@colrealpro/react-luau-doctor 0.20.1 → 0.20.3

package/dist/cli.js

@@ -3,7 +3,7 @@
 
 // src/cli.ts
 import fs11 from "fs";
-import os2 from "os";
+import os3 from "os";
 import path13 from "path";
 // package.json
 var package_default = {
@@ -11,7 +11,7 @@ var package_default = {
   publishConfig: {
     access: "public"
   },
-  version: "0.20.1",
+  version: "0.20.3",
   description: "Static analysis for React-Luau hooks, effects, rendering, and performance.",
   license: "MIT",
   type: "module",
@@ -34,10 +34,10 @@ var package_default = {
     check: "bunx tsc -p tsconfig.json --noEmit",
     "check:lsp": "npm --prefix editors/vscode run check",
     "test:lsp": "bun run scripts/build-lsp.ts && bun test tests/lsp.test.ts",
-    test: "bun run build && bun test --parallel=4",
+    test: "bun run build && bun test --parallel",
     "doctor:example": "bun run src/cli.ts examples",
     prepack: "bun run build && bun run check",
-    ci: "bun run build && bun run check && bun run check:lsp && bun run scripts/build-lsp.ts && bun test --parallel=4 && bun run scripts/verify-package.ts",
+    ci: "bun run build && bun run check && bun run check:lsp && bun run scripts/build-lsp.ts && bun test --parallel && bun run scripts/verify-package.ts",
     "verify:package": "bun run build && bun run scripts/verify-package.ts"
   },
   engines: {
@@ -45,7 +45,6 @@ var package_default = {
   },
   packageManager: "bun@1.4.0",
   dependencies: {
-    "jsonc-parser": "3.3.1",
     "web-tree-sitter": "0.26.11"
   },
   devDependencies: {
@@ -53,6 +52,7 @@ var package_default = {
     "@types/bun": "1.4.0",
     "@vscode/vsce": "^4.0.0",
     esbuild: "^0.28.2",
+    "jsonc-parser": "3.3.1",
     "vscode-languageserver": "^10.1.2",
     typescript: "5.8.3"
   },
@@ -552,7 +552,13 @@ function isLazyRefInitialization(context, call) {
   }
   return false;
 }
-function isRefInitializer(context, call) {
+var hookInitializerArguments = new Map([
+  ["React.useRef", 0],
+  ["React.useState", 0],
+  ["React.useBinding", 0],
+  ["React.useReducer", 1]
+]);
+function isHookInitializer(context, call) {
   let node = call;
   while (node.parent) {
     const parent = node.parent;
@@ -560,8 +566,11 @@ function isRefInitializer(context, call) {
       return false;
     if (parent.type === "arguments") {
       const hook = parent.parent;
-      if (hook?.type === "function_call" && reactApiPath(context, hook) === "React.useRef" && context.callArguments(hook)[0]?.id === node.id)
-        return true;
+      if (hook?.type === "function_call") {
+        const argumentIndex = hookInitializerArguments.get(reactApiPath(context, hook) ?? "");
+        if (argumentIndex !== undefined && context.callArguments(hook)[argumentIndex]?.id === node.id)
+          return true;
+      }
     }
     node = parent;
   }
@@ -595,18 +604,18 @@ var noBindingGetValueInRender = {
   id: "react-luau/no-binding-getvalue-in-render",
   category: "Correctness",
   severity: "warning",
-  description: "Do not read binding snapshots during render except to initialize a ref",
+  description: "Do not read binding snapshots during render except in hook initialization arguments",
   guidance: {
     explanation: "getValue returns a snapshot without subscribing \u2014 later binding updates do not rerender the component or update props built from that snapshot",
     help: "Pass the binding directly to the prop or use binding:map(function(value) return ... end)",
-    caveat: "A snapshot used to initialize React.useRef is allowed because the initial value is intentionally preserved"
+    caveat: "Snapshots in the first argument to React.useRef, React.useState, or React.useBinding, or the second argument to React.useReducer, are allowed because those arguments are used only for initialization"
   },
   run(context) {
     return context.findCalls().flatMap((call) => {
       const owner = context.nearestFunction(call);
       const name = call.childForFieldName("name");
       const receiver = name?.namedChildren[0];
-      if (!owner || !owner.isComponent && !owner.isHook || name?.type !== "method_index_expression" || name.namedChildren.at(-1)?.text !== "getValue" || !receiver || !isBinding(context, receiver) || isRefInitializer(context, call))
+      if (!owner || !owner.isComponent && !owner.isHook || name?.type !== "method_index_expression" || name.namedChildren.at(-1)?.text !== "getValue" || !receiver || !isBinding(context, receiver) || isHookInitializer(context, call))
         return [];
       return [
         {
@@ -8616,11 +8625,12 @@ function normalizeCategory(value) {
   return null;
 }
 
-// src/ci.ts
+// src/ci/index.ts
 import { spawnSync as spawnSync2 } from "child_process";
-import { createHash } from "crypto";
+import { createHash as createHash2 } from "crypto";
 import fs9 from "fs";
 import path11 from "path";
+import os2 from "os";
 import readline from "readline/promises";
 import { stdin as input, stdout as output } from "process";
 
@@ -8790,18 +8800,20 @@ function mergeBase(repoRoot, left, right = "HEAD") {
   return result.status === 0 ? result.stdout.trim() : null;
 }
 function resolveGitBase(repoRoot, requested) {
-  if (requested) {
-    if (requested.startsWith("-"))
-      throw new Error(`Invalid git ref: ${requested}`);
-    const base = mergeBase(repoRoot, requested);
+  const gitLab = process.env.GITLAB_CI === "true";
+  const baseRef = requested ?? (gitLab ? process.env.CI_MERGE_REQUEST_DIFF_BASE_SHA?.trim() : undefined);
+  if (baseRef) {
+    if (baseRef.startsWith("-"))
+      throw new Error(`Invalid git ref: ${baseRef}`);
+    const base = mergeBase(repoRoot, baseRef);
     if (base)
       return base;
-    const commit = verifyCommit(repoRoot, requested);
+    const commit = verifyCommit(repoRoot, baseRef);
     if (!commit)
-      throw new Error(`Could not resolve git base ref: ${requested}`);
+      throw new Error(`Could not resolve git base ref: ${baseRef}`);
     return commit;
   }
-  const environmentBase = process.env.GITHUB_BASE_REF?.trim();
+  const environmentBase = process.env.GITHUB_BASE_REF?.trim() || (gitLab ? process.env.CI_DEFAULT_BRANCH?.trim() : undefined);
   const candidates = [
     environmentBase ? `origin/${environmentBase}` : null,
     environmentBase ?? null,
@@ -8991,6 +9003,7 @@ function createGitScopePlan(scanRootInput, options, relativeRootInput = scanRoot
   const baselineFiles = [];
   const changedLines = new Map;
   const changedFiles = [];
+  const baselinePaths = new Map;
   const stagedSources = options.staged ? readGitObjects(repoRoot, repoFiles.map((file) => `:${file.currentPath}`)) : new Map;
   const baselineSources = options.scope === "changed" ? readGitObjects(repoRoot, repoFiles.filter((file) => file.baselinePath !== null).map((file) => `${base}:${file.baselinePath}`)) : new Map;
   for (const repoFile of repoFiles) {
@@ -9002,10 +9015,16 @@ function createGitScopePlan(scanRootInput, options, relativeRootInput = scanRoot
       continue;
     const source = options.staged ? stagedSources.get(`:${repoRelativePath}`) ?? null : currentSource(repoRoot, repoRelativePath, false);
     const relativePath = normalize2(path4.relative(relativeRoot, absolutePath));
+    if (repoFile.baselinePath !== null) {
+      baselinePaths.set(relativePath, normalize2(path4.relative(relativeRoot, path4.resolve(repoRoot, repoFile.baselinePath))));
+    }
     changedFiles.push(relativePath);
     if (source !== null)
       currentFiles.push({ absolutePath, relativePath, source, forceScan: false });
     const baseline = options.scope !== "changed" || repoFile.baselinePath === null ? null : baselineSources.get(`${base}:${repoFile.baselinePath}`) ?? null;
+    if (options.scope === "changed" && repoFile.baselinePath !== null && baseline === null) {
+      throw new Error(`Could not read baseline source for ${repoFile.baselinePath}`);
+    }
     if (baseline !== null)
       baselineFiles.push({ absolutePath, relativePath, source: baseline, forceScan: false });
     if (options.scope === "lines" && source !== null) {
@@ -9019,7 +9038,8 @@ function createGitScopePlan(scanRootInput, options, relativeRootInput = scanRoot
     changedFiles: [...new Set(changedFiles)].sort(),
     currentFiles,
     baselineFiles,
-    changedLines
+    changedLines,
+    baselinePaths
   };
 }
 
@@ -9314,6 +9334,747 @@ function renderAnnotations(report) {
 `);
 }
 
+// src/ci/report.ts
+var SUMMARY_MARKER = "<!-- react-luau-doctor:summary -->";
+var REVIEW_MARKER = "<!-- react-luau-doctor:review -->";
+var SUCCESS_ICON = '<img src="https://raw.githubusercontent.com/ColRealPro/react-luau-doctor/main/assets/ci/check-circle.svg" width="14" height="14" alt="">';
+var MAX_COMMENT_LENGTH = 60000;
+function escapeMarkdown(value) {
+  return value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/[\\`*_{}\[\]()!|#$~]/g, "\\$&").replace(/\r?\n/g, " ");
+}
+function inlineCode(value) {
+  const text = value.replace(/\r?\n/g, " ");
+  const fence = "`".repeat(Math.max(0, ...[...text.matchAll(/`+/g)].map((match) => match[0].length)) + 1);
+  const padding = text.startsWith("`") || text.endsWith("`") || text.startsWith(" ") && text.endsWith(" ") ? " " : "";
+  return `${fence}${padding}${text}${padding}${fence}`;
+}
+function escapeHtml(value) {
+  return value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
+}
+function issueCount(count) {
+  return `${count} ${count === 1 ? "issue" : "issues"}`;
+}
+function statusText(kind, text) {
+  let rendered = kind === "fixed" ? `**${escapeMarkdown(text)}**` : escapeMarkdown(text);
+  return rendered;
+}
+function renderReviewProgress(total, fixed, unknown, discussions) {
+  const lines = [`**React-Luau Doctor found ${total} new ${total === 1 ? "issue" : "issues"}**`];
+  const status = [];
+  if (unknown > 0) {
+    status.push(`${unknown} ${unknown === 1 ? "issue" : "issues"} awaiting verification`);
+  }
+  if (discussions === undefined && fixed > 0) {
+    status.push("discussion status unavailable");
+  }
+  const discussion = discussions ? `${discussions} ${discussions === 1 ? "discussion" : "discussions"} awaiting resolution` : "";
+  if (fixed > 0) {
+    let fixedText = `${fixed} of these ${issueCount(total)} fixed`;
+    if (fixed === total) {
+      if (total === 1) {
+        fixedText = "This issue fixed in later commits";
+      } else if (total === 2) {
+        fixedText = "Both issues fixed in later commits";
+      } else {
+        fixedText = `All ${total} issues fixed in later commits`;
+      }
+    }
+    const remaining = total - fixed - unknown;
+    if (remaining > 0) {
+      status.unshift(`${remaining} still ${remaining === 1 ? "remains" : "remain"} in the PR`);
+    }
+    lines.push("", [
+      `${SUCCESS_ICON} ${statusText("fixed", fixedText)}`,
+      status.length ? statusText("remaining", `\xB7 ${status.join(" \xB7 ")}`) : "",
+      discussion ? statusText("discussion", `\xB7 ${discussion}`) : ""
+    ].filter(Boolean).join(" "));
+  } else if (status.length || discussion) {
+    lines.push("", [
+      status.length ? statusText("remaining", status.join(" \xB7 ")) : "",
+      discussion ? statusText("discussion", `${status.length ? "\xB7 " : ""}${discussion}`) : ""
+    ].filter(Boolean).join(" "));
+  }
+  return lines.join(`
+`);
+}
+function ordered(diagnostics) {
+  return [...diagnostics].sort((a, b) => a.file.localeCompare(b.file) || a.location.line - b.location.line || a.rule.localeCompare(b.rule) || a.message.localeCompare(b.message));
+}
+function diagnosticDetails(diagnostic) {
+  const details = [diagnostic.help, diagnostic.explanation, diagnostic.caveat].filter((value) => Boolean(value) && value !== diagnostic.message);
+  return details.length ? `
+  ${[...new Set(details)].map(escapeMarkdown).join(" \xB7 ")}` : "";
+}
+function renderSummaryComment(report, options) {
+  const total = report.diagnostics.length;
+  const files = new Set(report.diagnostics.map((diagnostic) => diagnostic.file)).size;
+  const newLabel = report.scope === "changed" ? "new" : "reported";
+  const severity = [
+    `${report.counts.error} ${report.counts.error === 1 ? "error" : "errors"}`,
+    `${report.counts.warning} ${report.counts.warning === 1 ? "warning" : "warnings"}`,
+    `${report.counts.suggestion} ${report.counts.suggestion === 1 ? "suggestion" : "suggestions"}`
+  ].join(" & ");
