From 1ca28f229eb360498b93bd048ef745f32f7761e1 Mon Sep 17 00:00:00 2001
From: Craig Jennings <c@cjennings.net>
Date: Mon, 25 May 2026 18:05:55 -0500
Subject: refactor(prog): run JSON/YAML/webdev formatters via argv, not a shell
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

cj/json-format-buffer, cj/yaml-format-buffer, and cj/webdev-format-buffer ran their formatters through shell-command-on-region, which goes via a shell. I moved each to call-process-region with an explicit program and argv list, so a filename or buffer content can't be word-split or read as shell syntax. The webdev path dropped its shell-quote-argument dance once the filename became a plain argv element.

Point preservation is unchanged. One deliberate improvement, and it's tested: shell-command-on-region with replace replaced the buffer with the formatter's error text on a non-zero exit. The new per-formatter helper captures output to a temp buffer, checks the exit code, replaces only on success, and otherwise raises a user-error carrying stderr — so a failed format leaves the buffer alone.

I kept a small format-region helper in each of the three modules rather than one shared helper. They have no common module to live in short of system-lib, and coupling three unrelated domain modules through it wasn't worth saving sixteen lines.
---
 modules/prog-json.el | 29 ++++++++++++++++++++++++++---
 1 file changed, 26 insertions(+), 3 deletions(-)

(limited to 'modules/prog-json.el')

diff --git a/modules/prog-json.el b/modules/prog-json.el
index 7b49dff1..953b5f79 100644
--- a/modules/prog-json.el
+++ b/modules/prog-json.el
@@ -41,15 +41,38 @@
 ;; -------------------------------- Formatting ---------------------------------
 ;; pretty-print with sorted keys, bound to standard format key
 
+(defun cj/--json-format-region (program &rest args)
+  "Replace the buffer with PROGRAM ARGS run over its contents, via argv.
+Runs PROGRAM (with ARGS) on the whole buffer through
+`call-process-region' — no shell, so no quoting or word-splitting.
+The buffer is replaced only when PROGRAM exits zero; on a non-zero
+exit the buffer is left untouched and an error is signalled with
+the program's stderr text.  Point is preserved as closely as the
+reformatted size allows.  Returns t on success."
+  (let* ((point (point))
+         (src (current-buffer))
+         (out (generate-new-buffer " *json-format-out*"))
+         (status (apply #'call-process-region
+                        (point-min) (point-max) program
+                        nil out nil args)))
+    (unwind-protect
+        (if (and (integerp status) (zerop status))
+            (progn
+              (with-current-buffer src
+                (replace-buffer-contents out)
+                (goto-char (min point (point-max))))
+              t)
+          (user-error "%s failed: %s" program
+                      (string-trim (with-current-buffer out (buffer-string)))))
+      (kill-buffer out))))
+
 (defun cj/json-format-buffer ()
   "Format the current JSON buffer with sorted keys.
 Uses jq if available for reliable formatting, otherwise falls
 back to the built-in `json-pretty-print-buffer-ordered'."
   (interactive)
   (if (executable-find "jq")
-      (let ((point (point)))
-        (shell-command-on-region (point-min) (point-max) "jq --sort-keys ." nil t)
-        (goto-char (min point (point-max))))
+      (cj/--json-format-region "jq" "--sort-keys" ".")
     (json-pretty-print-buffer-ordered)))
 
 (defun cj/json-setup ()
-- 
cgit v1.2.3