refactor(prog): run JSON/YAML/webdev formatters via argv, not a shell

cj/json-format-buffer, cj/yaml-format-buffer, and cj/webdev-format-buffer ran their formatters through shell-command-on-region, which goes via a shell. I moved each to call-process-region with an explicit program and argv list, so a filename or buffer content can't be word-split or read as shell syntax. The webdev path dropped its shell-quote-argument dance once the filename became a plain argv element.

Point preservation is unchanged. One deliberate improvement, and it's tested: shell-command-on-region with replace replaced the buffer with the formatter's error text on a non-zero exit. The new per-formatter helper captures output to a temp buffer, checks the exit code, replaces only on success, and otherwise raises a user-error carrying stderr — so a failed format leaves the buffer alone.

I kept a small format-region helper in each of the three modules rather than one shared helper. They have no common module to live in short of system-lib, and coupling three unrelated domain modules through it wasn't worth saving sixteen lines.

1 files changed, 31 insertions, 0 deletions

diff --git a/tests/test-prog-yaml--yaml-format-buffer.el b/tests/test-prog-yaml--yaml-format-buffer.el
index 4e928a2c..28ad351f 100644
--- a/tests/test-prog-yaml--yaml-format-buffer.el
+++ b/tests/test-prog-yaml--yaml-format-buffer.el
@@ -6,8 +6,39 @@
 ;;; Code:
 
 (require 'ert)
+(require 'cl-lib)
 (require 'prog-yaml)
 
+;;; argv path — process invocation (stubbed, no shell)
+
+(ert-deftest test-prog-yaml--yaml-format-buffer-invokes-prettier-argv ()
+  "Normal: with prettier present, the formatter calls it via argv, no shell."
+  (let (program args)
+    (cl-letf (((symbol-function 'executable-find) (lambda (_p) "/usr/bin/prettier"))
+              ((symbol-function 'call-process-region)
+               (lambda (_start _end prog &rest rest)
+                 (setq program prog
+                       args (nthcdr 3 rest))
+                 (with-current-buffer (nth 1 rest) (insert "key: value\n"))
+                 0)))
+      (with-temp-buffer
+        (insert "key: value\n")
+        (cj/yaml-format-buffer)))
+    (should (equal "prettier" program))
+    (should (equal '("--parser" "yaml") args))))
+
+(ert-deftest test-prog-yaml--yaml-format-buffer-no-clobber-on-failure ()
+  "Error: a non-zero prettier exit leaves the buffer untouched and errors."
+  (cl-letf (((symbol-function 'executable-find) (lambda (_p) "/usr/bin/prettier"))
+            ((symbol-function 'call-process-region)
+             (lambda (_start _end _prog _delete buffer &rest _)
+               (with-current-buffer buffer (insert "[error] bad yaml"))
+               1)))
+    (with-temp-buffer
+      (insert "key: : bad\n")
+      (should-error (cj/yaml-format-buffer) :type 'user-error)
+      (should (string= (buffer-string) "key: : bad\n")))))
+
 ;;; Normal Cases
 
 (ert-deftest test-prog-yaml--yaml-format-buffer-normal-fixes-indentation ()