Isolate providers per client: add provider targets and a Codex-side form

internal/config/store.go

@@ -103,11 +103,11 @@ func (s *Store) ActiveCodex() *Provider {
 	return nil
 }
 
-// AddProvider validates and appends a provider.
-func (s *Store) AddProvider(name, preset, baseURL, apiKey string, models Models) (*Provider, error) {
+// AddProvider validates and appends a provider for the given target.
+func (s *Store) AddProvider(name, preset, baseURL, apiKey string, models Models, target string) (*Provider, error) {
 	s.mu.Lock()
 	defer s.mu.Unlock()
-	p, err := newProvider(name, preset, baseURL, apiKey, models)
+	p, err := newProvider(name, preset, baseURL, apiKey, models, target)
 	if err != nil {
 		return nil, err
 	}
@@ -119,8 +119,9 @@ func (s *Store) AddProvider(name, preset, baseURL, apiKey string, models Models)
 }
 
 // UpdateProvider replaces a provider's editable fields. An empty apiKey
-// keeps the stored key so edits never wipe it by accident.
-func (s *Store) UpdateProvider(id, name, preset, baseURL, apiKey string, models Models) (*Provider, error) {
+// keeps the stored key so edits never wipe it by accident; an empty
+// target keeps the stored one.
+func (s *Store) UpdateProvider(id, name, preset, baseURL, apiKey string, models Models, target string) (*Provider, error) {
 	s.mu.Lock()
 	defer s.mu.Unlock()
 	idx := -1
@@ -137,7 +138,10 @@ func (s *Store) UpdateProvider(id, name, preset, baseURL, apiKey string, models
 	if apiKey == "" {
 		apiKey = existing.APIKey
 	}
-	updated, err := newProvider(name, preset, baseURL, apiKey, models)
+	if target == "" {
+		target = existing.Target
+	}
+	updated, err := newProvider(name, preset, baseURL, apiKey, models, target)
 	if err != nil {
 		return nil, err
 	}
@@ -191,6 +195,9 @@ func (s *Store) ActivateClaude(id string) (*Provider, error) {
 	if idx < 0 {
 		return nil, fmt.Errorf("provider %q not found", id)
 	}
+	if s.cfg.Providers[idx].Target != TargetClaude {
+		return nil, fmt.Errorf("provider %q is not a Claude provider", id)
+	}
 	s.cfg.Providers[idx].EnabledForClaude = true
 	s.cfg.ActiveClaudeID = id
 	if err := s.saveLocked(); err != nil {
@@ -226,6 +233,9 @@ func (s *Store) ActivateCodex(id string) (*Provider, error) {
 	if idx < 0 {
 		return nil, fmt.Errorf("provider %q not found", id)
 	}
+	if s.cfg.Providers[idx].Target != TargetCodex {
+		return nil, fmt.Errorf("provider %q is not a Codex provider", id)
+	}
 	s.cfg.Providers[idx].EnabledForCodex = true
 	s.cfg.ActiveCodexID = id
 	if err := s.saveLocked(); err != nil {