From 97ceab3165bbf93aa8918dd1b74f1eabf3a57cfb Mon Sep 17 00:00:00 2001
From: "Calum H. (IMB11)" <contact@cal.engineer>
Date: Wed, 7 Oct 2026 18:30:13 +0100
Subject: [PATCH] fix: dont file download in mem files tab

---
 Cargo.lock                                    |   1 +
 .../download-manager/download-manager-job.vue |   6 +-
 .../external-file-downloads.ts                | 107 ++++++++
 .../download-manager/use-download-manager.ts  | 104 +++++++-
 .../app-frontend/src/locales/en-US/index.json |   9 +
 apps/app-frontend/src/providers/setup.ts      |   2 +
 .../src/providers/setup/file-download.ts      |  70 +++++
 apps/app/Cargo.toml                           |   1 +
 apps/app/build.rs                             |   3 +
 apps/app/src/api/files.rs                     | 243 +++++++++++++++++-
 .../api-client/src/modules/kyros/files/v1.ts  |  28 ++
 .../api-client/src/modules/kyros/types.ts     |   4 +
 .../layouts/wrapped/hosting/manage/files.vue  |  42 ++-
 packages/ui/src/providers/file-download.ts    |  20 ++
 packages/ui/src/providers/index.ts            |   1 +
 15 files changed, 615 insertions(+), 26 deletions(-)
 create mode 100644 apps/app-frontend/src/components/ui/download-manager/external-file-downloads.ts
 create mode 100644 apps/app-frontend/src/providers/setup/file-download.ts
 create mode 100644 packages/ui/src/providers/file-download.ts

