diff --git a/docs/pr-assets/1161-vision-sidecar-1440.png b/docs/pr-assets/1161-vision-sidecar-1440.png
new file mode 100644
index 000000000..84cdcf5da
Binary files /dev/null and b/docs/pr-assets/1161-vision-sidecar-1440.png differ
diff --git a/gui/src/i18n/de.ts b/gui/src/i18n/de.ts
index 1ddf5a014..565de3619 100644
--- a/gui/src/i18n/de.ts
+++ b/gui/src/i18n/de.ts
@@ -287,6 +287,7 @@ export const de: Record<TKey, string> = {
   "dash.backendAuto": "Automatisch",
   "dash.backendOpenAI": "OpenAI",
   "dash.backendAnthropic": "Anthropic",
+  "dash.backendChat": "Chat API",
   "dash.sidecarSaved": "Sidecar-Einstellungen gespeichert. Angewendet bei der nächsten Anfrage.",
   "dash.sidecarSaveFailed": "Sidecar-Einstellungen konnten nicht gespeichert werden.",
   "dash.injectionLabel": "Sub-Agent-Delegation",
diff --git a/gui/src/i18n/en.ts b/gui/src/i18n/en.ts
index 2d2fc9660..db225d411 100644
--- a/gui/src/i18n/en.ts
+++ b/gui/src/i18n/en.ts
@@ -305,6 +305,7 @@ export const en = {
   "dash.backendAuto": "Auto",
   "dash.backendOpenAI": "OpenAI",
   "dash.backendAnthropic": "Anthropic",
+  "dash.backendChat": "Chat API",
   "dash.sidecarSaved": "Sidecar settings saved. Applied on the next request.",
   "dash.sidecarSaveFailed": "Failed to save sidecar settings.",
   "dash.injectionLabel": "Sub-agent delegation",
diff --git a/gui/src/i18n/ja.ts b/gui/src/i18n/ja.ts
index d87f58f9d..32a1e125f 100644
--- a/gui/src/i18n/ja.ts
+++ b/gui/src/i18n/ja.ts
@@ -296,6 +296,7 @@ export const ja: Record<TKey, string> = {
   "dash.backendAuto": "自動",
   "dash.backendOpenAI": "OpenAI",
   "dash.backendAnthropic": "Anthropic",
+  "dash.backendChat": "Chat API",
   "dash.sidecarSaved": "サイドカー設定を保存しました。次回リクエスト時に適用されます。",
   "dash.sidecarSaveFailed": "サイドカー設定の保存に失敗しました。",
   "dash.injectionLabel": "サブエージェント委任",
diff --git a/gui/src/i18n/ko.ts b/gui/src/i18n/ko.ts
index bbf55e907..03297e3e9 100644
--- a/gui/src/i18n/ko.ts
+++ b/gui/src/i18n/ko.ts
@@ -291,6 +291,7 @@ export const ko: Record<TKey, string> = {
   "dash.backendAuto": "자동",
   "dash.backendOpenAI": "OpenAI",
   "dash.backendAnthropic": "Anthropic",
+  "dash.backendChat": "Chat API",
   "dash.sidecarSaved": "사이드카 설정이 저장됐습니다. 다음 요청부터 적용됩니다.",
   "dash.sidecarSaveFailed": "사이드카 설정 저장에 실패했습니다.",
   "dash.injectionLabel": "서브에이전트 위임",
diff --git a/gui/src/i18n/ru.ts b/gui/src/i18n/ru.ts
index 60064fd39..678af8f42 100644
--- a/gui/src/i18n/ru.ts
+++ b/gui/src/i18n/ru.ts
@@ -296,6 +296,7 @@ export const ru: Record<TKey, string> = {
   "dash.backendAuto": "Авто",
   "dash.backendOpenAI": "OpenAI",
   "dash.backendAnthropic": "Anthropic",
+  "dash.backendChat": "Chat API",
   "dash.sidecarSaved": "Настройки сайдкара сохранены. Вступят в силу со следующего запроса.",
   "dash.sidecarSaveFailed": "Не удалось сохранить настройки сайдкара.",
   "dash.injectionLabel": "Делегирование подагентам",
diff --git a/gui/src/i18n/tr.ts b/gui/src/i18n/tr.ts
index 32b11d619..e98ec98b3 100644
--- a/gui/src/i18n/tr.ts
+++ b/gui/src/i18n/tr.ts
@@ -297,6 +297,7 @@ export const tr: Record<TKey, string> = {
   "dash.backendAuto": "Otomatik",
   "dash.backendOpenAI": "OpenAI",
   "dash.backendAnthropic": "Anthropic",
+  "dash.backendChat": "Sohbet API",
   "dash.sidecarSaved": "Yan araç ayarları kaydedildi. Sonraki istekte uygulanacak.",
   "dash.sidecarSaveFailed": "Yan araç ayarları kaydedilemedi.",
   "dash.injectionLabel": "Alt ajan devri",
diff --git a/gui/src/i18n/zh-TW.ts b/gui/src/i18n/zh-TW.ts
index 3edb42ebb..c40be4973 100644
--- a/gui/src/i18n/zh-TW.ts
+++ b/gui/src/i18n/zh-TW.ts
@@ -190,6 +190,7 @@ export const zhTW: Record<TKey, string> = {
   "dash.backendAuto": "自動",
   "dash.backendOpenAI": "OpenAI",
   "dash.backendAnthropic": "Anthropic",
+  "dash.backendChat": "聊天 API",
   "dash.sidecarSaved": "附屬設定已儲存。將在下一個請求時生效。",
   "dash.sidecarSaveFailed": "儲存附屬設定失敗。",
   "dash.injectionLabel": "子代理委託",
diff --git a/gui/src/i18n/zh.ts b/gui/src/i18n/zh.ts
index 899e1fd6c..7e0f2cdbd 100644
--- a/gui/src/i18n/zh.ts
+++ b/gui/src/i18n/zh.ts
@@ -291,6 +291,7 @@ export const zh: Record<TKey, string> = {
   "dash.backendAuto": "自动",
   "dash.backendOpenAI": "OpenAI",
   "dash.backendAnthropic": "Anthropic",
+  "dash.backendChat": "Chat API",
   "dash.sidecarSaved": "附属设置已保存。将在下一个请求时生效。",
   "dash.sidecarSaveFailed": "保存附属设置失败。",
   "dash.injectionLabel": "子代理委托",
diff --git a/gui/src/pages/claude-code-sections.tsx b/gui/src/pages/claude-code-sections.tsx
index 70fa292fa..183d23b3f 100644
--- a/gui/src/pages/claude-code-sections.tsx
+++ b/gui/src/pages/claude-code-sections.tsx
@@ -170,6 +170,7 @@ export function ClaudeCodeSettingsCard({
                   { value: "auto", label: t("dash.backendAuto") },
                   { value: "openai", label: t("dash.backendOpenAI") },
                   { value: "anthropic", label: t("dash.backendAnthropic") },
+                  ...(key === "visionSidecar" ? [{ value: "chat", label: t("dash.backendChat") }] : []),
                 ]}
                 onChange={value => {
                   // Auto may exist as an empty in-memory draft so the model input
diff --git a/gui/src/pages/claude-manual-env.ts b/gui/src/pages/claude-manual-env.ts
index bb0c2970d..80373b26e 100644
--- a/gui/src/pages/claude-manual-env.ts
+++ b/gui/src/pages/claude-manual-env.ts
@@ -4,7 +4,7 @@
  * copy-paste shell block is directly unit-testable (tests/claude-manual-env.test.ts).
  */
 
