refactor(prog): run JSON/YAML/webdev formatters via argv, not a shell

cj/json-format-buffer, cj/yaml-format-buffer, and cj/webdev-format-buffer ran their formatters through shell-command-on-region, which goes via a shell. I moved each to call-process-region with an explicit program and argv list, so a filename or buffer content can't be word-split or read as shell syntax. The webdev path dropped its shell-quote-argument dance once the filename became a plain argv element.

Point preservation is unchanged. One deliberate improvement, and it's tested: shell-command-on-region with replace replaced the buffer with the formatter's error text on a non-zero exit. The new per-formatter helper captures output to a temp buffer, checks the exit code, replaces only on success, and otherwise raises a user-error carrying stderr — so a failed format leaves the buffer alone.

I kept a small format-region helper in each of the three modules rather than one shared helper. They have no common module to live in short of system-lib, and coupling three unrelated domain modules through it wasn't worth saving sixteen lines.

3 files changed, 128 insertions, 31 deletions

diff --git a/tests/test-prog-json--json-format-buffer.el b/tests/test-prog-json--json-format-buffer.el
index 227eafb9..70d7e98b 100644
--- a/tests/test-prog-json--json-format-buffer.el
+++ b/tests/test-prog-json--json-format-buffer.el
@@ -7,9 +7,40 @@
 ;;; Code:
 
 (require 'ert)
+(require 'cl-lib)
 (require 'json)
 (require 'prog-json)
 
+;;; argv path — process invocation (stubbed, no shell)
+
+(ert-deftest test-prog-json--json-format-buffer-invokes-jq-argv ()
+  "Normal: with jq present, the formatter calls jq via argv, no shell."
+  (let (program args)
+    (cl-letf (((symbol-function 'executable-find) (lambda (_p) "/usr/bin/jq"))
+              ((symbol-function 'call-process-region)
+               (lambda (_start _end prog &rest rest)
+                 (setq program prog
+                       args (nthcdr 3 rest))
+                 (with-current-buffer (nth 1 rest) (insert "{}"))
+                 0)))
+      (with-temp-buffer
+        (insert "{\"a\":1}")
+        (cj/json-format-buffer)))
+    (should (equal "jq" program))
+    (should (equal '("--sort-keys" ".") args))))
+
+(ert-deftest test-prog-json--json-format-buffer-no-clobber-on-failure ()
+  "Error: a non-zero jq exit leaves the buffer untouched and signals an error."
+  (cl-letf (((symbol-function 'executable-find) (lambda (_p) "/usr/bin/jq"))
+            ((symbol-function 'call-process-region)
+             (lambda (_start _end _prog _delete buffer &rest _)
+               (with-current-buffer buffer (insert "jq: parse error"))
+               1)))
+    (with-temp-buffer
+      (insert "{not valid json}")
+      (should-error (cj/json-format-buffer) :type 'user-error)
+      (should (string= (buffer-string) "{not valid json}")))))
+
 ;;; Normal Cases — jq path
 
 (ert-deftest test-prog-json--json-format-buffer-normal-formats-object ()
diff --git a/tests/test-prog-webdev-format.el b/tests/test-prog-webdev-format.el
index 5abb1f52..694f9e96 100644
--- a/tests/test-prog-webdev-format.el
+++ b/tests/test-prog-webdev-format.el
@@ -2,9 +2,12 @@
 
 ;;; Commentary:
 ;; Covers the prettier-formatting path in `modules/prog-webdev.el':
-;;   - `cj/--webdev-format-command'  (pure: file -> "prettier --stdin-filepath ...")
-;;   - `cj/webdev-format-buffer'     (interactive wrapper; `executable-find' and
-;;                                    `shell-command-on-region' stubbed)
+;;   - `cj/--webdev-format-args'    (pure: file -> ("--stdin-filepath" file))
+;;   - `cj/webdev-format-buffer'    (interactive wrapper; `executable-find' and
+;;                                   `call-process-region' stubbed)
+;;
+;; The formatter now runs prettier via `call-process-region' with an
+;; explicit argv list (no shell), so there is no command string to quote.
 ;;
 ;; `cj/webdev-keybindings' (the C-; f mount) is already covered by
 ;; `test-prog-webdev--format-wiring.el'.
@@ -21,70 +24,102 @@
 (format-test--ensure-packages-init)
 (require 'prog-webdev)
 
-;; --------------------------- cj/--webdev-format-command ----------------------
+;; --------------------------- cj/--webdev-format-args -------------------------
 
