Add null, blank and example-specific UTF-16 length checks to the English and Japanese login snippets before AuthService. Preserve credential bytes, authentication-failure behavior and the existing successful-session flow. Label the 256/1024 limits as application examples rather than tinystruct defaults.
Compile and execute exact extracted methods against controlled request/auth/session stubs with ephemeral official checksum-verified Temurin17. Baseline: 8 pass,20 fail. Candidate:28 pass,0 fail. Tagged Request API and Java17 target verified. Markdownlint, Unicode and diff checks pass. Root independently reviewed both documents. No full HTTP host, real authentication service, cookie-policy or envelope changes claimed; registry rebound remains root-owned.
Correct the English and Japanese static-file guidance against tinystruct v1.7.37 commit 089ec19022f3bb5d87f1e83e30b2034b24f7e77f. The configured-root exclusion uses lexical normalized paths before symlink resolution, and matching static candidates return before the later project-root-file check. Recommend real dedicated public directories without claiming an upstream security repair.
Verified the exact tagged HttpServer blob 58ff6ae082f7569e73207c9cb4614f680c9d3de7 and eight disposable POSIX filesystem path controls. Java is unavailable, so no Java or HTTP runtime verification is claimed. Changed Markdownlint, Unicode safety and diff checks pass. Parent independently reviewed both documents and the source evidence. Registry rebinding remains with the combined integration.
Verify context fallback order against transcript-context and passing 55-case workflow suite. Ground CLI injection guidance in tinystruct v1.7.37 Action.getArguments, CommandLine and ApplicationManager at 089ec19022f3bb5d87f1e83e30b2034b24f7e77f. Markdown lint and Pi projection check pass; preserve explicit Pi exclusions.
Preserve PR #3758 source head deec267f07. Correct the static-root policy against tagged upstream 089ec19022f3bb5d87f1e83e30b2034b24f7e77f: current directory and ancestors are rejected, while configured siblings are permitted. Independent EN/JA source review and Markdown lint passed.
Limit the CLI-first testing guidance to transport-neutral and Mode.CLI actions
in How It Works, When to Use, Best Practices and Red Flags, since actions with
an HTTP mode are rejected from the CLI and must be tested over HTTP.
Also document how FileHandler resolves a relative pattern, what limit, count
and %g mean, the enable steps, and list its level, formatter and encoding
properties in the config example. The ja-JP translation is updated to match.
Fix the FileHandler description: pattern is optional and defaults to
%h/java%u.log, with the parent directory created if missing. Also document
logging.enabled, the accepted logging.level values and aliases, custom
Handler/Formatter classes, the logger-level versus handler-level gates, and
that the configuration is read once at startup. Add a Red Flags row for
debug messages that never appear. The ja-JP translation is updated to match.
Bump the pinned upstream version to 1.7.37 and document what changed in
the framework since 1.7.34:
- Logging: the 'handlers' property (default ConsoleHandler) and the
opt-in FileHandler with its pattern/limit/count/append options
(1.7.36).
- Static files: HttpServer now serves only server.static.dirs /
server.static.dir (default 'static') and rejects traversal, hidden
files and project-root files (1.7.37).
- Dual-mode wording: only Mode.DEFAULT actions are reachable from both
CLI and HTTP; actions bound to Mode.CLI or an HTTP method are rejected
from the other transport (ApplicationManager.call).
- Login example now checks credentials instead of storing a hard-coded
user id in the session.
- Red Flags rows for the new failure modes.
The ja-JP translation is updated to match. The frontmatter description
is unchanged.
Add metadata.upstream: tinystruct==1.7.34 to both the English skill and
its Japanese translation, so a future sync can mechanically diff the
pinned version against the current tinystruct release instead of
rediscovering drift from prose. Also migrates the legacy top-level
`origin: ECC` key into the metadata block, matching the schema used by
the rest of the skills in this repo (tests/commands/learn-skill-discovery.test.js
already asserts top-level `origin:` is unsupported).
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Sync skills/tinystruct-patterns against tinystruct's own canonical copy of
this skill (.agents/skills/tinystruct-patterns/), which the framework repo
keeps up to date with each release:
- Document the bin/dispatcher / bin/dispatcher.cmd launcher generation
workflow (never hand-write or copy it; the framework generates it via
ApplicationManager.init()).
- Add native MCP server/tool integration (org.tinystruct.mcp.*), including
the prompt-injection warning for tool return values and overloaded-tool
schema merging.
- Add annotation-based DB mapping (@Table/@Id/@Column) alongside XML
mapping, the --mapping annotation generator flag, and table
auto-creation via database.autocreate.
- Add the programmatic logging/diagnostics subsystem (ANSI console colors,
StackWalker-based caller tracing, per-package level overrides).
- Update the architecture package map accordingly.
Also update the Japanese translation (docs/ja-JP/skills/tinystruct-patterns)
to match, which had drifted to an older, condensed version of this skill.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
haelyra