-export type SidecarBackend = "openai" | "anthropic";
+export type SidecarBackend = "openai" | "anthropic" | "chat";
 export interface SidecarOverride { backend?: SidecarBackend; model?: string }
 
 export interface ClaudeManualEnvState {
diff --git a/gui/src/pages/dashboard-overview-sections.tsx b/gui/src/pages/dashboard-overview-sections.tsx
index 7834743d0..68506689f 100644
--- a/gui/src/pages/dashboard-overview-sections.tsx
+++ b/gui/src/pages/dashboard-overview-sections.tsx
@@ -515,7 +515,11 @@ export function DashboardSidecarPanels({ d }: { d: Dash }) {
             <Select
               value={sidecar?.webSearch.model ?? "gpt-5.6-luna"}
               options={sidecarModels}
-              onChange={model => { void saveSidecar({ webSearch: { model, backend: sidecarBackendForModel(models, model) } }); }}
+              onChange={model => {
+                const backend = sidecarBackendForModel(models, model);
+                const webSearchBackend = backend === "openai" || backend === "anthropic" ? backend : undefined;
+                void saveSidecar({ webSearch: { model, ...(webSearchBackend ? { backend: webSearchBackend } : {}) } });
+              }}
               disabled={!sidecar || sidecarSaving}
               label={t("dash.sidecarModel")}
               align="right"
@@ -555,7 +559,8 @@ export function DashboardSidecarPanels({ d }: { d: Dash }) {
                   }
                   const ladder = visionReasoningLadder(models, model);
                   const reasoning = clampVisionReasoningToLadder(ladder, visionReasoning);
-                  const patch: SidecarPatch = { vision: { model, backend: visionSidecarBackendForModel(models, visionModels, model), reasoning } };
+                  const backend = visionSidecarBackendForModel(models, visionModels, model);
+                  const patch: SidecarPatch = { vision: { model, ...(backend === "unresolved" ? {} : { backend }), reasoning } };
                   // Choosing a model is the activation control: turning Vision back on from Off.
                   if (!visionEnabled) patch.vision = { ...patch.vision, enabled: true };
                   void saveSidecar(patch);
diff --git a/gui/src/pages/dashboard-shared.ts b/gui/src/pages/dashboard-shared.ts
index dcd25f98e..67cc0fb57 100644
--- a/gui/src/pages/dashboard-shared.ts
+++ b/gui/src/pages/dashboard-shared.ts
@@ -59,10 +59,12 @@ export interface SettingsData {
     diagnosticStale: boolean;
   };
 }
-export type SidecarBackend = "openai" | "anthropic";
+export type SidecarBackend = "openai" | "anthropic" | "chat";
+/** Web-search sidecars accept only OpenAI/Anthropic — `chat` is vision-only. */
+export type WebSearchBackend = "openai" | "anthropic";
 export type VisionReasoning = "low" | "medium" | "high" | "xhigh" | "max";
-export interface SidecarSetting {
-  backend?: SidecarBackend;
+export interface SidecarSetting<B extends SidecarBackend = SidecarBackend> {
+  backend?: B;
   model: string;
   reasoning?: VisionReasoning;
   streamRoutedModelOutput?: boolean;
@@ -72,7 +74,7 @@ export interface SidecarSetting {
 }
 export interface VisionModelOption { value: string; label: string; backend: SidecarBackend; baseline?: boolean }
 export interface SidecarData {
-  webSearch: SidecarSetting;
+  webSearch: SidecarSetting<WebSearchBackend>;
   vision: SidecarSetting;
   /** Server-computed eligible describers. Optional: an older server omits it and
    *  the client falls back to the legacy provider-name list rather than showing
@@ -80,7 +82,7 @@ export interface SidecarData {
   visionModels?: VisionModelOption[];
 }
 export interface SidecarPatch {
-  webSearch?: { backend?: SidecarBackend | null; model?: string; streamRoutedModelOutput?: boolean };
+  webSearch?: { backend?: WebSearchBackend | null; model?: string; streamRoutedModelOutput?: boolean };
   vision?: {
     backend?: SidecarBackend | null;
     model?: string;
@@ -169,10 +171,10 @@ export function updateJobLabel(status: UpdateJobStatus, t: (key: TKey) => string
   }
 }
 
-export function mergeSidecarSetting(
-  current: SidecarSetting,
+export function mergeSidecarSetting<B extends SidecarBackend = SidecarBackend>(
+  current: SidecarSetting<B>,
   update?: {
-    backend?: SidecarBackend | null;
+    backend?: B | null;
     model?: string;
     reasoning?: VisionReasoning;
     streamRoutedModelOutput?: boolean;
@@ -180,7 +182,7 @@ export function mergeSidecarSetting(
     maxDescriptionsPerTurn?: number;
     timeoutMs?: number;
   },
-): SidecarSetting {
+): SidecarSetting<B> {
   const merged = { ...current };
   if (update?.model !== undefined) merged.model = update.model;
   if (update?.backend === null) delete merged.backend;
@@ -317,8 +319,22 @@ export function shadowCallModelOptions(models: ModelInfo[], current: string | un
   return out;
 }
 
-export function sidecarBackendForModel(models: ModelInfo[], modelId: string): SidecarBackend {
-  return models.find(model => model.id === modelId)?.provider === "anthropic" ? "anthropic" : "openai";
+export type SidecarBackendResolution = SidecarBackend | "unresolved";
+
+export function sidecarBackendForModel(models: ModelInfo[], modelId: string): SidecarBackendResolution {
+  // Exact namespaced matches win; otherwise a bare id must match EXACTLY one
+  // catalog row. Ambiguity (two providers exposing the same bare id) is an
+  // unresolved state, never a guessed first match — persisting the wrong
+  // backend would route images to the wrong provider.
+  const qualifiedMatches = models.filter(item => item.namespaced === modelId);
+  const matches = qualifiedMatches.length > 0
+    ? qualifiedMatches
+    : models.filter(item => item.id === modelId);
+  const model = matches[0];
+  if (matches.length !== 1 || !model) return "unresolved";
+  if (model.provider === "anthropic") return "anthropic";
+  if (model.provider === "openai") return "openai";
+  return "chat";
 }
 
 /** Server eligibility is authoritative; catalog inference only supports legacy picker entries. */
@@ -326,7 +342,7 @@ export function visionSidecarBackendForModel(
   models: ModelInfo[],
   options: Array<{ value: string; backend?: SidecarBackend }>,
   modelId: string,
-): SidecarBackend {
+): SidecarBackendResolution {
   return options.find(option => option.value === modelId)?.backend ?? sidecarBackendForModel(models, modelId);
 }
 
diff --git a/gui/tests/vision-model-options.test.ts b/gui/tests/vision-model-options.test.ts
index f7cface9c..4eac3f7b0 100644
--- a/gui/tests/vision-model-options.test.ts
+++ b/gui/tests/vision-model-options.test.ts
@@ -68,9 +68,11 @@ test("a server-supplied vision backend wins when the catalog cannot identify its
     { value: model, label: model, backend: "anthropic" },
   ], [], undefined);
 
-  // This documents the old save-path result: catalog inference alone defaults
-  // to OpenAI when there is no matching model row.
-  expect(sidecarBackendForModel([], model)).toBe("openai");
+  // Catalog inference alone cannot name a backend for an unknown model: an
+  // unresolved result must never be silently mislabelled "chat" (or "openai"),
+  // because the save path would then persist a backend for a model it never
+  // resolved. The server-supplied option carries the real backend instead.
+  expect(sidecarBackendForModel([], model)).toBe("unresolved");
   expect(visionSidecarBackendForModel([], options, model)).toBe("anthropic");
 });
 
