From a44ee7111feed59c088b880782f02c50f897ca83 Mon Sep 17 00:00:00 2001
From: "stainless-app[bot]"
 <142633134+stainless-app[bot]@users.noreply.github.com>
Date: Sat, 18 Jul 2026 02:07:58 +0000
Subject: [PATCH 1/4] feat(stlc): configurable CI runner and
 private-production-repo support in workflow templates

---
 .github/workflows/ci.yml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 1556dd6..f5f1bb8 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -21,7 +21,7 @@ jobs:
   lint:
     timeout-minutes: 10
     name: lint
-    runs-on: ${{ github.repository == 'stainless-sdks/agentmail-cli' && 'depot-ubuntu-24.04' || 'ubuntu-latest' }}
+    runs-on: ${{ startsWith(github.repository, 'stainless-sdks/') && 'depot-ubuntu-24.04' || 'ubuntu-latest' }}
     if: (github.event_name == 'push' || github.event.pull_request.head.repo.fork) && (github.event_name != 'push' || github.event.head_commit.message != 'codegen metadata')
 
     steps:
@@ -48,7 +48,7 @@ jobs:
     permissions:
       contents: read
       id-token: write
-    runs-on: ${{ github.repository == 'stainless-sdks/agentmail-cli' && 'depot-ubuntu-24.04' || 'ubuntu-latest' }}
+    runs-on: ${{ startsWith(github.repository, 'stainless-sdks/') && 'depot-ubuntu-24.04' || 'ubuntu-latest' }}
     if: (github.event_name == 'push' || github.event.pull_request.head.repo.fork) && (github.event_name != 'push' || github.event.head_commit.message != 'codegen metadata')
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
@@ -95,7 +95,7 @@ jobs:
   test:
     timeout-minutes: 10
     name: test
-    runs-on: ${{ github.repository == 'stainless-sdks/agentmail-cli' && 'depot-ubuntu-24.04' || 'ubuntu-latest' }}
+    runs-on: ${{ startsWith(github.repository, 'stainless-sdks/') && 'depot-ubuntu-24.04' || 'ubuntu-latest' }}
     if: github.event_name == 'push' || github.event.pull_request.head.repo.fork
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

From 6a66ceb8d3b60367e956818d0dbccafa002b29e6 Mon Sep 17 00:00:00 2001
From: "stainless-app[bot]"
 <142633134+stainless-app[bot]@users.noreply.github.com>
Date: Mon, 20 Jul 2026 22:04:23 +0000
Subject: [PATCH 2/4] feat(api): api update

---
 .stats.yml                  | 4 ++--
 pkg/cmd/apikey.go           | 5 +++++
 pkg/cmd/apikey_test.go      | 4 +++-
 pkg/cmd/inboxapikey.go      | 5 +++++
 pkg/cmd/inboxapikey_test.go | 4 +++-
 pkg/cmd/podapikey.go        | 5 +++++
 pkg/cmd/podapikey_test.go   | 4 +++-
 7 files changed, 26 insertions(+), 5 deletions(-)

diff --git a/.stats.yml b/.stats.yml
index 5df686d..3674798 100644
--- a/.stats.yml
+++ b/.stats.yml
@@ -1,4 +1,4 @@
 configured_endpoints: 95
-openapi_spec_url: https://storage.googleapis.com/stainless-sdk-openapi-specs/agentmail/agentmail-710dd939e94b2dbb7a2d7ffae0f5dbc6bab5893c201299f452fcf39e7dbd886c.yml
-openapi_spec_hash: 4eb49916915aeac5a7897470322459d4
+openapi_spec_url: https://storage.googleapis.com/stainless-sdk-openapi-specs/agentmail/agentmail-de0e6b98063302dfd5d2764851feb9718d504c322e217df7e390b94f9ca69275.yml
+openapi_spec_hash: 25c26b19e1886ea1574a9da8402ec7df
 config_hash: 8c7283a75ec714092fa5f03087e28a65
diff --git a/pkg/cmd/apikey.go b/pkg/cmd/apikey.go
index 1f75a1e..9c632d6 100644
--- a/pkg/cmd/apikey.go
+++ b/pkg/cmd/apikey.go
@@ -49,6 +49,11 @@ var apiKeysCreate = requestflag.WithInnerFlags(cli.Command{
 			Usage:      "Read API keys.",
 			InnerField: "api_key_read",
 		},
+		&requestflag.InnerFlag[*bool]{
+			Name:       "permissions.api-key-update",
+			Usage:      "Update API keys.",
+			InnerField: "api_key_update",
+		},
 		&requestflag.InnerFlag[*bool]{
 			Name:       "permissions.domain-create",
 			Usage:      "Create domains.",
diff --git a/pkg/cmd/apikey_test.go b/pkg/cmd/apikey_test.go
index 2dd1fa4..d3f22a4 100644
--- a/pkg/cmd/apikey_test.go
+++ b/pkg/cmd/apikey_test.go
@@ -17,7 +17,7 @@ func TestAPIKeysCreate(t *testing.T) {
 			"--api-key", "string",
 			"api-keys", "create",
 			"--name", "name",
-			"--permissions", "{api_key_create: true, api_key_delete: true, api_key_read: true, domain_create: true, domain_delete: true, domain_read: true, domain_update: true, draft_create: true, draft_delete: true, draft_read: true, draft_send: true, draft_update: true, inbox_create: true, inbox_delete: true, inbox_read: true, inbox_update: true, label_blocked_read: true, label_spam_read: true, label_trash_read: true, list_entry_create: true, list_entry_delete: true, list_entry_read: true, message_read: true, message_send: true, message_update: true, metrics_read: true, pod_create: true, pod_delete: true, pod_read: true, thread_delete: true, thread_read: true, webhook_create: true, webhook_delete: true, webhook_read: true, webhook_update: true}",
+			"--permissions", "{api_key_create: true, api_key_delete: true, api_key_read: true, api_key_update: true, domain_create: true, domain_delete: true, domain_read: true, domain_update: true, draft_create: true, draft_delete: true, draft_read: true, draft_send: true, draft_update: true, inbox_create: true, inbox_delete: true, inbox_read: true, inbox_update: true, label_blocked_read: true, label_spam_read: true, label_trash_read: true, list_entry_create: true, list_entry_delete: true, list_entry_read: true, message_read: true, message_send: true, message_update: true, metrics_read: true, pod_create: true, pod_delete: true, pod_read: true, thread_delete: true, thread_read: true, webhook_create: true, webhook_delete: true, webhook_read: true, webhook_update: true}",
 		)
 	})
 
