Format Markdown with prettier in make fmt and fmt-check (closes #23)

`make fmt` now runs prettier over the Markdown files after the Go
formatters, and `make fmt-check` fails when prettier would change one.
`package.json`, `yarn.lock`, `.prettierrc` and `.prettierignore` are the
`sneak/prompts` copies at `dd4027b`, except for `"private": true` in
`package.json` in place of the licence field. Both scripts find yarn the
way that repo's scripts do. `script/bootstrap` installs prettier with
`yarn install --frozen-lockfile`. When the yarn those scripts would run
is not 1.22.22, it installs yarn through corepack under node 22.17.0:
the node on `PATH` if it has that version, otherwise one installed
through nvm from a hash-checked archive. `README.md` and `TODO.md` are
reformatted once.

Model: opus-5-5

script/bootstrap

@@ -6,7 +6,11 @@
 # goimports is installed via `go install` at a pinned commit (never
 # "latest"), unless the installed one already has the pinned version.
 # The linter is not installed: it runs only as the lint phase of the
-# Dockerfile.
+# Dockerfile. yarn is installed via corepack unless the yarn that
+# script/fmt runs already has the pinned version. It is installed under
+# the node on PATH if that has the pinned version; otherwise the pinned
+# node is installed via nvm (installing nvm itself first, from a
+# hash-verified release archive, never curl | sh).
 set -eu
 
 ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
@@ -16,6 +20,13 @@ ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
 GOIMPORTS_VERSION="v0.42.0"
 GOIMPORTS_REF="golang.org/x/tools/cmd/goimports@009367f5c17a8d4c45a961a3a509277190a9a6f0"
 
+# Pinned versions, 2026-07-06
+NODE_VERSION="22.17.0"
+NVM_VERSION="0.40.3"
+# sha256 of https://github.com/nvm-sh/nvm/archive/refs/tags/v0.40.3.tar.gz
+NVM_SHA256="5f4d6aaa04a177dc93c985e31dbc411ab6b8c6e1e21d8015dbc1372625fcd1d0"
+YARN_VERSION="1.22.22"
+
 PKGMGR=""
 SUDO=""
 APT_UPDATED=""
@@ -87,6 +98,103 @@ ensure_goimports() {
     echo "goimports $GOIMPORTS_VERSION installed"
 }
 
+# verify_sha256 <file> <expected-hash>
+verify_sha256() {
+    if command -v sha256sum >/dev/null 2>&1; then
+        actual="$(sha256sum "$1" | cut -d' ' -f1)"
+    else
+        actual="$(shasum -a 256 "$1" | cut -d' ' -f1)"
+    fi
+    if [ "$actual" != "$2" ]; then
+        echo "bootstrap: sha256 mismatch for $1" >&2
+        echo "  expected: $2" >&2
+        echo "  actual:   $actual" >&2
+        exit 1
+    fi
+}
+
+# nvm is a bash script; run a command in a bash with nvm loaded
+nvm_sh() {
+    bash -c ". \"\$HOME/.nvm/nvm.sh\" && $*"
+}
+
+ensure_nvm() {
+    [ -s "$HOME/.nvm/nvm.sh" ] && return 0
+    # nvm prerequisites; nvm itself requires bash
+    if missing bash; then pkg_install bash bash bash bash; fi
+    if missing curl; then pkg_install curl curl curl curl; fi
+    if missing git; then pkg_install git git git git; fi
+    tmp="$(mktemp -d)"
+    curl -fsSL -o "$tmp/nvm.tar.gz" \
+        "https://github.com/nvm-sh/nvm/archive/refs/tags/v${NVM_VERSION}.tar.gz"
+    verify_sha256 "$tmp/nvm.tar.gz" "$NVM_SHA256"
+    mkdir -p "$HOME/.nvm"
+    tar -xzf "$tmp/nvm.tar.gz" -C "$HOME/.nvm" --strip-components=1
+    rm -rf "$tmp"
+}
+
+# Print the version of the node on PATH, such as v22.17.0, or nothing.
+node_version() {
+    if missing node; then return 0; fi
+    node --version 2>/dev/null
+}
+
+ensure_node() {
+    if [ "$(node_version)" = "v$NODE_VERSION" ]; then
+        echo "node $NODE_VERSION already installed"
+        return 0
+    fi
+    ensure_nvm
+    nvm_sh "nvm install $NODE_VERSION"
+    echo "node $NODE_VERSION installed via nvm"
+}
+
+# Print the version of the yarn that script/fmt and script/fmt-check
+# run, or nothing: the yarn on PATH, else the one under the pinned node
+# in nvm.
+yarn_version() {
+    if ! missing yarn; then
+        yarn --version 2>/dev/null
+    elif [ -s "$HOME/.nvm/nvm.sh" ]; then
+        nvm_sh "nvm use $NODE_VERSION >/dev/null && yarn --version" \
+            2>/dev/null
+    fi
+}
+
+# A yarn that already has the pinned version is used with the node that
+# runs it. Otherwise yarn is installed via corepack under the pinned
+# node.
+ensure_yarn() {
+    if [ "$(yarn_version)" = "$YARN_VERSION" ]; then
+        echo "yarn $YARN_VERSION already installed"
+        return 0
+    fi
+    ensure_node
+    if [ "$(node_version)" = "v$NODE_VERSION" ]; then
+        corepack enable
+        corepack prepare "yarn@$YARN_VERSION" --activate
+    else
+        nvm_sh "nvm use $NODE_VERSION >/dev/null && corepack enable && \
+            corepack prepare yarn@$YARN_VERSION --activate"
+    fi
+    hash -r
+    if [ "$(yarn_version)" != "$YARN_VERSION" ]; then
+        echo "bootstrap: the yarn script/fmt runs is not $YARN_VERSION:" \
+            "$(command -v yarn || echo "none on PATH")" >&2
+        exit 1
+    fi
+    echo "yarn $YARN_VERSION installed"
+}
+
+install_js_deps() {
+    if missing yarn && [ -s "$HOME/.nvm/nvm.sh" ]; then
+        nvm_sh "nvm use $NODE_VERSION >/dev/null && cd \"$ROOT\" && \
+            yarn install --frozen-lockfile"
+    else
+        yarn install --frozen-lockfile
+    fi
+}
+
 main() {
     cd "$ROOT"
 