@@ -83,7 +85,9 @@ test("an older server with no option list cannot rewrite the persisted anthropic
 
   expect(options[0]).toMatchObject({ value: model, backend: "anthropic" });
   expect(visionSidecarBackendForModel([], options, model)).toBe("anthropic");
-  expect(sidecarBackendForModel([], model)).toBe("openai");
+  // The unresolved fallback exists precisely so this compatibility path cannot
+  // silently downgrade the persisted backend to a guessed one.
+  expect(sidecarBackendForModel([], model)).toBe("unresolved");
 });
 
 test("an authoritative empty list still keeps the configured model and its backend", () => {
@@ -95,3 +99,16 @@ test("an authoritative empty list still keeps the configured model and its backe
   expect(options.map(option => option.value)).toEqual([model]);
   expect(visionSidecarBackendForModel([], options, model)).toBe("anthropic");
 });
+
+test("an ambiguous bare id shared by two providers is unresolved, not a first-match guess", () => {
+  // Two catalog rows expose the same bare id under different namespaces. The
+  // old `find` took the first row and could persist the wrong backend; the
+  // contract is that ambiguity stays unresolved.
+  const shared: ModelInfo[] = [
+    { id: "shared", provider: "openai", namespaced: "openai/shared" },
+    { id: "shared", provider: "anthropic", namespaced: "anthropic/shared" },
+  ];
+  expect(sidecarBackendForModel(shared, "shared")).toBe("unresolved");
+  // An exact namespaced id still resolves deterministically.
+  expect(sidecarBackendForModel(shared, "anthropic/shared")).toBe("anthropic");
+});
diff --git a/src/cli/agent.ts b/src/cli/agent.ts
index 62e4f6c92..aa99d820b 100644
--- a/src/cli/agent.ts
+++ b/src/cli/agent.ts
@@ -20,7 +20,8 @@ const USAGE = `Usage:
   ocx agent effort <status|set> [--main <level|->] [--subagent <level|->] [--json]
   ocx agent subagents <status|set|clear> [model,model...] [--json]
   ocx agent fallback <status|set|clear> [model,model...] [--poll-ms <5000-600000>] [--json]
-  ocx agent sidecar <status|web|vision> [--model <id|->] [--backend <openai|anthropic|->]
+  ocx agent sidecar <status|web|vision> [--model <id|->] [--backend <openai|anthropic|chat|->]
+      (web backend: openai|anthropic; vision backend: openai|anthropic|chat)
       [--reasoning <level>] [--max-descriptions <n>] [--json]`;
 
 function clearable(value: string | undefined): string | null | undefined {
diff --git a/src/cli/integrations.ts b/src/cli/integrations.ts
index a3f7b6950..9e82a8e09 100644
--- a/src/cli/integrations.ts
+++ b/src/cli/integrations.ts
@@ -19,7 +19,7 @@ const CLAUDE_USAGE = `Usage:
       [--compact-window <tokens|default>] [--inject-agents <on|off>]
       [--small-fast-model <id|->] [--model-map <from=to,from=to|->]
       [--blocked-skills <name,name|->] [--web-model <id|->] [--web-backend <openai|anthropic|->]
-      [--vision-model <id|->] [--vision-backend <openai|anthropic|->] [--json]`;
+      [--vision-model <id|->] [--vision-backend <openai|anthropic|chat|->] [--json]`;
 
 const GROK_USAGE = `Usage:
   ocx grok [status] [--json]
diff --git a/src/server/management/agent-settings-routes.ts b/src/server/management/agent-settings-routes.ts
index ca8c6568c..2e1cbe910 100644
--- a/src/server/management/agent-settings-routes.ts
+++ b/src/server/management/agent-settings-routes.ts
@@ -1030,8 +1030,9 @@ export async function handleAgentSettingsRoutes(ctx: ManagementContext): Promise
       if (section === undefined || section === null) continue;
       if (!isPlainObject(section)) return jsonResponse({ error: `${field} must be an object or null` }, 400);
       if (section.backend !== undefined && section.backend !== null
-        && section.backend !== "openai" && section.backend !== "anthropic") {
-        return jsonResponse({ error: `${field}.backend must be openai, anthropic, or null` }, 400);
+        && section.backend !== "openai" && section.backend !== "anthropic" && (field !== "visionSidecar" || section.backend !== "chat")) {
+        const accepted = field === "visionSidecar" ? "openai, anthropic, chat, or null" : "openai, anthropic, or null";
+        return jsonResponse({ error: `${field}.backend must be ${accepted}` }, 400);
       }
       if (section.model !== undefined && typeof section.model !== "string") {
         return jsonResponse({ error: `${field}.model must be a string` }, 400);
@@ -1058,8 +1059,8 @@ export async function handleAgentSettingsRoutes(ctx: ManagementContext): Promise
         delete next[field];
         continue;
       }
-      const requested = section as { backend?: "openai" | "anthropic" | null; model?: string };
-      const override: NonNullable<OcxClaudeCodeConfig[typeof field]> = { ...next[field] };
+      const requested = section as { backend?: "openai" | "anthropic" | "chat" | null; model?: string };
+      const override = { ...(next[field] as Record<string, unknown> | undefined) } as Record<string, unknown>;
       if (requested.backend === null) delete override.backend;
       else if (requested.backend !== undefined) override.backend = requested.backend;
       if (requested.model === "") delete override.model;
diff --git a/src/server/management/config-routes.ts b/src/server/management/config-routes.ts
index 0306a02f4..fb9154af4 100644
--- a/src/server/management/config-routes.ts
+++ b/src/server/management/config-routes.ts
@@ -471,8 +471,8 @@ export async function handleConfigRoutes(ctx: ManagementContext): Promise<Respon
       return jsonResponse({ error: "webSearch.streamRoutedModelOutput must be a boolean" }, 400);
     }
     if (body.vision && body.vision.backend !== undefined
-      && body.vision.backend !== null && body.vision.backend !== "openai" && body.vision.backend !== "anthropic") {
-      return jsonResponse({ error: "vision.backend must be openai, anthropic, or null" }, 400);
+      && body.vision.backend !== null && body.vision.backend !== "openai" && body.vision.backend !== "anthropic" && body.vision.backend !== "chat") {
+      return jsonResponse({ error: "vision.backend must be openai, anthropic, chat, or null" }, 400);
     }
     if (body.vision && body.vision.maxDescriptionsPerTurn !== undefined
       && (typeof body.vision.maxDescriptionsPerTurn !== "number"
@@ -544,7 +544,7 @@ export async function handleConfigRoutes(ctx: ManagementContext): Promise<Respon
         else config.visionSidecar.model = body.vision.model;
       }
       if (body.vision.backend === null) delete config.visionSidecar.backend;
-      else if (body.vision.backend === "openai" || body.vision.backend === "anthropic") {
+      else if (body.vision.backend === "openai" || body.vision.backend === "anthropic" || body.vision.backend === "chat") {
         config.visionSidecar.backend = body.vision.backend;
       }
       if (typeof body.vision.maxDescriptionsPerTurn === "number") {
diff --git a/src/server/management/vision-sidecar-options.ts b/src/server/management/vision-sidecar-options.ts
index aefbb4dc8..4d1ee8204 100644
--- a/src/server/management/vision-sidecar-options.ts
+++ b/src/server/management/vision-sidecar-options.ts
@@ -20,7 +20,8 @@ import { listOpenAiForwardSidecarCandidates } from "../../providers/openai-sidec
 import { listManagementModelRows } from "./model-rows";
 
 /**
- * Backends whose executor could actually run: openai forward, anthropic OAuth.
+ * Backends whose executor could actually run: openai forward, anthropic OAuth,
+ * chat/google provider with usable auth.
  *
  * `anthropicSidecar` is REQUIRED rather than defaulted. `findAnthropicVisionProvider`
  * reads the OAuth account store from disk, and a default argument made every helper
@@ -36,11 +37,26 @@ export function enabledVisionBackends(
   // provider keyed "openai" — same predicate the runtime sidecar resolver uses.
   if (listOpenAiForwardSidecarCandidates(config).length > 0) backends.push("openai");
   if (anthropicSidecar) backends.push("anthropic");
+  // The chat describer needs a configured openai-chat/google provider with usable
+  // auth — same predicate the runtime chat sidecar resolver uses.
+  if (hasUsableChatVisionProvider(config)) backends.push("chat");
   // Neither side resolvable (fresh install, no login): fall back to both so the
   // picker is populated rather than empty, matching the permissive-unknown rule.
   return backends.length > 0 ? backends : ["openai", "anthropic"];
 }
 
