Describe the Bug

pyrefly suppress sometimes inadvertantly turns off pre-existing ignores for other linting tools.

Specifically, it does this if the pre-existing ignore comment is on the line above the code it ignores. When suppress runs, it inserts a pyrefly: ignore comment above the line it refers to, meaning that the comment from the other tool no longer targets the correct line.

Example

Running semgrep --config "p/python" example.py will pass.

# example.py

import subprocess


def run_command(cmd):
    # nosemgrep: python.lang.security.audit.subprocess-shell-true.subprocess-shell-true
    result = subprocess.run(cmd, shell=True, foo="bar")
    return result.returncode

Now, run pyrefly suppress. It inserts a line after the nosemgrep comment:

import subprocess


def run_command(cmd):
    # nosemgrep: python.lang.security.audit.subprocess-shell-true.subprocess-shell-true
    # pyrefly: ignore [no-matching-overload]
    result = subprocess.run(cmd, shell=True, foo="bar")
    return result.returncode

Now running semgrep will fail.

Possible approach

I suspect it's difficult/impossible to handle all possible cases of this, but one improvement could be to insert the comment on the same line as the targetted line, in this circumstance.

def run_command(cmd):
    # nosemgrep: python.lang.security.audit.subprocess-shell-true.subprocess-shell-true
    result = subprocess.run(cmd, shell=True, foo="bar")  # pyrefly: ignore [no-matching-overload]
    return result.returncode

Or, if there is already an ignore on the line:

def run_command(cmd):
    # nosemgrep: python.lang.security.audit.subprocess-shell-true.subprocess-shell-true
    result = subprocess.run(cmd, shell=True, foo=bar)  # noqa: F821  # pyrefly: ignore [no-matching-overload]
    return result.returncode

Of course then it could fall foul of line-wrapping rules.

Another approach could just be to warn the user of any lines that it inserted that may have affected other linter ignore lines.

Sandbox Link

No response

(Only applicable for extension issues) IDE Information

No response