Format Markdown with prettier in make fmt (closes #43)

script/fmt and script/fmt-check now run prettier on every Markdown file
after their Go steps, as the standard scripts from sneak/prompts at
dd4027b do. script/bootstrap gains the standard node, nvm and yarn
install next to its goimports install, and the last Dockerfile stage
copies package.json and yarn.lock before running it. .prettierrc,
.prettierignore and yarn.lock are the standard copies. package.json is
the standard one without its licence field and marked private, because
this repo's licence is the WTFPL. .dockerignore keeps the log of a failed
yarn install out of the build context. README.md and TODO.md are
reformatted once with it; REPO_POLICIES.md already matched.

Model: opus-5-5

.dockerignore

@@ -72,7 +72,12 @@
 **/*.sublime-*
 
 # This repository's host-built artifacts: the example program's binary,
-# test binaries and coverage output.
+# test binaries, coverage output, and the log yarn writes when an install
+# fails.
 /cmd/example/example
 /*.test
 /*.out
+/yarn-error.log
+
+# aider's files, among them a config file that can hold an API key.
+**/.aider*

.prettierignore

@@ -0,0 +1,2 @@
+node_modules/
+yarn.lock

.prettierrc

@@ -0,0 +1,4 @@
+{
+    "tabWidth": 4,
+    "proseWrap": "always"
+}

Dockerfile

@@ -31,6 +31,6 @@ COPY --from=lint /src/go.sum /dev/null
 COPY --from=test /src/go.sum /dev/null
 WORKDIR /src
 COPY script/ script/
-COPY go.mod go.sum ./
+COPY go.mod go.sum package.json yarn.lock ./
 RUN script/bootstrap
 COPY . .

README.md

@@ -3,11 +3,10 @@
 ## Summary
 
 simplelog is an opinionated logging package designed to facilitate easy and
-structured logging in Go applications with an absolute minimum of
+structured logging in Go applications with an absolute minimum of boilerplate.
-boilerplate.
 
-The idea is that you can add a single import line which replaces the
+The idea is that you can add a single import line which replaces the stdlib
-stdlib `log/slog` default handler, and solve the 90% case for logging.
+`log/slog` default handler, and solve the 90% case for logging.
 
 ## Current Status
 
@@ -18,16 +17,15 @@ Released v1.0.0 2024-06-14.  Works as intended.  No known bugs.
 - if output is a tty, outputs pretty color logs
 - if output is not a tty, outputs json
 - supports delivering each log message via a webhook
--   emits every `slog` attribute: those passed to a log call, those
+- emits every `slog` attribute: those passed to a log call, those accumulated
-    accumulated with `WithAttrs`, and those qualified by `WithGroup`.
+  with `WithAttrs`, and those qualified by `WithGroup`. `slog.Group` values
-    `slog.Group` values nest, and `slog.LogValuer` values are resolved. In
+  nest, and `slog.LogValuer` values are resolved. In json output attributes are
-    json output attributes are object fields (groups become nested objects);
+  object fields (groups become nested objects); in console output they are
-    in console output they are appended as `key=value` pairs, with grouped
+  appended as `key=value` pairs, with grouped keys written as `group.key=value`.
-    keys written as `group.key=value`. See
+  See [Attribute output](#attribute-output) for the details worth knowing
-    [Attribute output](#attribute-output) for the details worth knowing
+- reports a record that could not be delivered as an error from the handler's
--   reports a record that could not be delivered as an error from the
+  `Handle` method. See [When delivery fails](#when-delivery-fails) for how to
-    handler's `Handle` method. See
+  receive it
-    [When delivery fails](#when-delivery-fails) for how to receive it
 
