cowork-flow 1.9.1 → 2.0.0

package/template/.cowork-flow/adapters/opencode/adapter.yaml

@@ -13,7 +13,7 @@ capabilities:
   runtimeContextDispatch: native
   runtimeContextBinding: shim
   runtimeContextCleanup: native
-  editScopeWarning: unsupported
+  editScopeWarning: plugin
 dispatch:
   primitive: task
   agentsPath: .opencode/agents

package/template/.cowork-flow/adapters/qoder/adapter.yaml

@@ -13,7 +13,7 @@ capabilities:
   runtimeContextDispatch: native
   runtimeContextBinding: shim
   runtimeContextCleanup: native
-  editScopeWarning: unsupported
+  editScopeWarning: plugin
 dispatch:
   primitive: subagent
   # Host assets ship as a machine-level plugin; their layout is owned by

package/template/.cowork-flow/scripts/adapters/cli/subagent.py

@@ -34,6 +34,7 @@ from services.review_receipt import ReviewReceiptError, submit_review_receipt
 from services.workflow_runtime import (
     RuntimeContextError,
     RuntimeContextService,
+    normalize_relative_path,
 )
 from adapters.cli.execution_context_args import build_internal_execution_context_parser
 from infra.paths import get_repo_root
@@ -201,6 +202,23 @@ def _initial_context(
         {"file": item, "reason": "prompt-named context"}
         for item in args.allowed_context
     ]
+    assignment: dict = {
+        "title": args.title,
+        "goal": args.goal or args.title,
+        "allowed_context": allowed_context,
+        "expected_output": args.expected_output,
+        "source": args.source,
+    }
+    slice_name = (getattr(args, "slice", None) or "").strip()
+    if slice_name:
+        assignment["slice"] = slice_name
+    owned_paths: list[str] = []
+    for path in getattr(args, "owns", None) or []:
+        normalized = normalize_relative_path(path)
+        if normalized:
+            owned_paths.append(normalized)
+    if owned_paths:
+        assignment["owned_paths"] = owned_paths
     return {
         "schema_version": 2,
         "runtime_context_id": runtime_context_id,
@@ -215,13 +233,7 @@ def _initial_context(
             "kind": "prompt",
             "key": "cowork_runtime_context_id",
         },
-        "assignment": {
-            "title": args.title,
-            "goal": args.goal or args.title,
-            "allowed_context": allowed_context,
-            "expected_output": args.expected_output,
-            "source": args.source,
-        },
+        "assignment": assignment,
         "authority": {
             "may_start_task": False,
             "may_resume_main": False,
@@ -293,6 +305,76 @@ def cmd_status(args: argparse.Namespace) -> int:
     return 0
 