+/** Any enabled openai-chat/google provider the chat sidecar could actually dispatch through. */
+function hasUsableChatVisionProvider(config: OcxConfig): boolean {
+  for (const provider of Object.values(config.providers ?? {})) {
+    if (provider.disabled === true) continue;
+    const chatLike = provider.adapter === "openai-chat" || provider.adapter === "google";
+    if (!chatLike) continue;
+    if (provider.apiKey ?? provider.apiKeyPool?.[0]?.key) return true;
+    if (provider.authMode === "oauth") return true;
+  }
+  return false;
+}
+
 /** Visible catalog rows in the shape the eligibility predicate consumes. */
 export async function visionCandidateRows(config: OcxConfig): Promise<VisionCandidateModel[]> {
   let rows: Awaited<ReturnType<typeof listManagementModelRows>> = [];
diff --git a/src/types.ts b/src/types.ts
index 6d0e84aff..2890d21b9 100644
--- a/src/types.ts
+++ b/src/types.ts
@@ -517,7 +517,7 @@ export interface OcxClaudeCodeConfig {
   /** Claude-originated web-search override. Unset fields inherit the global sidecar settings. */
   webSearchSidecar?: { backend?: "openai" | "anthropic"; model?: string };
   /** Claude-originated vision override. Unset fields inherit the global sidecar settings. */
-  visionSidecar?: { backend?: "openai" | "anthropic"; model?: string };
+  visionSidecar?: { backend?: "openai" | "anthropic" | "chat"; model?: string };
   /** Persisted Claude Desktop four-family routing profile. */
   desktopProfile?: OcxClaudeDesktopProfile;
   /** Auto-reconcile Desktop 3P config when provider catalog changes. Default: enabled. */
@@ -1129,7 +1129,7 @@ export interface OcxVisionSidecarConfig {
   /** Master switch. Default: enabled when the selected backend has a usable credential. */
   enabled?: boolean;
   /** Description backend. Unset prefers a usable stored Anthropic OAuth credential, else OpenAI. */
-  backend?: "openai" | "anthropic";
+  backend?: "openai" | "anthropic" | "chat";
   /** Vision model that describes images. */
   model?: string;
   /** Max description cache misses admitted in one main-model turn. Zero disables description calls. */
diff --git a/src/vision/describe-chat.ts b/src/vision/describe-chat.ts
new file mode 100644
index 000000000..1012b80a4
--- /dev/null
+++ b/src/vision/describe-chat.ts
@@ -0,0 +1,272 @@
+import { createGoogleAdapter } from "../adapters/google";
+import type { OcxParsedRequest, OcxProviderConfig } from "../types";
+import { signalWithTimeout, cancelBodyOnAbort } from "../lib/abort";
+import { redactSecretString } from "../lib/redact";
+import { sidecarEnter } from "../lib/sidecar-tracker";
+import { createTranslatorBudget } from "../lib/translator-budget";
+import type { SidecarOutcomeRecorder } from "../web-search/executor";
+import { getOAuthCredentialProjectId, getValidAccessToken } from "../oauth";
+
+export interface ChatVisionSettings {
+  model: string;
+  timeoutMs: number;
+  detail?: string;
+  reasoning?: string;
+}
+
+export type DescribeChatOutcome = { text: string; error?: string };
+
+/**
+ * Fail before any credential acquisition or network activity when the destination
+ * is not HTTPS. The vision sidecar sends user images, so an `http:` baseUrl must
+ * never see a bearer token or an outbound request — checked BEFORE the OAuth token
+ * lookup, BEFORE Authorization construction, and BEFORE any fetch.
+ */
+function httpsGuardError(baseUrl: string): string | null {
+  let parsed: URL;
+  try {
+    parsed = new URL(baseUrl);
+  } catch {
+    return "invalid provider baseUrl";
+  }
+  if (parsed.protocol === "https:") return null;
+  // Cleartext is acceptable only when the bytes never leave the host: a local
+  // OpenAI-compatible server (e.g. http://127.0.0.1:1234/v1) is a legitimate
+  // chat-vision destination. Remote http: destinations stay rejected before
+  // any token fetch or network call.
+  const host = parsed.hostname.replace(/^\[|]$/g, "").toLowerCase();
+  const loopback = host === "localhost" || host === "127.0.0.1" || host === "::1";
+  if (parsed.protocol === "http:" && loopback) return null;
+  return `provider baseUrl must use HTTPS (got ${parsed.protocol})`;
+}
+
+function toChatImagePart(imageUrl: string, detail?: string): Record<string, unknown> {
+  return { type: "image_url", image_url: { url: imageUrl, detail: detail ?? "high" } };
+}
+
+async function describeImageGoogle(
+  imageUrl: string,
+  detail: string | undefined,
+  contextText: string,
+  provider: OcxProviderConfig,
+  providerName: string,
+  settings: ChatVisionSettings,
+  abortSignal?: AbortSignal,
+  recordOutcome?: SidecarOutcomeRecorder,
+): Promise<DescribeChatOutcome> {
+  const destinationError = httpsGuardError(provider.baseUrl);
+  if (destinationError) return { text: "", error: destinationError };
+  let requestProvider = provider;
+  if (provider.authMode === "oauth") {
+    try {
+      const token = await getValidAccessToken(providerName);
+      const project = provider.googleMode === "cloud-code-assist"
+        ? getOAuthCredentialProjectId(providerName)
+        : provider.project;
+      requestProvider = { ...provider, apiKey: token, ...(project ? { project } : {}) };
+    } catch (e) {
+      return { text: "", error: `google oauth token failed: ${e instanceof Error ? e.message : String(e)}` };
+    }
+  }
+
+  const parsed = {
+    modelId: settings.model,
+    context: {
+      messages: [{
+        role: "user",
+        content: [
+          { type: "text", text: contextText || "Describe this image." },
+          { type: "image", imageUrl, detail },
+        ],
+        timestamp: Date.now(),
+      }],
+    },
+    stream: true,
+    options: { maxOutputTokens: 1024, reasoning: settings.reasoning ?? "low" },
+  } as OcxParsedRequest;
+  const budget = createTranslatorBudget();
+  const adapter = createGoogleAdapter(requestProvider);
+  const sidecarExit = sidecarEnter("vision");
+  // Bound the AI Studio fallback below: created lazily, cleaned up in finally.
+  let fallbackSignal: ReturnType<typeof signalWithTimeout> | undefined;
+  try {
+    const request = await adapter.buildRequest(parsed, {
+      headers: new Headers(),
+      translatorBudget: budget,
+      abortSignal,
+    });
+    const response = adapter.fetchResponse
+      ? await adapter.fetchResponse(request, {
+        abortSignal,
+        timeoutMs: settings.timeoutMs,
+        stream: true,
+        returnRawErrors: true,
+      })
+      : (fallbackSignal = signalWithTimeout(settings.timeoutMs, abortSignal), await fetch(request.url, {
+        method: request.method,
+        headers: request.headers,
+        body: request.body,
+        // AI Studio leaves fetchResponse undefined, so this fallback must bound
+        // the request itself: without a timeout a stalled upstream holds a
+        // VISION_CONCURRENCY worker open indefinitely. signalWithTimeout
+        // merges settings.timeoutMs with the caller's abortSignal; cleanup()
+        // in finally releases the merged listener.
+        signal: fallbackSignal.signal,
+      }));
+    recordOutcome?.(response.status);
+    if (!response.ok) {
+      const text = await response.text().catch(() => "");
+      return { text: "", error: `google sidecar HTTP ${response.status}: ${redactSecretString(text.slice(0, 200))}` };
+    }
+    let text = "";
+    for await (const event of adapter.parseStream(response, budget)) {
+      if (event.type === "text_delta") text += event.text;
+      if (event.type === "error") return { text: "", error: event.message };
+    }
+    const trimmed = text.trim();
+    if (!trimmed) return { text: "", error: "google sidecar produced no description" };
+    return { text: trimmed };
+  } catch (e) {
+    recordOutcome?.(e instanceof Error && e.name === "TimeoutError" ? "timeout" : "connect_error");
+    return { text: "", error: e instanceof Error ? e.message : String(e) };
+  } finally {
+    fallbackSignal?.cleanup();
+    sidecarExit();
+  }
+}
+
+export async function describeImageChat(
+  imageUrl: string,
+  detail: string | undefined,
+  contextText: string,
+  provider: OcxProviderConfig,
+  providerName: string,
+  settings: ChatVisionSettings,
+  abortSignal?: AbortSignal,
+  recordOutcome?: SidecarOutcomeRecorder,
+): Promise<DescribeChatOutcome> {
+  if (provider.adapter === "google") {
+    return describeImageGoogle(
+      imageUrl,
+      detail,
+      contextText,
+      provider,
+      providerName,
+      settings,
+      abortSignal,
+      recordOutcome,
+    );
+  }
+  const destinationError = httpsGuardError(provider.baseUrl);
+  if (destinationError) return { text: "", error: destinationError };
+  let authHeader = "";
+  if (provider.authMode === "oauth") {
+    try {
+      const token = await getValidAccessToken(providerName);
+      authHeader = `Bearer ${token}`;
+    } catch (e) {
+      return { text: "", error: `oauth token failed: ${e instanceof Error ? e.message : String(e)}` };
+    }
+  } else {
+    const apiKey = provider.apiKey ?? provider.apiKeyPool?.[0]?.key ?? provider.headers?.Authorization?.replace(/^Bearer\s+/i, "");
+    if (apiKey) {
+      authHeader = `Bearer ${apiKey}`;
+    } else if (provider.authMode !== "local" && provider.keyOptional !== true) {
+      return { text: "", error: "provider has no API key or OAuth token" };
+    }
+    // authMode "local" / keyOptional: keyless destination, no Authorization header.
+  }
+
+  const content: unknown[] = [
+    { type: "text", text: contextText || "Describe this image." },
+    toChatImagePart(imageUrl, detail),
+  ];
+  const body: Record<string, unknown> = {
+    model: settings.model,
+    messages: [{ role: "user", content }],
+    stream: true,
+    max_tokens: 1024,
+  };
+  // Forward the planned reasoning through the provider-aware wire mapping,
+  // mirroring the openai-chat adapter: OpenAI-compatible targets carry
+  // reasoning_effort, gateway-object targets carry reasoning.enabled/effort.
+  if (settings.reasoning && settings.reasoning !== "none") {
+    if (provider.reasoningWireFormat === "gateway-object") {
+      body.reasoning = { enabled: true, effort: settings.reasoning };
+    } else {
+      body.reasoning_effort = settings.reasoning;
+    }
+  }
+
+  const headers: Record<string, string> = {
+    "Content-Type": "application/json",
+    ...(provider.headers ?? {}),
+    // The resolved credential must win over any static provider header: a
+    // configured Authorization would otherwise replace a freshly rotated OAuth
+    // token / API key and break every authenticated request with 401.
+    ...(authHeader ? { Authorization: authHeader } : {}),
+  };
+
+  const linkedSignal = signalWithTimeout(settings.timeoutMs ?? 30_000, abortSignal);
+  const sidecarExit = sidecarEnter("vision");
+  const t0 = Date.now();
+  try {
+    const baseUrl = provider.baseUrl.replace(/\/$/, "");
+    const url = new URL(`${baseUrl}/chat/completions`);
+    const res = await fetch(url.toString(), {
+      method: "POST",
+      headers,
+      body: JSON.stringify(body),
+      signal: linkedSignal.signal,
+    });
+    recordOutcome?.(res.status);
+    if (!res.ok) {
+      const t = await res.text().catch(() => "");
+      console.warn(`[vision] chat sidecar HTTP ${res.status} (${Date.now() - t0}ms)`);
+      return { text: "", error: `chat sidecar HTTP ${res.status}: ${redactSecretString(t.slice(0, 200))}` };
+    }
+    if (!res.body) return { text: "", error: "chat sidecar returned no response body" };
+    const detachBodyGuard = cancelBodyOnAbort(res.body, linkedSignal.signal);
+    let text = "";
+    try {
+      const reader = res.body.getReader();
+      const decoder = new TextDecoder();
+      let buf = "";
+      const consumeLine = (line: string) => {
+        const s = line.replace(/^data:\s*/, "").trim();
+        if (!s || s === "[DONE]") return;
+        try {
+          const j = JSON.parse(s);
+          const delta = j.choices?.[0]?.delta?.content;
+          if (typeof delta === "string") text += delta;
+          else if (Array.isArray(delta)) {
+            for (const part of delta) if (typeof part?.text === "string") text += part.text;
+          }
+          const message = j.choices?.[0]?.message?.content;
+          if (typeof message === "string") text += message;
+        } catch { /* ignore non-JSON data lines */ }
+      };
+      for (;;) {
+        const { done, value } = await reader.read();
+        if (done) break;
+        buf += decoder.decode(value, { stream: true });
+        const lines = buf.split(/\r?\n/);
+        buf = lines.pop() ?? "";
+        for (const line of lines) consumeLine(line);
+      }
+      consumeLine(buf);
+      const trimmed = text.trim();
+      if (!trimmed) return { text: "", error: "chat sidecar produced no description" };
+      return { text: trimmed };
+    } finally {
+      detachBodyGuard();
+    }
+  } catch (e) {
+    recordOutcome?.(e instanceof Error && e.name === "TimeoutError" ? "timeout" : "connect_error");
+    console.warn(`[vision] chat sidecar error (${Date.now() - t0}ms)`);
+    return { text: "", error: e instanceof Error ? e.message : String(e) };
+  } finally {
+    sidecarExit();
+    linkedSignal.cleanup();
+  }
+}
diff --git a/src/vision/eligibility.ts b/src/vision/eligibility.ts
index 7737f6784..a1c731cd9 100644
--- a/src/vision/eligibility.ts
+++ b/src/vision/eligibility.ts
@@ -26,15 +26,19 @@ import { nativeInputModalities } from "../codex/catalog/metadata";
 import { SUPPORTED_NATIVE_OPENAI_SLUGS } from "../codex/catalog/native-models";
 import { enrichProviderFromRegistry } from "../providers/derive";
 
