@mmerterden/multi-agent-pipeline 20.30.0 → 20.34.0

package/pipeline/scripts/phase-tracker.sh

@@ -86,7 +86,7 @@ usage:
   phase-tracker.sh model  <phase_id> <model_name>
   phase-tracker.sh meta   <phase_id> <key> <value>
   phase-tracker.sh now    <phase_id> "<text>"
-  phase-tracker.sh task   <phase_id> <task_id> <pending|in_progress|completed> [--subject S] [--active-form A]
+  phase-tracker.sh task   <phase_id> <task_id> <pending|in_progress|completed|deleted> [--subject S] [--active-form A]
   phase-tracker.sh cost   <phase_id>|total
   phase-tracker.sh tiles
   phase-tracker.sh report
@@ -1427,11 +1427,11 @@ EOF
     # client behind it - sees the same list. Quiet like `now`: the host already
     # rendered the change, so this only records it.
     need_jq
-    [ "$#" -ge 3 ] || { echo "task needs <phase_id> <task_id> <status> [--subject S] [--active-form A]" >&2; exit 64; }
+    [ "$#" -ge 3 ] || { echo "task needs <phase_id> <task_id> <status|deleted> [--subject S] [--active-form A]" >&2; exit 64; }
     PID="$1"; TID="$2"; TSTATUS="$3"; shift 3
     case "$TSTATUS" in
-      pending|in_progress|completed) ;;
-      *) echo "task: status must be pending, in_progress or completed" >&2; exit 64 ;;
+      pending|in_progress|completed|deleted) ;;
+      *) echo "task: status must be pending, in_progress, completed or deleted" >&2; exit 64 ;;
     esac
     TSUBJECT=""; HAS_SUBJECT=0; TACTIVE=""; HAS_ACTIVE=0
     while [ "$#" -gt 0 ]; do
@@ -1452,6 +1452,11 @@ EOF
     fi
     EXISTS=$(printf '%s' "$state" | jq -r --arg pid "$PID" --arg tid "$TID" \
       'any(.phases[] | select(.id == $pid) | .tasks[]?; .id == $tid)')
+    # A deleted task leaves the list; one never recorded is nothing to delete.
+    if [ "$TSTATUS" = "deleted" ] && [ "$EXISTS" != "true" ]; then
+      release_state_lock
+      exit 0
+    fi
     if [ "$EXISTS" != "true" ] && [ "$HAS_SUBJECT" -eq 0 ]; then
       release_state_lock
       echo "task: a new task needs --subject" >&2
@@ -1463,7 +1468,9 @@ EOF
       --arg act "$TACTIVE" --argjson ha "$HAS_ACTIVE" '
       .phases |= map(
         if .id == $pid then
-          if any(.tasks[]?; .id == $tid) then
+          if $st == "deleted" then
+            .tasks |= map(select(.id != $tid))
+          elif any(.tasks[]?; .id == $tid) then
             .tasks |= map(if .id == $tid then
               .status = $st
               | (if $hs == 1 then .subject = $subj else . end)

package/pipeline/scripts/plan-critique-gate.mjs

@@ -4,7 +4,9 @@
  * answer per objection, and a verdict decided by constitution rule id.
  *
  * At the end of Phase 1 the plan-critic persona writes objections to the plan
- * under four lenses (scope, feasibility, security, a cheaper alternative), and
+ * under six lenses (scope, feasibility, security, a cheaper alternative, an
+ * input the spec implies but no test exercises, a decision left to the
+ * implementer), and
  * the planner answers each one exactly once: accept and revise the plan, or
  * rebut with evidence. Both halves live in one file,
  * `<worktree>/.pipeline/plan-critique.json` (schemas/plan-critique.schema.json).
@@ -59,7 +61,14 @@ import { requirementIds } from "./spec-consistency-gate.mjs";
 import { resolveOne } from "./verify-citations.mjs";
 
 export const GATE = "plan-critique";
-export const LENSES = ["scope", "feasibility", "security", "alternative"];
+export const LENSES = [
+  "scope",
+  "feasibility",
+  "security",
+  "alternative",
+  "unstated-input",
+  "underspecified",
+];
 export const ANCHOR_KINDS = ["file", "plan", "analysis", "inference"];
 export const ACTIONS = ["accept", "rebut"];
 const OBJ_ID = /^OBJ-\d{2,3}$/;