 ## Planned Features
 
@@ -49,9 +47,9 @@ go get sneak.berlin/go/simplelog
 
 ## Usage
 
-Below is an example of how to use SimpleLog in a Go application. This
+Below is an example of how to use SimpleLog in a Go application. This example is
-example is provided in the form of a `main.go` file, which demonstrates
+provided in the form of a `main.go` file, which demonstrates logging at various
-logging at various levels using structured logging syntax.
+levels using structured logging syntax.
 
 ```go
 package main
@@ -73,61 +71,58 @@ func main() {
 ## Attribute output
 
 Attributes reach every handler: the ones passed to the log call, the ones
-accumulated with `WithAttrs`, and the ones qualified by the groups open at
+accumulated with `WithAttrs`, and the ones qualified by the groups open at the
-the time they were attached. `slog.Group` values nest, and
+time they were attached. `slog.Group` values nest, and `slog.LogValuer` values
-`slog.LogValuer` values are resolved to the value they stand for. A few
+are resolved to the value they stand for. A few behaviours are worth knowing
-behaviours are worth knowing before you rely on them.
+before you rely on them.
 
-**Your values are never modified.** Whatever you log is read and rendered,
+**Your values are never modified.** Whatever you log is read and rendered, never
-never written to. A map or a slice you pass to `slog.Any` comes back from
+written to. A map or a slice you pass to `slog.Any` comes back from the logger
-the logger exactly as you handed it over, even when a group later uses the
+exactly as you handed it over, even when a group later uses the same key.
-same key.
 
-**Durations are nanoseconds in json, and readable on the console.** The
+**Durations are nanoseconds in json, and readable on the console.** The json and
-json and webhook payloads emit a `slog.Duration` as a number of
+webhook payloads emit a `slog.Duration` as a number of nanoseconds, matching
-nanoseconds, matching `slog.NewJSONHandler`, so a consumer can compare and
+`slog.NewJSONHandler`, so a consumer can compare and aggregate the field without
-aggregate the field without parsing it. The console line emits the same
+parsing it. The console line emits the same duration as `3s`, matching
-duration as `3s`, matching `slog.NewTextHandler`, because a person reads
+`slog.NewTextHandler`, because a person reads it.
-it.
 
-**The json payload is an object, with the consequences an object has.**
+**The json payload is an object, with the consequences an object has.** The
-The record's own fields are named `Time`, `Level`, `Message` and `PC`, and
+record's own fields are named `Time`, `Level`, `Message` and `PC`, and they own
-they own those names: an attribute keyed after one of them is dropped from
+those names: an attribute keyed after one of them is dropped from the json and
-the json and webhook output. A key logged more than once keeps its last
+webhook output. A key logged more than once keeps its last value there for the
-value there for the same reason, with one exception: when both are
+same reason, with one exception: when both are `slog.Group` values sharing a
-`slog.Group` values sharing a key, the two groups are merged into one
+key, the two groups are merged into one object holding the members of both,
-object holding the members of both, rather than the second replacing the
+rather than the second replacing the first. Neither the collision nor the merge
-first. Neither the collision nor the merge applies to the console output,
+applies to the console output, which is a line of text: every pair appears, in
-which is a line of text: every pair appears, in order. If you need a field
+order. If you need a field called `message`, pick a key that does not collide -
-called `message`, pick a key that does not collide - the collision is
+the collision is silent.
-silent.
 
-**Empty things follow the `slog.Handler` contract.** An empty `Attr` is
+**Empty things follow the `slog.Handler` contract.** An empty `Attr` is ignored,
-ignored, an empty group is elided along with its key, a group with an
+an empty group is elided along with its key, a group with an empty key is
-empty key is inlined into its parent, and `WithGroup("")` returns the
+inlined into its parent, and `WithGroup("")` returns the handler unchanged.
-handler unchanged.
 
 ## When delivery fails
 
-Every handler returns an error from `Handle` when it could not deliver
+Every handler returns an error from `Handle` when it could not deliver the
-the record:
+record:
 
 - `ConsoleHandler` and `JSONHandler` return the error from their write to
