support single-command elevation for switches by atagen · Pull Request #797 · nix-community/nh

atagen · 2026-09-17T13:43:53Z

this PR enables "single elevation", ie. a full switch to be performed in a single child process.

this benefits run0 users and others without persistent/cached authorisation in their environment.

it is used with the --single-elevation flag, or the NH_SINGLE_ELEVATION variable (which can be set by a module option).
exclusion is achieved with --no-single-elevation in the case of the variable being present but the user desiring a one-off non-single-elevation switch.

it is achieved by the nh process re-executing itself privileged using a hidden argument, with the elevated child performing all necessary actions for the switch.

presently, it only effects the switch command, although could be extended to others if desired.

in order to make this feasible without bloating function signatures, it also flattens the elevate/ElevationStrategy bool/enum pair to an Option<ElevationStrategy>, with the matching semantics you'd expect.

Sanity Checking

Add a 👍 reaction to pull requests you find important.

Elevation programs without cached authorization otherwise prompt once for every privileged switch step.

coderabbitai · 2026-09-17T13:44:12Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Advanced

Run ID: 4e795ef8-9c43-4b48-a976-9044ee5f65c6

📥 Commits

Reviewing files that changed from the base of the PR and between 3c05c01 and d55a464.

📒 Files selected for processing (6)

CHANGELOG.md
crates/nh-nixos/src/args.rs
crates/nh-nixos/src/nixos.rs
crates/nh/src/interface.rs
crates/xtask/src/man.rs
docs/README.md

Included review availability: Your plan provides up to 8 included reviews per hour; 7 remain after this review.

📝 Walkthrough

Walkthrough

The PR adds --single-elevation and NH_SINGLE_ELEVATION for local nh os switch operations. It introduces a hidden internal command that runs activation, profile installation, and bootloader updates within one elevated process.

Changes

Single-elevation switch

Layer / File(s)	Summary
Command and argument contract `crates/nh-nixos/src/args.rs`, `crates/nh/src/interface.rs`	The switch command accepts single-elevation flags and defines arguments for the hidden `__single-elevation` command. Dispatch and feature handling support the new command.
Elevated switch execution `crates/nh-nixos/src/nixos.rs`	Local switch execution can re-execute the binary with elevation, then run activation, profile installation, and bootloader commands. The option is rejected with `--target-host`.
Configuration and documentation `CHANGELOG.md`, `crates/xtask/src/man.rs`, `docs/README.md`	The changelog, man-page environment table, README configuration example, and environment-variable documentation describe single elevation.

Suggested reviewers: faukah

Priority: ⬇️ Low

Merge Risk: ⚪ Minimal · up to d55a4

This change adds an opt-in single-elevation mode for local NixOS switches that consolidates repeated authorization prompts into one privileged re-execution, while preserving the existing remote and non-single-elevation behavior. Inspection of the new privileged execution path found the expected safeguards in place (an independent root check in the elevated child, and normal dry-run handling before any elevation occurs), so this looks safe to merge as an opt-in feature.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 38.89% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 18 functions across 4 files. (2 skipped: …	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly and concisely describes the main change: single-command elevation for switch operations.
Description check	✅ Passed	The description directly explains single-elevation support, its configuration flags, behavior, motivation, and scope.

Full details: Docstring Coverage

Explanation

Docstring coverage is 38.89% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 18 functions across 4 files. (2 skipped: 2 unsupported.)