diff --git a/Cargo.lock b/Cargo.lock
index 5f4b5ef373..89f897a66e 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -12558,6 +12558,7 @@ dependencies = [
  "tauri-plugin-single-instance",
  "tauri-plugin-updater",
  "tauri-plugin-window-state",
+ "tempfile",
  "theseus",
  "thiserror 2.0.17",
  "tokio",
diff --git a/apps/app-frontend/src/components/ui/download-manager/download-manager-job.vue b/apps/app-frontend/src/components/ui/download-manager/download-manager-job.vue
index ff2dbdaecb..963670ceee 100644
--- a/apps/app-frontend/src/components/ui/download-manager/download-manager-job.vue
+++ b/apps/app-frontend/src/components/ui/download-manager/download-manager-job.vue
@@ -65,7 +65,7 @@ const cancelLabel = computed(() =>
 	formatMessage(
 		needsAttention.value
 			? messages.dismiss
-			: props.job.kind === 'debug-export'
+			: props.job.kind === 'external-file' || props.job.kind === 'debug-export'
 				? commonMessages.cancelButton
 				: messages.cancel,
 	),
@@ -105,7 +105,9 @@ const instanceLink = computed(() =>
 					class="flex size-9 shrink-0 items-center justify-center rounded-xl border border-solid border-surface-5 bg-purple/10"
 				>
 					<component
-						:is="job.kind === 'debug-export' ? DownloadIcon : BoxIcon"
+						:is="
+							job.kind === 'external-file' || job.kind === 'debug-export' ? DownloadIcon : BoxIcon
+						"
 						class="size-6 text-primary"
 						aria-hidden="true"
 					/>
diff --git a/apps/app-frontend/src/components/ui/download-manager/external-file-downloads.ts b/apps/app-frontend/src/components/ui/download-manager/external-file-downloads.ts
new file mode 100644
index 0000000000..e2b6de3510
--- /dev/null
+++ b/apps/app-frontend/src/components/ui/download-manager/external-file-downloads.ts
@@ -0,0 +1,107 @@
+import { reactive, ref } from 'vue'
+
+export interface ExternalFileDownloadProgress {
+	stage: 'waiting' | 'downloading' | 'saving'
+	downloadedBytes: number
+	totalBytes: number | null
+}
+
+export interface ExternalFileDownloadTask {
+	id: string
+	filename: string
+	serverId?: string
+	serverName?: string
+	status: 'running' | 'succeeded' | 'failed' | 'canceled'
+	stage: 'preparing' | ExternalFileDownloadProgress['stage']
+	downloadedBytes: number
+	totalBytes: number | null
+	rate: number
+	lastRead: number
+	createdAt: string
+	finishedAt?: string
+	error?: string
+	canceling: boolean
+	cancel: () => Promise<void>
+}
+
+export const externalFileDownloads = ref(new Map<string, ExternalFileDownloadTask>())
+
+export function trackExternalFileDownload(
+	id: string,
+	filename: string,
+	onCancel: () => Promise<void>,
+	server: { serverId?: string; serverName?: string } = {},
+) {
+	const task = reactive<ExternalFileDownloadTask>({
+		id,
+		filename,
+		...server,
+		status: 'running',
+		stage: 'preparing',
+		downloadedBytes: 0,
+		totalBytes: null,
+		rate: 0,
+		lastRead: performance.now(),
+		createdAt: new Date().toISOString(),
+		canceling: false,
+		async cancel() {
+			if (task.status !== 'running' || task.canceling) return
+			task.canceling = true
+			try {
+				await onCancel()
+				if (task.status === 'running') finish('canceled')
+			} finally {
+				task.canceling = false
+			}
+		},
+	})
+	externalFileDownloads.value.set(id, task)
+	let previousBytes = 0
+	let previousTime = performance.now()
+
+	function finish(status: ExternalFileDownloadTask['status']) {
+		task.status = status
+		task.finishedAt = new Date().toISOString()
+		task.rate = 0
+	}
+
+	return {
+		update(progress: ExternalFileDownloadProgress) {
+			if (task.status !== 'running' || task.canceling) return
+			const now = performance.now()
+			if (progress.stage !== 'downloading' || progress.downloadedBytes < previousBytes) {
+				task.rate = 0
+			} else if (progress.downloadedBytes > previousBytes) {
+				const rate =
+					((progress.downloadedBytes - previousBytes) * 1000) / Math.max(1, now - previousTime)
+				task.rate = task.rate ? task.rate * 0.6 + rate * 0.4 : rate
+				task.lastRead = now
+			}
+			task.stage = progress.stage
+			task.downloadedBytes = progress.downloadedBytes
+			task.totalBytes = progress.totalBytes
+			previousBytes = progress.downloadedBytes
+			previousTime = now
+		},
+		succeed(filename: string) {
+			task.filename = filename
+			finish('succeeded')
+		},
+		fail(error: string) {
+			task.error = error
+			finish('failed')
+		},
+		canceled() {
+			finish('canceled')
+		},
+	}
+}
+
+export function getExternalFileDownloadRate(task: ExternalFileDownloadTask, now: number) {
+	return task.status === 'running' &&
+		task.stage === 'downloading' &&
+		!task.canceling &&
+		now - task.lastRead < 5000
+		? task.rate
+		: 0
+}
diff --git a/apps/app-frontend/src/components/ui/download-manager/use-download-manager.ts b/apps/app-frontend/src/components/ui/download-manager/use-download-manager.ts
index aff44edb3a..0a7b950060 100644
--- a/apps/app-frontend/src/components/ui/download-manager/use-download-manager.ts
+++ b/apps/app-frontend/src/components/ui/download-manager/use-download-manager.ts
@@ -26,13 +26,19 @@ import { injectAppEvents } from '@/providers/app-events'
 
 import { debugInfoExports, type DebugInfoExportTask } from './debug-info-export'
 import { createDownloadTransferTracker } from './download-transfer'
+import {
+	externalFileDownloads,
+	type ExternalFileDownloadTask,
+	getExternalFileDownloadRate,
+} from './external-file-downloads'
 import { createInstallJobProgressTracker } from './install-job-progress'
 import { storeVerificationTask } from './store-verification'
 import { useInstallJobDisplay } from './use-install-job-display'
 
 export interface DownloadManagerJob {
 	id: string
-	kind?: 'debug-export'
+	kind?: 'external-file' | 'debug-export'
+	serverId?: string
 	createdAt?: string
 	instanceId: string | null
 	status: InstallJobSnapshot['status']
@@ -69,6 +75,13 @@ const verificationMessages = defineMessages({
 	},
 })
 