+  const info = options.incomplete ? `score unavailable \xB7 fixes unverified \xB7 vs ${inlineCode(options.baseBranch)}` : `score ${report.score}/100 (${scoreLabel(report.score)}) \xB7 ${options.fixed.length} fixed \xB7 vs ${inlineCode(options.baseBranch)}`;
+  let headline;
+  if (options.incomplete) {
+    headline = `**React-Luau Doctor analysis incomplete \xB7 ${issueCount(total)} reported so far**` + `
+
+Findings may be missing and fixes have not been verified`;
+  } else if (options.skipped || total === 0) {
+    headline = `**React-Luau Doctor found no ${newLabel} issues${newLabel === "new" ? ". \uD83C\uDF89" : ""}**`;
+    if (options.skipped) {
+      headline += `
+
+No eligible React-Luau files changed in this pull request \xB7 scan skipped`;
+    }
+  } else {
+    headline = `**React-Luau Doctor found ${total} ${newLabel} ${total === 1 ? "issue" : "issues"}` + ` in ${files} ${files === 1 ? "file" : "files"} \xB7 ${severity} \xB7 ${info}**`;
+  }
+  const lines = [SUMMARY_MARKER, headline];
+  if (options.incomplete) {
+    lines.push("", `${severity} \xB7 ${info}`);
+  }
+  const sections = [
+    {
+      title: "Errors",
+      diagnostics: report.diagnostics.filter((d) => d.severity === "error"),
+      icon: "\u274C",
+      grouped: false,
+      baseline: false
+    },
+    {
+      title: `\u26A0\uFE0F ${report.counts.warning} ${report.counts.warning === 1 ? "warning" : "warnings"}`,
+      diagnostics: report.diagnostics.filter((d) => d.severity === "warning"),
+      icon: "\u26A0\uFE0F",
+      grouped: true,
+      baseline: false
+    },
+    {
+      title: `\uD83D\uDCA1 ${report.counts.suggestion} ${report.counts.suggestion === 1 ? "suggestion" : "suggestions"}`,
+      diagnostics: report.diagnostics.filter((d) => d.severity === "suggestion"),
+      icon: "\uD83D\uDCA1",
+      grouped: true,
+      baseline: false
+    },
+    {
+      title: `${options.fixed.length} fixed vs <code>${escapeHtml(options.baseBranch)}</code>`,
+      diagnostics: options.incomplete ? [] : options.fixed,
+      icon: SUCCESS_ICON,
+      grouped: true,
+      baseline: true
+    }
+  ];
+  const inlineNote = total > 0 && options.inlineCount > 0 ? " \xB7 See inline comments for fixes" : "";
+  const footer = `
+
+<sub>Reviewed by [React-Luau Doctor](https://github.com/ColRealPro/react-luau-doctor)` + ` for commit ${inlineCode(options.sha.slice(0, 7))}${inlineNote}</sub>
+`;
+  const reportLink = options.runUrl ? `[the full workflow report](${options.runUrl})` : "the workflow summary and logs";
+  const overflow = `
+
+Additional findings were omitted from this comment \xB7 See ` + `${reportLink} for all findings and diagnostic details
+`;
+  const fullLink = options.runUrl && (total > 0 || options.fixed.length > 0 || options.incomplete) ? `
+
+[View full workflow report](${options.runUrl})` : "";
+  const limit = options.limit ?? MAX_COMMENT_LENGTH;
+  const reserve = footer.length + Math.max(overflow.length, fullLink.length);
+  let omitted = false;
+  let body = lines.join(`
+`);
+  for (const note of report.notes ?? []) {
+    const text = `
+
+${escapeMarkdown(note)}`;
+    if (body.length + text.length + reserve > limit) {
+      omitted = true;
+      continue;
+    }
+    body += text;
+  }
+  for (const section of sections) {
+    if (!section.diagnostics.length)
+      continue;
+    const start = section.grouped ? `
+
+<details>
+<summary>${section.title}</summary>
+` : `
+
+**Errors**
+
+`;
+    const end = section.grouped ? `
+</details>` : "";
+    let content = "";
+    let file = "";
+    for (const diagnostic of ordered(section.diagnostics)) {
+      const group = section.grouped && file !== diagnostic.file ? `
+**${inlineCode(diagnostic.file)}**
+` : "";
+      const uncertainLocation = section.baseline && diagnostic.baselineLocationUncertain;
+      const location = uncertainLocation ? "File" : section.grouped ? `L${diagnostic.location.line}` : inlineCode(`${diagnostic.file}:${diagnostic.location.line}`);
+      const message = escapeMarkdown(diagnostic.message);
+      const description = section.baseline ? statusText("fixed", diagnostic.message) : !section.grouped ? `**${message}**` : message;
+      const entry = `${group}${group ? `
+` : ""}- ${section.icon} [${location}](${options.url(diagnostic, section.baseline)})` + ` ${description} ${inlineCode(diagnostic.rule)}` + `${options.includeDiagnosticDetails ? diagnosticDetails(diagnostic) : ""}
+`;
+      if (body.length + start.length + content.length + entry.length + end.length + reserve > limit) {
+        omitted = true;
+        continue;
+      }
+      content += entry;
+      file = diagnostic.file;
+    }
+    if (content)
+      body += start + content + end;
+  }
+  return body + (omitted ? overflow : fullLink) + footer;
+}
+function diagnosticDifference(left, right, anchors) {
+  const fingerprint = (d) => `${d.file}\x00${d.rule}\x00${d.severity}\x00${d.message}`;
+  const groups = new Map;
+  for (const diagnostic of ordered(left)) {
+    groups.set(fingerprint(diagnostic), [
+      ...groups.get(fingerprint(diagnostic)) ?? [],
+      diagnostic
+    ]);
+  }
+  const result = [];
+  for (const [key, baseline] of groups) {
+    const current = right.filter((diagnostic) => fingerprint(diagnostic) === key);
+    const matched = new Set;
+    const used = new Set;
+    if (anchors) {
+      for (const diagnostic of baseline) {
+        const anchor = anchors.left(diagnostic);
+        if (!anchor || baseline.filter((entry) => anchors.left(entry) === anchor).length !== 1) {
+          continue;
+        }
+        const candidates = current.filter((entry) => !used.has(entry) && anchors.right(entry) === anchor);
+        if (candidates.length !== 1)
+          continue;
+        matched.add(diagnostic);
+        used.add(candidates[0]);
+      }
+    }
+    const remaining = baseline.filter((entry) => !matched.has(entry));
+    const count = current.length - used.size;
+    const uncertain = count > 0 && count < remaining.length;
+    for (const diagnostic of remaining.slice(count)) {
+      result.push(uncertain ? { ...diagnostic, baselineLocationUncertain: true } : diagnostic);
+    }
+  }
+  return ordered(result);
+}
+
+// src/ci/github.ts
+import { createHash } from "crypto";
+var STATE_PREFIX = "<!-- react-luau-doctor:state:";
+var MAX_REVIEW_COMMENTS = 20;
+function assignFindings(records, analysis) {
+  const groups = new Map;
+  for (const record of records) {
+    if (!record.file) {
+      record.finding.status = "unknown";
+      continue;
+    }
+    const key = findingFingerprint({ ...record.finding, file: record.file });
+    groups.set(key, [...groups.get(key) ?? [], record]);
+  }
+  for (const [key, group] of groups) {
+    const identities = [...new Set(group.map((entry) => entry.identity))];
+    const originals = identities.map((identity) => group.find((entry) => entry.identity === identity));
+    const current = analysis.current.filter((finding) => findingFingerprint(finding) === key).map((finding) => ({ finding, used: false }));
+    const matches = new Map;
+    for (const original of originals) {
+      if (!original.finding.anchor || originals.filter((entry) => entry.finding.anchor === original.finding.anchor).length !== 1) {
+        continue;
+      }
+      const candidates = current.filter((entry) => !entry.used && entry.finding.anchor === original.finding.anchor);
+      if (candidates.length !== 1)
+        continue;
+      candidates[0].used = true;
+      matches.set(original.identity, candidates[0].finding);
+    }
+    const unmatched = originals.filter((entry) => !matches.has(entry.identity));
+    const remaining = current.filter((entry) => !entry.used);
+    const ambiguous = remaining.length > 0 && remaining.length < unmatched.length;
+    if (!ambiguous) {
+      for (const original of unmatched) {
+        const candidate = remaining.filter((entry) => !entry.used).sort((a, b) => Math.abs(a.finding.line - original.finding.line) - Math.abs(b.finding.line - original.finding.line))[0];
+        if (!candidate)
+          continue;
+        candidate.used = true;
+        matches.set(original.identity, candidate.finding);
+      }
+    }
+    for (const record of group) {
+      const match = matches.get(record.identity);
+      const potentiallyRelocated = analysis.deletedFiles?.has(record.file) && analysis.current.some((finding) => finding.file !== record.file && finding.rule === record.finding.rule && finding.severity === record.finding.severity && finding.message === record.finding.message);
+      if (match) {
+        record.finding.status = "active";
+        match.identity = record.identity;
+      } else {
+        record.finding.status = !ambiguous && !potentiallyRelocated && analysis.verifiedFiles.has(record.file) && analysis.eligible({ ...record.finding, file: record.file }) && record.state.signature === analysis.signature ? "fixed" : "unknown";
+      }
+    }
+  }
+}
+function findingFingerprint(finding) {
+  return createHash("sha256").update(`${finding.file}\x00${finding.rule}\x00${finding.severity}\x00${finding.message}`).digest("hex").slice(0, 32);
+}
+function readReviewState(body) {
+  const encoded = body.match(/<!-- react-luau-doctor:state:([A-Za-z0-9+/=]+) -->/)?.[1];
+  if (!encoded)
+    return null;
+  try {
+    const state = JSON.parse(Buffer.from(encoded, "base64").toString("utf8"));
+    if (state.version !== 1 || typeof state.commit !== "string" || typeof state.signature !== "string" || !Array.isArray(state.findings) || state.findings.length === 0 || state.findings.length > MAX_REVIEW_COMMENTS) {
+      return null;
+    }
+    if (state.findings.some((f) => !f || typeof f.file !== "string" || typeof f.rule !== "string" || typeof f.severity !== "string" || typeof f.message !== "string" || !Number.isSafeInteger(f.line) || f.line < 1 || !["active", "fixed", "unknown"].includes(f.status) || [f.anchor, f.identity, f.diagnosticId].some((value) => value !== undefined && typeof value !== "string"))) {
+      return null;
+    }
+    return state;
+  } catch {
+    return null;
+  }
+}
+function renderReviewBody(state, discussions) {
+  const fixed = state.findings.filter((finding) => finding.status === "fixed").length;
+  const unknown = state.findings.filter((finding) => finding.status === "unknown").length;
+  const progress = renderReviewProgress(state.findings.length, fixed, unknown, discussions);
+  const metadata = Buffer.from(JSON.stringify(state)).toString("base64");
+  return `${REVIEW_MARKER}
+${progress}
+
+${STATE_PREFIX}${metadata} -->`;
+}
+
+class StalePublication extends Error {
+}
+
+class GitHubClient {
+  repo;
+  pullNumber;
+  publication;
+  constructor(repo, pullNumber, publication) {
+    this.repo = repo;
+    this.pullNumber = pullNumber;
+    this.publication = publication;
+  }
+  async request(endpoint, options = {}, graphql = false) {
+    const token = process.env.GITHUB_TOKEN;
+    if (!token)
+      throw new Error("GITHUB_TOKEN is unavailable");
+    const base = (process.env.GITHUB_API_URL ?? "https://api.github.com").replace(/\/$/, "");
+    const url = graphql ? `${base.replace(/\/api\/v3$/, "/api")}/graphql` : `${base}/repos/${this.repo}${endpoint}`;
+    for (let attempt = 0;; attempt += 1) {
+      if (attempt > 0 && options.guarded)
+        await this.assertCurrent();
+      const response = await fetch(url, {
+        method: options.method ?? "GET",
+        headers: {
+          Accept: "application/vnd.github+json",
+          Authorization: `Bearer ${token}`,
+          "X-GitHub-Api-Version": "2022-11-28",
+          "User-Agent": "react-luau-doctor",
+          "Content-Type": "application/json"
+        },
+        body: options.body === undefined ? undefined : JSON.stringify(options.body),
+        signal: AbortSignal.timeout(30000)
+      });
+      const responseText = response.status === 204 ? "" : await response.text();
+      const result = response.ok && responseText ? JSON.parse(responseText) : undefined;
+      const rateLimited = response.status === 429 || response.status === 403 && (response.headers.get("x-ratelimit-remaining") === "0" || /rate limit|rate_limit|abuse detection/i.test(responseText)) || response.ok && graphql && result?.errors && /rate limit|rate_limit/i.test(responseText);
+      if (response.ok && !rateLimited) {
+        if (graphql && (result?.errors || !result?.data)) {
+          throw new Error(`GitHub GraphQL: ${responseText}`);
+        }
+        return result;
+      }
