fix(doctor): host TLS repair runs under --no-interactive

The step delegates to hack global trust, which is itself
non-interactive-safe (sudo preflight; keychain-only skip; host trust
env always written) — classifying the whole repair as destructive
denied non-interactive runs the safe env/bundle writes. From PR
review.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: roodboi

src/commands/doctor.ts

@@ -3138,11 +3138,13 @@ async function maybeRepairMacHostTlsTrust(): Promise<void> {
   }
 
   note(hostTlsTrust.message, "doctor");
+  // Not classified destructive: `hack global trust` is itself
+  // non-interactive-safe — it preflights sudo and skips only the System
+  // keychain step, while the safe host trust env/bundle writes always run.
   const okRepair = await doctorConfirm({
     message:
-      "Repair macOS host TLS trust now? (Bun/Node/curl/git trust for https://*.hack; may prompt for sudo to update the System keychain)",
+      "Repair macOS host TLS trust now? (Bun/Node/curl/git trust for https://*.hack; the sudo System-keychain step is skipped automatically when it would prompt)",
     initialValue: true,
-    destructive: true,
   });
   if (!okRepair) {
     return;

tests/doctor-fix-noninteractive.test.ts

@@ -203,15 +203,16 @@ test("doctor --fix under HACK_NO_INTERACTIVE skips macOS keychain repair and rep
   ]);
 
   expect(code).toBe(0);
-  // Destructive/system-level step (macOS host TLS trust repair, which chains
-  // into a System keychain sudo prompt) is declined automatically and
-  // surfaced in the skipped-steps summary instead of hanging on a prompt.
+  // Host TLS repair is safe to run non-interactively: it delegates to
+  // `hack global trust`, which preflights sudo and skips only the System
+  // keychain step while still writing the host trust env. It must NOT be
+  // in the skipped-steps summary.
   const skippedNote = noteCalls.find((message) =>
     message.includes("Skipped (non-interactive")
   );
-  expect(skippedNote).toBeDefined();
-  expect(skippedNote).toContain("Repair macOS host TLS trust");
-  expect(skippedNote).toContain("hack doctor --fix");
+  if (skippedNote !== undefined) {
+    expect(skippedNote).not.toContain("Repair macOS host TLS trust");
+  }
 });
 
 test("doctor --fix never calls the raw clack confirm prompt under HACK_NO_INTERACTIVE", async () => {