v17.0.28

17.0.28 (2026-09-21)

Bug Fixes

• agent-defs-rust: admit ACP server flags by value presence (f59e60d)
• agent-hook-config-rust: lock skill fingerprint dependency (caa5cf3)
• agent-skill-config-rust: retain non-Error filesystem failures (147b5da)
• auth-store-rust: lock credential transactions across owners (8c3f715)
• auth-store: retain original lock acquisition signals (1ee1914)
• config-extends-rust: support nested addon embedding (3bbe07d)
• config-mutations-rust: match current TOML SDK diagnostics (a5827f1)
• config-mutations-rust: match locked TOML reference diagnostics (792b883)
• frontmatter-rust: show source context for unfinished flow collections (403cb7b)
• mcp-oauth-rust: accept optional browser opener (3719ea4)
• mcp-oauth-rust: align owned cancellation and issuer contracts (06afee9)
• mcp-oauth-rust: bind and preserve imported grants (722bcdf)
• mcp-oauth-rust: bind cached tokens to static client (43d5908)
• mcp-oauth-rust: capture hidden landing-page fields (e21798c)
• mcp-oauth-rust: classify malformed endpoint rejections safely (d41f9ec)
• mcp-oauth-rust: complete the public root API surface (0b2a5e7)
• mcp-oauth-rust: correlate rejected grant provenance (5c84aca)
• mcp-oauth-rust: enforce configured grant scopes (9313310)
• mcp-oauth-rust: isolate and lock persisted profiles (93208b2)
• mcp-oauth-rust: isolate explicitly configured dynamic grants (08bd41f)
• mcp-oauth-rust: negotiate JSON credential endpoint responses (40d6065)
• mcp-oauth-rust: preserve browser and configured client policies (22f7c48)
• mcp-oauth-rust: preserve hidden resource lock options (74ac1b3)
• mcp-oauth-rust: preserve persistence and live clock ownership (886c8f1)
• mcp-oauth-rust: preserve standalone embedded OAuth modules (9d8bade)
• mcp-oauth-rust: preserve stored registration metadata (86b332b)
• mcp-oauth-rust: reconcile callback lifecycle contracts (b89dafb)
• mcp-oauth-rust: reconcile canonical OAuth scope contracts (4657d5d)
• mcp-oauth-rust: reconcile registration metadata integration (2fe9d20)
• mcp-oauth-rust: refuse corrupt persisted grants (606e332)
• mcp-oauth-rust: retain provider registration and scope metadata (731a943)
• mcp-oauth-rust: return owned authorized token snapshots (80a63c2)
• mcp-oauth-rust: serialize refresh recovery and cancellation (7dd3410)
• mcp-oauth-rust: settle canceled host HTTP requests (03eea69)
• mcp-oauth: bind dynamic cached grants to explicit clients (a2e5a41)
• mcp-oauth: capture grants before invoking host clocks (0e2bdaf)
• mcp-oauth: capture native persistence settings (f7b88d6)
• mcp-oauth: capture provider authentication policies (26d3f3e)
• mcp-oauth: capture standalone loopback options at entry (b071e2e)
• mcp-oauth: copy persistence settings before backend callbacks (7047839)
• mcp-oauth: correlate rejected requests with presented grants (32ce489)
• mcp-oauth: enforce registration issuer and secret expiry (bbf728b)
• mcp-oauth: fail closed on corrupt persisted credentials (1223fe3)
• mcp-oauth: isolate explicitly requested scope profiles (23730d3)
• mcp-oauth: negotiate JSON registration and token responses (8705a21)
• mcp-oauth: own callback waits and preserve fixed redirects (a5c5525)
• mcp-oauth: own discovery metadata from loaded sessions (dded126)
• mcp-oauth: own request metadata and rejected grant provenance (d187758)
• mcp-oauth: preserve declared browser policies (ab4cfef)
• mcp-oauth: preserve declared callback page text (622ec09)
• mcp-oauth: preserve native registration redirect identity (ab99e01)
• mcp-oauth: preserve original import clock ownership (f26981d)
• mcp-oauth: quarantine refresh grants with uncertain outcomes (edec88d)
• mcp-oauth: recognize native errors across bundled copies (a944c96)
• mcp-oauth: reconcile resource identities only while locked (b1b3412)
• mcp-oauth: reject ambiguous callback parameters (050cf80)
• mcp-oauth: reject cached grants from other client configurations (5e0b280)
• mcp-oauth: reject empty native flow fragments (68203f0)
