Upgrade to 0.14.0

Choose permissions for stdio clients and new API keys, restore permanent deletion, and read inline attachment content.

Fluxmail 0.14.0 makes new connections read-only unless you choose a profile, and the full profile no longer includes permanent deletion. It also changes how download_attachment returns inline images and text, and how fluxmail accounts add imap picks a security mode. The store format does not change.

Find your migration

Only follow the rows for the interfaces you use.

Interface	Required changes
MCP	Add a profile to `fluxmail stdio` arguments. Add `mail.delete` to `full` connections that permanently delete mail. Read inline images from `image` content and text attachments from resource `text`.
CLI	Pass `--profile` to `fluxmail apikey create` when a key needs more than read access. Pass `--imap-security tls` when adding an IMAP account that uses implicit TLS on a port other than 993.
REST	Set `permissionProfile` when creating an API key that needs more than read access. Add `mail.delete` to `full` keys that permanently delete mail.

Choose a profile for stdio clients

fluxmail stdio without --profile or --allow now starts read-only. If a client drafts, organizes, sends, or schedules mail, add a permission profile to its arguments and restart it:

fluxmail stdio --profile full

The MCP bundle has a Permission profile setting. It defaults to full, and a profile you saved earlier stays in effect.

Create API keys with the access they need

fluxmail apikey create and POST /api/v1/me/api-keys now create read-only keys when you give no permissions. Existing keys keep their profiles. To create a key that can send mail, choose the profile when you create it:

fluxmail apikey create --name agent --profile full

For REST, include "permissionProfile": "full" in the request body.

Restore permanent deletion

The full profile no longer includes mail.delete. This applies to existing API keys, stdio connections, and MCP bundle installations that use full. CLI commands are not affected.

If a client needs to permanently delete messages, add mail.delete to its profile:

fluxmail stdio --profile full --allow mail.delete
fluxmail apikey permissions <key-id> --profile full --allow mail.delete

The MCP bundle does not offer permanent deletion.

Read inline attachment content

When inline is true, download_attachment now returns PNG, JPEG, GIF, and WebP attachments as image content. UTF-8 text attachments, such as plain text, CSV, JSON, and XML, return as a resource with text. Reading an attachment resource URI returns text for the same types. Other attachments still use base64 blob.

If your client decodes blob for every attachment, read data from image content and text from text resources.

Set the IMAP security mode explicitly

When you omit --imap-security or --smtp-security, fluxmail accounts add imap now uses tls on ports 993 and 465 and starttls on other ports. Before this release, IMAP used tls on every port.

If your IMAP server uses implicit TLS on another port, pass --imap-security tls. Accounts you already added keep their saved settings.