feat(web,ui): per-project forced git provider and settings gating

Adds a per-project forced provider (github|gitlab|gitea) on top of the
per-project API base URL overrides: stored under gitProviders.provider in
projects/<projectId>.json, sanitized server-side, and winning over remote-host
detection both in useGitProvider and in server repo resolution
(parseGitLabRemoteUrl/parseGiteaRemoteUrl accept any host when the provider
is forced). The Projects settings page replaces the three always-visible URL
fields with a provider selector (auto-detect + the three forges) and one URL
override for the active provider. Global provider override fields on the
GitHub/GitLab/Gitea settings tabs now render only once an account is
connected, and Settings search availability matches that gating.

Also fixes the useConfigStore/useDirectoryStore circular-import TDZ in the
bundled chunk via the window-registered store handle and defers the directory
subscription to a microtask; fixes the Gitea PR merge payload (Do carries the
merge-style string enum, not a boolean + MergeMethod); and adds a documented
Gitea client live-test harness (scripts/gitea-live-test.ts + client.d.ts).

packages/web/server/lib/git-providers/DOCUMENTATION.md

@@ -27,11 +27,13 @@
 ## Public exports — `project-config.js`
 
 - `OPENCHAMBER_PROJECTS_DIR`: `path.join(OPENCHAMBER_DATA_DIR, 'projects')` (same `OPENCHAMBER_DATA_DIR` env logic as `config.js`).
-- `sanitizeProjectGitProviders(payload)`: same provider allowlist/`normalizeBaseUrl` rules as `sanitizeGitProviders`, but the per-project shape only carries `apiBaseUrl` (`detectUrls` tolerated and stripped); `undefined` when nothing valid remains.
+- `sanitizeProjectGitProviders(payload)`: same provider allowlist/`normalizeBaseUrl` rules as `sanitizeGitProviders`, but the per-project shape only carries `apiBaseUrl` (`detectUrls` tolerated and stripped) plus an optional forced `provider` (`github|gitlab|gitea`, normalized lowercase; unknown values dropped); `undefined` when nothing valid remains.
 - `readProjectJson(projectId)`: raw JSON object from `projects/<projectId>.json`; `{}` on missing/malformed file, `null` for an invalid projectId; never throws.
 - `getProjectGitProviders(projectId)`: effective per-project overrides (`{}` when unset or invalid projectId).
 - `resolveProjectIdFromDirectory(directory)`: projectId for a directory — worktree-aware: the directory is first resolved to its main repo root via `git rev-parse --git-common-dir` (handles linked worktrees created outside the project root, and a project rooted at the filesystem `/`), then the longest matching project path from the settings.json `projects` list that equals it or is a path-prefix wins; when git is unavailable or the directory is not a git repo, the directory's own exact/containment match applies; fallback `createProjectIdFromPath(directory)`; `null` for empty input. Results are cached per-directory for 60s (TTL cache, negative results included) so forge hot paths don't exec git / re-read settings.json per request. `_clearResolveProjectIdCache()` is a test-only hook to drop the cache.
 - `getProjectProviderApiBaseUrl(provider, projectId)`: per-project `apiBaseUrl` override or `null`.
+- `getProjectProvider(projectId)`: the project's forced provider (`github|gitlab|gitea`) or `null` when auto-detected.
+- `getProjectProviderFromDirectory(directory)`: forced provider for a directory's owning project (via `resolveProjectIdFromDirectory` → `getProjectProvider`), or `null`.
 - `getEffectiveProviderApiBaseUrl(provider, directory)`: project override -> `getProviderApiBaseUrl(provider)` (global -> built-in default); `null` only when nothing resolves.
 - `saveProjectGitProviders(projectId, payload)`: persist the per-project overrides, preserving all other project JSON keys (atomic tmp-file + rename write); returns the saved `gitProviders` object (or `{}`); throws for an invalid projectId.
 
