sigil: interface and scanner fixes
2026-06-10
https://tinksoft.com/log/sigil-masks-and-wards/
----------------------------------

Sigil grew from about 770 lines to 1,900. Most of the work was in the interface
and scanner behavior.

## interface

The new terminal interface has four screens:

- scan progress
- editable search paths
- findings with a detail panel
- review and transfer to [Locket](/projects/locket/)

The previous review flow removed a finding from the screen without calling
Locket. That path was deleted. The current flow performs the transfer.

## masking

All findings now pass through one `Masked()` function before reaching the
terminal, interface, JSON report, or markdown report. Raw secret values are not
printed.

## scanner changes

- `.gitignore` rules are applied using a parser built on the Go standard library
- binary files, lockfiles, and `_test.go` files are skipped
- the scanner uses a 1 MB line buffer for minified files
- AWS-key detection now requires AWS context and ignores `go.sum` hashes

## fixes

The `--exit-code` flag parsed correctly but did not affect the process exit
status. This prevented the pre-commit hook from blocking commits. It now exits
non-zero when findings are present.

The Locket command path also had a quote-injection bug. Arguments are now passed
without shell interpolation.

Tests cover the Locket client, report formats, gitignore parser, and terminal
interface. Generated binaries and stale reports were removed from the repo.