@@ -34,6 +34,7 @@ func TestAPIKeysCreate(t *testing.T) {
 			"--permissions.api-key-create=true",
 			"--permissions.api-key-delete=true",
 			"--permissions.api-key-read=true",
+			"--permissions.api-key-update=true",
 			"--permissions.domain-create=true",
 			"--permissions.domain-delete=true",
 			"--permissions.domain-read=true",
@@ -77,6 +78,7 @@ func TestAPIKeysCreate(t *testing.T) {
 			"  api_key_create: true\n" +
 			"  api_key_delete: true\n" +
 			"  api_key_read: true\n" +
+			"  api_key_update: true\n" +
 			"  domain_create: true\n" +
 			"  domain_delete: true\n" +
 			"  domain_read: true\n" +
diff --git a/pkg/cmd/inboxapikey.go b/pkg/cmd/inboxapikey.go
index 4478dd7..f914116 100644
--- a/pkg/cmd/inboxapikey.go
+++ b/pkg/cmd/inboxapikey.go
@@ -55,6 +55,11 @@ var inboxesAPIKeysCreate = requestflag.WithInnerFlags(cli.Command{
 			Usage:      "Read API keys.",
 			InnerField: "api_key_read",
 		},
+		&requestflag.InnerFlag[*bool]{
+			Name:       "permissions.api-key-update",
+			Usage:      "Update API keys.",
+			InnerField: "api_key_update",
+		},
 		&requestflag.InnerFlag[*bool]{
 			Name:       "permissions.domain-create",
 			Usage:      "Create domains.",
diff --git a/pkg/cmd/inboxapikey_test.go b/pkg/cmd/inboxapikey_test.go
index 363128d..607f309 100644
--- a/pkg/cmd/inboxapikey_test.go
+++ b/pkg/cmd/inboxapikey_test.go
@@ -18,7 +18,7 @@ func TestInboxesAPIKeysCreate(t *testing.T) {
 			"inboxes:api-keys", "create",
 			"--inbox-id", "inbox_id",
 			"--name", "name",
-			"--permissions", "{api_key_create: true, api_key_delete: true, api_key_read: true, domain_create: true, domain_delete: true, domain_read: true, domain_update: true, draft_create: true, draft_delete: true, draft_read: true, draft_send: true, draft_update: true, inbox_create: true, inbox_delete: true, inbox_read: true, inbox_update: true, label_blocked_read: true, label_spam_read: true, label_trash_read: true, list_entry_create: true, list_entry_delete: true, list_entry_read: true, message_read: true, message_send: true, message_update: true, metrics_read: true, pod_create: true, pod_delete: true, pod_read: true, thread_delete: true, thread_read: true, webhook_create: true, webhook_delete: true, webhook_read: true, webhook_update: true}",
+			"--permissions", "{api_key_create: true, api_key_delete: true, api_key_read: true, api_key_update: true, domain_create: true, domain_delete: true, domain_read: true, domain_update: true, draft_create: true, draft_delete: true, draft_read: true, draft_send: true, draft_update: true, inbox_create: true, inbox_delete: true, inbox_read: true, inbox_update: true, label_blocked_read: true, label_spam_read: true, label_trash_read: true, list_entry_create: true, list_entry_delete: true, list_entry_read: true, message_read: true, message_send: true, message_update: true, metrics_read: true, pod_create: true, pod_delete: true, pod_read: true, thread_delete: true, thread_read: true, webhook_create: true, webhook_delete: true, webhook_read: true, webhook_update: true}",
 		)
 	})
 
