betterfiles.patch

diff --git a/config/config.go b/config/config.go
index 230062f5..3e482e9f 100644
--- a/config/config.go
+++ b/config/config.go
@@ -138,6 +138,11 @@ type SystemConfiguration struct {
 	// Directory where local backups will be stored on the machine.
 	BackupDirectory string `default:"/var/lib/pterodactyl/backups" json:"-" yaml:"backup_directory"`
 
+	// FileHistory controls bounded per-file revision storage for panel file edits.
+	FileHistory FileHistoryConfiguration `json:"-" yaml:"file_history"`
+	// FileCollaboration controls native Yjs collaborative editing limits.
+	FileCollaboration FileCollaborationConfiguration `json:"-" yaml:"file_collaboration"`
+
 	// TmpDirectory specifies where temporary files for Pterodactyl installation processes
 	// should be created. This supports environments running docker-in-docker.
 	TmpDirectory string `default:"/tmp/pterodactyl" json:"-" yaml:"tmp_directory"`
@@ -255,6 +260,21 @@ type SystemConfiguration struct {
 	OpenatMode string `default:"auto" yaml:"openat_mode"`
 }
 
+type FileHistoryConfiguration struct {
+	Enabled             bool   `default:"true" yaml:"enabled"`
+	ZstdLevel           int    `default:"12" yaml:"zstd_level"`
+	AnchorInterval      uint64 `default:"4" yaml:"anchor_interval"`
+	KeepChains          uint64 `default:"2" yaml:"keep_chains"`
+	FileSizeCap         uint64 `default:"1048576" yaml:"file_size_cap"`
+	PerFileDiskBudget   uint64 `default:"5242880" yaml:"per_file_disk_budget"`
+	PerServerDiskBudget uint64 `default:"209715200" yaml:"per_server_disk_budget"`
+}
+
+type FileCollaborationConfiguration struct {
+	Enabled     bool   `default:"true" yaml:"enabled"`
+	FileSizeCap uint64 `default:"10485760" yaml:"file_size_cap"`
+}
+
 type CrashDetection struct {
 	// CrashDetectionEnabled sets if crash detection is enabled globally for all servers on this node.
 	CrashDetectionEnabled bool `default:"true" yaml:"enabled"`
diff --git a/environment/docker/client_accessor.go b/environment/docker/client_accessor.go
new file mode 100644
index 00000000..f8eea154
--- /dev/null
+++ b/environment/docker/client_accessor.go
@@ -0,0 +1,7 @@
+package docker
+
+import "github.com/docker/docker/client"
+
+func (e *Environment) Client() *client.Client {
+	return e.client
+}
diff --git a/go.mod b/go.mod
index 6ed6d60f..44c218d8 100644
--- a/go.mod
+++ b/go.mod
@@ -1,8 +1,6 @@
 module github.com/pterodactyl/wings
 
-go 1.24.0
-
-toolchain go1.24.1
+go 1.26.7
 
 require (
 	emperror.dev/errors v0.8.1
@@ -13,11 +11,14 @@ require (
 	github.com/apex/log v1.9.0
 	github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2
 	github.com/beevik/etree v1.5.0
+	github.com/bmatcuk/doublestar/v4 v4.9.1
 	github.com/buger/jsonparser v1.1.1
 	github.com/cenkalti/backoff/v4 v4.3.0
 	github.com/creasty/defaults v1.8.0
+	github.com/distribution/reference v0.6.0
 	github.com/docker/docker v28.3.3+incompatible
 	github.com/docker/go-connections v0.5.0
+	github.com/dsnet/compress v0.0.2-0.20230904184137-39efe44ab707
 	github.com/fatih/color v1.18.0
 	github.com/franela/goblin v0.0.0-20211003143422-0a4f594942bf
 	github.com/gabriel-vasile/mimetype v1.4.8
@@ -39,12 +40,16 @@ require (
 	github.com/mitchellh/colorstring v0.0.0-20190213212951-d06e56a500db
 	github.com/patrickmn/go-cache v2.1.0+incompatible
 	github.com/pkg/sftp v1.13.10
+	github.com/reearth/ygo v1.31.0
 	github.com/sabhiram/go-gitignore v0.0.0-20210923224102-525f6e181f06
+	github.com/shiv248/operational-transformation-go v1.0.0
 	github.com/spf13/cobra v1.9.1
 	github.com/stretchr/testify v1.10.0
+	github.com/ulikunitz/xz v0.5.15
 	golang.org/x/crypto v0.46.0
-	golang.org/x/sync v0.19.0
+	golang.org/x/sync v0.21.0
 	golang.org/x/sys v0.39.0
+	golang.org/x/time v0.10.0
 	gopkg.in/ini.v1 v1.67.0
 	gopkg.in/yaml.v2 v2.4.0
 	gopkg.in/yaml.v3 v3.0.1
@@ -66,9 +71,7 @@ require (
 	github.com/containerd/errdefs/pkg v0.3.0 // indirect
 	github.com/containerd/log v0.1.0 // indirect
 	github.com/davecgh/go-spew v1.1.1 // indirect
-	github.com/distribution/reference v0.6.0 // indirect
 	github.com/docker/go-units v0.5.0 // indirect
-	github.com/dsnet/compress v0.0.2-0.20230904184137-39efe44ab707 // indirect
 	github.com/dustin/go-humanize v1.0.1 // indirect
 	github.com/felixge/httpsnoop v1.0.4 // indirect
 	github.com/gammazero/deque v1.0.0 // indirect
@@ -117,7 +120,6 @@ require (
 	github.com/spf13/pflag v1.0.6 // indirect
 	github.com/twitchyliquid64/golang-asm v0.15.1 // indirect
 	github.com/ugorji/go/codec v1.2.12 // indirect
-	github.com/ulikunitz/xz v0.5.15 // indirect
 	go.opentelemetry.io/auto/sdk v1.1.0 // indirect
 	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.60.0 // indirect
 	go.opentelemetry.io/otel v1.35.0 // indirect
@@ -131,8 +133,7 @@ require (
 	golang.org/x/exp v0.0.0-20250305212735-054e65f0b394 // indirect
 	golang.org/x/net v0.47.0 // indirect
 	golang.org/x/term v0.38.0 // indirect
-	golang.org/x/text v0.32.0 // indirect
-	golang.org/x/time v0.0.0-20220922220347-f3bd1da661af // indirect
+	golang.org/x/text v0.39.0 // indirect
 	golang.org/x/xerrors v0.0.0-20240903120638-7835f813f4da // indirect
 	google.golang.org/protobuf v1.36.5 // indirect
 	gotest.tools/v3 v3.0.2 // indirect
diff --git a/go.sum b/go.sum
index 9e2465a9..f38a2fb2 100644
--- a/go.sum
+++ b/go.sum
@@ -51,6 +51,8 @@ github.com/aws/aws-sdk-go v1.20.6/go.mod h1:KmX6BPdI08NWTb3/sm4ZGu5ShLoqVDhKgpiN
 github.com/aybabtme/rgbterm v0.0.0-20170906152045-cc83f3b3ce59/go.mod h1:q/89r3U2H7sSsE2t6Kca0lfwTK8JdoNGS/yzM/4iH5I=
 github.com/beevik/etree v1.5.0 h1:iaQZFSDS+3kYZiGoc9uKeOkUY3nYMXOKLl6KIJxiJWs=
 github.com/beevik/etree v1.5.0/go.mod h1:gPNJNaBGVZ9AwsidazFZyygnd+0pAU38N4D+WemwKNs=
+github.com/bmatcuk/doublestar/v4 v4.9.1 h1:X8jg9rRZmJd4yRy7ZeNDRnM+T3ZfHv15JiBJ/avrEXE=
+github.com/bmatcuk/doublestar/v4 v4.9.1/go.mod h1:xBQ8jztBU6kakFMg+8WGxn0c6z1fTSPVIjEY1Wr7jzc=
 github.com/bodgit/plumbing v1.3.0 h1:pf9Itz1JOQgn7vEOE7v7nlEfBykYqvUYioC61TwWCFU=
 github.com/bodgit/plumbing v1.3.0/go.mod h1:JOTb4XiRu5xfnmdnDJo6GmSbSbtSyufrsyZFByMtKEs=
 github.com/bodgit/sevenzip v1.6.1 h1:kikg2pUMYC9ljU7W9SaqHXhym5HyKm8/M/jd31fYan4=
@@ -309,6 +311,8 @@ github.com/pkg/sftp v1.13.10/go.mod h1:bJ1a7uDhrX/4OII+agvy28lzRvQrmIQuaHrcI1Hbe
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/prometheus/client_model v0.0.0-20190812154241-14fe0d1b01d4/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
+github.com/reearth/ygo v1.31.0 h1:JkPDRZq69nFFIKV1FYZJ9/u86xYg65Bn4r4/YVqZZIU=
+github.com/reearth/ygo v1.31.0/go.mod h1:QN5MsM+QBk9cP6Sr/iaKlkJtnJ9Fo0fT+MJqSw2xPUA=
 github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec h1:W09IVJc94icq4NjY3clb7Lk8O1qJ8BdBEF8z0ibU0rE=
 github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec/go.mod h1:qqbHyh8v60DhA7CoWK5oRCqLrMHRGoxYCSS9EjAz6Eo=
 github.com/robfig/cron/v3 v3.0.1 h1:WdRxkvbJztn8LMz/QEvLN5sBU+xKpSqwwUO1Pjr4qDs=
@@ -324,6 +328,8 @@ github.com/rwcarlsen/goexif v0.0.0-20190401172101-9e8deecbddbd/go.mod h1:hPqNNc0
 github.com/sabhiram/go-gitignore v0.0.0-20210923224102-525f6e181f06 h1:OkMGxebDjyw0ULyrTYWeN0UNCCkmCWfjPnIA2W6oviI=
 github.com/sabhiram/go-gitignore v0.0.0-20210923224102-525f6e181f06/go.mod h1:+ePHsJ1keEjQtpvf9HHw0f4ZeJ0TLRsxhunSI2hYJSs=
 github.com/sergi/go-diff v1.0.0/go.mod h1:0CfEIISq7TuYL3j771MWULgwwjU+GofnZX9QAmXWZgo=
+github.com/shiv248/operational-transformation-go v1.0.0 h1:ahbdsqDStbvaOYX8Jhqx7zqpSuL00SoSrI9NC5EdeiE=
+github.com/shiv248/operational-transformation-go v1.0.0/go.mod h1:m9K4grcjjhDlIcXZlqnHVnfaysxUKOhuJ4qZiUPE1ME=
 github.com/sirupsen/logrus v1.9.3 h1:dueUQJ1C2q9oE3F7wvmSGAaVtTmUizReu6fjN8uqzbQ=
 github.com/sirupsen/logrus v1.9.3/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
 github.com/smartystreets/assertions v1.0.0/go.mod h1:kHHU4qYBaI3q23Pp3VPrmWhuIUrLW/7eUrw0BU5VaoM=
@@ -449,8 +455,8 @@ golang.org/x/mod v0.1.1-0.20191105210325-c90efee705ee/go.mod h1:QqPTAvyqsEbceGzB
 golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
-golang.org/x/mod v0.30.0 h1:fDEXFVZ/fmCKProc/yAXXUijritrDzahmwwefnjoPFk=
-golang.org/x/mod v0.30.0/go.mod h1:lAsf5O2EvJeSFMiBxXDki7sCgAxEUcZHXoXMKT4GJKc=
+golang.org/x/mod v0.37.0 h1:vF1DjpVEshcIqoEaauuHebaLk1O1forxjxBaVn884JQ=
+golang.org/x/mod v0.37.0/go.mod h1:m8S8VeM9r4dzDwjrKO0a1sZP3YjeMamRRlD+fmR2Q/0=
 golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180906233101-161cd47e91fd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
@@ -485,8 +491,8 @@ golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJ
 golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.19.0 h1:vV+1eWNmZ5geRlYjzm2adRgW2/mcpevXNg50YZtPCE4=
-golang.org/x/sync v0.19.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI=
+golang.org/x/sync v0.21.0 h1:HLII4xRRTtCRkxYp4HNFF0Js/Og6q2i++KXbg0gHCwM=
+golang.org/x/sync v0.21.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
 golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20180909124046-d0be0721c37e/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
@@ -525,12 +531,12 @@ golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
 golang.org/x/text v0.4.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
 golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
-golang.org/x/text v0.32.0 h1:ZD01bjUt1FQ9WJ0ClOL5vxgxOI/sVCNgX1YtKwcY0mU=
-golang.org/x/text v0.32.0/go.mod h1:o/rUWzghvpD5TXrTIBuJU77MTaN0ljMWE47kxGJQ7jY=
+golang.org/x/text v0.39.0 h1:UbZz4pLOvn600D6Oh6GGEI6VAmndrEBLv8/6BEXzyus=
+golang.org/x/text v0.39.0/go.mod h1:3UwRclnC2g0TU9x8PZiyfOajCd1zaUNHF9cvqcQZ+ZM=
 golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
-golang.org/x/time v0.0.0-20220922220347-f3bd1da661af h1:Yx9k8YCG3dvF87UAn2tu2HQLf2dt/eR1bXxpLMWeH+Y=
-golang.org/x/time v0.0.0-20220922220347-f3bd1da661af/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
+golang.org/x/time v0.10.0 h1:3usCWA8tQn0L8+hFJQNgzpWbd89begxN66o1Ojdn5L4=
+golang.org/x/time v0.10.0/go.mod h1:3BpzKBy/shNhVucY/MWOyx10tF3SFh9QdLuxbVysPQM=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20190114222345-bf090417da8b/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20190226205152-f727befe758c/go.mod h1:9Yl7xja0Znq3iFh3HoIrodX9oNMXvdceNzlUR8zjMvY=
@@ -560,8 +566,8 @@ golang.org/x/tools v0.0.0-20200212150539-ea181f53ac56/go.mod h1:TB2adYChydJhpapK
 golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
 golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
 golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
-golang.org/x/tools v0.39.0 h1:ik4ho21kwuQln40uelmciQPp9SipgNDdrafrYA4TmQQ=
-golang.org/x/tools v0.39.0/go.mod h1:JnefbkDPyD8UU2kI5fuf8ZX4/yUeh9W877ZeBONxUqQ=
+golang.org/x/tools v0.47.0 h1:7Kn5x/d1svx/PzryTsqeoZN4TZwqeH5pGWjefhLi/1Q=
+golang.org/x/tools v0.47.0/go.mod h1:dFHnyTvFWY212G+h7ZY4Vsp/K3U4/7W9TyVaAul8uCA=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
diff --git a/router/betterfiles_entry.go b/router/betterfiles_entry.go
new file mode 100644
index 00000000..74ccb8f6
--- /dev/null
+++ b/router/betterfiles_entry.go
@@ -0,0 +1,70 @@
+package router
+
+import (
+	"time"
+
+	"github.com/gabriel-vasile/mimetype"
+	"golang.org/x/sys/unix"
+
+	"github.com/pterodactyl/wings/internal/ufs"
+	serverfs "github.com/pterodactyl/wings/server/filesystem"
+)
+
+type betterFilesEntry struct {
+	Name         string `json:"name"`
+	Size         int64  `json:"size"`
+	SizePhysical int64  `json:"size_physical"`
+	Directory    bool   `json:"directory"`
+	File         bool   `json:"file"`
+	Symlink      bool   `json:"symlink"`
+	Mime         string `json:"mime"`
+	Created      string `json:"created"`
+	Modified     string `json:"modified"`
+}
+
+func newBetterFilesEntry(name string, info ufs.FileInfo, mime string) betterFilesEntry {
+	if mime == "" {
+		if info.IsDir() {
+			mime = "inode/directory"
+		} else {
+			mime = "application/octet-stream"
+		}
+	}
+	return betterFilesEntry{
+		Name:         name,
+		Size:         info.Size(),
+		SizePhysical: betterFilesPhysicalSize(info),
+		Directory:    info.IsDir(),
+		File:         info.Mode().IsRegular(),
+		Symlink:      info.Mode()&ufs.ModeSymlink != 0,
+		Mime:         mime,
+		Created:      betterFilesCreatedTime(info).UTC().Format(time.RFC3339),
+		Modified:     info.ModTime().UTC().Format(time.RFC3339),
+	}
+}
+
+func betterFilesCreatedTime(info ufs.FileInfo) time.Time {
+	if stat, ok := info.Sys().(*unix.Stat_t); ok {
+		return time.Unix(stat.Ctim.Sec, stat.Ctim.Nsec)
+	}
+	return info.ModTime()
+}
+
+func betterFilesMime(fs *serverfs.Filesystem, value string, info ufs.FileInfo) string {
+	if info.IsDir() {
+		return "inode/directory"
+	}
+	if !info.Mode().IsRegular() {
+		return "application/octet-stream"
+	}
+	file, err := fs.UnixFS().OpenFile(value, ufs.O_RDONLY|ufs.O_NOFOLLOW, 0)
+	if err != nil {
+		return "application/octet-stream"
+	}
+	defer file.Close()
+	detected, err := mimetype.DetectReader(file)
+	if err != nil || detected == nil {
+		return "application/octet-stream"
+	}
+	return detected.String()
+}
diff --git a/router/betterfiles_http_test.go b/router/betterfiles_http_test.go
new file mode 100644
index 00000000..c1797680
--- /dev/null
+++ b/router/betterfiles_http_test.go
@@ -0,0 +1,127 @@
+package router
+
+import (
+	"encoding/json"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+	"os"
+	"path/filepath"
+	"strconv"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/gbrlsnchs/jwt/v3"
+	"github.com/google/uuid"
+	"github.com/stretchr/testify/require"
+
+	"github.com/pterodactyl/wings/config"
+	"github.com/pterodactyl/wings/remote"
+	"github.com/pterodactyl/wings/router/tokens"
+	"github.com/pterodactyl/wings/server"
+)
+
+func newBetterFilesHTTPServer(t *testing.T, uploadLimitMB, diskMB int64, ignored ...string) (*server.Manager, *server.Server, http.Handler) {
+	t.Helper()
+	root := t.TempDir()
+	next, err := config.NewAtPath(filepath.Join(root, "config.yml"))
+	require.NoError(t, err)
+	next.AuthenticationToken = "better-files-http-test-token"
+	next.Api.UploadLimit = uploadLimitMB
+	next.System.Data = filepath.Join(root, "volumes")
+	next.System.RootDirectory = root
+	// These fixtures measure per-write quota accounting from an empty root.
