This is an automated email from the ASF dual-hosted git repository.
cziegeler pushed a commit to branch master
in repository
https://gitbox.apache.org/repos/asf/sling-org-apache-sling-scripting-core.git
The following commit(s) were added to refs/heads/master by this push:
new 63052ea docs: expand README and AGENTS.md with module overview and
console plugin guidance (#40)
63052ea is described below
commit 63052eaa12f9a0950ef4fb749c8fb05c97dc3b1d
Author: Carsten Ziegeler <[email protected]>
AuthorDate: Thu Jul 16 17:59:39 2026 +0200
docs: expand README and AGENTS.md with module overview and console plugin
guidance (#40)
Co-authored-by: Maia <maia@noreply>
---
AGENTS.md | 18 ++++++++++++++++++
CLAUDE.md | 1 +
README.md | 32 +++++++++++++++++++++++++++++++-
3 files changed, 50 insertions(+), 1 deletion(-)
diff --git a/AGENTS.md b/AGENTS.md
index d85db58..1af50ae 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -4,3 +4,21 @@
The threat model for this project is
https://github.com/apache/sling/blob/master/docs/threat-model.md .
<!-- sling-security-default:end -->
+## Console plugin hardening
+
+Recent console plugin updates introduced stricter servlet error handling
patterns in:
+
+-
`src/main/java/org/apache/sling/scripting/core/impl/ScriptCacheConsolePlugin.java`
+-
`src/main/java/org/apache/sling/scripting/core/impl/ScriptingVariablesConsolePlugin.java`
+
+When changing Web Console servlets in this module:
+
+- Wrap `doGet` / `doPost` logic in narrow `try/catch` blocks for checked and
runtime failures relevant to the method body.
+- Log the failure with contextual messages, and send explicit `500` responses
when possible (only if the response is not already committed).
+- For classpath resource streaming, null-check resource streams and return
`404` when the resource is missing.
+- Keep existing authorization and request validation behavior intact; fail
closed with explicit HTTP error codes.
+
+## Dependencies, commands, and structure
+
+- No new build/test commands were introduced by the recent console plugin fix.
+- No new module-level dependencies or repository structure changes were
introduced.
diff --git a/CLAUDE.md b/CLAUDE.md
new file mode 100644
index 0000000..9a80b01
--- /dev/null
+++ b/CLAUDE.md
@@ -0,0 +1 @@
+read @AGENTS.md
diff --git a/README.md b/README.md
index da10db8..459d5e9 100644
--- a/README.md
+++ b/README.md
@@ -6,4 +6,34 @@
This module is part of the [Apache Sling](https://sling.apache.org) project.
-Sling Scripting core functionality
+The Apache Sling Scripting Core bundle provides core scripting runtime
functionality for Sling, including script engine integration, script caching,
bindings support, and bundled script handling.
+
+## Current baseline
+
+- Java 17 (`<sling.java.version>17</sling.java.version>`)
+- Parent POM: `org.apache.sling:sling-bundle-parent:66`
+- Current module version: `3.0.3-SNAPSHOT`
+
+## Servlet API support
+
+This module supports both servlet namespaces used in Sling deployments:
+
+- `javax.servlet-api` 4.0.1
+- `jakarta.servlet-api` 6.1.0
+
+Recent updates include Jakarta-oriented scripting context handling fixes and
hardened Web Console plugin error handling.
+
+## Build and test
+
+Run a full local build (including unit and integration tests):
+
+```bash
+mvn clean verify
+```
+
+## Repository structure
+
+- `src/main/java` - production code
+- `src/main/resources` - OSGi metadata and resources
+- `src/test/java` - unit and integration tests
+- `src/test/resources` - test resources
