@@ -46,13 +46,18 @@ export interface DownloadJob {
     modelName: string;
     publisher: string;
     quantization?: string;
-    backend: "llamacpp" | "mlx" | "vllm" | "ollama";
+    backend: "llamacpp" | "mlx" | "vllm" | "ollama" | "transformers";
     destinationDir: string;
     modelId: string;
     shards: DownloadShard[];
     state: DownloadJobState;
     error?: DownloadJobError;
     retryCount: number;
+    jobReceivedBytes?: number;
+    totalBytes?: number;
+    bytesPerSecond?: number;
+    etaSeconds?: number;
+    recoveredAtStartup?: boolean;
     createdAt: string;
     updatedAt: string;
 }
@@ -95,7 +100,7 @@ export function createJob(
 // benefit.
 export function updateJob(
     id: string,
-    partial: Partial<Pick<DownloadJob, "state" | "error" | "retryCount" | "shards">>
+    partial: Partial<Pick<DownloadJob, "state" | "error" | "retryCount" | "shards" | "jobReceivedBytes" | "totalBytes" | "bytesPerSecond" | "etaSeconds" | "recoveredAtStartup">>
 ): DownloadJob | null {
     const all = listJobs();
     const idx = all.findIndex((j) => j.id === id);
 
@@ -1,5 +1,14 @@
 import type { BrowserWindow } from "electron";
-import { listJobs, updateJob } from "./download-jobs-store";
+import * as downloadWorker from "./download-worker";
+import * as fs from "node:fs";
+import { createJob, deleteJob, getJob, listJobs, updateJob, type DownloadJob } from "./download-jobs-store";
+import { getDownloadManager } from "./native-downloader";
+import { detectModelFormat, getSpecs, resolveAutomaticRuntime } from "./system-specs";
+
+export interface DownloadControls { concurrency: number; bandwidthMbps: number }
+export interface RecoveryStatus { recoveredJobs: number; recoveredAt: string | null }
+let recoveryStatus: RecoveryStatus = { recoveredJobs: 0, recoveredAt: null };
+export function getJobs(): DownloadJob[] { return listJobs(); }
 
 // Deliberately a getWindow() closure, not a captured event.sender from one
 // ipcMain.handle invocation — jobs push progress at times disconnected from
@@ -28,10 +37,71 @@ export function broadcast(): void {
 // resuming is exactly what downloadGgufFile's Range-request logic already
 // does for a partial file, whatever caused the interruption).
 export function resumeInterruptedJobs(): void {
+    let recoveredJobs = 0;
     for (const job of listJobs()) {
-        if (job.state === "downloading" || job.state === "resolving") {
-            updateJob(job.id, { state: "queued" });
+        if (["downloading", "resolving", "verifying", "installing"].includes(job.state)) {
+            updateJob(job.id, { state: "queued", recoveredAtStartup: true });
+            recoveredJobs++;
         }
     }
     broadcast();
+    downloadWorker.wake();
+    recoveryStatus = { recoveredJobs, recoveredAt: new Date().toISOString() };
+}
+
+export function getRecoveryStatus(): RecoveryStatus { return recoveryStatus; }
+
+export function configure(controls: DownloadControls): DownloadControls {
+    const concurrency = Math.max(1, Math.min(8, Math.floor(controls.concurrency)));
+    const bandwidthMbps = Math.max(0, Number(controls.bandwidthMbps) || 0);
+    const manager = getDownloadManager();
+    manager.setGlobalConcurrency(concurrency);
+    manager.setBandwidthLimit(bandwidthMbps > 0 ? bandwidthMbps * 1024 * 1024 / 8 : undefined);
+    return { concurrency, bandwidthMbps };
+}
+
+export async function createHuggingFaceJob(input: { modelId: string; filename: string; expectedBytes: number; destinationDir: string; backend?: "automatic" | DownloadJob["backend"] }): Promise<DownloadJob> {
+    const filename = input.filename.replace(/\\/g, "/").split("/").pop() || input.filename;
+    // "automatic" (the default) resolves the same way the model-recommendation
+    // flow does: format inferred from the filename/repo id, matched against
+    // this machine's detected hardware.