@@ -36,6 +36,7 @@ func TestInboxesAPIKeysCreate(t *testing.T) {
 			"--permissions.api-key-create=true",
 			"--permissions.api-key-delete=true",
 			"--permissions.api-key-read=true",
+			"--permissions.api-key-update=true",
 			"--permissions.domain-create=true",
 			"--permissions.domain-delete=true",
 			"--permissions.domain-read=true",
@@ -79,6 +80,7 @@ func TestInboxesAPIKeysCreate(t *testing.T) {
 			"  api_key_create: true\n" +
 			"  api_key_delete: true\n" +
 			"  api_key_read: true\n" +
+			"  api_key_update: true\n" +
 			"  domain_create: true\n" +
 			"  domain_delete: true\n" +
 			"  domain_read: true\n" +
diff --git a/pkg/cmd/podapikey.go b/pkg/cmd/podapikey.go
index ff85ae4..cba4ed1 100644
--- a/pkg/cmd/podapikey.go
+++ b/pkg/cmd/podapikey.go
@@ -55,6 +55,11 @@ var podsAPIKeysCreate = requestflag.WithInnerFlags(cli.Command{
 			Usage:      "Read API keys.",
 			InnerField: "api_key_read",
 		},
+		&requestflag.InnerFlag[*bool]{
+			Name:       "permissions.api-key-update",
+			Usage:      "Update API keys.",
+			InnerField: "api_key_update",
+		},
 		&requestflag.InnerFlag[*bool]{
 			Name:       "permissions.domain-create",
 			Usage:      "Create domains.",
diff --git a/pkg/cmd/podapikey_test.go b/pkg/cmd/podapikey_test.go
index 730ea70..97829eb 100644
--- a/pkg/cmd/podapikey_test.go
+++ b/pkg/cmd/podapikey_test.go
@@ -18,7 +18,7 @@ func TestPodsAPIKeysCreate(t *testing.T) {
 			"pods:api-keys", "create",
 			"--pod-id", "pod_id",
 			"--name", "name",
-			"--permissions", "{api_key_create: true, api_key_delete: true, api_key_read: true, domain_create: true, domain_delete: true, domain_read: true, domain_update: true, draft_create: true, draft_delete: true, draft_read: true, draft_send: true, draft_update: true, inbox_create: true, inbox_delete: true, inbox_read: true, inbox_update: true, label_blocked_read: true, label_spam_read: true, label_trash_read: true, list_entry_create: true, list_entry_delete: true, list_entry_read: true, message_read: true, message_send: true, message_update: true, metrics_read: true, pod_create: true, pod_delete: true, pod_read: true, thread_delete: true, thread_read: true, webhook_create: true, webhook_delete: true, webhook_read: true, webhook_update: true}",
+			"--permissions", "{api_key_create: true, api_key_delete: true, api_key_read: true, api_key_update: true, domain_create: true, domain_delete: true, domain_read: true, domain_update: true, draft_create: true, draft_delete: true, draft_read: true, draft_send: true, draft_update: true, inbox_create: true, inbox_delete: true, inbox_read: true, inbox_update: true, label_blocked_read: true, label_spam_read: true, label_trash_read: true, list_entry_create: true, list_entry_delete: true, list_entry_read: true, message_read: true, message_send: true, message_update: true, metrics_read: true, pod_create: true, pod_delete: true, pod_read: true, thread_delete: true, thread_read: true, webhook_create: true, webhook_delete: true, webhook_read: true, webhook_update: true}",
 		)
 	})
 
@@ -36,6 +36,7 @@ func TestPodsAPIKeysCreate(t *testing.T) {
 			"--permissions.api-key-create=true",
 			"--permissions.api-key-delete=true",
 			"--permissions.api-key-read=true",
+			"--permissions.api-key-update=true",
 			"--permissions.domain-create=true",
 			"--permissions.domain-delete=true",
 			"--permissions.domain-read=true",
@@ -79,6 +80,7 @@ func TestPodsAPIKeysCreate(t *testing.T) {
 			"  api_key_create: true\n" +
 			"  api_key_delete: true\n" +
 			"  api_key_read: true\n" +
+			"  api_key_update: true\n" +
 			"  domain_create: true\n" +
 			"  domain_delete: true\n" +
 			"  domain_read: true\n" +