+      const retryAfter = response.headers.get("retry-after");
+      const reset = Number(response.headers.get("x-ratelimit-reset"));
+      const delay = retryAfter ? /^\d+$/.test(retryAfter) ? Number(retryAfter) * 1000 : Date.parse(retryAfter) - Date.now() : response.headers.get("x-ratelimit-remaining") === "0" && reset ? Math.max(0, reset * 1000 - Date.now() + 1000) : 60000;
+      if (!rateLimited || attempt >= 2 || !Number.isFinite(delay) || delay > 60000) {
+        throw new Error(`GitHub API ${response.status}: ${responseText}`);
+      }
+      process.stderr.write(`react-luau-doctor: GitHub API ${response.status}; retrying in ${Math.ceil(Math.max(0, delay) / 1000)} seconds
+`);
+      await new Promise((resolve) => setTimeout(resolve, Math.max(0, delay)));
+    }
+  }
+  async list(endpoint) {
+    const all = [];
+    for (let page = 1;; page++) {
+      const batch = await this.request(`${endpoint}?per_page=100&page=${page}`);
+      if (!Array.isArray(batch))
+        throw new Error("GitHub returned an invalid paginated response");
+      all.push(...batch);
+      if (batch.length < 100)
+        return all;
+    }
+  }
+  async assertCurrent() {
+    const pull = await this.request(`/pulls/${this.pullNumber}`);
+    if (pull.head?.sha !== this.publication.head || pull.base?.sha !== this.publication.base || pull.state !== "open") {
+      throw new StalePublication("PR head or baseline changed; skipping outdated publication");
+    }
+    const summaries = await this.list(`/issues/${this.pullNumber}/comments`);
+    for (const summary of summaries.filter((c) => c.user?.type === "Bot" && c.body?.startsWith(SUMMARY_MARKER))) {
+      const marker = summary.body?.match(/<!-- react-luau-doctor:run:(\d+):(\d+) -->/);
+      if (marker && this.publication.runId && (BigInt(marker[1]) > BigInt(this.publication.runId) || marker[1] === this.publication.runId && Number(marker[2]) > Number(this.publication.attempt))) {
+        throw new StalePublication("A newer workflow run already published; skipping outdated publication");
+      }
+    }
+    if (!summaries.some((c) => c.user?.type === "Bot" && c.body?.startsWith(SUMMARY_MARKER))) {
+      const reviews = await this.list(`/pulls/${this.pullNumber}/reviews`);
+      for (const review of reviews.filter((r) => r.user?.type === "Bot")) {
+        const state = readReviewState(review.body ?? "");
+        if (state?.runId && /^\d+$/.test(state.runId) && this.publication.runId && (BigInt(state.runId) > BigInt(this.publication.runId) || state.runId === this.publication.runId && Number(state.attempt) > Number(this.publication.attempt))) {
+          throw new StalePublication("A newer review run already published; skipping outdated publication");
+        }
+      }
+    }
+  }
+  async mutate(endpoint, method, body) {
+    await this.assertCurrent();
+    return this.request(endpoint, { method, body, guarded: true });
+  }
+  async sticky(body, complete = true) {
+    await this.assertCurrent();
+    const comments = await this.list(`/issues/${this.pullNumber}/comments`);
+    const previous = comments.find((c) => c.user?.type === "Bot" && c.body?.startsWith(SUMMARY_MARKER));
+    const identity = `<!-- react-luau-doctor:commit:${this.publication.head}:${this.publication.base}:complete -->`;
+    if (!complete && previous?.body?.includes(identity))
+      return;
+    const stamp = (this.publication.runId ? `
+<!-- react-luau-doctor:run:${this.publication.runId}:${this.publication.attempt} -->` : "") + `
+<!-- react-luau-doctor:commit:${this.publication.head}:${this.publication.base}:${complete ? "complete" : "incomplete"} -->`;
+    const next = body + stamp;
+    if (previous?.body === next)
+      return;
+    await this.mutate(previous ? `/issues/comments/${previous.id}` : `/issues/${this.pullNumber}/comments`, previous ? "PATCH" : "POST", { body: next });
+  }
+  async threads() {
+    const [owner, name] = this.repo.split("/");
+    const result = new Map;
+    let cursor = null;
+    for (;; ) {
+      const response = await this.request("", {
+        method: "POST",
+        body: {
+          query: `query($owner: String!, $name: String!, $number: Int!, $cursor: String) {
+              repository(owner: $owner, name: $name) {
+                pullRequest(number: $number) {
+                  reviewThreads(first: 100, after: $cursor) {
+                    nodes {
+                      isResolved
+                      comments(first: 1) {
+                        nodes { databaseId }
+                      }
+                    }
+                    pageInfo {
+                      hasNextPage
+                      endCursor
+                    }
+                  }
+                }
+              }
+            }`,
+          variables: { owner, name, number: this.pullNumber, cursor }
+        }
+      }, true);
+      const connection = response.data.repository?.pullRequest?.reviewThreads;
+      if (!connection || !Array.isArray(connection.nodes)) {
+        throw new Error("GitHub review-thread state is unavailable");
+      }
+      for (const thread of connection.nodes) {
+        const root = thread.comments.nodes[0]?.databaseId;
+        if (typeof thread.isResolved !== "boolean") {
+          throw new Error("GitHub returned an invalid review-thread resolution state");
+        }
+        if (root)
+          result.set(root, { resolved: thread.isResolved });
+      }
+      if (!connection.pageInfo.hasNextPage)
+        return result;
+      if (!connection.pageInfo.endCursor || connection.pageInfo.endCursor === cursor) {
+        throw new Error("GitHub review-thread pagination did not advance");
+      }
+      cursor = connection.pageInfo.endCursor;
+    }
+  }
+}
+function commentFingerprint(comment) {
+  if (comment.user?.type !== "Bot" || !comment.body?.startsWith(REVIEW_MARKER) || comment.in_reply_to_id) {
+    return null;
+  }
+  const marker = comment.body.match(/<!-- react-luau-doctor:fingerprint:([a-f0-9]{32}) -->/i);
+  if (marker)
+    return marker[1].toLowerCase();
+  const legacy = comment.body.match(/\*\*React-Luau Doctor\*\* \u00B7 `([^`]+)` \((error|warning|suggestion)\)\n\n([^\n]+)/);
+  return legacy ? findingFingerprint({
+    file: comment.path,
+    rule: legacy[1],
+    severity: legacy[2],
+    message: legacy[3]
+  }) : null;
+}
+function recoverReviewState(review, comments) {
+  const count = Number(review.body?.match(/(?:^|\n)(?:\*\*)?React-Luau Doctor found (\d+) new issues?(?:\*\*)?(?:\n|$)/)?.[1]);
+  const roots = comments.filter((comment) => comment.pull_request_review_id === review.id && !comment.in_reply_to_id);
+  if (!count || count > MAX_REVIEW_COMMENTS || roots.length !== count)
+    return null;
+  const commit = review.commit_id ?? roots[0]?.original_commit_id ?? roots[0]?.commit_id;
+  if (!commit)
+    return null;
+  const findings = [];
+  for (const comment of roots) {
+    const diagnostic = comment.body?.match(/\*\*React-Luau Doctor\*\* \u00B7 `([^`]+)` \((error|warning|suggestion)\)\n\n([^\n]+)/);
+    const line = comment.original_line ?? comment.line;
+    if (!diagnostic || !Number.isSafeInteger(line) || line < 1)
+      return null;
+    const finding = {
+      file: comment.path,
+      rule: diagnostic[1],
+      severity: diagnostic[2],
+      message: diagnostic[3],
+      line,
+      identity: `legacy:${review.id}:${comment.id}`,
+      status: "unknown"
+    };
+    if (commentFingerprint(comment) !== findingFingerprint(finding))
+      return null;
+    findings.push(finding);
+  }
+  return { version: 1, commit, signature: "", findings };
+}
+function prioritizedFindings(candidates) {
+  const severity = { error: 0, warning: 1, suggestion: 2 };
+  const counts = new Map;
+  return [...candidates].sort((a, b) => a.finding.file.localeCompare(b.finding.file) || a.finding.line - b.finding.line || a.diagnostic.id.localeCompare(b.diagnostic.id)).map((candidate) => {
+    const key = `${candidate.finding.severity}\x00${candidate.finding.file}`;
+    const round = counts.get(key) ?? 0;
+    counts.set(key, round + 1);
+    return { candidate, round };
+  }).sort((a, b) => severity[a.candidate.diagnostic.severity] - severity[b.candidate.diagnostic.severity] || a.round - b.round || a.candidate.finding.file.localeCompare(b.candidate.finding.file)).map(({ candidate }) => candidate);
+}
+async function reviewSnapshot(client) {
+  const [reviews, comments] = await Promise.all([
+    client.list(`/pulls/${client.pullNumber}/reviews`),
+    client.list(`/pulls/${client.pullNumber}/comments`)
+  ]);
+  return { reviews, comments };
+}
+async function reconcileReviews(client, snapshot, analysis, canInline) {
+  if (!analysis.complete)
+    return snapshot.comments.filter((c) => commentFingerprint(c)).length;
+  const ownedReviews = snapshot.reviews.filter((r) => r.user?.type === "Bot" && (r.body?.startsWith(REVIEW_MARKER) || /^(?:\*\*)?React-Luau Doctor found (?:\d+ )?new issues?(?:\*\*)?$/.test(r.body ?? "") || r.body?.startsWith("\u2705 React-Luau Doctor: findings from this review are no longer current")));
+  let threads;
+  try {
+    threads = await client.threads();
+  } catch (error) {
+    process.stderr.write(`react-luau-doctor: could not read review threads; preserving discussions: ${error instanceof Error ? error.message : String(error)}
+`);
+  }
+  const states = new Map;
+  const records = [];
+  for (const review of ownedReviews) {
+    const original = readReviewState(review.body ?? "") ?? recoverReviewState(review, snapshot.comments);
+    if (!original)
+      continue;
+    const state = { ...original, findings: original.findings.map((finding) => ({ ...finding })) };
+    states.set(review.id, state);
+    for (const finding of state.findings) {
+      const identity = finding.identity ?? `${state.commit}:${findingFingerprint(finding)}:${finding.line}`;
+      finding.identity = identity;
+      records.push({
+        state,
+        finding,
+        identity,
+        file: analysis.canonicalFile(finding.file, state.commit)
+      });
+    }
+  }
+  assignFindings(records, analysis);
+  for (const state of states.values()) {
+    if (state.signature !== "")
+      continue;
+    if (state.findings.every((finding) => {
+      const file = analysis.canonicalFile(finding.file, state.commit);
+      return finding.status === "active" && file && analysis.verifiedFiles.has(file) && analysis.eligible({ ...finding, file });
+    })) {
+      state.signature = analysis.signature;
+    }
+  }
+  const represented = new Map;
+  const representedIdentities = new Set;
+  const failures = [];
+  const updates = [];
+  let inlineCount = snapshot.comments.filter((c) => commentFingerprint(c)).length;
+  for (const review of ownedReviews.sort((a, b) => a.id - b.id)) {
+    const state = states.get(review.id);
+    if (!state) {
+      const retained = snapshot.comments.filter((comment) => comment.pull_request_review_id === review.id && commentFingerprint(comment)).length;
+      const body = `${REVIEW_MARKER}
+**React-Luau Doctor \xB7 earlier findings**
+
+` + `${retained ? `${issueCount(retained)} retained inline \xB7 ` : ""}` + "Original finding history unavailable \xB7 See the current PR report";
+      updates.push({ review, body, cleanup: [] });
+      continue;
+    }
+    let discussions = threads ? 0 : undefined;
+    const ownedComments = snapshot.comments.filter((c) => c.pull_request_review_id === review.id && commentFingerprint(c));
+    const consumedComments = new Set;
+    const cleanup = [];
+    for (const finding of state.findings) {
+      const file = analysis.canonicalFile(finding.file, state.commit);
+      const fingerprint = findingFingerprint(finding);
+      const comments = ownedComments.filter((c) => !consumedComments.has(c.id) && commentFingerprint(c) === fingerprint).sort((a, b) => Math.abs((a.original_line ?? a.line ?? finding.line) - finding.line) - Math.abs((b.original_line ?? b.line ?? finding.line) - finding.line));
+      const comment = comments[0];
+      if (comment)
+        consumedComments.add(comment.id);
+      const replies = comment ? snapshot.comments.filter((c) => c.in_reply_to_id === comment.id) : [];
+      const discussion = comment && replies.length > 0;
+      if (discussion && threads) {
+        const thread = threads.get(comment.id);
+        if (!thread || typeof thread.resolved !== "boolean")
+          discussions = undefined;