package/pipeline/scripts/prune-logs.sh

@@ -23,6 +23,9 @@
 #     PRUNE_GRACE_MIN minutes (default 10) are spared, so pruning while a
 #     run is still writing its log dir cannot break resume. An explicit
 #     --task=ID bypasses the grace; PRUNE_GRACE_MIN=0 disables it.
+#   - resumable runs: a task dir whose agent-state.json status is not
+#     finished, abandoned or cancelled is spared however old it is
+#     (an unreadable status counts as resumable); --task bypasses this too.
 #
 # Usage:
 #   prune-logs.sh                       # dry-run: every idle task dir
@@ -31,6 +34,8 @@
 #   prune-logs.sh --project=my-ios-app  # only one project's task dirs
 #   prune-logs.sh --task=PROJ-123       # only one task dir
 #   prune-logs.sh --older-than=30 --yes
+#   prune-logs.sh --only-from=FILE      # only the folders FILE lists, one per
+#                                       # line as the dry run prints them
 #
 # Env:
 #   PRUNE_LOG_ROOT   override the log root (default $HOME/.claude/logs/multi-agent)
@@ -46,6 +51,7 @@ DELETE=0
 OLDER_DAYS=0
 PROJECT=""
 TASK=""
+ONLY_FROM=""
 
 usage() {
   grep -E '^#( |$)' "$0" | sed -E 's/^# ?//'
@@ -82,6 +88,13 @@ for arg in "$@"; do
         exit 2
       fi
       ;;
+    --only-from=*)
+      ONLY_FROM="${arg#*=}"
+      if [ ! -f "$ONLY_FROM" ]; then
+        echo "prune-logs: --only-from needs a readable list file" >&2
+        exit 2
+      fi
+      ;;
     -h | --help)
       usage
       exit 0
@@ -132,6 +145,31 @@ is_reserved_name() {
   return 1
 }
 
+# A run that can still be resumed keeps its log however old it is: only a
+# finished, abandoned or cancelled run (or a dir with no recorded status) is
+# pruned; a failed run is one /multi-agent:resume picks up again. --task is
+# an explicit target and bypasses this too.
+run_status() {
+  local f="$1/agent-state.json"
+  [ -f "$f" ] || return 0
+  # A state that cannot be read is treated as resumable ("?"): pruning is
+  # the one step here that cannot be undone.
+  node -e 'try{const j=JSON.parse(require("fs").readFileSync(process.argv[1],"utf8"));process.stdout.write(j&&typeof j==="object"&&typeof j.status==="string"?j.status:"")}catch{process.stdout.write("?")}' "$f" 2>/dev/null || printf '?'
+}
+is_resumable() {
+  case "$(run_status "$1")" in
+    "" | complete | completed | done | abandoned | cancelled) return 1 ;;
+  esac
+  return 0
+}
+
+# --only-from narrows the match to a confirmed list; every other check still
+# applies, so a listed folder that became active or resumable is spared.
+ONLY_LIST=""
+if [ -n "$ONLY_FROM" ]; then
+  ONLY_LIST=$'\n'"$(cat "$ONLY_FROM")"$'\n'
+fi
+
 MTIME_ARGS=()
 if [ "$OLDER_DAYS" -gt 0 ]; then
   MTIME_ARGS=(-mtime "+$OLDER_DAYS")
@@ -139,6 +177,7 @@ fi
 