   stdout, wrapped, so `errors.Is` still matches the original
--   `WebhookHandler` returns an error when the request fails, and also when
+- `WebhookHandler` returns an error when the request fails, and also when the
-    the server answers with a status outside 2xx, a redirect included,
+  server answers with a status outside 2xx, a redirect included, since it does
-    since it does not follow redirects
+  not follow redirects. A request that has not finished after 5 seconds fails
--   `MultiplexHandler`, which simplelog installs as the default, passes the
+  with a timeout error, so a webhook server that never answers holds up a log
-    record to every handler it holds even after one of them fails, then
+  call for 5 seconds at most
-    returns all their errors joined with `errors.Join` (nil if none failed)
+- `MultiplexHandler`, which simplelog installs as the default, passes the record
+  to every handler it holds even after one of them fails, then returns all their
+  errors joined with `errors.Join` (nil if none failed)
 
-`slog.Info`, `slog.Error` and the other `slog.Logger` methods throw that
+`slog.Info`, `slog.Error` and the other `slog.Logger` methods throw that error
-error away. That is how `log/slog` works, and simplelog cannot change it.
+away. That is how `log/slog` works, and simplelog cannot change it. To find out
-To find out whether a record was delivered, build a `slog.Record` and pass
+whether a record was delivered, build a `slog.Record` and pass it to the handler
-it to the handler yourself, for example
+yourself, for example `slog.Default().Handler().Handle(ctx, record)`, then check
-`slog.Default().Handler().Handle(ctx, record)`, then check the error it
+the error it returns. Console output takes the file and line from the record's
-returns. Console output takes the file and line from the record's `PC`,
+`PC`, which you set with `runtime.Callers` as the `log/slog` documentation
-which you set with `runtime.Callers` as the `log/slog` documentation
 shows. A record whose `PC` is zero prints `???:0` instead.
 
 ## Entrypoints
@@ -139,9 +134,12 @@ development workflow, and the Makefile targets are thin shims that call them.
 The scripts are POSIX sh (not bash) so they run in minimal containers such as
 alpine. We provide:
 
-- `script/bootstrap` — install all dependencies (go if missing, then
+- `script/bootstrap` — install all dependencies (go if missing, goimports with
-  `go mod download`); golangci-lint is not installed, since it runs only in
+  `go install` at a pinned commit unless the installed one already reports the
-  Docker
+  pinned version, then `go mod download`; node through nvm at a pinned version
+  if node is missing, yarn at a pinned version if it is missing, then the
+  `prettier` that `package.json` and `yarn.lock` pin); golangci-lint is not
+  installed, since it runs only in Docker
 - `script/setup` — set up the repo for development after a fresh clone: runs
   `script/bootstrap`, then `script/install-precommit`
 - `script/projectname` — output the project name (our own extension); used by
@@ -149,23 +147,23 @@ alpine. We provide:
 - `script/test` — run the test suite under the race detector in Docker by
   building only the `test` stage of the `Dockerfile`, without the build cache,
   so every run tests; the image is tagged `simplelog-test`
-- `script/lint` — run golangci-lint in Docker by building only the `lint`
+- `script/lint` — run golangci-lint in Docker by building only the `lint` stage
-  stage of the `Dockerfile`, without the build cache, so every run lints; the
+  of the `Dockerfile`, without the build cache, so every run lints; the image is
-  image is tagged `simplelog-lint`
+  tagged `simplelog-lint`
-- `script/fmt` — format all files with goimports (writes); goimports runs
+- `script/fmt` — format all files (writes): Go with the goimports that
-  with `go run` at a pinned commit, so nothing needs to install it
+  `script/bootstrap` installs, then every `*.md` file with `prettier`
-- `script/fmt-check` — check formatting (read-only); fails if `gofmt -l`
+- `script/fmt-check` — check formatting (read-only); fails if `gofmt -l` reports
-  reports files
+  files, or if `prettier` would change any `*.md` file
 - `script/check` — run all checks: `test`, `lint`, `fmt-check` (our own
   extension)
-- `script/docker` — build the Docker image without the build cache, tagged
+- `script/docker` — build the Docker image without the build cache, tagged via
-  via `script/projectname` (byte-identical across repos); it also passes the
+  `script/projectname` (byte-identical across repos); it also passes the output
