Reject redirect-following curl probe flags

src/lib/adapters/http/curl-args.ts

@@ -41,12 +41,9 @@ const CURL_SAFE_FLAG_OPTIONS = new Set([
   "-sS",
   "-sf",
   "-f",
-  "-L",
-  "-sfL",
   "--fail",
   "--silent",
   "--show-error",
-  "--location",
   "--compressed",
   "--get",
 ]);

src/lib/adapters/http/probe.test.ts

@@ -222,6 +222,24 @@ describe("http-probe helpers", () => {
     expect(result.message).toContain("curl probe URL must use http or https");
   });
 
+  it.each([
+    ["-L", ["-L"]],
+    ["-sfL", ["-sfL"]],
+    ["--location", ["--location"]],
+  ])("rejects redirect-following curl option %s before spawning", (_label, args) => {
+    let spawned = false;
+    const result = runCurlProbe(["-sS", ...args, "https://example.test/models"], {
+      spawnSyncImpl: () => {
+        spawned = true;
+        throw new Error("should not spawn");
+      },
+    });
+
+    expect(spawned).toBe(false);
+    expect(result.ok).toBe(false);
+    expect(result.message).toContain("curl probe option is not allowed");
+  });
+
   it("rejects curl probe request bodies that read from local files", () => {
     let spawned = false;
     const result = runCurlProbe(

src/lib/inference/ollama/model-size.test.ts

@@ -63,6 +63,8 @@ describe("probeRegistrySize", () => {
     probeRegistrySize("qwen3.5:9b", recorder.capture);
     const [argv] = recorder.calls;
     expect(argv[0]).toBe("curl");
+    expect(argv).toContain("-sf");
+    expect(argv).not.toContain("-sfL");
     expect(argv[argv.length - 1]).toBe(
       "https://registry.ollama.ai/v2/library/qwen3.5/manifests/9b",
     );

src/lib/inference/ollama/model-size.ts

@@ -45,7 +45,7 @@ export function probeRegistrySize(model: string, capture: CaptureFn = runCapture
     [
       "curl",
       ...buildValidatedCurlCommandArgs([
-        "-sfL",
+        "-sf",
         "--max-time",
         String(PROBE_TIMEOUT_SECONDS),
         "-H",