 
+def cmd_prompt(args: argparse.Namespace) -> int:
+    """Render a paste-ready dispatch prompt for one runtime context.
+
+    Host-neutral by design: the two transport lines the runtime parses,
+    then generic pointers the child resolves itself via the CLI.
+    """
+    repo_root = get_repo_root()
+    try:
+        context = _find_subagent(repo_root, args.subagent_id)
+    except FileNotFoundError:
+        print(f"Error: subagent not found: {args.subagent_id}", file=sys.stderr)
+        return 1
+    assignment = context.get("assignment")
+    assignment = assignment if isinstance(assignment, dict) else {}
+    host_context_key = _suggest_host_context_key(
+        str(context.get("host") or ""),
+        args.subagent_id,
+    )
+    lines = [
+        f"cowork_runtime_context_id: {args.subagent_id}",
+        f"cowork_host_context_key: {host_context_key}",
+        "",
+        "First read your assignment; do not infer it from this prompt:",
+        f".cowork-flow/run subagent status {args.subagent_id}",
+        f"Goal: {assignment.get('goal') or context.get('title') or ''}",
+        f"Expected output: {assignment.get('expected_output') or ''}",
+    ]
+    slice_name = assignment.get("slice")
+    owned = [str(path) for path in (assignment.get("owned_paths") or [])]
+    if slice_name or owned:
+        lines.append(f"Slice: {slice_name or '(unnamed)'}")
+        if owned:
+            lines.append(f"Owned paths: {', '.join(owned)}")
+    print("\n".join(lines))
+    return 0
+
+
+def cmd_list(args: argparse.Namespace) -> int:
+    repo_root = get_repo_root()
+    task_dir = getattr(args, "task", None)
+    if task_dir:
+        candidate = Path(task_dir)
+        if candidate.is_absolute():
+            try:
+                candidate = candidate.resolve().relative_to(repo_root.resolve())
+            except ValueError:
+                pass
+        task_dir = candidate.as_posix()
+    contexts = RuntimeContextService(repo_root).list_contexts(
+        task_dir=task_dir,
+        open_only=bool(getattr(args, "open", False)),
+    )
+    if not contexts:
+        print("no subagent contexts")
+        return 0
+    for context in contexts:
+        assignment = context.get("assignment")
+        assignment = assignment if isinstance(assignment, dict) else {}
+        owned = [str(path) for path in (assignment.get("owned_paths") or [])]
+        print(
+            f"{context.get('runtime_context_id', '?')}  "
+            f"{context.get('status', 'unknown')}  "
+            f"{context.get('agent_type', 'unknown')}  "
+            f"{context.get('task_dir') or '-'}  "
+            f"slice={assignment.get('slice') or '-'}  "
+            f"owns={','.join(owned) or '-'}"
+        )
+    return 0
+
+
 def cmd_update(args: argparse.Namespace) -> int:
     if args.status not in VALID_STATUSES:
         print(f"Error: status must be one of {', '.join(sorted(VALID_STATUSES))}", file=sys.stderr)
@@ -421,6 +503,13 @@ def build_parser() -> argparse.ArgumentParser:
     init.add_argument("--goal")
     init.add_argument("--expected-output", default="Files changed, validation commands, and blockers.")
     init.add_argument("--allowed-context", action="append", default=[])
+    init.add_argument("--slice", default=None, help="Slice name this child owns")
+    init.add_argument(
+        "--owns",
+        action="append",
+        default=[],
+        help="Owned repository-relative path (repeatable); overlapping claims of an open implement context fail closed",
+    )
     init.add_argument("--host", default=None)
     init.add_argument("--adapter", default=None)
     init.set_defaults(func=cmd_init)
@@ -429,6 +518,21 @@ def build_parser() -> argparse.ArgumentParser:
     status.add_argument("subagent_id")
     status.set_defaults(func=cmd_status)
 
+    prompt = subparsers.add_parser(
+        "prompt",
+        help="Render a paste-ready dispatch prompt for a runtime context",
+    )
+    prompt.add_argument("subagent_id")
+    prompt.set_defaults(func=cmd_prompt)
+
+    listing = subparsers.add_parser(
+        "list",
+        help="List subagent runtime contexts (open-first inventory)",
+    )
+    listing.add_argument("--task", default=None, help="Only contexts of this task directory")
+    listing.add_argument("--open", action="store_true", help="Only contexts not yet closed")
+    listing.set_defaults(func=cmd_list)
+
     update = subparsers.add_parser("update", help="Update subagent runtime status")
     update.add_argument("subagent_id")
     update.add_argument("--status", required=True)

package/template/.cowork-flow/scripts/adapters/cli/task_lifecycle_commands.py

@@ -441,7 +441,6 @@ def cmd_complete(args: argparse.Namespace) -> int:
     result = service.complete(
         task_dir,
         execution_context=execution_context,
-        allow_unchecked_specs=bool(getattr(args, "allow_unchecked", False)),
         allow_missing_evidence=bool(
             getattr(args, "allow_missing_evidence", False)
         ),

package/template/.cowork-flow/scripts/adapters/cli/task_parser.py

@@ -95,13 +95,6 @@ def _add_next_output_options(parser: argparse.ArgumentParser) -> None:
         action="store_true",
         help="Validate task context JSONL without changing task state",
     )
-    parser.add_argument(
-        "--allow-unchecked",
-        dest="allow_unchecked",
-        action="store_true",
-        help="With task completion: allow unchecked spec-check commands "
-        "(missing/timeout) and record the exemption in task.json meta",
-    )
     parser.add_argument(
         "--allow-missing-evidence",
         dest="allow_missing_evidence",

package/template/.cowork-flow/scripts/adapters/host/claude_code_policy.py

@@ -4,8 +4,7 @@ workflow hook.
 
