What style translates to

Every flag molto fmt and molto lint take, the exact command each one runs, and the clang-format and clang-tidy configuration Molto writes from format.json and linter.json.

Formatting and linting is the argument: Molto owns one vocabulary and renders it as the backend’s own. This page is the receipt — every flag, every key, and the exact bytes that end up in .bin/style/.

molto fmt

Writing is the default. --check and --diff are two ways of asking what it would do without doing it, and passing both is a usage error: two answers to one question.

There is no --profile and no --format. A profile decides which defines are in force, and a formatter never sees a define; the output shape is a diff or a count, and neither is negotiable.

molto lint

-j takes a count between 1 and 1024. Anything else — zero, a negative, a word, a number with a suffix — is refused with the value quoted back, and exits 4. A build told to take two workers and silently taking the whole machine is worse than one that stops.

The parser accepts --opt value, --opt=value, -o value and bare boolean flags, and --help is always there.

What each command reads

fmt includes headers because a header is not a translation unit but it is code. lint does not analyse headers on their own — a header is analysed as part of every source that includes it, and the compiler pass records which ones it read so a change to any of them re-analyses the source.

Both then subtract what exclude matches. A directory that is not there is not a failure: a project with no src/ has nothing to do and exits 0.

Streams and exit codes

So molto fmt --diff > patch yields a patch and nothing else, and molto lint --format json leaves stdout parseable — the header and the tally are suppressed rather than moved.

A warning is reported and still succeeds. Only fmt exits 3 for a missing tool — a missing linter is not an error, because the compiler pass is what molto lint promises with nothing installed.

--format has no default on purpose

Absent is not an implicit text. Absent means “whatever suits the stream”: rich at a terminal, text through a pipe. NO_COLOR drops the colour from rich but not the frames. Write the flag down when the output has to be the same wherever it goes.

What actually runs

molto fmt, once per file:

clang-format --style=file:.bin/style/clang-format.yaml -i               src/foo.c   # write
clang-format --style=file:.bin/style/clang-format.yaml --dry-run --Werror src/foo.c # --check
clang-format --style=file:.bin/style/clang-format.yaml                  src/foo.c   # --diff

--Werror is what makes --dry-run exit non-zero exactly when the file would change. -i exits zero either way, so a write reads the file back afterwards to know whether it changed at all. In diff mode the formatter’s stdout is the formatted file, so nothing else may be mixed into it and Molto computes the diff itself, with three lines of context.

molto lint, twice per source:

gcc -fsyntax-only -fdiagnostics-color=never src/foo.c \
    -MMD -MF .bin/lint/src/foo.c.d \
    -Wall -Wextra -Wpedantic  <std, defines, includes and flags of [target] and the profile> \
    -I<root>/src

clang-tidy --config-file=.bin/style/clang-tidy.yaml --quiet src/foo.c -- \
    <the same compile arguments> -I<root>/src

Three things are deliberate there. -O and -g are not passed: a syntax-only pass stops before optimisation, so -O2 would advertise -Wmaybe-uninitialized and friends without being able to deliver them. The preset’s warnings go first, because the last flag wins in gcc and clang, and a preset -Wall appended after your -Wno-unused would re-enable what you turned off. And the defines do go through, because #ifdef decides what even compiles: linting with the wrong profile analyses code the build never sees. Both passes run under the project’s [env].

format.json, key by key

Ten lines are written every run, whether or not the file exists:

# Generated by molto from format.json. Do not edit.
BasedOnStyle: LLVM
Standard: c++03
IndentWidth: 4
ColumnLimit: 100
UseTab: Never
BreakBeforeBraces: Attach
PointerAlignment: Right
SortIncludes: CaseSensitive
SpaceBeforeParens: Never
ReflowComments: true

ForIndentation rather than Always: the canonical key promises to indent with tabs, and Always would put them inside alignment too. ReflowComments is emitted as a boolean and not as the Always/Never enum that clang-format 20 introduced, because clang-format 19 refuses the whole file over the enum — and a rejected configuration leaves molto fmt reporting that it formatted nothing rather than that it could not.

Standard comes from the manifest

There is no key for the language. .h carries none in its extension and clang-format has no C mode at all — it parses everything as C++ and Standard only picks the dialect.

c++03 is the point of the exercise for C: it is the only dialect in which requires, concept and co_await are ordinary identifiers, which is what they are in C.

