sfw wrapper for uv run -- send dependency resolution through the sfw firewall, but not the actual command (child process)

gistfile1.txt

# uv() — sfw wrapper. Goal: dependency resolution (sync/add/pip/tool/...)
# runs inside sfw; the program launched by `uv run` runs OUTSIDE sfw.
# (aliasing `uv` to `sfw uv` breaks networking of inner command in `uv run inner_command`)
# sfw filters the whole process tree, so we split `uv run X` into:
#   sfw uv sync <env-flags>   (network, filtered)
#   uv run --no-sync ... X    (exec, unfiltered)
# Debug: `type uv`, `command uv ...` to bypass, UV_SFW_TRACE=1 to print cmds.
uv() {
  _uv_exec() {
    [[ -n "$UV_SFW_TRACE" ]] && printf 'uv-wrapper> %q ' "$@" >&2 && echo >&2
    command "$@"
  }

  # everything except `run` → wrap wholesale (safe default: over-filter)
  if [[ "$1" != "run" ]]; then
    _uv_exec sfw uv "$@"
    return
  fi
  shift

  # Collect env-shaping flags so the sync step builds the env run expects.
  # MAINTENANCE: if a new `uv run` flag changes env contents, add it below.
  # Missing-flag symptom: run errors on stale env, or the `-*` warning fires.
  local -a envflags=()
  while (( $# )); do
    case "$1" in
      # flags with value
      --extra|--group|--only-group|--no-group|--package|--python|-p)
        (( $# < 2 )) && { echo "uv-wrapper: $1 needs a value" >&2; return 2; }
        envflags+=("$1" "$2"); shift 2 ;;
      # boolean flags
      --all-extras|--all-groups|--no-dev|--dev|--locked|--frozen|--exact)
        envflags+=("$1"); shift ;;
      # ephemeral deps resolve at run time — no separate sync exists,
      # so the split is impossible: run fully under sfw.
      # (Workaround: prewarm once, then `command uv run --offline ...`.)
      --with|--with-requirements|--with-editable)
        (( $# < 2 )) && { echo "uv-wrapper: $1 needs a value" >&2; return 2; }
        _uv_exec sfw uv run "${envflags[@]}" "$1" "$2" "${@:3}"; return ;;
      --) shift; break ;;
      # unknown flag: can't tell if env-shaping or value-taking → fail safe
      -*)
        echo "uv-wrapper: unknown flag '$1', full sfw wrap (extend wrapper?)" >&2
        _uv_exec sfw uv run "${envflags[@]}" "$@"; return ;;
      # first non-flag = command. NB: PEP 723 scripts resolve deps at run
      # time too → prewarm those with `sfw uv run script.py` once.
      *) break ;;
    esac
  done

  (( $# == 0 )) && { _uv_exec sfw uv run "${envflags[@]}"; return; }

  # envflags passed to BOTH: sync (build the right env) and run
  # (--package/--python also affect env selection). Abort if sync fails.
  _uv_exec sfw uv sync "${envflags[@]}" || return
  _uv_exec uv run --no-sync "${envflags[@]}" "$@"
}