+	// Disable the manager's asynchronous startup scan so it cannot race writes.
+	next.System.DiskCheckInterval = 0
+	next.System.User.Uid = os.Getuid()
+	next.System.User.Gid = os.Getgid()
+	next.System.FileHistory.Enabled = false
+	config.Set(next)
+
+	serverUUID := uuid.NewString()
+	settings, err := json.Marshal(map[string]interface{}{
+		"uuid":      serverUUID,
+		"build":     map[string]interface{}{"disk_space": diskMB},
+		"container": map[string]interface{}{"image": "alpine:3.20"},
+		"egg":       map[string]interface{}{"file_denylist": ignored},
+	})
+	require.NoError(t, err)
+	manager := server.NewEmptyManager(nil)
+	s, err := manager.InitServer(remote.ServerConfigurationResponse{Settings: settings})
+	require.NoError(t, err)
+	manager.Add(s)
+	t.Cleanup(s.CtxCancel)
+	return manager, s, Configure(manager, nil)
+}
+
+func signBetterFilesUploadToken(t *testing.T, serverUUID string) string {
+	t.Helper()
+	now := time.Now().Add(time.Second)
+	payload := tokens.UploadPayload{
+		Payload: jwt.Payload{
+			IssuedAt:       jwt.NumericDate(now),
+			ExpirationTime: jwt.NumericDate(now.Add(time.Hour)),
+		},
+		Scoped:     tokens.Scoped{Scope: string(tokens.FileUpload)},
+		ServerUuid: serverUUID,
+		UserUuid:   uuid.NewString(),
+		UniqueId:   uuid.NewString(),
+	}
+	signed, err := jwt.Sign(payload, config.GetJwtAlgorithm())
+	require.NoError(t, err)
+	return string(signed)
+}
+
+func signBetterFilesDownloadToken(t *testing.T, serverUUID, filePath string) string {
+	t.Helper()
+	now := time.Now().Add(time.Second)
+	payload := tokens.FilePayload{
+		Payload: jwt.Payload{
+			IssuedAt:       jwt.NumericDate(now),
+			ExpirationTime: jwt.NumericDate(now.Add(time.Hour)),
+		},
+		Scoped:     tokens.Scoped{Scope: string(tokens.FileDownload)},
+		FilePath:   filePath,
+		ServerUuid: serverUUID,
+		UserUuid:   uuid.NewString(),
+		UniqueId:   uuid.NewString(),
+	}
+	signed, err := jwt.Sign(payload, config.GetJwtAlgorithm())
+	require.NoError(t, err)
+	return string(signed)
+}
+
+func performResumableRequest(handler http.Handler, method, token, directory, filename string, offset int64, length *int64, complete bool, body io.Reader) *httptest.ResponseRecorder {
+	query := url.Values{"token": {token}, "directory": {directory}, "file": {filename}}
+	request := httptest.NewRequest(method, "/upload/file?"+query.Encode(), body)
+	if method == http.MethodPatch {
+		request.Header.Set("Content-Type", "application/offset+octet-stream")
+		request.Header.Set("Upload-Offset", strconv.FormatInt(offset, 10))
+		if length != nil {
+			request.Header.Set("Upload-Length", strconv.FormatInt(*length, 10))
+		}
+		if complete {
+			request.Header.Set("Upload-Complete", "?1")
+		}
+	}
+	recorder := httptest.NewRecorder()
+	handler.ServeHTTP(&deadlineResponseRecorder{ResponseRecorder: recorder}, request)
+	return recorder
+}
+
+type deadlineResponseRecorder struct {
+	*httptest.ResponseRecorder
+}
+
+func (*deadlineResponseRecorder) SetReadDeadline(time.Time) error {
+	return nil
+}
+
+func readServerHTTPFixture(t *testing.T, s *server.Server, name string) []byte {
+	t.Helper()
+	data, err := os.ReadFile(filepath.Join(s.Filesystem().Path(), filepath.FromSlash(strings.TrimPrefix(name, "/"))))
+	require.NoError(t, err)
+	return data
+}
diff --git a/router/betterfiles_paths.go b/router/betterfiles_paths.go
new file mode 100644
index 00000000..81085fef
--- /dev/null
+++ b/router/betterfiles_paths.go
@@ -0,0 +1,170 @@
+package router
+
+import (
+	"errors"
+	"net/http"
+	pathpkg "path"
+	"strings"
+	"unicode/utf8"
+
+	"github.com/gin-gonic/gin"
+	"golang.org/x/sys/unix"
+
+	"github.com/pterodactyl/wings/internal/ufs"
+	serverfs "github.com/pterodactyl/wings/server/filesystem"
+)
+
+const (
+	betterFilesMaxPathLength = 4096
+	betterFilesMaxNameLength = 255
+)
+
+var errBetterFilesInvalidPath = errors.New("invalid file path")
+
+// normalizeBetterFilesRoot converts a user supplied server path to one canonical,
+// slash-prefixed path. Parent components are rejected before cleaning so that a
+// traversal attempt can never be silently reinterpreted as a different path.
+func normalizeBetterFilesRoot(value string) (string, error) {
+	if value == "" {
+		return "/", nil
+	}
+	if !validBetterFilesPathText(value) {
+		return "", errBetterFilesInvalidPath
+	}
+	if strings.Contains(value, "\\") || hasParentPathComponent(value) {
+		return "", errBetterFilesInvalidPath
+	}
+
+	cleaned := pathpkg.Clean("/" + strings.TrimLeft(value, "/"))
+	if cleaned == "." {
+		cleaned = "/"
+	}
+	if !strings.HasPrefix(cleaned, "/") || len(cleaned) > betterFilesMaxPathLength {
+		return "", errBetterFilesInvalidPath
+	}
+	if !validBetterFilesComponents(cleaned) {
+		return "", errBetterFilesInvalidPath
+	}
+	return cleaned, nil
+}
+
+// joinBetterFilesPath resolves a relative request path below root. Absolute
+// values and values resolving to root itself are deliberately rejected.
+func joinBetterFilesPath(root, value string) (string, error) {
+	if value == "" || pathpkg.IsAbs(value) || !validBetterFilesPathText(value) {
+		return "", errBetterFilesInvalidPath
+	}
+	if strings.Contains(value, "\\") || hasParentPathComponent(value) {
+		return "", errBetterFilesInvalidPath
+	}
+
+	relative := pathpkg.Clean(value)
+	if relative == "." || relative == "/" || strings.HasPrefix(relative, "../") {
+		return "", errBetterFilesInvalidPath
+	}
+	if !validBetterFilesComponents(relative) {
+		return "", errBetterFilesInvalidPath
+	}
+
+	joined := pathpkg.Join(root, relative)
+	if joined == root || joined == "/" || len(joined) > betterFilesMaxPathLength {
+		return "", errBetterFilesInvalidPath
+	}
+	if root != "/" && !strings.HasPrefix(joined, root+"/") {
+		return "", errBetterFilesInvalidPath
+	}
+	return joined, nil
+}
+
+func normalizeBetterFilesUploadPath(directory, filename string) (string, string, error) {
+	root, err := normalizeBetterFilesRoot(directory)
+	if err != nil {
+		return "", "", err
+	}
+	if filename == "" || filename == "." || filename == ".." || !validBetterFilesPathText(filename) {
+		return "", "", errBetterFilesInvalidPath
+	}
+	if strings.ContainsAny(filename, `/\\`) || len(filename) > betterFilesMaxNameLength {
+		return "", "", errBetterFilesInvalidPath
+	}
+	target, err := joinBetterFilesPath(root, filename)
+	if err != nil {
+		return "", "", err
+	}
+	return root, target, nil
+}
+
+func validBetterFilesPathText(value string) bool {
+	return value != "" && len(value) <= betterFilesMaxPathLength && utf8.ValidString(value) && !strings.ContainsRune(value, '\x00')
+}
+
+func validBetterFilesComponents(value string) bool {
+	for _, component := range strings.Split(strings.Trim(value, "/"), "/") {
+		if component == "" {
+			continue
+		}
+		if component == "." || component == ".." || len(component) > betterFilesMaxNameLength {
+			return false
+		}
+	}
+	return true
+}
+
+func hasParentPathComponent(value string) bool {
+	for _, component := range strings.Split(value, "/") {
+		if component == ".." {
+			return true
+		}
+	}
+	return false
+}
+
+// ensureBetterFilesAllowed checks both canonical and relative spellings of a
+// path, including its ancestors. This keeps gitignore-style directory rules
+// effective without changing the behavior of Filesystem.IsIgnored globally.
+func ensureBetterFilesAllowed(fs *serverfs.Filesystem, paths ...string) error {
+	for _, value := range paths {
+		cleaned, err := normalizeBetterFilesRoot(value)
+		if err != nil {
+			return err
+		}
+		if cleaned == "/" {
+			continue
+		}
+
+		parts := strings.Split(strings.TrimPrefix(cleaned, "/"), "/")
+		for i := 1; i <= len(parts); i++ {
+			relative := strings.Join(parts[:i], "/")
+			if err := fs.IsIgnored(relative, "/"+relative); err != nil {
+				return err
+			}
+		}
+	}
+	return nil
+}
+
+func betterFilesLstat(fs *serverfs.Filesystem, value string) (ufs.FileInfo, error) {
+	info, err := fs.UnixFS().Lstat(value)
+	if err != nil {
+		return nil, err
+	}
+	if info.Mode()&ufs.ModeSymlink != 0 {
+		return nil, errBetterFilesInvalidPath
+	}
+	return info, nil
+}
+
+func betterFilesPhysicalSize(info ufs.FileInfo) int64 {
+	if stat, ok := info.Sys().(*unix.Stat_t); ok {
+		return stat.Blocks * 512
+	}
+	return info.Size()
+}
+
+func abortBetterFilesPath(c *gin.Context, err error) {
+	status := http.StatusUnprocessableEntity
+	if errors.Is(err, ufs.ErrNotExist) {
+		status = http.StatusNotFound
+	}
+	c.AbortWithStatusJSON(status, gin.H{"error": "The requested file path is invalid or unavailable."})
+}
diff --git a/router/betterfiles_paths_test.go b/router/betterfiles_paths_test.go
new file mode 100644
index 00000000..5742f97a
--- /dev/null
+++ b/router/betterfiles_paths_test.go
@@ -0,0 +1,32 @@
+package router
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+
+	serverfs "github.com/pterodactyl/wings/server/filesystem"
+)
+
+func TestNormalizeBetterFilesPaths(t *testing.T) {
+	root, err := normalizeBetterFilesRoot("/plugins/./config")
+	require.NoError(t, err)
+	require.Equal(t, "/plugins/config", root)
+
+	joined, err := joinBetterFilesPath(root, "emoji-😀/paper.yml")
+	require.NoError(t, err)
+	require.Equal(t, "/plugins/config/emoji-😀/paper.yml", joined)
+
+	for _, invalid := range []string{"../escape", "folder/../escape", "/absolute", "nul\x00file", `windows\path`} {
+		_, err := joinBetterFilesPath(root, invalid)
+		require.Error(t, err, invalid)
+	}
+}
+
+func TestEnsureBetterFilesAllowedChecksAncestors(t *testing.T) {
+	fs, err := serverfs.New(t.TempDir(), 0, []string{"private/**", "*.secret"})
+	require.NoError(t, err)
+	require.Error(t, ensureBetterFilesAllowed(fs, "/private/nested/file.txt"))
+	require.Error(t, ensureBetterFilesAllowed(fs, "/config/password.secret"))
+	require.NoError(t, ensureBetterFilesAllowed(fs, "/config/paper.yml"))
+}
diff --git a/router/betterfiles_test_helpers_test.go b/router/betterfiles_test_helpers_test.go
new file mode 100644
index 00000000..25a8e740
--- /dev/null
+++ b/router/betterfiles_test_helpers_test.go
@@ -0,0 +1,41 @@
+package router
+
+import (
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/pterodactyl/wings/config"
+	serverfs "github.com/pterodactyl/wings/server/filesystem"
+)
+
+func newBetterFilesTestFilesystem(t *testing.T, disk int64, ignored ...string) *serverfs.Filesystem {
+	t.Helper()
+	configuration, err := config.NewAtPath(filepath.Join(t.TempDir(), "config.yml"))
+	require.NoError(t, err)
+	configuration.AuthenticationToken = "better-files-filesystem-test-token"
+	configuration.System.User.Uid = os.Getuid()
+	configuration.System.User.Gid = os.Getgid()
+	config.Set(configuration)
+	fs, err := serverfs.New(t.TempDir(), disk, ignored)
+	require.NoError(t, err)
+	return fs
+}
+
+func writeBetterFilesFixture(t *testing.T, fs *serverfs.Filesystem, name string, data []byte) {
+	t.Helper()
+	hostPath := filepath.Join(fs.Path(), filepath.FromSlash(strings.TrimPrefix(name, "/")))
+	require.NoError(t, os.MkdirAll(filepath.Dir(hostPath), 0o755))
+	require.NoError(t, os.WriteFile(hostPath, data, 0o644))
+}
+
+func readBetterFilesFixture(t *testing.T, fs *serverfs.Filesystem, name string) []byte {
+	t.Helper()
+	hostPath := filepath.Join(fs.Path(), filepath.FromSlash(strings.TrimPrefix(name, "/")))
+	data, err := os.ReadFile(hostPath)
+	require.NoError(t, err)
+	return data
+}
diff --git a/router/middleware/middleware.go b/router/middleware/middleware.go
index 19087114..a236b62c 100644
--- a/router/middleware/middleware.go
+++ b/router/middleware/middleware.go
@@ -99,13 +99,26 @@ func SetAccessControlHeaders() gin.HandlerFunc {
 	return func(c *gin.Context) {
 		c.Header("Access-Control-Allow-Origin", location)
 		c.Header("Access-Control-Allow-Credentials", "true")
-		c.Header("Access-Control-Allow-Methods", "GET, POST, PATCH, PUT, DELETE, OPTIONS")
-		c.Header("Access-Control-Allow-Headers", "Accept, Accept-Encoding, Authorization, Cache-Control, Content-Type, Content-Length, Origin, X-Real-IP, X-CSRF-Token")
+		c.Header("Access-Control-Allow-Methods", "GET, HEAD, POST, PATCH, PUT, DELETE, OPTIONS")
+		c.Header("Access-Control-Allow-Headers", "Accept, Accept-Encoding, Authorization, Cache-Control, Content-Type, Content-Length, Origin, Upload-Complete, Upload-Length, Upload-Offset, X-Real-IP, X-CSRF-Token")
+
+		if isStreamDownloadRequest(c) {
+			c.Header("Access-Control-Allow-Headers", "Accept, Accept-Encoding, Authorization, Cache-Control, Content-Type, Content-Length, If-Match, If-Modified-Since, If-None-Match, If-Range, If-Unmodified-Since, Origin, Range, X-Real-IP, X-CSRF-Token")
+			c.Header("Access-Control-Expose-Headers", "Accept-Ranges, Content-Disposition, Content-Encoding, Content-Length, Content-Range, Content-Type, ETag, Last-Modified, X-Content-Type-Options, X-Request-Id")
+			c.Header("Vary", "Origin, Access-Control-Request-Headers")
+		}
+		if c.Request != nil && c.Request.URL != nil && c.Request.URL.Path == "/upload/file" {
+			c.Header("Access-Control-Expose-Headers", "Retry-After, Upload-Offset, X-Request-Id")
+		}
 
 		// CORS for Private Networks (RFC1918)
 		// @see https://developer.chrome.com/blog/private-network-access-update/?utm_source=devtools
 		if allowPrivateNetwork {
-			c.Header("Access-Control-Request-Private-Network", "true")
+			if isStreamDownloadRequest(c) {
+				c.Header("Access-Control-Allow-Private-Network", "true")
+			} else {
+				c.Header("Access-Control-Request-Private-Network", "true")
+			}
 		}
 
 		// Maximum age allowable under Chromium v76 is 2 hours, so just use that since
@@ -136,6 +149,13 @@ func SetAccessControlHeaders() gin.HandlerFunc {
 	}
 }
 
+func isStreamDownloadRequest(c *gin.Context) bool {
+	if c.Request == nil || c.Request.URL == nil {
+		return false
+	}
+	return c.Request.URL.Path == "/download/stream" || c.Request.URL.Path == "/download/directory"
+}
+
 // ServerExists will ensure that the requested server exists in this setup.