• mcp-oauth: reject empty redirect fragments (2a15092)
• mcp-oauth: reject malformed client HTTP errors promptly (7067838)
• mcp-oauth: reject malformed explicit refresh responses (79ceba0)
• mcp-oauth: reject unusable access tokens with safe diagnostics (64b005a)
• mcp-oauth: reserve all recognized callback query fields (bf758d1)
• mcp-oauth: retain configured app during consent (934c556)
• mcp-oauth: retain declared persistence dependencies (9babbe8)
• mcp-oauth: retain imported registration ownership (e4d5ce0)
• mcp-oauth: retain live browser method receivers (ffb42c6)
• mcp-oauth: retain native recovery lock policies (c995f28)
• mcp-oauth: retain native resource callback signals (024b595)
• mcp-oauth: retain the selected persistence backend (0ec0478)
• mcp-oauth: retire credentials across named resource URL changes (2c63d11)
• mcp-oauth: serialize complete shared-store transactions (b16a15d)
• mcp-oauth: serve callback failures as explicit plain text (d2e0b06)
• mcp-oauth: settle canceled host HTTP requests (d219183)
• mcp-oauth: settle cancellation while persistence waits (dc38006)
• mcp-oauth: validate native issuer identities (f1544a2)
• mcp-oauth: validate persisted fragment boundaries (ea551c4)
• mcp-oauth: validate redirect and import inputs before setup (c067efb)
• mcp-oauth: validate relative lifetime anchors (793f8bf)
• mcp-oauth: validate runtime expiry clocks (00e62a8)
• packaging: retain published self contract references (542091c)
• process-runner-rust: isolate filesystem fixtures in root tests (6a082b4)
• rust: align development SDK pins with the lockfile (ae6be11)
• safe-bash-mcp: align authentication reset with captured binding (e4d8ef0)
• safe-bash-mcp: capture artifact command policies before binding (bb0fd2f)
• safe-bash-mcp: capture artifact generation policies (34f4334)
• safe-bash-mcp: capture binding session factory selection (ba0520d)
• safe-bash-mcp: capture import credentials before host clocks (9cae5ee)
• safe-bash-mcp: capture nested binding OAuth policies (1326a9e)
• safe-bash-mcp: capture registry credential values before callbacks (1351cea)
• safe-bash-mcp: capture resource policies before binding (19361ff)
• safe-bash-mcp: expose auth response policy (c648847)
• safe-bash-mcp: expose bounded import policies (5d71977)
• safe-bash-mcp: expose discovery and resource timeouts (e2bb004)
• safe-bash-mcp: expose generation policy limits (470cd7a)
• safe-bash-mcp: expose resource byte limits (b0f7ee7)
• safe-bash-mcp: expose tool execution policies (ca05b74)
• safe-bash-mcp: preflight OAuth access token imports (cb22928)
• safe-bash-mcp: preserve declared binding ceilings (22eaafa)
• safe-bash-mcp: preserve declared registry fields (5569d67)
• safe-bash-mcp: preserve imported OAuth timing values (76989c2)
• safe-bash-mcp: preserve native OAuth client policies (f7da104)
• safe-bash-mcp: preserve native OAuth policy options (28fe0e6)
• safe-bash-mcp: reject empty registry fragments (dd841d9)
• safe-bash-mcp: retain artifact generation policies (5245996)
• safe-bash-mcp: retain artifact validation registries (37e634b)
• safe-bash-mcp: retain auth and reset option handles (4d5483b)
• safe-bash-mcp: retain command defaults and byte ceilings (5cec309)
• safe-bash-mcp: retain credential hook result identities (b8cca7a)
• safe-bash-mcp: retain credential import persistence ownership (57feef1)
• safe-bash-mcp: retain credential recovery policies (14d8674)
• safe-bash-mcp: retain declared schema operation policies (3e2226a)
• safe-bash-mcp: retain explicit auth opt-ins and observers (bfba27c)
• safe-bash-mcp: retain host binding policies (96d0854)
• safe-bash-mcp: retain HTTP error phase metadata (496cf4c)
• safe-bash-mcp: retain import signal and fetch handles (e371132)
• safe-bash-mcp: retain original credential reflection guards (3b12ed4)
• safe-bash-mcp: retain resource OAuth through SSE fallback (a90bc14)
• safe-bash-mcp: retain server instructions in generated help (25a3175)