 Rendering stays in workflow_state_hook.py; this module owns only the
 claude-code transport specifics — the runtime preamble block and the
-PostToolUse spec-advisory path (stderr + exit 2, shared with codex via the
-neutral helper).
+PostToolUse edit-scope advisory.
 """
 
 from __future__ import annotations
@@ -13,8 +12,8 @@ from __future__ import annotations
 from pathlib import Path
 from typing import Any
 
+from adapters.host.edit_scope import edit_scope_warning
 from adapters.host.policy_base import HostPolicy
-from adapters.host.workflow_state_hook import spec_only_post_tool_use
 
 CLAUDE_PREAMBLE = (
     (
@@ -30,7 +29,10 @@ def preamble(root: Path) -> tuple[str, ...]:
 
 
 def post_tool_use(root: Path, hook_input: dict[str, Any]) -> tuple[str, int]:
-    return spec_only_post_tool_use(root, hook_input, POLICY)
+    """PostToolUse transport: the edit-scope advisory rides the standard
+    additionalContext envelope, exit 0 — the edit already happened, so
+    this decorates the result and never blocks it."""
+    return edit_scope_warning(root, hook_input), 0
 
 
 POLICY = HostPolicy(

package/template/.cowork-flow/scripts/adapters/host/codex_policy.py

@@ -3,20 +3,19 @@
 
 Rendering stays in workflow_state_hook.py; this module owns only the codex
 transport specifics — the dispatch-mode preamble (config-driven, the codex
-wrapper surfaces it above every injection) and the probe-based session-start
+wrapper surfaces it above every injection), the probe-based session-start
 detection (codex registers UserPromptSubmit only, so the digest shape derives
-from the session state file probe). PostToolUse reuses the neutral spec-only
-stderr path shared with claude-code.
+from the session state file probe), and the PostToolUse edit-scope advisory.
 """
 
 from __future__ import annotations
 
-import sys
 from pathlib import Path
 from typing import Any
 
+from adapters.host.edit_scope import edit_scope_warning
 from adapters.host.policy_base import HostPolicy
-from adapters.host.workflow_state_hook import _load_common, spec_only_post_tool_use
+from adapters.host.workflow_state_hook import _load_common
 
 
 def codex_dispatch_mode(root: Path) -> str:
@@ -47,7 +46,10 @@ def preamble(root: Path) -> tuple[str, ...]:
 
 
 def post_tool_use(root: Path, hook_input: dict[str, Any]) -> tuple[str, int]:
-    return spec_only_post_tool_use(root, hook_input, POLICY)
+    """PostToolUse transport: the edit-scope advisory rides the standard
+    additionalContext envelope, exit 0. apply_patch payloads carry their
+    paths inside the patch text, which the shared extractor covers."""
+    return edit_scope_warning(root, hook_input), 0
 
 
 POLICY = HostPolicy(

package/template/.cowork-flow/scripts/adapters/host/edit_scope.py

@@ -0,0 +1,113 @@
+#!/usr/bin/env python3
+"""Shared edit-phase scope advisory (the PostToolUse short path).
+
+At most one line when an edited file is outside the active task's
+file-scope whitelist; empty string (silent) when in scope, when the task
+is not in a spec-contract state, for subagent sessions, or on any error.
+Hosts differ only in transport: inject.py hosts reach this through their
+policy `post_tool_use` slot, the dsh preset plugin through its own Python
+protocol. The wording is frozen by context-injection.md — never fork it
+per host.
+"""
+
+from __future__ import annotations
+
+import re
+from pathlib import Path
+from typing import Any
+
+from adapters.host.workflow_state_hook import (
+    STAGE_CONTRACT_STATES,
+    _get_active_task_with_fallback,
+    _session_scope,
+)
+
+_APPLY_PATCH_FILE_RE = re.compile(
+    r"^\*\*\* (?:Update|Add|Delete) File: (.+?)\s*$", re.MULTILINE
+)
+
+
+def extract_edited_paths(tool_input: Any) -> list[str]:
+    """Best-effort edited file paths from a PostToolUse tool_input payload.
+
+    Hosts differ: claude-code, zcode, qoder and opencode pass file_path,
+    while codex's apply_patch carries the paths inside the patch text.
+    Returning every extractable path keeps a multi-file patch from
+    silently skipping the warning; deduplication keeps one edit from
+    checking the same file twice."""
+    if not isinstance(tool_input, dict):
+        return []
+    paths: list[str] = []
+    for key in ("file_path", "filePath", "path"):
+        value = tool_input.get(key)
+        if isinstance(value, str) and value.strip():
+            paths.append(value.strip())
+    for key in ("input", "patch", "patchText"):
+        text = tool_input.get(key)
+        if isinstance(text, str):
+            paths.extend(
+                match.strip() for match in _APPLY_PATCH_FILE_RE.findall(text)
+            )
+    seen: set[str] = set()
+    unique: list[str] = []
+    for path in paths:
+        if path not in seen:
+            seen.add(path)
+            unique.append(path)
+    return unique
+
+
+def edit_scope_warning(
+    root: Path,
+    hook_input: dict[str, Any],
+    *,
+    fallback_for_unbound: bool = False,
+) -> str:
+    """At most one line when the edited file is outside the task's
+    file-scope whitelist. Silence rules: no active in_progress/review
+    task, a subagent session, an in-scope path, an unreadable whitelist,
+    or no extractable path. `fallback_for_unbound` follows the calling
+    host's policy (zcode: true). Never raises — the edit has already
+    happened."""
+    try:
+        task_path, status, _source = _get_active_task_with_fallback(
+            root, hook_input, fallback_for_unbound
+        )
+    except Exception:
+        return ""
+    if not task_path or status not in STAGE_CONTRACT_STATES:
+        return ""
+    if _session_scope(root, hook_input) == "subagent":
+        return ""
+    paths = extract_edited_paths(hook_input.get("tool_input"))
+    if not paths:
+        return ""
+    try:
+        from services.fact_view import file_scope_whitelist, path_in_scope
+
+        whitelist = file_scope_whitelist(root, root / task_path)
+    except Exception:
+        return ""
+    for file_path in paths:
+        # Hosts pass absolute edit paths; whitelist entries are
+        # repo-relative. Same normalization as run_edit_checks took.
+        normalized = file_path.replace("\\", "/").strip()
+        try:
+            normalized = (
+                Path(normalized).resolve().relative_to(root.resolve()).as_posix()
+            )
+        except (ValueError, OSError):
+            pass
+        try:
+            if path_in_scope(whitelist, normalized).get("inScope"):
+                continue
+        except Exception:
+            return ""
+        while normalized.startswith("./"):
+            normalized = normalized[2:]
+        return (
+            f"⚠️ {normalized} is outside the task's declared scope. "
+            "If intended, declare it in the task's `implement.jsonl` (agent-mutable) "
+            "or revert the edit."
+        )
+    return ""

