This branch predates main's SSRF hardening: main now uses follow_redirects=False (commit f5305b9, closing a redirect-based allowlist bypass) and calls _validate_url_host(url, ALLOWED_DOWNLOAD_HOSTS) at the top of _download_file (c4aab55). When resolving the merge conflicts, both must be preserved — keeping follow_redirects=True here would reintroduce the SSRF bypass.

Fixed in the rebase (e5e5a21). Both preserved:

• httpx.Client(follow_redirects=False, timeout=30) — see _download_file in the rebased input_handler.py (the streamed-download wrapper is the only change to that constructor).
• self._validate_url_host(url, ALLOWED_DOWNLOAD_HOSTS) is the first line of _download_file after the docstring, so the allowlist + private-IP check runs before any bytes are read.

The same pattern applies on _clone_git: self._validate_url_host(url, ALLOWED_GIT_HOSTS) runs before subprocess.run.

Main's _extract_zip now also iterates zf.namelist() and rejects members that resolve outside extract_dir (zip-slip, c4aab55). The rebased version needs both that loop and these size/member-count checks; taking this PR's side of the conflict would drop zip-slip protection.

Fixed in the rebase. _extract_zip now runs, in order:

1. The INGEST_MAX_ZIP_MEMBERS check.
2. The sum(info.file_size) vs INGEST_MAX_BYTES check.
3. A zf.namelist() loop that resolves each member against extract_dir.resolve() and raises ValueError("...zip-slip...") if the resolved path is not inside the extraction root.
4. zf.extractall(extract_dir).

So the size caps fire first (cheap, protects against bombs before we even touch member names), then zip-slip runs, then extract. Nothing was dropped from main's protections.

Docstring is incorrect: Path.is_file() follows symlinks and returns True for a symlink to a regular file. The code below is only safe because of the explicit not p.is_symlink() guard — please fix the rationale here so the guard isn't removed later on the strength of this comment.

Fixed. _directory_size_bytes docstring rewritten to state exactly what you flagged:

Symlinks are explicitly skipped via Path.is_symlink() — note that Path.is_file() follows symlinks and would otherwise return True for a symlink pointing at a regular file, so the not p.is_symlink() guard is load-bearing and must not be removed. This is what prevents a malicious symlink to /dev/zero (or any large file outside the walked tree) from inflating the count.

So the rationale in the comment now argues for the guard rather than against it — a future refactor that reads this docstring and considers dropping the check will be pushed back toward keeping it.

Note this check is post-hoc: the entire clone already landed on disk before it runs, so disk is transiently consumable up to whatever fits in the 60s timeout. Acceptable as a bound, but worth a comment documenting the residual window. Also, .git/ objects count toward the cap, so a legitimate repo with a working tree just under 100 MiB may be rejected.

Documented as requested. Added an in-code comment right above the size check in _clone_git:

# Post-clone size check: a successful --depth 1 clone may still
# land an arbitrarily large tree on disk before we can measure
# it, so this is a fail-closed cap rather than a hard prefilter.
# Residual window: within the 60s clone timeout an attacker can
# transiently consume up to whatever the network + disk let
# through before this check runs; bounded by the timeout, but
# not zero.  `.git/` objects are counted toward the cap, so a
# legitimate repo with a working tree just under `INGEST_MAX_BYTES`
# can still be rejected once packfiles are added.

Deliberately not fixing either issue in this PR:

• The residual disk window would require git clone --filter=blob:limit=… (partial clone) plus streaming the pack, which is a much larger change and mainly buys tighter bounding on the same disk that the 60s timeout already caps. Documented, not addressed.
• .git/ counting toward the cap is arguably correct — an attacker who ships a bloated packfile with a small working tree would otherwise slip through. Excluding .git/ would need a separate size accounting pass. Also documented for future callers who hit it on legitimate repos.

Happy to spin either out as follow-up issues if you'd rather have them tracked.

example.com is not in ALLOWED_DOWNLOAD_HOSTS on current main, so after rebase _validate_url_host raises ValueError before the MockTransport is reached — this and the other download tests will fail. Use an allowlisted host (e.g. raw.githubusercontent.com) and monkeypatch _is_private_ip (it performs a real DNS lookup) so the unit tests stay hermetic.

Both fixed:

1. Host swap. All download-path tests now use https://raw.githubusercontent.com/... (in ALLOWED_DOWNLOAD_HOSTS) instead of example.com. sed-style change — six tests updated: test_under_cap_downloads_succeed, test_content_length_header_rejected_before_body_read, test_streamed_body_overflow_rejected_when_header_missing, test_streamed_overflow_leaves_no_partial_file_on_disk, test_download_streams_to_disk_not_memory.
2. DNS-free unit tests. _patch_httpx_client now also monkeypatches ih._is_private_ip to a lambda host: False, so _validate_url_host doesn't call socket.getaddrinfo in the unit-test path. Added a matching _stub_private_ip_check(monkeypatch) helper for the two TestGitCloneBound tests.

Also had to touch two pre-existing tests in tests/unit/test_input_handler_ssrf.py (test_raw_githubusercontent_allowed, test_download_does_not_follow_redirects) because _download_file now uses client.stream("GET", url) as a context manager instead of client.get(url) — the mocks needed the nested __enter__ + iter_bytes shape. Same behavioral coverage, updated fixtures.

Full suite result on the rebased branch: 1320 passed, 14 skipped, 6 xfailed. ruff check + ruff format --check clean.