Skip to content

feat(enrichment): unsafe-any (TS) counter analyzer#3491

Closed
bohdansolovie wants to merge 5 commits into
JSONbored:mainfrom
bohdansolovie:feat/enrichment-unsafe-any-2017-v4
Closed

feat(enrichment): unsafe-any (TS) counter analyzer#3491
bohdansolovie wants to merge 5 commits into
JSONbored:mainfrom
bohdansolovie:feat/enrichment-unsafe-any-2017-v4

Conversation

@bohdansolovie

@bohdansolovie bohdansolovie commented Jul 5, 2026

Copy link
Copy Markdown
Contributor

Summary

Fixes #2017

  • Add UnsafeAnyFinding and a local unsafeAny analyzer that flags newly-added : any annotations, as any casts, and <any> assertions in non-test TypeScript source
  • Strip string literals before matching; skip full-line comments; track multi-line /* */ block comments across added patch lines; guard object-literal shorthand values; cap at 25 findings
  • Register the analyzer in the REES registry with render/docs/metadata; sync src/review/enrichment-analyzer-names.ts with the enrichment registry (hardcodedUrl, debugLeftover, unsafeAny)
  • Add review-enrichment/test/unsafe-any.test.ts covering annotation/cast/assertion, leading and multi-line block comments, object-literal guards, non-TS/test skip, .mts/.cts, cap, and brief rendering

Test plan

  • cd review-enrichment && npm run build && npm run metadata && node --test test/unsafe-any.test.ts test/analyzer-registry.test.ts
  • CI validate-code

Made with Cursor

bohdansolovie and others added 5 commits July 5, 2026 11:36
@bohdansolovie @cursoragent
feat(enrichment): add unsafe-any counter analyzer
f34cc58 
Flags newly-added `: any`, `as any`, and `<any>` in TypeScript diffs as a
type-safety erosion signal. Syncs the REES analyzer name registry with the
enrichment registry for merged hardcodedUrl/debugLeftover plus unsafeAny.

Co-authored-by: Cursor <cursoragent@cursor.com>
@bohdansolovie @cursoragent
fix(enrichment): strip block comments and test mts/cts in unsafe-any
60a311d 
Address Orb nits: ignore inline /* */ comments before matching and pin
.mts/.cts extension coverage in tests.

Co-authored-by: Cursor <cursoragent@cursor.com>
@bohdansolovie @cursoragent
chore: refresh PR head for CI
fe5c6e5 
Co-authored-by: Cursor <cursoragent@cursor.com>
@bohdansolovie @cursoragent
fix(enrichment): detect any after leading block comments in unsafe-any
cc33dae 
Only skip full-line comments instead of any line starting with /*, and
tighten : any matching so object-literal values like { value: any }
are not reported as type annotations.

Co-authored-by: Cursor <cursoragent@cursor.com>
@bohdansolovie @cursoragent
fix(enrichment): track multi-line block comments in unsafe-any scan
bcfb984 
Track block-comment state across added patch lines and tighten object-
literal guards so commented or shorthand values are not reported.

Co-authored-by: Cursor <cursoragent@cursor.com>
@bohdansolovie
bohdansolovie requested a review from JSONbored as a code owner July 5, 2026 10:14
@superagent-security

superagent-security Bot commented Jul 5, 2026

Copy link
Copy Markdown
Contributor

Superagent didn't find any vulnerabilities or security issues in this PR.

@loopover-orb loopover-orb Bot added the gittensor:bug Gittensor-scored bug fix — scores a 0.05x multiplier. label Jul 5, 2026
@loopover-orb

loopover-orb Bot commented Jul 5, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Caution

🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥

🛑 Gittensory review result - reject/close recommended

Review updated: 2026-07-05 10:18:12 UTC

10 files · 1 AI reviewer · 1 blocker · readiness 62/100 · CI pending · blocked

🛑 Suggested Action - Reject/Close

  • AI reviewers agree on a likely critical defect: review-enrichment/src/analyzers/unsafe-any.ts:16: `ANNOTATION_RE` does not match reachable annotations followed by commas, so `function f(v: any, next: string) {}` and `let a: any, b: string
  • ` are silently missed
  • change the object-literal guard to avoid only value-position object literals or add a follow-up parse/context check instead of excluding all comma/braces after `any`. — Resolve the flagged defect, or override if the AI reviewers are mistaken, then re-run the gate.

Review summary
This adds a focused local REES analyzer for newly-added explicit TypeScript `any` usage and wires it through metadata, rendering, UI analyzer lists, and tests. The registration path is coherent, but the core annotation regex intentionally suppresses `: any` before commas/braces, which skips common real TypeScript annotations such as function parameters and multi-variable declarations. That makes the analyzer undercount the exact pattern it claims to report.

