fix(enrichment): restore comma-separated any annotations in unsafe-any

Drop the object-literal guard that suppressed valid `(v: any, next)` and
`let a: any, b` matches; document the remaining shorthand false-positive.

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: bohdansolovie

apps/gittensory-ui/src/lib/rees-analyzers.ts

@@ -952,7 +952,7 @@ export const REES_ANALYZERS = [
       reports: "File, line, and kind: annotation, cast, or assertion.",
       network: "Pure local analyzer. No external network call.",
       notes:
-        "Structural regex only — no type-checker. String literals and full-line comments are ignored; inline `//` and `/* */` comments are stripped before matching.",
+        "Structural regex only — no type-checker. String literals and full-line comments are ignored; inline `//` and `/* */` comments (including multi-line blocks) are stripped before matching. Object-literal shorthand values such as `{ value: any }` may false-positive when `any` is a variable name.",
     },
   },
   {

review-enrichment/analyzer-metadata.json

@@ -1075,7 +1075,7 @@
         "looksAt": "Added lines in changed non-test .ts/.tsx/.mts/.cts source files.",
         "reports": "File, line, and kind: annotation, cast, or assertion.",
         "network": "Pure local analyzer. No external network call.",
-        "notes": "Structural regex only — no type-checker. String literals and full-line comments are ignored; inline `//` and `/* */` comments are stripped before matching."
+        "notes": "Structural regex only — no type-checker. String literals and full-line comments are ignored; inline `//` and `/* */` comments (including multi-line blocks) are stripped before matching. Object-literal shorthand values such as `{ value: any }` may false-positive when `any` is a variable name."
       }
     },
     {

review-enrichment/src/analyzers/registry.ts

@@ -993,7 +993,7 @@ export const ANALYZER_DESCRIPTORS = [
       reports: "File, line, and kind: annotation, cast, or assertion.",
       network: "Pure local analyzer. No external network call.",
       notes:
-        "Structural regex only — no type-checker. String literals and full-line comments are ignored; inline `//` and `/* */` comments are stripped before matching.",
+        "Structural regex only — no type-checker. String literals and full-line comments are ignored; inline `//` and `/* */` comments (including multi-line blocks) are stripped before matching. Object-literal shorthand values such as `{ value: any }` may false-positive when `any` is a variable name.",
     },
     render: (findings, helpers) => {
       if (!findings.length) return [];

review-enrichment/src/analyzers/unsafe-any.ts

@@ -12,7 +12,7 @@ const TS_EXTS = new Set(["ts", "tsx", "mts", "cts"]);
 
 const CAST_RE = /\bas\s+any\b/;
 const ASSERTION_RE = /<\s*any\s*>/;
-const ANNOTATION_RE = /:\s*any\b(?!\s*[,}])/;
+const ANNOTATION_RE = /:\s*any\b/;
 
 function isTypeScriptPath(path: string): boolean {
   const ext = /\.([^.]+)$/.exec(path)?.[1]?.toLowerCase();

review-enrichment/test/unsafe-any.test.ts

@@ -49,9 +49,9 @@ test("detectUnsafeAny: ignores block comments after real code", () => {
   assert.equal(detectUnsafeAny("/* @internal */ const value: any = input;"), "annotation");
 });
 
-test("detectUnsafeAny: does not treat object-literal values as type annotations", () => {
-  assert.equal(detectUnsafeAny("return { value: any };"), null);
-  assert.equal(detectUnsafeAny("return { value: any, other: true };"), null);
+test("detectUnsafeAny: flags comma-separated parameter and declarator annotations", () => {
+  assert.equal(detectUnsafeAny("function f(v: any, next: string) {}"), "annotation");
+  assert.equal(detectUnsafeAny("let a: any, b: string;"), "annotation");
 });
 
 test("scanPatchForUnsafeAny: ignores multi-line block comments spanning added lines", () => {