+const fileMessages = defineMessages({
+	preparing: { id: 'app.file-download.preparing', defaultMessage: 'Preparing download…' },
+	waiting: { id: 'app.file-download.waiting', defaultMessage: 'Waiting for the server…' },
+	canceling: { id: 'app.file-download.canceling', defaultMessage: 'Canceling download…' },
+	canceled: { id: 'app.action-bar.install.summary.canceled', defaultMessage: 'Canceled' },
+})
+
 const debugExportMessages = defineMessages({
 	canceled: { id: 'app.action-bar.install.summary.canceled', defaultMessage: 'Canceled' },
 	title: {
@@ -167,12 +180,14 @@ export function useDownloadManager() {
 		const task = storeVerificationTask.value
 		return task ? [buildVerificationRow(task)] : []
 	})
+	const fileRows = computed(() => [...externalFileDownloads.value.values()].map(buildFileRow))
 	const debugExportRows = computed(() =>
 		[...debugInfoExports.value.values()].map(buildDebugExportRow),
 	)
 	const allRows = computed(() => [
 		...rows.value,
 		...verificationRows.value,
+		...fileRows.value,
 		...debugExportRows.value,
 	])
 
@@ -197,10 +212,11 @@ export function useDownloadManager() {
 	)
 	const rate = computed(() =>
 		display.formatRate(
-			activeJobs.value.reduce(
-				(total, job) => total + (transfer.get(job.id, now.value).rate ?? 0),
-				0,
-			),
+			activeJobs.value.reduce((total, job) => {
+				const file = externalFileDownloads.value.get(job.id)
+				const fileRate = file ? getExternalFileDownloadRate(file, now.value) : null
+				return total + (fileRate ?? transfer.get(job.id, now.value).rate ?? 0)
+			}, 0),
 		),
 	)
 
@@ -246,6 +262,68 @@ export function useDownloadManager() {
 		}
 	}
 
+	function buildFileRow(task: ExternalFileDownloadTask): DownloadManagerJob {
+		const rate = getExternalFileDownloadRate(task, now.value)
+		const progress = task.totalBytes ? Math.min(0.99, task.downloadedBytes / task.totalBytes) : 0
+		const text =
+			task.error ??
+			formatMessage(
+				task.canceling
+					? fileMessages.canceling
+					: task.status === 'canceled'
+						? fileMessages.canceled
+						: task.status === 'succeeded'
+							? commonMessages.savedLabel
+							: task.stage === 'preparing'
+								? fileMessages.preparing
+								: task.stage === 'waiting'
+									? fileMessages.waiting
+									: task.stage === 'saving'
+										? commonMessages.savingButton
+										: commonMessages.downloadingButton,
+			)
+
+		return {
+			id: task.id,
+			kind: 'external-file',
+			serverId: task.serverId,
+			createdAt: task.createdAt,
+			instanceId: null,
+			status: task.status,
+			paused: false,
+			canceling: task.canceling,
+			canPause: false,
+			canCancel: task.status === 'running' && task.stage !== 'saving',
+			title: task.serverName ?? task.filename,
+			iconUrl: null,
+			text,
+			taskType: task.filename,
+			finishedAt: task.finishedAt,
+			progress,
+			overallProgress: task.status === 'succeeded' ? 1 : progress,
+			progressLabel:
+				task.status === 'running' && (task.stage === 'downloading' || task.stage === 'saving')
+					? [
+							task.totalBytes
+								? `${formatBytes(task.downloadedBytes)} / ${formatBytes(task.totalBytes)}`
+								: formatBytes(task.downloadedBytes),
+							display.formatRate(rate),
+						]
+							.filter(Boolean)
+							.join(' · ')
+					: '',
+			waiting: task.stage !== 'downloading' || !task.totalBytes,
+			eta:
+				rate && task.totalBytes
+					? display.formatEta((task.totalBytes - task.downloadedBytes) / rate)
+					: '',
+			canRetry: false,
+			canCopyDetails: !!task.error,
+			copied: copiedJobs.value.has(task.id),
+			busy: busyJobs.value.has(task.id),
+		}
+	}
+
 	function buildVerificationRow(
 		task: NonNullable<typeof storeVerificationTask.value>,
 	): DownloadManagerJob {
@@ -387,6 +465,11 @@ export function useDownloadManager() {
 			await runAction(id, debugExport.cancel)
 			return
 		}
+		const file = externalFileDownloads.value.get(id)
+		if (file) {
+			await runAction(id, file.cancel)
+			return
+		}
 		if (!jobs.value.get(id)?.can_cancel) return
 		await runJobAction(id, () => install_job_cancel(id))
 	}
@@ -403,6 +486,11 @@ export function useDownloadManager() {
 			if (debugExport.status !== 'running') debugInfoExports.value.delete(id)
 			return
 		}
+		const file = externalFileDownloads.value.get(id)
+		if (file) {
+			if (file.status !== 'running') externalFileDownloads.value.delete(id)
+			return
+		}
 		if (storeVerificationTask.value?.id === id) {
 			if (storeVerificationTask.value.status !== 'running') storeVerificationTask.value = null
 			return
@@ -424,10 +512,8 @@ export function useDownloadManager() {
 