• safe-bash-mcp: settle canceled host credential imports (1b92390)
• safe-bash-mcp: snapshot compiled tool identity (7336fa8)
• safe-bash-mcp: snapshot registry OAuth configuration (3694bfb)
• safe-bash-mcp: snapshot schema discovery inputs (75d3bc2)
• safe-bash-mcp: summarize metadata HTTP failures safely (00dc480)
• safe-bash-mcp: validate static headers without reflection (df2b61c)
• safe-bash-mcp: withhold reflected OAuth callback diagnostics (dd62fed)
• safe-bash-mcp: withhold reflected OAuth error credentials (57b6f86)
• safe-bash-mcp: withhold reflected OAuth metadata diagnostics (a325a20)
• safe-bash: attach named sessions through environment defaults (1a0540b)
• safe-playwright-cloudflare: stop fixture relay sends after close (fa3ed07)
• safe-playwright-cloudflare: support Bun native lifecycle fixtures (ab815c5)
• terminal-pilot-rust: identify invalid command key values (f55df66)
• terminal-pilot-rust: preserve final output at process exit (222cc72)
• tiny-mcp-client-rust: complete legacy initialization before ready (6c9214a)
• tiny-mcp-client-rust: preserve pins and exchange deadlines (7b83466)
• tiny-mcp-client-rust: preserve primary initialization failures (2096f50)
• tiny-mcp-client-rust: restore HTTP transport contracts (c1ae753)
• tiny-mcp-client-rust: restore native reference compatibility (042a0f3)
• tiny-mcp-client-rust: retain hidden call option fields (011d958)
• tiny-mcp-client-rust: retain negotiated legacy revisions (d2e4257)
• tiny-mcp-client: await HTTP initialization completion (a9fa5e9)
• tiny-mcp-client: bound complete input exchanges (27e41b5)
• tiny-mcp-client: bypass cache reads for explicit metadata (e2712c3)
• tiny-mcp-client: cancel originating OAuth operations (f09f546)
• tiny-mcp-client: encode SSE resume cursors as UTF-8 (ef4e667)
• tiny-mcp-client: honor explicit protocol pins (841d707)
• tiny-mcp-client: negotiate supported legacy revisions (e296d0d)
• tiny-mcp-client: own headers before OAuth callbacks (dfc783f)
• tiny-mcp-client: own tool-call options through completion (1ababce)
• tiny-mcp-client: preserve HTTP failure status and method (2f34139)
• tiny-mcp-client: preserve initialization POST failures (d768e0a)
• tiny-mcp-client: reject advertised resource fragments (76f5498)
• tiny-mcp-client: reject ambiguous Bearer challenges (f7fa6d4)
• tiny-mcp-client: reject empty SSE endpoint fragments (549fd24)
• tiny-mcp-client: reject overflowing request deadlines (da01504)
• tiny-mcp-client: retain and reset SSE receive cursors (8aa39a8)
• tiny-mcp-client: retain failures through session cleanup (46de982)
• tiny-mcp-client: retain final handshake close reason (f4a38cd)
• tiny-mcp-client: settle failures before metadata cleanup (d2371c2)
• tiny-mcp-client: settle OAuth cache cancellation promptly (dba087b)
• tiny-mcp-client: validate discovery URL components (908a33d)
• tiny-mcp-client: validate original HTTP targets (f969f7e)
• toolcraft-design-rust: expose line buffer factories at SDK root (c38d76c)
• toolcraft-schema: project schema dependency fields (9d62ada)
• workspaces: include safe-bash MCP development dependency (21b6be8)
• workspaces: register safe-bash MCP test dependency (90fd872)

Features

• agent-defs-rust: add declarative MCP descriptors to agent definitions (e078bfe)
• agent-defs-rust: declare spawn behavior in provider files (bce7deb)
• agent-defs-rust: derive hook support from declarative agent descriptors (92ad8b6)
• agent-defs-rust: derive skill directories from declarative agent descriptors (7d4361a)
• agent-harness-tools-rust: add command execution and sessions (977b076)
• agent-harness-tools-rust: add execution factory registry (be75710)
• agent-harness-tools-rust: add managed log streaming (a7a62ea)
• agent-harness-tools-rust: add persistent live queue foundation (f9269f8)
• agent-harness-tools-rust: add plan discovery and archive (0d614bf)
• agent-harness-tools-rust: add portable binary probes (5632de4)
