rebuild: fix nh

modules/common/nix/default.nix

@@ -54,7 +54,11 @@ in {
   nix.optimise.automatic = true;
 
   environment.systemPackages = [
-    pkgs.nh
+    (pkgs.nh.overrideAttrs (old: {
+      patches = old.patches or [] ++ [
+        ./nh.patch
+      ];
+    }))
     pkgs.nix-index
     pkgs.nix-output-monitor
   ];

modules/common/nix/nh.patch

@@ -0,0 +1,28 @@
+diff --git i/src/darwin.rs w/src/darwin.rs
+index 64cdbd5..8bd337c 100644
+--- i/src/darwin.rs
++++ w/src/darwin.rs
+@@ -46,7 +46,7 @@ impl DarwinRebuildArgs {
+     fn rebuild(self, variant: &DarwinRebuildVariant) -> Result<()> {
+         use DarwinRebuildVariant::{Build, Switch};
+ 
+-        if nix::unistd::Uid::effective().is_root() {
++        if nix::unistd::Uid::effective().is_root() && !self.bypass_root_check {
+             bail!("Don't run nh os as root. I will call sudo internally as needed");
+         }
+ 
+diff --git i/src/interface.rs w/src/interface.rs
+index a7e199c..fc63b10 100644
+--- i/src/interface.rs
++++ w/src/interface.rs
+@@ -595,6 +595,10 @@ pub struct DarwinRebuildArgs {
+     /// Extra arguments passed to nix build
+     #[arg(last = true)]
+     pub extra_args: Vec<String>,
++
++    /// Don't panic if calling nh as root
++    #[arg(short = 'R', long, env = "NH_BYPASS_ROOT_CHECK")]
++    pub bypass_root_check: bool,
+ }
+ 
+ impl DarwinRebuildArgs {

rebuild.nu

@@ -60,8 +60,8 @@ def main --wrapped [
   ] | append ($args_split | get --ignore-errors 1 | default [])
 
   if (uname | get kernel-name) == "Darwin" {
-    NH_BYPASS_ROOT_CHECK=true NH_NO_CHECKS=true sudo nh darwin switch . ...$nh_flags -- ...$nix_flags
+    sudo NH_BYPASS_ROOT_CHECK=true NH_NO_CHECKS=true nh darwin switch . ...$nh_flags -- ...$nix_flags
   } else {
-    NH_BYPASS_ROOT_CHECK=true NH_NO_CHECKS=true sudo nh os switch . ...$nh_flags -- ...$nix_flags
+    NH_BYPASS_ROOT_CHECK=true NH_NO_CHECKS=true nh os switch . ...$nh_flags -- ...$nix_flags
   }
 }