From c9fa0d14919edbe8bc9c6b096d9347b6548f583b Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Tue, 30 Jun 2026 14:14:55 +0000
Subject: [PATCH] Add label management commands (create, update, delete)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

gwcli previously only listed/applied/removed labels; creation and deletion
required the Gmail UI. Add imperative label CRUD via the Gmail
users.labels API:

- labels create <name>   — create a user label (rejects duplicates),
  with --message-list-visibility / --label-list-visibility flags and
  '/'-nested names
- labels update <label>  — rename and/or change visibility
- labels delete <label>  — delete a user label (--force required,
  refuses system labels)

create/update/delete accept a label name or ID via the shared
resolveLabelID helper, and any mutation invalidates the connection's
label cache. The gmail.labels OAuth scope already requested covers all
of this.

Also fix two pre-existing dispatch bugs where "labels apply" and
"labels remove" never matched because Kong includes the <label-id> arg
placeholder in the command string. Initialize the label/message caches
in NewFake so LoadLabels works under test.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UdqRpUFcLqZQjFpDDkbnxk
---
 CLAUDE.md               |  20 ++-
 labels.go               | 114 +++++++++++++++++
 labels_test.go          | 277 ++++++++++++++++++++++++++++++++++++++++
 main.go                 |  61 ++++++++-
 pkg/gwcli/connection.go |  68 ++++++++++
 5 files changed, 535 insertions(+), 5 deletions(-)
 create mode 100644 labels_test.go

diff --git a/CLAUDE.md b/CLAUDE.md
index 612058e..00676c8 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -307,11 +307,25 @@ involved — nothing is auto-created.
 
 **Label Operations:**
 - `gwcli labels list` - List all labels
+- `gwcli labels create <name>` - Create a new user label
+- `gwcli labels update <label> [--name <new>]` - Rename / change visibility
+- `gwcli labels delete <label> --force` - Delete a user label (`--force` required)
 - `gwcli labels apply <label> --message <id>` - Apply label to message
 - `gwcli labels remove <label> --message <id>` - Remove label from message
 
-Labels are created/deleted in the Gmail UI. gwcli does not manage label
-creation/deletion.
+gwcli manages labels imperatively via the Gmail API (`users.labels` CRUD,
+implemented in `labels.go` with the connection methods `CreateLabel`,
+`UpdateLabel`, `DeleteLabel` in `connection.go`). `update` and `delete` accept a
+label **name or ID** (resolved via the shared `resolveLabelID` helper, the same
+name/ID matching used elsewhere); nested labels use `/` in the name (e.g.
+`Work/Urgent`). Visibility flags map to the Gmail API:
+`--message-list-visibility` (`show`/`hide`) and `--label-list-visibility`
+(`labelShow`/`labelShowIfUnread`/`labelHide`). `create` rejects a duplicate
+name; `delete` refuses to remove Gmail system labels (INBOX, SENT, ...) and
+requires `--force` (non-interactive rule #3). Any mutation invalidates the
+connection's label cache so the next access reloads from the API. The
+`gmail.labels` OAuth scope (already requested) covers all of this — no
+re-consent needed.
 
 ### Filter Management
 
@@ -675,7 +689,7 @@ Note: Service accounts require domain-wide delegation with the `https://www.goog
 2. **Kong syntax**: Command matching uses exact strings like `"messages list"` not path-style routes
 3. **No interactive prompts**: All commands must work non-interactively (for scripting). Destructive commands require an explicit `--force` flag instead of prompting (e.g. `filters delete`).
 4. **Label IDs vs Names**: Always handle both - users may provide either
-5. **Label create/delete**: Done in the Gmail UI; gwcli does not create/delete labels
+5. **Label create/delete**: Managed via the Gmail API (`labels create`/`update`/`delete`); `delete` requires `--force` and rejects system labels
 6. **Labels load from the Gmail API**: Labels are fetched directly from the API (all user labels + system labels). There is no config file and nothing is auto-created.
 