+        else if (!thread.resolved && discussions !== undefined)
+          discussions++;
+      }
+      const key = findingFingerprint({ ...finding, file: file ?? finding.file });
+      if ((finding.status === "active" && comment || finding.status === "unknown") && !representedIdentities.has(finding.identity)) {
+        represented.set(key, (represented.get(key) ?? 0) + 1);
+        representedIdentities.add(finding.identity);
+      }
+      if (comment && finding.status === "fixed" && !discussion && threads?.has(comment.id)) {
+        cleanup.push(comment);
+      }
+    }
+    const body = renderReviewBody(state, discussions);
+    if (body !== review.body) {
+      state.runId = client.publication.runId;
+      state.attempt = client.publication.attempt;
+    }
+    updates.push({
+      review,
+      body: body === review.body ? body : renderReviewBody(state, discussions),
+      cleanup
+    });
+  }
+  for (const comment of snapshot.comments) {
+    if (!commentFingerprint(comment) || states.has(comment.pull_request_review_id))
+      continue;
+    const key = commentFingerprint(comment);
+    represented.set(key, (represented.get(key) ?? 0) + 1);
+  }
+  const selected = [];
+  const candidates = [];
+  const alreadyPublished = [...states.values()].filter((state) => state.commit === client.publication.head).reduce((count, state) => count + state.findings.length, 0);
+  for (const candidate of analysis.introduced) {
+    const key = findingFingerprint(candidate.finding);
+    const count = represented.get(key) ?? 0;
+    if (count) {
+      represented.set(key, count - 1);
+      continue;
+    }
+    if (!canInline(candidate.diagnostic))
+      continue;
+    candidates.push(candidate);
+  }
+  for (const candidate of prioritizedFindings(candidates)) {
+    const key = findingFingerprint(candidate.finding);
+    if (selected.length + alreadyPublished >= MAX_REVIEW_COMMENTS)
+      break;
+    const current = analysis.current.find((finding) => findingFingerprint(finding) === key && (candidate.finding.diagnosticId ? finding.diagnosticId === candidate.finding.diagnosticId : finding.line === candidate.finding.line && finding.column === candidate.finding.column));
+    candidate.finding.identity = current?.identity ?? `${client.publication.head}:${key}:${candidate.diagnostic.id}`;
+    const nextState = {
+      version: 1,
+      signature: analysis.signature,
+      commit: client.publication.head,
+      findings: [...selected, candidate].map((entry) => entry.finding)
+    };
+    if (renderReviewBody(nextState, 0).length > MAX_COMMENT_LENGTH || inlineBody(candidate.finding, candidate.diagnostic).length > MAX_COMMENT_LENGTH) {
+      continue;
+    }
+    selected.push(candidate);
+  }
+  let publicationSucceeded = true;
+  if (selected.length) {
+    const state = {
+      version: 1,
+      commit: client.publication.head,
+      signature: analysis.signature,
+      runId: client.publication.runId,
+      attempt: client.publication.attempt,
+      findings: selected.map((entry) => entry.finding)
+    };
+    const comments = selected.map(({ finding, diagnostic }) => ({
+      path: finding.file,
+      line: finding.line,
+      side: "RIGHT",
+      body: inlineBody(finding, diagnostic)
+    }));
+    try {
+      await client.mutate(`/pulls/${client.pullNumber}/reviews`, "POST", {
+        commit_id: client.publication.head,
+        event: "COMMENT",
+        body: renderReviewBody(state, 0),
+        comments
+      });
+      inlineCount += comments.length;
+    } catch (error) {
+      if (error instanceof StalePublication)
+        throw error;
+      publicationSucceeded = false;
+      failures.push(`could not create new review comments: ${String(error)}`);
+    }
+  }
+  for (const { review, body, cleanup } of updates) {
+    try {
+      if (body !== review.body) {
+        await client.mutate(`/pulls/${client.pullNumber}/reviews/${review.id}`, "PUT", { body });
+      }
+      if (!publicationSucceeded)
+        continue;
+      for (const comment of cleanup) {
+        const latest = await client.list(`/pulls/${client.pullNumber}/comments`);
+        if (latest.some((entry) => entry.in_reply_to_id === comment.id))
+          continue;
+        if (!latest.some((entry) => entry.id === comment.id))
+          continue;
+        await client.mutate(`/pulls/comments/${comment.id}`, "DELETE");
+        inlineCount--;
+      }
+    } catch (error) {
+      if (error instanceof StalePublication)
+        throw error;
+      failures.push(`could not update review ${review.id}: ${String(error)}`);
+    }
+  }
+  if (failures.length) {
+    process.stderr.write(`react-luau-doctor: could not update inline review comments: ${failures.join("; ")}
+`);
+  }
+  return inlineCount;
+}
+function inlineBody(finding, diagnostic) {
+  const details = [diagnostic.help, diagnostic.explanation, diagnostic.caveat].filter((value) => Boolean(value) && value !== finding.message);
+  const header = `${REVIEW_MARKER}
+<!-- react-luau-doctor:fingerprint:${findingFingerprint(finding)} -->`;
+  const title = `**React-Luau Doctor** \xB7 ${inlineCode(finding.rule)} (${finding.severity})`;
+  const guidance = [...new Set(details)].map((detail) => `
+
+${escapeMarkdown(detail)}`).join("");
+  return `${header}
+${title}
+
+${escapeMarkdown(finding.message)}${guidance}`;
+}
+
 // src/scope.ts
 import path10 from "path";
 
@@ -9620,7 +10381,8 @@ function previousCachedReport(session, key) {
   return {
     scannedFiles: report.scannedFiles,
     candidateFiles: report.candidateFiles,
-    diagnostics: report.diagnostics
+    diagnostics: report.diagnostics,
+    unverifiedFiles: report.unverifiedFiles
   };
 }
 function cachedReport(session, key) {
@@ -9632,7 +10394,8 @@ function cachedReport(session, key) {
   return {
     scannedFiles: report.scannedFiles,
     candidateFiles: report.candidateFiles,
-    diagnostics: report.diagnostics
+    diagnostics: report.diagnostics,
+    unverifiedFiles: report.unverifiedFiles
   };
 }
 function cacheHasSameFileSet(session) {
@@ -10493,6 +11256,7 @@ async function analyzeReactFile(input, tree, selectedRules = rules) {
       project: input.project
     };
     const context = createRuleContext(file);
+    const syntaxFindings = parsedTree.rootNode.hasError ? parseErrors.run(context) : [];
     const categorySet = input.categories && input.categories.length > 0 ? new Set(input.categories) : null;
     const isSuppressed = input.respectInlineDisables ? createInlineSuppressionChecker(input.source) : () => false;
     const diagnostics = [];
@@ -10504,7 +11268,7 @@ async function analyzeReactFile(input, tree, selectedRules = rules) {
       const severity = effectiveSeverity(rule.severity, rule.id, input.config);
       if (!severity)
         continue;
-      const findings = rule.run(context);
+      const findings = rule.id === parseErrors.id ? syntaxFindings : rule.run(context);
       for (const finding of findings) {
         const configuredSeverity = input.config.rules?.[rule.id];
         const diagnostic = toDiagnostic(file, rule.id, rule.category, severity, {
@@ -10525,7 +11289,8 @@ async function analyzeReactFile(input, tree, selectedRules = rules) {
       relativePath: input.relativePath,
       isReactFile: model.isReactFile,
       scanned: true,
-      diagnostics: filteredDiagnostics
+      diagnostics: filteredDiagnostics,
+      unverified: syntaxFindings.length > 0
     };
   } finally {
     if (!tree)
@@ -12852,7 +13617,8 @@ async function scanPath(target = ".", options = {}) {
         counts: countDiagnostics(reportHit.diagnostics),
         diagnostics: reportHit.diagnostics,
         partial: false,
-        skippedFiles: []
+        skippedFiles: [],
+        unverifiedFiles: reportHit.unverifiedFiles
       };
     }
   }
@@ -12907,6 +13673,7 @@ async function scanPath(target = ".", options = {}) {
       options.analysisSession.effectModules = cacheSession.effectModules ?? previousEffectModules;
     const diagnostics = [];
     const skippedFiles = [];
+    const unverifiedFiles = [];
     let scannedFiles = 0;
     let scanCandidates = candidates;
     let incrementalReuse = false;
@@ -12914,6 +13681,7 @@ async function scanPath(target = ".", options = {}) {
     if (canCacheWholeReport && previousReport && previousProject && cacheHasSameFileSet(cacheSession) && projectModelFeatureKey(previousProject) === projectModelFeatureKey(project)) {
       const affectedFiles = transitiveAffectedFiles(changedFiles, previousEffectModules, currentEffectModules);
       diagnostics.push(...previousReport.diagnostics.filter((diagnostic) => !affectedFiles.has(normalizeRelative4(diagnostic.file))));
+      unverifiedFiles.push(...(previousReport.unverifiedFiles ?? []).filter((file) => !affectedFiles.has(normalizeRelative4(file))));
       scanCandidates = candidates.filter((candidate) => {
         const relativePath = normalizeRelative4(candidate.relativePath ?? path9.relative(root, candidate.absolutePath));
         return affectedFiles.has(relativePath);
@@ -12928,6 +13696,8 @@ async function scanPath(target = ".", options = {}) {
       if (result.scanned)
         scannedFiles += 1;
       diagnostics.push(...result.diagnostics);
+      if (result.unverified)
+        unverifiedFiles.push(result.relativePath);
     };
     const prepareCandidate = (candidate) => {
       const relativePath = normalizeRelative4(candidate.relativePath ?? path9.relative(root, candidate.absolutePath));
@@ -13013,13 +13783,15 @@ async function scanPath(target = ".", options = {}) {
       counts: countDiagnostics(diagnostics),
       diagnostics,
       partial: skippedFiles.length > 0,
-      skippedFiles
+      skippedFiles,
+      unverifiedFiles: unverifiedFiles.length ? [...new Set(unverifiedFiles)].sort() : undefined
     };
     if (canPersistCache)
       saveProjectCache(cacheSession, project, cacheSession.effectModules ?? cachedEffectModules(cacheSession), canCacheWholeReport && !report.partial ? reportCacheKey : undefined, canCacheWholeReport && !report.partial ? {
         scannedFiles: report.scannedFiles,
         candidateFiles: report.candidateFiles ?? candidates.length,
-        diagnostics: report.diagnostics
+        diagnostics: report.diagnostics,
+        unverifiedFiles: report.unverifiedFiles
       } : undefined);
     return report;
   } finally {
@@ -13101,24 +13873,29 @@ async function scanProjectWithScope(projectRoot, options) {
   let diagnostics = current.diagnostics;
   let partial = current.partial;
   let skippedFiles = current.skippedFiles;
+  let unverifiedFiles = current.unverifiedFiles;
   if (effectiveScope === "changed") {
     const baseline = await scanPath(targetRoot, {
       ...sharedScanOptions(scanOptions, projectRoot, "baseline"),
       files: plan.baselineFiles
     });
-    options.onDelta?.(current.diagnostics, baseline.diagnostics);
+    options.onDelta?.(current.diagnostics, baseline.diagnostics, { current, baseline, plan });
     const baselineSkipped = new Set(baseline.skippedFiles ?? []);
     const baselinePaths = new Set(plan.baselineFiles.map((file) => file.relativePath ?? ""));
     const comparableCurrent = current.diagnostics.filter((diagnostic) => !baselinePaths.has(diagnostic.file) || !baselineSkipped.has(diagnostic.file));
     diagnostics = introducedDiagnostics(comparableCurrent, baseline.diagnostics);
     partial = partial || Boolean(baseline.partial);
     skippedFiles = [...new Set([...current.skippedFiles ?? [], ...baseline.skippedFiles ?? []])].sort();
+    unverifiedFiles = [
+      ...new Set([...current.unverifiedFiles ?? [], ...baseline.unverifiedFiles ?? []])
+    ].sort();
   } else if (effectiveScope === "lines") {
     diagnostics = current.diagnostics.filter((diagnostic) => touchesChangedLines(diagnostic, plan.changedLines.get(diagnostic.file) ?? []));
   }
   return rebuildReport(current, diagnostics, {
     partial,
     skippedFiles,
+    unverifiedFiles,
     scope: options.staged ? "staged" : effectiveScope,
     base: plan.base,
     changedFiles: plan.changedFiles
@@ -13136,6 +13913,7 @@ function aggregateReports(root, reports) {
   const startedDuration = reports.reduce((total, entry) => total + entry.report.durationMs, 0);
   const diagnostics = [];
   const skippedFiles = [];
+  const unverifiedFiles = [];
   const changedFiles = [];
   const notes = [];
   const projects = [];
@@ -13150,6 +13928,7 @@ function aggregateReports(root, reports) {