 // Returns a 404 if we cannot locate it. If the server is found it is set into
 // the request context, and the logger for the context is also updated to include
diff --git a/router/middleware/middleware_test.go b/router/middleware/middleware_test.go
new file mode 100644
index 00000000..320dbfa2
--- /dev/null
+++ b/router/middleware/middleware_test.go
@@ -0,0 +1,115 @@
+package middleware
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+
+	"github.com/gin-gonic/gin"
+
+	"github.com/pterodactyl/wings/config"
+)
+
+func TestSetAccessControlHeadersAllowsRangeStreaming(t *testing.T) {
+	config.Set(&config.Configuration{
+		PanelLocation:           "https://panel.example.com",
+		AllowedOrigins:          []string{"https://cdn.example.com"},
+		AllowCORSPrivateNetwork: true,
+		AuthenticationToken:     "token",
+		AuthenticationTokenId:   "token-id",
+	})
+
+	gin.SetMode(gin.TestMode)
+	router := gin.New()
+	router.Use(SetAccessControlHeaders())
+	router.GET("/download/stream", func(c *gin.Context) {
+		c.Status(http.StatusNoContent)
+	})
+	router.GET("/download/file", func(c *gin.Context) {
+		c.Status(http.StatusNoContent)
+	})
+	router.GET("/download/directory", func(c *gin.Context) {
+		c.Status(http.StatusNoContent)
+	})
+	router.PATCH("/upload/file", func(c *gin.Context) {
+		c.Status(http.StatusNoContent)
+	})
+
+	t.Run("stream route exposes range headers", func(t *testing.T) {
+		request := httptest.NewRequest(http.MethodOptions, "/download/stream", nil)
+		request.Header.Set("Origin", "https://cdn.example.com")
+		request.Header.Set("Access-Control-Request-Headers", "range")
+		recorder := httptest.NewRecorder()
+
+		router.ServeHTTP(recorder, request)
+
+		if recorder.Code != http.StatusNoContent {
+			t.Fatalf("expected status %d, got %d", http.StatusNoContent, recorder.Code)
+		}
+		if got := recorder.Header().Get("Access-Control-Allow-Origin"); got != "https://cdn.example.com" {
+			t.Fatalf("expected allowed origin to match request origin, got %q", got)
+		}
+		if got := recorder.Header().Get("Access-Control-Allow-Headers"); !strings.Contains(got, "Range") {
+			t.Fatalf("expected Range in allowed headers, got %q", got)
+		}
+		if got := recorder.Header().Get("Access-Control-Allow-Headers"); !strings.Contains(got, "If-Range") {
+			t.Fatalf("expected If-Range in allowed headers, got %q", got)
+		}
+		if got := recorder.Header().Get("Access-Control-Expose-Headers"); !strings.Contains(got, "Content-Range") {
+			t.Fatalf("expected Content-Range in exposed headers, got %q", got)
+		}
+		if got := recorder.Header().Get("Access-Control-Expose-Headers"); !strings.Contains(got, "Last-Modified") {
+			t.Fatalf("expected Last-Modified in exposed headers, got %q", got)
+		}
+		if got := recorder.Header().Get("Access-Control-Allow-Private-Network"); got != "true" {
+			t.Fatalf("expected private network CORS header, got %q", got)
+		}
+	})
+
+	t.Run("directory archive route exposes download headers", func(t *testing.T) {
+		request := httptest.NewRequest(http.MethodOptions, "/download/directory", nil)
+		recorder := httptest.NewRecorder()
+		router.ServeHTTP(recorder, request)
+		if got := recorder.Header().Get("Access-Control-Expose-Headers"); !strings.Contains(got, "Content-Disposition") {
+			t.Fatalf("expected Content-Disposition in exposed headers, got %q", got)
+		}
+	})
+
+	t.Run("resumable upload route allows and exposes response headers", func(t *testing.T) {
+		request := httptest.NewRequest(http.MethodOptions, "/upload/file", nil)
+		recorder := httptest.NewRecorder()
+		router.ServeHTTP(recorder, request)
+		if got := recorder.Header().Get("Access-Control-Allow-Headers"); !strings.Contains(got, "Upload-Offset") || !strings.Contains(got, "Upload-Length") {
+			t.Fatalf("expected resumable upload headers, got %q", got)
+		}
+		if got := recorder.Header().Get("Access-Control-Expose-Headers"); !strings.Contains(got, "Upload-Offset") || !strings.Contains(got, "Retry-After") {
+			t.Fatalf("expected Upload-Offset and Retry-After in exposed headers, got %q", got)
+		}
+		if got := recorder.Header().Get("Access-Control-Allow-Methods"); !strings.Contains(got, "HEAD") || !strings.Contains(got, "PATCH") {
+			t.Fatalf("expected resumable upload methods, got %q", got)
+		}
+	})
+
+	t.Run("download route keeps default headers", func(t *testing.T) {
+		request := httptest.NewRequest(http.MethodOptions, "/download/file", nil)
+		request.Header.Set("Origin", "https://cdn.example.com")
+		request.Header.Set("Access-Control-Request-Headers", "range")
+		recorder := httptest.NewRecorder()
+
+		router.ServeHTTP(recorder, request)
+
+		if recorder.Code != http.StatusNoContent {
+			t.Fatalf("expected status %d, got %d", http.StatusNoContent, recorder.Code)
+		}
+		if got := recorder.Header().Get("Access-Control-Allow-Headers"); strings.Contains(got, "Range") {
+			t.Fatalf("expected default headers without Range, got %q", got)
+		}
+		if got := recorder.Header().Get("Access-Control-Expose-Headers"); got != "" {
+			t.Fatalf("expected no exposed headers on normal download route, got %q", got)
+		}
+		if got := recorder.Header().Get("Access-Control-Allow-Private-Network"); got != "" {
+			t.Fatalf("expected no stream private network header, got %q", got)
+		}
+	})
+}
diff --git a/router/router.go b/router/router.go
index bdac7606..53f831cf 100644
--- a/router/router.go
+++ b/router/router.go
@@ -27,6 +27,7 @@ func Configure(m *wserver.Manager, client remote.Client) *gin.Engine {
 	}
 	router.Use(middleware.AttachRequestID(), middleware.CaptureErrors(), middleware.SetAccessControlHeaders())
 	router.Use(middleware.AttachServerManager(m), middleware.AttachApiClient(client))
+	router.GET("/openapi.json", getOpenAPI)
 	// @todo log this into a different file so you can setup IP blocking for abusive requests and such.
 	// This should still dump requests in debug mode since it does help with understanding the request
 	// lifecycle and quickly seeing what was called leading to the logs. However, it isn't feasible to mix
@@ -46,7 +47,11 @@ func Configure(m *wserver.Manager, client remote.Client) *gin.Engine {
 	// These routes use signed URLs to validate access to the resource being requested.
 	router.GET("/download/backup", getDownloadBackup)
 	router.GET("/download/file", getDownloadFile)
+	router.GET("/download/directory", getDownloadDirectory)
+	router.GET("/download/stream", getDownloadStream)
 	router.POST("/upload/file", postServerUploadFiles)
+	router.PATCH("/upload/file", patchServerUploadFile)
+	router.HEAD("/upload/file", headServerUploadFile)
 
 	// This route is special it sits above all the other requests because we are
 	// using a JWT to authorize access to it, therefore it needs to be publicly
@@ -63,6 +68,7 @@ func Configure(m *wserver.Manager, client remote.Client) *gin.Engine {
 	protected := router.Use(middleware.RequireAuthorization())
 	protected.POST("/api/update", postUpdateConfiguration)
 	protected.GET("/api/system", getSystemInformation)
+	protected.GET("/api/system/config", getSystemConfiguration)
 	protected.GET("/api/servers", getAllServers)
 	protected.POST("/api/servers", postCreateServer)
 	protected.DELETE("/api/transfers/:server", deleteTransfer)
@@ -79,6 +85,14 @@ func Configure(m *wserver.Manager, client remote.Client) *gin.Engine {
 		server.GET("/logs", getServerLogs)
 		server.POST("/power", postServerPower)
 		server.POST("/commands", postServerCommands)
+		git := server.Group("/git")
+		{
+			git.GET("/status", getServerGitStatus)
+			git.POST("/install", postServerGitInstall)
+			git.POST("/clone", postServerGitClone)
+			git.POST("/pull", postServerGitPull)
+			git.POST("/diff", postServerGitDiff)
+		}
 		server.POST("/install", postServerInstall)
 		server.POST("/reinstall", postServerReinstall)
 		server.POST("/sync", postServerSync)
@@ -92,15 +106,27 @@ func Configure(m *wserver.Manager, client remote.Client) *gin.Engine {
 		files := server.Group("/files")
 		{
 			files.GET("/contents", getServerFileContents)
+			files.GET("/revisions", getServerFileRevisions)
+			files.GET("/revisions/:revision", getServerFileRevision)
+			files.POST("/revisions/:revision/restore", postServerFileRevisionRestore)
+			files.GET("/search", getServerFilesSearch)
+			files.POST("/search", postServerFilesSearch)
+			files.GET("/archive/list", getServerArchiveList)
+			files.POST("/archive/extract", postServerArchiveExtract)
 			files.GET("/list-directory", getServerListDirectory)
-			files.PUT("/rename", putServerRenameFiles)
+			files.PUT("/rename", putServerRenameFilesSafe)
 			files.POST("/copy", postServerCopyFile)
+			files.DELETE("/operations/:operation", deleteServerFileOperation)
+			files.GET("/fingerprints", getServerFileFingerprints)
+			files.GET("/largest-directories", getServerLargestDirectories)
+			files.POST("/copy-many", postServerCopyMany)
 			files.POST("/write", postServerWriteFile)
 			files.POST("/create-directory", postServerCreateDirectory)
 			files.POST("/delete", postServerDeleteFiles)
 			files.POST("/compress", postServerCompressFiles)
 			files.POST("/decompress", postServerDecompressFiles)
 			files.POST("/chmod", postServerChmodFile)
+			files.POST("/collaboration/revoke", postServerBetterFilesCollaborationRevoke)
 
 			files.GET("/pull", middleware.RemoteDownloadEnabled(), getServerPullingFiles)
 			files.POST("/pull", middleware.RemoteDownloadEnabled(), postServerPullRemoteFile)
diff --git a/router/router_cdn_stream.go b/router/router_cdn_stream.go
new file mode 100644
index 00000000..b9f5258b
--- /dev/null
+++ b/router/router_cdn_stream.go
@@ -0,0 +1,48 @@
+package router
+
+import (
+	"net/http"
+
+	"github.com/gin-gonic/gin"
+
+	"github.com/pterodactyl/wings/router/middleware"
+	"github.com/pterodactyl/wings/router/tokens"
+)
+
+// Handles streaming a specific file with HTTP Range support.