 ## Error Handling Pattern
diff --git a/labels.go b/labels.go
index b181dd9..7188e91 100644
--- a/labels.go
+++ b/labels.go
@@ -75,6 +75,120 @@ func runLabelsList(ctx context.Context, conn *gwcli.CmdG, systemOnly, userOnly b
 	return out.writeTable(headers, rows)
 }
 
+func runLabelsCreate(ctx context.Context, conn *gwcli.CmdG, name, messageListVisibility, labelListVisibility string, out *outputWriter) error {
+	if strings.TrimSpace(name) == "" {
+		return fmt.Errorf("label name is required")
+	}
+
+	out.writeVerbose("Loading labels to check for duplicates...")
+	if err := conn.LoadLabels(ctx, out.verbose); err != nil {
+		return fmt.Errorf("failed to load labels: %w", err)
+	}
+	for _, l := range conn.Labels() {
+		if strings.EqualFold(l.Label, name) {
+			return fmt.Errorf("label %q already exists (ID: %s)", l.Label, l.ID)
+		}
+	}
+
+	out.writeVerbose("Creating label %q...", name)
+	created, err := conn.CreateLabel(ctx, name, messageListVisibility, labelListVisibility)
+	if err != nil {
+		return fmt.Errorf("failed to create label: %w", err)
+	}
+
+	if out.json {
+		o := labelListOutput{
+			ID:              created.Id,
+			Name:            created.Name,
+			Type:            created.Type,
+			MessageListView: created.MessageListVisibility,
+			LabelListView:   created.LabelListVisibility,
+		}
+		if created.Color != nil {
+			o.Color = created.Color.BackgroundColor
+		}
+		return out.writeJSON(o)
+	}
+
+	out.writeMessage(fmt.Sprintf("Created label %q (ID: %s)", created.Name, created.Id))
+	return nil
+}
+
+func runLabelsUpdate(ctx context.Context, conn *gwcli.CmdG, labelRef, newName, messageListVisibility, labelListVisibility string, out *outputWriter) error {
+	if newName == "" && messageListVisibility == "" && labelListVisibility == "" {
+		return fmt.Errorf("nothing to update: provide --name, --message-list-visibility, or --label-list-visibility")
+	}
+
+	out.writeVerbose("Loading labels to resolve %q...", labelRef)
+	if err := conn.LoadLabels(ctx, out.verbose); err != nil {
+		return fmt.Errorf("failed to load labels: %w", err)
+	}
+
+	resolvedID, err := resolveLabelID(conn, labelRef)
+	if err != nil {
+		return err
+	}
+	out.writeVerbose("Resolved label %q to ID %q", labelRef, resolvedID)
+
+	updated, err := conn.UpdateLabel(ctx, resolvedID, newName, messageListVisibility, labelListVisibility)
+	if err != nil {
+		return fmt.Errorf("failed to update label: %w", err)
+	}
+
+	if out.json {
+		o := labelListOutput{
+			ID:              updated.Id,
+			Name:            updated.Name,
+			Type:            updated.Type,
+			MessageListView: updated.MessageListVisibility,
+			LabelListView:   updated.LabelListVisibility,
+		}
+		if updated.Color != nil {
+			o.Color = updated.Color.BackgroundColor
+		}
+		return out.writeJSON(o)
+	}
+
+	out.writeMessage(fmt.Sprintf("Updated label %q (ID: %s)", updated.Name, updated.Id))
+	return nil
+}
+
+func runLabelsDelete(ctx context.Context, conn *gwcli.CmdG, labelRef string, force bool, out *outputWriter) error {
+	if !force {
+		return fmt.Errorf("refusing to delete without --force")
+	}
+
+	out.writeVerbose("Loading labels to resolve %q...", labelRef)
+	if err := conn.LoadLabels(ctx, out.verbose); err != nil {
+		return fmt.Errorf("failed to load labels: %w", err)
+	}
+
+	resolvedID, err := resolveLabelID(conn, labelRef)
+	if err != nil {
+		return err
+	}
+
+	// Guard against deleting Gmail system labels (INBOX, SENT, ...), which the
+	// API rejects anyway — give a clearer error up front.
+	for _, l := range conn.Labels() {
+		if l.ID == resolvedID && l.Response != nil && l.Response.Type == "system" {
+			return fmt.Errorf("cannot delete system label %q", l.Label)
+		}
+	}
+
+	out.writeVerbose("Deleting label %q (ID: %s)...", labelRef, resolvedID)
+	if err := conn.DeleteLabel(ctx, resolvedID); err != nil {
+		return fmt.Errorf("failed to delete label: %w", err)
+	}
+
+	if out.json {
+		return out.writeJSON(map[string]string{"status": "deleted", "id": resolvedID})
+	}
+
+	out.writeMessage(fmt.Sprintf("Deleted label (ID: %s)", resolvedID))
+	return nil
+}
+
 func runLabelsApply(ctx context.Context, conn *gwcli.CmdG, labelID, messageID string, stdin bool, verbose bool, out *outputWriter) error {
 	var ids []string
 	var err error
diff --git a/labels_test.go b/labels_test.go
new file mode 100644
index 0000000..f341319
--- /dev/null
+++ b/labels_test.go
@@ -0,0 +1,277 @@
+package main
