Working directory

Read this at run time rather than carrying your own copy. The skip lists and the per-file ceiling move with the reading pipeline, and a client that hardcodes them starts pushing bytes the server refuses.

`secretShapes` names the credential shapes no lane stores unasked. Skip them locally; a client that sends one anyway is refused per file rather than per push.

curl -X GET "https://runlog-7613480744.us-central1.run.app/v1/api/workspace/describe" \
  -H "Authorization: Bearer $RUNLOG_API_KEY" \
  -H "X-Project-Id: p7Kd2mQx"

{
  "codeExtensions": [
    ".go",
    ".ts",
    ".py"
  ],
  "maxFileBytes": 2097152,
  "projectId": "p7Kd2mQx",
  "projectName": "Checkout",
  "secretShapes": [
    "private-key",
    "cloud-credential"
  ],
  "skippedDirectories": [
    "node_modules",
    ".git"
  ],
  "skippedExtensions": [
    ".lock"
  ],
  "skippedNames": [
    ".DS_Store"
  ],
  "version": 1
}

Compare `contentId` against the same content address computed locally. Equal means the file is already read, and sending it again would cost money to learn nothing.

curl -X GET "https://runlog-7613480744.us-central1.run.app/v1/api/workspace/manifest" \
  -H "Authorization: Bearer $RUNLOG_API_KEY" \
  -H "X-Project-Id: p7Kd2mQx"

{
  "files": [
    {
      "contentId": "9dRk2mVt7QzLpXe4Nb1CsHgYo6JwFu3Ai0",
      "path": "cmd/main.go"
    }
  ],
  "version": 1
}

This route is not metered. Asking what something costs can never be the thing that spends the allowance.

`basis` is `measured` when this project's own history priced it and `calibrated` when the platform figure did. `allowanceWindow` names the window `allowanceRemainingUsd` belongs to, so a quote never reports a figure against a window it did not come from.

curl -X POST "https://runlog-7613480744.us-central1.run.app/v1/api/workspace/quote" \
  -H "Authorization: Bearer $RUNLOG_API_KEY" \
  -H "X-Project-Id: p7Kd2mQx" \
  -H "Content-Type: application/json" \
  -d '{
  "byteCount": 3819044,
  "fileCount": 412,
  "version": 1
}'

{
  "allowanceRemainingUsd": 6.15,
  "allowanceWindow": "weekly",
  "basis": "measured",
  "byteCount": 3819044,
  "estimateUsd": 0.42,
  "fileCount": 412,
  "prepaidBalanceUsd": 25,
  "version": 1,
  "weeklyAllowanceUsd": 9
}

A refusal is per file and never stops the rest of the push, so one unreadable file cannot cost you the batch. Every refusal names its path and says why in the words the person who ran the command reads.

`includeSecret` is you naming one exact path to read anyway. It is per path rather than a mode, so nothing sends a whole folder of credentials by setting one flag.

curl -X POST "https://runlog-7613480744.us-central1.run.app/v1/api/workspace/sync" \
  -H "Authorization: Bearer $RUNLOG_API_KEY" \
  -H "X-Project-Id: p7Kd2mQx" \
  -H "Content-Type: application/json" \
  -d '{
  "items": [
    {
      "content": "cGFja2FnZSBtYWluCg==",
      "contentType": "text/x-go",
      "path": "cmd/main.go"
    }
  ],
  "version": 1
}'

{
  "indexed": [
    "cmd/main.go"
  ],
  "refused": [
    {
      "path": ".env",
      "reason": "This looks like a credential, so it was left alone."
    }
  ],
  "version": 1
}

Deletion is a separate call from the push on purpose: a client that crashed mid-scan must not be able to empty a project by reporting the files it had not reached yet as gone.

curl -X POST "https://runlog-7613480744.us-central1.run.app/v1/api/workspace/reconcile" \
  -H "Authorization: Bearer $RUNLOG_API_KEY" \
  -H "X-Project-Id: p7Kd2mQx" \
  -H "Content-Type: application/json" \
  -d '{
  "paths": [
    "cmd/old.go"
  ],
  "version": 1
}'

{
  "refused": [],
  "removed": [
    "cmd/old.go"
  ],
  "version": 1
}