• agent-harness-tools-rust: add safe run log directories (4dbcb2d)
• agent-harness-tools-rust: add workflow document discovery (4b063bd)
• agent-harness-tools-rust: expose owned workspace transfer (45c27af)
• agent-harness-tools-rust: resolve runtime command execution (8e1f803)
• agent-hook-config-rust: add portable hook transformation and atomic file policies (42b1e66)
• agent-hook-config-rust: add same-format symlink bridging and rollback (5d49c1e)
• agent-hook-config-rust: expose native hook transformation and file APIs (4f3a865)
• agent-hook-config-rust: own overlapping hook bridge lifecycles (ad89df3)
• agent-mcp-config-rust: add compatible MCP configuration policies and native execution (49c47a5)
• agent-skill-config-rust: add native installation and bundled configuration (d2c9454)
• agent-skill-config-rust: add native skill resolution and Git exclude policies (e7a9639)
• agent-skill-config-rust: own active skill bridge lifecycles (804351e)
• agent-spawn-rust: add bounded parallel scheduling (0e07621)
• agent-spawn-rust: add declarative launch planning (753e96c)
• agent-spawn-rust: add independent command execution (98234a0)
• agent-spawn-rust: add native stream framing and middleware (7efd291)
• agent-spawn-rust: capture native OpenTelemetry (28e3bee)
• agent-spawn-rust: capture sessions and observed usage (c961a5b)
• agent-spawn-rust: convert ACP session updates independently (eba871f)
• agent-spawn-rust: discover and select saved agent runs (8831f98)
• agent-spawn-rust: embed run resource bridges (8a99ba6)
• agent-spawn-rust: embed runtime environments (7911f1b)
• agent-spawn-rust: execute ACP sessions with owned protocol client (ff52bcc)
• agent-spawn-rust: execute CLI agents through owned runtimes (11dd00b)
• agent-spawn-rust: execute interactive agents with owned runtimes (6011190)
• agent-spawn-rust: implement independent stream adapters (6b561be)
• agent-spawn-rust: implement native retry lifecycle (ab1aa9f)
• agent-spawn-rust: share autonomous timeout retry policy (7e5b60c)
• agent-spawn-rust: stream agent events and retry executions (eddb3ac)
• agent-spawn-rust: stream and decode saved agent logs (fec3c2d)
• agent-spawn-rust: summarize tool actions without shell dependencies (76cabb7)
• agent-spawn-rust: write redacted spawn logs safely (493903b)
• auth-store-rust: expose pure backend selection (20c07af)
• auth-store: lock persisted credential transactions across processes (eb5e1c4)
• config-extends-rust: add portable document parsing and extends admission (e927d33)
• config-extends-rust: add portable owned merge and prompt composition cores (ae27600)
• config-extends-rust: add rooted prompt document resolution (71f761c)
• config-extends-rust: add runtime-free async native resolver APIs (f52fdc7)
• config-extends-rust: add standalone native document and compatible merge adapters (28e1945)
• config-extends-rust: resolve owned base chains and prompt templates (f8c632b)
• config-mutations-rust: add atomic write policy and release terminal buffers (6567919)
• config-mutations-rust: add backups restore and declarative file factories (2a81dab)
• config-mutations-rust: add config execution and declarative factories (4f38ded)
• config-mutations-rust: add own YAML codec and native graph bindings (9aafc8f)
• config-mutations-rust: add template execution with embedded Rust renderer (b1312a0)
• config-mutations-rust: add testing API with Rust mock filesystem policy (2f73c53)
• config-mutations-rust: add YAML admission options for frontmatter (5f8c31f)
• config-mutations-rust: execute injected file mutations with Rust policy (3dfad96)
• config-mutations-rust: expose compatible root SDK and filesystem helpers (5cbb199)
• config-mutations-rust: expose YAML document syntax spans (77318eb)
• frontmatter-rust: add compatible YAML frontmatter parsing and serialization (5a7b20a)
• mcp-oauth-rust: add fixed-memory incremental SHA-256 (94d80ac)
• mcp-oauth-rust: bound credential JSON admission before copying (083ac18)