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"io"
+	"net/http"
+	"strings"
+	"testing"
+
+	"github.com/wesnick/gwcli/pkg/gwcli"
+)
+
+// labelsListJSON is a minimal Users.Labels.List response used to seed the
+// connection's label cache in tests.
+const labelsListJSON = `{
+	"labels": [
+		{"id": "INBOX", "name": "INBOX", "type": "system"},
+		{"id": "Label_1", "name": "Work", "type": "user"}
+	]
+}`
+
+// labelsTestClient builds an *http.Client whose RoundTripper answers the
+// Users.Labels.List call with labelsListJSON and routes every other Gmail
+// request to mutate (typically the create/update/delete call under test).
+func labelsTestClient(t *testing.T, mutate func(*http.Request) (*http.Response, error)) *http.Client {
+	t.Helper()
+	return &http.Client{
+		Transport: roundTripFunc(func(req *http.Request) (*http.Response, error) {
+			if !strings.Contains(req.URL.String(), "gmail.googleapis.com") {
+				t.Fatalf("unexpected URL: %s", req.URL.String())
+			}
+			// Label listing (used by LoadLabels) is a GET on .../labels.
+			if req.Method == http.MethodGet && strings.HasSuffix(req.URL.Path, "/labels") {
+				return &http.Response{
+					StatusCode: http.StatusOK,
+					Header:     make(http.Header),
+					Body:       io.NopCloser(strings.NewReader(labelsListJSON)),
+				}, nil
+			}
+			return mutate(req)
+		}),
+	}
+}
+
+func TestRunLabelsCreate(t *testing.T) {
+	const createdJSON = `{"id": "Label_99", "name": "Urgent", "type": "user", "labelListVisibility": "labelShow", "messageListVisibility": "show"}`
+
+	client := labelsTestClient(t, func(req *http.Request) (*http.Response, error) {
+		if req.Method != http.MethodPost {
+			t.Errorf("expected POST for create, got %s", req.Method)
+		}
+		return &http.Response{
+			StatusCode: http.StatusOK,
+			Header:     make(http.Header),
+			Body:       io.NopCloser(strings.NewReader(createdJSON)),
+		}, nil
+	})
+
+	conn, err := gwcli.NewFake(client)
+	if err != nil {
+		t.Fatalf("NewFake() error = %v", err)
+	}
+
+	var buf bytes.Buffer
+	out := &outputWriter{json: true, writer: &buf}
+
+	if err := runLabelsCreate(context.Background(), conn, "Urgent", "show", "labelShow", out); err != nil {
+		t.Fatalf("runLabelsCreate() error = %v", err)
+	}
+
+	var result labelListOutput
+	if err := json.Unmarshal(buf.Bytes(), &result); err != nil {
+		t.Fatalf("failed to unmarshal output: %v", err)
+	}
+	if result.ID != "Label_99" {
+		t.Errorf("expected ID 'Label_99', got %q", result.ID)
+	}
+	if result.Name != "Urgent" {
+		t.Errorf("expected name 'Urgent', got %q", result.Name)
+	}
+}
+
+func TestRunLabelsCreateEmptyName(t *testing.T) {
+	client := &http.Client{
+		Transport: roundTripFunc(func(req *http.Request) (*http.Response, error) {
+			t.Fatal("HTTP request should not be made with empty name")
+			return nil, nil
+		}),
+	}
+	conn, err := gwcli.NewFake(client)
+	if err != nil {
+		t.Fatalf("NewFake() error = %v", err)
+	}
+
+	var buf bytes.Buffer
+	out := &outputWriter{json: true, writer: &buf}
+
+	err = runLabelsCreate(context.Background(), conn, "   ", "", "", out)
+	if err == nil {
+		t.Fatal("expected error for empty name, got nil")
+	}
+	if !strings.Contains(err.Error(), "name is required") {
+		t.Errorf("expected 'name is required' error, got %q", err.Error())
+	}
+}
+
+func TestRunLabelsCreateDuplicate(t *testing.T) {
+	client := labelsTestClient(t, func(req *http.Request) (*http.Response, error) {
+		t.Fatalf("create RPC should not be issued for a duplicate name (method=%s)", req.Method)
+		return nil, nil
+	})
+	conn, err := gwcli.NewFake(client)
+	if err != nil {
+		t.Fatalf("NewFake() error = %v", err)
+	}
+
+	var buf bytes.Buffer
+	out := &outputWriter{json: true, writer: &buf}
+
+	// "work" matches the existing "Work" label case-insensitively.
+	err = runLabelsCreate(context.Background(), conn, "work", "", "", out)
+	if err == nil {
+		t.Fatal("expected error for duplicate label, got nil")
+	}
+	if !strings.Contains(err.Error(), "already exists") {
+		t.Errorf("expected 'already exists' error, got %q", err.Error())
+	}
+}
+
+func TestRunLabelsUpdate(t *testing.T) {
+	const patchedJSON = `{"id": "Label_1", "name": "Work Renamed", "type": "user"}`
+
+	var patchedID string
+	client := labelsTestClient(t, func(req *http.Request) (*http.Response, error) {
+		if req.Method != http.MethodPatch {
+			t.Errorf("expected PATCH for update, got %s", req.Method)
+		}
+		patchedID = req.URL.Path[strings.LastIndex(req.URL.Path, "/")+1:]
