download-cache

Each download computes SHA-1 while streaming and compares it to the expected hash; a mismatch deletes the file and retries, and a third mismatch returns Error::HashMismatch. When no hash is known, the size is checked instead.

The cache key is the file's SHA-1, so if either source serves the same jar, the second download links the existing object in cache/objects. CurseForge files without SHA-1 are hashed after download and stored under their computed hash.

IconCache only allows HTTPS URLs on cdn.modrinth.com, media.forgecdn.net, and edge.forgecdn.net, refusing others with Error::DisallowedHost. The check runs before the request and again on every redirect hop to prevent allowlist bypass.

The client retries connect errors, 5xx responses, and 429 rate limits up to 3 attempts with 500 ms, 2 s, and 8 s backoff, honoring Retry-After and Modrinth rate-limit headers. It never retries 404 or 403 responses.

MediaCache::prune sorts cache files by modification time and deletes the oldest until the directory is under its cap: 64 MiB for icons and 256 MiB for images. Launcher::open runs one background sweep per start, and gcl config prune-cache triggers it manually.

Stream files instead of holding them in memory, never download inside spawn_blocking (only hash or unzip there), and do not retry 404 or 403. Stage writes in unique .part files and rename on success so concurrent downloads never collide.