-/** The two wire protocols `planVisionSidecar` can actually dispatch to. */
-export type VisionSidecarBackend = "openai" | "anthropic";
+/** The wire protocols `planVisionSidecar` can actually dispatch to. */
+export type VisionSidecarBackend = "openai" | "anthropic" | "chat";
 
 /**
  * Default entry per backend: cheap, image-capable, and present in every deployment. Offered
  * whenever its side is enabled, and withheld only when that provider explicitly lists it as a
  * model the sidecar describes FOR — never merely because a metadata table stayed silent.
+ *
+ * The chat side has no universal baseline: it dispatches through a CONFIGURED chat/google
+ * provider, and no canonical provider exists to name. Chat rows therefore come only from
+ * catalog/configured models, never from a fabricated default.
  */
-export const BASELINE_VISION_MODELS: Record<VisionSidecarBackend, string> = {
+export const BASELINE_VISION_MODELS: Record<"openai" | "anthropic", string> = {
   openai: "gpt-5.6-luna",
   anthropic: "claude-haiku-4-5",
 };
@@ -163,12 +167,24 @@ export function visionBackendForCandidate(
   // executor to name, no catalog row qualifies; the side's baseline is added separately and
   // keeps the picker populated. Narrowing here never widens the write gate, which is a
   // different predicate (`modelAcceptsImageInput`) and still treats unknown as allowed.
-  if (anthropicProviderName === undefined) return undefined;
-  return candidate.provider === anthropicProviderName ? "anthropic" : undefined;
+  if (anthropicProviderName !== undefined && candidate.provider === anthropicProviderName) return "anthropic";
+  // A chat-side row is reachable only through its configured chat/google adapter with
+  // usable auth — the same predicate the runtime chat sidecar resolver uses. A routed
+  // row whose provider is absent, disabled, or keyless must not be offered, because
+  // selecting it would fail at describe time rather than at pick time.
+  const configured = config.providers?.[candidate.provider];
+  if (!configured || configured.disabled === true) return undefined;
+  const chatLike = configured.adapter === "openai-chat" || configured.adapter === "google";
+  if (!chatLike) return undefined;
+  const hasAuth = Boolean(configured.apiKey ?? configured.apiKeyPool?.[0]?.key)
+    || configured.authMode === "oauth"
+    || configured.authMode === "local"
+    || configured.keyOptional === true;
+  return hasAuth ? "chat" : undefined;
 }
 