+		return &http.Response{
+			StatusCode: http.StatusOK,
+			Header:     make(http.Header),
+			Body:       io.NopCloser(strings.NewReader(patchedJSON)),
+		}, nil
+	})
+
+	conn, err := gwcli.NewFake(client)
+	if err != nil {
+		t.Fatalf("NewFake() error = %v", err)
+	}
+
+	var buf bytes.Buffer
+	out := &outputWriter{json: true, writer: &buf}
+
+	// Resolve by name "Work" -> ID "Label_1".
+	if err := runLabelsUpdate(context.Background(), conn, "Work", "Work Renamed", "", "", out); err != nil {
+		t.Fatalf("runLabelsUpdate() error = %v", err)
+	}
+	if patchedID != "Label_1" {
+		t.Errorf("expected PATCH on 'Label_1', got %q", patchedID)
+	}
+
+	var result labelListOutput
+	if err := json.Unmarshal(buf.Bytes(), &result); err != nil {
+		t.Fatalf("failed to unmarshal output: %v", err)
+	}
+	if result.Name != "Work Renamed" {
+		t.Errorf("expected name 'Work Renamed', got %q", result.Name)
+	}
+}
+
+func TestRunLabelsUpdateNoChanges(t *testing.T) {
+	client := labelsTestClient(t, func(req *http.Request) (*http.Response, error) {
+		t.Fatalf("no RPC should be issued when nothing changes (method=%s)", req.Method)
+		return nil, nil
+	})
+	conn, err := gwcli.NewFake(client)
+	if err != nil {
+		t.Fatalf("NewFake() error = %v", err)
+	}
+
+	var buf bytes.Buffer
+	out := &outputWriter{json: true, writer: &buf}
+
+	err = runLabelsUpdate(context.Background(), conn, "Work", "", "", "", out)
+	if err == nil {
+		t.Fatal("expected error when no fields provided, got nil")
+	}
+	if !strings.Contains(err.Error(), "nothing to update") {
+		t.Errorf("expected 'nothing to update' error, got %q", err.Error())
+	}
+}
+
+func TestRunLabelsDelete(t *testing.T) {
+	var deletedID string
+	client := labelsTestClient(t, func(req *http.Request) (*http.Response, error) {
+		if req.Method != http.MethodDelete {
+			t.Errorf("expected DELETE, got %s", req.Method)
+		}
+		deletedID = req.URL.Path[strings.LastIndex(req.URL.Path, "/")+1:]
+		return &http.Response{
+			StatusCode: http.StatusNoContent,
+			Header:     make(http.Header),
+			Body:       io.NopCloser(strings.NewReader("")),
+		}, nil
+	})
+
+	conn, err := gwcli.NewFake(client)
+	if err != nil {
+		t.Fatalf("NewFake() error = %v", err)
+	}
+
+	var buf bytes.Buffer
+	out := &outputWriter{json: true, writer: &buf}
+
+	if err := runLabelsDelete(context.Background(), conn, "Work", true, out); err != nil {
+		t.Fatalf("runLabelsDelete() error = %v", err)
+	}
+	if deletedID != "Label_1" {
+		t.Errorf("expected DELETE on 'Label_1', got %q", deletedID)
+	}
+
+	var result map[string]string
+	if err := json.Unmarshal(buf.Bytes(), &result); err != nil {
+		t.Fatalf("failed to unmarshal output: %v", err)
+	}
+	if result["status"] != "deleted" || result["id"] != "Label_1" {
+		t.Errorf("unexpected delete result: %v", result)
+	}
+}
+
+func TestRunLabelsDeleteRequiresForce(t *testing.T) {
+	client := labelsTestClient(t, func(req *http.Request) (*http.Response, error) {
+		t.Fatalf("no RPC should be issued without --force (method=%s)", req.Method)
+		return nil, nil
+	})
+	conn, err := gwcli.NewFake(client)
+	if err != nil {
+		t.Fatalf("NewFake() error = %v", err)
+	}
+
+	var buf bytes.Buffer
+	out := &outputWriter{json: true, writer: &buf}
+
+	err = runLabelsDelete(context.Background(), conn, "Work", false, out)
+	if err == nil {
+		t.Fatal("expected error without --force, got nil")
+	}
+	if !strings.Contains(err.Error(), "--force") {
+		t.Errorf("expected '--force' error, got %q", err.Error())
+	}
+}
+
+func TestRunLabelsDeleteSystemLabel(t *testing.T) {
+	client := labelsTestClient(t, func(req *http.Request) (*http.Response, error) {
+		if req.Method == http.MethodDelete {
+			t.Fatal("system label should not be deleted")
+		}
+		return nil, nil
+	})
+	conn, err := gwcli.NewFake(client)
+	if err != nil {
+		t.Fatalf("NewFake() error = %v", err)
+	}
+
+	var buf bytes.Buffer
+	out := &outputWriter{json: true, writer: &buf}
+
+	err = runLabelsDelete(context.Background(), conn, "INBOX", true, out)
+	if err == nil {
+		t.Fatal("expected error deleting system label, got nil")
+	}
+	if !strings.Contains(err.Error(), "system label") {
+		t.Errorf("expected 'system label' error, got %q", err.Error())
+	}
+}
diff --git a/main.go b/main.go
index bc44ac4..a524d78 100644
--- a/main.go
+++ b/main.go
@@ -142,6 +142,24 @@ type CLI struct {
 			UserOnly bool `help:"User labels only" name:"user-only"`
 		} `cmd:"" help:"List labels"`
 