 	async function copyDetails(id: string) {
 		await runAction(id, async () => {
-			const debugExport = debugInfoExports.value.get(id)
-			const details = debugExport
-				? (debugExport.error ?? '')
-				: await install_job_support_details(id)
+			const file = externalFileDownloads.value.get(id) ?? debugInfoExports.value.get(id)
+			const details = file ? (file.error ?? '') : await install_job_support_details(id)
 			if (disposed) return
 			await navigator.clipboard.writeText(details)
 			if (disposed) return
diff --git a/apps/app-frontend/src/locales/en-US/index.json b/apps/app-frontend/src/locales/en-US/index.json
index 3a6f744a6e..2d7281b7b8 100644
--- a/apps/app-frontend/src/locales/en-US/index.json
+++ b/apps/app-frontend/src/locales/en-US/index.json
@@ -479,6 +479,15 @@
   "app.features-settings.sync-across-devices.title": {
     "message": "Sync features across devices"
   },
+  "app.file-download.canceling": {
+    "message": "Canceling download…"
+  },
+  "app.file-download.preparing": {
+    "message": "Preparing download…"
+  },
+  "app.file-download.waiting": {
+    "message": "Waiting for the server…"
+  },
   "app.home.jump-back-in.actions.label": {
     "message": "Instance actions"
   },
diff --git a/apps/app-frontend/src/providers/setup.ts b/apps/app-frontend/src/providers/setup.ts
index bec1551bb7..5c8bf5982f 100644
--- a/apps/app-frontend/src/providers/setup.ts
+++ b/apps/app-frontend/src/providers/setup.ts
@@ -6,6 +6,7 @@ import type { InstanceIconConfig } from '@/helpers/types'
 import type { AppEvents } from './app-events'
 import { setupOnboardingChecklistProvider } from './onboarding-checklist'
 import { setupCreationModal } from './setup/creation-modal'
+import { setupFileDownloadProvider } from './setup/file-download'
 import { setupFileDropProvider } from './setup/file-drop'
 import { setupFilePickerProvider } from './setup/file-picker'
 import { setupImageViewerEditorProvider } from './setup/image-viewer-editor'
@@ -24,6 +25,7 @@ export function setupProviders(
 	const tags = setupTagsProvider(notificationManager)
 	setupFileDropProvider()
 	setupFilePickerProvider()
+	setupFileDownloadProvider(client)
 	setupImageViewerEditorProvider()
 	setupInstanceImportProvider(notificationManager)
 	const onboardingChecklist = setupOnboardingChecklistProvider(appEvents)
diff --git a/apps/app-frontend/src/providers/setup/file-download.ts b/apps/app-frontend/src/providers/setup/file-download.ts
new file mode 100644
index 0000000000..eb6be894ac
--- /dev/null
+++ b/apps/app-frontend/src/providers/setup/file-download.ts
@@ -0,0 +1,70 @@
+import type { AbstractModrinthClient } from '@modrinth/api-client'
+import { provideFileDownload } from '@modrinth/ui'
+import { Channel, invoke } from '@tauri-apps/api/core'
+
+import {
+	type ExternalFileDownloadProgress,
+	trackExternalFileDownload,
+} from '@/components/ui/download-manager/external-file-downloads'
+
+interface NativeSaveError {
+	message?: string
+}
+
+export function setupFileDownloadProvider(client: AbstractModrinthClient) {
+	provideFileDownload({
+		async download(file) {
+			const saveId = await invoke<string | null>('plugin:files|files_select_external', {
+				filename: file.filename,
+				filter: null,
+			}).catch((error: NativeSaveError) => {
+				throw new Error(error.message ?? String(error))
+			})
+			if (!saveId) return false
+
+			let cancelled = false
+			let finished = false
+			const task = trackExternalFileDownload(
+				saveId,
+				file.filename,
+				async () => {
+					cancelled = true
+					await invoke('plugin:files|files_release_external', { saveId })
+				},
+				{ serverId: file.serverId, serverName: file.serverName },
+			)
+			const onProgress = new Channel<ExternalFileDownloadProgress>((progress) => {
+				if (cancelled || finished) return
+				task.update(progress)
+			})
+
+			try {
+				const { token } = await client.kyros.files_v1.authorizeFileDownload(
+					file.nodeUrlHost,
+					file.worldId,
+					file.path,
+				)
+				if (cancelled) return false
+				const url = client.kyros.files_v1.getFileDownloadUrl(file.nodeUrlHost, file.worldId, token)
+				const savedFilename = await invoke<string>('plugin:files|files_save_external', {
+					saveId,
+					request: { url },
+					onProgress,
+				})
+				task.succeed(savedFilename)
+				return true
+			} catch (error) {
+				if (cancelled) {
+					task.canceled()
+					return false
+				}
+				const message = (error as NativeSaveError).message ?? String(error)
+				task.fail(message)
+				throw new Error(message)
+			} finally {
+				finished = true
+				await invoke('plugin:files|files_release_external', { saveId }).catch(() => undefined)
+			}
+		},
+	})
+}
diff --git a/apps/app/Cargo.toml b/apps/app/Cargo.toml
index e5c59d1dfe..c8d4accdfd 100644
--- a/apps/app/Cargo.toml
+++ b/apps/app/Cargo.toml
@@ -38,6 +38,7 @@ tauri-plugin-os = { workspace = true }
 tauri-plugin-single-instance = { workspace = true }
 tauri-plugin-updater = { workspace = true }
 tauri-plugin-window-state = { workspace = true }
+tempfile = { workspace = true }
 theseus = { workspace = true, features = ["tauri"] }
 thiserror = { workspace = true }
 tokio = { workspace = true, features = ["time"] }
diff --git a/apps/app/build.rs b/apps/app/build.rs
index ee792094f8..f959d17c2c 100644
--- a/apps/app/build.rs
+++ b/apps/app/build.rs
@@ -423,6 +423,9 @@ fn main() {
                         "file_rename",
                         "file_delete",
                         "file_save_as",
+                        "files_select_external",
+                        "files_save_external",
+                        "files_release_external",
                         "file_read_dragged_file",
                     ])
                     .default_permission(
diff --git a/apps/app/src/api/files.rs b/apps/app/src/api/files.rs
index 9600acefb5..de8ade6b2b 100644
--- a/apps/app/src/api/files.rs
+++ b/apps/app/src/api/files.rs
@@ -1,15 +1,46 @@
 use crate::api::Result;
 use async_zip::base::read::seek::ZipFileReader;
-use serde::Serialize;
+use serde::{Deserialize, Serialize};
+use std::collections::HashMap;
 use std::io::Cursor;
-use tauri::Runtime;
+use std::path::PathBuf;
+use std::sync::Arc;
+use std::time::{Duration, Instant};
+use tauri::{Manager, Runtime};
 use tauri_plugin_dialog::DialogExt;
+use tauri_plugin_http::reqwest;
+use tokio::io::AsyncWriteExt;
+use tokio_util::sync::CancellationToken;
 