• mcp-oauth-rust: enforce grant scope isolation (f8cfebb)
• mcp-oauth-rust: enforce provider authentication method profiles (7ab4a11)
• mcp-oauth-rust: establish grants with explicit authentication (3ba1dec)
• mcp-oauth-rust: implement bounded registration metadata admission (9d433b7)
• mcp-oauth-rust: implement resource transaction queues (e7e507f)
• mcp-oauth-rust: implement token endpoint authentication plans (c39e11f)
• mcp-oauth-rust: import named client grants atomically (94cfa45)
• mcp-oauth-rust: normalize owned stored client registrations (76adb8d)
• mcp-oauth-rust: own durable resource credential identities (3daf42c)
• mcp-oauth-rust: parse bounded raw token grants (9b3c9c2)
• mcp-oauth-rust: preserve exact registration redirect identities (e10fe00)
• mcp-oauth-rust: preserve registration trust and caller ownership (9efe959)
• mcp-oauth: anchor imported relative token lifetimes (483a102)
• mcp-oauth: atomically import named OAuth sessions (73502c5)
• mcp-oauth: honor registered token authentication methods (88129ca)
• mcp-oauth: import resource-bound initial grants (1a968f2)
• mcp-oauth: isolate named credential persistence profiles (d52dab3)
• mcp-oauth: parse raw OAuth token grants (429e0ee)
• mcp-oauth: preserve full client registration metadata (e26ddc8)
• poe-acp-client-rust: add independent native ACP client (184aed2)
• poe-agent-rust: add Chat Completions provider (496ae8a)
• poe-agent-rust: add file tools and owned glob matching (cfd9328)
• poe-agent-rust: add independent provider resolution foundation (72325c3)
• poe-agent-rust: add memory compaction and context plugins (5598f45)
• poe-agent-rust: add owned OpenAI streaming transport (d14f07d)
• poe-agent-rust: add owned web and HTML conversion plugin (9f37539)
• poe-agent-rust: add plugin registry and configuration resolver (249c820)
• poe-agent-rust: add policy skills scratchpad and spawn plugins (bd4d62c)
• poe-agent-rust: add public builders and reusable sessions (7d0c774)
• poe-agent-rust: add Responses provider (3133d9a)
• poe-agent-rust: add shell policy and execution plugin (879c3a9)
• poe-agent-rust: assemble model streams and tool outcomes (b2d03ed)
• poe-agent-rust: complete public exports and Git context (a74a51f)
• poe-agent-rust: implement ACP replay and transcript persistence (80912d7)
• poe-agent-rust: implement hook dispatch and decision policies (62cba46)
• poe-agent-rust: implement hybrid ACP execution loop (e88ab95)
• poe-agent-rust: implement immutable configuration policies (4b48632)
• poe-agent-rust: implement independent history stores (152ca65)
• poe-agent-rust: implement independent session storage (ff44b88)
• poe-agent-rust: implement live prompt transformation pipelines (147ace9)
• poe-agent-rust: implement native tool registry policies (4d3f64f)
• poe-agent-rust: implement owned file awareness tracking (a6401cb)
• poe-agent-rust: implement plugin setup and embedded MCP tools (60ba94c)
• poe-agent-rust: implement run context disposal lifecycle (147cae1)
• poe-agent-rust: implement structured tool result policies (41ec2ca)
• poe-agent-rust: implement tool host forks and injected spawn (af2d00d)
• poe-agent-rust: reconstruct owned session history branches (4acbe53)
• poe-code-config-rust: add configured service migration (dc70cff)
• poe-code-config-rust: add job and template state registries (051ca9a)
• poe-code-config-rust: add owned static schema compiler (bfb1196)
• poe-code-config-rust: add scoped configuration foundation (580a51e)
• process-runner-rust: add deterministic workspace tar encoding (61d2e26)
• process-runner-rust: add Docker runtime template policies (9ad78d7)
• process-runner-rust: add native host execution policies (4a7fbad)
• process-runner-rust: add native mock replay lifecycle (698d768)
• process-runner-rust: add native workspace transfer policies (e71f187)
• process-runner-rust: add own build context ignore filtering (6363d0d)
• process-runner-rust: add persistent Docker environment policies (657f4de)