+    const backend = !input.backend || input.backend === "automatic"
+        ? resolveAutomaticRuntime(detectModelFormat(input.filename) === "unknown" ? detectModelFormat(input.modelId) : detectModelFormat(input.filename), await getSpecs())
+        : input.backend;
+    const job = createJob({
+        kind: "huggingface", modelName: input.modelId.split("/").pop() || input.modelId,
+        publisher: input.modelId.split("/")[0] || "Hugging Face", backend,
+        destinationDir: input.destinationDir, modelId: input.modelId,
+        quantization: filename.match(/(Q\d(?:_[A-Z0-9]+)*)/i)?.[1],
+        shards: [{ filename: input.filename, path: `${input.destinationDir}/${filename}`, expectedBytes: Math.max(0, input.expectedBytes), receivedBytes: 0, state: "queued" }],
+    });
+    broadcast(); downloadWorker.wake(); return job;
+}
+
+export function pauseJob(id: string): void {
+    const job = getJob(id); if (!job || !["queued", "resolving", "downloading"].includes(job.state)) return;
+    downloadWorker.pause(id); updateJob(id, { state: "paused", etaSeconds: undefined, bytesPerSecond: undefined }); broadcast();
+}
+export function resumeJob(id: string): void {
+    const job = getJob(id); if (!job || !["paused", "failed", "cancelled"].includes(job.state)) return;
+    downloadWorker.clearRetryTimer(id); updateJob(id, { state: "queued", error: undefined, recoveredAtStartup: false }); broadcast(); downloadWorker.wake();
+}
+export function retryJob(id: string): void { resumeJob(id); }
+export function cancelJob(id: string): void {
+    const job = getJob(id); if (!job || ["ready", "cancelled"].includes(job.state)) return;
+    downloadWorker.cancel(id); updateJob(id, { state: "cancelled", etaSeconds: undefined, bytesPerSecond: undefined }); broadcast();
+}
+export function removeJob(id: string): void {
+    const job = getJob(id); if (!job) return;
+    downloadWorker.cancel(id);
+    for (const shard of job.shards) {
+        for (const suffix of [".part", ".part.json"]) { try { fs.rmSync(`${shard.path}${suffix}`, { force: true }); } catch { /* best effort */ } }
+    }
+    deleteJob(id); broadcast();
+}
+export function diskForecast(id: string): { requiredBytes: number; availableBytes: number | null; enough: boolean | null } {
+    const job = getJob(id); if (!job) throw new Error("Download job not found");
+    const requiredBytes = job.shards.reduce((sum, shard) => sum + Math.max(0, shard.expectedBytes - shard.receivedBytes), 0);
+    try { const stats = fs.statfsSync(job.destinationDir); const availableBytes = stats.bavail * stats.bsize; return { requiredBytes, availableBytes, enough: availableBytes >= requiredBytes }; }
+    catch { return { requiredBytes, availableBytes: null, enough: null }; }
 }
@@ -0,0 +1,166 @@
+import * as accounts from "./accounts";
+import * as downloadQueue from "./download-queue";
+import { getJob, listJobs, updateJob, type DownloadErrorKind, type DownloadJob, type DownloadShard } from "./download-jobs-store";
+import { logger } from "./logger";
+import { getDownloadManager, type JobEvent, type JsDownloadJob } from "./native-downloader";
+
+const MAX_AUTO_RETRIES = 3;
+
+// How often raw JobEvents get coalesced into a `downloads:update` broadcast
+// — matches the ~100ms cadence the Rust side's own progress ticker already
+// uses, so this never becomes the bottleneck. A job's terminal state always
+// broadcasts immediately regardless (see `driveJob`'s `finally`), so the UI
+// never has to wait out this throttle to see a job actually finish.
+const BROADCAST_THROTTLE_MS = 100;
+let lastBroadcastAt = 0;
+
+function throttledBroadcast(): void {
+    const now = Date.now();
+    if (now - lastBroadcastAt < BROADCAST_THROTTLE_MS) return;
+    lastBroadcastAt = now;
+    downloadQueue.broadcast();
+}
+
+// Job ids currently being driven — guards against `wake()` picking up the
+// same "queued" job twice; the real concurrency gate is the Rust manager's
+// own semaphore, this is purely a JS-side duplicate-start guard.
