Format Go with gofmt, then golines -m 77 (closes #215)

script/fmt now runs golines -m 77 after gofmt, repeating golines until
it changes nothing, since one pass can leave a line the next splits.
script/fmt-check fails when either would change a file.
script/bootstrap installs golines v0.13.0 with go install, pinned to
its commit, and checks the installed version with go version -m.

The tree is reformatted. The longer lines this makes are fixed by
hand: nolint directives moved onto their own line above the statement,
one string split, and 20 functions over funlen's 80 lines shortened or
split, RunWAF and limitPercentages among them.

Model: opus-5-5

script/bootstrap

@@ -6,8 +6,9 @@
 # used directly if installed; otherwise it is installed at a pinned
 # version via nvm (installing nvm itself first, from a hash-verified
 # release archive, never curl | sh). Go comes from the package manager,
-# for gofmt in script/fmt and script/fmt-check: the tests and the linter
-# run in docker and need no Go on the host.
+# for gofmt and golines in script/fmt and script/fmt-check: the tests
+# and the linter run in docker and need no Go on the host. golines is
+# installed with go install at a pinned commit.
 set -eu
 
 ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
@@ -18,6 +19,9 @@ NVM_VERSION="0.40.3"
 # sha256 of https://github.com/nvm-sh/nvm/archive/refs/tags/v0.40.3.tar.gz
 NVM_SHA256="5f4d6aaa04a177dc93c985e31dbc411ab6b8c6e1e21d8015dbc1372625fcd1d0"
 YARN_VERSION="1.22.22"
+# golines v0.13.0, 2025-08-21
+GOLINES_VERSION="v0.13.0"
+GOLINES_COMMIT="8f32f0f7e89c30f572c7f2cd3b2a48016b9d8bbf"
 
 PKGMGR=""
 SUDO=""
@@ -117,6 +121,23 @@ ensure_yarn() {
     fi
 }
 
+# go install writes to GOBIN, or to GOPATH/bin when GOBIN is unset,
+# whether or not that is on the PATH. script/fmt and script/fmt-check
+# run golines from the same place, never another copy on the PATH.
+# golines --version prints "vdev" for a binary go install built, so
+# the version comes from the module line go version -m prints.
+ensure_golines() {
+    gobin="$(go env GOBIN)"
+    golines="${gobin:-$(go env GOPATH)/bin}/golines"
+    if [ -x "$golines" ]; then
+        installed="$(go version -m "$golines" | awk '$1 == "mod" { print $3 }')"
+        if [ "$installed" = "$GOLINES_VERSION" ]; then
+            return 0
+        fi
+    fi
+    go install "github.com/segmentio/golines@$GOLINES_COMMIT"
+}
+
 install_js_deps() {
     if missing yarn && [ -s "$HOME/.nvm/nvm.sh" ]; then
         nvm_sh "nvm use $NODE_VERSION >/dev/null && cd \"$ROOT\" && \
@@ -132,8 +153,9 @@ main() {
     if missing make; then pkg_install gnumake make make make; fi
     if missing git; then pkg_install git git git git; fi
     if missing curl; then pkg_install curl curl curl curl; fi
-    if missing gofmt; then pkg_install go golang go go; fi
+    if missing go; then pkg_install go golang go go; fi
 
+    ensure_golines
     ensure_node
     ensure_yarn
     install_js_deps

script/fmt

@@ -1,6 +1,6 @@
 #!/bin/sh
-# script/fmt: format all files (writes): the Go code with gofmt, the
-# Markdown with prettier.
+# script/fmt: format all files (writes): the Go code with gofmt and
+# then golines -m 77, the Markdown with prettier.
 set -eu
 
 ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
@@ -24,9 +24,39 @@ run_yarn() {
         shift && exec yarn "$@"' bash "$NODE_VERSION" "$@"
 }
 
+# The golines that script/bootstrap installed: go install puts it in
+# GOBIN, or in GOPATH/bin when GOBIN is unset.
+golines_path() {
+    gobin="$(go env GOBIN)"
+    golines="${gobin:-$(go env GOPATH)/bin}/golines"
+    if [ ! -x "$golines" ]; then
+        echo "fmt: no golines; run script/bootstrap first" >&2
+        exit 1
+    fi
+    echo "$golines"
+}
+
 main() {
     cd "$ROOT"
+    golines="$(golines_path)"
     gofmt -w cmd internal
+    # One golines pass can leave a line that the next pass splits
+    # further, so run it until it would change nothing. The check is
+    # not the while condition, where set -e would ignore a golines
+    # failure.
+    passes=0
+    while true; do
+        unformatted="$("$golines" -m 77 -l cmd internal)"
+        if [ -z "$unformatted" ]; then
+            break
+        fi
+        passes=$((passes + 1))
+        if [ "$passes" -gt 5 ]; then
+            echo "fmt: golines -m 77 still changes files after 5 passes" >&2
+            exit 1
+        fi
+        "$golines" -m 77 -w cmd internal
+    done
     run_yarn run prettier --write '**/*.md' --tab-width 4 --prose-wrap always
 }
 

script/fmt-check

@@ -1,6 +1,6 @@
 #!/bin/sh
 # script/fmt-check: check formatting (read-only): the Go code with
-# gofmt, the Markdown with prettier.
+# gofmt and golines -m 77, the Markdown with prettier.
 set -eu
 
 ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
@@ -24,14 +24,33 @@ run_yarn() {
         shift && exec yarn "$@"' bash "$NODE_VERSION" "$@"
 }
 
+# The golines that script/bootstrap installed: go install puts it in
+# GOBIN, or in GOPATH/bin when GOBIN is unset.
+golines_path() {
+    gobin="$(go env GOBIN)"
+    golines="${gobin:-$(go env GOPATH)/bin}/golines"
+    if [ ! -x "$golines" ]; then
+        echo "fmt-check: no golines; run script/bootstrap first" >&2
+        exit 1
+    fi
+    echo "$golines"
+}
+
 main() {
     cd "$ROOT"
+    golines="$(golines_path)"
     unformatted="$(gofmt -l cmd internal)"
     if [ -n "$unformatted" ]; then
         echo "fmt-check: gofmt would change:" >&2
         echo "$unformatted" >&2
         exit 1
     fi
+    unformatted="$("$golines" -m 77 -l cmd internal)"
+    if [ -n "$unformatted" ]; then
+        echo "fmt-check: golines -m 77 would change:" >&2
+        echo "$unformatted" >&2
+        exit 1
+    fi
     run_yarn run prettier --check '**/*.md' --tab-width 4 --prose-wrap always
 }