fix(git-hooks): use printf instead of echo for consistent output

Replace echo with printf for better portability and control over output
formatting in pre-push hook validation messages.

Author: jdalton

.git-hooks/pre-push

@@ -11,7 +11,7 @@ YELLOW='\033[1;33m'
 GREEN='\033[0;32m'
 NC='\033[0m'
 
-echo "${GREEN}Running mandatory pre-push validation...${NC}"
+printf "${GREEN}Running mandatory pre-push validation...${NC}\n"
 
 # Allowed public API key (used in socket-lib).
 ALLOWED_PUBLIC_KEY="sktsec_t_--RAN5U4ivauy4w37-6aoKyYPDt5ZbaT5JBVMqiwKo_api"
@@ -38,60 +38,60 @@ while read local_ref local_sha remote_ref remote_sha; do
   # ============================================================================
   # CHECK 1: Scan commit messages for AI attribution
   # ============================================================================
-  echo "Checking commit messages for AI attribution..."
+  printf "Checking commit messages for AI attribution...\n"
 
   # Check each commit in the range for AI patterns.
   while IFS= read -r commit_sha; do
     full_msg=$(git log -1 --format='%B' "$commit_sha")
 
     if echo "$full_msg" | grep -qiE "(Generated with.*(Claude|AI)|Co-Authored-By: Claude|Co-Authored-By: AI|🤖 Generated|AI generated|@anthropic\.com|Assistant:|Generated by Claude|Machine generated)"; then
       if [ $ERRORS -eq 0 ]; then
-        echo "${RED}✗ BLOCKED: AI attribution found in commit messages!${NC}"
-        echo "Commits with AI attribution:"
+        printf "${RED}✗ BLOCKED: AI attribution found in commit messages!${NC}\n"
+        printf "Commits with AI attribution:\n"
       fi
-      echo "  - $(git log -1 --oneline "$commit_sha")"
+      printf "  - %s\n" "$(git log -1 --oneline "$commit_sha")"
       ERRORS=$((ERRORS + 1))
     fi
   done < <(git rev-list "$range")
 
   if [ $ERRORS -gt 0 ]; then
-    echo ""
-    echo "These commits were likely created with --no-verify, bypassing the"
-    echo "commit-msg hook that strips AI attribution."
-    echo ""
-    echo "To fix:"
-    echo "  git rebase -i $remote_sha"
-    echo "  Mark commits as 'reword', remove AI attribution, save"
-    echo "  git push"
+    printf "\n"
+    printf "These commits were likely created with --no-verify, bypassing the\n"
+    printf "commit-msg hook that strips AI attribution.\n"
+    printf "\n"
+    printf "To fix:\n"
+    printf "  git rebase -i %s\n" "$remote_sha"
+    printf "  Mark commits as 'reword', remove AI attribution, save\n"
+    printf "  git push\n"
   fi
 
   # ============================================================================
   # CHECK 2: File content security checks
   # ============================================================================
-  echo "Checking files for security issues..."
+  printf "Checking files for security issues...\n"
 
   # Get all files changed in these commits.
   CHANGED_FILES=$(git diff --name-only "$range" 2>/dev/null || echo "")
 
   if [ -n "$CHANGED_FILES" ]; then
     # Check for sensitive files.
     if echo "$CHANGED_FILES" | grep -qE '^\.env(\.local)?$'; then
-      echo "${RED}✗ BLOCKED: Attempting to push .env file!${NC}"
-      echo "Files: $(echo "$CHANGED_FILES" | grep -E '^\.env(\.local)?$')"
+      printf "${RED}✗ BLOCKED: Attempting to push .env file!${NC}\n"
+      printf "Files: %s\n" "$(echo "$CHANGED_FILES" | grep -E '^\.env(\.local)?$')"
       ERRORS=$((ERRORS + 1))
     fi
 
     # Check for .DS_Store.
     if echo "$CHANGED_FILES" | grep -q '\.DS_Store'; then
-      echo "${RED}✗ BLOCKED: .DS_Store file in push!${NC}"
-      echo "Files: $(echo "$CHANGED_FILES" | grep '\.DS_Store')"
+      printf "${RED}✗ BLOCKED: .DS_Store file in push!${NC}\n"
+      printf "Files: %s\n" "$(echo "$CHANGED_FILES" | grep '\.DS_Store')"
       ERRORS=$((ERRORS + 1))
     fi
 