-  output of `git describe` as the `VERSION` build argument, which is ignored
+  of `git describe` as the `VERSION` build argument, which is ignored because
-  because this `Dockerfile` does not declare it
+  this `Dockerfile` does not declare it
-- `script/cibuild` — what CI runs: `script/bootstrap`, then `script/check`,
+- `script/cibuild` — what CI runs: `script/bootstrap`, then `script/check`, then
-  then the same image build as `script/docker` (byte-identical across repos)
+  the same image build as `script/docker` (byte-identical across repos)
-- `script/precommit` — run by the git pre-commit hook (our own extension);
+- `script/precommit` — run by the git pre-commit hook (our own extension); runs
-  runs a `go mod tidy` guard, then `script/check`
+  a `go mod tidy` guard, then `script/check`
 - `script/install-precommit` — installs the git pre-commit hook (our own
   extension); `make hooks` shims to it
 

TODO.md

@@ -1,83 +1,89 @@
 # Workflow
 
-* branch (from `main`)
+- branch (from `main`)
-* do the work in Next Step
+- do the work in Next Step
-* move Next Step to the top of Completed Steps
+- move Next Step to the top of Completed Steps
-* move the top item of Future Steps into Next Step
+- move the top item of Future Steps into Next Step
-* commit (`TODO.md` changes in the same commit as the work)
+- commit (`TODO.md` changes in the same commit as the work)
-* merge to `main` if the branch is not protected, otherwise open a PR
+- merge to `main` if the branch is not protected, otherwise open a PR
-* push
+- push
 
 # Status
 
 1.0+
 
-Tagged v1.0.0 (2024-06-14) and 1.0.1 (2026-02-08). In post-1.0
+Tagged v1.0.0 (2024-06-14) and 1.0.1 (2026-02-08). In post-1.0 maintenance; the
-maintenance; the library is referenced by the Go styleguide.
+library is referenced by the Go styleguide.
 
 # Next Step
 
-Restructure README.md into the standard sections: Description, Getting
+Restructure README.md into the standard sections: Description, Getting Started,
-Started, Rationale, Design, TODO, License, Author
+Rationale, Design, TODO, License, Author
 
 # Completed Steps
 
-* 2026-10-06: re-vendored the standard files from `sneak/prompts` at
+- 2026-10-06: `make fmt` and `make fmt-check` also format Markdown, with
-    commit `dd4027b`: `REPO_POLICIES.md`, the CI workflow, `.gitignore`,
+  `prettier` at the standard settings, pinned through `package.json` and
-    and `.golangci.yml` together with the lint stage's new image, plus
+  `yarn.lock`; `script/bootstrap` installs node and yarn for it, and the
-    the `.editorconfig` and `.dockerignore` this repo lacked, which
+  existing Markdown was formatted once
-    finishes the Makefile and policy-files step. `script/cibuild` now
+- 2026-10-06: re-vendored the standard files from `sneak/prompts` at commit
-    bootstraps and runs `script/check` before building the image, the
+  `dd4027b`: `REPO_POLICIES.md`, the CI workflow, `.gitignore`, and
-    format check runs only on the host, the last `Dockerfile` stage runs
+  `.golangci.yml` together with the lint stage's new image, plus the
-    `script/bootstrap`, and `script/fmt` runs goimports at a pinned commit
+  `.editorconfig` and `.dockerignore` this repo lacked, which finishes the
-* 2026-10-06: the console handler takes the file and line it prints from
+  Makefile and policy-files step. `script/cibuild` now bootstraps and runs
-    the record's `PC` instead of counting stack frames, so they name the
+  `script/check` before building the image, the format check runs only on the
-    call site whether the record came through a `slog.Logger` or straight
+  host, the last `Dockerfile` stage runs `script/bootstrap`, which installs
-    to `Handle`
+  goimports at a pinned commit
-* 2026-10-06: the tests run under the race detector, in Docker:
+- 2026-10-06: a webhook request now times out after 5 seconds, so a server that
-    `script/test` builds the `test` stage of the `Dockerfile`, which runs
+  never answers no longer stops every log call; the webhook handler also reads
-    `go test -race`, and a new final stage makes a plain `docker build`
+  each answer to the end so its connection is reused
-    run both the `lint` and `test` stages
+- 2026-10-06: the console handler takes the file and line it prints from the
-* 2026-10-06: the linter runs only in Docker: `script/lint` builds the
+  record's `PC` instead of counting stack frames, so they name the call site
-    `lint` stage of the `Dockerfile`, every `docker build` in `script/`
+  whether the record came through a `slog.Logger` or straight to `Handle`