     partial = partial || Boolean(report.partial);
     diagnostics.push(...report.diagnostics.map((diagnostic) => prefixDiagnostic(diagnostic, prefix)));
     skippedFiles.push(...(report.skippedFiles ?? []).map((file) => prefix ? normalize3(path10.posix.join(prefix, file)) : file));
+    unverifiedFiles.push(...(report.unverifiedFiles ?? []).map((file) => prefix ? normalize3(path10.posix.join(prefix, file)) : file));
     changedFiles.push(...(report.changedFiles ?? []).map((file) => prefix ? normalize3(path10.posix.join(prefix, file)) : file));
     notes.push(...report.notes ?? []);
   }
@@ -13170,6 +13949,7 @@ function aggregateReports(root, reports) {
     diagnostics,
     partial,
     skippedFiles: [...new Set(skippedFiles)].sort(),
+    unverifiedFiles: unverifiedFiles.length ? [...new Set(unverifiedFiles)].sort() : undefined,
     scope: scopes.size === 1 ? [...scopes][0] : undefined,
     base: bases.size === 1 ? [...bases][0] : undefined,
     changedFiles: [...new Set(changedFiles)].sort(),
@@ -13178,7 +13958,7 @@ function aggregateReports(root, reports) {
   };
 }
 
-// src/ci.ts
+// src/ci/index.ts
 var DEFAULT_SETTINGS = {
   provider: "github",
   blocking: "none",
@@ -13191,11 +13971,6 @@ var DEFAULT_SETTINGS = {
 };
 var GITHUB_WORKFLOW = path11.join(".github", "workflows", "react-luau-doctor.yml");
 var GITLAB_WORKFLOW = ".gitlab-ci.yml";
-var SUMMARY_MARKER = "<!-- react-luau-doctor:summary -->";
-var REVIEW_MARKER = "<!-- react-luau-doctor:review -->";
-var MAX_REVIEW_COMMENTS = 20;
-var MAX_GITHUB_RETRIES = 2;
-var MAX_RATE_LIMIT_WAIT_MS = 60000;
 var PACKAGE_SPEC = `${package_default.name}@${package_default.version}`;
 function yamlString(value) {
   return JSON.stringify(value);
@@ -13224,6 +13999,8 @@ jobs:
       - uses: actions/checkout@v5
         with:
           fetch-depth: 0
+          ref: \${{ github.event.pull_request.head.sha || github.sha }}
+          persist-credentials: false
       - uses: oven-sh/setup-bun@v2
         with:
           bun-version: "1.4.0"
@@ -13243,6 +14020,12 @@ jobs:
           ${settings.comment ? "--comment" : "--no-comment"}
           ${settings.reviewComments ? "--review-comments" : "--no-review-comments"}
           ${settings.commitStatus ? "--commit-status" : "--no-commit-status"}
+      - name: Upload full Doctor report
+        if: always() && steps.doctor.outputs.report-path != ''
+        uses: actions/upload-artifact@v4
+        with:
+          name: react-luau-doctor-report
+          path: \${{ steps.doctor.outputs.report-path }}
 `;
 }
 function renderGitLabWorkflow(settings) {
@@ -13257,6 +14040,8 @@ react-luau-doctor:
     DOCTOR_DIRECTORY: ${yamlString(settings.directory)}
     DOCTOR_SCOPE: ${yamlString(settings.scope)}
     DOCTOR_BLOCKING: ${yamlString(settings.blocking)}
+  before_script:
+    - apt-get update -qq && apt-get install -y --no-install-recommends git
   script:
     - 'bunx --bun ${PACKAGE_SPEC} "$DOCTOR_DIRECTORY" --scope "$DOCTOR_SCOPE" --blocking "$DOCTOR_BLOCKING" --no-color'
 `;
@@ -13269,8 +14054,9 @@ function parseBoolean(value, name) {
   throw new Error(`${name} must be true or false`);
 }
 function parseBlocking(value) {
-  if (value !== "error" && value !== "warning" && value !== "none")
+  if (value !== "error" && value !== "warning" && value !== "none") {
     throw new Error("--blocking must be error, warning, or none");
+  }
   return value;
 }
 function parseScope(value) {
@@ -13280,8 +14066,9 @@ function parseScope(value) {
   return value;
 }
 function parseProvider(value) {
-  if (value !== "github" && value !== "gitlab")
+  if (value !== "github" && value !== "gitlab") {
     throw new Error("--provider must be github or gitlab");
+  }
   return value;
 }
 function nextValue(argv, index, flag) {
@@ -13338,7 +14125,9 @@ function parseManagedWorkflowSettings(filename) {
     return {};
   const text = fs9.readFileSync(filename, "utf8");
   const match = (name) => text.match(new RegExp(`^\\s*${name}:\\s*(.+?)\\s*$`, "m"))?.[1]?.replace(/^['"]|['"]$/g, "");
-  const result = { provider: filename.endsWith(".gitlab-ci.yml") ? "gitlab" : "github" };
+  const result = {
+    provider: filename.endsWith(".gitlab-ci.yml") ? "gitlab" : "github"
+  };
   const blocking = match("DOCTOR_BLOCKING") ?? match("blocking");
   const scope = match("DOCTOR_SCOPE") ?? match("scope");
   const project = match("DOCTOR_PROJECT") ?? match("project");
@@ -13429,15 +14218,23 @@ function runCommand(cwd, command, args, allowFailure = false) {
 }
 function openPullRequest(cwd, files, action) {
   findGitRoot(cwd);
-  if (!runCommand(cwd, "gh", ["--version"], true))
+  if (!runCommand(cwd, "gh", ["--version"], true)) {
     throw new Error("--pr requires the GitHub CLI (gh) to be installed and authenticated");
+  }
   const branch = action === "install" ? "chore/add-react-luau-doctor-ci" : "chore/upgrade-react-luau-doctor-ci";
   const title = action === "install" ? "Add React-Luau Doctor CI" : "Upgrade React-Luau Doctor CI";
   runCommand(cwd, "git", ["switch", "-c", branch]);
   runCommand(cwd, "git", ["add", "--", ...files.map((file) => path11.relative(cwd, file))]);
   runCommand(cwd, "git", ["commit", "-m", title]);
   runCommand(cwd, "git", ["push", "-u", "origin", branch]);
-  const url = runCommand(cwd, "gh", ["pr", "create", "--title", title, "--body", "Adds React-Luau Doctor pull request analysis."]);
+  const url = runCommand(cwd, "gh", [
+    "pr",
+    "create",
+    "--title",
+    title,
+    "--body",
+    "Adds React-Luau Doctor pull request analysis."
+  ]);
   process.stdout.write(`${url}
 `);
 }
@@ -13453,80 +14250,296 @@ async function runCiManage(action, argv) {
       return;
   }
   const files = writeManagedCi(options.cwd, settings);
-  for (const filename of files)
+  for (const filename of files) {
     process.stdout.write(`${action === "install" ? "Installed" : action === "config" ? "Updated" : "Upgraded"} ${path11.relative(options.cwd, filename)}
 `);
+  }
   if (options.pr)
     openPullRequest(options.cwd, files, action === "install" ? "install" : "upgrade");
 }
-function diagnosticFingerprint2(diagnostic) {
-  return `${diagnostic.file}\x00${diagnostic.rule}\x00${diagnostic.severity}\x00${diagnostic.message}`;
-}
-function countDifference(left, right) {
-  const counts = new Map;
-  for (const diagnostic of right) {
-    const key = diagnosticFingerprint2(diagnostic);
-    counts.set(key, (counts.get(key) ?? 0) + 1);
-  }
-  let difference = 0;
-  for (const diagnostic of left) {
-    const key = diagnosticFingerprint2(diagnostic);
-    const remaining = counts.get(key) ?? 0;
-    if (remaining > 0)
-      counts.set(key, remaining - 1);
-    else
-      difference += 1;
-  }
-  return difference;
-}
-async function fixedIssueCount(directory, base) {
-  const plan = createGitScopePlan(directory, { scope: "changed", base });
-  if (plan.currentFiles.length === 0 && plan.baselineFiles.length === 0)
-    return 0;
-  const config = loadConfigWithSource(directory).config;
-  const selected = (file) => isSelectedLuauPath(file.relativePath ?? "", config);
-  const current = await scanPath(directory, { files: plan.currentFiles.filter(selected), config, categories: config.categories });
-  const baseline = await scanPath(directory, { files: plan.baselineFiles.filter(selected), config, categories: config.categories });
-  return countDifference(baseline.diagnostics, current.diagnostics);
-}
 function resolveCiProjectRoots(directory, project) {
   if (!project || project === "*")
     return [directory];
   return project.split(",").map((entry) => {
     const resolved = path11.resolve(directory, entry.trim());
-    if (!fs9.existsSync(resolved) || !fs9.statSync(resolved).isDirectory())
+    if (!fs9.existsSync(resolved) || !fs9.statSync(resolved).isDirectory()) {
       throw new Error(`Could not find project: ${entry}`);
+    }
     return resolved;
   });
 }
-async function scanForCi(settings, eventName, base, onFixed) {
-  const directory = path11.resolve(process.cwd(), settings.directory);
-  const isPullRequest = eventName === "pull_request";
-  const scope = isPullRequest ? settings.scope : "full";
+function gitResult(directory, args) {
+  const result = spawnSync2(gitExecutable, args, {
+    cwd: directory,
+    encoding: "utf8",
+    windowsHide: true,
+    maxBuffer: 64 * 1024 * 1024
+  });
+  return result.status === 0 ? result.stdout : null;
+}
+function renameResolver(directory, head) {
+  const cache = new Map;
+  return (file, commit) => {
+    if (!commit)
+      return file;
+    if (!cache.has(commit)) {
+      const diff = gitResult(directory, [
+        "diff",
+        "--name-status",
+        "-z",
+        "--find-renames",
+        commit,
+        head
+      ]);
+      const renames = new Map;
+      if (diff !== null) {
+        const fields = diff.split("\x00");
+        for (let i = 0;i < fields.length && fields[i]; ) {
+          const status = fields[i++];
+          const oldPath = fields[i++];
+          if (/^[RC]/.test(status)) {
+            const newPath = fields[i++];
+            if (status.startsWith("R"))
+              renames.set(oldPath, newPath);
+          }
+        }
+      }
+      cache.set(commit, diff === null ? null : renames);
+    }
+    const renames = cache.get(commit);
+    return renames ? renames.get(file) ?? file : null;
+  };
+}
+async function scanForCi(settings, isPullRequest, base, head, snapshot) {
+  const directory = path11.resolve(settings.directory);
+  const repoRoot = isPullRequest ? findGitRoot(directory) : directory;
   const roots = resolveCiProjectRoots(directory, settings.project);
+  const canonicalFile = renameResolver(repoRoot, head);
+  const historicalFiles = new Set;
+  for (const review of snapshot?.reviews ?? []) {
+    const state = readReviewState(review.body ?? "");
+    if (!state)
+      continue;
+    for (const finding of state.findings) {
+      const file = canonicalFile(finding.file, state.commit);
+      if (file)
+        historicalFiles.add(file);
+    }
+  }
+  for (const comment of snapshot?.comments ?? []) {
+    if (comment.user?.type === "Bot" && comment.body?.startsWith("<!-- react-luau-doctor:review -->")) {
+      const file = canonicalFile(comment.path, comment.commit_id ?? "");
+      if (file)
+        historicalFiles.add(file);
+    }
+  }
   const reports = [];
-  for (const projectRoot of roots) {
-    const config = loadConfigWithSource(projectRoot).config;
-    const report = await scanProjectWithScope(projectRoot, {
-      scope,
+  const comparisons = [];
+  const currentDiagnostics = [];
+  const fixed = [];
+  const verifiedFiles = new Set;
+  const deletedFiles = new Set;
+  const uncertainFiles = new Set;
+  const unverifiedFiles = new Set;
+  const verificationSkippedFiles = new Set;
+  const configs = roots.map((root) => ({ root, config: loadConfigWithSource(root).config }));
+  const signature = createHash2("sha256").update(JSON.stringify({
+    version: package_default.version,
+    configs: configs.map(({ root, config }) => ({
+      root: path11.relative(directory, root),
+      config
+    }))
+  })).digest("hex");
+  let complete = true;
+  let potentiallyRelocated = false;
+  const normalize = (file) => file.split(path11.sep).join("/");
+  const relativeFile = (file, root) => normalize(path11.relative(directory, path11.resolve(root, file)));
+  const rebaseDiagnostic = (diagnostic, root) => ({
+    ...diagnostic,
+    file: relativeFile(diagnostic.file, root)
+  });
+  for (const { root: projectRoot, config } of configs) {
+    const sources = new Map;
+    const eligibleFiles = new Set;
+    const scope = isPullRequest ? settings.scope : "full";
+    const comparisonOptions = {
+      scope: "changed",
       base,
+      config,
       minSeverity: "suggestion",
       categories: config.categories,
       respectInlineDisables: config.respectInlineDisables ?? true,
-      onDelta: onFixed ? (current, baseline) => onFixed(countDifference(baseline, current)) : undefined
-    });
+      onDelta: (current, baseline, context) => {
+        complete &&= !context.current.partial && !context.baseline.partial && !context.current.unverifiedFiles?.length && !context.baseline.unverifiedFiles?.length;
+        for (const file of [
+          ...context.current.unverifiedFiles ?? [],
+          ...context.baseline.unverifiedFiles ?? []
+        ]) {
