feat: Implement per-line and per-function inline suppression comments

[Nanle-code]

Overview

Developers sometimes need to suppress a specific ChainProof finding on a known-safe code path without suppressing the entire rule globally. Inline suppression comments (similar to eslint-disable) provide fine-grained control without polluting a baseline file or disabling rules project-wide.

Proposed Syntax

Single-line suppression

(bool ok,) = msg.sender.call{value: amount}(""); // chainproof-disable-next-line CP-107

Block suppression

// chainproof-disable CP-107
function knownSafeWithdraw() external {
    // ... reentrancy guard applied via mutex, not CEI pattern
    (bool ok,) = msg.sender.call{value: amount}("");
}
// chainproof-enable CP-107

Suppress all rules on a line

someRiskyCall(); // chainproof-disable-line

Require a reason (optional enforcement)

// chainproof-disable-next-line CP-107 -- mutex pattern applied, see AuditReport-2025.pdf

Implementation Plan

1. After parsing, extract all comment nodes from the AST
2. Build a suppression map: Map<lineNumber, ruleId[]>
3. After rule execution, filter findings against the suppression map
4. Suppressed findings are included in JSON output with suppressed: true for auditability
5. Report how many findings were suppressed in the summary line
6. Add a --no-inline-suppression flag to disable this feature for strict CI modes

Acceptance Criteria

• Comment extraction from Solidity AST
• Suppression map construction for chainproof-disable-next-line, chainproof-disable/enable blocks
• Findings filtered against suppression map before reporting
• Suppressed findings appear in JSON output with suppressed: true
• Summary line shows: "X findings suppressed by inline comments"
• --no-inline-suppression CLI flag
• VS Code extension respects suppressions (finding removed from Problems panel)
• Warning emitted for suppression comments that do not match any finding (unused suppression)

[Babigdk]

Proposal: Inline Suppression System for ChainProof (ESLint-style Controls)

I’d like to implement fine-grained inline suppression for ChainProof findings to improve developer ergonomics without losing auditability.

Scope of Work:

• Parse Solidity AST comments and extract suppression directives:

  • chainproof-disable-next-line CP-107
  • chainproof-disable / chainproof-enable block ranges
  • chainproof-disable-line (all rules)

• Build suppression map: Map<lineNumber, ruleId[]>

• Filter findings post-analysis based on suppression map

• Preserve suppressed findings in output with suppressed: true

• Add summary metric: "X findings suppressed by inline comments"

• Emit warnings for unused suppression comments (no matching findings)

• Add CLI flag --no-inline-suppression for strict CI mode

• Ensure VS Code extension respects suppression logic (hide from Problems panel)

Deliverables:

• Solidity comment parser integration
• Suppression engine + rule filter layer
• CLI support for disabling inline suppression
• Updated JSON output schema with suppression metadata
• VS Code integration update
• Reporting improvements (suppression stats + warnings)

Goal:
Enable safe, localized suppression of findings while maintaining full audit transparency and CI control flexibility.

[fathiaoyinloye]

Hi maintainers,

I'd like to work on this issue.

I have experience building developer tooling, static analysis workflows, parsers, and test automation. This issue is particularly interesting because it improves usability while preserving auditability and security visibility.

My approach would be to:

• Extend the AST processing pipeline to extract and normalize Solidity comments.
• Implement support for chainproof-disable-next-line, chainproof-disable-line, and block-based chainproof-disable / chainproof-enable directives.
• Build a suppression mapping layer that associates findings with applicable suppressions.
• Filter findings during report generation while retaining suppressed findings in JSON output with suppressed: true.
• Add suppression statistics to the scan summary output.
• Implement the --no-inline-suppression flag for strict CI environments.
• Detect and report unused suppression directives to help maintain clean codebases.
• Ensure the VS Code extension respects suppressions so filtered findings are removed from the Problems panel.
• Add comprehensive tests covering comment parsing, suppression matching, reporting, CLI behavior, and edge cases.

I'll ensure the implementation remains backward compatible, auditable, and aligned with the project's security-focused goals.

Please assign this issue to me if it's available. Thank you!

[Jayydy]

Hello, can i be assigned to this issue?

[grantfox-oss]

🦊 GrantFox — @Jayydy has been assigned to this issue as part of the Official Campaign campaign!

Next steps:

1. Open a Pull Request referencing this issue (e.g., Closes #19)
2. Your PR will be reviewed by the StellarChainproof maintainers

Good luck! Track your progress on GrantFox.