fix(cli): restore api-keys create flags; release note for 1.4 - #243
Merged
Merged
Conversation
CreateApiKeyRequest became a oneOf (bearer key | public key) in #231. The CLI generator emits only --json for a union body, so the 1.4.0 regen dropped --name, --permissions and the --permissions.* flags from `api-keys create`, `inboxes api-keys create` and `pods api-keys create`, all of which work against prod on 1.3.0. The CLI overrides now point those three operations at a flattened CliCreateApiKeyRequest carrying both variants' fields. public_key is a free-form object: with PublicJwk's members listed, generator 0.38.10 turns x/y into required top-level flags and blocks bearer creation; a bearer-only body instead makes the local schema check reject public_key passed via --json. Verified with a local generation and --dry-run: bearer flags send the same body as 1.3.0, and public keys work via --public-key/--client-id/--expires-at or --json. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2 tasks
1.4 drops the twelve public-key and browser-credential commands whose API routes were removed in #231/#237, renames providers connect --authorize to --accept-disclosure, and adds inbox search and api-keys get/update. Maps each removed 1.3 command to its api-keys replacement. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
duharry0915
changed the title
sidharth0612
approved these changes
Sep 14, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
The 1.4.0 regen (agentmail-cli#52) dropped the per-field flags from three commands that work against prod today:
api-keys create--name --permissions+ 36--permissions.*--jsononly--name --permissions --public-key --client-id --expires-at+ 38--permissions.*inboxes api-keys create--jsononlypods api-keys create--jsononlyCause: #231 turned
CreateApiKeyRequestinto aoneOf(bearer key or public key), and fern-cli-generator 0.38.10 emits only--jsonfor a union body.Fix (CLI overrides only, SDKs untouched): the three create operations now point at a flattened
CliCreateApiKeyRequestwith both variants' fields. I tried two narrower versions first and both failed:PublicJwk's members made--public-key.xand.yrequired flags, which blocked bearer creation.public_keypassed via--json.So
public_keyis a free-form object here, and the server validates the JWK.Release note
Also adds an Upgrading to 1.4 section to
integrations/cli.mdx(folded in from #244), above the 1.2 note and in the same style:api-keysreplacement. Their API routes were removed in docs(api-keys): browser keys as API keys, Authorize Inbox, and the alias route removals #231/Remove the revoke-all endpoint and revoked_at #237, so these commands already fail on 1.3.providers connect --authorizeto--accept-disclosure.api-keys get/update,api-keys list --type, andthreads get --limit/--page-token.Test plan
Local generation (temporary
local-file-systemgroup, not committed) +cargo build+--dry-run:api-keys create --name ci-test --permissions.inbox-read true→{"name":"ci-test","permissions":{"inbox_read":true}}, the same body as 1.3.0 and with no null variant fields. Same result on the inbox and pod routes.--public-key '{…}' --client-id cid --expires-at …→ correct public-key body--json '{"public_key":{…},"name":"pk","client_id":"cid"}'passes the local checkreference.mdis identical.gen-cli-overrides.py --checkpassesfern check: 0 errors; every flag and value in the release note matches--helpon the local 1.4.0 buildAfter merge: re-dispatch
release-cli.ymlat 1.4.0 and close #52.🤖 Generated with Claude Code