+		Create struct {
+			Name                  string `arg:"" required:"" help:"Name of the label to create (use '/' for nesting, e.g. 'Work/Urgent')"`
+			MessageListVisibility string `name:"message-list-visibility" help:"Show label's messages in the message list: show|hide" enum:"show,hide," default:""`
+			LabelListVisibility   string `name:"label-list-visibility" help:"Show label in the label list: labelShow|labelShowIfUnread|labelHide" enum:"labelShow,labelShowIfUnread,labelHide," default:""`
+		} `cmd:"" help:"Create a new label"`
+
+		Update struct {
+			LabelID               string `arg:"" required:"" help:"Label ID or name to update"`
+			Name                  string `name:"name" help:"New name for the label"`
+			MessageListVisibility string `name:"message-list-visibility" help:"Show label's messages in the message list: show|hide" enum:"show,hide," default:""`
+			LabelListVisibility   string `name:"label-list-visibility" help:"Show label in the label list: labelShow|labelShowIfUnread|labelHide" enum:"labelShow,labelShowIfUnread,labelHide," default:""`
+		} `cmd:"" help:"Update (rename / change visibility of) a label"`
+
+		Delete struct {
+			LabelID string `arg:"" required:"" help:"Label ID or name to delete"`
+			Force   bool   `name:"force" short:"f" help:"Confirm deletion"`
+		} `cmd:"" help:"Delete a label"`
+
 		Apply struct {
 			LabelID   string `arg:"" required:"" help:"Label ID or name"`
 			MessageID string `help:"Message ID" name:"message"`
@@ -585,7 +603,46 @@ func main() {
 			os.Exit(2)
 		}
 