-    runs without the build cache, and `script/bootstrap` no longer
+- 2026-10-06: the tests run under the race detector, in Docker: `script/test`
-    installs golangci-lint
+  builds the `test` stage of the `Dockerfile`, which runs `go test -race`, and a
-* 2026-10-06: every handler now returns a failed delivery from `Handle`
+  new final stage makes a plain `docker build` run both the `lint` and `test`
-    instead of discarding it: console and JSON return the stdout write
+  stages
-    error, the webhook also fails on a non-2xx answer, and the multiplex
+- 2026-10-06: the linter runs only in Docker: `script/lint` builds the `lint`
-    delivers to every handler and returns their errors joined
+  stage of the `Dockerfile`, every `docker build` in `script/` runs without the
-* 2026-08-10: fixed every handler discarding slog attributes: console,
+  build cache, and `script/bootstrap` no longer installs golangci-lint
-    JSON and webhook handlers now emit record attributes, accumulate
+- 2026-10-06: every handler now returns a failed delivery from `Handle` instead
-    WithAttrs without mutating the receiver, and honour WithGroup;
+  of discarding it: console and JSON return the stdout write error, the webhook
-    slog.Group values nest and LogValuer values are resolved; console
+  also fails on a non-2xx answer, and the multiplex delivers to every handler
-    keys and values holding invalid UTF-8 are quoted
+  and returns their errors joined
-* 2026-08-07: added canonical `.golangci.yml` (v2 schema), pinned the
+- 2026-08-10: fixed every handler discarding slog attributes: console, JSON and
-    `Dockerfile` lint stage to golangci-lint v2.12.2 (tag+digest), and
+  webhook handlers now emit record attributes, accumulate WithAttrs without
-    fixed all findings the v1→v2 jump surfaced without changing any
+  mutating the receiver, and honour WithGroup; slog.Group values nest and
-    exported signatures or behavior
+  LogValuer values are resolved; console keys and values holding invalid UTF-8
-- 2026-07-07 Adopted scripts-to-rule-them-all: `script/` entrypoints,
+  are quoted
-    Makefile shims, README Entrypoints section
+- 2026-08-07: added canonical `.golangci.yml` (v2 schema), pinned the
-* 2026-02-08: fixed JSONHandler deadlock from recursive log.Println,
+  `Dockerfile` lint stage to golangci-lint v2.12.2 (tag+digest), and fixed all
-    with regression test; tagged 1.0.1
+  findings the v1→v2 jump surfaced without changing any exported signatures or
-* 2024-06-14: 1.0 prep: lint and fmt enforced in Docker build, call
+  behavior
-    stack depth fix so log locations report correctly, example script,
+
-    removed non-building RELP code; tagged v1.0.0
+* 2026-07-07 Adopted scripts-to-rule-them-all: `script/` entrypoints, Makefile
-* 2024-05-22: module path moved to sneak.berlin/go/simplelog
+  shims, README Entrypoints section
-* 2024-05-14: initial library: slog-based console, JSON, webhook, and
+
-    RELP handlers, MultiplexHandler, caller file/line info, UTC ISO
+- 2026-02-08: fixed JSONHandler deadlock from recursive log.Println, with
-    timestamps, level-colored output
+  regression test; tagged 1.0.1
+- 2024-06-14: 1.0 prep: lint and fmt enforced in Docker build, call stack depth
+  fix so log locations report correctly, example script, removed non-building
+  RELP code; tagged v1.0.0
+- 2024-05-22: module path moved to sneak.berlin/go/simplelog
+- 2024-05-14: initial library: slog-based console, JSON, webhook, and RELP
+  handlers, MultiplexHandler, caller file/line info, UTC ISO timestamps,
+  level-colored output
 
 # Future Steps
 
-* Delete the old plain TODO file once this TODO.md lands
+- Delete the old plain TODO file once this TODO.md lands
-* Add .aider.* to .gitignore and remove the stray aider artifacts from
+- Add .aider.\* to .gitignore and remove the stray aider artifacts from the
-    the working tree
+  working tree
-* Pick one tag scheme before the next release (v1.0.0 vs 1.0.1 are
+- Pick one tag scheme before the next release (v1.0.0 vs 1.0.1 are inconsistent)
-    inconsistent)
+- Tag v1.0.2, with the leading v, once the attribute fix lands, so consuming
-* Tag v1.0.2, with the leading v, once the attribute fix lands, so
+  repos can move off pseudo-version pins in one step
-    consuming repos can move off pseudo-version pins in one step
+- Fix RELP output to cache (from old TODO)
-* Fix RELP output to cache (from old TODO)
+- Re-add RELP delivery over TCP to remote rsyslog imrelp; removed 2024-06-14
-* Re-add RELP delivery over TCP to remote rsyslog imrelp; removed
+  because it did not build (README planned feature)