Blockers

  • review-enrichment/src/analyzers/unsafe-any.ts:16: `ANNOTATION_RE` does not match reachable annotations followed by commas, so `function f(v: any, next: string) {}` and `let a: any, b: string;` are silently missed; change the object-literal guard to avoid only value-position object literals or add a follow-up parse/context check instead of excluding all comma/braces after `any`.
Nits — 5 non-blocking
  • review-enrichment/src/analyzers/unsafe-any.ts:52: `stripComments(codeOnly(line))` still treats every `//` as a comment delimiter, so regex literals or URL-like code fragments may be truncated; add a regression test if this analyzer is meant to stay regex-only.
  • review-enrichment/test/unsafe-any.test.ts:17: Add a test for `function f(v: any, next: string) {}` because parameter lists are one of the most common `: any` annotation shapes.
  • review-enrichment/src/analyzers/unsafe-any.ts:16: Replace the broad `(?!\s*[,}])` suppression with logic that specifically ignores object-literal property values, then cover both `return { value: any }` and `function f(v: any, next: string) {}`.
  • review-enrichment/test/unsafe-any.test.ts: Add a regression for multi-variable declarations like `let a: any, b = 1;` so the analyzer does not keep missing valid type annotations.
  • Readiness score is below the configured threshold — Use the readiness panel as advisory maintainer context; the score does not block this PR.

Why this is blocked

  • review-enrichment/src/analyzers/unsafe-any.ts:16: `ANNOTATION_RE` does not match reachable annotations followed by commas, so `function f(v: any, next: string) {}` and `let a: any, b: string;` are silently missed; change the object-literal guard to avoid only value-position object literals or add a follow-up parse/context check instead of excluding all comma/braces after `any`.
Signal Result Evidence
Code review ❌ 1 blocker 1 reviewer
Linked issue ✅ Linked #2017
Related work ⚠️ 3 scoped overlaps Top overlaps are listed below; lower-confidence bulk is hidden.
Change scope ❌ 8/20 High review scope from cached public metadata (1 linked issue).
Validation posture ❌ 5/25 Preflight is holding this PR: the review lane is unavailable, so it is not ready for automated review.
Contributor workload ✅ 10/10 Author activity: 287 registered-repo PR(s), 177 merged, 9 issue(s).
Contributor context ✅ Confirmed Gittensor contributor bohdansolovie; Gittensor profile; 287 PR(s), 9 issue(s).
Gate result ❌ Blocking Repo-configured hard blocker found.
Review context
  • Author: bohdansolovie
  • Role context: outside_contributor
  • Public audience mode: oss maintainer
  • Lane context: Repository registration is not available in the local Gittensory cache.
  • Public profile languages: Python, C++, JavaScript
  • Official Gittensor activity: 287 PR(s), 9 issue(s).
  • Related work: Titles/paths share 8 meaningful terms. (issue #2029, issue #2026)
  • Related work: Titles/paths share 7 meaningful terms. (issue #2023, issue #2029)
  • Related work: Titles/paths share 7 meaningful terms. (issue #2023, issue #2033)
  • Additional title-only matches omitted; title-only overlap does not block.
Contributor next steps
  • Review top overlaps.
  • Add a concise scope and risk note.
  • Await review-lane availability.
  • Refresh registry data or choose a registered active repo.
  • Check active issues and PRs before submitting.
Signal definitions
  • Related work = same linked issue, overlapping active PRs, or title/path similarity.
  • Change scope = cached public metadata such as size labels, draft state, and review-burden hints.
  • Validation posture = whether the PR provides enough public validation/test evidence for maintainer review.
  • Contributor workload = public contributor activity and cleanup pressure, not a repo-wide quality failure.
  • Contributor context = public GitHub/Gittensor identity context; non-Gittensor status is not a blocker.

🟩 Safe / merged · 🟦 Advisory · 🟨 Held for review · 🟥 Blocked / closed

💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →.

Checked by Gittensory, a quiet PR intelligence layer for OSS maintainers.

  • Re-run Gittensory review

@codecov

codecov Bot commented Jul 5, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 93.03%. Comparing base (b5d2956) to head (bcfb984).
⚠️ Report is 2 commits behind head on main.

Additional details and impacted files 
@@           Coverage Diff           @@
##             main    #3491   +/-   ##
=======================================
  Coverage   93.03%   93.03%           
=======================================
  Files         299      299           
  Lines       31204    31204           
  Branches    11386    11386           
=======================================
  Hits        29031    29031           
  Misses       1517     1517           
  Partials      656      656
Files with missing lines Coverage Δ
src/review/enrichment-analyzer-names.ts 100.00% <ø> (ø)
🚀 New features to boost your workflow:
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@loopover-orb

loopover-orb Bot commented Jul 5, 2026

Copy link
Copy Markdown
Contributor

Gittensory is closing this pull request on the maintainer's behalf (AI reviewers agree on a likely critical defect: review-enrichment/src/analyzers/unsafe-any.ts:16: `ANNOTATION_RE` does not match reachable annotations followed by commas, so `function f(v: any, next: string) {}` and `let a: any, b: string;` are silently missed; change the object-literal guard to avoid only value-position object literals or add a follow-up parse/context check instead of excluding all comma/braces after `any`.). This is an automated maintenance action — to pursue this change, please open a new pull request with the issues resolved. Closed PRs may be analyzed later to improve review accuracy, but they are not automatically reopened or re-reviewed.

@loopover-orb loopover-orb Bot closed this Jul 5, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@JSONbored JSONbored Awaiting requested review from JSONbored JSONbored is a code owner

Assignees

@bohdansolovie bohdansolovie

Labels

gittensor:bug Gittensor-scored bug fix — scores a 0.05x multiplier.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

feat(enrichment): unsafe-any (TS) counter analyzer

1 participant

@bohdansolovie