+func getDownloadStream(c *gin.Context) {
+	df, ok := getTokenStreamFile(c)
+	if !ok {
+		return
+	}
+	defer df.Close()
+
+	serveDownloadFile(c, df, "inline", true, false)
+}
+
+func getTokenStreamFile(c *gin.Context) (*downloadFile, bool) {
+	manager := middleware.ExtractManager(c)
+	token := tokens.FilePayload{}
+	if err := tokens.ParseToken([]byte(c.Query("token")), &token); err != nil {
+		middleware.CaptureAndAbort(c, err)
+		return nil, false
+	}
+
+	s, ok := manager.Get(token.ServerUuid)
+	if !ok || token.Denylisted() || !token.HasScope(tokens.FileDownload) {
+		c.AbortWithStatusJSON(http.StatusNotFound, gin.H{
+			"error": "The requested resource was not found on this server.",
+		})
+		return nil, false
+	}
+
+	filePath, ok := cleanDownloadFilePath(token.FilePath)
+	if !ok {
+		c.AbortWithStatusJSON(http.StatusBadRequest, gin.H{
+			"error": "Invalid file path.",
+		})
+		return nil, false
+	}
+
+	return openDownloadFile(c, s.Filesystem(), filePath)
+}
diff --git a/router/router_download_directory.go b/router/router_download_directory.go
new file mode 100644
index 00000000..7ebaca70
--- /dev/null
+++ b/router/router_download_directory.go
@@ -0,0 +1,312 @@
+package router
+
+import (
+	"archive/tar"
+	"archive/zip"
+	"compress/gzip"
+	"context"
+	"errors"
+	"io"
+	"net/http"
+	pathpkg "path"
+	"strconv"
+	"strings"
+	"unicode"
+
+	"github.com/dsnet/compress/bzip2"
+	"github.com/gin-gonic/gin"
+	"github.com/klauspost/compress/zstd"
+	"github.com/ulikunitz/xz"
+
+	"github.com/pterodactyl/wings/internal/ufs"
+	"github.com/pterodactyl/wings/router/middleware"
+	"github.com/pterodactyl/wings/router/tokens"
+	serverfs "github.com/pterodactyl/wings/server/filesystem"
+)
+
+type directoryArchiveFormat struct {
+	name      string
+	extension string
+	mime      string
+}
+
+var directoryArchiveFormats = map[string]directoryArchiveFormat{
+	"tar":      {name: "tar", extension: "tar", mime: "application/x-tar"},
+	"tar_gz":   {name: "tar_gz", extension: "tar.gz", mime: "application/gzip"},
+	"tar_xz":   {name: "tar_xz", extension: "tar.xz", mime: "application/x-xz"},
+	"tar_bz2":  {name: "tar_bz2", extension: "tar.bz2", mime: "application/x-bzip2"},
+	"tar_zstd": {name: "tar_zstd", extension: "tar.zst", mime: "application/zstd"},
+	"zip":      {name: "zip", extension: "zip", mime: "application/zip"},
+}
+
+const (
+	maxDirectoryArchiveEntries = 500000
+	maxDirectoryArchiveDepth   = 256
+)
+
+func getDownloadDirectory(c *gin.Context) {
+	manager := middleware.ExtractManager(c)
+	token := tokens.FilePayload{}
+	if err := tokens.ParseToken([]byte(c.Query("token")), &token); err != nil {
+		abortDirectoryDownload(c)
+		return
+	}
+	s, ok := manager.Get(token.ServerUuid)
+	if !ok || token.Denylisted() || !token.IsUniqueRequest() || !token.HasScope(tokens.FileDownload) {
+		abortDirectoryDownload(c)
+		return
+	}
+
+	formatName := c.Query("archive_format")
+	if formatName == "" {
+		formatName = "tar_gz"
+	}
+	format, ok := directoryArchiveFormats[formatName]
+	if !ok {
+		c.AbortWithStatusJSON(http.StatusUnprocessableEntity, gin.H{"error": "Unsupported directory archive format."})
+		return
+	}
+	root, err := normalizeBetterFilesRoot(token.FilePath)
+	if err != nil || ensureBetterFilesAllowed(s.Filesystem(), root) != nil {
+		abortDirectoryDownload(c)
+		return
+	}
+	info, err := betterFilesLstat(s.Filesystem(), root)
+	if err != nil || !info.IsDir() {
+		abortDirectoryDownload(c)
+		return
+	}
+
+	name := pathpkg.Base(root)
+	if root == "/" || name == "." || name == "/" {
+		name = "server-files"
+	}
+	filename := safeArchiveFilename(name) + "." + format.extension
+	c.Header("Content-Disposition", "attachment; filename="+strconv.Quote(filename))
+	c.Header("Content-Type", format.mime)
+	c.Header("X-Content-Type-Options", "nosniff")
+	c.Status(http.StatusOK)
+
+	if err := streamDirectoryArchive(c.Request.Context(), c.Writer, s.Filesystem(), root, format); err != nil && !errors.Is(err, context.Canceled) {
+		s.Log().WithError(err).Warn("directory archive stream ended with an error")
+	}
+}
+
+func abortDirectoryDownload(c *gin.Context) {
+	c.AbortWithStatusJSON(http.StatusNotFound, gin.H{"error": "The requested directory was not found on this server."})
+}
+
+func safeArchiveFilename(value string) string {
+	var builder strings.Builder
+	for _, character := range value {
+		if character > unicode.MaxASCII || character < 0x20 || character == 0x7f || character == '/' || character == '\\' {
+			builder.WriteByte('_')
+		} else {
+			builder.WriteRune(character)
+		}
+	}
+	if builder.Len() == 0 {
+		return "directory"
+	}
+	return builder.String()
+}
+
+func streamDirectoryArchive(ctx context.Context, output io.Writer, fs *serverfs.Filesystem, root string, format directoryArchiveFormat) error {
+	if format.name == "zip" {
+		writer := zip.NewWriter(output)
+		err := writeZipDirectory(ctx, writer, fs, root)
+		closeErr := writer.Close()
+		if err != nil {
+			return err
+		}
+		return closeErr
+	}
+
+	compressed, closeCompressed, err := directoryArchiveCompressor(output, format.name)
+	if err != nil {
+		return err
+	}
+	writer := tar.NewWriter(compressed)
+	err = writeTarDirectory(ctx, writer, fs, root)
+	closeTarErr := writer.Close()
+	closeCompressionErr := closeCompressed()
+	if err != nil {
+		return err
+	}
+	if closeTarErr != nil {
+		return closeTarErr
+	}
+	return closeCompressionErr
+}
+
+func directoryArchiveCompressor(output io.Writer, format string) (io.Writer, func() error, error) {
+	switch format {
+	case "tar":
+		return output, func() error { return nil }, nil
+	case "tar_gz":
+		writer, err := gzip.NewWriterLevel(output, gzip.DefaultCompression)
+		if err != nil {
+			return nil, nil, err
+		}
+		return writer, writer.Close, nil
+	case "tar_xz":
+		writer, err := xz.NewWriter(output)
+		if err != nil {
+			return nil, nil, err
+		}
+		return writer, writer.Close, nil
+	case "tar_bz2":
+		writer, err := bzip2.NewWriter(output, &bzip2.WriterConfig{Level: 6})
+		if err != nil {
+			return nil, nil, err
+		}
+		return writer, writer.Close, nil
+	case "tar_zstd":
+		writer, err := zstd.NewWriter(output, zstd.WithEncoderLevel(zstd.SpeedDefault), zstd.WithEncoderConcurrency(1))
+		if err != nil {
+			return nil, nil, err
+		}
+		return writer, writer.Close, nil
+	default:
+		return nil, nil, errors.New("unsupported archive format")
+	}
+}
+
+type directoryArchiveItem struct {
+	path  string
+	rel   string
+	depth int
+}
+
+func writeTarDirectory(ctx context.Context, writer *tar.Writer, fs *serverfs.Filesystem, root string) error {
+	buffer := make([]byte, 64*1024)
+	return walkDirectoryArchive(ctx, fs, root, func(item directoryArchiveItem, info ufs.FileInfo, file io.Reader) error {
+		header, err := tar.FileInfoHeader(info, "")
+		if err != nil {
+			return err
+		}
+		header.Name = item.rel
+		if info.IsDir() {
+			header.Name += "/"
+		}
+		if err := writer.WriteHeader(header); err != nil {
+			return err
+		}
+		if file == nil {
+			return nil
+		}
+		written, err := io.CopyBuffer(writerOnly{Writer: writer}, file, buffer)
+		if err != nil {
+			return err
+		}
+		if written != info.Size() {
+			return io.ErrUnexpectedEOF
+		}
+		return nil
+	})
+}
+
+func writeZipDirectory(ctx context.Context, writer *zip.Writer, fs *serverfs.Filesystem, root string) error {
+	buffer := make([]byte, 64*1024)
+	return walkDirectoryArchive(ctx, fs, root, func(item directoryArchiveItem, info ufs.FileInfo, file io.Reader) error {
+		header, err := zip.FileInfoHeader(info)
+		if err != nil {
+			return err
+		}
+		header.Name = item.rel
+		if info.IsDir() {
+			header.Name += "/"
+			header.Method = zip.Store
+		} else {
+			header.Method = zip.Deflate
+		}
+		destination, err := writer.CreateHeader(header)
+		if err != nil || file == nil {
+			return err
+		}
+		written, err := io.CopyBuffer(writerOnly{Writer: destination}, file, buffer)
+		if err != nil {
+			return err
+		}
+		if written != info.Size() {
+			return io.ErrUnexpectedEOF
+		}
+		return nil
+	})
+}
+
+func walkDirectoryArchive(
+	ctx context.Context,
+	fs *serverfs.Filesystem,
+	root string,
+	visit func(directoryArchiveItem, ufs.FileInfo, io.Reader) error,
+) error {
+	if err := ctx.Err(); err != nil {
+		return err
+	}
+	entries, err := fs.ReadDirStat(root)
+	if err != nil {
+		return err
+	}
+	stack := make([]directoryArchiveItem, 0, len(entries))
+	for i := len(entries) - 1; i >= 0; i-- {
+		stack = append(stack, directoryArchiveItem{path: pathpkg.Join(root, entries[i].Name()), rel: entries[i].Name(), depth: 1})
+	}
+
+	visited := 0
+	for len(stack) > 0 {
+		if err := ctx.Err(); err != nil {
+			return err
+		}
+		item := stack[len(stack)-1]
+		stack = stack[:len(stack)-1]
+		visited++
+		if visited > maxDirectoryArchiveEntries || item.depth > maxDirectoryArchiveDepth {
+			return errors.New("directory archive traversal limit exceeded")
+		}
+		if pathpkg.IsAbs(item.rel) || hasParentPathComponent(item.rel) || ensureBetterFilesAllowed(fs, item.path) != nil {
+			continue
+		}
+		info, err := fs.UnixFS().Lstat(item.path)
+		if err != nil {
+			return err
+		}
+		if info.Mode()&ufs.ModeSymlink != 0 {
+			continue
+		}
+		if info.IsDir() {
+			if err := visit(item, info, nil); err != nil {
+				return err
+			}
+			children, err := fs.ReadDirStat(item.path)
+			if err != nil {
+				return err
+			}
+			for i := len(children) - 1; i >= 0; i-- {
+				stack = append(stack, directoryArchiveItem{
+					path:  pathpkg.Join(item.path, children[i].Name()),
+					rel:   pathpkg.Join(item.rel, children[i].Name()),
+					depth: item.depth + 1,
+				})
+			}
+			continue
+		}
+		if !info.Mode().IsRegular() {
+			continue
+		}
+		file, err := fs.UnixFS().OpenFile(item.path, ufs.O_RDONLY|ufs.O_NOFOLLOW, 0)
+		if err != nil {
+			return err
+		}
+		reader := &fingerprintContextReader{ctx: ctx, reader: io.LimitReader(file, info.Size())}
+		err = visit(item, info, reader)
+		closeErr := file.Close()
+		if err != nil {
+			return err
+		}
+		if closeErr != nil {
+			return closeErr
+		}
+	}
+	return nil
+}
diff --git a/router/router_download_directory_http_test.go b/router/router_download_directory_http_test.go
new file mode 100644
index 00000000..b6e0cb84
--- /dev/null
+++ b/router/router_download_directory_http_test.go
@@ -0,0 +1,59 @@
+package router
+
+import (
+	"archive/zip"
+	"bytes"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestDirectoryDownloadJWTDirectoryValidationAndIgnoredFiles(t *testing.T) {
+	_, s, handler := newBetterFilesHTTPServer(t, 10, 10, "folder/secret.txt")
+	writeBetterFilesFixture(t, s.Filesystem(), "/folder/visible.txt", []byte("visible"))
+	writeBetterFilesFixture(t, s.Filesystem(), "/folder/secret.txt", []byte("secret"))
+	token := signBetterFilesDownloadToken(t, s.ID(), "/folder")
+	request := httptest.NewRequest(http.MethodGet, "/download/directory?"+url.Values{
+		"token":          {token},
+		"archive_format": {"zip"},
+	}.Encode(), nil)
+	recorder := httptest.NewRecorder()
+	handler.ServeHTTP(recorder, request)
+	require.Equal(t, http.StatusOK, recorder.Code)
+	require.Equal(t, "application/zip", recorder.Header().Get("Content-Type"))
+	require.Contains(t, recorder.Header().Get("Content-Disposition"), "folder.zip")
+
+	archive, err := zip.NewReader(bytes.NewReader(recorder.Body.Bytes()), int64(recorder.Body.Len()))
+	require.NoError(t, err)
+	files := map[string][]byte{}
+	for _, entry := range archive.File {
+		if entry.FileInfo().IsDir() {
+			continue
+		}
+		opened, err := entry.Open()
+		require.NoError(t, err)
+		files[entry.Name], err = io.ReadAll(opened)
+		require.NoError(t, err)
+		require.NoError(t, opened.Close())
+	}
+	require.Equal(t, []byte("visible"), files["visible.txt"])
+	require.NotContains(t, files, "secret.txt")
+
+	invalid := httptest.NewRecorder()
+	handler.ServeHTTP(invalid, httptest.NewRequest(http.MethodGet, "/download/directory?token=invalid", nil))
+	require.Equal(t, http.StatusNotFound, invalid.Code)
+
+	fileToken := signBetterFilesDownloadToken(t, s.ID(), "/folder/visible.txt")
+	fileResponse := httptest.NewRecorder()
+	handler.ServeHTTP(fileResponse, httptest.NewRequest(http.MethodGet, "/download/directory?"+url.Values{"token": {fileToken}}.Encode(), nil))
+	require.Equal(t, http.StatusNotFound, fileResponse.Code)
+
+	traversalToken := signBetterFilesDownloadToken(t, s.ID(), "/../folder")
+	traversalResponse := httptest.NewRecorder()
+	handler.ServeHTTP(traversalResponse, httptest.NewRequest(http.MethodGet, "/download/directory?"+url.Values{"token": {traversalToken}}.Encode(), nil))
+	require.Equal(t, http.StatusNotFound, traversalResponse.Code)
+}
diff --git a/router/router_download_directory_test.go b/router/router_download_directory_test.go
new file mode 100644
index 00000000..913fac3e
--- /dev/null
+++ b/router/router_download_directory_test.go
@@ -0,0 +1,99 @@
+package router
+
+import (
+	"archive/tar"
+	"archive/zip"
+	"bytes"
+	"compress/bzip2"
+	"compress/gzip"
+	"context"
+	"io"
+	"testing"
+
+	"github.com/klauspost/compress/zstd"
+	"github.com/stretchr/testify/require"
+	"github.com/ulikunitz/xz"
+)
+
+func TestStreamDirectoryArchiveEverySupportedFormat(t *testing.T) {
+	fs := newBetterFilesTestFilesystem(t, 0, "secret.txt")
+	writeBetterFilesFixture(t, fs, "/folder/hello.txt", []byte("hello"))
+	writeBetterFilesFixture(t, fs, "/folder/nested/world.txt", []byte("world"))
+	writeBetterFilesFixture(t, fs, "/folder/secret.txt", []byte("secret"))
+
+	for _, name := range []string{"tar", "tar_gz", "tar_xz", "tar_bz2", "tar_zstd", "zip"} {
+		t.Run(name, func(t *testing.T) {
+			var output bytes.Buffer
+			require.NoError(t, streamDirectoryArchive(context.Background(), &output, fs, "/folder", directoryArchiveFormats[name]))
+			files := readDirectoryArchiveFixture(t, name, output.Bytes())
+			require.Equal(t, []byte("hello"), files["hello.txt"])
+			require.Equal(t, []byte("world"), files["nested/world.txt"])
+			require.NotContains(t, files, "secret.txt")
+		})
+	}
+}
+
+func TestStreamDirectoryArchiveCancellation(t *testing.T) {
+	fs := newBetterFilesTestFilesystem(t, 0)
+	writeBetterFilesFixture(t, fs, "/folder/file.txt", []byte("content"))
+	ctx, cancel := context.WithCancel(context.Background())
+	cancel()
+	var output bytes.Buffer
+	require.ErrorIs(t, streamDirectoryArchive(ctx, &output, fs, "/folder", directoryArchiveFormats["tar"]), context.Canceled)
+}
+
+func readDirectoryArchiveFixture(t *testing.T, format string, data []byte) map[string][]byte {
+	t.Helper()
+	if format == "zip" {
+		reader, err := zip.NewReader(bytes.NewReader(data), int64(len(data)))
+		require.NoError(t, err)
+		files := make(map[string][]byte)
+		for _, entry := range reader.File {
+			if entry.FileInfo().IsDir() {
+				continue
+			}
+			opened, err := entry.Open()
+			require.NoError(t, err)
+			files[entry.Name], err = io.ReadAll(opened)
+			require.NoError(t, err)
+			require.NoError(t, opened.Close())
+		}
+		return files
+	}
+
+	var reader io.Reader = bytes.NewReader(data)
+	switch format {
+	case "tar_gz":
+		opened, err := gzip.NewReader(reader)
+		require.NoError(t, err)
+		defer opened.Close()
+		reader = opened
+	case "tar_xz":
+		opened, err := xz.NewReader(reader)
+		require.NoError(t, err)
+		reader = opened
+	case "tar_bz2":
+		reader = bzip2.NewReader(reader)
+	case "tar_zstd":
+		opened, err := zstd.NewReader(reader)
+		require.NoError(t, err)
+		defer opened.Close()
+		reader = opened
+	}
+