• process-runner-rust: add portable Docker execution policies (b710524)
• process-runner-rust: own Docker runner cancellation lifecycle (1c83ee8)
• providers-rust: add declarative provider registry and authentication policy (d93265a)
• safe-bash-mcp: add durable OAuth credential reset (07cefe1)
• safe-bash-mcp: add explicit headless authentication (32e5784)
• safe-bash-mcp: add remote schema discovery SDK (327c8b1)
• safe-bash-mcp: archive external schema documents reproducibly (038b6a3)
• safe-bash-mcp: bind explicit runtime credential environments (5afb11c)
• safe-bash-mcp: bind imported relative token lifetimes (e87fe3c)
• safe-bash-mcp: configure OAuth registration display names (0af50b0)
• safe-bash-mcp: expose native remote resource access (269b1fc)
• safe-bash-mcp: expose SDK in scoped safe-bash releases (a79c3ee)
• safe-bash-mcp: generate remote tool shell commands (b6d9931)
• safe-bash-mcp: generate reproducible remote schema artifacts (228488b)
• safe-bash-mcp: handle remote input through host hooks (a052202)
• safe-bash-mcp: import OAuth credentials from virtual input (3f9dab5)
• safe-bash-mcp: import original OAuth credentials atomically (e8beba7)
• safe-bash-mcp: initialize declarative credential configuration (6ad001c)
• safe-bash-mcp: inspect individual tool schemas offline (453c88c)
• safe-bash-mcp: negotiate legacy SSE without masking failures (ae97df0)
• safe-bash-mcp: parse tool arguments using native schemas (295bd09)
• safe-bash: support owner-scoped named browser attachment (c1786ce)
• task-list-rust: add bounded task migration (5dbbfbb)
• task-list-rust: add GitHub task backend and project sync (1b7449e)
• task-list-rust: add Markdown task storage (ffc8af5)
• task-list-rust: add source-preserving YAML task storage (92ac502)
• task-list-rust: add state machine and identity foundation (5d2630f)
• task-list-rust: package canonical task schemas (62b3153)
• terminal-pilot-mcp-rust: add standalone terminal automation server (addea70)
• terminal-pilot-rust: add display core and POSIX PTY transport (d61a014)
• terminal-pilot-rust: add named session runtime (f6c4035)
• terminal-pilot-rust: add native sessions and pilot lifecycle (d1a2572)
• terminal-pilot-rust: add validated automation commands (de12fd5)
• terminal-png-mcp-rust: add native image tool server (ad5133f)
• terminal-png-rust: add independent native terminal renderer (85595cd)
• tiny-http-mcp-oauth-test-server-rust: add native MCP OAuth fixture (0e6720b)
• tiny-mcp-client-rust: support typed SSE streams (e303ecf)
• tiny-mcp-client: support legacy remote SSE handshakes (da74f62)
• tiny-oauth-test-server-rust: add native OAuth fixture (8423dd2)
• toolcraft-design-rust: add own template engine and native bindings (a27c570)
• toolcraft-design-rust: buffer live dashboard lines transactionally (103b11c)
• toolcraft-design-rust: calculate dashboard geometry (f4e4480)
• toolcraft-design-rust: format coherent scoped logs (501f724)
• toolcraft-design-rust: format terminal checklists and scoped ACP output (4123d6b)
• toolcraft-design-rust: render ACP tool and usage activity (cf154ff)
• toolcraft-design-rust: render native colors and theme palettes (7d8ab31)
• toolcraft-design-rust: retain bounded streaming previews (469d311)
• toolcraft-schema: allow bounded JSON document budgets (4e82f37)
• toolcraft-schema: project native JSON Schema properties (9d8fcea)

Performance Improvements

• agent-hook-config-rust: serialize native transformation results once (a6db03c)
• config-extends-rust: retain admitted document trees in native resolution (2785bf8)
• poe-code-config-rust: parse stored documents in one crossing (e3b5f35)
• terminal-pilot-rust: spawn macOS PTYs without fork (1d2fdee)
• terminal-png-rust: bound compression searches and filter rows (a441529)
• toolcraft-design-rust: batch plain checklist data across native boundary (6e8baf8)
• toolcraft-design-rust: render owned data graphs without lookup callbacks (351ae95)