Address review: quote "$@", fail the README check closed, reword the ruff preview note

- scripts/test: forward arguments as "$@".
- scripts/update_readme_snippets.py: a per-block error now exits non-zero
  instead of printing and keeping the stale block, which let --check pass;
  the missing-file special case that worked around that goes away.
- pyproject.toml: say what lint.preview actually turns on.
- path_security docstring: the copy-paste example passes encoding= too.

Author: maxisbey

pyproject.toml

@@ -195,7 +195,8 @@ line-length = 120
 target-version = "py310"
 
 [tool.ruff.lint]
-# preview + explicit-preview-rules enables exactly one preview rule: PLW1514 (text I/O without encoding=).
+# lint.preview is required to select PLW1514 (text I/O without encoding=); it also opts the stable rules into their
+# preview behaviours and fixes. explicit-preview-rules only stops the prefixes below pulling in other preview rules.
 preview = true
 explicit-preview-rules = true
 extend-select = ["PLW1514"]

scripts/test

@@ -4,7 +4,7 @@ set -ex
 
 uv run --frozen coverage erase
 # PYTHONWARNDEFAULTENCODING=1 mirrors CI: text I/O without encoding= fails under pytest's "error" filter.
-PYTHONWARNDEFAULTENCODING=1 uv run --frozen coverage run -m pytest -n auto $@
+PYTHONWARNDEFAULTENCODING=1 uv run --frozen coverage run -m pytest -n auto "$@"
 uv run --frozen coverage combine
 uv run --frozen coverage report
 # strict-no-cover spawns `uv run coverage json` internally without --frozen;

scripts/update_readme_snippets.py

@@ -43,15 +43,7 @@ def process_snippet_block(match: re.Match[str], check_mode: bool = False) -> str
     file_path = match.group(2)
 
     try:
-        # Read the entire file. A missing source file must be fatal: a "Warning"
-        # that returns the stale block lets --check pass with exit 0, so a
-        # renamed or deleted snippet is invisible to CI. SystemExit deliberately
-        # escapes the `except Exception` below.
-        file = Path(file_path)
-        if not file.exists():
-            sys.exit(f"Error: snippet-source file not found: {file_path}")
-
-        code = file.read_text(encoding="utf-8").rstrip()
+        code = Path(file_path).read_text(encoding="utf-8").rstrip()
         github_url = get_github_url(file_path)
 
         # Build the replacement block
@@ -88,9 +80,9 @@ def process_snippet_block(match: re.Match[str], check_mode: bool = False) -> str
 
         return replacement
 
-    except Exception as e:
-        print(f"Error processing {file_path}: {e}")
-        return full_match
+    except OSError as e:
+        # Fatal, not "warn and keep the stale block": that would let --check pass with exit 0.
+        sys.exit(f"Error processing {file_path}: {e}")
 
 
 def update_readme_snippets(check_mode: bool = False) -> bool:

src/mcp/shared/path_security.py

@@ -12,7 +12,7 @@
 
     @mcp.resource("file://docs/{+path}")
     def read_doc(path: str) -> str:
-        return safe_join("/data/docs", path).read_text()
+        return safe_join("/data/docs", path).read_text(encoding="utf-8")
 """
 
 import string