 matches=()
 skipped_active=0
+skipped_resumable=0
 while IFS= read -r -d '' d; do
   base="$(basename "$d")"
   if is_reserved_name "$base"; then continue; fi
@@ -147,6 +186,12 @@ while IFS= read -r -d '' d; do
   if [ -n "$TASK" ] && [ "$base" != "$TASK" ]; then continue; fi
   # --project: the immediate parent dir name must equal the project
   if [ -n "$PROJECT" ] && [ "$(basename "$(dirname "$d")")" != "$PROJECT" ]; then continue; fi
+  if [ -n "$ONLY_FROM" ]; then
+    case "$ONLY_LIST" in
+      *$'\n'"${d#"$LOG_ROOT"/}"$'\n'*) ;;
+      *) continue ;;
+    esac
+  fi
   # Active-task grace: spare dirs a run touched in the last GRACE_MIN minutes
   # so a concurrent run keeps a resumable log dir. --task is an explicit,
   # deliberate target and bypasses the grace.
@@ -155,12 +200,16 @@ while IFS= read -r -d '' d; do
     skipped_active=$((skipped_active + 1))
     continue
   fi
+  if [ -z "$TASK" ] && is_resumable "$d"; then
+    skipped_resumable=$((skipped_resumable + 1))
+    continue
+  fi
   matches+=("$d")
 done < <(find "$LOG_ROOT" -mindepth 1 -maxdepth 2 -type d ${MTIME_ARGS[@]+"${MTIME_ARGS[@]}"} -print0 2>/dev/null)
 
 if [ "${#matches[@]}" -eq 0 ]; then
-  if [ "$skipped_active" -gt 0 ]; then
-    echo "prune-logs: only active task dirs matched (touched in the last ${GRACE_MIN}m)  -  spared, nothing to do"
+  if [ "$skipped_active" -gt 0 ] || [ "$skipped_resumable" -gt 0 ]; then
+    echo "prune-logs: only active or resumable task dirs matched ($skipped_active touched in the last ${GRACE_MIN}m, $skipped_resumable resumable)  -  spared, nothing to do"
   else
     echo "prune-logs: no task logs matched under $LOG_ROOT  -  nothing to do"
   fi
@@ -179,6 +228,7 @@ if [ "$DELETE" -eq 0 ]; then
   echo "DRY-RUN  -  would remove ${#matches[@]} task log dir(s) (frees ~${human}):"
   for d in "${matches[@]}"; do echo "  ${d#"$LOG_ROOT"/}"; done
   [ "$skipped_active" -gt 0 ] && echo "Spared $skipped_active active dir(s) touched in the last ${GRACE_MIN}m."
+  [ "$skipped_resumable" -gt 0 ] && echo "Spared $skipped_resumable run(s) that can still be resumed."
   echo "Audit trail + metrics corpus are preserved. Re-run with --yes to delete."
   exit 0
 fi
@@ -199,5 +249,6 @@ for d in "${matches[@]}"; do
 done
 spared_note=""
 [ "$skipped_active" -gt 0 ] && spared_note=", spared $skipped_active active"
+[ "$skipped_resumable" -gt 0 ] && spared_note="${spared_note}, spared $skipped_resumable resumable"
 echo "══ prune-logs: removed ${removed}/${#matches[@]} task log dir(s)${spared_note}, freed ~${human} (audit + metrics preserved) ══"
 exit 0