 function baselineCandidate(
-  backend: VisionSidecarBackend,
+  backend: "openai" | "anthropic",
   anthropicProviderName: string | undefined,
 ): VisionCandidateModel {
   return {
diff --git a/src/vision/index.ts b/src/vision/index.ts
index 1f6c09d56..53f333951 100644
--- a/src/vision/index.ts
+++ b/src/vision/index.ts
@@ -4,6 +4,7 @@ import { modelInList } from "../types";
 import type { VisionReasoningEffort } from "../reasoning-effort";
 import { describeImage, type DescribeOutcome, type VisionSettings } from "./describe";
 import { describeImageAnthropic } from "./anthropic-describe";
+import { describeImageChat } from "./describe-chat";
 import { normalizeVisionReasoningForModel } from "./reasoning";
 import type { CodexAuthContext } from "../codex/auth-context";
 import { getAccountSet } from "../oauth/store";
@@ -209,11 +210,90 @@ export function findAnthropicVisionProvider(config: OcxConfig): AnthropicVisionP
   return undefined;
 }
 
+/** Chat-adapter or google-adapter provider selected to run the chat vision sidecar. */
+export interface ChatVisionProvider {
+  providerName: string;
+  provider: OcxProviderConfig;
+  model: string;
+}
+
+/**
+ * Resolve the provider that runs the chat vision sidecar for `model`.
+ *
+ * A provider-qualified `provider/model` selects exactly that provider when it is
+ * enabled, chat-like, and has usable auth. A bare model resolves ONLY through a
+ * unique configured match (defaultModel or the provider's model list): an
+ * ambiguous match (two providers listing the same model) and a provider that only
+ * has live-discovered models (no configured list) both produce NO provider —
+ * routing a user's image to an arbitrary first authenticated provider is exactly
+ * the mis-send the qualified form exists to prevent.
+ */
+export function findChatVisionProvider(config: OcxConfig, model: string): ChatVisionProvider | undefined {
+  let providerName = "";
+  let bareModel = model;
+  let qualified = false;
+  if (model.includes("/")) {
+    const sep = model.indexOf("/");
+    const prefix = model.slice(0, sep);
+    bareModel = model.slice(sep + 1);
+    // The prefix is a provider qualifier ONLY when such a provider actually
+    // exists. A namespaced catalog id like "anthropic/claude-3-haiku" where
+    // "anthropic" is a model namespace (not a configured provider) must fall
+    // through to bare resolution against the published namespaced ids.
+    if (config.providers[prefix]) {
+      providerName = prefix;
+      qualified = true;
+    }
+  }
+  const isChatLike = (p: OcxProviderConfig) => p.adapter === "openai-chat" || p.adapter === "google";
+  // "Usable" = a credential exists OR the provider is explicitly keyless
+  // (authMode "local", keyOptional) — a local OpenAI-compatible server may
+  // need no Authorization at all. Loopback http: is allowed by the guard.
+  const hasAuth = (p: OcxProviderConfig) => {
+    if (p.apiKey ?? p.apiKeyPool?.[0]?.key) return true;
+    if (p.authMode === "oauth") return true;
+    if (p.authMode === "local" || p.keyOptional === true) return true;
+    return false;
+  };
+  if (qualified) {
+    const provider = config.providers[providerName];
+    if (provider && provider.disabled !== true && isChatLike(provider) && hasAuth(provider)) {
+      return { provider, providerName, model: bareModel };
+    }
+    return undefined;
+  }
+  const matches: Array<{ provider: OcxProviderConfig; providerName: string; model: string }> = [];
+  for (const [name, provider] of Object.entries(config.providers)) {
+    if (provider.disabled === true) continue;
+    if (!isChatLike(provider)) continue;
+    if (!hasAuth(provider)) continue;
+    const models = provider.models ?? [];
+    const defaultModel = provider.defaultModel;
+    if (bareModel === defaultModel) {
+      matches.push({ provider, providerName: name, model: bareModel });
+      continue;
+    }
+    if (models.includes(bareModel)) {
+      matches.push({ provider, providerName: name, model: bareModel });
+      continue;
+    }
+    // A bare id that is the suffix of a namespaced published id ("gemini-flash"
+    // matching "google/gemini-flash") resolves to the PUBLISHED id, not the
+    // bare one — the bare id is not routable upstream.
+    const published = models.find(m => m.endsWith("/" + bareModel));
+    if (published) {
+      matches.push({ provider, providerName: name, model: published });
+    }
+  }
+  if (matches.length === 1) return { ...matches[0]! };
+  return undefined;
+}
+
 export function resolveVisionBackend(
-  explicit: "openai" | "anthropic" | undefined,
+  explicit: "openai" | "anthropic" | "chat" | undefined,
   anthropicSidecar: AnthropicVisionProvider | undefined,
-): "openai" | "anthropic" {
-  if (explicit === "openai" || explicit === "anthropic") return explicit;
+): "openai" | "anthropic" | "chat" {
+  if (explicit === "openai" || explicit === "anthropic" || explicit === "chat") return explicit;
   return anthropicSidecar ? "anthropic" : "openai";
 }
 
@@ -225,8 +305,11 @@ export function resolveOpenAiVisionModel(config: Pick<OcxConfig, "visionSidecar"
 /** Effective describer model for the backend `planVisionSidecar` selected. */
 export function resolveEffectiveVisionModel(
   config: Pick<OcxConfig, "visionSidecar">,
-  backend: "openai" | "anthropic",
+  backend: "openai" | "anthropic" | "chat",
 ): string {
+  // The chat sidecar's model is provider-qualified and resolved separately via
+  // findChatVisionProvider; the generic default only applies to the forward sides.
+  if (backend === "chat") return resolveOpenAiVisionModel(config);
   return backend === "anthropic"
     ? config.visionSidecar?.model || DEFAULT_ANTHROPIC_VISION_MODEL
     : resolveOpenAiVisionModel(config);
@@ -255,9 +338,10 @@ export function shouldResolveOpenAiVisionSidecar(
 }
 
 export interface VisionPlan {
-  backend: "openai" | "anthropic";
+  backend: "openai" | "anthropic" | "chat";
   forwardSidecar?: ResolvedOpenAiForwardSidecar;
   anthropicSidecar?: AnthropicVisionProvider;
+  chatSidecar?: ChatVisionProvider;
   settings: VisionSettings;
   maxDescriptionsPerTurn: number;
 }
@@ -284,6 +368,21 @@ export function planVisionSidecar(
   const model = resolveEffectiveVisionModel(config, backend);
   const maxDescriptionsPerTurn = resolveMaxDescriptionsPerTurn(cfg.maxDescriptionsPerTurn);
 