-    2024-06-14 because it did not build (README planned feature)
+- Add regex filtering for webhook logs (from old TODO)
-* Add regex filtering for webhook logs (from old TODO)
+- Better console output format (from old TODO)
-* Better console output format (from old TODO)

handler_errors_internal_test.go

@@ -5,6 +5,7 @@ import (
 	"context"
 	"errors"
 	"log/slog"
+	"net"
 	"net/http"
 	"net/http/httptest"
 	"strings"
@@ -160,3 +161,103 @@ func TestWebhookHandlerReturnsErrorOnRedirect(t *testing.T) {
 		t.Fatalf("Handle returned %v, want an error for the redirect", err)
 	}
 }
+
+// A server that accepts the request and never answers must not hold up
+// the log call: Handle gives up after webhookTimeout and says why.
+func TestWebhookHandlerTimesOutOnServerThatNeverAnswers(t *testing.T) {
+	t.Parallel()
+
+	testEnded := make(chan struct{})
+
+	server := httptest.NewServer(http.HandlerFunc(
+		func(_ http.ResponseWriter, _ *http.Request) {
+			<-testEnded
+		},
+	))
+
+	// server.Close waits for running requests, so the server's handler
+	// is released first.
+	defer func() {
+		close(testEnded)
+		server.Close()
+	}()
+
+	handler, err := NewWebhookHandler(server.URL)
+	if err != nil {
+		t.Fatalf("NewWebhookHandler: %v", err)
+	}
+
+	// Handle runs in a goroutine so that a lost timeout fails the test
+	// instead of hanging the test run.
+	handleErr := make(chan error, 1)
+
+	go func() {
+		handleErr <- handler.Handle(context.Background(), errorTestRecord())
+	}()
+
+	select {
+	case err = <-handleErr:
+	case <-time.After(webhookTimeout + time.Second):
+		t.Fatal("Handle did not return within webhookTimeout")
+	}
+
+	var netErr net.Error
+	if !errors.As(err, &netErr) || !netErr.Timeout() {
+		t.Fatalf("Handle returned %v, want a timeout error", err)
+	}
+}
+
+// A server that sends a 2xx status and then never finishes the answer
+// must not hold up the log call either: reading the answer counts toward
+// webhookTimeout, and Handle returns the read's error.
+func TestWebhookHandlerTimesOutOnServerThatStallsTheAnswer(t *testing.T) {
+	t.Parallel()
+
+	testEnded := make(chan struct{})
+
+	server := httptest.NewServer(http.HandlerFunc(
+		func(w http.ResponseWriter, _ *http.Request) {
+			w.WriteHeader(http.StatusOK)
+
+			// Flush sends the status now; the answer stays unfinished
+			// until the test ends.
+			err := http.NewResponseController(w).Flush()
+			if err != nil {
+				t.Errorf("flush the status: %v", err)
+			}
+
+			<-testEnded
+		},
+	))
+
+	// server.Close waits for running requests, so the server's handler
+	// is released first.
+	defer func() {
+		close(testEnded)
+		server.Close()
+	}()
+
+	handler, err := NewWebhookHandler(server.URL)
+	if err != nil {
+		t.Fatalf("NewWebhookHandler: %v", err)
+	}
+
+	// Handle runs in a goroutine so that a lost timeout fails the test
+	// instead of hanging the test run.
+	handleErr := make(chan error, 1)
+
+	go func() {
+		handleErr <- handler.Handle(context.Background(), errorTestRecord())
+	}()
+
+	select {
+	case err = <-handleErr:
+	case <-time.After(webhookTimeout + time.Second):
+		t.Fatal("Handle did not return within webhookTimeout")
+	}
+
+	var netErr net.Error
+	if !errors.As(err, &netErr) || !netErr.Timeout() {
+		t.Fatalf("Handle returned %v, want a timeout error", err)
+	}
+}

package.json

@@ -0,0 +1,6 @@
+{
+  "private": true,
+  "devDependencies": {
+    "prettier": "3.8.1"
+  }
+}

script/bootstrap

@@ -2,11 +2,26 @@
 # script/bootstrap: install all dependencies needed to build and develop
 # this repo. Idempotent: every install is guarded by a check so already
 # installed tools are skipped. Base tooling comes from nix, apt, brew,
-# or apk (detected in that order); assumes nothing is present.
+# or apk (detected in that order); assumes nothing is present. Node is
+# used directly if installed; otherwise it is installed at a pinned
+# version via nvm (installing nvm itself first, from a hash-verified
+# release archive, never curl | sh).
 set -eu
 
 ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
 
+# Pinned versions, 2026-07-06
+NODE_VERSION="22.17.0"
+NVM_VERSION="0.40.3"
+# sha256 of https://github.com/nvm-sh/nvm/archive/refs/tags/v0.40.3.tar.gz
+NVM_SHA256="5f4d6aaa04a177dc93c985e31dbc411ab6b8c6e1e21d8015dbc1372625fcd1d0"
+YARN_VERSION="1.22.22"
+
+# goimports from golang.org/x/tools v0.30.0, 2025-02-10: the last release
+# that Go 1.22, the Go of go.mod and the Dockerfile, can build.
+GOIMPORTS_COMMIT="09747cdf594a7924dcecb506312be3bd6e437962"
+GOIMPORTS_VERSION="v0.30.0"
+
 PKGMGR=""
 SUDO=""
 
@@ -47,6 +62,98 @@ missing() {