package/pipeline/scripts/rework-rulings.mjs

@@ -0,0 +1,106 @@
+#!/usr/bin/env node
+/**
+ * rework-rulings.mjs  -  what happens to each open finding when the rework cap
+ * is reached.
+ *
+ * Phase 2 allows a fixed number of rework rounds. At the cap every accepted
+ * finding still open gets one ruling, recorded, never dropped:
+ *
+ *   escalate   load-bearing: blocking severity, or a security finding
+ *              (ruleId SEC-* / CON-SEC-*, a security criteriaSource, or the
+ *              security-auditor's `security` object). The run stops and the
+ *              user decides.
+ *   parked     anything else. It leaves the loop as a follow-up with its
+ *              reason, shown before commit (Phase 4 Step 0b), carried in the
+ *              PR follow-ups and recorded in the debt list, so the run can finish instead of stopping on a
+ *              finding that is safe to defer.
+ *
+ * The run escalates when any ruling is `escalate`; otherwise it continues.
+ *
+ * Usage:
+ *   rework-rulings.mjs --triage <triage-output.json> [--state <agent-state.json>]
+ *
+ *   --state records the result as reviewIterations[-1].rulings.
+ *
+ * Output: {escalate, parked, rulings[]} as JSON on stdout.
+ * Exit: 0 decided (either way) · 2 usage or unreadable triage · 3 state write failed
+ *
+ * @module pipeline/scripts/rework-rulings
+ */
+
+import { invokedDirectly } from "../lib/invoked-directly.mjs";
+import { readRegularJson } from "../lib/regular-file.mjs";
+import { updateState } from "./gate-ledger.mjs";
+
+const SECURITY_RULE = /^(CON-)?SEC-/i;
+
+/** True when a finding may not leave the loop without the user. */
+export function loadBearing(f) {
+  if (f?.severity === "blocking") return true;
+  if (typeof f?.ruleId === "string" && SECURITY_RULE.test(f.ruleId)) return true;
+  if (f?.security && typeof f.security === "object") return true;
+  return typeof f?.criteriaSource === "string" && /security/i.test(f.criteriaSource);
+}
+
+/** One ruling per accepted finding of a triage output. */
+export function rule(triage) {
+  const rulings = (triage?.accepted ?? []).map((f) => {
+    const escalate = loadBearing(f);
+    return {
+      fingerprint: f.fingerprint ?? null,
+      file: f.file ?? null,
+      line: Number.isInteger(f.line) ? f.line : null,
+      severity: f.severity ?? null,
+      ruling: escalate ? "escalate" : "parked",
+      reason: escalate
+        ? f.severity === "blocking"
+          ? "blocking finding open at the rework cap"
+          : "security finding open at the rework cap"
+        : `rework cap reached; ${f.severity ?? "unrated"} finding parked as a follow-up`,
+      issue: f.issue ?? "",
+    };
+  });
+  return {
+    escalate: rulings.some((r) => r.ruling === "escalate"),
+    parked: rulings.filter((r) => r.ruling === "parked").length,
+    rulings,
+  };
+}
+
+function flag(argv, name) {
+  const i = argv.indexOf(`--${name}`);
+  return i >= 0 ? argv[i + 1] : undefined;
+}
+
+if (invokedDirectly(import.meta.url)) {
+  const argv = process.argv.slice(2);
+  const triagePath = flag(argv, "triage");
+  if (!triagePath) {
+    console.error("usage: rework-rulings.mjs --triage <path> [--state <path>]");
+    process.exit(2);
+  }
+  const triage = readRegularJson(triagePath, null);
+  if (!triage || !Array.isArray(triage.accepted)) {
+    console.error(`rework-rulings: no accepted[] in ${triagePath}`);
+    process.exit(2);
+  }
+  const result = rule(triage);
+  const statePath = flag(argv, "state");
+  if (statePath) {
+    try {
+      await updateState(statePath, (s) => {
+        const iterations = Array.isArray(s.reviewIterations) ? [...s.reviewIterations] : [];
+        if (!iterations.length) iterations.push({ iteration: 1 });
+        iterations[iterations.length - 1] = {
+          ...iterations[iterations.length - 1],
+          rulings: result.rulings,
+        };
+        return { ...s, reviewIterations: iterations };
+      });
+    } catch (e) {
+      console.error(`rework-rulings: state not written: ${e.message}`);
+      process.exitCode = 3;
+    }
+  }
+  process.stdout.write(JSON.stringify(result) + "\n");
+}

package/pipeline/scripts/runs-index.mjs

@@ -81,12 +81,12 @@ const PHASE_WAITING_FROM = PHASE_CONTRACT.thresholds.waitingFromPhase;
  */
 const LAST_PHASE = PHASE_CONTRACT.phases[PHASE_CONTRACT.phases.length - 1].id;
 
-export const CONTRACT_VERSION = "1.2.0";
+export const CONTRACT_VERSION = "1.3.0";
 
 const STATE_MAX_BYTES = 16 * 1024 * 1024;
 
 /** The run fields runs-index.schema.json marks x-sensitivity local. */
-export const LOCAL_RUN_FIELDS = ["dir", "worktreePath", "prUrl", "duplicateOf"];
+export const LOCAL_RUN_FIELDS = ["dir", "worktreePath", "prUrl", "duplicateOf", "channelUrls"];
 
 const GROUPS = {
   waiting: "Waiting on you",
@@ -226,6 +226,57 @@ function runTypeOf(state, kind) {
   return "development";
 }
 