Everything Molto has no word for

BasedOnStyle: LLVM is the base, and the ten keys are layered on top of it. That is most of clang-format: LLVM decides your continuation indent, your alignment, your short-function rule. Seven keys is what RFC-0005 opened with, not the ceiling.

preset in format.json changes nothing today. It is read and validated — molto and none are accepted, kernel and gnu are refused by name — but the base is BasedOnStyle: LLVM either way. In linter.json it has teeth.

linter.json, rule by rule

# Generated by molto from linter.json. Do not edit.
Checks: '-*,clang-diagnostic-*,bugprone-*,readability-magic-numbers,-modernize-*'
WarningsAsErrors: 'bugprone-*'

The list is composed in one order, always:

1. -* first. clang-tidy composes what it is given on top of its own default, which is clang-analyzer-*. Clearing it is what makes the generated file say exactly what linter.json says — and keeps a different clang-tidy, whose default is its own to change, from enabling a different set on the next machine.
2. clang-diagnostic-*,bugprone-* when preset is molto, which is the default. none appends nothing.
3. Each rule, in the order you wrote it. warn and error append the rule’s checks, skipping one the preset already enabled. error also appends them to WarningsAsErrors. off appends each positive check negated and drops the ones that were already negative — negating the list as a whole would only negate its first element.

The analyzer separates its families with a dot, not the hyphen the rest of clang-tidy uses: clang-analyzer-security-* matches nothing at all. unix.Stream is subtracted because it reads while((n = fread(...)) > 0) as a read past the end of the file, and the Annex K check is subtracted because it asks for memcpy_s and snprintf_s, which are optional in C11 and absent from glibc — it would fire on every call to the C library and bury the rest.

The two named individually — swappable_parameters and spurious_wakeup — are bugprone checks that describe C badly. The first flags any two adjacent parameters of one type, which is how most C functions are written; the second cannot see a retry loop one function above the wait. A project should be able to refuse them without giving up the ninety-odd checks around them.

preset in linter.json also arms the compiler

It is the only key that reaches the compiler pass. molto adds -Wall -Wextra -Wpedantic to it; none leaves that pass with your [target].flags and nothing else. Setting "preset": "none" therefore turns off both halves at once, which is usually not what someone reaching for it wants.

The severity map does not silence the compiler

rules is translated into clang-tidy’s configuration, and nowhere else. "unused": "off" stops clang-tidy from repeating the warning; it does not stop gcc from raising -Wunused-variable under the preset’s -Wall. To silence the compiler, put -Wno-unused in [target].flags of Project.toml — where the build will see it too, which is the point.

Shared keys, and their limits

A backend pin is looked for inside the version pickup reports, because that is a sentence (clang-format version 22.1.8) and not a number. Molto verifies the pin; it never installs — that is pickup’s half of the split.

exclude patterns are POSIX fnmatch without FNM_PATHNAME, matched against the path relative to the project root. A star crosses a slash, so vendor/* matches vendor/a/b.c. A pattern ending in /** is tried a second time with that suffix removed, so it matches the directory itself too.

The generated configuration is composed into a 4096-byte buffer. A linter.json that overflows it is an error — the translated check list is too long — not a file quietly cut in half.

Every error, and what it means

All of them exit 2, and all of them name what is wrong. Nothing in either file is ignored.

What --format json produces

[
  {
    "file": "src/foo.c",
    "line": 12,
    "column": 5,
    "severity": "warning",
    "message": "…",
    "rule": "unused_variable"
  }
]

severity is note, warning or error. Paths are relative to the project root. Every entry carries all six fields; an empty rule is "", never absent.

The caret lines are not in it. A compiler interleaves source snippets and In file included from headers, which carry no file and no line of their own. They are kept in the text form, where they are read next to the line they point at, and dropped from JSON, where nothing could act on them.

rule is Molto’s spelling: cut at the comma clang-tidy appends, with a -W or -Werror= prefix dropped and hyphens turned into underscores. -Wunused-variable reads as unused_variable and bugprone-assignment-in-if-condition as bugprone_assignment_in_if_condition. To act on one — NOLINT, -Wno-… — turn the underscores back into hyphens.

A pass that says more than 65536 bytes about one file is cut off there, and the cut is reported as a note on that file. It is never silent.

Where the state lives

molto clean --all removes all of it. Neither command writes compile_commands.json — a build does — so an external clang-tidy reading that database is reading what molto build last left there.

What invalidates a recorded result

The mode is not part of the fmt fingerprint: what is recorded is that a file is in its final form under this style, and that is the same fact --check asks about, --diff asks about and a write has just made true. One entry serves all three.

Nothing is recorded for a run that was killed by a signal, exited 127, or had its output cut off: a failure should be retried, not replayed. lint additionally refuses to record when the source changed while it was being analysed, which would otherwise pin stale diagnostics under a current signature and never invalidate them.

Environment

An overridden tool reports no version, so the recorded results cannot notice that the binary changed underneath them. After swapping one, run with --refresh-analysis once.