 pub fn init<R: Runtime>() -> tauri::plugin::TauriPlugin<R> {
     tauri::plugin::Builder::new("files")
+        .setup(|app, _| {
+            app.manage(ExternalSaveSessions::default());
+            Ok(())
+        })
+        .on_event(|app, event| {
+            if let tauri::RunEvent::WindowEvent {
+                label,
+                event: tauri::WindowEvent::Destroyed,
+                ..
+            } = event
+            {
+                app.state::<ExternalSaveSessions>().0.retain(|_, session| {
+                    if &session.window_label == label {
+                        session.cancel.cancel();
+                        false
+                    } else {
+                        true
+                    }
+                });
+            }
+        })
         .invoke_handler(tauri::generate_handler![
             file_extract_zip,
             file_save_as,
+            files_select_external,
+            files_save_external,
+            files_release_external,
             file_read_dragged_file,
             file_list,
             file_read,
@@ -232,3 +263,211 @@ pub async fn file_save_as<R: Runtime>(
 
     Ok(())
 }
+
+#[derive(Default)]
+pub struct ExternalSaveSessions(
+    dashmap::DashMap<String, Arc<ExternalSaveSession>>,
+);
+
+struct ExternalSaveSession {
+    window_label: String,
+    path: PathBuf,
+    lock: tokio::sync::Mutex<()>,
+    cancel: CancellationToken,
+}
+
+#[derive(Deserialize)]
+pub struct ExternalSaveFilter {
+    name: String,
+    extensions: Vec<String>,
+}
+
+#[derive(Deserialize)]
+pub struct ExternalSaveRequest {
+    url: String,
+    #[serde(default)]
+    headers: HashMap<String, String>,
+}
+
+#[derive(Serialize)]
+#[serde(rename_all = "camelCase")]
+pub struct ExternalSaveProgress {
+    stage: &'static str,
+    downloaded_bytes: u64,
+    total_bytes: Option<u64>,
+}
+
+#[derive(Serialize)]
+#[serde(rename_all = "camelCase")]
+pub struct ExternalSaveError {
+    message: String,
+    status_code: Option<u16>,
+}
+
+impl ExternalSaveError {
+    fn new(message: impl Into<String>) -> Self {
+        Self {
+            message: message.into(),
+            status_code: None,
+        }
+    }
+}
+
+impl From<std::io::Error> for ExternalSaveError {
+    fn from(error: std::io::Error) -> Self {
+        Self::new(error.to_string())
+    }
+}
+
+impl From<reqwest::Error> for ExternalSaveError {
+    fn from(error: reqwest::Error) -> Self {
+        Self {
+            status_code: error.status().map(|status| status.as_u16()),
+            message: error.without_url().to_string(),
+        }
+    }
+}
+
+fn external_save_session<R: Runtime>(
+    window: &tauri::WebviewWindow<R>,
+    state: &ExternalSaveSessions,
+    save_id: &str,
+) -> std::result::Result<Arc<ExternalSaveSession>, ExternalSaveError> {
+    state
+        .0
+        .get(save_id)
+        .filter(|session| session.window_label == window.label())
+        .map(|session| Arc::clone(session.value()))
+        .ok_or_else(|| ExternalSaveError::new("Unknown save session"))
+}
+
+#[tauri::command]
+pub async fn files_select_external<R: Runtime>(
+    window: tauri::WebviewWindow<R>,
+    state: tauri::State<'_, ExternalSaveSessions>,
+    filename: String,
+    filter: Option<ExternalSaveFilter>,
+) -> std::result::Result<Option<String>, ExternalSaveError> {
+    let file_name = filename
+        .rsplit(['/', '\\'])
+        .next()
+        .filter(|name| !name.is_empty())
+        .unwrap_or("download");
+    let mut dialog = window.dialog().file().set_file_name(file_name);
+    if let Some(filter) = filter {
+        let extensions: Vec<&str> =
+            filter.extensions.iter().map(String::as_str).collect();
+        dialog = dialog.add_filter(filter.name, &extensions);
+    }
+    let (tx, rx) = tokio::sync::oneshot::channel();
+    dialog.save_file(|path| {
+        let _ = tx.send(path);
+    });
+    let Some(destination) = rx.await.unwrap_or(None) else {
+        return Ok(None);
+    };
+    let path = PathBuf::try_from(destination)
+        .map_err(|error| ExternalSaveError::new(error.to_string()))?;
+    let save_id = uuid::Uuid::new_v4().to_string();
+    state.0.insert(
+        save_id.clone(),
+        Arc::new(ExternalSaveSession {