@@ -65,6 +67,7 @@
   "version": 1,
   "projectNotes": "...",
   "gitProviders": {
+    "provider": "gitlab",
     "github": { "apiBaseUrl": "https://project.github.example.com" },
     "gitlab": { "apiBaseUrl": "https://project.gitlab.example.com" }
   }
@@ -72,6 +75,7 @@
 ```
 
 - Per-project `gitProviders` carry `apiBaseUrl` only (no `detectUrls`); unknown provider keys are dropped and `apiBaseUrl` is normalized with the same rules as the global settings.
+- Optional `provider` (`github|gitlab|gitea`) forces the project's git provider instead of auto-detection. Client-side, a forced provider short-circuits remote-host detection (`useGitProvider`); server-side, it makes any remote host acceptable for that provider's repo parsing (`gitlab/repo.js`, `gitea/repo.js`).
 - `projects/<projectId>.json` is shared with the scheduled-tasks/projectNotes config; reading and saving preserve all other keys (the `gitProviders` key is omitted entirely when empty).
 - **Precedence per provider:** project override (`projects/<projectId>.json` → `getProjectProviderApiBaseUrl`) > global `settings.json` (`getProviderApiBaseUrl`) > built-in default (`GIT_PROVIDER_DEFAULTS`).
 

packages/web/server/lib/git-providers/project-config.js

@@ -30,26 +30,35 @@ const normalizeProjectPathForMatch = (value) => {
   return value.replace(/\\/g, '/').replace(/\/+$/g, '') || value;
 };
 
+const GIT_PROVIDER_SET = new Set(['github', 'gitlab', 'gitea']);
+
 /**
  * Validate/normalize a per-project `gitProviders` value. Same provider
  * allowlist and `normalizeBaseUrl` rules as `sanitizeGitProviders`, but the
  * per-project shape only carries `apiBaseUrl` (any `detectUrls` are tolerated
- * and stripped). Returns undefined when nothing valid remains.
+ * and stripped) plus an optional forced `provider` (github|gitlab|gitea) that
+ * overrides automatic provider detection for the project. Returns undefined
+ * when nothing valid remains.
  */
 export function sanitizeProjectGitProviders(payload) {
-  const sanitized = sanitizeGitProviders(payload);
-  if (!sanitized) {
-    return undefined;
-  }
   const result = {};
-  for (const provider of Object.keys(sanitized)) {
-    const entry = sanitized[provider];
-    const normalized = {};
-    if (entry.apiBaseUrl) {
-      normalized.apiBaseUrl = entry.apiBaseUrl;
+  if (payload && typeof payload === 'object' && !Array.isArray(payload)) {
+    const forcedProvider = typeof payload.provider === 'string' ? payload.provider.trim().toLowerCase() : '';
+    if (GIT_PROVIDER_SET.has(forcedProvider)) {
+      result.provider = forcedProvider;
     }
-    if (Object.keys(normalized).length > 0) {
-      result[provider] = normalized;
+  }
+  const sanitized = sanitizeGitProviders(payload);
+  if (sanitized) {
+    for (const provider of Object.keys(sanitized)) {
+      const entry = sanitized[provider];
+      const normalized = {};
+      if (entry.apiBaseUrl) {
+        normalized.apiBaseUrl = entry.apiBaseUrl;
+      }
+      if (Object.keys(normalized).length > 0) {
+        result[provider] = normalized;
+      }
     }
   }
   return Object.keys(result).length > 0 ? result : undefined;
@@ -270,6 +279,28 @@ export function getProjectProviderApiBaseUrl(provider, projectId) {
   return getProjectGitProviders(projectId)[provider]?.apiBaseUrl || null;
 }
 
+/**
+ * The project's forced git provider (github|gitlab|gitea), or null when the
+ * provider is auto-detected from the remote. Only meaningful for a projectId
+ * that resolves to a project config; invalid ids yield null.
+ */
+export function getProjectProvider(projectId) {
+  const providers = getProjectGitProviders(projectId);
+  return providers.provider || null;
+}
+
+/**
+ * The forced git provider for a directory's owning project, or null when
+ * unset or when the directory resolves to no project.
+ */
+export function getProjectProviderFromDirectory(directory) {
+  const projectId = resolveProjectIdFromDirectory(directory);
+  if (!projectId) {
+    return null;
+  }
+  return getProjectProvider(projectId);
+}
+
 /**
  * Effective API base URL for a provider given a directory: the project override
  * (when the directory resolves to a project with one) wins, else the global

packages/web/server/lib/git-providers/project-config.test.js

@@ -12,6 +12,8 @@ process.env.OPENCHAMBER_DATA_DIR = TEMP_DATA_DIR;
 const {
   sanitizeProjectGitProviders,
   getProjectGitProviders,
+  getProjectProvider,
+  getProjectProviderFromDirectory,
   resolveProjectIdFromDirectory,
   getProjectProviderApiBaseUrl,
   getEffectiveProviderApiBaseUrl,
@@ -73,6 +75,46 @@ describe('sanitizeProjectGitProviders', () => {
     expect(sanitizeProjectGitProviders([])).toBeUndefined();
     expect(getProjectGitProviders('proj_1')).toEqual({});
   });
+
+  test('keeps a forced provider when it is one of the known providers', () => {
+    expect(sanitizeProjectGitProviders({
+      provider: 'GitLab',
+      gitlab: { apiBaseUrl: 'gitlab.example.com' },
+    })).toEqual({
+      provider: 'gitlab',
+      gitlab: { apiBaseUrl: 'https://gitlab.example.com' },
+    });
+  });
+
+  test('drops an unknown or empty forced provider', () => {
+    expect(sanitizeProjectGitProviders({
+      provider: 'bitbucket',
+      github: { apiBaseUrl: 'github.example.com' },
+    })).toEqual({ github: { apiBaseUrl: 'https://github.example.com' } });
+    expect(sanitizeProjectGitProviders({ provider: '' })).toBeUndefined();
+    expect(sanitizeProjectGitProviders({ provider: '  ' })).toBeUndefined();
+  });
+});
+
+describe('getProjectProvider / getProjectProviderFromDirectory', () => {
+  test('returns the forced provider or null', () => {
+    fs.mkdirSync(PROJECTS_DIR, { recursive: true });
+    fs.writeFileSync(projectFile('proj_provider'), JSON.stringify({
+      gitProviders: { provider: 'gitea', gitea: { apiBaseUrl: 'https://gitea.example.com' } },
+    }, null, 2));
+    expect(getProjectProvider('proj_provider')).toBe('gitea');
+    expect(getProjectProvider('proj_missing')).toBeNull();
+  });
+
+  test('resolves the forced provider through the directory', () => {
+    fs.mkdirSync(PROJECTS_DIR, { recursive: true });
+    fs.writeFileSync(projectFile('proj_forced'), JSON.stringify({
+      gitProviders: { provider: 'gitlab' },
+    }, null, 2));
+    writeSettingsProjects([{ id: 'proj_forced', path: '/home/user/gl' }]);
+    expect(getProjectProviderFromDirectory('/home/user/gl')).toBe('gitlab');
+    expect(getProjectProviderFromDirectory('/home/user/unregistered')).toBeNull();
+  });
 });
 
 describe('saveProjectGitProviders round-trip', () => {