-(ert-deftest test-prog-webdev--format-command-normal ()
-  "Normal: a plain .ts path yields the stdin-filepath prettier command."
-  (should (equal "prettier --stdin-filepath /home/me/app.ts"
-                 (cj/--webdev-format-command "/home/me/app.ts"))))
+(ert-deftest test-prog-webdev--format-args-normal ()
+  "Normal: a plain .ts path yields the stdin-filepath argv list."
+  (should (equal '("--stdin-filepath" "/home/me/app.ts")
+                 (cj/--webdev-format-args "/home/me/app.ts"))))
 
-(ert-deftest test-prog-webdev--format-command-spaces-quoted ()
-  "Boundary: a path with spaces is shell-quoted."
-  (should (equal (format "prettier --stdin-filepath %s"
-                         (shell-quote-argument "/home/me/my app/index.tsx"))
-                 (cj/--webdev-format-command "/home/me/my app/index.tsx"))))
+(ert-deftest test-prog-webdev--format-args-spaces-not-quoted ()
+  "Boundary: a path with spaces is passed verbatim — argv needs no quoting."
+  (should (equal '("--stdin-filepath" "/home/me/my app/index.tsx")
+                 (cj/--webdev-format-args "/home/me/my app/index.tsx"))))
 
-(ert-deftest test-prog-webdev--format-command-tsx-extension ()
+(ert-deftest test-prog-webdev--format-args-tsx-extension ()
   "Boundary: a .tsx path is passed through (prettier infers the parser)."
-  (should (equal "prettier --stdin-filepath /x/Component.tsx"
-                 (cj/--webdev-format-command "/x/Component.tsx"))))
+  (should (equal '("--stdin-filepath" "/x/Component.tsx")
+                 (cj/--webdev-format-args "/x/Component.tsx"))))
 
 ;; ---------------------------- cj/webdev-format-buffer ------------------------
 
 (ert-deftest test-prog-webdev-format-buffer-runs-prettier-on-the-file ()
-  "Normal: with prettier on PATH, the region command targets `buffer-file-name'."
-  (let (cmd)
+  "Normal: with prettier on PATH, the argv targets `buffer-file-name'."
+  (let (program args)
     (cl-letf (((symbol-function 'executable-find) (lambda (_p) "/usr/bin/prettier"))
-              ((symbol-function 'shell-command-on-region)
-               (lambda (_start _end command &rest _) (setq cmd command))))
+              ((symbol-function 'call-process-region)
+               (lambda (_start _end prog &rest rest)
+                 ;; rest = (DELETE BUFFER DISPLAY &rest ARGS)
+                 (setq program prog
+                       args (nthcdr 3 rest))
+                 0)))
       (with-temp-buffer
         (insert "const x=1\n")
         (setq buffer-file-name "/home/me/app.ts")
         (cj/webdev-format-buffer)
         (setq buffer-file-name nil)))
-    (should (equal (cj/--webdev-format-command "/home/me/app.ts") cmd))))
+    (should (equal "prettier" program))
+    (should (equal '("--stdin-filepath" "/home/me/app.ts") args))))
 
 (ert-deftest test-prog-webdev-format-buffer-falls-back-to-file-ts ()
   "Boundary: a buffer with no file uses the \"file.ts\" filename hint."
-  (let (cmd)
+  (let (args)
     (cl-letf (((symbol-function 'executable-find) (lambda (_p) "/usr/bin/prettier"))
-              ((symbol-function 'shell-command-on-region)
-               (lambda (_start _end command &rest _) (setq cmd command))))
+              ((symbol-function 'call-process-region)
+               (lambda (_start _end _prog &rest rest)
+                 (setq args (nthcdr 3 rest))
+                 0)))
       (with-temp-buffer
         (insert "const x=1\n")
         (should-not buffer-file-name)
         (cj/webdev-format-buffer)))
-    (should (equal (cj/--webdev-format-command "file.ts") cmd))))
+    (should (equal '("--stdin-filepath" "file.ts") args))))
 
 (ert-deftest test-prog-webdev-format-buffer-clamps-point-to-point-max ()
   "Boundary: after a format that shrinks the buffer, point clamps to point-max."
   (cl-letf (((symbol-function 'executable-find) (lambda (_p) "/usr/bin/prettier"))
-            ((symbol-function 'shell-command-on-region)
-             (lambda (_start _end _command &rest _)
-               (delete-region (point-min) (point-max))
-               (insert "x"))))
+            ((symbol-function 'call-process-region)
+             (lambda (_start _end _prog _delete buffer &rest _)
+               ;; Simulate prettier writing a shorter result to the output buffer.
+               (with-current-buffer buffer (insert "x"))
+               0)))
     (with-temp-buffer
       (insert "a really long original buffer body that prettier will shorten\n")
       (goto-char 40)
       (cj/webdev-format-buffer)
       (should (= (point) (point-max))))))
 