package/template/.cowork-flow/scripts/adapters/host/opencode_policy.py

@@ -12,6 +12,10 @@ session file probe (session_start_event=None), as with codex.
 
 from __future__ import annotations
 
+from pathlib import Path
+from typing import Any
+
+from adapters.host.edit_scope import edit_scope_warning
 from adapters.host.policy_base import HostPolicy
 
 OPENCODE_DIGEST_POLICY = (
@@ -20,6 +24,13 @@ OPENCODE_DIGEST_POLICY = (
 )
 
 
+def post_tool_use(root: Path, hook_input: dict[str, Any]) -> tuple[str, int]:
+    """PostToolUse transport for the plugin's tool.execute.after hook: the
+    edit-scope advisory is bare text (emit_text), appended to the finished
+    tool output by the shim. Exit 0 — never blocks the edit."""
+    return edit_scope_warning(root, hook_input), 0
+
+
 POLICY = HostPolicy(
     host="opencode",
     digest_policy=OPENCODE_DIGEST_POLICY,
@@ -29,4 +40,5 @@ POLICY = HostPolicy(
     emit_not_initialized=True,
     # stdout is the injection itself: the shim forwards it verbatim.
     emit_text=True,
+    post_tool_use=post_tool_use,
 )

package/template/.cowork-flow/scripts/adapters/host/qoder_policy.py

@@ -3,9 +3,7 @@
 
 Rendering stays in workflow_state_hook.py; this module owns only what Qoder
 changes. Qoder shares the JSON envelope shape (`hookSpecificOutput`) with
-claude-code and codex, but its `PostToolUse` is not a blockable event: exit 2
-there is ignored, so the edit-phase spec advisory must travel as
-`additionalContext` on exit 0 instead of stderr.
+claude-code and codex.
 
 Host assets (hooks declaration, fixed subagents, commands, skills) ship as a
 machine-level Qoder plugin, so the hook reaches this entry through the plugin
@@ -17,8 +15,9 @@ from __future__ import annotations
 from pathlib import Path
 from typing import Any
 
+from adapters.host.edit_scope import edit_scope_warning
 from adapters.host.policy_base import HostPolicy
-from adapters.host.workflow_state_hook import hook_state_summary, spec_edit_warning
+from adapters.host.workflow_state_hook import hook_state_summary
 
 QODER_PREAMBLE = (
     (
@@ -34,7 +33,10 @@ def preamble(root: Path) -> tuple[str, ...]:
 
 
 def post_tool_use(root: Path, hook_input: dict[str, Any]) -> tuple[str, int]:
-    return spec_edit_warning(root, hook_input, POLICY), 0
+    """PostToolUse transport: the edit-scope advisory rides the standard
+    additionalContext envelope, exit 0 (never a systemMessage — that gate
+    stays on the two injecting events)."""
+    return edit_scope_warning(root, hook_input), 0
 