     ! command -v "$1" >/dev/null 2>&1
 }
 
+# Print the golang.org/x/tools version that the goimports on PATH was
+# built from, or nothing. goimports has no --version flag; `go version -m`
+# prints the module versions Go records in every binary it builds.
+goimports_version() {
+    bin="$(command -v goimports)" || return 0
+    go version -m "$bin" 2>/dev/null |
+        awk '$1 == "mod" && $2 == "golang.org/x/tools" { print $3 }'
+}
+
+# Install goimports at the pinned commit unless the one on PATH already
+# reports the pinned version. go install writes to GOBIN, or to the bin
+# directory of GOPATH when GOBIN is unset, which need not be on the
+# caller's PATH; script/fmt puts that directory first on PATH the same
+# way, so the check here sees the goimports that script/fmt runs.
+ensure_goimports() {
+    gobin="$(go env GOBIN)"
+    PATH="${gobin:-$(go env GOPATH)/bin}:$PATH"
+    if [ "$(goimports_version)" != "$GOIMPORTS_VERSION" ]; then
+        go install "golang.org/x/tools/cmd/goimports@$GOIMPORTS_COMMIT"
+        hash -r
+        if [ "$(goimports_version)" != "$GOIMPORTS_VERSION" ]; then
+            echo "bootstrap: goimports on PATH is not $GOIMPORTS_VERSION" \
+                "after installing it: $(command -v goimports || echo none)" >&2
+            exit 1
+        fi
+    fi
+    echo "goimports $GOIMPORTS_VERSION at $(command -v goimports)"
+}
+
+# verify_sha256 <file> <expected-hash>
+verify_sha256() {
+    if command -v sha256sum >/dev/null 2>&1; then
+        actual="$(sha256sum "$1" | cut -d' ' -f1)"
+    else
+        actual="$(shasum -a 256 "$1" | cut -d' ' -f1)"
+    fi
+    if [ "$actual" != "$2" ]; then
+        echo "bootstrap: sha256 mismatch for $1" >&2
+        echo "  expected: $2" >&2
+        echo "  actual:   $actual" >&2
+        exit 1
+    fi
+}
+
+# nvm is a bash script; run a command in a bash with nvm loaded
+nvm_sh() {
+    bash -c ". \"\$HOME/.nvm/nvm.sh\" && $*"
+}
+
+ensure_nvm() {
+    [ -s "$HOME/.nvm/nvm.sh" ] && return 0
+    # nvm prerequisites; nvm itself requires bash
+    if missing bash; then pkg_install bash bash bash bash; fi
+    if missing curl; then pkg_install curl curl curl curl; fi
+    if missing git; then pkg_install git git git git; fi
+    tmp="$(mktemp -d)"
+    curl -fsSL -o "$tmp/nvm.tar.gz" \
+        "https://github.com/nvm-sh/nvm/archive/refs/tags/v${NVM_VERSION}.tar.gz"
+    verify_sha256 "$tmp/nvm.tar.gz" "$NVM_SHA256"
+    mkdir -p "$HOME/.nvm"
+    tar -xzf "$tmp/nvm.tar.gz" -C "$HOME/.nvm" --strip-components=1
+    rm -rf "$tmp"
+}
+
+ensure_node() {
+    if ! missing node; then return 0; fi
+    ensure_nvm
+    nvm_sh "nvm install $NODE_VERSION"
+}
+
+ensure_yarn() {
+    if ! missing yarn; then return 0; fi
+    if ! missing corepack; then
+        corepack enable
+        corepack prepare "yarn@$YARN_VERSION" --activate
+    elif [ -s "$HOME/.nvm/nvm.sh" ]; then
+        nvm_sh "nvm use $NODE_VERSION >/dev/null && corepack enable && \
+            corepack prepare yarn@$YARN_VERSION --activate"
+    else
+        npm install -g "yarn@$YARN_VERSION"
+    fi
+}
+
+install_js_deps() {
+    if missing yarn && [ -s "$HOME/.nvm/nvm.sh" ]; then
+        nvm_sh "nvm use $NODE_VERSION >/dev/null && cd \"$ROOT\" && \
+            yarn install --frozen-lockfile"
+    else
+        yarn install --frozen-lockfile
+    fi
+}
+
 main() {
     cd "$ROOT"
 
@@ -55,10 +162,14 @@ main() {
 
     if missing go; then pkg_install go golang go go; fi
     # golangci-lint is not installed: it runs only in docker (script/lint).
-    # Nor is goimports: script/fmt runs it with `go run` at a pinned commit.
+    ensure_goimports
 
     go mod download
 
+    ensure_node
+    ensure_yarn
+    install_js_deps
+
     echo "bootstrap complete"
 }
 

script/fmt

@@ -1,17 +1,37 @@
 #!/bin/sh
-# script/fmt: format all files (writes). goimports runs with `go run` at
+# script/fmt: format all files (writes): Go with the goimports that
-# a pinned commit, so nothing installs it and every machine formats with
+# script/bootstrap installs, then Markdown with prettier. It puts Go's bin
-# the same version.
+# directory first on PATH, as script/bootstrap does, so it runs that
+# goimports even when the directory is not on the caller's PATH.
 set -eu
 
 ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
 
-# goimports from golang.org/x/tools v0.51.0, 2026-10-02
+# Must match the pin in script/bootstrap.
-GOIMPORTS="golang.org/x/tools/cmd/goimports@ea2f152dc35325e4b9b639583972375972350a84"
+NODE_VERSION="22.17.0"
+
+# script/bootstrap installs node and yarn under nvm and leaves neither