-	case "labels apply":
+	case "labels create <name>":
+		cmdCtx := context.Background()
+		conn, err := getConnection(cli.Config, cli.User, cli.Verbose)
+		if err != nil {
+			out.writeError(err)
+			os.Exit(3)
+		}
+
+		if err := runLabelsCreate(cmdCtx, conn, cli.Labels.Create.Name, cli.Labels.Create.MessageListVisibility, cli.Labels.Create.LabelListVisibility, out); err != nil {
+			out.writeError(err)
+			os.Exit(2)
+		}
+
+	case "labels update <label-id>":
+		cmdCtx := context.Background()
+		conn, err := getConnection(cli.Config, cli.User, cli.Verbose)
+		if err != nil {
+			out.writeError(err)
+			os.Exit(3)
+		}
+
+		if err := runLabelsUpdate(cmdCtx, conn, cli.Labels.Update.LabelID, cli.Labels.Update.Name, cli.Labels.Update.MessageListVisibility, cli.Labels.Update.LabelListVisibility, out); err != nil {
+			out.writeError(err)
+			os.Exit(2)
+		}
+
+	case "labels delete <label-id>":
+		cmdCtx := context.Background()
+		conn, err := getConnection(cli.Config, cli.User, cli.Verbose)
+		if err != nil {
+			out.writeError(err)
+			os.Exit(3)
+		}
+
+		if err := runLabelsDelete(cmdCtx, conn, cli.Labels.Delete.LabelID, cli.Labels.Delete.Force, out); err != nil {
+			out.writeError(err)
+			os.Exit(2)
+		}
+
+	case "labels apply <label-id>":
 		cmdCtx := context.Background()
 		conn, err := getConnection(cli.Config, cli.User, cli.Verbose)
 		if err != nil {
@@ -598,7 +655,7 @@ func main() {
 			os.Exit(2)
 		}
 