+	files := make(map[string][]byte)
+	archive := tar.NewReader(reader)
+	for {
+		header, err := archive.Next()
+		if err == io.EOF {
+			break
+		}
+		require.NoError(t, err)
+		if header.FileInfo().IsDir() {
+			continue
+		}
+		files[header.Name], err = io.ReadAll(archive)
+		require.NoError(t, err)
+	}
+	return files
+}
diff --git a/router/router_download_helpers.go b/router/router_download_helpers.go
new file mode 100644
index 00000000..ff4dcb44
--- /dev/null
+++ b/router/router_download_helpers.go
@@ -0,0 +1,206 @@
+package router
+
+import (
+	"errors"
+	"io"
+	"mime"
+	"net/http"
+	pathpkg "path"
+	"path/filepath"
+	"strconv"
+	"strings"
+	"unicode/utf8"
+
+	"github.com/gabriel-vasile/mimetype"
+	"github.com/gin-gonic/gin"
+	"golang.org/x/sys/unix"
+
+	"github.com/pterodactyl/wings/internal/ufs"
+	"github.com/pterodactyl/wings/router/middleware"
+	serverfs "github.com/pterodactyl/wings/server/filesystem"
+)
+
+type downloadFile struct {
+	file ufs.File
+	info ufs.FileInfo
+}
+
+func (df *downloadFile) Close() error {
+	return df.file.Close()
+}
+
+func openDownloadFile(c *gin.Context, fs *serverfs.Filesystem, filePath string) (*downloadFile, bool) {
+	info, err := fs.UnixFS().Lstat(filePath)
+	if err != nil {
+		abortDownloadFileError(c, err)
+		return nil, false
+	}
+	if info.IsDir() {
+		c.AbortWithStatusJSON(http.StatusNotFound, gin.H{
+			"error": "The requested resource was not found on this server.",
+		})
+		return nil, false
+	}
+	if !info.Mode().IsRegular() {
+		c.AbortWithStatusJSON(http.StatusBadRequest, gin.H{
+			"error": "Cannot open files of this type.",
+		})
+		return nil, false
+	}
+
+	file, err := fs.UnixFS().OpenFile(filePath, ufs.O_RDONLY|unix.O_NONBLOCK, 0)
+	if err != nil {
+		abortDownloadFileError(c, err)
+		return nil, false
+	}
+
+	openedInfo, err := file.Stat()
+	if err != nil {
+		_ = file.Close()
+		abortDownloadFileError(c, err)
+		return nil, false
+	}
+	if openedInfo.IsDir() {
+		_ = file.Close()
+		c.AbortWithStatusJSON(http.StatusNotFound, gin.H{
+			"error": "The requested resource was not found on this server.",
+		})
+		return nil, false
+	}
+	if !openedInfo.Mode().IsRegular() {
+		_ = file.Close()
+		c.AbortWithStatusJSON(http.StatusBadRequest, gin.H{
+			"error": "Cannot open files of this type.",
+		})
+		return nil, false
+	}
+
+	return &downloadFile{file: file, info: openedInfo}, true
+}
+
+func abortDownloadFileError(c *gin.Context, err error) {
+	if errors.Is(err, ufs.ErrNotExist) || errors.Is(err, ufs.ErrBadPathResolution) {
+		c.AbortWithStatusJSON(http.StatusNotFound, gin.H{
+			"error": "The requested resource was not found on this server.",
+		})
+		return
+	}
+	middleware.CaptureAndAbort(c, err)
+}
+
+func serveDownloadFile(c *gin.Context, df *downloadFile, disposition string, inline bool, fixedSize bool) {
+	c.Header("Accept-Ranges", "bytes")
+	c.Header("Content-Disposition", disposition+"; filename="+strconv.Quote(df.info.Name()))
+	c.Header("Content-Type", downloadContentType(df, inline))
+	c.Header("ETag", downloadETag(df.info))
+	c.Header("X-Content-Type-Options", "nosniff")
+	if inline {
+		c.Header("Cross-Origin-Resource-Policy", "cross-origin")
+	}
+
+	content := io.ReadSeeker(df.file)
+	if fixedSize {
+		content = newFixedDownloadReader(df.file, df.info.Size())
+	}
+	http.ServeContent(c.Writer, c.Request, df.info.Name(), df.info.ModTime(), content)
+}
+
+func downloadContentType(df *downloadFile, inline bool) string {
+	if !inline {
+		return "application/octet-stream"
+	}
+	if contentType := mime.TypeByExtension(filepath.Ext(df.info.Name())); contentType != "" {
+		return contentType
+	}
+
+	m, err := mimetype.DetectReader(df.file)
+	_, _ = df.file.Seek(0, io.SeekStart)
+	if err == nil && m != nil {
+		return m.String()
+	}
+	return "application/octet-stream"
+}
+
+func downloadETag(info ufs.FileInfo) string {
+	return `W/"` + strconv.FormatInt(info.Size(), 16) + `-` + strconv.FormatInt(info.ModTime().UnixNano(), 16) + `"`
+}
+
+type fixedDownloadReader struct {
+	reader io.ReadSeeker
+	size   int64
+	offset int64
+}
+
+func newFixedDownloadReader(reader io.ReadSeeker, size int64) *fixedDownloadReader {
+	return &fixedDownloadReader{
+		reader: reader,
+		size:   size,
+	}
+}
+
+func (r *fixedDownloadReader) Read(p []byte) (int, error) {
+	if r.offset >= r.size {
+		return 0, io.EOF
+	}
+
+	remaining := r.size - r.offset
+	if int64(len(p)) > remaining {
+		p = p[:int(remaining)]
+	}
+
+	n, err := r.reader.Read(p)
+	if n == 0 && errors.Is(err, io.EOF) {
+		for i := range p {
+			p[i] = 0
+		}
+		r.offset += int64(len(p))
+		return len(p), nil
+	}
+
+	r.offset += int64(n)
+	return n, err
+}
+
+func (r *fixedDownloadReader) Seek(offset int64, whence int) (int64, error) {
+	var target int64
+	switch whence {
+	case io.SeekStart:
+		target = offset
+	case io.SeekCurrent:
+		target = r.offset + offset
+	case io.SeekEnd:
+		target = r.size + offset
+	default:
+		return 0, errors.New("invalid whence")
+	}
+	if target < 0 {
+		return 0, errors.New("negative position")
+	}
+	if _, err := r.reader.Seek(target, io.SeekStart); err != nil {
+		return 0, err
+	}
+	r.offset = target
+	return target, nil
+}
+
+func cleanDownloadFilePath(value string) (string, bool) {
+	value = strings.TrimSpace(strings.ReplaceAll(value, "\\", "/"))
+	if value == "" || strings.Contains(value, "\x00") || !utf8.ValidString(value) || len(value) > 4096 {
+		return "", false
+	}
+	if !strings.HasPrefix(value, "/") {
+		value = "/" + value
+	}
+	for _, segment := range strings.Split(value, "/") {
+		if segment == ".." {
+			return "", false
+		}
+	}
+
+	cleaned := pathpkg.Clean(value)
+	if cleaned == "." || cleaned == "/" || !strings.HasPrefix(cleaned, "/") {
+		return "", false
+	}
+
+	return cleaned, true
+}
diff --git a/router/router_download_helpers_test.go b/router/router_download_helpers_test.go
new file mode 100644
index 00000000..7ed8d5a4
--- /dev/null
+++ b/router/router_download_helpers_test.go
@@ -0,0 +1,164 @@
+package router
+
+import (
+	"bytes"
+	"io"
+	"os"
+	"path/filepath"
+	"testing"
+)
+
+func TestCleanDownloadFilePath(t *testing.T) {
+	tests := []struct {
+		name string
+		in   string
+		want string
+		ok   bool
+	}{
+		{name: "relative file", in: "foo/bar.txt", want: "/foo/bar.txt", ok: true},
+		{name: "absolute file", in: "/foo/bar.txt", want: "/foo/bar.txt", ok: true},
+		{name: "backslashes", in: `foo\bar.txt`, want: "/foo/bar.txt", ok: true},
+		{name: "empty", in: "", ok: false},
+		{name: "root", in: "/", ok: false},
+		{name: "traversal", in: "/foo/../bar.txt", ok: false},
+		{name: "nul byte", in: "foo\x00bar.txt", ok: false},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got, ok := cleanDownloadFilePath(tt.in)
+			if ok != tt.ok {
+				t.Fatalf("expected ok %t, got %t", tt.ok, ok)
+			}
+			if got != tt.want {
+				t.Fatalf("expected path %q, got %q", tt.want, got)
+			}
+		})
+	}
+}
+
+func TestCleanUploadFilename(t *testing.T) {
+	tests := []struct {
+		name string
+		in   string
+		want string
+		ok   bool
+	}{
+		{name: "simple", in: "world.zip", want: "world.zip", ok: true},
+		{name: "spaces", in: "my world.zip", want: "my world.zip", ok: true},
+		{name: "empty", in: "", ok: false},
+		{name: "dot", in: ".", ok: false},
+		{name: "dot dot", in: "..", ok: false},
+		{name: "forward slash", in: "../world.zip", ok: false},
+		{name: "nested path", in: "saves/world.zip", ok: false},
+		{name: "backslash", in: `saves\world.zip`, ok: false},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got, ok := cleanUploadFilename(tt.in)
+			if ok != tt.ok {
+				t.Fatalf("expected ok %t, got %t", tt.ok, ok)
+			}
+			if got != tt.want {
+				t.Fatalf("expected filename %q, got %q", tt.want, got)
+			}
+		})
+	}
+}
+
+func TestFixedDownloadReader(t *testing.T) {
+	t.Run("reads unchanged file", func(t *testing.T) {
+		path := filepath.Join(t.TempDir(), "download.txt")
+		if err := os.WriteFile(path, []byte("download contents"), 0o644); err != nil {
+			t.Fatal(err)
+		}
+
+		f, err := os.Open(path)
+		if err != nil {
+			t.Fatal(err)
+		}
+		defer f.Close()
+
+		info, err := f.Stat()
+		if err != nil {
+			t.Fatal(err)
+		}
+
+		got, err := os.ReadFile(path)
+		if err != nil {
+			t.Fatal(err)
+		}
+		buf := make([]byte, len(got))
+		n, err := newFixedDownloadReader(f, info.Size()).Read(buf)
+		if err != nil {
+			t.Fatal(err)
+		}
+		if string(buf[:n]) != string(got) {
+			t.Fatalf("expected %q, got %q", string(got), string(buf[:n]))
+		}
+	})
+
+	t.Run("caps file growth to original size", func(t *testing.T) {
+		path := filepath.Join(t.TempDir(), "download.txt")
+		if err := os.WriteFile(path, []byte("download"), 0o644); err != nil {
+			t.Fatal(err)
+		}
+
+		f, err := os.Open(path)
+		if err != nil {
+			t.Fatal(err)
+		}
+		defer f.Close()
+
+		info, err := f.Stat()
+		if err != nil {
+			t.Fatal(err)
+		}
+		reader := newFixedDownloadReader(f, info.Size())
+
+		if err := os.WriteFile(path, []byte("download with extra bytes"), 0o644); err != nil {
+			t.Fatal(err)
+		}
+
+		got, err := io.ReadAll(reader)
+		if err != nil {
+			t.Fatal(err)
+		}
+		if string(got) != "download" {
+			t.Fatalf("expected %q, got %q", "download", string(got))
+		}
+	})
+
+	t.Run("pads when file shrinks before fixed size is read", func(t *testing.T) {
+		path := filepath.Join(t.TempDir(), "download.txt")
+		if err := os.WriteFile(path, []byte("download"), 0o644); err != nil {
+			t.Fatal(err)
+		}
+
+		f, err := os.Open(path)
+		if err != nil {
+			t.Fatal(err)
+		}
+		defer f.Close()
+
+		info, err := f.Stat()
+		if err != nil {
+			t.Fatal(err)
+		}
+		reader := newFixedDownloadReader(f, info.Size())
+
+		if err := os.WriteFile(path, []byte("down"), 0o644); err != nil {
+			t.Fatal(err)
+		}
+
+		got, err := io.ReadAll(reader)
+		if err != nil {
+			t.Fatal(err)
+		}
+		want := append([]byte("down"), bytes.Repeat([]byte{0}, 4)...)
+		if !bytes.Equal(got, want) {
+			t.Fatalf("expected %q, got %q", want, got)
+		}
+	})
+}
diff --git a/router/router_file_operations.go b/router/router_file_operations.go
new file mode 100644
index 00000000..57408574
--- /dev/null
+++ b/router/router_file_operations.go
@@ -0,0 +1,25 @@
+package router
+
+import (
+	"net/http"
+
+	"github.com/gin-gonic/gin"
+	"github.com/google/uuid"
+
+	"github.com/pterodactyl/wings/router/middleware"
+)
+
+func deleteServerFileOperation(c *gin.Context) {
+	identifier := c.Param("operation")
+	if _, err := uuid.Parse(identifier); err != nil {
+		c.AbortWithStatusJSON(http.StatusUnprocessableEntity, gin.H{"error": "The operation identifier is malformed."})
+		return
+	}
+
+	s := middleware.ExtractServer(c)
+	if !s.FileOperations().Cancel(identifier) {
+		c.AbortWithStatusJSON(http.StatusNotFound, gin.H{"error": "The requested operation was not found on this server."})
+		return
+	}
+	c.Status(http.StatusNoContent)
+}
diff --git a/router/router_file_operations_test.go b/router/router_file_operations_test.go
new file mode 100644
index 00000000..5b89b4f8
--- /dev/null
+++ b/router/router_file_operations_test.go
@@ -0,0 +1,39 @@
+package router
+
+import (
+	"context"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/google/uuid"
+	"github.com/stretchr/testify/require"
+
+	"github.com/pterodactyl/wings/config"
+	"github.com/pterodactyl/wings/server"
+)
+
+func TestDeleteServerFileOperationResponses(t *testing.T) {
+	_, s, handler := newBetterFilesHTTPServer(t, 10, 10)
+	started := make(chan struct{})
+	operation, done, err := s.FileOperations().Start(context.Background(), "copy_many", func(ctx context.Context, _ *server.FileOperation) error {
+		close(started)
+		<-ctx.Done()
+		return ctx.Err()
+	})
+	require.NoError(t, err)
+	<-started
+
+	request := func(identifier string) *httptest.ResponseRecorder {
+		recorder := httptest.NewRecorder()
+		req := httptest.NewRequest(http.MethodDelete, "/api/servers/"+s.ID()+"/files/operations/"+identifier, nil)
+		req.Header.Set("Authorization", "Bearer "+config.Get().Token.Token)
+		handler.ServeHTTP(recorder, req)
+		return recorder
+	}
+	require.Equal(t, http.StatusUnprocessableEntity, request("not-a-uuid").Code)
+	require.Equal(t, http.StatusNotFound, request(uuid.NewString()).Code)
+	require.Equal(t, http.StatusNoContent, request(operation.Identifier()).Code)
+	require.ErrorIs(t, <-done, server.ErrFileOperationCanceled)
+	require.Equal(t, http.StatusNotFound, request(operation.Identifier()).Code)
+}
diff --git a/router/router_openapi.go b/router/router_openapi.go
new file mode 100644
index 00000000..4eedcb91
--- /dev/null
+++ b/router/router_openapi.go
@@ -0,0 +1,156 @@
+package router
+
+import (
+	"net/http"
+
+	"github.com/gin-gonic/gin"
+)
+
+// getOpenAPI exposes the concrete Better Files capability surface. Better
+// Files performs exact method detection against these path keys, so this list
+// intentionally contains only routes mounted by Configure.
+func getOpenAPI(c *gin.Context) {
+	operation := func(summary string, statuses ...string) gin.H {
+		responses := gin.H{}
+		for _, status := range statuses {
+			responses[status] = gin.H{"description": http.StatusText(statusCode(status))}
+		}
+		return gin.H{"summary": summary, "responses": responses}
+	}
+	multipartUpload := operation("Upload flat files or a folder batch using multipart form data", "200", "400", "403", "404", "409", "413", "500")
+	multipartUpload["x-betterfiles-folder-upload"] = gin.H{
+		"version": 1, "paths_field": "paths", "max_files": maxMultipartUploadFiles,
+	}
+	multipartUpload["description"] = "Uses the existing signed upload URL and directory query parameter. Optional paths is one JSON string array in a multipart text field, matched to files parts in order. Paths are canonical relative paths, not URL-encoded; each basename must match its files part. Without paths, filenames remain flat. One single-use token authorizes the whole request, including failures. Invalid manifests/paths/limits are preflighted; runtime failures may leave earlier files written, so obtain a fresh token before retrying."
+	multipartUpload["requestBody"] = gin.H{
+		"required": true,
+		"content": gin.H{"multipart/form-data": gin.H{"schema": gin.H{
+			"type": "object", "required": []string{"files"},
+			"properties": gin.H{
+				"files": gin.H{"type": "array", "minItems": 1, "items": gin.H{"type": "string", "format": "binary"}},
+				"paths": gin.H{"type": "string", "description": "Optional JSON array with exactly one relative path for each files part, in the same order.", "example": `["mods/a/config.yml","mods/b/config.yml"]`},
+			},
+		}}},
+	}
+	search := operation("Search regular files with Wings-rs V2 filters", "200", "400", "401", "403", "404", "408", "413", "422", "500")
+	search["description"] = "Returns only regular files. Result names are relative to root, but gitignore-style globs are anchored at the server filesystem root. Basename globs match at any depth; ordered ! negation is supported and excluded directories are pruned. Case-insensitive matching folds ASCII only. Size min is inclusive and max is exclusive. Content searches use the first 128 bytes as a UTF-8 heuristic, allow NUL bytes, and stop at the first literal match. include_unmatched includes oversized/unsearched files, not searched nonmatches or detected-binary files. No archives, virtual backup mounts, V1 POST payload, or match_context support. Unknown fields are rejected. Traversal/read limit errors return no partial results."