+const active = new Set<string>();
+const retryTimers = new Map<string, NodeJS.Timeout>();
+
+export function clearRetryTimer(jobId: string): void {
+    const timer = retryTimers.get(jobId);
+    if (timer) clearTimeout(timer);
+    retryTimers.delete(jobId);
+}
+
+function toJsDownloadJob(job: DownloadJob): JsDownloadJob {
+    return {
+        id: job.id,
+        modelId: job.modelId,
+        token: accounts.getAccountToken("huggingface") ?? undefined,
+        destinationDir: job.destinationDir,
+        shards: job.shards.map((s) => ({
+            filename: s.filename,
+            path: s.path,
+            expectedBytes: s.expectedBytes,
+            receivedBytes: s.receivedBytes,
+            sha256: s.sha256,
+        })),
+    };
+}
+
+function withShardPatch(job: DownloadJob, filename: string, patch: Partial<DownloadShard>): DownloadShard[] {
+    return job.shards.map((s) => (s.filename === filename ? { ...s, ...patch } : s));
+}
+
+function handleEvent(event: JobEvent): void {
+    const job = getJob(event.jobId);
+    if (!job) return; // job was deleted while its download was in flight
+
+    switch (event.kind) {
+        case "shard_state":
+            if (event.shardFilename && event.shardState) {
+                updateJob(job.id, { shards: withShardPatch(job, event.shardFilename, { state: event.shardState as DownloadShard["state"] }) });
+            }
+            break;
+        case "shard_progress":
+            if (event.shardFilename && event.receivedBytes !== undefined) {
+                updateJob(job.id, {
+                    shards: withShardPatch(job, event.shardFilename, { receivedBytes: event.receivedBytes }),
+                    jobReceivedBytes: event.jobReceivedBytes,
+                    totalBytes: event.totalBytes,
+                    bytesPerSecond: event.bytesPerSec,
+                    etaSeconds: event.etaSeconds,
+                });
+            }
+            break;
+        case "job_state":
+            if (event.jobState) {
+                updateJob(job.id, { state: event.jobState as DownloadJob["state"] });
+            }
+            break;
+        case "job_error":
+            updateJob(job.id, {
+                state: "failed",
+                error: {
+                    message: event.errorMessage ?? "Download failed.",
+                    kind: (event.errorKind ?? "unknown") as DownloadErrorKind,
+                    retryable: event.retryable ?? false,
+                },
+            });
+            break;
+    }
+}
+
+// A `"failed"` job whose error is marked retryable gets a small number of
+// automatic requeue attempts with exponential backoff before it's left for
+// a manual retry — distinct from the Rust side's own per-chunk retry
+// (MAX_ATTEMPTS_PER_CHUNK), which handles much shorter-lived transient
+// failures within a single shard transfer.
+function maybeAutoRetry(jobId: string): void {
+    const job = getJob(jobId);
+    if (!job || job.state !== "failed" || !job.error?.retryable || job.retryCount >= MAX_AUTO_RETRIES) return;
+
+    const backoffMs = 1000 * 2 ** job.retryCount;
+    if (retryTimers.has(jobId)) return;
+    const expectedRetryCount = job.retryCount;
+    const timer = setTimeout(() => {
+        retryTimers.delete(jobId);
+        const current = getJob(jobId);
+        if (!current || current.state !== "failed" || !current.error?.retryable || current.retryCount !== expectedRetryCount) return;
+        updateJob(jobId, { state: "queued", retryCount: expectedRetryCount + 1 });
+        wake();
+    }, backoffMs);
+    timer.unref();
+    retryTimers.set(jobId, timer);
+}
+
+async function driveJob(job: DownloadJob): Promise<void> {
+    active.add(job.id);
+    try {
+        await getDownloadManager().startJob(toJsDownloadJob(job), (err, event) => {
+            if (err) {
+                logger.error(`Download job ${job.id}: event callback error: ${err.message}`);
+                return;
+            }
+            handleEvent(event);
+            throttledBroadcast();
+        });
+    } catch (err) {
+        // The rejection carries the same message the "job_error" event
+        // already recorded via handleEvent — this catch exists only so an
+        // unexpected throw here doesn't become an unhandled rejection.
+        logger.error(`Download job ${job.id}: ${(err as Error).message}`);
+    } finally {
+        active.delete(job.id);
+        downloadQueue.broadcast();
+        maybeAutoRetry(job.id);
+    }
+}
+
+// Picks up every currently-"queued" Hugging Face job not already being
+// driven. Safe to call repeatedly/redundantly — `active` prevents double
+// starts. Called once at app-ready and again whenever something might have
+// made a "queued" job appear (a fresh `downloads:create`, a manual
+// retry/resume, or `download-queue.ts`'s startup requeue).
