fix: follow the redirect only as an http->https upgrade (Copilot review)

An already-https LZ_HOST_URL that answers with a redirect (e.g.
canonicalization) must not re-enter the upgrade path - on a loopback
host it would grant the -k cert-skip to a probe that never needed
upgrading. A non-http:// base now refuses the redirect loudly (rc 2)
with a warn telling the operator to set LZ_HOST_URL to the URL the
server expects.

Harness: new always-redirect mock mode + 3 assertions; 18/18 at HEAD;
the two behavioral assertions fail against the pre-fix commit (the -k
retry fired, no refusal warn).

Author: claytondukes

install.sh

@@ -141,6 +141,17 @@ validate_token() {
   fi
   case "$_PROBE_HTTP" in
     301|302|307|308)
+      # Follow the redirect ONLY as an HTTP->HTTPS upgrade. An already-https
+      # base that redirects (e.g. canonicalization) must NOT re-enter this
+      # path - it could grant the loopback cert-skip to a probe that never
+      # needed upgrading. It falls through to the non-200 fail-loud below.
+      case "$base" in
+        http://*) : ;;
+        *)
+          warn "the LZ API at ${base} answered HTTP ${_PROBE_HTTP} (a redirect); refusing to follow it from a non-http:// base - set LZ_HOST_URL to the URL the server expects"
+          return 2
+          ;;
+      esac
       # Strip trailing slashes BEFORE the :80 strip, or a trailing slash
       # shields the port ('localhost:80/' must become 'localhost', not
       # 'localhost:80' - retrying https against the plaintext port always

tests/validate-token.test.sh

@@ -35,6 +35,8 @@ case "${MOCK_MODE}" in
       http://*)  printf '\n301' ;;
       https://*) echo "curl: (7) Failed to connect to localhost port 443" >&2; exit 7 ;;
     esac ;;
+  always-redirect)
+    printf '\n301' ;;
 esac
 MOCK
 chmod +x "${WORK}/curl"
@@ -107,6 +109,14 @@ export MOCK_MODE=redirect-then-ok LZ_HOST_URL="http://localhost:80@evil.com/"
 validate_token tok; check "userinfo-host 301 -> verified https retry -> 0" 0 $?
 assert_not "userinfo host must NOT get the loopback cert-skip" retry_used_k "@evil.com"
 
+# 8. Already-https base that redirects: NOT an http->https upgrade - refuse
+#    to follow (rc 2) and never grant the loopback -k retry
+export MOCK_LOG="${WORK}/log8"; : > "$MOCK_LOG"
+export MOCK_MODE=always-redirect LZ_HOST_URL="https://localhost"
+validate_token tok; check "https base 301 -> refused, rc 2" 2 $?
+assert_not "https-base redirect must NOT trigger a -k retry" retry_used_k "https://localhost"
+assert "https-base redirect warns instead of following" grep -q "WARN: .*refusing to follow" "$MOCK_LOG"
+
 echo
 echo "passed=$pass failed=$fail"
 [ "$fail" -eq 0 ]