From 4caffbe2625d6ca8b66f0f6a6248b99eadbdcd55 Mon Sep 17 00:00:00 2001
From: "stainless-app[bot]"
 <142633134+stainless-app[bot]@users.noreply.github.com>
Date: Tue, 28 Jul 2026 19:37:17 +0000
Subject: [PATCH 3/4] feat(api): api update

---
 .stats.yml                  |  4 ++--
 pkg/cmd/apikey.go           | 24 ++++++++++++------------
 pkg/cmd/apikey_test.go      | 10 +++++-----
 pkg/cmd/inboxapikey.go      | 24 ++++++++++++------------
 pkg/cmd/inboxapikey_test.go | 10 +++++-----
 pkg/cmd/podapikey.go        | 24 ++++++++++++------------
 pkg/cmd/podapikey_test.go   | 10 +++++-----
 7 files changed, 53 insertions(+), 53 deletions(-)

diff --git a/.stats.yml b/.stats.yml
index 3674798..1a52241 100644
--- a/.stats.yml
+++ b/.stats.yml
@@ -1,4 +1,4 @@
 configured_endpoints: 95
-openapi_spec_url: https://storage.googleapis.com/stainless-sdk-openapi-specs/agentmail/agentmail-de0e6b98063302dfd5d2764851feb9718d504c322e217df7e390b94f9ca69275.yml
-openapi_spec_hash: 25c26b19e1886ea1574a9da8402ec7df
+openapi_spec_url: https://storage.googleapis.com/stainless-sdk-openapi-specs/agentmail/agentmail-0507cda65e473e78bdde89c5ac0c3476a26e5d5f23d9650ea364ead0b876e2c0.yml
+openapi_spec_hash: 714305157eba3e25f840eac5d04236a3
 config_hash: 8c7283a75ec714092fa5f03087e28a65
diff --git a/pkg/cmd/apikey.go b/pkg/cmd/apikey.go
index 9c632d6..9ebdcd9 100644
--- a/pkg/cmd/apikey.go
+++ b/pkg/cmd/apikey.go
@@ -134,6 +134,11 @@ var apiKeysCreate = requestflag.WithInnerFlags(cli.Command{
 			Usage:      "Access messages labeled trash.",
 			InnerField: "label_trash_read",
 		},
+		&requestflag.InnerFlag[*bool]{
+			Name:       "permissions.label-unauthenticated-read",
+			Usage:      "Access messages labeled unauthenticated.",
+			InnerField: "label_unauthenticated_read",
+		},
 		&requestflag.InnerFlag[*bool]{
 			Name:       "permissions.list-entry-create",
 			Usage:      "Create list entries.",
@@ -149,9 +154,14 @@ var apiKeysCreate = requestflag.WithInnerFlags(cli.Command{
 			Usage:      "Read list entries.",
 			InnerField: "list_entry_read",
 		},
+		&requestflag.InnerFlag[*bool]{
+			Name:       "permissions.message-delete",
+			Usage:      "Delete messages. Also required to delete threads.",
+			InnerField: "message_delete",
+		},
 		&requestflag.InnerFlag[*bool]{
 			Name:       "permissions.message-read",
-			Usage:      "Read messages.",
+			Usage:      "Read messages. Also required to read threads.",
 			InnerField: "message_read",
 		},
 		&requestflag.InnerFlag[*bool]{
@@ -161,7 +171,7 @@ var apiKeysCreate = requestflag.WithInnerFlags(cli.Command{
 		},
 		&requestflag.InnerFlag[*bool]{
 			Name:       "permissions.message-update",
-			Usage:      "Update message labels.",
+			Usage:      "Update message labels. Also required to update threads.",
 			InnerField: "message_update",
 		},
 		&requestflag.InnerFlag[*bool]{
@@ -184,16 +194,6 @@ var apiKeysCreate = requestflag.WithInnerFlags(cli.Command{
 			Usage:      "Read pods.",
 			InnerField: "pod_read",
 		},
-		&requestflag.InnerFlag[*bool]{
-			Name:       "permissions.thread-delete",
-			Usage:      "Delete threads.",
-			InnerField: "thread_delete",
-		},
-		&requestflag.InnerFlag[*bool]{
-			Name:       "permissions.thread-read",
-			Usage:      "Read threads.",
-			InnerField: "thread_read",
-		},
 		&requestflag.InnerFlag[*bool]{
 			Name:       "permissions.webhook-create",
 			Usage:      "Create webhooks.",
diff --git a/pkg/cmd/apikey_test.go b/pkg/cmd/apikey_test.go
index d3f22a4..87bc67d 100644
--- a/pkg/cmd/apikey_test.go
+++ b/pkg/cmd/apikey_test.go
@@ -17,7 +17,7 @@ func TestAPIKeysCreate(t *testing.T) {
 			"--api-key", "string",
 			"api-keys", "create",
 			"--name", "name",
-			"--permissions", "{api_key_create: true, api_key_delete: true, api_key_read: true, api_key_update: true, domain_create: true, domain_delete: true, domain_read: true, domain_update: true, draft_create: true, draft_delete: true, draft_read: true, draft_send: true, draft_update: true, inbox_create: true, inbox_delete: true, inbox_read: true, inbox_update: true, label_blocked_read: true, label_spam_read: true, label_trash_read: true, list_entry_create: true, list_entry_delete: true, list_entry_read: true, message_read: true, message_send: true, message_update: true, metrics_read: true, pod_create: true, pod_delete: true, pod_read: true, thread_delete: true, thread_read: true, webhook_create: true, webhook_delete: true, webhook_read: true, webhook_update: true}",
+			"--permissions", "{api_key_create: true, api_key_delete: true, api_key_read: true, api_key_update: true, domain_create: true, domain_delete: true, domain_read: true, domain_update: true, draft_create: true, draft_delete: true, draft_read: true, draft_send: true, draft_update: true, inbox_create: true, inbox_delete: true, inbox_read: true, inbox_update: true, label_blocked_read: true, label_spam_read: true, label_trash_read: true, label_unauthenticated_read: true, list_entry_create: true, list_entry_delete: true, list_entry_read: true, message_delete: true, message_read: true, message_send: true, message_update: true, metrics_read: true, pod_create: true, pod_delete: true, pod_read: true, webhook_create: true, webhook_delete: true, webhook_read: true, webhook_update: true}",
 		)
 	})
 
