook or Google Calendar event, a Slack message or reaction, a GitHub push, pull request or issue, a new YouTube video or feed post, a Notion page or comment, a Google Drive file, a webhook, or a Telegram message. A routine can also have its own email address, and a routine's emailed report can be answered.

Knowledge, rebuilt (#317, #318, #320–#323, #330, #364, #370). Uploads go up to 100 MB and are indexed as a background job. Word, Excel and PowerPoint files are read, including the 97–2003 formats, and scans are read with OCR. Knowledge is private to the person who uploaded it until they share it. Citations open the page they came from, and synced sources stay current.

Two-step sign-in (#325, #327). An account can add an authenticator app. Once it has one, the database itself refuses the account's requests without the second code, on every table and RPC, so a stolen password alone is not enough. Passwords must be at least eight characters.

A browser beside the conversation (#282–#289, #299, #312). The agent's browser opens next to the chat, a saved login can be reused, and a routine can drive a browser too.

The interface in Turkish (#390). Every word the interface says now goes through a translation. Turkish is the first language after English.

Teams (#319, #343, #347, #349, #386, #387). An agent is shared deliberately rather than by default. Invitations say who they are from, and somebody invited joins that team rather than getting a workspace of their own.

A turn that outlives the tab, and a document that writes itself (#313, #314). A reply keeps going when the tab closes. The agent can write a long document into a side panel while the conversation continues.

Smaller things. You can sign in with Google or GitHub (#361). A stopped reply keeps what it had written (#344). Every reply shows what it cost (#295). There is a settings area with a profile (#297). Steps in a reply show the logo of the connected app they called (#391).