+(ert-deftest test-prog-webdev-format-buffer-replaces-on-success ()
+  "Normal: a zero exit replaces the buffer with the formatter's output."
+  (cl-letf (((symbol-function 'executable-find) (lambda (_p) "/usr/bin/prettier"))
+            ((symbol-function 'call-process-region)
+             (lambda (_start _end _prog _delete buffer &rest _)
+               (with-current-buffer buffer (insert "const x = 1;\n"))
+               0)))
+    (with-temp-buffer
+      (insert "const x=1\n")
+      (cj/webdev-format-buffer)
+      (should (string= (buffer-string) "const x = 1;\n")))))
+
+(ert-deftest test-prog-webdev-format-buffer-no-clobber-on-failure ()
+  "Error: a non-zero exit leaves the buffer untouched and signals an error."
+  (cl-letf (((symbol-function 'executable-find) (lambda (_p) "/usr/bin/prettier"))
+            ((symbol-function 'call-process-region)
+             (lambda (_start _end _prog _delete buffer &rest _)
+               (with-current-buffer buffer (insert "[error] syntax error"))
+               1)))
+    (with-temp-buffer
+      (insert "const x=1\n")
+      (should-error (cj/webdev-format-buffer) :type 'user-error)
+      ;; Buffer must still hold the original source, not the error text.
+      (should (string= (buffer-string) "const x=1\n")))))
+
 (ert-deftest test-prog-webdev-format-buffer-errors-without-prettier ()
   "Error: prettier missing -> `user-error', nothing shells out."
   (let ((ran nil))
     (cl-letf (((symbol-function 'executable-find) (lambda (_p) nil))
-              ((symbol-function 'shell-command-on-region)
-               (lambda (&rest _) (setq ran t))))
+              ((symbol-function 'call-process-region)
+               (lambda (&rest _) (setq ran t) 0)))
       (with-temp-buffer
         (should-error (cj/webdev-format-buffer) :type 'user-error)))
     (should-not ran)))
diff --git a/tests/test-prog-yaml--yaml-format-buffer.el b/tests/test-prog-yaml--yaml-format-buffer.el
index 4e928a2c..28ad351f 100644
--- a/tests/test-prog-yaml--yaml-format-buffer.el
+++ b/tests/test-prog-yaml--yaml-format-buffer.el
@@ -6,8 +6,39 @@
 ;;; Code:
 
 (require 'ert)
+(require 'cl-lib)
 (require 'prog-yaml)
 
+;;; argv path — process invocation (stubbed, no shell)
+
+(ert-deftest test-prog-yaml--yaml-format-buffer-invokes-prettier-argv ()
+  "Normal: with prettier present, the formatter calls it via argv, no shell."
+  (let (program args)
+    (cl-letf (((symbol-function 'executable-find) (lambda (_p) "/usr/bin/prettier"))
+              ((symbol-function 'call-process-region)
+               (lambda (_start _end prog &rest rest)
+                 (setq program prog
+                       args (nthcdr 3 rest))
+                 (with-current-buffer (nth 1 rest) (insert "key: value\n"))
+                 0)))
+      (with-temp-buffer
+        (insert "key: value\n")
+        (cj/yaml-format-buffer)))
+    (should (equal "prettier" program))
+    (should (equal '("--parser" "yaml") args))))
+
+(ert-deftest test-prog-yaml--yaml-format-buffer-no-clobber-on-failure ()
+  "Error: a non-zero prettier exit leaves the buffer untouched and errors."
+  (cl-letf (((symbol-function 'executable-find) (lambda (_p) "/usr/bin/prettier"))
+            ((symbol-function 'call-process-region)
+             (lambda (_start _end _prog _delete buffer &rest _)
+               (with-current-buffer buffer (insert "[error] bad yaml"))
+               1)))
+    (with-temp-buffer
+      (insert "key: : bad\n")
+      (should-error (cj/yaml-format-buffer) :type 'user-error)
+      (should (string= (buffer-string) "key: : bad\n")))))
+
 ;;; Normal Cases
 
 (ert-deftest test-prog-yaml--yaml-format-buffer-normal-fixes-indentation ()