fix(import-external-session): commit missing generated proto bindings

.github/workflows/build.yml

@@ -164,6 +164,15 @@ jobs:
         run: ./scripts/build-tmux.sh
 
       - name: Run tests with coverage (pinned tmux 3.4)
+        # STAPLER_SQUAD_TMUX_CREATE_TIMEOUT_SECONDS: production default is 10s
+        # (session/tmux/tmux.go's sessionCreateTimeoutDefault) -- this only
+        # widens the budget for this CI job, where a fully-loaded runner
+        # running every package's -race suite concurrently can occasionally
+        # exceed 10s of pure CPU-scheduling delay spinning up even an
+        # isolated tmux -L server, not lock contention. See tmux.go's
+        # sessionCreateTimeout doc comment for the incident this closes.
+        env:
+          STAPLER_SQUAD_TMUX_CREATE_TIMEOUT_SECONDS: "30"
         run: |
           TMUX_BIN="$(pwd)/bin/tmux" go test -race -coverprofile=coverage.out \
             -covermode=atomic ./server/... ./session/... ./config/... \

.github/workflows/generated-proto-guard.yml

@@ -0,0 +1,61 @@
+name: Generated Protobuf Guard
+
+# Hard CI backstop for generated protobuf/connect code getting committed. gen/ and
+# web-app/src/gen/ are gitignored (see .gitignore) — every make target that consumes
+# generated code (build, test, lint) already depends on proto-gen, and CI regenerates
+# fresh before every consuming step (see .github/workflows/lint.yml, .github/actions/
+# prepare/action.yml). Committing these files anyway has caused real breakage twice:
+# once when a stale/incomplete force-add (git add -f) shipped generated bindings that
+# didn't match proto/session/v1/import.proto's actual contents, and once when a CI
+# workflow step ran Jest before regenerating protos and only "worked" by accident
+# because most generated files happened to already be force-added (PR #445 fixed both;
+# see that PR's description for the full incident writeup). AI coding agents in
+# particular tend to `git add -f` a generated file to make a local build pass without
+# realizing the ignore is deliberate — this workflow catches that regardless of how it
+# happened (manual commit, agent-driven commit, a stray `git add -A`/`git add -f`, a
+# merge, etc).
+
+on:
+  pull_request:
+    branches: [ main ]
+
+jobs:
+  guard:
+    name: no-checked-in-generated-protos
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Check PR diff for committed generated protobuf files
+        env:
+          BASE_SHA: ${{ github.event.pull_request.base.sha }}
+          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+        run: |
+          set -euo pipefail
+          CHANGED=$(git diff --name-only --diff-filter=ACMR "$BASE_SHA...$HEAD_SHA" || true)
+          if [ -z "$CHANGED" ]; then
+            echo "No added/modified files detected"
+            exit 0
+          fi
+
+          # Mirrors the "Generated protocol buffer code" block in .gitignore.
+          MATCHES=$(echo "$CHANGED" | grep -E '^gen/|^web/src/gen/|^web-app/src/gen/' || true)
+
+          if [ -n "$MATCHES" ]; then
+            echo "::error::This PR commits generated protobuf file(s) that must never be tracked:"
+            echo "$MATCHES"
+            echo ""
+            echo "These paths are gitignored (see .gitignore's \"Generated protocol buffer"
+            echo "code\" block) and are always regenerated fresh by make proto-gen / buf"
+            echo "generate proto before every consuming build/test/lint step — see"
+            echo ".github/workflows/lint.yml and .github/actions/prepare/action.yml."
+            echo ""
+            echo "Fix: git rm --cached <file> for each path above, commit, and re-push."
+            echo "If your change needs a NEW proto file's generated output to build/test"
+            echo "locally, run 'make proto-gen' — do not git add -f the result."
+            exit 1
+          fi
+
+          echo "No generated protobuf files in diff — OK"

.github/workflows/lint.yml

@@ -71,16 +71,22 @@ jobs:
         working-directory: web-app
         run: pnpm install --frozen-lockfile
 
-      - name: Jest
-        working-directory: web-app
-        run: npx jest --ci --maxWorkers=4
-
+      # Must run before Jest (and before golangci-lint below): generated code is
+      # gitignored, not committed (see #445) — any step that reads gen/ or
+      # web-app/src/gen/ needs these to have run first in THIS job. Ordering
+      # bug history: Jest used to run before this step, so it silently depended
+      # on generated files happening to already be committed; the one proto
+      # file whose generated output wasn't committed broke Jest with "Could not
+      # locate module" until this reorder.
       - name: Generate protobuf code
         run: buf generate proto
 
       - name: Generate ent ORM code
         run: go run -mod=mod entgo.io/ent/cmd/ent generate --feature sql/upsert ./session/ent/schema
 
+      - name: Jest
+        working-directory: web-app
+        run: npx jest --ci --maxWorkers=4
 
       - name: Create web dist stub
         run: |

.gitignore

@@ -15,7 +15,13 @@ stapler-squad-test
 !web-app/src/**/logs/
 !web-app/src/**/logs/**
 
-# Generated protocol buffer code
+# Generated protocol buffer code — regenerate with: make proto-gen (or buf generate proto).
+# NEVER force-add (git add -f) files under these paths, even to "fix" a build. Every
+# make target that consumes generated code (build, test, lint) already depends on
+# proto-gen; CI generates fresh before every consuming step. Committing these files
+# has caused real breakage twice: once by force-adding a stale/incomplete generation,
+# once by a CI workflow step ordering bug that only "worked" because these were
+# force-added in the first place (see PR #445 and CI job "no-checked-in-generated-protos").
 gen/
 web/src/gen/
 web-app/src/gen/