@@ -51,9 +51,11 @@ func TestAPIKeysCreate(t *testing.T) {
 			"--permissions.label-blocked-read=true",
 			"--permissions.label-spam-read=true",
 			"--permissions.label-trash-read=true",
+			"--permissions.label-unauthenticated-read=true",
 			"--permissions.list-entry-create=true",
 			"--permissions.list-entry-delete=true",
 			"--permissions.list-entry-read=true",
+			"--permissions.message-delete=true",
 			"--permissions.message-read=true",
 			"--permissions.message-send=true",
 			"--permissions.message-update=true",
@@ -61,8 +63,6 @@ func TestAPIKeysCreate(t *testing.T) {
 			"--permissions.pod-create=true",
 			"--permissions.pod-delete=true",
 			"--permissions.pod-read=true",
-			"--permissions.thread-delete=true",
-			"--permissions.thread-read=true",
 			"--permissions.webhook-create=true",
 			"--permissions.webhook-delete=true",
 			"--permissions.webhook-read=true",
@@ -95,9 +95,11 @@ func TestAPIKeysCreate(t *testing.T) {
 			"  label_blocked_read: true\n" +
 			"  label_spam_read: true\n" +
 			"  label_trash_read: true\n" +
+			"  label_unauthenticated_read: true\n" +
 			"  list_entry_create: true\n" +
 			"  list_entry_delete: true\n" +
 			"  list_entry_read: true\n" +
+			"  message_delete: true\n" +
 			"  message_read: true\n" +
 			"  message_send: true\n" +
 			"  message_update: true\n" +
@@ -105,8 +107,6 @@ func TestAPIKeysCreate(t *testing.T) {
 			"  pod_create: true\n" +
 			"  pod_delete: true\n" +
 			"  pod_read: true\n" +
-			"  thread_delete: true\n" +
-			"  thread_read: true\n" +
 			"  webhook_create: true\n" +
 			"  webhook_delete: true\n" +
 			"  webhook_read: true\n" +
diff --git a/pkg/cmd/inboxapikey.go b/pkg/cmd/inboxapikey.go
index f914116..e758dc6 100644
--- a/pkg/cmd/inboxapikey.go
+++ b/pkg/cmd/inboxapikey.go
@@ -140,6 +140,11 @@ var inboxesAPIKeysCreate = requestflag.WithInnerFlags(cli.Command{
 			Usage:      "Access messages labeled trash.",
 			InnerField: "label_trash_read",
 		},
+		&requestflag.InnerFlag[*bool]{
+			Name:       "permissions.label-unauthenticated-read",
+			Usage:      "Access messages labeled unauthenticated.",
+			InnerField: "label_unauthenticated_read",
+		},
 		&requestflag.InnerFlag[*bool]{
 			Name:       "permissions.list-entry-create",
 			Usage:      "Create list entries.",
@@ -155,9 +160,14 @@ var inboxesAPIKeysCreate = requestflag.WithInnerFlags(cli.Command{
 			Usage:      "Read list entries.",
 			InnerField: "list_entry_read",
 		},
+		&requestflag.InnerFlag[*bool]{
+			Name:       "permissions.message-delete",
+			Usage:      "Delete messages. Also required to delete threads.",
+			InnerField: "message_delete",
+		},
 		&requestflag.InnerFlag[*bool]{
 			Name:       "permissions.message-read",
-			Usage:      "Read messages.",
+			Usage:      "Read messages. Also required to read threads.",
 			InnerField: "message_read",
 		},
 		&requestflag.InnerFlag[*bool]{
@@ -167,7 +177,7 @@ var inboxesAPIKeysCreate = requestflag.WithInnerFlags(cli.Command{
 		},
 		&requestflag.InnerFlag[*bool]{
 			Name:       "permissions.message-update",
-			Usage:      "Update message labels.",
+			Usage:      "Update message labels. Also required to update threads.",
 			InnerField: "message_update",
 		},
 		&requestflag.InnerFlag[*bool]{
@@ -190,16 +200,6 @@ var inboxesAPIKeysCreate = requestflag.WithInnerFlags(cli.Command{
 			Usage:      "Read pods.",
 			InnerField: "pod_read",
 		},
-		&requestflag.InnerFlag[*bool]{
-			Name:       "permissions.thread-delete",
-			Usage:      "Delete threads.",
-			InnerField: "thread_delete",
-		},
-		&requestflag.InnerFlag[*bool]{
-			Name:       "permissions.thread-read",
-			Usage:      "Read threads.",
-			InnerField: "thread_read",
-		},
 		&requestflag.InnerFlag[*bool]{
 			Name:       "permissions.webhook-create",
 			Usage:      "Create webhooks.",
diff --git a/pkg/cmd/inboxapikey_test.go b/pkg/cmd/inboxapikey_test.go
index 607f309..c149eaf 100644
--- a/pkg/cmd/inboxapikey_test.go
+++ b/pkg/cmd/inboxapikey_test.go
@@ -18,7 +18,7 @@ func TestInboxesAPIKeysCreate(t *testing.T) {
 			"inboxes:api-keys", "create",
 			"--inbox-id", "inbox_id",
 			"--name", "name",
-			"--permissions", "{api_key_create: true, api_key_delete: true, api_key_read: true, api_key_update: true, domain_create: true, domain_delete: true, domain_read: true, domain_update: true, draft_create: true, draft_delete: true, draft_read: true, draft_send: true, draft_update: true, inbox_create: true, inbox_delete: true, inbox_read: true, inbox_update: true, label_blocked_read: true, label_spam_read: true, label_trash_read: true, list_entry_create: true, list_entry_delete: true, list_entry_read: true, message_read: true, message_send: true, message_update: true, metrics_read: true, pod_create: true, pod_delete: true, pod_read: true, thread_delete: true, thread_read: true, webhook_create: true, webhook_delete: true, webhook_read: true, webhook_update: true}",
+			"--permissions", "{api_key_create: true, api_key_delete: true, api_key_read: true, api_key_update: true, domain_create: true, domain_delete: true, domain_read: true, domain_update: true, draft_create: true, draft_delete: true, draft_read: true, draft_send: true, draft_update: true, inbox_create: true, inbox_delete: true, inbox_read: true, inbox_update: true, label_blocked_read: true, label_spam_read: true, label_trash_read: true, label_unauthenticated_read: true, list_entry_create: true, list_entry_delete: true, list_entry_read: true, message_delete: true, message_read: true, message_send: true, message_update: true, metrics_read: true, pod_create: true, pod_delete: true, pod_read: true, webhook_create: true, webhook_delete: true, webhook_read: true, webhook_update: true}",
 		)
 	})
 