+          unverifiedFiles.add(relativeFile(file, projectRoot));
+        }
+        const skipped = new Set([
+          ...context.current.skippedFiles ?? [],
+          ...context.baseline.skippedFiles ?? []
+        ]);
+        const currentFiles = new Set(context.plan.currentFiles.map((file) => file.relativePath));
+        for (const file of context.plan.changedFiles) {
+          const repoFile = repoRelativeDiagnosticPath(projectRoot, file, repoRoot);
+          eligibleFiles.add(repoFile);
+          if (!currentFiles.has(file))
+            deletedFiles.add(repoFile);
+          if (!skipped.has(file))
+            verifiedFiles.add(repoFile);
+        }
+        for (const input of context.plan.currentFiles) {
+          if (input.relativePath && input.source !== undefined) {
+            sources.set(repoRelativeDiagnosticPath(projectRoot, input.relativePath, repoRoot), input.source);
+          }
+        }
+        for (const diagnostic of current) {
+          currentDiagnostics.push(rebaseDiagnostic(diagnostic, projectRoot));
+        }
+        if (complete) {
+          const baselineSources = new Map(context.plan.baselineFiles.map((file) => [
+            file.relativePath,
+            file.source?.split(/\r?\n/) ?? []
+          ]));
+          const currentSources = new Map(context.plan.currentFiles.map((file) => [
+            file.relativePath,
+            file.source?.split(/\r?\n/) ?? []
+          ]));
+          for (const diagnostic of diagnosticDifference(baseline, current, {
+            left: (entry) => baselineSources.get(entry.file)?.[entry.location.line - 1]?.trim() ?? "",
+            right: (entry) => currentSources.get(entry.file)?.[entry.location.line - 1]?.trim() ?? ""
+          })) {
+            if (!currentFiles.has(diagnostic.file) && current.some((entry) => entry.file !== diagnostic.file && entry.rule === diagnostic.rule && entry.severity === diagnostic.severity && entry.message === diagnostic.message)) {
+              potentiallyRelocated = true;
+              continue;
+            }
+            const oldFile = context.plan.baselinePaths.get(diagnostic.file) ?? diagnostic.file;
+            const oldSource = context.plan.baselineFiles.find((file) => file.relativePath === diagnostic.file)?.source ?? "";
+            const newSource = sources.get(repoRelativeDiagnosticPath(projectRoot, diagnostic.file, repoRoot)) ?? "";
+            const directives = (source) => source.split(/\r?\n/).filter((line) => /react-luau-doctor.*(?:disable|ignore)/i.test(line)).join(`
+`);
+            if (directives(oldSource) !== directives(newSource))
+              continue;
+            fixed.push({
+              ...rebaseDiagnostic({ ...diagnostic, file: oldFile }, projectRoot),
+              ...diagnostic.baselineLocationUncertain ? { baselineLocationUncertain: true } : {}
+            });
+          }
+        }
+      }
+    };
+    const report = await scanProjectWithScope(projectRoot, { ...comparisonOptions, scope });
     reports.push({ projectRoot, report });
+    for (const file of report.unverifiedFiles ?? []) {
+      unverifiedFiles.add(relativeFile(file, projectRoot));
+    }
+    complete &&= !report.partial && !report.unverifiedFiles?.length;
+    if (isPullRequest && base) {
+      const comparison = scope === "changed" ? report : await scanProjectWithScope(projectRoot, comparisonOptions);
+      comparisons.push({ projectRoot, report: comparison });
+      const extraFiles = [];
+      for (const file of historicalFiles) {
+        const absolutePath = path11.resolve(repoRoot, file);
+        const relativePath = normalize(path11.relative(projectRoot, absolutePath));
+        if (relativePath.startsWith("../") || path11.isAbsolute(relativePath) || !isSelectedLuauPath(relativePath, config) || eligibleFiles.has(file)) {
+          continue;
+        }
+        eligibleFiles.add(file);
+        if (!fs9.existsSync(absolutePath)) {
+          const existsAtHead = gitResult(repoRoot, ["ls-tree", "-z", head, "--", file]);
+          if (existsAtHead === "") {
+            verifiedFiles.add(file);
+            deletedFiles.add(file);
+          }
+          continue;
+        }
+        const source = fs9.readFileSync(absolutePath, "utf8");
+        sources.set(file, source);
+        extraFiles.push({ absolutePath, relativePath, source });
+      }
+      if (extraFiles.length) {
+        const extra = await scanPath(projectRoot, {
+          files: extraFiles,
+          projectRoot,
+          config,
+          categories: config.categories
+        });
+        complete &&= !extra.partial && !extra.unverifiedFiles?.length;
+        for (const file of extra.unverifiedFiles ?? []) {
+          unverifiedFiles.add(relativeFile(file, projectRoot));
+        }
+        for (const file of extra.skippedFiles ?? []) {
+          verificationSkippedFiles.add(relativeFile(file, projectRoot));
+        }
+        for (const file of extraFiles) {
+          if (!extra.skippedFiles?.includes(file.relativePath)) {
+            verifiedFiles.add(repoRelativeDiagnosticPath(projectRoot, file.relativePath, repoRoot));
+          }
+        }
+        currentDiagnostics.push(...extra.diagnostics.map((diagnostic) => rebaseDiagnostic(diagnostic, projectRoot)));
+      }
+    }
+    for (const [file, source] of sources) {
+      if (/react-luau-doctor.*(?:disable|ignore)/i.test(source))
+        uncertainFiles.add(file);
+    }
   }
-  return roots.length === 1 && roots[0] === directory ? reports[0].report : aggregateReports(directory, reports);
-}
-async function findNewReviewDiagnostics(settings, eventName, event, currentReport) {
-  if (event.action === "synchronize" && event.before) {
-    const report = await scanForCi({ ...settings, scope: "changed" }, eventName, event.before);
-    return { diagnostics: report.diagnostics, base: event.before };
-  }
-  if (event.action && event.action !== "opened")
-    return { diagnostics: [] };
-  return { diagnostics: currentReport.diagnostics };
+  const report = roots.length === 1 && roots[0] === directory ? reports[0].report : aggregateReports(directory, reports);
+  const comparison = comparisons.length ? aggregateReports(directory, comparisons) : report;
+  const sourceCache = new Map;
+  const toFinding = (diagnostic) => {
+    const file = repoRelativeDiagnosticPath(directory, diagnostic.file, repoRoot);
+    const absolute = path11.resolve(repoRoot, file);
+    if (!sourceCache.has(file)) {
+      sourceCache.set(file, fs9.existsSync(absolute) ? fs9.readFileSync(absolute, "utf8").split(/\r?\n/) : []);
+    }
+    return {
+      file,
+      rule: diagnostic.rule,
+      severity: diagnostic.severity,
+      message: diagnostic.message,
+      line: diagnostic.location.line,
+      column: diagnostic.location.column,
+      diagnosticId: diagnostic.id,
+      anchor: createHash2("sha256").update(sourceCache.get(file)?.[diagnostic.location.line - 1]?.trim() ?? "").digest("hex").slice(0, 16),
+      status: "active"
+    };
+  };
+  return {
+    repoRoot,
+    report: {
+      ...report,
+      partial: Boolean(report.partial) || !complete,
+      unverifiedFiles: unverifiedFiles.size ? [...unverifiedFiles].sort() : undefined,
+      skippedFiles: [
+        ...new Set([...report.skippedFiles ?? [], ...verificationSkippedFiles])
+      ].sort(),
+      notes: potentiallyRelocated ? [
+        ...report.notes ?? [],
+        "Some removed findings may have moved to other files and were not counted as fixed"
+      ] : report.notes
+    },
+    comparison,
+    fixed: complete ? fixed : [],
+    analysis: {
+      signature,
+      complete,
+      current: currentDiagnostics.map(toFinding),
+      introduced: comparison.diagnostics.map((diagnostic) => ({
+        diagnostic,
+        finding: toFinding(diagnostic)
+      })),
+      verifiedFiles,
+      deletedFiles,
+      canonicalFile,
+      eligible: (finding) => !uncertainFiles.has(finding.file) && configs.some(({ root, config }) => {
+        const relative = normalize(path11.relative(root, path11.resolve(repoRoot, finding.file)));
+        return !relative.startsWith("../") && !path11.isAbsolute(relative) && isSelectedLuauPath(relative, config) && config.rules?.[finding.rule] !== "off";
+      })
+    }
+  };
 }
 function shouldBlock(report, level) {
   if (level === "none")
@@ -13560,329 +14573,32 @@ function githubRunUrl() {
   const runId = process.env.GITHUB_RUN_ID;
   return server && repository && runId ? `${server}/${repository}/actions/runs/${runId}` : null;
 }
-function wait(milliseconds) {
-  return new Promise((resolve) => setTimeout(resolve, milliseconds));
-}
 function errorMessage(error) {
   return error instanceof Error ? error.message : String(error);
 }
-function githubRetryDelay(response, responseText, attempt) {
-  const remaining = response.headers.get("x-ratelimit-remaining");
-  const rateLimited = response.status === 429 || response.status === 403 && (remaining === "0" || /rate limit|rate_limit|abuse detection/i.test(responseText)) || response.status === 200 && /"errors"\s*:/.test(responseText) && /rate limit|rate_limit/i.test(responseText);
-  if (!rateLimited)
-    return null;
-  const retryAfter = response.headers.get("retry-after");
-  if (retryAfter) {
-    const seconds = Number(retryAfter);
-    if (Number.isFinite(seconds) && seconds >= 0)
-      return seconds * 1000;
-    const date = Date.parse(retryAfter);
-    if (Number.isFinite(date))
-      return Math.max(0, date - Date.now());
-  }
-  if (remaining === "0") {
-    const reset = Number(response.headers.get("x-ratelimit-reset"));
-    if (Number.isFinite(reset))
-      return Math.max(0, reset * 1000 - Date.now() + 1000);
-  }
-  return 60000 * 2 ** attempt;
-}
-async function githubRequest(url, options = {}) {
-  const token = process.env.GITHUB_TOKEN;
-  if (!token)
-    throw new Error("GITHUB_TOKEN is unavailable");
-  for (let attempt = 0;; attempt += 1) {
-    const response = await fetch(url, {
-      method: options.method ?? "GET",
-      headers: {
-        Accept: "application/vnd.github+json",
-        Authorization: `Bearer ${token}`,
-        "X-GitHub-Api-Version": "2022-11-28",
-        "User-Agent": "react-luau-doctor",
-        "Content-Type": "application/json"
-      },
-      body: options.body === undefined ? undefined : JSON.stringify(options.body)
-    });
-    const responseText = response.status === 204 ? "" : await response.text();
-    const delay = githubRetryDelay(response, responseText, attempt);
-    if (response.ok && delay === null)
-      return responseText ? JSON.parse(responseText) : undefined;
-    if (delay === null || attempt >= MAX_GITHUB_RETRIES || delay > MAX_RATE_LIMIT_WAIT_MS) {
-      const retryDetail = delay !== null && delay > MAX_RATE_LIMIT_WAIT_MS ? ` Retry after ${Math.ceil(delay / 1000)} seconds.` : "";
-      throw new Error(`GitHub API ${response.status}: ${responseText}${retryDetail}`);
-    }
-    process.stderr.write(`react-luau-doctor: GitHub API ${response.status}; retrying in ${Math.ceil(delay / 1000)} seconds
-`);
-    await wait(delay);
-  }
-}
-async function githubApi(repo, endpoint, options = {}) {
-  const apiBase = (process.env.GITHUB_API_URL ?? "https://api.github.com").replace(/\/$/, "");
-  return githubRequest(`${apiBase}/repos/${repo}${endpoint}`, options);
-}
-function repoRelativeDiagnosticPath(directory, diagnosticFile) {
+function repoRelativeDiagnosticPath(directory, diagnosticFile, repoRoot) {
   const absoluteDirectory = path11.resolve(directory);
-  const repoRoot = findGitRoot(absoluteDirectory);
   const prefix = path11.relative(repoRoot, absoluteDirectory).split(path11.sep).join("/");
   return prefix && prefix !== "." ? path11.posix.join(prefix, diagnosticFile) : diagnosticFile;
 }
-function githubFileUrl(repo, sha, diagnostic, directory) {
+function githubFileUrl(repo, sha, diagnostic, directory, repoRoot) {
   const server = process.env.GITHUB_SERVER_URL ?? "https://github.com";
-  const repoPath = repoRelativeDiagnosticPath(directory, diagnostic.file);
-  const encoded = repoPath.split("/").map(encodeURIComponent).join("/");
-  return `${server}/${repo}/blob/${sha}/${encoded}#L${diagnostic.location.line}`;
-}
-function renderSummaryComment(report, repo, sha, fixed, skipped, directory) {
-  if (skipped) {
-    return `${SUMMARY_MARKER}
-## React-Luau Doctor
-
-No eligible React-Luau files changed in this pull request, so the scan was skipped.