+            window_label: window.label().to_string(),
+            path,
+            lock: tokio::sync::Mutex::new(()),
+            cancel: CancellationToken::new(),
+        }),
+    );
+    Ok(Some(save_id))
+}
+
+#[tauri::command]
+pub async fn files_save_external<R: Runtime>(
+    window: tauri::WebviewWindow<R>,
+    state: tauri::State<'_, ExternalSaveSessions>,
+    save_id: String,
+    request: ExternalSaveRequest,
+    on_progress: tauri::ipc::Channel<ExternalSaveProgress>,
+) -> std::result::Result<String, ExternalSaveError> {
+    let session = external_save_session(&window, &state, &save_id)?;
+    let url = url::Url::parse(&request.url)
+        .map_err(|_| ExternalSaveError::new("Invalid download URL"))?;
+    if !matches!(url.scheme(), "http" | "https") {
+        return Err(ExternalSaveError::new("Unsupported download URL"));
+    }
+    tokio::select! {
+        _ = session.cancel.cancelled() => Err(ExternalSaveError::new("Download cancelled")),
+        result = async {
+            let _lock = session.lock.lock().await;
+            let _ = on_progress.send(ExternalSaveProgress {
+                stage: "waiting",
+                downloaded_bytes: 0,
+                total_bytes: None,
+            });
+            let client = reqwest::Client::builder()
+                .connect_timeout(Duration::from_secs(30))
+                .read_timeout(Duration::from_secs(60))
+                .build()?;
+            let mut download = client.get(url);
+            for (name, value) in request.headers {
+                download = download.header(name, value);
+            }
+            let mut response = download.send().await?.error_for_status()?;
+            let total_bytes = response.content_length();
+            let mut downloaded_bytes = 0;
+            let mut last_progress = Instant::now();
+            let _ = on_progress.send(ExternalSaveProgress {
+                stage: "downloading",
+                downloaded_bytes,
+                total_bytes,
+            });
+            let parent = session.path.parent().ok_or_else(|| {
+                ExternalSaveError::new("Invalid save destination")
+            })?;
+            let temporary = tempfile::NamedTempFile::new_in(parent)?;
+            let (file, temporary_path) = temporary.into_parts();
+            let mut file = tokio::fs::File::from_std(file);
+            while let Some(chunk) = response.chunk().await? {
+                file.write_all(&chunk).await?;
+                downloaded_bytes += chunk.len() as u64;
+                if last_progress.elapsed() >= Duration::from_millis(200) {
+                    let _ = on_progress.send(ExternalSaveProgress {
+                        stage: "downloading",
+                        downloaded_bytes,
+                        total_bytes,
+                    });
+                    last_progress = Instant::now();
+                }
+            }
+            let _ = on_progress.send(ExternalSaveProgress {
+                stage: "saving",
+                downloaded_bytes,
+                total_bytes,
+            });
+            file.flush().await?;
+            file.sync_all().await?;
+            drop(file);
+            temporary_path
+                .persist(&session.path)
+                .map_err(|error| error.error)?;
+            Ok(session
+                .path
+                .file_name()
+                .unwrap_or_default()
+                .to_string_lossy()
+                .to_string())
+        } => result,
+    }
+}
+
+#[tauri::command]
+pub async fn files_release_external<R: Runtime>(
+    window: tauri::WebviewWindow<R>,
+    state: tauri::State<'_, ExternalSaveSessions>,
+    save_id: String,
+) -> std::result::Result<(), ExternalSaveError> {
+    let session = external_save_session(&window, &state, &save_id)?;
+    session.cancel.cancel();
+    state.0.remove(&save_id);
+    Ok(())
+}
diff --git a/packages/api-client/src/modules/kyros/files/v1.ts b/packages/api-client/src/modules/kyros/files/v1.ts
index 567104f3ca..bc8af4faa6 100644
--- a/packages/api-client/src/modules/kyros/files/v1.ts
+++ b/packages/api-client/src/modules/kyros/files/v1.ts
@@ -7,6 +7,34 @@ export class KyrosFilesV1Module extends AbstractModule {
 		return 'kyros_files_v1'
 	}
 
