Bugs and follow-ups from namespace scoping (#707)

[SaulMoro]

Found while building #816 (#707). All predate it; none block it. Line refs are on #816's head (a2b817ad).

Status

#	Resolution
1	#833 (merged): an entry with a key its schema does not know is not delivered, and pull and doctor name the file, entry and key
2	not a bug: tags reaching a tagged skill in an inactive namespace is what #337 added (e2e/roles-tags-pull.test.ts); #833 (merged) fixed the design doc that listed it as a gap
3	#832 (merged): pull --dry-run reports the hooks and MCP warnings
4	#833 (merged): English closing line
5	#865 (merged): pull records what it delivered and keeps a locally changed copy; with the record, the #816 leftover warning no longer names a member's own file

Follow-ups noticed:

• A mistyped top-level key in a hooks or MCP file (server: for servers:) is still ignored. Fixed in fix(pull): do not deliver an env, hook or MCP entry with a mistyped key (#822) #833 (merged): the file fails and what is installed is kept, as env.yaml already did.
• env list, mcp list, hooks list and status do not name an entry that is not delivered, for projects: either. fix(env,hooks,mcp,status): name the entries that are not delivered (#822) #851 (open, external). Last open item: this issue closes when fix(env,hooks,mcp,status): name the entries that are not delivered (#822) #851 merges.
• env add on a variable that is not delivered reports Updated without saying so. Fixed in fix(pull): do not deliver an env, hook or MCP entry with a mistyped key (#822) #833 (merged): it warns that pull will not deliver it.

#	Kind	Area	Impact
1	bug	env / hooks / MCP entry keys	a typo in a scoping key sends the entry to everyone
2	bug	skills tag channel	a skill of an inactive namespace reaches the member
3	bug	pull --dry-run	hooks / MCP warnings never show
4	bug	recall output	Chinese line in CLI output (repo rule: English only)
5	enhancement	pull overwrite	local edits to a delivered skill / agent / rule are lost without a warning

Removed: enabling noUnusedLocals (or adopting knip) will be decided separately.

1. Unknown entry keys are dropped silently (bug)

env/env.yaml
  - key: DB_URL
    value: ...
    role: [frontend]        # typo of `roles`
today     zod strips `role`  →  DB_URL reaches every member
expected  entry rejected, warning names the file and the key

Entry schemas are plain z.object (strip): EnvVariableSchema (src/resources/env.ts:21), TeamHookSchema (src/resources/hooks.ts:19), the MCP server schema (src/resources/mcp.ts). Fail closed, like the removed projects: key in #816.

2. Tags pull skills from inactive namespaces (bug)

skills/billing/invoice/   tagged `finance`     member: namespaces [checkout], subscribed [finance]
today     invoice is delivered, though billing is not active
expected  tags select among root + active namespaces only

filterByTags runs over every team skill (src/resources/desired.ts:253), not the active set.

3. pull --dry-run shows no hooks / MCP warnings (bug)

teamai pull --dry-run
  reconcileHooksAllScopes   if (dryRun) return   (src/pull.ts:2013)
  reconcileMcpAllScopes     if (dryRun) return   (src/pull.ts:2044)
today     no unknown-id, `roles:` deprecation or conflict warnings
expected  resolve and warn, then skip the write

A maintainer runs --dry-run to see exactly these.

4. Chinese footer in recall (bug)

src/recall.ts:236 appends 以上内容来自团队知识库，仅供参考。…. CLAUDE.md: "CLI user-facing output must be English." Replace with an English line and assert it in tests.

5. Pull overwrites local edits (enhancement)

today     every full pull re-copies skills / agents / rules over the local copy
          only deletion is gated (byte-equal)
expected  a locally changed copy is kept, and pull names it with the next step

Needs a per-item record of what was delivered.

The same record would quiet a skill warning #816 adds (81692686). When the skill version changes, pull keeps any installed file that is not byte-equal to another version's file at that path and names it on every pull (removeLeftoverVersionFiles, src/resources/skills.ts). A member's own file at such a path, e.g. README.md, is therefore named on every pull. With per-file delivery records, pull could tell a leftover it wrote from the member's file and stay quiet.