@@ -102,6 +210,9 @@ main() {
 
     go mod download
 
+    ensure_yarn
+    install_js_deps
+
     echo "bootstrap complete"
 }
 

script/fmt

@@ -4,6 +4,26 @@ set -eu
 
 ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
 
+# Must match the pin in script/bootstrap.
+NODE_VERSION="22.17.0"
+
+# script/bootstrap installs node and yarn under nvm and leaves neither
+# on the PATH of the shell that called it, so resolve the pinned
+# toolchain here the way bootstrap's own install step does. nvm is a
+# bash script, hence the subshell.
+run_yarn() {
+    if command -v yarn >/dev/null 2>&1; then
+        yarn "$@"
+        return
+    fi
+    if [ ! -s "$HOME/.nvm/nvm.sh" ]; then
+        echo "fmt: no yarn; run script/bootstrap first" >&2
+        exit 1
+    fi
+    bash -c '. "$HOME/.nvm/nvm.sh" && nvm use "$1" >/dev/null &&
+        shift && exec yarn "$@"' bash "$NODE_VERSION" "$@"
+}
+
 main() {
     cd "$ROOT"
     # script/bootstrap installs goimports into Go's bin directory, which
@@ -13,6 +33,7 @@ main() {
     PATH="$gobin:$PATH"
     gofmt -s -w .
     goimports -w .
+    run_yarn run prettier --write '**/*.md' --tab-width 4 --prose-wrap always
 }
 
 main "$@"

script/fmt-check

@@ -5,6 +5,26 @@ set -eu
 
 ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
 
+# Must match the pin in script/bootstrap.
+NODE_VERSION="22.17.0"
+
+# script/bootstrap installs node and yarn under nvm and leaves neither
+# on the PATH of the shell that called it, so resolve the pinned
+# toolchain here the way bootstrap's own install step does. nvm is a
+# bash script, hence the subshell.
+run_yarn() {
+    if command -v yarn >/dev/null 2>&1; then
+        yarn "$@"
+        return
+    fi
+    if [ ! -s "$HOME/.nvm/nvm.sh" ]; then
+        echo "fmt-check: no yarn; run script/bootstrap first" >&2
+        exit 1
+    fi
+    bash -c '. "$HOME/.nvm/nvm.sh" && nvm use "$1" >/dev/null &&
+        shift && exec yarn "$@"' bash "$NODE_VERSION" "$@"
+}
+
 main() {
     cd "$ROOT"
     # script/bootstrap installs goimports into Go's bin directory, which
@@ -18,6 +38,7 @@ main() {
         echo "$files" | sort -u >&2
         exit 1
     fi
+    run_yarn run prettier --check '**/*.md' --tab-width 4 --prose-wrap always
 }
 
 main "$@"