+	search["security"] = []gin.H{{"daemonToken": []string{}}}
+	search["parameters"] = []gin.H{{"in": "path", "name": "server", "required": true, "schema": gin.H{"type": "string", "format": "uuid"}}}
+	search["x-search-limits"] = gin.H{
+		"request_bytes": maxSearchV2RequestBytes, "results": maxSearchV2Results,
+		"patterns_combined": maxSearchV2Patterns, "pattern_bytes_combined": maxSearchV2PatternBytes,
+		"alternatives_per_pattern": maxSearchV2Alternatives, "entries": maxSearchV2Entries,
+		"directories": maxSearchV2Directories, "depth": maxSearchV2Depth,
+		"total_read_bytes": maxSearchV2TotalRead, "timeout_seconds": int(searchV2Timeout.Seconds()),
+	}
+	search["requestBody"] = gin.H{
+		"required": true,
+		"content": gin.H{"application/json": gin.H{"schema": gin.H{
+			"type": "object", "additionalProperties": false,
+			"properties": gin.H{
+				"root": gin.H{"type": []string{"string", "null"}, "default": "/", "maxLength": betterFilesMaxPathLength, "description": "Server directory; omitted, null or empty means /. At most 4096 UTF-8 bytes; parent components, backslashes and symlinks are rejected."},
+				"path_filter": gin.H{"type": []string{"object", "null"}, "default": nil, "additionalProperties": false, "properties": gin.H{
+					"include":          gin.H{"type": []string{"array", "null"}, "default": []string{}, "maxItems": maxSearchV2Patterns, "items": gin.H{"type": "string", "maxLength": betterFilesMaxPathLength}, "description": "Ordered gitignore-style include overrides. Empty/omitted/null includes all files. At most 128 include+exclude patterns and 64 KiB combined, each at most 4096 UTF-8 bytes. Brace alternatives are limited to 64 expansions within a path component; nested/empty alternatives and alternatives containing slashes are unsupported."},
+					"exclude":          gin.H{"type": []string{"array", "null"}, "default": []string{}, "maxItems": maxSearchV2Patterns, "items": gin.H{"type": "string", "maxLength": betterFilesMaxPathLength}, "description": "Ordered gitignore-style exclusions; directory matches prune descendants. A later ! pattern cannot re-include files below an already-pruned directory."},
+					"case_insensitive": gin.H{"type": []string{"boolean", "null"}, "default": false},
+				}},
+				"size_filter": gin.H{"type": []string{"object", "null"}, "default": nil, "additionalProperties": false, "properties": gin.H{
+					"min": gin.H{"type": []string{"integer", "null"}, "format": "int64", "minimum": 0, "default": nil, "description": "Inclusive minimum bytes; omitted/null is unbounded below (equivalent to zero)."},
+					"max": gin.H{"type": []string{"integer", "null"}, "format": "int64", "minimum": 0, "default": nil, "description": "Exclusive maximum bytes; omitted/null is unbounded above. min > max is invalid; equal bounds give no results."},
+				}},
+				"content_filter": gin.H{"type": []string{"object", "null"}, "default": nil, "additionalProperties": false, "properties": gin.H{
+					"query":             gin.H{"type": []string{"string", "null"}, "default": "", "maxLength": betterFilesMaxPathLength, "description": "Literal UTF-8 query, at most 4096 bytes. Empty/omitted/null matches every eligible file passing the UTF-8 head check; no regular expressions."},
+					"max_search_size":   gin.H{"type": []string{"integer", "null"}, "format": "int64", "minimum": 0, "maximum": maxSearchV2ReadLimit, "default": defaultSearchV2ReadLimit, "description": "Files larger than this threshold are not content-searched. Explicit zero is preserved. At most this many bytes are scanned per eligible file; a growing file remains bounded. Unsearched included files may still read 128 bytes for MIME detection."},
+					"include_unmatched": gin.H{"type": []string{"boolean", "null"}, "default": false, "description": "Include oversized files without applying the query; searched nonmatches and invalid-UTF-8-head files still do not match."},
+					"case_insensitive":  gin.H{"type": []string{"boolean", "null"}, "default": false},
+				}},
+				"per_page": gin.H{"type": []string{"integer", "null"}, "minimum": 0, "default": 100, "description": "Maximum returned results; values above 500 are capped to 500. Zero returns an empty list. Omitted/null defaults to 100. Ordering is unspecified; no pagination cursor."},
+			},
+		}}},
+	}
+	search["responses"].(gin.H)["200"] = gin.H{"description": "Matching regular files; results is [] when empty.", "content": gin.H{"application/json": gin.H{"schema": gin.H{
+		"type": "object", "required": []string{"results"}, "additionalProperties": false,
+		"properties": gin.H{"results": gin.H{"type": "array", "maxItems": maxSearchV2Results, "items": gin.H{
+			"type": "object", "required": []string{"name", "size", "size_physical", "directory", "file", "symlink", "mime", "created", "modified"},
+			"properties": gin.H{
+				"name":          gin.H{"type": "string", "description": "Slash-separated file path relative to root; never an absolute host path."},
+				"size":          gin.H{"type": "integer", "format": "int64", "minimum": 0},
+				"size_physical": gin.H{"type": "integer", "format": "int64", "minimum": 0, "description": "Allocated bytes where available, otherwise logical size."},
+				"directory":     gin.H{"type": "boolean", "const": false}, "file": gin.H{"type": "boolean", "const": true}, "symlink": gin.H{"type": "boolean", "const": false},
+				"mime": gin.H{"type": "string"}, "created": gin.H{"type": "string", "format": "date-time", "description": "Metadata-change time or modification-time fallback."}, "modified": gin.H{"type": "string", "format": "date-time"},
+			},
+		}}},
+	}}}}
+	for _, status := range []string{"400", "401", "403", "404", "408", "413", "422", "500"} {
+		search["responses"].(gin.H)[status].(gin.H)["content"] = gin.H{"application/json": gin.H{"schema": gin.H{"type": "object", "required": []string{"error"}, "properties": gin.H{"error": gin.H{"type": "string"}, "request_id": gin.H{"type": "string"}}}}}
+	}
+
+	c.JSON(http.StatusOK, gin.H{
+		"openapi": "3.1.0",
+		"info": gin.H{
+			"title":   "Wings Better Files API",
+			"version": "1.0.0",
+		},
+		"components": gin.H{"securitySchemes": gin.H{"daemonToken": gin.H{"type": "http", "scheme": "bearer"}}},
+		"paths": gin.H{
+			"/upload/file": gin.H{
+				"post":  multipartUpload,
+				"head":  operation("Read the current resumable upload offset", "200", "404"),
+				"patch": operation("Append a resumable upload chunk", "200", "408", "409", "413", "429"),
+			},
+			"/download/directory": gin.H{
+				"get": operation("Stream a directory archive", "200", "404"),
+			},
+			"/api/servers/{server}/files/copy-many": gin.H{
+				"post": operation("Copy multiple files or directories", "200", "202", "422"),
+			},
+			"/api/servers/{server}/files/rename": gin.H{
+				"put": operation("Rename multiple files", "204", "400", "422"),
+			},
+			"/api/servers/{server}/files/search": gin.H{
+				"get":  operation("Search files using the V1 query contract", "200", "400"),
+				"post": search,
+			},
+			"/api/servers/{server}/files/largest-directories": gin.H{
+				"get": operation("Analyze directory disk usage", "200", "404", "422"),
+			},
+			"/api/servers/{server}/files/fingerprints": gin.H{
+				"get": operation("Fingerprint files", "200", "422"),
+			},
+			"/api/servers/{server}/files/operations/{operation}": gin.H{
+				"delete": operation("Cancel a file operation", "204", "404", "422"),
+			},
+		},
+	})
+}
+
+func statusCode(value string) int {
+	switch value {
+	case "200":
+		return http.StatusOK
+	case "202":
+		return http.StatusAccepted
+	case "204":
+		return http.StatusNoContent
+	case "400":
+		return http.StatusBadRequest
+	case "401":
+		return http.StatusUnauthorized
+	case "404":
+		return http.StatusNotFound
+	case "403":
+		return http.StatusForbidden
+	case "408":
+		return http.StatusRequestTimeout
+	case "409":
+		return http.StatusConflict
+	case "413":
+		return http.StatusRequestEntityTooLarge
+	case "429":
+		return http.StatusTooManyRequests
+	case "422":
+		return http.StatusUnprocessableEntity
+	default:
+		return http.StatusInternalServerError
+	}
+}
diff --git a/router/router_openapi_test.go b/router/router_openapi_test.go
new file mode 100644
index 00000000..1ef31da9
--- /dev/null
+++ b/router/router_openapi_test.go
@@ -0,0 +1,135 @@
+package router
+
+import (
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestOpenAPIBetterFilesCapabilitiesMatchRuntimeMethods(t *testing.T) {
+	_, _, handler := newBetterFilesHTTPServer(t, 10, 10)
+	request := httptest.NewRequest(http.MethodGet, "/openapi.json", nil)
+	recorder := httptest.NewRecorder()
+	handler.ServeHTTP(recorder, request)
+	require.Equal(t, http.StatusOK, recorder.Code)
+
+	var document struct {
+		Paths map[string]map[string]interface{} `json:"paths"`
+	}
+	require.NoError(t, json.Unmarshal(recorder.Body.Bytes(), &document))
+	expected := map[string][]string{
+		"/upload/file":                                       {"head", "patch", "post"},
+		"/download/directory":                                {"get"},
+		"/api/servers/{server}/files/copy-many":              {"post"},
+		"/api/servers/{server}/files/rename":                 {"put"},
+		"/api/servers/{server}/files/search":                 {"get", "post"},
+		"/api/servers/{server}/files/largest-directories":    {"get"},
+		"/api/servers/{server}/files/fingerprints":           {"get"},
+		"/api/servers/{server}/files/operations/{operation}": {"delete"},
+	}
+	for path, methods := range expected {
+		require.Contains(t, document.Paths, path)
+		for _, method := range methods {
+			require.Contains(t, document.Paths[path], method, "%s %s", method, path)
+		}
+	}
+
+	patch, ok := document.Paths["/upload/file"]["patch"].(map[string]interface{})
+	require.True(t, ok)
+	responses, ok := patch["responses"].(map[string]interface{})
+	require.True(t, ok)
+	for _, status := range []string{"200", "408", "409", "413", "429"} {
+		require.Contains(t, responses, status)
+	}
+	post := document.Paths["/upload/file"]["post"].(map[string]interface{})
+	capability := post["x-betterfiles-folder-upload"].(map[string]interface{})
+	require.Equal(t, float64(1), capability["version"])
+	require.Equal(t, "paths", capability["paths_field"])
+	require.Equal(t, float64(maxMultipartUploadFiles), capability["max_files"])
+	content := post["requestBody"].(map[string]interface{})["content"].(map[string]interface{})
+	schema := content["multipart/form-data"].(map[string]interface{})["schema"].(map[string]interface{})
+	properties := schema["properties"].(map[string]interface{})
+	require.Contains(t, properties, "files")
+	require.Contains(t, properties, "paths")
+	postResponses := post["responses"].(map[string]interface{})
+	for _, status := range []string{"200", "400", "403", "404", "409", "413"} {
+		require.Contains(t, postResponses, status)
+	}
+}
+
+// BFM's capability check requires a POST JSON request schema containing these
+// properties. A version string or a GET/POST route alone is not sufficient.