     # Check for log files.
     if echo "$CHANGED_FILES" | grep -E '\.log$' | grep -v 'test.*\.log' | grep -q .; then
-      echo "${RED}✗ BLOCKED: Log file in push!${NC}"
-      echo "Files: $(echo "$CHANGED_FILES" | grep -E '\.log$' | grep -v 'test.*\.log')"
+      printf "${RED}✗ BLOCKED: Log file in push!${NC}\n"
+      printf "Files: %s\n" "$(echo "$CHANGED_FILES" | grep -E '\.log$' | grep -v 'test.*\.log')"
       ERRORS=$((ERRORS + 1))
     fi
 
@@ -105,35 +105,35 @@ while read local_ref local_sha remote_ref remote_sha; do
 
         # Check for hardcoded user paths.
         if grep -E '(/Users/[^/\s]+/|/home/[^/\s]+/|C:\\Users\\[^\\]+\\)' "$file" 2>/dev/null | grep -q .; then
-          echo "${RED}✗ BLOCKED: Hardcoded personal path found in: $file${NC}"
+          printf "${RED}✗ BLOCKED: Hardcoded personal path found in: %s${NC}\n" "$file"
           grep -n -E '(/Users/[^/\s]+/|/home/[^/\s]+/|C:\\Users\\[^\\]+\\)' "$file" | head -3
           ERRORS=$((ERRORS + 1))
         fi
 
         # Check for Socket API keys.
         if grep -E 'sktsec_[a-zA-Z0-9_-]+' "$file" 2>/dev/null | grep -v "$ALLOWED_PUBLIC_KEY" | grep -v 'your_api_key_here' | grep -v 'SOCKET_SECURITY_API_KEY=' | grep -v 'fake-token' | grep -v 'test-token' | grep -q .; then
-          echo "${RED}✗ BLOCKED: Real API key detected in: $file${NC}"
+          printf "${RED}✗ BLOCKED: Real API key detected in: %s${NC}\n" "$file"
           grep -n 'sktsec_' "$file" | grep -v "$ALLOWED_PUBLIC_KEY" | grep -v 'your_api_key_here' | grep -v 'fake-token' | grep -v 'test-token' | head -3
           ERRORS=$((ERRORS + 1))
         fi
 
         # Check for AWS keys.
         if grep -iE '(aws_access_key|aws_secret|AKIA[0-9A-Z]{16})' "$file" 2>/dev/null | grep -q .; then
-          echo "${RED}✗ BLOCKED: Potential AWS credentials found in: $file${NC}"
+          printf "${RED}✗ BLOCKED: Potential AWS credentials found in: %s${NC}\n" "$file"
           grep -n -iE '(aws_access_key|aws_secret|AKIA[0-9A-Z]{16})' "$file" | head -3
           ERRORS=$((ERRORS + 1))
         fi
 
         # Check for GitHub tokens.
         if grep -E 'gh[ps]_[a-zA-Z0-9]{36}' "$file" 2>/dev/null | grep -q .; then
-          echo "${RED}✗ BLOCKED: Potential GitHub token found in: $file${NC}"
+          printf "${RED}✗ BLOCKED: Potential GitHub token found in: %s${NC}\n" "$file"
           grep -n -E 'gh[ps]_[a-zA-Z0-9]{36}' "$file" | head -3
           ERRORS=$((ERRORS + 1))
         fi
 
         # Check for private keys.
         if grep -E '-----BEGIN (RSA |EC |DSA )?PRIVATE KEY-----' "$file" 2>/dev/null | grep -q .; then
-          echo "${RED}✗ BLOCKED: Private key found in: $file${NC}"
+          printf "${RED}✗ BLOCKED: Private key found in: %s${NC}\n" "$file"
           ERRORS=$((ERRORS + 1))
         fi
       fi
@@ -144,11 +144,11 @@ while read local_ref local_sha remote_ref remote_sha; do
 done
 
 if [ $TOTAL_ERRORS -gt 0 ]; then
-  echo ""
-  echo "${RED}✗ Push blocked by mandatory validation!${NC}"
-  echo "Fix the issues above before pushing."
+  printf "\n"
+  printf "${RED}✗ Push blocked by mandatory validation!${NC}\n"
+  printf "Fix the issues above before pushing.\n"
   exit 1
 fi
 
-echo "${GREEN}✓ All mandatory validation passed!${NC}"
+printf "${GREEN}✓ All mandatory validation passed!${NC}\n"
 exit 0