@@ -53,9 +53,11 @@ func TestInboxesAPIKeysCreate(t *testing.T) {
 			"--permissions.label-blocked-read=true",
 			"--permissions.label-spam-read=true",
 			"--permissions.label-trash-read=true",
+			"--permissions.label-unauthenticated-read=true",
 			"--permissions.list-entry-create=true",
 			"--permissions.list-entry-delete=true",
 			"--permissions.list-entry-read=true",
+			"--permissions.message-delete=true",
 			"--permissions.message-read=true",
 			"--permissions.message-send=true",
 			"--permissions.message-update=true",
@@ -63,8 +65,6 @@ func TestInboxesAPIKeysCreate(t *testing.T) {
 			"--permissions.pod-create=true",
 			"--permissions.pod-delete=true",
 			"--permissions.pod-read=true",
-			"--permissions.thread-delete=true",
-			"--permissions.thread-read=true",
 			"--permissions.webhook-create=true",
 			"--permissions.webhook-delete=true",
 			"--permissions.webhook-read=true",
@@ -97,9 +97,11 @@ func TestInboxesAPIKeysCreate(t *testing.T) {
 			"  label_blocked_read: true\n" +
 			"  label_spam_read: true\n" +
 			"  label_trash_read: true\n" +
+			"  label_unauthenticated_read: true\n" +
 			"  list_entry_create: true\n" +
 			"  list_entry_delete: true\n" +
 			"  list_entry_read: true\n" +
+			"  message_delete: true\n" +
 			"  message_read: true\n" +
 			"  message_send: true\n" +
 			"  message_update: true\n" +
@@ -107,8 +109,6 @@ func TestInboxesAPIKeysCreate(t *testing.T) {
 			"  pod_create: true\n" +
 			"  pod_delete: true\n" +
 			"  pod_read: true\n" +
-			"  thread_delete: true\n" +
-			"  thread_read: true\n" +
 			"  webhook_create: true\n" +
 			"  webhook_delete: true\n" +
 			"  webhook_read: true\n" +
diff --git a/pkg/cmd/podapikey.go b/pkg/cmd/podapikey.go
index cba4ed1..4b7ed90 100644
--- a/pkg/cmd/podapikey.go
+++ b/pkg/cmd/podapikey.go
@@ -140,6 +140,11 @@ var podsAPIKeysCreate = requestflag.WithInnerFlags(cli.Command{
 			Usage:      "Access messages labeled trash.",
 			InnerField: "label_trash_read",
 		},
+		&requestflag.InnerFlag[*bool]{
+			Name:       "permissions.label-unauthenticated-read",
+			Usage:      "Access messages labeled unauthenticated.",
+			InnerField: "label_unauthenticated_read",
+		},
 		&requestflag.InnerFlag[*bool]{
 			Name:       "permissions.list-entry-create",
 			Usage:      "Create list entries.",
@@ -155,9 +160,14 @@ var podsAPIKeysCreate = requestflag.WithInnerFlags(cli.Command{
 			Usage:      "Read list entries.",
 			InnerField: "list_entry_read",
 		},
+		&requestflag.InnerFlag[*bool]{
+			Name:       "permissions.message-delete",
+			Usage:      "Delete messages. Also required to delete threads.",
+			InnerField: "message_delete",
+		},
 		&requestflag.InnerFlag[*bool]{
 			Name:       "permissions.message-read",
-			Usage:      "Read messages.",
+			Usage:      "Read messages. Also required to read threads.",
 			InnerField: "message_read",
 		},
 		&requestflag.InnerFlag[*bool]{
@@ -167,7 +177,7 @@ var podsAPIKeysCreate = requestflag.WithInnerFlags(cli.Command{
 		},
 		&requestflag.InnerFlag[*bool]{
 			Name:       "permissions.message-update",
-			Usage:      "Update message labels.",
+			Usage:      "Update message labels. Also required to update threads.",
 			InnerField: "message_update",
 		},
 		&requestflag.InnerFlag[*bool]{
@@ -190,16 +200,6 @@ var podsAPIKeysCreate = requestflag.WithInnerFlags(cli.Command{
 			Usage:      "Read pods.",
 			InnerField: "pod_read",
 		},
-		&requestflag.InnerFlag[*bool]{
-			Name:       "permissions.thread-delete",
-			Usage:      "Delete threads.",
-			InnerField: "thread_delete",
-		},
-		&requestflag.InnerFlag[*bool]{
-			Name:       "permissions.thread-read",
-			Usage:      "Read threads.",
-			InnerField: "thread_read",
-		},
 		&requestflag.InnerFlag[*bool]{
 			Name:       "permissions.webhook-create",
 			Usage:      "Create webhooks.",
diff --git a/pkg/cmd/podapikey_test.go b/pkg/cmd/podapikey_test.go
index 97829eb..e9718d6 100644
--- a/pkg/cmd/podapikey_test.go
+++ b/pkg/cmd/podapikey_test.go
@@ -18,7 +18,7 @@ func TestPodsAPIKeysCreate(t *testing.T) {
 			"pods:api-keys", "create",
 			"--pod-id", "pod_id",
 			"--name", "name",
-			"--permissions", "{api_key_create: true, api_key_delete: true, api_key_read: true, api_key_update: true, domain_create: true, domain_delete: true, domain_read: true, domain_update: true, draft_create: true, draft_delete: true, draft_read: true, draft_send: true, draft_update: true, inbox_create: true, inbox_delete: true, inbox_read: true, inbox_update: true, label_blocked_read: true, label_spam_read: true, label_trash_read: true, list_entry_create: true, list_entry_delete: true, list_entry_read: true, message_read: true, message_send: true, message_update: true, metrics_read: true, pod_create: true, pod_delete: true, pod_read: true, thread_delete: true, thread_read: true, webhook_create: true, webhook_delete: true, webhook_read: true, webhook_update: true}",
+			"--permissions", "{api_key_create: true, api_key_delete: true, api_key_read: true, api_key_update: true, domain_create: true, domain_delete: true, domain_read: true, domain_update: true, draft_create: true, draft_delete: true, draft_read: true, draft_send: true, draft_update: true, inbox_create: true, inbox_delete: true, inbox_read: true, inbox_update: true, label_blocked_read: true, label_spam_read: true, label_trash_read: true, label_unauthenticated_read: true, list_entry_create: true, list_entry_delete: true, list_entry_read: true, message_delete: true, message_read: true, message_send: true, message_update: true, metrics_read: true, pod_create: true, pod_delete: true, pod_read: true, webhook_create: true, webhook_delete: true, webhook_read: true, webhook_update: true}",
 		)
 	})
 