Fix all pre-merge checks with AI

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

NotAShelf · 2026-09-17T14:14:26Z

  programs.nh = {
-    enable = true;
-    clean.enable = true;
+      enable = true;


You seem to have forgotten to add this option to the NixOS module. Do you intend for this to be nixpkgs-module exclusive?

oops, I didn't even realise you'd nuked this repo's module and I guess I just skipped over it, lol

faukah · 2026-09-17T15:42:15Z

+  #[arg(long, env = "NH_SINGLE_ELEVATION", value_parser = clap::builder::BoolishValueParser::new())]
+  pub single_elevation: bool,
+
+  #[arg(long)]
+  pub no_single_elevation: bool,


Why would we use both of these? I assume we can just do --single-elevation=false if we want to disable single-command elevation?

makes sense, the main reason is giving an escape hatch to people who set single elevation in their system and want a one-off, but just making it an on-by-default boolean is probably better

faukah · 2026-09-17T15:49:06Z

+fn forwarded_verbosity_args(
+  args: impl IntoIterator<Item = OsString>,
+) -> Vec<OsString> {
+  args
+    .into_iter()
+    .take_while(|arg| arg != "--")
+    .filter(|arg| {
+      arg.to_str().is_some_and(|arg| {
+        matches!(arg, "--verbose" | "--quiet")
+          || arg.strip_prefix('-').is_some_and(|short| {
+            !short.is_empty()
+              && short.chars().all(|flag| matches!(flag, 'v' | 'q'))
+          })
+      })
+    })
+    .collect()
+}


its true...

atagen · 2026-09-17T15:59:42Z

thank you both for the review - before I take any further action to rectify these issues, @faukah has mentioned that you'd consider making single elevation the default strategy.

what do you think, @NotAShelf ? I'd be happy enough to expand the scope here if it's desired, or I can just patch up and follow @faukah's suggestion up in later work.

NotAShelf · 2026-09-17T20:00:40Z

thank you both for the review - before I take any further action to rectify these issues, @faukah has mentioned that you'd consider making single elevation the default strategy.

what do you think, @NotAShelf ? I'd be happy enough to expand the scope here if it's desired, or I can just patch up and follow @faukah's suggestion up in later work.

Fine by me.

atagen added 2 commits September 17, 2026 22:47

nh-nixos: model activation elevation as an option

172d575

nh-nixos: support single-command elevation for switches

d55a464

Elevation programs without cached authorization otherwise prompt once for every privileged switch step.

atagen changed the title ~~nh-nixos: model activation elevation as an option~~ support single-command elevation for switches Sep 17, 2026

NotAShelf reviewed Sep 17, 2026

View reviewed changes

faukah approved these changes Sep 17, 2026

View reviewed changes

Navigation Menu

Uh oh!

support single-command elevation for switches - #797

support single-command elevation for switches#797
atagen wants to merge 2 commits into
nix-community:masterfrom
atagen:single-command-activation

atagen commented Sep 17, 2026

Uh oh!

coderabbitai Bot commented Sep 17, 2026 •

edited

Loading

Walkthrough

Changes

❌ Failed checks (1 warning)

Uh oh!

NotAShelf Sep 17, 2026

Uh oh!

atagen Sep 17, 2026 •

edited

Loading

Uh oh!

faukah Sep 17, 2026

Uh oh!

atagen Sep 17, 2026

Uh oh!

Uh oh!

faukah Sep 17, 2026

Uh oh!

NotAShelf Sep 17, 2026

Uh oh!

atagen Sep 17, 2026

Uh oh!

atagen commented Sep 17, 2026

Uh oh!

NotAShelf commented Sep 17, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

atagen commented Sep 17, 2026

Sanity Checking

Uh oh!

coderabbitai Bot commented Sep 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

❌ Failed checks (1 warning)

Uh oh!

NotAShelf Sep 17, 2026

Choose a reason for hiding this comment

Uh oh!

atagen Sep 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

faukah Sep 17, 2026

Choose a reason for hiding this comment

Uh oh!

atagen Sep 17, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

faukah Sep 17, 2026

Choose a reason for hiding this comment

Uh oh!

NotAShelf Sep 17, 2026

Choose a reason for hiding this comment

Uh oh!

atagen Sep 17, 2026

Choose a reason for hiding this comment

Uh oh!

atagen commented Sep 17, 2026

Uh oh!

NotAShelf commented Sep 17, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

coderabbitai Bot commented Sep 17, 2026 •

edited

Loading

atagen Sep 17, 2026 •

edited

Loading