+func bfmSearchV2Schema(document map[string]interface{}) map[string]interface{} {
+	paths, _ := document["paths"].(map[string]interface{})
+	operation, _ := paths["/api/servers/{server}/files/search"].(map[string]interface{})
+	post, _ := operation["post"].(map[string]interface{})
+	body, _ := post["requestBody"].(map[string]interface{})
+	content, _ := body["content"].(map[string]interface{})
+	jsonBody, _ := content["application/json"].(map[string]interface{})
+	schema, _ := jsonBody["schema"].(map[string]interface{})
+	properties, _ := schema["properties"].(map[string]interface{})
+	for _, name := range []string{"path_filter", "size_filter", "content_filter", "per_page"} {
+		if _, present := properties[name]; !present {
+			return nil
+		}
+	}
+	return schema
+}
+
+func TestOpenAPISearchV2SatisfiesBFMCapabilityDetection(t *testing.T) {
+	_, _, handler := newBetterFilesHTTPServer(t, 10, 10)
+	response := httptest.NewRecorder()
+	handler.ServeHTTP(response, httptest.NewRequest(http.MethodGet, "/openapi.json", nil))
+	require.Equal(t, http.StatusOK, response.Code)
+	var document map[string]interface{}
+	require.NoError(t, json.Unmarshal(response.Body.Bytes(), &document))
+	schema := bfmSearchV2Schema(document)
+	require.NotNil(t, schema)
+	require.Equal(t, false, schema["additionalProperties"])
+	properties := schema["properties"].(map[string]interface{})
+	require.Contains(t, properties, "root")
+	require.NotContains(t, properties, "match_context")
+	for _, name := range []string{"path_filter", "size_filter", "content_filter"} {
+		filter := properties[name].(map[string]interface{})
+		require.ElementsMatch(t, []interface{}{"object", "null"}, filter["type"])
+		require.Nil(t, filter["default"])
+		require.Equal(t, false, filter["additionalProperties"])
+	}
+	path := properties["path_filter"].(map[string]interface{})["properties"].(map[string]interface{})
+	for _, field := range []string{"include", "exclude", "case_insensitive"} {
+		require.Contains(t, path, field)
+	}
+	content := properties["content_filter"].(map[string]interface{})["properties"].(map[string]interface{})
+	for _, field := range []string{"query", "max_search_size", "include_unmatched", "case_insensitive"} {
+		require.Contains(t, content, field)
+	}
+	readLimit := content["max_search_size"].(map[string]interface{})
+	require.Equal(t, float64(0), readLimit["minimum"])
+	require.Equal(t, float64(defaultSearchV2ReadLimit), readLimit["default"])
+	require.Equal(t, float64(maxSearchV2ReadLimit), readLimit["maximum"])
+	post := document["paths"].(map[string]interface{})["/api/servers/{server}/files/search"].(map[string]interface{})["post"].(map[string]interface{})
+	responses := post["responses"].(map[string]interface{})
+	for _, code := range []string{"200", "400", "401", "403", "404", "408", "413", "422", "500"} {
+		require.Contains(t, responses, code)
+	}
+	resultSchema := responses["200"].(map[string]interface{})["content"].(map[string]interface{})["application/json"].(map[string]interface{})["schema"].(map[string]interface{})
+	results := resultSchema["properties"].(map[string]interface{})["results"].(map[string]interface{})
+	require.Equal(t, "array", results["type"])
+	require.Equal(t, float64(maxSearchV2Results), results["maxItems"])
+}
+
+func TestOpenAPILegacyAndSchemaLessSearchDoNotAdvertiseAdvancedSearch(t *testing.T) {
+	for _, fixture := range []string{
+		`{"info":{"version":"999"},"paths":{}}`,
+		`{"paths":{"/api/servers/{server}/files/search":{"get":{}}}}`,
+		`{"paths":{"/api/servers/{server}/files/search":{"get":{},"post":{}}}}`,
+		`{"paths":{"/api/servers/{server}/files/search":{"post":{"requestBody":{"content":{"application/json":{"schema":{"properties":{"query":{},"root":{}}}}}}}}}}`,
+	} {
+		var document map[string]interface{}
+		require.NoError(t, json.Unmarshal([]byte(fixture), &document))
+		require.Nil(t, bfmSearchV2Schema(document))
+	}
+}
diff --git a/router/router_resumable_upload.go b/router/router_resumable_upload.go
new file mode 100755
index 00000000..3cad86dc
--- /dev/null
+++ b/router/router_resumable_upload.go
@@ -0,0 +1,571 @@
+package router
+
+import (
+	"context"
+	"errors"
+	"io"
+	"net"
+	"net/http"
+	"strconv"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/gin-gonic/gin"
+
+	"github.com/pterodactyl/wings/config"
+	"github.com/pterodactyl/wings/internal/models"
+	"github.com/pterodactyl/wings/internal/ufs"
+	"github.com/pterodactyl/wings/router/middleware"
+	"github.com/pterodactyl/wings/router/tokens"
+	"github.com/pterodactyl/wings/server"
+	"github.com/pterodactyl/wings/server/filesystem"
+)
+
+const (
+	maxConcurrentResumableUploads          = 64
+	maxConcurrentResumableUploadsPerServer = 16
+	maxConcurrentResumableUploadsPerToken  = 4
+	maxResumableUploadLocks                = maxConcurrentResumableUploads + 64
+	maxResumableUploadSessions             = 4096
+	maxResumableUploadSessionsPerServer    = 256
+	resumableUploadIdleTimeout             = 30 * time.Second
+)
+
+var errResumableUploadIdleTimeout = errors.New("resumable upload body timed out")
+
+type resumableUploadIdleTimeoutContextKey struct{}
+
+type resumableUploadLockRegistry struct {
+	mu     sync.Mutex
+	active map[string]struct{}
+}
+
+type resumableUploadAdmissionRegistry struct {
+	mu             sync.Mutex
+	globalLimit    int
+	perServerLimit int
+	perTokenLimit  int
+	global         int
+	byServer       map[string]int
+	byToken        map[string]int
+}
+
+type resumableUploadSession struct {
+	serverID string
+	target   string
+	expires  time.Time
+	consumed bool
+}
+
+type resumableUploadSessionRegistry struct {
+	mu             sync.Mutex
+	globalLimit    int
+	perServerLimit int
+	nextExpiry     time.Time
+	sessions       map[string]resumableUploadSession
+	byServer       map[string]int
+}
+
+var uploadLocks = resumableUploadLockRegistry{active: make(map[string]struct{})}
+
+var uploadAdmissions = newResumableUploadAdmissionRegistry(
+	maxConcurrentResumableUploads,
+	maxConcurrentResumableUploadsPerServer,
+	maxConcurrentResumableUploadsPerToken,
+)
+
+var uploadSessions = newResumableUploadSessionRegistry(
+	maxResumableUploadSessions,
+	maxResumableUploadSessionsPerServer,
+)
+
+var uploadBufferPool = sync.Pool{New: func() interface{} {
+	buffer := make([]byte, 64*1024)
+	return &buffer
+}}
+
+var saveUploadActivity = func(s *server.Server, user, ip, filename, directory string) {
+	s.SaveActivity(s.NewRequestActivity(user, ip), server.ActivityFileUploaded, models.ActivityMeta{
+		"file":      filename,
+		"directory": directory,
+	})
+}
+
+func (r *resumableUploadLockRegistry) acquire(key string) (func(), bool) {
+	r.mu.Lock()
+	defer r.mu.Unlock()
+	if _, ok := r.active[key]; ok || len(r.active) >= maxResumableUploadLocks {
+		return nil, false
+	}
+	r.active[key] = struct{}{}
+
+	return func() {
+		r.mu.Lock()
+		delete(r.active, key)
+		r.mu.Unlock()
+	}, true
+}
+
+func newResumableUploadAdmissionRegistry(global, perServer, perToken int) *resumableUploadAdmissionRegistry {
+	return &resumableUploadAdmissionRegistry{
+		globalLimit:    global,
+		perServerLimit: perServer,
+		perTokenLimit:  perToken,
+		byServer:       make(map[string]int),
+		byToken:        make(map[string]int),
+	}
+}
+
+func (r *resumableUploadAdmissionRegistry) acquire(serverID, tokenID string) (func(), bool) {
+	tokenKey := serverID + "\x00" + tokenID
+	r.mu.Lock()
+	if r.global >= r.globalLimit || r.byServer[serverID] >= r.perServerLimit || r.byToken[tokenKey] >= r.perTokenLimit {
+		r.mu.Unlock()
+		return nil, false
+	}
+	r.global++
+	r.byServer[serverID]++
+	r.byToken[tokenKey]++
+	r.mu.Unlock()
+
+	var once sync.Once
+	return func() {
+		once.Do(func() {
+			r.mu.Lock()
+			r.global--
+			r.byServer[serverID]--
+			if r.byServer[serverID] == 0 {
+				delete(r.byServer, serverID)
+			}
+			r.byToken[tokenKey]--
+			if r.byToken[tokenKey] == 0 {
+				delete(r.byToken, tokenKey)
+			}
+			r.mu.Unlock()
+		})
+	}, true
+}
+
+func newResumableUploadSessionRegistry(global, perServer int) *resumableUploadSessionRegistry {
+	return &resumableUploadSessionRegistry{
+		globalLimit:    global,
+		perServerLimit: perServer,
+		sessions:       make(map[string]resumableUploadSession),
+		byServer:       make(map[string]int),
+	}
+}
+
+func (r *resumableUploadSessionRegistry) bind(token *tokens.UploadPayload, serverID, target string) bool {
+	now := time.Now()
+	r.mu.Lock()
+	defer r.mu.Unlock()
+	r.pruneExpired(now)
+
+	if session, ok := r.sessions[token.UniqueId]; ok {
+		return !session.consumed && session.serverID == serverID && session.target == target
+	}
+	if len(r.sessions) >= r.globalLimit || r.byServer[serverID] >= r.perServerLimit {
+		return false
+	}
+	if token.ExpirationTime == nil || !now.Before(token.ExpirationTime.Time) || !token.IsUniqueRequest() {
+		return false
+	}
+
+	expires := token.ExpirationTime.Time
+	r.sessions[token.UniqueId] = resumableUploadSession{
+		serverID: serverID,
+		target:   target,
+		expires:  expires,
+	}
+	r.byServer[serverID]++
+	if r.nextExpiry.IsZero() || expires.Before(r.nextExpiry) {
+		r.nextExpiry = expires
+	}
+	return true
+}
+
+func (r *resumableUploadSessionRegistry) retire(tokenID, serverID, target string) {
+	r.mu.Lock()
+	if session, ok := r.sessions[tokenID]; ok && !session.consumed && session.serverID == serverID && session.target == target {
+		session.target = ""
+		session.consumed = true
+		r.sessions[tokenID] = session
+	}
+	r.mu.Unlock()
+}
+
+func (r *resumableUploadSessionRegistry) pruneExpired(now time.Time) {
+	if r.nextExpiry.IsZero() || now.Before(r.nextExpiry) {
+		return
+	}
+	r.nextExpiry = time.Time{}
+	for id, session := range r.sessions {
+		if !now.Before(session.expires) {
+			delete(r.sessions, id)
+			r.byServer[session.serverID]--
+			if r.byServer[session.serverID] == 0 {
+				delete(r.byServer, session.serverID)
+			}
+			continue
+		}
+		if r.nextExpiry.IsZero() || session.expires.Before(r.nextExpiry) {
+			r.nextExpiry = session.expires
+		}
+	}
+}
+
+func headServerUploadFile(c *gin.Context) {
+	s, token, ok := resumableUploadServer(c)
+	if !ok {
+		return
+	}
+	directory, target, ok := resumableUploadTarget(c, s)
+	_ = directory
+	if !ok {
+		return
+	}
+	if !uploadSessions.bind(token, s.ID(), target) {
+		abortResumableUploadFile(c)
+		return
+	}
+
+	release, ok := uploadLocks.acquire(s.ID() + "\x00" + target)
+	if !ok {
+		c.AbortWithStatusJSON(http.StatusServiceUnavailable, gin.H{"error": "Too many uploads are currently active."})
+		return
+	}
+	defer release()
+
+	offset, err := resumableUploadOffset(s.Filesystem(), target)
+	if err != nil {
+		abortResumableUploadFile(c)
+		return
+	}
+	c.Header("Upload-Offset", strconv.FormatInt(offset, 10))
+	c.Status(http.StatusOK)
+}
+
+func patchServerUploadFile(c *gin.Context) {
+	s, token, ok := resumableUploadServer(c)
+	if !ok {
+		return
+	}
+	directory, target, ok := resumableUploadTarget(c, s)
+	if !ok {
+		return
+	}
+
+	if contentType := c.GetHeader("Content-Type"); contentType != "application/offset+octet-stream" {
+		c.AbortWithStatusJSON(http.StatusUnsupportedMediaType, gin.H{"error": "Content-Type must be application/offset+octet-stream."})
+		return
+	}
+	requestedOffset, ok := parseUploadInteger(c, "Upload-Offset", true)
+	if !ok {
+		return
+	}
+	uploadLength, hasUploadLength, ok := parseOptionalUploadInteger(c, "Upload-Length")
+	if !ok {
+		return
+	}
+	complete, ok := parseUploadComplete(c)
+	if !ok {
+		return
+	}
+
+	maxSize, ok := resumableUploadLimit(c)
+	if !ok {
+		return
+	}
+	if hasUploadLength && uploadLength > maxSize {
+		c.AbortWithStatusJSON(http.StatusRequestEntityTooLarge, gin.H{"error": "The upload exceeds the configured upload limit."})
+		return
+	}
+	if !uploadSessions.bind(token, s.ID(), target) {
+		abortResumableUploadFile(c)
+		return
+	}
+
+	releaseAdmission, ok := uploadAdmissions.acquire(s.ID(), token.UniqueId)
+	if !ok {
+		c.Header("Retry-After", "1")
+		c.AbortWithStatusJSON(http.StatusTooManyRequests, gin.H{"error": "Too many resumable uploads are currently active."})
+		return
+	}
+	defer releaseAdmission()
+
+	release, ok := uploadLocks.acquire(s.ID() + "\x00" + target)
+	if !ok {
+		c.AbortWithStatusJSON(http.StatusConflict, gin.H{"error": "An upload is already active for this file."})
+		return
+	}
+	defer release()
+
+	current, err := resumableUploadOffset(s.Filesystem(), target)
+	if err != nil {
+		abortResumableUploadFile(c)
+		return
+	}
+	c.Header("Upload-Offset", strconv.FormatInt(current, 10))
+	if requestedOffset != current {
+		c.AbortWithStatusJSON(http.StatusConflict, gin.H{"error": "Upload offset does not match the current file size."})
+		return
+	}
+	if current > maxSize || (hasUploadLength && (uploadLength < current || requestedOffset > uploadLength)) {
+		c.AbortWithStatusJSON(http.StatusConflict, gin.H{"error": "Upload length is inconsistent with the current file size."})
+		return
+	}
+
+	allowed := maxSize - current
+	if hasUploadLength && uploadLength-current < allowed {
+		allowed = uploadLength - current
+	}
+	if c.Request.ContentLength >= 0 && c.Request.ContentLength > allowed {
+		c.AbortWithStatusJSON(http.StatusRequestEntityTooLarge, gin.H{"error": "The upload chunk exceeds the remaining upload length."})
+		return
+	}
+	if err := s.Filesystem().HasSpaceFor(maxInt64(c.Request.ContentLength, 0)); err != nil {
+		c.AbortWithStatusJSON(http.StatusInsufficientStorage, gin.H{"error": "The server does not have enough disk space for this upload."})
+		return
+	}
+	if directory != "/" {
+		if err := s.Filesystem().CreateDirectory(pathBase(directory), pathDirectory(directory)); err != nil {
+			middleware.CaptureAndAbort(c, err)
+			return
+		}
+	}
+
+	file, err := s.Filesystem().Touch(target, ufs.O_WRONLY|ufs.O_APPEND|ufs.O_NOFOLLOW)
+	if err != nil {
+		middleware.CaptureAndAbort(c, err)
+		return
+	}
+	rollback := func() {
+		_ = file.Truncate(current)
+	}
+
+	buffer := uploadBufferPool.Get().(*[]byte)
+	defer uploadBufferPool.Put(buffer)
+	deadlineReader := newResumableUploadDeadlineReader(
+		c.Writer,
+		c.Request.Body,
+		resumableUploadIdleTimeoutForRequest(c.Request),
+	)
+	reader := io.LimitReader(&contextUploadReader{ctx: c.Request.Context(), reader: deadlineReader}, allowed+1)
+	written, copyErr := io.CopyBuffer(writerOnly{Writer: file}, reader, *buffer)
+	if deadlineErr := deadlineReader.clear(); copyErr == nil && deadlineErr != nil {
+		copyErr = deadlineErr
+	}
+	if copyErr != nil || written > allowed {
+		rollback()
+		_ = file.Close()
+		if filesystem.IsErrorCode(copyErr, filesystem.ErrCodeDiskSpace) {
+			c.AbortWithStatusJSON(http.StatusInsufficientStorage, gin.H{"error": "The server does not have enough disk space for this upload."})
+		} else if written > allowed {
+			c.AbortWithStatusJSON(http.StatusRequestEntityTooLarge, gin.H{"error": "The upload chunk exceeds the remaining upload length."})
+		} else if errors.Is(copyErr, errResumableUploadIdleTimeout) {
+			c.AbortWithStatusJSON(http.StatusRequestTimeout, gin.H{"error": "The upload body was idle for too long."})
+		} else {
+			middleware.CaptureAndAbort(c, copyErr)
+		}
+		return
+	}
+
+	newOffset := current + written
+	if complete && hasUploadLength && newOffset != uploadLength {
+		rollback()
+		_ = file.Close()
+		c.Header("Upload-Offset", strconv.FormatInt(current, 10))
+		c.AbortWithStatusJSON(http.StatusConflict, gin.H{"error": "Final upload length does not match Upload-Length."})
+		return
+	}
+	if err := file.Close(); err != nil {
+		middleware.CaptureAndAbort(c, err)
+		return
+	}
+	if err := s.Filesystem().Chown(target); err != nil {
+		middleware.CaptureAndAbort(c, err)
+		return
+	}
+
+	if complete {
+		uploadSessions.retire(token.UniqueId, s.ID(), target)
+		saveUploadActivity(s, token.UserUuid, c.ClientIP(), c.Query("file"), directory)
+	}
+
+	c.Header("Upload-Offset", strconv.FormatInt(newOffset, 10))