+	/**
+	 * Authorize a short-lived, single-use file download.
+	 */
+	public async authorizeFileDownload(
+		nodeUrlHost: string,
+		worldId: string,
+		path: string,
+	): Promise<Kyros.Files.v1.FileDownloadAuthorization> {
+		return this.client.request<Kyros.Files.v1.FileDownloadAuthorization>(
+			`/worlds/${worldId}/files/contents-raw/authorize`,
+			{
+				api: getNodeBaseUrl(nodeUrlHost),
+				version: 'v1',
+				method: 'GET',
+				params: { path },
+			},
+		)
+	}
+
+	/**
+	 * Build the browser URL for a previously authorized file download.
+	 */
+	public getFileDownloadUrl(nodeUrlHost: string, worldId: string, token: string): string {
+		const url = new URL(`/v1/worlds/${worldId}/files/contents-raw`, getNodeBaseUrl(nodeUrlHost))
+		url.searchParams.set('token', token)
+		return url.toString()
+	}
+
 	/**
 	 * Authorize a short-lived, single-use full-world download.
 	 */
diff --git a/packages/api-client/src/modules/kyros/types.ts b/packages/api-client/src/modules/kyros/types.ts
index 27040064fb..533a217807 100644
--- a/packages/api-client/src/modules/kyros/types.ts
+++ b/packages/api-client/src/modules/kyros/types.ts
@@ -29,6 +29,10 @@ export namespace Kyros {
 