+const JIRA_KEY = /^[A-Z][A-Z0-9_]{0,30}-[0-9]{1,9}$/;
+const GH_PART = /^[A-Za-z0-9_.-]{1,100}$/;
+
+/**
+ * Where a run's work came from: its Jira key, its GitHub issue as
+ * owner/repo#N, or free text. A GitHub issue that got a Jira carries both.
+ */
+export function sourceOf(state) {
+  const jira =
+    typeof state?.jiraId === "string" && JIRA_KEY.test(state.jiraId) ? state.jiraId : null;
+  const g = state?.githubIssue;
+  const issue =
+    g &&
+    GH_PART.test(String(g.owner)) &&
+    GH_PART.test(String(g.repo)) &&
+    Number.isInteger(g.number) &&
+    g.number > 0
+      ? `${g.owner}/${g.repo}#${g.number}`
+      : null;
+  if (issue) return { kind: "github", jira, issue };
+  if (jira) return { kind: "jira", jira, issue: null };
+  if (state?.inputType === "free-text") return { kind: "text", jira: null, issue: null };
+  return null;
+}
+
+const CHANNELS = ["pr", "jira", "confluence", "wiki", "issue"];
+const CHANNEL_STATES = new Set(["posted", "skipped", "failed"]);
+
+/** Where Phase 5 sent the report: each adapter's outcome, in a fixed order. */
+export function channelsOf(state) {
+  const r = state?.channelResults;
+  if (!r || typeof r !== "object") return { channels: [], urls: {} };
+  const channels = [];
+  const urls = {};
+  for (const c of CHANNELS) {
+    const v = r[c];
+    if (!v || !CHANNEL_STATES.has(v.status)) continue;
+    channels.push({ channel: c, status: v.status });
+    if (typeof v.url === "string" && /^https:\/\/\S+$/.test(v.url)) urls[c] = v.url;
+  }
+  return { channels, urls };
+}
+
+/** The run's PR number, from the state or its PR address; null when neither names one. */
+export function prNumberOf(state, prUrl) {
+  const n = state?.pr?.number;
+  if (Number.isInteger(n) && n > 0) return n;
+  const m = /\/(?:pull|pull-requests)\/(\d{1,9})(?:[/?#]|$)/.exec(String(prUrl ?? ""));
+  return m && Number(m[1]) > 0 ? Number(m[1]) : null;
+}
+
 /** The issue summary Phase 0 recorded, else the input the run was launched with. */
 function titleOf(state) {
   return textOrNull(state?.title) ?? textOrNull(state?.launchRequest?.input);
@@ -388,6 +439,7 @@ export function buildIndex() {
     const tracker = readJson(trackerPath);
     const phases = summarisePhases(tracker);
     const prUrl = state?.pr?.url ?? state?.prUrl ?? null;
+    const prNumber = prNumberOf(state, prUrl);
     const kind = statePath ? "pipeline" : trackerPath ? "tracker-only" : "empty";
     const currentPhase = Number.isFinite(Number(state?.currentPhase))
       ? Number(state.currentPhase)
@@ -443,7 +495,15 @@ export function buildIndex() {
       // exactly what nobody measured.
       unlockedWrites: Number.isInteger(tracker?.unlockedWrites) ? tracker.unlockedWrites : 0,
       runType: runTypeOf(state, kind),
+      mode:
+        typeof state?.mode === "string" && /^[a-z][a-z-]{0,30}$/.test(state.mode)
+          ? state.mode
+          : null,
       title: titleOf(state),
+      source: sourceOf(state),
+      prNumber,
+      channels: channelsOf(state).channels,
+      channelUrls: channelsOf(state).urls,
       progress: runProgress(phases.phases),
       currentTask: currentTaskOf(phases.phases, currentPhase),
       // Whether the session the run was launched under is alive, from

