0.3.8 regresses inline cofferdam-ignore suppression comments for custom-plugin findings

[TAJD]

Summary

Upgrading from 0.3.7 → 0.3.8 causes previously-suppressed findings to reappear as new/unbaselined, with zero code changes. Confirmed by toggling only the @cofferdam/cofferdam/@cofferdam/check-sdk version back and forth in bestefforttools (a downstream project with a custom local plugin, Refactor.HyroxRng).

Repro

In bestefforttools:

• lib/geneticAlgorithm.ts:33:

  // cofferdam-ignore: Refactor.HyroxRng: default RNG factory — this is the canonical injection point
  rng: () => Math.random(),

• lib/hyroxTemplates.ts:41:

  // cofferdam-ignore: Refactor.HyroxRng: template ID minter — non-deterministic on purpose so concurrent saves can't collide via deterministic RNG
  id: `${now}-${Math.random().toString(36).slice(2, 8)}`,

Both lines are legitimate, intentional exceptions to the Refactor.HyroxRng custom check (source: tools/cofferdam-checks/hyrox-rng/src/index.ts — a Pattern B/AST findAll check, doesn't handle suppression itself; relies on the engine's inline-comment suppression mechanism).

Steps:

1. On @cofferdam/cofferdam@0.3.7 + @cofferdam/check-sdk@0.3.7: rebuild the plugin (pnpm cofferdam:plugins), run cofferdam check --no-cache → 0 Refactor.HyroxRng findings (suppression honored).
2. Bump both packages to 0.3.8 (still within existing ^0.3.7 semver range), reinstall, rebuild plugin, re-run cofferdam check --no-cache → 2 new high-severity Refactor.HyroxRng findings, exactly at the two lines above, despite the inline cofferdam-ignore comments being completely unchanged.
3. Revert to 0.3.7 → findings disappear again (0 findings) with no other change.

Expected

Inline cofferdam-ignore: <ruleId>: <reason> suppression comments should continue to suppress matching findings across a patch version bump, especially since these two specific exceptions are canonical, documented workarounds (the RNG injection point and a deliberately-non-deterministic ID minter) — not something that should ever legitimately need re-flagging without a code change.

Impact

This blocks upgrading downstream projects past 0.3.7 without either (a) waiting for a fix, or (b) moving these exceptions into .cofferdam/baseline.json instead of inline comments, which is a less self-documenting pattern than what's used today and would need to be repeated for any future exception hit by the same regression.

Environment

• Downstream repo: bestefforttools (Windows, pnpm 10.18.0)
• @cofferdam/cofferdam / @cofferdam/check-sdk: 0.3.7 (working) → 0.3.8 (regressed)