diff --git a/scripts/harness_checks/line_count_baseline.json b/scripts/harness_checks/line_count_baseline.json
index 796334f45..817dc8b32 100644
--- a/scripts/harness_checks/line_count_baseline.json
+++ b/scripts/harness_checks/line_count_baseline.json
@@ -1,11 +1,12 @@
 {
-  "hard_cap": 3000,
-  "warn_cap": 1500,
-  "root": "harness-discipline-docs",
-  "offenders": {
-    "src/spark_cli/cli.py": 18105,
-    "src/spark_cli/system_map.py": 5658,
-    "tests/test_cli.py": 14759,
-    "tests/test_system_map.py": 2055
-  }
-}
+    "hard_cap": 3000,
+    "warn_cap": 1500,
+    "root": "harness-discipline-docs",
+    "offenders": {
+        "src/spark_cli/cli.py": 18111,
+        "src/spark_cli/system_map.py": 5658,
+        "tests/test_cli.py": 14759,
+        "tests/test_system_map.py": 2055
+    },
+    "src/spark_cli/cli.py": 18111
+}
\ No newline at end of file
diff --git a/src/spark_cli/cli.py b/src/spark_cli/cli.py
index 8a444135e..7e09fd237 100644
--- a/src/spark_cli/cli.py
+++ b/src/spark_cli/cli.py
@@ -11552,6 +11552,9 @@ def resolve_llm_doctor_target(args: argparse.Namespace) -> dict[str, Any]:
 def openai_compatible_chat_completion(target: dict[str, Any], prompt: str) -> str:
     base_url = str(target["base_url"]).rstrip("/")
     url = f"{base_url}/chat/completions"
+    errors = validate_url_safety(url, label="LLM provider base_url")
+    if errors:
+        raise SystemExit(f"LLM provider URL rejected: {'; '.join(errors)}")
     body = {
         "model": target["model"],
         "messages": [
@@ -11585,6 +11588,9 @@ def openai_compatible_chat_completion(target: dict[str, Any], prompt: str) -> st
 def ollama_chat_completion(target: dict[str, Any], prompt: str) -> str:
     base_url = str(target["base_url"]).rstrip("/")
     url = f"{base_url}/api/chat"
+    errors = validate_url_safety(url, label="Ollama base_url")
+    if errors:
+        raise SystemExit(f"Ollama URL rejected: {'; '.join(errors)}")
     body = {
         "model": target["model"],
         "stream": False,