+# on the PATH of the shell that called it, so resolve the pinned
+# toolchain here the way bootstrap's own install step does. nvm is a
+# bash script, hence the subshell.
+run_yarn() {
+    if command -v yarn >/dev/null 2>&1; then
+        exec yarn "$@"
+    fi
+    if [ ! -s "$HOME/.nvm/nvm.sh" ]; then
+        echo "fmt: no yarn; run script/bootstrap first" >&2
+        exit 1
+    fi
+    exec bash -c '. "$HOME/.nvm/nvm.sh" && nvm use "$1" >/dev/null &&
+        shift && exec yarn "$@"' bash "$NODE_VERSION" "$@"
+}
 
 main() {
     cd "$ROOT"
-    go run "$GOIMPORTS" -l -w .
+    gobin="$(go env GOBIN)"
+    PATH="${gobin:-$(go env GOPATH)/bin}:$PATH"
+    goimports -l -w .
+    run_yarn run prettier --write '**/*.md' --tab-width 4 --prose-wrap always
 }
 
 main "$@"

script/fmt-check

@@ -1,10 +1,30 @@
 #!/bin/sh
 # script/fmt-check: check formatting (read-only). Fails and lists the
-# offending files if gofmt would reformat anything.
+# offending files if gofmt would reformat any Go file; otherwise fails if
+# prettier would reformat any Markdown file.
 set -eu
 
 ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
 
+# Must match the pin in script/bootstrap.
+NODE_VERSION="22.17.0"
+
+# script/bootstrap installs node and yarn under nvm and leaves neither
+# on the PATH of the shell that called it, so resolve the pinned
+# toolchain here the way bootstrap's own install step does. nvm is a
+# bash script, hence the subshell.
+run_yarn() {
+    if command -v yarn >/dev/null 2>&1; then
+        exec yarn "$@"
+    fi
+    if [ ! -s "$HOME/.nvm/nvm.sh" ]; then
+        echo "fmt-check: no yarn; run script/bootstrap first" >&2
+        exit 1
+    fi
+    exec bash -c '. "$HOME/.nvm/nvm.sh" && nvm use "$1" >/dev/null &&
+        shift && exec yarn "$@"' bash "$NODE_VERSION" "$@"
+}
+
 main() {
     cd "$ROOT"
     unformatted="$(gofmt -l .)"
@@ -13,6 +33,7 @@ main() {
         echo "$unformatted"
         exit 1
     fi
+    run_yarn run prettier --check '**/*.md' --tab-width 4 --prose-wrap always
 }
 
 main "$@"

webhook_handler.go

@@ -6,15 +6,22 @@ import (
 	"encoding/json"
 	"errors"
 	"fmt"
+	"io"
 	"log/slog"
 	"net/http"
 	"net/url"
+	"time"
 )
 
 // errWebhookStatus is returned when the webhook answers with a status
 // outside 2xx.
 var errWebhookStatus = errors.New("webhook did not accept the record")
 
+// webhookTimeout bounds each webhook request, reading the answer
+// included. Handle runs inside the log call, so a server that never
+// answers would otherwise hold that call up for good.
+const webhookTimeout = 5 * time.Second
+
 // WebhookHandler POSTs each log record as JSON to a configured webhook
 // URL.
 type WebhookHandler struct {
@@ -34,6 +41,7 @@ func NewWebhookHandler(webhookURL string) (*WebhookHandler, error) {
 	return &WebhookHandler{
 		webhookURL: webhookURL,
 		client: &http.Client{
+			Timeout: webhookTimeout,
 			// Following a redirect can resend the request as a GET
 			// without the record, so Handle gets the redirect answer
 			// itself and returns it as an error.
@@ -80,7 +88,8 @@ func (w *WebhookHandler) WithGroup(name string) slog.Handler {
 
 // Handle marshals the record, with its attributes, to one JSON object and
 // POSTs it to the webhook URL. It returns an error when the request fails
-// or the server answers with a status outside 2xx.
+// or runs past webhookTimeout, or when the server answers with a status
+// outside 2xx.
 func (w *WebhookHandler) Handle(ctx context.Context, record slog.Record) error {
 	jsonData, err := json.Marshal(recordToMap(record, w.attrs))
 	if err != nil {
@@ -106,6 +115,15 @@ func (w *WebhookHandler) Handle(ctx context.Context, record slog.Record) error {
 
 	defer func() { _ = response.Body.Close() }()
 
+	// The answer is read to the end so the client can reuse the
+	// connection for the next record. The read counts toward
+	// webhookTimeout, so a server that sends its status and then stalls
+	// fails here.
+	_, err = io.Copy(io.Discard, response.Body)
+	if err != nil {
+		return fmt.Errorf("error reading webhook answer: %w", err)
+	}
+
 	if response.StatusCode < http.StatusOK ||
 		response.StatusCode >= http.StatusMultipleChoices {
 		return fmt.Errorf("%w: %s", errWebhookStatus, response.Status)

yarn.lock

@@ -0,0 +1,8 @@
+# THIS IS AN AUTOGENERATED FILE. DO NOT EDIT THIS FILE DIRECTLY.
+# yarn lockfile v1
+
+
+prettier@3.8.1:
+  version "3.8.1"
+  resolved "https://registry.yarnpkg.com/prettier/-/prettier-3.8.1.tgz#edf48977cf991558f4fcbd8a3ba6015ba2a3a173"
+  integrity sha512-UOnG6LftzbdaHZcKoPFtOcCKztrQ57WkHDeRD9t/PTQtmT0NHSeWWepj6pS0z/N7+08BHFDQVUrfmfMRcZwbMg==