Please make a different return codes for bitcoin client when sending coins from command line.

Now amount error and address error have equal return codes and becomes difficult to distinguish error while writing a high-level interface.

Not agree with you.

JSON-RPC provides too many permissions. For webshop you need only address generation and info about receiving coins to address. JSON-RPC will provide an opportunity after site hack steal coins through it with website's uid.

That is, you still need a wrapper that implenets only the necessary functions and that changes the uid (by sudo or suid)

Ummm, the command-line RPC is implemented on top of the JSON-RPC mechanism.

So if the command-line RPC is working on your machine, then the JSON-RPC is, too.