package/pipeline/scripts/scope-check-gate.mjs

@@ -10,21 +10,29 @@
  * Usage:
  *   git diff --name-only <base>...HEAD | node scope-check-gate.mjs --check .pipeline/scope-check.json --diff-files -
  *   node scope-check-gate.mjs --check scope-check.json --diff-files files.txt [--advisory]
+ *       [--patch <unified diff> | --repo <dir> --patch-range <a>...<b>]
  *
- * Output (stdout, JSON): {ok, justified, unjustified[], unlisted[], notDone}
+ * Output (stdout, JSON): {ok, justified, unjustified[], unlisted[], notDone, formatOnly[]}
  *   unjustified = in the diff, missing from files[] (or with an empty reason)
  *   unlisted    = in files[], not in the diff (stale entry; reported, never fatal)
+ *   formatOnly  = with --patch, hunks whose removed and added lines differ only
+ *                 in whitespace: a reformat of lines the task did not need to
+ *                 touch. Reported, never fatal. --patch-range reads that diff
+ *                 with git itself, its output format pinned, so a caller needs
+ *                 no file or process substitution for it.
  *
  * Exit codes: 0 every diff file justified (or --advisory), 1 otherwise or on
  * unreadable input, 64 usage.
  */
 
+import { execFileSync } from "node:child_process";
 import { readFileSync } from "node:fs";
 
 import { normalizeFile } from "./_fingerprint.mjs";
+import { parseUnifiedDiff } from "./_unified-diff.mjs";
 
 const USAGE =
-  "usage: scope-check-gate.mjs --check <scope-check.json> --diff-files <path|-> [--advisory]";
+  "usage: scope-check-gate.mjs --check <scope-check.json> --diff-files <path|-> [--advisory] [--patch <diff> | --repo <dir> --patch-range <a>...<b>]";
 
 function parseArgs(argv) {
   const opts = {};
@@ -33,15 +41,145 @@ function parseArgs(argv) {
     if (a === "--check") opts.check = argv[++i];
     else if (a === "--diff-files") opts.diffFiles = argv[++i];
     else if (a === "--advisory") opts.advisory = true;
+    else if (a === "--patch") opts.patch = argv[++i];
+    else if (a === "--patch-range") opts.patchRange = argv[++i];
+    else if (a === "--repo") opts.repo = argv[++i];
     else return null;
   }
+  if (opts.patchRange !== undefined && !/^[A-Za-z0-9_./~^@{}-]+$/.test(opts.patchRange))
+    return null;
+  if (opts.patchRange?.startsWith("-")) return null;
   return opts.check && opts.diffFiles ? opts : null;
 }
 
+/** The diff of a revision range, in the one shape formatOnlyHunks reads. */
+function rangeDiff(repo, range) {
+  return execFileSync(
+    "git",
+    [
+      "-C",
+      repo || ".",
+      "-c",
+      "core.quotePath=false",
+      "diff",
+      "--no-ext-diff",
+      "--no-color",
+      "--no-textconv",
+      "--src-prefix=a/",
+      "--dst-prefix=b/",
+      range,
+      "--",
+    ],
+    { encoding: "utf8", maxBuffer: 64 * 1024 * 1024, timeout: 30_000 },
+  );
+}
+
 function readText(path) {
   return path === "-" ? readFileSync(0, "utf-8") : readFileSync(path, "utf-8");
 }
 