+export function wake(): void {
+    for (const job of listJobs()) {
+        if (job.state === "queued" && job.kind === "huggingface" && !active.has(job.id)) {
+            void driveJob(job);
+        }
+    }
+}
+
+export function start(): void {
+    wake();
+}
+
+export function pause(jobId: string): void {
+    clearRetryTimer(jobId);
+    getDownloadManager().pauseJob(jobId);
+}
+
+export function cancel(jobId: string): void {
+    clearRetryTimer(jobId);
+    getDownloadManager().cancelJob(jobId);
+}
@@ -0,0 +1,99 @@
+import * as path from "node:path";
+
+export interface NativeDownloadProgress {
+    receivedBytes: number;
+    totalBytes?: number;
+}
+
+export interface JobEvent {
+    jobId: string;
+    kind: "shard_progress" | "shard_state" | "job_state" | "job_error";
+    shardFilename?: string;
+    shardState?: string;
+    jobState?: string;
+    receivedBytes?: number;
+    jobReceivedBytes?: number;
+    totalBytes?: number;
+    bytesPerSec?: number;
+    etaSeconds?: number;
+    errorMessage?: string;
+    errorKind?: string;
+    retryable?: boolean;
+}
+
+export interface JsShard {
+    filename: string;
+    path: string;
+    expectedBytes: number;
+    receivedBytes: number;
+    sha256?: string;
+}
+
+export interface JsDownloadJob {
+    id: string;
+    modelId: string;
+    token?: string;
+    destinationDir: string;
+    shards: JsShard[];
+}
+
+export interface NativeDownloadManager {
+    setGlobalConcurrency(limit: number): void;
+    setBandwidthLimit(bytesPerSec: number | undefined | null): void;
+    pauseJob(jobId: string): void;
+    cancelJob(jobId: string): void;
+    startJob(job: JsDownloadJob, onEvent: (err: Error | null, event: JobEvent) => void): Promise<void>;
+}
+
+interface NativeAddon {
+    downloadGgufFile(
+        modelId: string,
+        filename: string,
+        destPath: string,
+        token: string | undefined | null,
+        onProgress: (err: Error | null, progress: NativeDownloadProgress) => void
+    ): Promise<void>;
+    DownloadManager: new () => NativeDownloadManager;
+}
+
+// The Rust addon is built by `lib`'s `napi build` step into app/native/ as a
+// plain filesystem artifact (not an npm dependency under node_modules —
+// see the plan for why: a `file:` dependency would need `npm ci` to
+// reconcile a different lockfile integrity hash per platform's .node
+// binary). `dist/native-downloader.js` sits one level under app/, so
+// app/native is a sibling reached by going up just one directory. Electron
+// transparently redirects native-module requires from inside app.asar to
+// the asarUnpack'd app.asar.unpacked counterpart at packaging time.
+let nativeAddon: NativeAddon | undefined;
+
+function getNativeAddon(): NativeAddon {
+    if (!nativeAddon) {
+        nativeAddon = require(path.join(__dirname, "..", "native")) as NativeAddon;
+    }
+    return nativeAddon;
+}
+
+export function downloadGgufFileNative(
+    modelId: string,
+    filename: string,
+    destPath: string,
+    token: string | undefined | null,
+    onProgress: (err: Error | null, progress: NativeDownloadProgress) => void
+): Promise<void> {
+    return getNativeAddon().downloadGgufFile(modelId, filename, destPath, token, onProgress);
+}
+
+// One instance for the app's lifetime — its global concurrency semaphore
+// and bandwidth limiter are only meaningfully "global" if nothing else
+// constructs a second one. Purely additive to `downloadGgufFileNative`
+// above, which stays exactly as-is for the existing single-file `hf:
+// downloadFile` flow.
+let downloadManager: NativeDownloadManager | undefined;
+
+export function getDownloadManager(): NativeDownloadManager {
+    if (!downloadManager) {
+        const { DownloadManager } = getNativeAddon();
+        downloadManager = new DownloadManager();
+    }
+    return downloadManager;
+}