@@ -53,9 +53,11 @@ func TestPodsAPIKeysCreate(t *testing.T) {
 			"--permissions.label-blocked-read=true",
 			"--permissions.label-spam-read=true",
 			"--permissions.label-trash-read=true",
+			"--permissions.label-unauthenticated-read=true",
 			"--permissions.list-entry-create=true",
 			"--permissions.list-entry-delete=true",
 			"--permissions.list-entry-read=true",
+			"--permissions.message-delete=true",
 			"--permissions.message-read=true",
 			"--permissions.message-send=true",
 			"--permissions.message-update=true",
@@ -63,8 +65,6 @@ func TestPodsAPIKeysCreate(t *testing.T) {
 			"--permissions.pod-create=true",
 			"--permissions.pod-delete=true",
 			"--permissions.pod-read=true",
-			"--permissions.thread-delete=true",
-			"--permissions.thread-read=true",
 			"--permissions.webhook-create=true",
 			"--permissions.webhook-delete=true",
 			"--permissions.webhook-read=true",
@@ -97,9 +97,11 @@ func TestPodsAPIKeysCreate(t *testing.T) {
 			"  label_blocked_read: true\n" +
 			"  label_spam_read: true\n" +
 			"  label_trash_read: true\n" +
+			"  label_unauthenticated_read: true\n" +
 			"  list_entry_create: true\n" +
 			"  list_entry_delete: true\n" +
 			"  list_entry_read: true\n" +
+			"  message_delete: true\n" +
 			"  message_read: true\n" +
 			"  message_send: true\n" +
 			"  message_update: true\n" +
@@ -107,8 +109,6 @@ func TestPodsAPIKeysCreate(t *testing.T) {
 			"  pod_create: true\n" +
 			"  pod_delete: true\n" +
 			"  pod_read: true\n" +
-			"  thread_delete: true\n" +
-			"  thread_read: true\n" +
 			"  webhook_create: true\n" +
 			"  webhook_delete: true\n" +
 			"  webhook_read: true\n" +