 	export namespace Files {
 		export namespace v1 {
+			export interface FileDownloadAuthorization {
+				token: string
+			}
+
 			export interface FullWorldDownloadAuthorization {
 				token: string
 			}
diff --git a/packages/ui/src/layouts/wrapped/hosting/manage/files.vue b/packages/ui/src/layouts/wrapped/hosting/manage/files.vue
index 0fc14cfbf1..debed3a073 100644
--- a/packages/ui/src/layouts/wrapped/hosting/manage/files.vue
+++ b/packages/ui/src/layouts/wrapped/hosting/manage/files.vue
@@ -11,6 +11,7 @@ import { defineMessages, useVIntl } from '#ui/composables/i18n'
 import { useServerPermissions } from '#ui/composables/server-permissions'
 import {
 	injectAuth,
+	injectFileDownload,
 	injectModrinthClient,
 	injectModrinthServerContext,
 	injectNotificationManager,
@@ -27,6 +28,7 @@ const props = defineProps<{
 }>()
 
 const client = injectModrinthClient()
+const fileDownload = injectFileDownload(null)
 const auth = injectAuth()
 const serverContext = injectModrinthServerContext()
 const {
@@ -387,27 +389,41 @@ async function writeFile(path: string, content: string): Promise<void> {
 
 async function downloadFile(path: string, fileName: string): Promise<void> {
 	try {
-		const fileData = await client.kyros.files_v0.downloadFile(path)
-		if (fileData) {
-			saveBlob(fileData, fileName)
+		const activeWorldId = worldId.value
+		const location = serverContext.serverFull.value?.location
+		if (!activeWorldId || location?.status !== 'assigned')
+			throw new Error('No active world or assigned node')
+
+		const nodeUrlHost = location.location_metadata.url_host
+		if (fileDownload) {
+			await fileDownload.download({
+				type: 'server-file',
+				filename: fileName,
+				serverId,
+				serverName: serverContext.server.value.name,
+				nodeUrlHost,
+				worldId: activeWorldId,
+				path,
+			})
+			return
 		}
-	} catch {
+
+		const { token } = await client.kyros.files_v1.authorizeFileDownload(
+			nodeUrlHost,
+			activeWorldId,
+			path,
+		)
+		const downloadUrl = client.kyros.files_v1.getFileDownloadUrl(nodeUrlHost, activeWorldId, token)
+		window.location.assign(downloadUrl)
+	} catch (error) {
 		addNotification({
 			title: formatMessage(commonMessages.downloadFailedLabel),
-			text: 'Could not download the file.',
+			text: error instanceof Error ? error.message : 'Could not download the file.',
 			type: 'error',
 		})
 	}
 }
 
-function saveBlob(blob: Blob, fileName: string) {
-	const link = document.createElement('a')
-	link.href = window.URL.createObjectURL(blob)
-	link.download = fileName
-	link.click()
-	window.URL.revokeObjectURL(link.href)
-}
-
 async function statFile(path: string): Promise<Kyros.Files.v1.FileStatResponse> {
 	if (!worldId.value) throw new Error('No active world')
 	return client.kyros.files_v1.stat(worldId.value, { path })
diff --git a/packages/ui/src/providers/file-download.ts b/packages/ui/src/providers/file-download.ts
new file mode 100644
index 0000000000..3e4d02d739
--- /dev/null
+++ b/packages/ui/src/providers/file-download.ts
@@ -0,0 +1,20 @@
+import { createContext } from './create-context'
+
+export interface FileDownload {
+	type: 'server-file'
+	filename: string
+	serverId: string
+	serverName: string
+	nodeUrlHost: string
+	worldId: string
+	path: string
+}
+
+export interface FileDownloadProvider {
+	download: (file: FileDownload) => Promise<boolean>
+}
+
+export const [injectFileDownload, provideFileDownload] = createContext<FileDownloadProvider>(
+	'FileDownloadProvider',
+	'fileDownload',
+)
diff --git a/packages/ui/src/providers/index.ts b/packages/ui/src/providers/index.ts
index 9c6f8333ed..a14625a924 100644
--- a/packages/ui/src/providers/index.ts
+++ b/packages/ui/src/providers/index.ts
@@ -4,6 +4,7 @@ export * from './attribution-moderation'
 export * from './auth'
 export * from './content-manager'
 export { createContext } from './create-context'
+export * from './file-download'
 export * from './file-drop'
 export * from './file-picker'
 export * from './hosting-purchase-intent'