 
 # The task directory name is user-chosen and unbounded, and the host renders

package/template/.cowork-flow/scripts/adapters/host/workflow_state_hook.py

@@ -466,97 +466,6 @@ def _stage_contract_block(
         return None
 
 
-_APPLY_PATCH_FILE_RE = re.compile(
-    r"^\*\*\* (?:Update|Add|Delete) File: (.+?)\s*$", re.MULTILINE
-)
-
-
-def _extract_edited_paths(tool_input: Any) -> list[str]:
-    """Best-effort edited file paths from a PostToolUse tool_input payload.
-
-    Hosts differ: claude-code and zcode pass file_path, while codex's
-    apply_patch carries the paths inside the patch text. Returning every
-    extractable path keeps a multi-file patch from silently skipping
-    checks; deduplication keeps one edit from burning the throttle window
-    on the same file twice."""
-    if not isinstance(tool_input, dict):
-        return []
-    paths: list[str] = []
-    for key in ("file_path", "filePath", "path"):
-        value = tool_input.get(key)
-        if isinstance(value, str) and value.strip():
-            paths.append(value.strip())
-    for key in ("input", "patch", "patchText"):
-        text = tool_input.get(key)
-        if isinstance(text, str):
-            paths.extend(
-                match.strip() for match in _APPLY_PATCH_FILE_RE.findall(text)
-            )
-    seen: set[str] = set()
-    unique: list[str] = []
-    for path in paths:
-        if path not in seen:
-            seen.add(path)
-            unique.append(path)
-    return unique
-
-
-def spec_edit_warning(
-    root: Path,
-    hook_input: dict[str, Any],
-    policy: HostPolicy,
-) -> str:
-    """Editor-phase spec-check single-line warning (PostToolUse short path).
-
-    Delegated subagents are the primary coders, so spec violations must
-    reach them too: only an active in_progress/review task is required —
-    session scope is not consulted here (scope warnings stay main-only in
-    the zcode policy's edit_scope_warning). Hosts with
-    fallback_for_unbound (zcode) follow another main session's binding for
-    their never-bound hook sessions only while exactly one main-session
-    binding exists (see _get_active_task_with_fallback); strict-identity
-    hosts (claude-code/codex) require the calling session's own binding.
-    no_task, planning, and completed stay silent. Empty string means
-    silent. Never raises — the editor path must not break edits.
-    """
-    try:
-        task_path, status, _source = _get_active_task_with_fallback(
-            root, hook_input, policy.fallback_for_unbound
-        )
-    except Exception:
-        return ""
-    if not task_path or status not in STAGE_CONTRACT_STATES:
-        return ""
-    paths = _extract_edited_paths(hook_input.get("tool_input"))
-    if not paths:
-        return ""
-    try:
-        from services.spec_check import run_edit_checks
-
-        for path in paths:
-            warning = run_edit_checks(root, path)
-            if warning:
-                return warning
-        return ""
-    except Exception:
-        return ""
-
-
-def spec_only_post_tool_use(
-    root: Path,
-    hook_input: dict[str, Any],
-    policy: HostPolicy,
-) -> tuple[str, int]:
-    """claude-code / codex PostToolUse transport: spec-check advisory on
-    stderr only (exit 2 surfaces it to the model); the edit itself has
-    already happened. No additionalContext payload."""
-    warning = spec_edit_warning(root, hook_input, policy)
-    if warning:
-        print(warning, file=sys.stderr)
-        return "", 2
-    return "", 0
-
-
 def _load_breadcrumbs(root: Path) -> dict[str, str]:
     path = (
         root

package/template/.cowork-flow/scripts/adapters/host/zcode_policy.py

@@ -4,27 +4,20 @@
 Rendering stays in workflow_state_hook.py (single source shared with the
 other hosts); this module owns only what is zcode-specific — the digest
 policy wording, the newest-session fallback for unbound hook sessions, the
-rebind hints and essential-files check ported from the zcode JS hook, the
-merged scope+spec edit warning, and the PostToolUse transport contract the
-zcode shim relies on.
+rebind hints and essential-files check ported from the zcode JS hook, and
+the PostToolUse transport contract the zcode shim relies on.
 """
 
 from __future__ import annotations
 
 import json
 import re
-import sys
 from pathlib import Path
 from typing import Any
 
