feat: wire real AgentOS execution

packages/backend/convex/gitConnectionData.ts

@@ -3,6 +3,21 @@ import { ConvexError, v } from "convex/values";
 import { internalMutation, mutation, query } from "./_generated/server";
 import { requireCurrentOrganization, requireProjectMember } from "./authz";
 
+// Provider ("forge") that owns a repository host. A project's source must be
+// served by the same forge whose credentials are attached, so a Gitea token is
+// never offered to GitHub and vice versa. Unknown hosts return null, leaving
+// the caller free to attach without a forge constraint.
+export const forgeForHost = (host: string): "github" | "gitea" | null => {
+  const normalized = host.toLowerCase();
+  if (normalized === "github.com" || normalized.endsWith(".githost.com")) {
+    return "github";
+  }
+  if (normalized === "git.openputer.com") {
+    return "gitea";
+  }
+  return null;
+};
+
 export const persist = internalMutation({
   args: {
     credentialCiphertext: v.string(),
@@ -110,6 +125,15 @@ export const attachToProject = mutation({
     if (!connection || connection.organizationId !== organizationId) {
       throw new ConvexError("Git connection not found");
     }
+    const project = await ctx.db.get(args.projectId);
+    if (project) {
+      const expected = forgeForHost(project.sourceHost);
+      if (expected && connection.provider !== expected) {
+        throw new ConvexError(
+          `Git credential provider (${connection.provider}) does not match this project's forge (${expected})`
+        );
+      }
+    }
     await ctx.db.patch(args.projectId, {
       gitConnectionId: connection._id,
       updatedAt: Date.now(),