
First PyPI release of `streamlit-coco` (alpha). Published from temporary Trusted Publisher on [`lletourmy/streamlit-coco`](https://github.com/lletourmy/streamlit-coco).

### Changed
- **Temporary PyPI release repo** — `make sync-release` / Trusted Publisher gate target [`lletourmy/streamlit-coco`](https://github.com/lletourmy/streamlit-coco) until DevoteamSP is validated on PyPI ([`doc/deployment/publish.md`](doc/deployment/publish.md))
- **Dependabot** — bump transitive `cryptography` to `50.0.0` (and `pyopenssl` to `26.4.0`); `GitPython` already at `3.1.58`

### Added

#### Examples
- **Product Backlog Desk** — multipage demo (`examples/backlog_desk/`, `make backlog`): Board / Epic / Ticket / Release with a right-rail Copilot (skills + `panel()`) over local JSON/Markdown (no SQL); navigator-style theme; Edit/Write gated by approvals

### Changed
- **Compact tool cards** — transcript tools render as collapsed expanders (label: family · status · meta); auto-open on error; CCv2 `<details>` parity ([`doc/features/tools-display/SPEC.md`](doc/features/tools-display/SPEC.md))

#### Dual-repo publish
- Public release repo (temporary) [`lletourmy/streamlit-coco`](https://github.com/lletourmy/streamlit-coco); `make sync-release` / `scripts/sync_release.sh`; guide [`doc/deployment/publish.md`](doc/deployment/publish.md)
- Apache-2.0 `LICENSE`; PyPI Trusted Publisher gate in `release.yml` (`github.repository == lletourmy/streamlit-coco` only)

#### Phase 3 — HITL, headless, render flexibility
- **Headless multi-turn** — `CocoSession.stream()` and `await session.run(prompt)`; `execute_plan()` / `set_permission_mode()`; extended `examples/headless_pipeline.py`
- **Streamlit-free core imports** — lazy `__getattr__` for UI exports so headless scripts never load Streamlit; smoke test + example assert
- **Plan mode Execute CTA** — native `render_plan_banner()` in `panel()`; CCv2 banner **Execute plan** trigger
- **Edit/Write unified diff** — approval + transcript previews via `difflib` (`tool_extract.unified_diff`); Before/After fallback when empty
- **Pluggable text renderer** — `text_renderer=` on `panel()`, `render_transcript()`, `render_output_field()` (`markdown` / `write` / `text` / … or callable); feature docs under `doc/features/text-renderer/`
- **App-owned `request_input`** — form + optional multi-field `schema=` (AskUserQuestion remains the in-turn CoCo channel)
- Headless checklist re-signed (2026-07-27): `query()` + `run()` + `stream()` live path; no Streamlit import

#### Earlier unreleased (pre–Phase 3 on this branch)
- **Clear tool “running” captions when done** — parse SDK `UserMessage` / NDJSON `user` tool results; finalize leftover `running` tools on turn `result`
- **CCv2 skill hygiene** — JS cleanup via AbortController; pause `run_every` on pending approval; drop `provide_input`; `isolate_styles=True`; CSS via `--st-yellow-*` / `--st-red-*` / radius tokens
- **API reference** — [`doc/api.md`](doc/api.md)
- **Deployment docs (local)** — [`doc/deployment/local.md`](doc/deployment/local.md)
- **Typed error hierarchy** — `streamlit_coco.errors`; `require_environment()`
- **NDJSON fixture corpus** — `tests/fixtures/ndjson/` + `tests/test_ndjson_fixtures.py`
- Feature docs pack + checklist sign-offs (panel, approvals, tools-display, structured-output, chat-ccv2, headless)
- GitHub CI/CD (ci / security / release + optional PyPI publish on `v*` tags); `make publish`; hatch sdist excludes for agent/IDE dirs
- Smoke tests: CCv2 register-once; core import does not load Streamlit

### Changed
- [`doc/prd.md`](doc/prd.md) reconciled with shipped Phase 3; FR-S* / FR-ST* status; FR-S3 superseded by tools-display SPEC (not “collapse cards”)
- [`doc/roadmap.md`](doc/roadmap.md) — Later: FR-S2, FR-S7, FR-ST4 truncation, Vite/CCv2, e2e; Next: Docker/SPCS docs; PyPI `0.1.0` via temporary Trusted Publisher
- `doc-dev/` — development-only docs tree; excluded from `make sync-release` and sdist (never published to `streamlit-coco`)
- Package / README / identity URLs point at the public [`streamlit-coco`](https://github.com/lletourmy/streamlit-coco) repo; development continues on [`streamlit-coco-dev`](https://github.com/DevoteamSP/streamlit-coco-dev)
- GitHub repository renamed to [`DevoteamSP/streamlit-coco-dev`](https://github.com/DevoteamSP/streamlit-coco-dev) (package name remains `streamlit-coco`)
- Examples `structured_output.py` / `approval_gate.py`: `get_or_create_session` + eager `start()` for CCv2 transcript across reruns
- Chat demo sidebar: compact status badges; Settings popover; test prompts behind a toggle
- CCv2 `chat()` registration cached (`@lru_cache`) so `st.components.v2.component` runs once per process
- Headless example: separate event loops for `query()` vs `CocoSession` to avoid SDK cancel-scope teardown issues

### Fixed
- Grep / Glob completed cards: compact summary instead of dumping full result bodies
- AskUserQuestion: free-form / “Other…” options always last in radio / multiselect
- Security workflow: free Gitleaks CLI instead of `gitleaks-action@v2` (org license)

---