+const INDENT_SENSITIVE = /(\.(py|pyi|ya?ml|coffee|haml|slim|pug)|(^|\/)(GNU)?[Mm]akefile)$/;
+
+const LINE_COMMENT = /(\.(py|pyi|ya?ml|sh|bash|zsh|rb|toml|coffee)|(^|\/)(GNU)?[Mm]akefile)$/;
+// Languages where a space next to a bracket, comma, semicolon or colon never
+// carries meaning. YAML, shell, Makefile and CSS are left out on purpose.
+const TIGHT_LANGS =
+  /\.(js|jsx|mjs|cjs|ts|tsx|java|go|cs|swift|kt|kts|json|rs|dart|scala|py|pyi|c|h|cc|cpp|hpp|m|mm)$/;
+const LEADING_OPERATOR_LANGS = /\.(kt|kts|swift|go|scala)$/;
+const BREAK_KEEPERS = /\b(return|throw|yield|break|continue)$/;
+const LEADING_OPERATOR = /^[+\-*/%&|^.?]/;
+const TIGHT = /\s*([(){}[\],;:])\s*/g;
+
+/** One line with string literals and comments verbatim and every other whitespace run as one space. */
+function foldLine(line, hashComments) {
+  const out = [];
+  let quote = null;
+  let gap = false;
+  for (let i = 0; i < line.length; i++) {
+    const c = line[i];
+    if (quote) {
+      out.push(c);
+      if (c === "\\") out.push(line[++i] ?? "");
+      else if (c === quote) quote = null;
+      continue;
+    }
+    if (c === " " || c === "\t" || c === "\r") {
+      gap = true;
+      continue;
+    }
+    if (gap && out.length) out.push(" ");
+    gap = false;
+    if ((c === "/" && line[i + 1] === "/") || (hashComments && c === "#")) {
+      out.push(line.slice(i));
+      break;
+    }
+    if (c === '"' || c === "'" || c === "`") quote = c;
+    out.push(c);
+  }
+  return out.join("");
+}
+
+/**
+ * The layout-free form of some lines. Each line is folded on its own (linear
+ * in the hunk), then the lines are joined by a space, except that a break
+ * after return, throw, yield, break or continue, and in Kotlin, Swift, Go or
+ * Scala a break before a leading operator, stays a break. Space next to
+ * brackets, commas, semicolons and colons is dropped only in TIGHT_LANGS, and
+ * never in a hunk that holds a C preprocessor line.
+ */
+function outsideStrings(text, file = "") {
+  const hashComments = LINE_COMMENT.test(file);
+  const lines = text.split("\n").map((l) => foldLine(l, hashComments));
+  let joined = "";
+  lines.forEach((line, i) => {
+    if (i === 0) {
+      joined = line;
+      return;
+    }
+    const keepBreak =
+      BREAK_KEEPERS.test(lines[i - 1]) ||
+      (LEADING_OPERATOR_LANGS.test(file) && LEADING_OPERATOR.test(line));
+    joined += (keepBreak ? "\u23ce" : " ") + line;
+  });
+  const preprocessor = lines.some((l) => l.startsWith("#")) && !hashComments;
+  const tight = TIGHT_LANGS.test(file) && !preprocessor;
+  return (tight ? joined.replace(TIGHT, "$1") : joined).trim();
+}
+
+const indentOf = (line) => /^[ \t]*/.exec(line)[0];
+
+/** True when the removed and added lines differ only in layout. */
+function layoutOnly(file, removed, added) {
+  if (!removed.length || !added.length) return false;
+  if (INDENT_SENSITIVE.test(file)) {
+    if (removed.length !== added.length) return false;
+    return removed.every(
+      (r, i) =>
+        indentOf(r.text) === indentOf(added[i].text) &&
+        outsideStrings(r.text, file) === outsideStrings(added[i].text, file),
+    );
+  }
+  const joined = (lines) => outsideStrings(lines.map((d) => d.text).join("\n"), file);
+  return joined(removed) === joined(added);
+}
+
+/**
+ * Hunks of a unified diff whose change is layout only: whitespace outside
+ * string literals, and in indentation-sensitive files never a leading indent.
+ */
+export function formatOnlyHunks(patch) {
+  const found = [];
+  for (const [file, diff] of parseUnifiedDiff(patch)) {
+    for (const h of diff.hunks) {
+      if (!h.removed.length && !h.added.length) continue;
+      if (layoutOnly(file, h.removed, h.added)) {
+        found.push({ file: normalizeFile(file), hunk: h.header });
+      }
+    }
+  }
+  return found;
+}
+
 export function evaluate(check, diffFiles) {
   const files = Array.isArray(check?.files) ? check.files : [];
   const reasons = new Map();
@@ -81,6 +219,15 @@ function main() {
     return fail;
   }
   const result = evaluate(check, diffFiles);
+  if (opts.patch || opts.patchRange) {
+    try {
+      const patch = opts.patch ? readText(opts.patch) : rangeDiff(opts.repo, opts.patchRange);
+      result.formatOnly = formatOnlyHunks(patch);
+    } catch (err) {
+      result.formatOnly = [];
+      result.patchError = err.message;
+    }
+  }
   process.stdout.write(JSON.stringify(result) + "\n");
   return result.ok ? 0 : fail;
 }