-	case "labels remove":
+	case "labels remove <label-id>":
 		cmdCtx := context.Background()
 		conn, err := getConnection(cli.Config, cli.User, cli.Verbose)
 		if err != nil {
diff --git a/pkg/gwcli/connection.go b/pkg/gwcli/connection.go
index b045fc8..2087af5 100644
--- a/pkg/gwcli/connection.go
+++ b/pkg/gwcli/connection.go
@@ -121,6 +121,8 @@ func (c *CmdG) LabelCache(label *Label) *Label {
 func NewFake(client *http.Client) (*CmdG, error) {
 	conn := &CmdG{
 		authedClient: client,
+		messageCache: make(map[string]*Message),
+		labelCache:   make(map[string]*Label),
 	}
 	return conn, conn.setupClients()
 }
@@ -516,6 +518,72 @@ func (c *CmdG) Labels() []*Label {
 	return ret
 }
 
+// invalidateLabels drops the cached labels so the next access reloads them
+// from the Gmail API. Called after a create/update/delete mutates the
+// account's label set.
+func (c *CmdG) invalidateLabels() {
+	c.m.Lock()
+	defer c.m.Unlock()
+	c.labelCache = make(map[string]*Label)
+	c.labelsLoaded = false
+}
+
+// CreateLabel creates a new user label and returns the created Gmail label.
+// messageListVisibility ("show"/"hide") and labelListVisibility
+// ("labelShow"/"labelShowIfUnread"/"labelHide") are optional; empty values let
+// Gmail apply its defaults.
+func (c *CmdG) CreateLabel(ctx context.Context, name, messageListVisibility, labelListVisibility string) (*gmail.Label, error) {
+	label := &gmail.Label{
+		Name:                  name,
+		MessageListVisibility: messageListVisibility,
+		LabelListVisibility:   labelListVisibility,
+	}
+	var ret *gmail.Label
+	err := wrapLogRPC("gmail.Users.Labels.Create", func() (err error) {
+		ret, err = c.gmail.Users.Labels.Create(email, label).Context(ctx).Do()
+		return
+	}, "email=%q name=%q", email, name)
+	if err != nil {
+		return nil, err
+	}
+	c.invalidateLabels()
+	return ret, nil
+}
+
+// UpdateLabel renames a label and/or changes its visibility. Empty arguments
+// are left unchanged. id may be a label ID; callers that have a name should
+// resolve it to an ID first.
+func (c *CmdG) UpdateLabel(ctx context.Context, id, name, messageListVisibility, labelListVisibility string) (*gmail.Label, error) {
+	patch := &gmail.Label{
+		Name:                  name,
+		MessageListVisibility: messageListVisibility,
+		LabelListVisibility:   labelListVisibility,
+	}
+	var ret *gmail.Label
+	err := wrapLogRPC("gmail.Users.Labels.Patch", func() (err error) {
+		ret, err = c.gmail.Users.Labels.Patch(email, id, patch).Context(ctx).Do()
+		return
+	}, "email=%q id=%q name=%q", email, id, name)
+	if err != nil {
+		return nil, err
+	}
+	c.invalidateLabels()
+	return ret, nil
+}
+
+// DeleteLabel permanently deletes a user label. Messages keep existing; only
+// the label association is removed.
+func (c *CmdG) DeleteLabel(ctx context.Context, id string) error {
+	err := wrapLogRPC("gmail.Users.Labels.Delete", func() error {
+		return c.gmail.Users.Labels.Delete(email, id).Context(ctx).Do()
+	}, "email=%q id=%q", email, id)
+	if err != nil {
+		return err
+	}
+	c.invalidateLabels()
+	return nil
+}
+
 // GmailService returns the Gmail API service.
 func (c *CmdG) GmailService() *gmail.Service {
 	return c.gmail