-`;
-  }
-  const lines = [
-    SUMMARY_MARKER,
-    "## React-Luau Doctor",
-    "",
-    `**${report.counts.error} errors \xB7 ${report.counts.warning} warnings \xB7 ${report.counts.suggestion} suggestions \xB7 Score ${report.score}/100**`,
-    "",
-    `${report.diagnostics.length} ${report.scope === "changed" ? "introduced finding" : "reported finding"}${report.diagnostics.length === 1 ? "" : "s"} \xB7 ${fixed} fixed`
-  ];
-  const errors = report.diagnostics.filter((diagnostic) => diagnostic.severity === "error").slice(0, 20);
-  if (errors.length > 0) {
-    lines.push("", "### Errors");
-    for (const diagnostic of errors) {
-      lines.push(`- [\`${diagnostic.file}:${diagnostic.location.line}\`](${githubFileUrl(repo, sha, diagnostic, directory)}) **${diagnostic.rule}**: ${diagnostic.message}`);
-    }
-  }
-  const warningsByFile = new Map;
-  for (const diagnostic of report.diagnostics.filter((entry) => entry.severity === "warning").slice(0, 50)) {
-    const entries = warningsByFile.get(diagnostic.file) ?? [];
-    entries.push(diagnostic);
-    warningsByFile.set(diagnostic.file, entries);
-  }
-  if (warningsByFile.size > 0) {
-    lines.push("", "### Warnings");
-    for (const [file, diagnostics] of warningsByFile) {
-      lines.push(`- **${file}**`);
-      for (const diagnostic of diagnostics)
-        lines.push(`  - [line ${diagnostic.location.line}](${githubFileUrl(repo, sha, diagnostic, directory)}): ${diagnostic.message}`);
-    }
-  }
-  if (report.diagnostics.length > errors.length + [...warningsByFile.values()].reduce((sum, entries) => sum + entries.length, 0)) {
-    lines.push("", "Additional findings are available in the workflow logs.");
-  }
-  const runUrl = githubRunUrl();
-  if (runUrl)
-    lines.push("", `[View full workflow run](${runUrl})`);
-  lines.push("", `<sub>Reviewed commit \`${sha.slice(0, 7)}\`</sub>`);
-  return `${lines.join(`
-`)}
-`;
-}
-async function listComments(repo, endpoint) {
-  const comments = [];
-  for (let page = 1;; page += 1) {
-    const batch = await githubApi(repo, `${endpoint}?per_page=100&page=${page}`);
-    comments.push(...batch);
-    if (batch.length < 100)
-      return comments;
-  }
-}
-function isDoctorComment(comment, marker) {
-  return comment.user?.type === "Bot" && comment.body?.startsWith(marker) === true;
-}
-async function updateStickyComment(repo, pullNumber, body, createIfMissing = true) {
-  const comments = await listComments(repo, `/issues/${pullNumber}/comments`);
-  const previous = comments.find((comment) => isDoctorComment(comment, SUMMARY_MARKER));
-  if (previous)
-    await githubApi(repo, `/issues/comments/${previous.id}`, { method: "PATCH", body: { body } });
-  else if (createIfMissing)
-    await githubApi(repo, `/issues/${pullNumber}/comments`, { method: "POST", body: { body } });
-}
-function changedLineMap(directory, base) {
-  return createGitScopePlan(directory, { scope: "lines", base }).changedLines;
-}
-function touchesChangedLine(diagnostic, ranges) {
-  return ranges.some((range) => diagnostic.location.line >= range.start && diagnostic.location.line <= range.end);
-}
-function reviewFingerprint(pathname, rule, severity, message) {
-  return createHash("sha256").update(`${pathname}\x00${rule}\x00${severity}\x00${message}`).digest("hex").slice(0, 32);
-}
-function diagnosticReviewFingerprint(directory, diagnostic) {
-  return reviewFingerprint(repoRelativeDiagnosticPath(directory, diagnostic.file), diagnostic.rule, diagnostic.severity, diagnostic.message);
-}
-function fingerprintFromReviewBody(body, pathname) {
-  const marker = body.match(/<!-- react-luau-doctor:fingerprint:([a-f0-9]{32}) -->/i);
-  if (marker)
-    return marker[1].toLowerCase();
-  const legacy = body.match(/\*\*React-Luau Doctor\*\* \u00B7 `([^`]+)` \((error|warning|suggestion)\)\n\n([^\n]+)/);
-  return legacy ? reviewFingerprint(pathname, legacy[1], legacy[2], legacy[3]) : null;
-}
-function reviewCommentBody(directory, diagnostic) {
-  const fingerprint = diagnosticReviewFingerprint(directory, diagnostic);
-  return `${REVIEW_MARKER}
-<!-- react-luau-doctor:fingerprint:${fingerprint} -->
-**React-Luau Doctor** \xB7 \`${diagnostic.rule}\` (${diagnostic.severity})
-
-${diagnostic.message}${diagnostic.help ? `
-
-${diagnostic.help}` : ""}`;
-}
-var ARCHIVED_REVIEW_BODY = "\u2705 React-Luau Doctor: findings from this review are no longer current. Active findings, if any, are shown in newer reviews.";
-async function listReviewComments(repo, pullNumber) {
-  const comments = [];
-  for (let page = 1;; page += 1) {
-    const batch = await githubApi(repo, `/pulls/${pullNumber}/comments?per_page=100&page=${page}`);
-    comments.push(...batch);
-    if (batch.length < 100)
-      return comments;
-  }
-}
-async function listReviews(repo, pullNumber) {
-  const reviews = [];
-  for (let page = 1;; page += 1) {
-    const batch = await githubApi(repo, `/pulls/${pullNumber}/reviews?per_page=100&page=${page}`);
-    reviews.push(...batch);
-    if (batch.length < 100)
-      return reviews;
-  }
-}
-function isDoctorReview(review) {
-  return review.user?.type === "Bot" && (review.body?.includes("React-Luau Doctor") ?? false);
-}
-function doctorReviewCommentFingerprint(comment) {
-  if (comment.user?.type !== "Bot" || !comment.body.startsWith(REVIEW_MARKER))
-    return null;
-  return fingerprintFromReviewBody(comment.body, comment.path);
-}
-function takeCount(counts, key) {
-  const count = counts.get(key) ?? 0;
-  if (count === 0)
-    return false;
-  counts.set(key, count - 1);
-  return true;
-}
-function incrementCount(counts, key) {
-  counts.set(key, (counts.get(key) ?? 0) + 1);
-}
-async function manageReviewComments(repo, pullNumber, currentReport, newDiagnostics, directory, newBase, pullBase) {
-  const [allReviewComments, reviews] = await Promise.all([
-    listReviewComments(repo, pullNumber),
-    listReviews(repo, pullNumber)
-  ]);
-  const reviewComments = allReviewComments.map((comment) => ({ comment, fingerprint: doctorReviewCommentFingerprint(comment) })).filter((entry) => entry.fingerprint !== null);
-  const activeCounts = new Map;
-  for (const diagnostic of currentReport.diagnostics)
-    incrementCount(activeCounts, diagnosticReviewFingerprint(directory, diagnostic));
-  const newCounts = new Map;
-  for (const diagnostic of newDiagnostics)
-    incrementCount(newCounts, diagnosticReviewFingerprint(directory, diagnostic));
-  const replacementCounts = new Map;
-  const staleComments = [];
-  const orderedComments = reviewComments.slice().sort((left, right) => Number(left.comment.position === null) - Number(right.comment.position === null));
-  for (const { comment, fingerprint } of orderedComments) {
-    if (comment.position !== null && takeCount(activeCounts, fingerprint)) {
-      takeCount(newCounts, fingerprint);
-      continue;
-    }
-    const needsReplacement = takeCount(activeCounts, fingerprint);
-    if (needsReplacement) {
-      incrementCount(replacementCounts, fingerprint);
-      takeCount(newCounts, fingerprint);
-    }
-    staleComments.push({ comment, fingerprint, needsReplacement });
-  }
-  const newLineMap = newCounts.size > 0 || newBase === pullBase && replacementCounts.size > 0 ? changedLineMap(directory, newBase) : new Map;
-  const pullLineMap = newBase === pullBase ? newLineMap : replacementCounts.size > 0 ? changedLineMap(directory, pullBase) : new Map;
-  const candidates = [];
-  for (const diagnostic of newDiagnostics) {
-    if (!touchesChangedLine(diagnostic, newLineMap.get(diagnostic.file) ?? []))
-      continue;
-    const fingerprint = diagnosticReviewFingerprint(directory, diagnostic);
-    if (!takeCount(newCounts, fingerprint))
-      continue;
-    candidates.push({ diagnostic, replacement: false });
-  }
-  for (const diagnostic of currentReport.diagnostics) {
-    if (!touchesChangedLine(diagnostic, pullLineMap.get(diagnostic.file) ?? []))
-      continue;
-    const fingerprint = diagnosticReviewFingerprint(directory, diagnostic);
-    if (!takeCount(replacementCounts, fingerprint))
-      continue;
-    candidates.push({ diagnostic, replacement: true });
-  }
-  const selected = candidates.slice(0, MAX_REVIEW_COMMENTS);
-  const comments = selected.map(({ diagnostic }) => ({
-    path: repoRelativeDiagnosticPath(directory, diagnostic.file),
-    line: diagnostic.location.line,
-    side: "RIGHT",
-    body: reviewCommentBody(directory, diagnostic)
-  }));
-  const failures = [];
-  let postedNewComments = true;
-  if (comments.length > 0) {
-    try {
-      await githubApi(repo, `/pulls/${pullNumber}/reviews`, {
-        method: "POST",
-        body: { event: "COMMENT", body: "React-Luau Doctor found new issues", comments }
-      });
-    } catch (error) {
-      postedNewComments = false;
-      failures.push(`could not create new review comments: ${errorMessage(error)}`);
-    }
-  }
-  if (postedNewComments) {
-    const postedReplacementCounts = new Map;
-    for (const candidate of selected) {
-      if (candidate.replacement)
-        incrementCount(postedReplacementCounts, diagnosticReviewFingerprint(directory, candidate.diagnostic));
-    }
-    const remainingByReview = new Map;
-    for (const { comment } of reviewComments) {
-      remainingByReview.set(comment.pull_request_review_id, (remainingByReview.get(comment.pull_request_review_id) ?? 0) + 1);
-    }
-    for (const stale of staleComments) {
-      if (stale.needsReplacement && !takeCount(postedReplacementCounts, stale.fingerprint))
-        continue;
-      try {
-        await githubApi(repo, `/pulls/comments/${stale.comment.id}`, { method: "DELETE" });
-        const reviewId = stale.comment.pull_request_review_id;
-        const remaining = Math.max(0, (remainingByReview.get(reviewId) ?? 1) - 1);
-        remainingByReview.set(reviewId, remaining);
-      } catch (error) {
-        failures.push(`could not delete stale review comment ${stale.comment.id}: ${errorMessage(error)}`);
-      }
-    }
-    for (const review of reviews) {
-      if (!isDoctorReview(review) || review.body === ARCHIVED_REVIEW_BODY)
-        continue;
-      if ((remainingByReview.get(review.id) ?? 0) > 0)
-        continue;
-      try {
-        await githubApi(repo, `/pulls/${pullNumber}/reviews/${review.id}`, {
-          method: "PUT",
-          body: { body: ARCHIVED_REVIEW_BODY }