From 21ad6558a3b23b244e7bda8b41a3c52d8ee2611a Mon Sep 17 00:00:00 2001
From: "stainless-app[bot]"
 <142633134+stainless-app[bot]@users.noreply.github.com>
Date: Tue, 28 Jul 2026 19:37:43 +0000
Subject: [PATCH 4/4] release: 0.7.15

---
 .release-please-manifest.json |  2 +-
 CHANGELOG.md                  | 10 ++++++++++
 pkg/cmd/version.go            |  2 +-
 3 files changed, 12 insertions(+), 2 deletions(-)

diff --git a/.release-please-manifest.json b/.release-please-manifest.json
index ec46183..1985dc1 100644
--- a/.release-please-manifest.json
+++ b/.release-please-manifest.json
@@ -1,3 +1,3 @@
 {
-  ".": "0.7.14"
+  ".": "0.7.15"
 }
\ No newline at end of file
diff --git a/CHANGELOG.md b/CHANGELOG.md
index ecdf208..4562e19 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,15 @@
 # Changelog
 
+## 0.7.15 (2026-07-28)
+
+Full Changelog: [v0.7.14...v0.7.15](https://github.com/agentmail-to/agentmail-cli/compare/v0.7.14...v0.7.15)
+
+### Features
+
+* **api:** api update ([4caffbe](https://github.com/agentmail-to/agentmail-cli/commit/4caffbe2625d6ca8b66f0f6a6248b99eadbdcd55))
+* **api:** api update ([6a66ceb](https://github.com/agentmail-to/agentmail-cli/commit/6a66ceb8d3b60367e956818d0dbccafa002b29e6))
+* **stlc:** configurable CI runner and private-production-repo support in workflow templates ([a44ee71](https://github.com/agentmail-to/agentmail-cli/commit/a44ee7111feed59c088b880782f02c50f897ca83))
+
 ## 0.7.14 (2026-07-15)
 
 Full Changelog: [v0.7.13...v0.7.14](https://github.com/agentmail-to/agentmail-cli/compare/v0.7.13...v0.7.14)
diff --git a/pkg/cmd/version.go b/pkg/cmd/version.go
index 6e914c7..c34323a 100644
--- a/pkg/cmd/version.go
+++ b/pkg/cmd/version.go
@@ -2,4 +2,4 @@
 
 package cmd
 
-const Version = "0.7.14" // x-release-please-version
+const Version = "0.7.15" // x-release-please-version