+  if (backend === "chat") {
+    const chatProvider = findChatVisionProvider(config, cfg.model ?? "");
+    if (!chatProvider) return undefined;
+    return {
+      backend,
+      chatSidecar: chatProvider,
+      settings: {
+        model: chatProvider.model,
+        reasoning: normalizeVisionReasoningForModel(chatProvider.model, cfg.reasoning) ?? DEFAULT_REASONING,
+        timeoutMs: resolveVisionTimeoutMs(cfg.timeoutMs),
+      },
+      maxDescriptionsPerTurn,
+    };
+  }
+
   if (backend === "anthropic") {
     if (!anthropicSidecar) return undefined;
     return {
@@ -444,6 +543,25 @@ async function executeDescription(
       abortSignal,
     );
   }
+  if (plan.backend === "chat") {
+    const sidecar = plan.chatSidecar;
+    if (!sidecar) return { text: "", error: "chat vision sidecar is unavailable" };
+    return describeImageChat(
+      job.imageUrl,
+      job.detail,
+      job.contextText,
+      sidecar.provider,
+      sidecar.providerName,
+      {
+        model: sidecar.model,
+        timeoutMs: plan.settings.timeoutMs,
+        detail: job.detail,
+        reasoning: plan.settings.reasoning,
+      },
+      abortSignal,
+      recordSidecarOutcome,
+    );
+  }
   if (!plan.forwardSidecar) return { text: "", error: "OpenAI vision sidecar is unavailable" };
   return describeImage(
     job.imageUrl,
diff --git a/tests/vision-chat.test.ts b/tests/vision-chat.test.ts
new file mode 100644
index 000000000..63c2a28b6
--- /dev/null
+++ b/tests/vision-chat.test.ts
@@ -0,0 +1,348 @@
+import { afterEach, describe, expect, test } from "bun:test";
+import { describeImageChat } from "../src/vision/describe-chat";
+import { planVisionSidecar } from "../src/vision";
+import { parseRequest } from "../src/responses/parser";
+import type { OcxConfig, OcxProviderConfig } from "../src/types";
+
+const originalFetch = globalThis.fetch;
+const image = "data:image/png;base64,aGVsbG8=";
+const settings = { model: "vision-test", timeoutMs: 5000 };
+
+afterEach(() => { globalThis.fetch = originalFetch; });
+
+function chatSse(text: string): Response {
+  const body = [
+    `data: ${JSON.stringify({ choices: [{ delta: { content: text } }] })}`,
+    "",
+    "data: [DONE]",
+    "",
+  ].join("\n");
+  return new Response(body, { headers: { "content-type": "text/event-stream" } });
+}
+
+function geminiSse(text: string): Response {
+  const body = [
+    `data: ${JSON.stringify({ candidates: [{ content: { parts: [{ text }] } }] })}`,
+    "",
+    `data: ${JSON.stringify({ candidates: [{ finishReason: "STOP" }] })}`,
+    "",
+  ].join("\n");
+  return new Response(body, { headers: { "content-type": "text/event-stream" } });
+}
+
+describe("chat vision sidecar", () => {
+  test("sends an image_url through an OpenAI-compatible provider", async () => {
+    let capturedUrl = "";
+    let capturedBody: Record<string, any> | undefined;
+    globalThis.fetch = (async (url, init) => {
+      capturedUrl = String(url);
+      capturedBody = JSON.parse(String(init?.body));
+      return chatSse("Mimo description");
+    }) as typeof fetch;
+    const provider: OcxProviderConfig = {
+      adapter: "openai-chat",
+      baseUrl: "https://vision.example/v1",
+      authMode: "key",
+      apiKey: "test-key",
+    };
+
+    const result = await describeImageChat(image, "high", "describe this", provider, "mimo", settings);
+
+    expect(result).toEqual({ text: "Mimo description" });
+    expect(capturedUrl).toBe("https://vision.example/v1/chat/completions");
+    expect(capturedBody?.model).toBe("vision-test");
+    expect(capturedBody?.messages[0].content).toEqual([
+      { type: "text", text: "describe this" },
+      { type: "image_url", image_url: { url: image, detail: "high" } },
+    ]);
+  });
+
+  test("uses the native Google adapter wire format", async () => {
+    let capturedUrl = "";
+    let capturedBody: Record<string, any> | undefined;
+    globalThis.fetch = (async (url, init) => {
+      capturedUrl = String(url);
+      capturedBody = JSON.parse(String(init?.body));
+      return geminiSse("Gemini description");
+    }) as typeof fetch;
+    const provider: OcxProviderConfig = {
+      adapter: "google",
+      baseUrl: "https://generativelanguage.googleapis.com",
+      authMode: "key",
+      apiKey: "test-key",
+    };
+
+    const result = await describeImageChat(image, "high", "describe this", provider, "gemini", { model: "gemini-test", timeoutMs: 5000 });
+
+    expect(result).toEqual({ text: "Gemini description" });
+    expect(capturedUrl).toBe("https://generativelanguage.googleapis.com/v1beta/models/gemini-test:streamGenerateContent?alt=sse");
+    expect(capturedBody?.contents?.[0]?.parts).toEqual([
+      { text: "describe this" },
+      { inline_data: { mime_type: "image/png", data: "aGVsbG8=" } },
+    ]);
+  });
+
+  test("the resolved credential wins over a static provider Authorization header", async () => {
+    let capturedAuth = "";
+    globalThis.fetch = (async (_url, init) => {
+      capturedAuth = String((init?.headers as Record<string, string>)?.Authorization ?? (init?.headers as Headers)?.get?.("Authorization") ?? "");
+      return chatSse("authed description");
+    }) as typeof fetch;
+    const provider: OcxProviderConfig = {
+      adapter: "openai-chat",
+      baseUrl: "https://vision.example/v1",
+      authMode: "key",
+      apiKey: "fresh-key",
+      headers: { Authorization: "Bearer stale-static" },
+    };
+
+    const result = await describeImageChat(image, "high", "describe this", provider, "mimo", settings);
+
+    expect(result.error).toBeUndefined();
+    expect(capturedAuth).toBe("Bearer fresh-key");
+  });
+
+  test("a keyless local provider (authMode local) sends no Authorization header", async () => {
+    let capturedAuth: string | undefined = "unset";
+    globalThis.fetch = (async (_url, init) => {
+      const h = init?.headers as Record<string, string>;
+      capturedAuth = h?.Authorization ?? (init?.headers as Headers)?.get?.("Authorization") ?? undefined;
+      return chatSse("local description");
+    }) as typeof fetch;
+    const provider: OcxProviderConfig = {
+      adapter: "openai-chat",
+      baseUrl: "http://127.0.0.1:1234/v1",
+      authMode: "local",
+    };
+
+    const result = await describeImageChat(image, "high", "describe this", provider, "local", settings);
+
+    expect(result.error).toBeUndefined();
+    expect(capturedAuth).toBeUndefined();
+  });
+
+  test("forwards the planned reasoning through the provider-aware wire mapping", async () => {
+    let capturedBody: Record<string, any> | undefined;
+    globalThis.fetch = (async (_url, init) => {
+      capturedBody = JSON.parse(String(init?.body));
+      return chatSse("reasoned description");
+    }) as typeof fetch;
+    const provider: OcxProviderConfig = {
+      adapter: "openai-chat",
+      baseUrl: "https://vision.example/v1",
+      authMode: "key",
+      apiKey: "k",
+    };
+
+    await describeImageChat(image, "high", "describe this", provider, "mimo", { ...settings, reasoning: "high" });
+
+    expect(capturedBody?.reasoning_effort).toBe("high");
+    expect(capturedBody?.reasoning).toBeUndefined();
+
+    // gateway-object providers emit reasoning.enabled/effort instead.
+    const gateway: OcxProviderConfig = {
+      adapter: "openai-chat",
+      baseUrl: "https://gateway.example/v1",
+      authMode: "key",
+      apiKey: "k",
+      reasoningWireFormat: "gateway-object",
+    };
+    globalThis.fetch = (async (_url, init) => {
+      capturedBody = JSON.parse(String(init?.body));
+      return chatSse("gateway description");
+    }) as typeof fetch;
+    await describeImageChat(image, "high", "describe this", gateway, "gateway", { ...settings, reasoning: "medium" });
+
+    expect(capturedBody?.reasoning).toEqual({ enabled: true, effort: "medium" });
+    expect(capturedBody?.reasoning_effort).toBeUndefined();
+  });
+});
+
+describe("chat vision destination guard", () => {
+  afterEach(() => { globalThis.fetch = originalFetch; });
+