-        });
-      } catch (error) {
-        failures.push(`could not archive empty review ${review.id}: ${errorMessage(error)}`);
-      }
-    }
-  }
-  if (failures.length > 0)
-    throw new Error(failures.join("; "));
+  const repoPath = repoRelativeDiagnosticPath(directory, diagnostic.file, repoRoot);
+  const encoded = repoPath.split("/").map((segment) => encodeURIComponent(segment).replace(/[!'()*]/g, (char) => `%${char.charCodeAt(0).toString(16)}`)).join("/");
+  return `${server}/${repo}/blob/${sha}/${encoded}${diagnostic.baselineLocationUncertain ? "" : `#L${diagnostic.location.line}`}`;
 }
-async function publishCommitStatus(repo, sha, report, blocking) {
+async function publishCommitStatus(client, sha, report, blocking) {
   const blocked = shouldBlock(report, blocking);
-  await githubApi(repo, `/statuses/${sha}`, {
-    method: "POST",
-    body: {
-      state: blocked ? "failure" : "success",
-      context: "React-Luau Doctor",
-      description: `Score ${report.score}/100 \xB7 ${report.counts.error} errors \xB7 ${report.counts.warning} warnings`,
-      target_url: githubRunUrl() ?? undefined
-    }
-  });
+  const body = {
+    state: report.partial ? "error" : blocked ? "failure" : "success",
+    context: "React-Luau Doctor",
+    description: report.partial ? "Analysis incomplete; findings and fixes are unverified" : `Score ${report.score}/100 \xB7 ${report.counts.error} errors \xB7 ${report.counts.warning} warnings`,
+    target_url: githubRunUrl() ?? undefined
+  };
+  if (client.pullNumber)
+    await client.mutate(`/statuses/${sha}`, "POST", body);
+  else
+    await client.request(`/statuses/${sha}`, { method: "POST", body });
 }
 function parseCiRunOptions(argv) {
   const settings = { ...DEFAULT_SETTINGS };
@@ -13924,17 +14640,33 @@ function parseCiRunOptions(argv) {
 async function runCiJob(argv) {
   const settings = parseCiRunOptions(argv);
   const eventName = process.env.GITHUB_EVENT_NAME ?? "";
+  if (eventName === "pull_request_target") {
+    throw new Error("ci run does not execute PR analysis under pull_request_target; use pull_request with least-privilege permissions");
+  }
   const event = githubEvent();
   const isPullRequest = eventName === "pull_request" && event.pull_request !== undefined;
   const base = isPullRequest ? event.pull_request.base.sha : undefined;
   const head = isPullRequest ? event.pull_request.head.sha : process.env.GITHUB_SHA ?? "HEAD";
-  let fixedFromScan;
-  const report = await scanForCi(settings, eventName, base, (count) => {
-    fixedFromScan = (fixedFromScan ?? 0) + count;
-  });
-  const reviewChanges = isPullRequest ? await findNewReviewDiagnostics(settings, eventName, event, report) : { diagnostics: [] };
-  const fixed = isPullRequest && base ? fixedFromScan ?? (await Promise.all(resolveCiProjectRoots(path11.resolve(settings.directory), settings.project).map((root) => fixedIssueCount(root, base)))).reduce((sum, count) => sum + count, 0) : 0;
-  const skipped = isPullRequest && report.scannedFiles === 0 && fixed === 0;
+  const repo = githubRepo(event);
+  const client = repo ? new GitHubClient(repo, event.pull_request?.number ?? 0, {
+    head,
+    base: base ?? "",
+    runId: process.env.GITHUB_RUN_ID ?? "",
+    attempt: process.env.GITHUB_RUN_ATTEMPT ?? "1"
+  }) : undefined;
+  let snapshot;
+  if (client && isPullRequest && settings.reviewComments) {
+    try {
+      snapshot = await reviewSnapshot(client);
+    } catch (error) {
+      process.stderr.write(`react-luau-doctor: could not update inline review comments: ${errorMessage(error)}
+`);
+    }
+  }
+  const scan = await scanForCi(settings, isPullRequest, base, head, snapshot);
+  const { report, fixed, analysis } = scan;
+  const baselineCommit = scan.comparison.base ?? base;
+  const skipped = isPullRequest && report.scannedFiles === 0 && fixed.length === 0 && report.diagnostics.length === 0 && !report.partial;
   const effectiveBlocking = isPullRequest ? settings.blocking : "none";
   process.stdout.write(`${renderTextReport(report, true, false, false, process.stdout.columns ?? 120)}
 `);
@@ -13944,39 +14676,105 @@ async function runCiJob(argv) {
 `);
   writeOutput("score", report.score);
   writeOutput("total-issues", report.diagnostics.length);
-  writeOutput("fixed-issues", fixed);
+  writeOutput("fixed-issues", fixed.length);
   writeOutput("error-count", report.counts.error);
   writeOutput("warning-count", report.counts.warning);
+  writeOutput("suggestion-count", report.counts.suggestion);
   writeOutput("affected-files", affectedFiles(report));
-  const repo = githubRepo(event);
-  if (repo && isPullRequest) {
-    const pullNumber = event.pull_request.number;
-    if (settings.comment) {
+  writeOutput("analysis-complete", report.partial ? "false" : "true");
+  const render = (inlineCount, limit) => renderSummaryComment(report, {
+    baseBranch: event.pull_request?.base.ref ?? "baseline",
+    fixed,
+    sha: head,
+    inlineCount,
+    incomplete: report.partial,
+    skipped,
+    runUrl: githubRunUrl(),
+    limit,
+    includeDiagnosticDetails: limit === Number.POSITIVE_INFINITY,
+    url: (diagnostic, baseline) => githubFileUrl(repo ?? "unknown/repository", baseline ? baselineCommit ?? "HEAD" : head, diagnostic, settings.directory, scan.repoRoot)
+  });
+  const fullReport = render(0, Number.POSITIVE_INFINITY);
+  if (process.env.GITHUB_STEP_SUMMARY) {
+    if (Buffer.byteLength(fullReport) < 900000) {
+      fs9.appendFileSync(process.env.GITHUB_STEP_SUMMARY, fullReport);
+    } else {
+      fs9.appendFileSync(process.env.GITHUB_STEP_SUMMARY, `${render(0)}
+The complete diagnostic report exceeds the workflow summary limit and is available in the report artifact and logs
+`);
+    }
+  }
+  const reportFile = path11.join(fs9.mkdtempSync(path11.join(process.env.RUNNER_TEMP ?? os2.tmpdir(), "react-luau-doctor-report-")), "report.json");
+  fs9.writeFileSync(reportFile, JSON.stringify({
+    ...report,
+    fixedDiagnostics: fixed,
+    baseBranch: event.pull_request?.base.ref,
+    baseCommit: baselineCommit,
+    baseBranchCommit: base,
+    headCommit: head
+  }, null, 2) + `
+`);
+  writeOutput("report-path", reportFile);
+  process.stdout.write(`Full diagnostic report
+${JSON.stringify({ ...report, fixedDiagnostics: fixed })}
+`);
+  if (client && isPullRequest) {
+    let inlineCount = snapshot?.comments.filter((comment) => comment.user?.type === "Bot" && comment.body?.startsWith("<!-- react-luau-doctor:review -->")).length ?? 0;
+    let stale = false;
+    const publishSummary = async () => {
+      if (!settings.comment || stale)
+        return;
       try {
-        await updateStickyComment(repo, pullNumber, renderSummaryComment(report, repo, head, fixed, skipped, settings.directory), !skipped);
+        await client.sticky(render(inlineCount), !report.partial);
       } catch (error) {
+        stale ||= error instanceof StalePublication;
         process.stderr.write(`react-luau-doctor: could not update the sticky PR comment: ${errorMessage(error)}
 `);
       }
-    }
-    if (settings.reviewComments && base) {
+    };
+    await publishSummary();
+    if (settings.reviewComments && snapshot && base && !stale) {
       try {
-        await manageReviewComments(repo, pullNumber, report, reviewChanges.diagnostics, path11.resolve(settings.directory), reviewChanges.base ?? base, base);
+        const reviewBase = event.action === "synchronize" ? event.before : base;
+        if (event.action === "synchronize" && (!reviewBase || !/^[a-f0-9]{40}$/i.test(reviewBase) || gitResult(scan.repoRoot, ["merge-base", "--is-ancestor", reviewBase, head]) === null)) {
+          throw new Error("Previous PR head is unavailable or history was rewritten; new inline comments were skipped");
+        }
+        const lines = createGitScopePlan(path11.resolve(settings.directory), {
+          scope: "lines",
+          base: reviewBase
+        }).changedLines;
+        const canInline = (diagnostic) => (lines.get(diagnostic.file) ?? []).some((range) => diagnostic.location.line >= range.start && diagnostic.location.line <= range.end);
+        let introduced = !event.action || event.action === "opened" ? analysis.introduced : [];
+        if (analysis.complete && event.action === "synchronize" && analysis.introduced.some(({ diagnostic }) => canInline(diagnostic))) {
+          const update = await scanForCi({ ...settings, scope: "changed" }, true, reviewBase, head);
+          if (!update.analysis.complete) {
+            throw new Error("Previous PR head analysis was incomplete; new inline comments were skipped");
+          }
+          const fresh = new Set(update.comparison.diagnostics.map((diagnostic) => diagnostic.file + "\x00" + diagnostic.id));
+          introduced = analysis.introduced.filter(({ diagnostic }) => fresh.has(diagnostic.file + "\x00" + diagnostic.id));
+        }
+        const latestSnapshot = await reviewSnapshot(client);
+        inlineCount = await reconcileReviews(client, latestSnapshot, {
+          ...analysis,
+          introduced
+        }, canInline);
       } catch (error) {
+        stale ||= error instanceof StalePublication;
         process.stderr.write(`react-luau-doctor: could not update inline review comments: ${errorMessage(error)}
 `);
       }
+      await publishSummary();
     }
   }
-  if (repo && settings.commitStatus) {
+  if (client && settings.commitStatus) {
     try {
-      await publishCommitStatus(repo, head, report, effectiveBlocking);
+      await publishCommitStatus(client, head, report, effectiveBlocking);
     } catch (error) {
       process.stderr.write(`react-luau-doctor: could not publish the commit status: ${errorMessage(error)}
 `);
     }
   }
-  if (shouldBlock(report, effectiveBlocking))
+  if (report.partial || shouldBlock(report, effectiveBlocking))
     process.exitCode = 1;
 }
 async function runCiCommand(argv) {
@@ -15849,7 +16647,7 @@ async function main() {
       process.stdout.write(`React-Luau Doctor ${VERSION2}
 Bun ${Bun.version}
 ${process.platform} ${process.arch}
-${os2.release()}
+${os3.release()}
 `);
       return;
     }
@@ -15923,5 +16721,5 @@ ${renderUpdateNotice(update.current, update.latest, colorized)}
 }
 main();
 
-//# debugId=3EFE794093E582F464756E2164756E21
+//# debugId=1B34073C2F3EACBB64756E2164756E21
 //# sourceMappingURL=cli.js.map