+from adapters.host.edit_scope import edit_scope_warning
 from adapters.host.policy_base import HostPolicy
-from adapters.host.workflow_state_hook import (
-    STAGE_CONTRACT_STATES,
-    _get_active_task_with_fallback,
-    _session_scope,
-    build_hook_context,
-    spec_edit_warning,
-)
+from adapters.host.workflow_state_hook import build_hook_context
 
 # Wording frozen by context-injection.md: zcode drops the
 # registry warning and asks for the fingerprint every hook.
@@ -162,72 +155,12 @@ def essential_files_warning(root: Path) -> str:
     )
 
 
-def edit_scope_warning(root: Path, hook_input: dict[str, Any]) -> str:
-    """Per-edit out-of-scope warning (zcode-only capability). Port of the
-    zcode hook's editScopeWarning: at most one line when the edited file is
-    outside the task's file-scope whitelist. Silence rules match the JS
-    source, including the newest-session display fallback for sessions with
-    no resolvable identity. Never raises."""
-    try:
-        task_path, status, _source = _get_active_task_with_fallback(
-            root, hook_input, POLICY.fallback_for_unbound
-        )
-    except Exception:
-        return ""
-    if not task_path or status not in STAGE_CONTRACT_STATES:
-        return ""
-    if _session_scope(root, hook_input) == "subagent":
-        return ""
-    tool_input = hook_input.get("tool_input")
-    file_path = (
-        tool_input.get("file_path") if isinstance(tool_input, dict) else None
-    )
-    if not isinstance(file_path, str) or not file_path.strip():
-        return ""
-    # Hosts pass absolute edit paths; whitelist entries are
-    # repo-relative. Same normalization as run_edit_checks.
-    normalized = file_path.replace("\\", "/").strip()
-    try:
-        normalized = (
-            Path(normalized).resolve().relative_to(root.resolve()).as_posix()
-        )
-    except (ValueError, OSError):
-        pass
-    try:
-        from services.fact_view import file_scope_whitelist, path_in_scope
-
-        whitelist = file_scope_whitelist(root, root / task_path)
-        if path_in_scope(whitelist, normalized).get("inScope"):
-            return ""
-    except Exception:
-        return ""
-    while normalized.startswith("./"):
-        normalized = normalized[2:]
-    return (
-        f"⚠️ {normalized} is outside the task's declared scope. "
-        "If intended, add it with `task context add` (agent-mutable) "
-        "or revert the edit."
-    )
-
-
-def merged_edit_warning(root: Path, hook_input: dict[str, Any]) -> str:
-    """zcode PostToolUse Edit/Write/MultiEdit context: the scope warning and
-    the spec-check warning merged into one additionalContext payload, at
-    most one line each, joined by a newline (port of the zcode hook's
-    mergedEditWarning)."""
-    scope_line = edit_scope_warning(root, hook_input)
-    spec_line = spec_edit_warning(root, hook_input, POLICY)
-    if scope_line and spec_line:
-        return f"{scope_line}\n{spec_line}"
-    return scope_line or spec_line
-
-
 def post_tool_use(root: Path, hook_input: dict[str, Any]) -> tuple[str, int]:
-    """zcode PostToolUse transport: Edit/Write/MultiEdit get the merged
-    edit warning; Bash events refresh the full state only for workflow
-    lifecycle commands (the shim pre-filters the common case, this keeps
-    the entry correct standalone). Edit storms must not multiply the
-    injection payload."""
+    """zcode PostToolUse transport: Edit/Write/MultiEdit get the shared
+    scope warning (with zcode's newest-session fallback); Bash events
+    refresh the full state only for workflow lifecycle commands (the shim
+    pre-filters the common case, this keeps the entry correct standalone).
+    Edit storms must not multiply the injection payload."""
     tool_name = str(hook_input.get("tool_name") or "")
     tool_input = hook_input.get("tool_input")
     file_path = (
@@ -238,7 +171,12 @@ def post_tool_use(root: Path, hook_input: dict[str, Any]) -> tuple[str, int]:
         and isinstance(file_path, str)
         and file_path.strip()
     ):
-        return merged_edit_warning(root, hook_input), 0
+        return (
+            edit_scope_warning(
+                root, hook_input, fallback_for_unbound=POLICY.fallback_for_unbound
+            ),
+            0,
+        )
     if not is_lifecycle_bash(hook_input):
         return "", 0
     claim_after_lifecycle_bash(root, hook_input)