+  test("an http: openai-compatible destination fails without any network call", async () => {
+    let fetchCalled = false;
+    globalThis.fetch = (async () => { fetchCalled = true; return chatSse("unreachable"); }) as typeof fetch;
+    const provider: OcxProviderConfig = {
+      adapter: "openai-chat",
+      baseUrl: "http://vision.example/v1",
+      authMode: "key",
+      apiKey: "test-key",
+    };
+
+    const result = await describeImageChat(image, "high", "describe this", provider, "mimo", settings);
+
+    expect(result.error).toContain("must use HTTPS");
+    expect(result.text).toBe("");
+    expect(fetchCalled).toBe(false);
+  });
+
+  test("an http: OAuth destination fails BEFORE token acquisition and before any network call", async () => {
+    let fetchCalled = false;
+    globalThis.fetch = (async () => { fetchCalled = true; return chatSse("unreachable"); }) as typeof fetch;
+    const provider: OcxProviderConfig = {
+      adapter: "openai-chat",
+      baseUrl: "http://vision.example/v1",
+      authMode: "oauth",
+    };
+
+    const result = await describeImageChat(image, "high", "describe this", provider, "mimo", settings);
+
+    // The HTTPS error, not an "oauth token failed" error: the guard must run before
+    // getValidAccessToken is reached.
+    expect(result.error).toContain("must use HTTPS");
+    expect(result.error).not.toContain("oauth");
+    expect(fetchCalled).toBe(false);
+  });
+
+  test("an http: Google destination fails before token acquisition and before any network call", async () => {
+    let fetchCalled = false;
+    globalThis.fetch = (async () => { fetchCalled = true; return geminiSse("unreachable"); }) as typeof fetch;
+    const provider: OcxProviderConfig = {
+      adapter: "google",
+      baseUrl: "http://generativelanguage.googleapis.com",
+      authMode: "oauth",
+    };
+
+    const result = await describeImageChat(image, "high", "describe this", provider, "gemini", settings);
+
+    expect(result.error).toContain("must use HTTPS");
+    expect(result.error).not.toContain("oauth");
+    expect(fetchCalled).toBe(false);
+  });
+
+  test("a loopback http: destination is allowed (cleartext never leaves the host)", async () => {
+    let fetchCalled = false;
+    globalThis.fetch = (async () => { fetchCalled = true; return chatSse("local-description"); }) as typeof fetch;
+    const provider: OcxProviderConfig = {
+      adapter: "openai-chat",
+      baseUrl: "http://127.0.0.1:1234/v1",
+      authMode: "key",
+      apiKey: "local-key",
+    };
+
+    const result = await describeImageChat(image, "high", "describe this", provider, "local", settings);
+
+    expect(result.error).toBeUndefined();
+    expect(fetchCalled).toBe(true);
+  });
+});
+
+describe("chat vision plan provider resolution", () => {
+  const routed: OcxProviderConfig = {
+    adapter: "openai-chat",
+    baseUrl: "https://routed.test/v1",
+    apiKey: "routed-key",
+    noVisionModels: ["text-model"],
+  };
+  const request = parseRequest({
+    model: "routed/text-model",
+    input: [{
+      type: "message",
+      role: "user",
+      content: [
+        { type: "input_text", text: "what is in this picture?" },
+        { type: "input_image", image_url: "data:image/png;base64,aGVsbG8=" },
+      ],
+    }],
+  });
+  const chatConfig = (providers: Record<string, OcxProviderConfig>, model: string): OcxConfig =>
+    ({ port: 10100, defaultProvider: "routed", providers, visionSidecar: { enabled: true, backend: "chat", model } }) as OcxConfig;
+
+  test("a bare model with two live-only providers produces NO plan (no arbitrary first-provider pick)", () => {
+    const config = chatConfig({
+      routed,
+      p1: { adapter: "openai-chat", baseUrl: "https://p1.test/v1", apiKey: "k1", liveModels: true },
+      p2: { adapter: "openai-chat", baseUrl: "https://p2.test/v1", apiKey: "k2", liveModels: true },
+    }, "gemini-flash");
+
+    expect(planVisionSidecar(config, routed, "text-model", request)).toBeUndefined();
+  });
+
+  test("a bare model listed by TWO configured providers is ambiguous and produces NO plan", () => {
+    const config = chatConfig({
+      routed,
+      p1: { adapter: "openai-chat", baseUrl: "https://p1.test/v1", apiKey: "k1", models: ["gemini-flash"] },
+      p2: { adapter: "openai-chat", baseUrl: "https://p2.test/v1", apiKey: "k2", models: ["gemini-flash"] },
+    }, "gemini-flash");
+
+    expect(planVisionSidecar(config, routed, "text-model", request)).toBeUndefined();
+  });
+
+  test("a provider-qualified model selects exactly that provider", () => {
+    const config = chatConfig({
+      routed,
+      p1: { adapter: "openai-chat", baseUrl: "https://p1.test/v1", apiKey: "k1", liveModels: true },
+      p2: { adapter: "openai-chat", baseUrl: "https://p2.test/v1", apiKey: "k2", liveModels: true },
+    }, "p2/gemini-flash");
+
+    const plan = planVisionSidecar(config, routed, "text-model", request);
+    expect(plan?.backend).toBe("chat");
+    expect(plan?.chatSidecar?.providerName).toBe("p2");
+    expect(plan?.chatSidecar?.model).toBe("gemini-flash");
+  });
+
+  test("a uniquely configured bare model resolves to its provider", () => {
+    const config = chatConfig({
+      routed,
+      p1: { adapter: "openai-chat", baseUrl: "https://p1.test/v1", apiKey: "k1", defaultModel: "gemini-flash" },
+    }, "gemini-flash");
+
+    const plan = planVisionSidecar(config, routed, "text-model", request);
+    expect(plan?.backend).toBe("chat");
+    expect(plan?.chatSidecar?.providerName).toBe("p1");
+  });
+
+  test("disabled or unauthenticated chat providers produce no plan", () => {
+    const disabled = chatConfig({
+      routed,
+      p1: { adapter: "openai-chat", baseUrl: "https://p1.test/v1", apiKey: "k1", disabled: true, models: ["gemini-flash"] },
+    }, "gemini-flash");
+    expect(planVisionSidecar(disabled, routed, "text-model", request)).toBeUndefined();
+
+    const unauthenticated = chatConfig({
+      routed,
+      p1: { adapter: "openai-chat", baseUrl: "https://p1.test/v1", models: ["gemini-flash"] },
+    }, "gemini-flash");
+    expect(planVisionSidecar(unauthenticated, routed, "text-model", request)).toBeUndefined();
+  });
+
+  test("a namespaced model id resolves through its unique configured provider", () => {
+    // "anthropic" here is a MODEL NAMESPACE inside the published id, not a
+    // configured provider: the prefix must not be read as a provider qualifier.
+    const config = chatConfig({
+      routed,
+      p1: { adapter: "openai-chat", baseUrl: "https://p1.test/v1", apiKey: "k1", models: ["anthropic/claude-3-haiku"] },
+    }, "anthropic/claude-3-haiku");
+
+    const plan = planVisionSidecar(config, routed, "text-model", request);
+    expect(plan?.backend).toBe("chat");
+    expect(plan?.chatSidecar?.providerName).toBe("p1");
+    expect(plan?.chatSidecar?.model).toBe("anthropic/claude-3-haiku");
+  });
+
+  test("a bare model matched by namespace suffix keeps the id the provider publishes", () => {
+    // Bare "gemini-flash" matches the suffix of "google/gemini-flash": the plan
+    // must carry the PUBLISHED namespaced id, not the bare (unroutable) one.
+    const config = chatConfig({
+      routed,
+      p1: { adapter: "openai-chat", baseUrl: "https://p1.test/v1", apiKey: "k1", models: ["google/gemini-flash"] },
+    }, "gemini-flash");
+
+    const plan = planVisionSidecar(config, routed, "text-model", request);
+    expect(plan?.backend).toBe("chat");
+    expect(plan?.chatSidecar?.providerName).toBe("p1");
+    expect(plan?.chatSidecar?.model).toBe("google/gemini-flash");
+  });
+
+  test("an ambiguous namespaced-suffix match produces no plan", () => {
+    const config = chatConfig({
+      routed,
+      p1: { adapter: "openai-chat", baseUrl: "https://p1.test/v1", apiKey: "k1", models: ["google/gemini-flash"] },
+      p2: { adapter: "openai-chat", baseUrl: "https://p2.test/v1", apiKey: "k2", models: ["vertex/gemini-flash"] },
+    }, "gemini-flash");
+
+    expect(planVisionSidecar(config, routed, "text-model", request)).toBeUndefined();
+  });
+});