Every change since v0.4.0

  • A release for October: 0.4.0 → 0.5.0 (#392)
  • The mark of the service a step called, beside its dot (#391)
  • The words in your own language (#390)
  • Put the logo in the brand tile, not a C (#389)
  • Every screen as drawn (redesign 3/3) (#388)
  • The clean team tool, 2/3: the shell and the routes (#387)
  • The clean team tool, 1/3: foundation and backend (#386)
  • Show one unit of money: credits where there are credits, dollars where there are not (#384)
  • Offer the model as three words, with the list underneath (#385)
  • Ask for the first document instead of pretending there is one (#382)
  • Say who can read a thread once, and say that a brainstorm is the team's (#381)
  • Call a thread one thing, count what it can read, and offer the next step (#380)
  • Give a drafted persona room to finish (#379)
  • Know the hosted reward table by name (#378)
  • Show the product, ask less, and let the assistant open (#377)
  • Read full pages when every page is read (#376)
  • Keep the mail that arrived before the read cap, and let a key outlive its turn (#375)
  • Leave a blob out, cut a list between its items, and give the page reader room (#374)
  • Read eval cases made from real data from outside the repository (#371)
  • Let a deployment reword the prompt without publishing what it learned (#369)
  • Bring the public tree up to what the hosted one already fixed (#368)
  • Say whose name it is, whose data stays out, and what leaves an install (#367)
  • Read mail as mail, and read many results for a question (#365)
  • Read Word, Excel and PowerPoint 97-2003 files (#370)
  • Keep synced knowledge current, and index it as uploads are (#364)
  • Say what an app holds only after reading it (#366)
  • Read what a Drive folder holds, and say what it could not (#363)
  • Send a question about a connected app to the app (#362)
  • Let people in with Google or GitHub (#361)
  • Count a turn's tokens by what they cost (#360)
  • Carry the conversation on when the browser's answer arrives (#359)
  • Tell a run that did part of its task from one a site refused (#357)
  • Keep passage embeddings beside the database when a vector index is bound (#356)
  • Check a connected key once, and say so when the provider refuses it (#355)
  • Let an operator cap how much knowledge one workspace may hold (#354)
  • Fix four small things the team pilot found (#353)
  • Say so when the model provider refuses, and tell the operator (#352)
  • Offer the commercial licence to whoever cannot sign the FSL (#351)
  • Do not offer the invitation again to somebody who just turned it down (#349)
  • Answer a missing workspace with null, so /welcome stops reloading itself (#348)
  • Let somebody invited join their team instead of a workspace of their own (#347)
  • The thread you opened, the file name you exported, and dialogs instead of prompts (#346)
  • Say what to do when the credits run out, where the reply would have been (#344)
  • Answer the question under a long paste; cite what the answer came from (#345)
  • Pilot day one: a team on one address, feedback that reaches someone, invitations that say who from (#343)
  • Count a workspace's passages once, not once per passage (#341)
  • Draft a routine in the request's language, stop counting an unfinished sign-in, offer weekdays (#342)
  • Ask Slack in the form it reads (#340)
  • Link the inbound mail section by the anchor it has (#339)
  • Start a routine from a Telegram message, let Siri wait for a webhook's report, and give the agent watch_event and run_routine (#338)
  • Answer a routine's emailed report, or mail a routine at its own address (#337)
  • Start a routine on a Notion page or comment, or a Google Drive file (#336)
  • Start a routine on a Slack channel message or a reaction (#335)
  • Start a routine on a GitHub push, pull request or issue, a new YouTube video, or a feed's new post (#333)
  • The lint the redesign left: Prettier's spelling of sixteen files, and a settings test that built a Supabase client (#334)
  • A settled look: rail and panel, the greeting front door, replies as prose, a file manager for Knowledge (#332)
  • The commercial line, drawn before anybody asks for it (#331)
  • Index one document at a time per workspace, in smaller inserts (#330)
  • Run webhook and app-event routines in a Durable Object (#329)
  • Start a routine on a Gmail, Outlook or Google Calendar event (#328)
  • The loose ends of the second step: passwords of eight, a code for an old session, nobody charged for nothing (#327)
  • A routine that waits for something to happen: the shared plumbing for event triggers (#326)
  • A second step at the door: two-step sign-in, required where the data is (#325)
  • Browser runs send their reasoning level, and the free retry has a lower ceiling (#324)
  • The picker that keeps its files (#323)
  • Knowledge, last mile: citations that open, better retrieval, OCR, web pages, rename, delete for good (#322)
  • Knowledge that is yours until you share it (#321)
  • The file that indexes itself: 100 MB uploads, indexing as a job, Office files (#320)
  • An agent shared on purpose (#319)
  • The search that reads its own question: knowledge correctness fixes (#318)
  • The agent knows its documents, and keeps its brief short (#317)
  • The side panel holds its height, so the document scrolls inside it (#316)
  • The document scrolls by itself, not the page behind it (#315)
  • A document that writes itself (#314)
  • The turn that outlives the tab (#313)
  • A routine that can open a browser (#312)
  • The dial beside the question (#309)
  • The October hardening (#306)
  • The deleted and the anonymous (#304)
  • The routine engine's loose ends (#302)
  • The turn that paused keeps its grounding (#301)
  • The upload limit the API forgot, and the feed the dialog let go (#300)
  • The browser that starts where you are (#299)
  • The balance opens where it is counted (#298)
  • A settings area, and a profile of your own (#297)
  • The balance in the corner (#296)
  • What every reply costs (#295)
  • The 0077 note comes home (#290)
  • The answer that says only what the browser saw (#289)
  • The batch the person approved (#288)
  • The task that waits its turn (#287)
  • The agent is told where its browser tasks stand (#286)
  • A call cut off mid-write is told so, and a turn is warned before its ceiling (#285)
  • The calls that waited behind a question are answered (#284)
  • A browser answer is phrased against the message that asked for it (#283)
  • The browser beside the conversation, the login you save, and a browser without a task (#282)
  • The issues that code could close (#310)

Full changelog: v0.4.0...v0.5.0

Assets 2
Loading