Use black

flake.nix

@@ -62,6 +62,7 @@
           pre-commit-check = nix-pre-commit-hooks.lib.${system}.run {
             src = ./.;
             hooks = {
+              black.enable = true;
               nixpkgs-fmt.enable = true;
               shellcheck.enable = true;
             };
@@ -138,6 +139,7 @@
 
         devShell = pkgs.mkShell {
           buildInputs = (with pkgs; [
+            black
             nixpkgs-fmt
             shellcheck
             sops

pkgs/bwrap-helper/bwrap-helper.py

@@ -15,7 +15,9 @@ def add_switch(name: str, default=False):
     if default:
         parser.add_argument(f"--no-{name}", dest=name, action="store_false")
     else:
-        parser.add_argument(f"--{name}", dest=name, action="store_true", default=default)
+        parser.add_argument(
+            f"--{name}", dest=name, action="store_true", default=default
+        )
 
 
 def tmp_file(name: str):
@@ -76,42 +78,72 @@ path_entries = [
 ]
 
 argument_groups = {
-    "base": (True, [
+    "base": (
-        "--tmpfs", "/tmp",
+        True,
-        "--proc", "/proc",
+        [
-        "--dev", "/dev",
+            "--tmpfs",
-        "--dir", home,
+            "/tmp",
-        "--dir", f"/run/user/{uid}",
+            "--proc",
+            "/proc",
+            "--dev",
+            "/dev",
+            "--dir",
+            home,
+            "--dir",
+            f"/run/user/{uid}",
             *ro_bind("/etc/localtime"),
             "--unshare-all",
             "--die-with-parent",
-    ]),
+        ],
-    "nix-store": (True, [
+    ),
-        *flat_map(ro_bind, [
+    "nix-store": (
+        True,
+        [
+            *flat_map(
+                ro_bind,
+                [
                     "/nix/store",
                     "/etc/static",
-        ]),
+                ],
-    ]),
+            ),
-    "path": (True, [
+        ],
+    ),
+    "path": (
+        True,
+        [
             *flat_map(ro_bind_try, path_entries),
             *setenv("PATH", ":".join(path_entries)),
-        *ro_bind_try("/run/current-system/sw")  # not really path, but also libraries etc.
+            *ro_bind_try(
-    ]),
+                "/run/current-system/sw"
-    "gui": (False, [
+            ),  # not really path, but also libraries etc.
+        ],
+    ),
+    "gui": (
+        False,
+        [
             *dev_bind("/dev/dri"),
-        *flat_map(ro_bind, [
+            *flat_map(
+                ro_bind,
+                [
                     "/sys/dev/char",
                     "/sys/devices/pci0000:00",
                     f"/run/user/{uid}/{os.getenv('WAYLAND_DISPLAY')}",
                     "/run/opengl-driver",
                     "/etc/fonts",
-        ]),
+                ],
+            ),
             *ro_bind_try("/run/opengl-driver-32"),
-    ]),
+        ],
-    "x11": (False, [
+    ),
+    "x11": (
+        False,
+        [
             *ro_bind("/tmp/.X11-unix"),
-    ]),
+        ],
-    "audio": (False, [
+    ),
+    "audio": (
+        False,
+        [
             *ro_bind(f"/run/user/{uid}/pulse"),
             # should in theory autodetect, but sometimes it does not work
             *setenv("PULSE_SERVER", f"/run/user/{uid}/pulse/native"),
@@ -120,38 +152,62 @@ argument_groups = {
             *setenv("PULSE_COOKIE", f"{home}/.config/pulse/cookie"),
             # ALSA compat
             *ro_bind("/etc/asound.conf"),
-    ]),
+        ],
-    "passwd": (False, [
+    ),
+    "passwd": (
+        False,
+        [
             *ro_bind(
                 generate_tmp_file(
                     "passwd",
-                f"{username}:x:{uid}:{gid}::{home}:/run/current-system/sw/bin/bash\n"
+                    f"{username}:x:{uid}:{gid}::{home}:/run/current-system/sw/bin/bash\n",
                 ),
-            "/etc/passwd"
+                "/etc/passwd",
             )
-    ]),
+        ],
-    "network": (False, [
+    ),
+    "network": (
+        False,
+        [
             "--share-net",
-        *flat_map(ro_bind, [
+            *flat_map(
+                ro_bind,
+                [
                     "/etc/resolv.conf",
                     "/etc/ssl/certs",
-        ]),
+                ],
-    ]),
+            ),
-    "dbus": (False, [
+        ],
+    ),
+    "dbus": (
+        False,
+        [
             *ro_bind("/run/dbus/system_bus_socket"),
             *ro_bind(generate_tmp_file("machine-id", "0" * 32), "/etc/machine-id"),
-    ]),
+        ],
-    "new-session": (True, [
+    ),
+    "new-session": (
+        True,
+        [
             "--new-session",
-    ]),
+        ],
-    "pwd": (False, [
+    ),
+    "pwd": (
+        False,
+        [
             *ro_bind(os.getcwd()),
-        "--chdir", os.getcwd(),
+            "--chdir",
-    ]),
+            os.getcwd(),
-    "pwd-rw": (False, [
+        ],
+    ),
+    "pwd-rw": (
+        False,
+        [
             *bind(os.getcwd()),
-        "--chdir", os.getcwd(),
+            "--chdir",
-    ]),
+            os.getcwd(),
+        ],
+    ),
 }
 
 passthrough_args = [