+	c.Status(http.StatusOK)
+}
+
+func resumableUploadServer(c *gin.Context) (*server.Server, *tokens.UploadPayload, bool) {
+	token := &tokens.UploadPayload{}
+	if err := tokens.ParseToken([]byte(c.Query("token")), token); err != nil {
+		abortResumableUploadFile(c)
+		return nil, nil, false
+	}
+	s, ok := middleware.ExtractManager(c).Get(token.ServerUuid)
+	if !ok || token.UniqueId == "" || token.Denylisted() || !token.HasScope(tokens.FileUpload) {
+		abortResumableUploadFile(c)
+		return nil, nil, false
+	}
+	return s, token, true
+}
+
+func resumableUploadTarget(c *gin.Context, s *server.Server) (string, string, bool) {
+	directory, target, err := normalizeBetterFilesUploadPath(c.Query("directory"), c.Query("file"))
+	if err != nil || ensureBetterFilesAllowed(s.Filesystem(), target) != nil {
+		abortResumableUploadFile(c)
+		return "", "", false
+	}
+	return directory, target, true
+}
+
+func resumableUploadOffset(fs *filesystem.Filesystem, target string) (int64, error) {
+	info, err := fs.UnixFS().Lstat(target)
+	if errors.Is(err, ufs.ErrNotExist) {
+		return 0, nil
+	}
+	if err != nil {
+		return 0, err
+	}
+	if !info.Mode().IsRegular() || info.Mode()&ufs.ModeSymlink != 0 {
+		return 0, errBetterFilesInvalidPath
+	}
+	return info.Size(), nil
+}
+
+func resumableUploadLimit(c *gin.Context) (int64, bool) {
+	megabytes := config.Get().Api.UploadLimit
+	const maxMegabytes = int64(^uint64(0)>>1) / (1024 * 1024)
+	if megabytes <= 0 || megabytes > maxMegabytes {
+		c.AbortWithStatusJSON(http.StatusInternalServerError, gin.H{"error": "Upload limit is not configured correctly."})
+		return 0, false
+	}
+	return megabytes * 1024 * 1024, true
+}
+
+func parseUploadInteger(c *gin.Context, name string, required bool) (int64, bool) {
+	value := c.GetHeader(name)
+	if value == "" && required {
+		c.AbortWithStatusJSON(http.StatusBadRequest, gin.H{"error": name + " header is required."})
+		return 0, false
+	}
+	parsed, err := strconv.ParseInt(value, 10, 64)
+	if err != nil || parsed < 0 {
+		c.AbortWithStatusJSON(http.StatusBadRequest, gin.H{"error": name + " must be a non-negative integer."})
+		return 0, false
+	}
+	return parsed, true
+}
+
+func parseOptionalUploadInteger(c *gin.Context, name string) (int64, bool, bool) {
+	if c.GetHeader(name) == "" {
+		return 0, false, true
+	}
+	value, ok := parseUploadInteger(c, name, false)
+	return value, true, ok
+}
+
+func parseUploadComplete(c *gin.Context) (bool, bool) {
+	switch c.GetHeader("Upload-Complete") {
+	case "", "?0":
+		return false, true
+	case "?1":
+		return true, true
+	default:
+		c.AbortWithStatusJSON(http.StatusBadRequest, gin.H{"error": "Upload-Complete must be ?0 or ?1."})
+		return false, false
+	}
+}
+
+func abortResumableUploadFile(c *gin.Context) {
+	c.AbortWithStatusJSON(http.StatusNotFound, gin.H{"error": "The requested resource was not found on this server."})
+}
+
+type contextUploadReader struct {
+	ctx    context.Context
+	reader io.Reader
+}
+
+type resumableUploadDeadlineReader struct {
+	reader     io.Reader
+	controller *http.ResponseController
+	timeout    time.Duration
+	supported  bool
+}
+
+func newResumableUploadDeadlineReader(writer http.ResponseWriter, reader io.Reader, timeout time.Duration) *resumableUploadDeadlineReader {
+	return &resumableUploadDeadlineReader{
+		reader:     reader,
+		controller: http.NewResponseController(writer),
+		timeout:    timeout,
+	}
+}
+
+func (r *resumableUploadDeadlineReader) Read(buffer []byte) (int, error) {
+	if err := r.setDeadline(time.Now().Add(r.timeout)); err != nil {
+		return 0, err
+	}
+	n, err := r.reader.Read(buffer)
+	if err != nil {
+		var networkError net.Error
+		if errors.As(err, &networkError) && networkError.Timeout() {
+			return n, errors.Join(errResumableUploadIdleTimeout, err)
+		}
+	}
+	return n, err
+}
+
+func (r *resumableUploadDeadlineReader) setDeadline(deadline time.Time) error {
+	err := r.controller.SetReadDeadline(deadline)
+	if err != nil {
+		return err
+	}
+	r.supported = true
+	return nil
+}
+
+func (r *resumableUploadDeadlineReader) clear() error {
+	if !r.supported {
+		return nil
+	}
+	return r.controller.SetReadDeadline(time.Time{})
+}
+
+func resumableUploadIdleTimeoutForRequest(request *http.Request) time.Duration {
+	if timeout, ok := request.Context().Value(resumableUploadIdleTimeoutContextKey{}).(time.Duration); ok && timeout > 0 {
+		return timeout
+	}
+	return resumableUploadIdleTimeout
+}
+
+func (r *contextUploadReader) Read(buffer []byte) (int, error) {
+	select {
+	case <-r.ctx.Done():
+		return 0, r.ctx.Err()
+	default:
+		return r.reader.Read(buffer)
+	}
+}
+
+type writerOnly struct{ io.Writer }
+
+func maxInt64(a, b int64) int64 {
+	if a > b {
+		return a
+	}
+	return b
+}
+
+func pathBase(value string) string {
+	index := strings.LastIndexByte(value, '/')
+	return value[index+1:]
+}
+
+func pathDirectory(value string) string {
+	index := strings.LastIndexByte(value, '/')
+	if index <= 0 {
+		return "/"
+	}
+	return value[:index]
+}
diff --git a/router/router_resumable_upload_test.go b/router/router_resumable_upload_test.go
new file mode 100755
index 00000000..67860ee0
--- /dev/null
+++ b/router/router_resumable_upload_test.go
@@ -0,0 +1,343 @@
+package router
+
+import (
+	"bufio"
+	"bytes"
+	"context"
+	"fmt"
+	"net"
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+	"os"
+	"path/filepath"
+	"strconv"
+	"sync"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	"github.com/gbrlsnchs/jwt/v3"
+	"github.com/stretchr/testify/require"
+
+	"github.com/pterodactyl/wings/router/tokens"
+	"github.com/pterodactyl/wings/server"
+)
+
+func TestResumableUploadBehavior(t *testing.T) {
+	_, s, handler := newBetterFilesHTTPServer(t, 10, 20)
+	token := signBetterFilesUploadToken(t, s.ID())
+	var activities atomic.Int64
+	previousActivity := saveUploadActivity
+	saveUploadActivity = func(_ *server.Server, _, _, _, _ string) { activities.Add(1) }
+	t.Cleanup(func() { saveUploadActivity = previousActivity })
+
+	total := int64(11)
+	first := performResumableRequest(handler, http.MethodPatch, token, "/uploads", "hello.txt", 0, &total, false, bytes.NewBufferString("hello "))
+	require.Equal(t, http.StatusOK, first.Code)
+	require.Equal(t, "6", first.Header().Get("Upload-Offset"))
+	head := performResumableRequest(handler, http.MethodHead, token, "/uploads", "hello.txt", 0, nil, false, nil)
+	require.Equal(t, http.StatusOK, head.Code)
+	require.Equal(t, "6", head.Header().Get("Upload-Offset"))
+	second := performResumableRequest(handler, http.MethodPatch, token, "/uploads", "hello.txt", 6, &total, true, bytes.NewBufferString("world"))
+	require.Equal(t, http.StatusOK, second.Code)
+	require.Equal(t, "11", second.Header().Get("Upload-Offset"))
+	require.Equal(t, []byte("hello world"), readServerHTTPFixture(t, s, "/uploads/hello.txt"))
+	require.Equal(t, int64(1), activities.Load())
+
+	emptyLength := int64(0)
+	emptyToken := signBetterFilesUploadToken(t, s.ID())
+	empty := performResumableRequest(handler, http.MethodPatch, emptyToken, "/uploads", "empty.txt", 0, &emptyLength, true, bytes.NewReader(nil))
+	require.Equal(t, http.StatusOK, empty.Code)
+	info, err := os.Stat(filepath.Join(s.Filesystem().Path(), "uploads", "empty.txt"))
+	require.NoError(t, err)
+	require.Zero(t, info.Size())
+	require.Equal(t, int64(2), activities.Load())
+}
+
+func TestResumableUploadIncorrectOffsetAndFinalLengthRollback(t *testing.T) {
+	_, s, handler := newBetterFilesHTTPServer(t, 10, 20)
+	token := signBetterFilesUploadToken(t, s.ID())
+	previousActivity := saveUploadActivity
+	saveUploadActivity = func(_ *server.Server, _, _, _, _ string) {}
+	t.Cleanup(func() { saveUploadActivity = previousActivity })
+
+	total := int64(4)
+	require.Equal(t, http.StatusOK, performResumableRequest(handler, http.MethodPatch, token, "/", "offset.txt", 0, &total, false, bytes.NewBufferString("ab")).Code)
+	wrong := performResumableRequest(handler, http.MethodPatch, token, "/", "offset.txt", 0, &total, false, bytes.NewBufferString("zz"))
+	require.Equal(t, http.StatusConflict, wrong.Code)
+	require.Equal(t, "2", wrong.Header().Get("Upload-Offset"))
+	require.Equal(t, []byte("ab"), readServerHTTPFixture(t, s, "/offset.txt"))
+
+	lengthMismatch := int64(5)
+	mismatchToken := signBetterFilesUploadToken(t, s.ID())
+	mismatch := performResumableRequest(handler, http.MethodPatch, mismatchToken, "/", "mismatch.txt", 0, &lengthMismatch, true, bytes.NewBufferString("abc"))
+	require.Equal(t, http.StatusConflict, mismatch.Code)
+	require.Equal(t, []byte{}, readServerHTTPFixture(t, s, "/mismatch.txt"))
+}
+
+func TestResumableUploadConcurrentChunksCannotInterleave(t *testing.T) {
+	_, s, handler := newBetterFilesHTTPServer(t, 10, 20)
+	token := signBetterFilesUploadToken(t, s.ID())
+	total := int64(4)
+	responses := make(chan int, 2)
+	var workers sync.WaitGroup
+	for _, content := range []string{"aaaa", "bbbb"} {
+		content := content
+		workers.Add(1)
+		go func() {
+			defer workers.Done()
+			responses <- performResumableRequest(handler, http.MethodPatch, token, "/", "concurrent.txt", 0, &total, false, bytes.NewBufferString(content)).Code
+		}()
+	}
+	workers.Wait()
+	close(responses)
+	counts := map[int]int{}
+	for status := range responses {
+		counts[status]++
+	}
+	require.Equal(t, 1, counts[http.StatusOK])
+	require.Equal(t, 1, counts[http.StatusConflict])
+	data := readServerHTTPFixture(t, s, "/concurrent.txt")
+	require.True(t, bytes.Equal(data, []byte("aaaa")) || bytes.Equal(data, []byte("bbbb")))
+}
+
+func TestResumableUploadLimitsQuotaAndIgnoredPath(t *testing.T) {
+	_, limitedServer, limitedHandler := newBetterFilesHTTPServer(t, 1, 10)
+	limitedToken := signBetterFilesUploadToken(t, limitedServer.ID())
+	tooLarge := int64(1024*1024 + 1)
+	response := performResumableRequest(limitedHandler, http.MethodPatch, limitedToken, "/", "large.bin", 0, &tooLarge, false, bytes.NewReader(nil))
+	require.Equal(t, http.StatusRequestEntityTooLarge, response.Code)
+
+	_, quotaServer, quotaHandler := newBetterFilesHTTPServer(t, 10, 1)
+	quotaToken := signBetterFilesUploadToken(t, quotaServer.ID())
+	body := bytes.Repeat([]byte{'x'}, 1024*1024+1)
+	quotaLength := int64(len(body))
+	response = performResumableRequest(quotaHandler, http.MethodPatch, quotaToken, "/", "quota.bin", 0, &quotaLength, false, bytes.NewReader(body))
+	require.Equal(t, http.StatusInsufficientStorage, response.Code)
+
+	_, ignoredServer, ignoredHandler := newBetterFilesHTTPServer(t, 10, 10, "private/**")
+	ignoredToken := signBetterFilesUploadToken(t, ignoredServer.ID())
+	ignoredLength := int64(1)
+	response = performResumableRequest(ignoredHandler, http.MethodPatch, ignoredToken, "/private", "secret.txt", 0, &ignoredLength, true, bytes.NewBufferString("x"))
+	require.Equal(t, http.StatusNotFound, response.Code)
+}
+
+func TestResumableUploadOffsetHeaderIsDecimalBytes(t *testing.T) {
+	_, s, handler := newBetterFilesHTTPServer(t, 10, 10)
+	token := signBetterFilesUploadToken(t, s.ID())
+	content := []byte("😀")
+	length := int64(len(content))
+	response := performResumableRequest(handler, http.MethodPatch, token, "/", "utf8.txt", 0, &length, false, bytes.NewReader(content))
+	require.Equal(t, http.StatusOK, response.Code)
+	offset, err := strconv.ParseInt(response.Header().Get("Upload-Offset"), 10, 64)
+	require.NoError(t, err)
+	require.Equal(t, int64(4), offset)
+}
+
+func TestResumableUploadTokenIsBoundToOneTargetAndRetiredOnCompletion(t *testing.T) {
+	_, s, handler := newBetterFilesHTTPServer(t, 10, 20)
+	token := signBetterFilesUploadToken(t, s.ID())
+	previousActivity := saveUploadActivity
+	saveUploadActivity = func(_ *server.Server, _, _, _, _ string) {}
+	t.Cleanup(func() { saveUploadActivity = previousActivity })
+	total := int64(4)
+
+	first := performResumableRequest(handler, http.MethodPatch, token, "/", "bound.txt", 0, &total, false, bytes.NewBufferString("ab"))
+	require.Equal(t, http.StatusOK, first.Code)
+
+	replayed := performResumableRequest(handler, http.MethodPatch, token, "/", "other.txt", 0, &total, false, bytes.NewBufferString("xx"))
+	require.Equal(t, http.StatusNotFound, replayed.Code)
+	replayedHead := performResumableRequest(handler, http.MethodHead, token, "/", "other.txt", 0, nil, false, nil)
+	require.Equal(t, http.StatusNotFound, replayedHead.Code)
+
+	completed := performResumableRequest(handler, http.MethodPatch, token, "/", "bound.txt", 2, &total, true, bytes.NewBufferString("cd"))
+	require.Equal(t, http.StatusOK, completed.Code)
+	require.Equal(t, []byte("abcd"), readServerHTTPFixture(t, s, "/bound.txt"))
+
+	retired := performResumableRequest(handler, http.MethodHead, token, "/", "bound.txt", 0, nil, false, nil)
+	require.Equal(t, http.StatusNotFound, retired.Code)
+}
+
+func TestResumableUploadSessionsAreBoundedAndPruneExpiredEntries(t *testing.T) {
+	sessions := newResumableUploadSessionRegistry(1, 1)
+	now := time.Now()
+	first := &tokens.UploadPayload{
+		Payload:  jwt.Payload{ExpirationTime: jwt.NumericDate(now.Add(time.Hour))},
+		UniqueId: fmt.Sprintf("%s-first-%d", t.Name(), now.UnixNano()),
+	}
+	second := &tokens.UploadPayload{
+		Payload:  jwt.Payload{ExpirationTime: jwt.NumericDate(now.Add(time.Hour))},
+		UniqueId: fmt.Sprintf("%s-second-%d", t.Name(), now.UnixNano()),
+	}
+
+	require.True(t, sessions.bind(first, "server", "/first.txt"))
+	require.False(t, sessions.bind(first, "server", "/other.txt"))
+	require.False(t, sessions.bind(second, "server", "/second.txt"), "a full live registry must reject a new session")
+
+	sessions.mu.Lock()
+	expired := sessions.sessions[first.UniqueId]
+	expired.expires = now.Add(-time.Second)
+	sessions.sessions[first.UniqueId] = expired
+	sessions.nextExpiry = expired.expires
+	sessions.mu.Unlock()
+
+	require.True(t, sessions.bind(second, "server", "/second.txt"), "expired entries must be pruned before rejecting a new session")
+	require.Equal(t, 1, sessions.byServer["server"])
+}
+
+func TestResumableUploadCompletedSessionConsumesLongLivedTokenUntilJWTExpiry(t *testing.T) {
+	sessions := newResumableUploadSessionRegistry(1, 1)
+	now := time.Now()
+	expires := jwt.NumericDate(now.Add(2 * time.Hour))
+	token := &tokens.UploadPayload{
+		Payload:  jwt.Payload{ExpirationTime: expires},
+		UniqueId: fmt.Sprintf("%s-%d", t.Name(), now.UnixNano()),
+	}
+
+	require.True(t, sessions.bind(token, "server", "/file.txt"))
+	sessions.retire(token.UniqueId, "server", "/file.txt")
+
+	sessions.mu.Lock()
+	consumed := sessions.sessions[token.UniqueId]
+	sessions.mu.Unlock()
+	require.True(t, consumed.consumed)
+	require.Equal(t, "server", consumed.serverID)
+	require.Empty(t, consumed.target)
+	require.Equal(t, expires.Time, consumed.expires)
+	require.False(t, sessions.bind(token, "server", "/file.txt"))
+	require.False(t, sessions.bind(token, "server", "/other.txt"))
+}
+
+func TestResumableUploadSessionPerServerCapPreservesOtherServers(t *testing.T) {
+	sessions := newResumableUploadSessionRegistry(3, 2)
+	now := time.Now()
+	newToken := func(name string) *tokens.UploadPayload {
+		return &tokens.UploadPayload{
+			Payload:  jwt.Payload{ExpirationTime: jwt.NumericDate(now.Add(time.Hour))},
+			UniqueId: fmt.Sprintf("%s-%s-%d", t.Name(), name, now.UnixNano()),
+		}
+	}
+
+	serverATombstone := newToken("a-1")
+	require.True(t, sessions.bind(serverATombstone, "server-a", "/one.txt"))
+	sessions.retire(serverATombstone.UniqueId, "server-a", "/one.txt")
+	require.True(t, sessions.bind(newToken("a-2"), "server-a", "/two.txt"))
+	require.False(t, sessions.bind(newToken("a-3"), "server-a", "/three.txt"), "active sessions and tombstones must share the per-server cap")
+	require.True(t, sessions.bind(newToken("b-1"), "server-b", "/one.txt"), "another server must retain its own capacity")
+	require.False(t, sessions.bind(newToken("b-2"), "server-b", "/two.txt"), "the global cap must still be enforced")
+	require.Equal(t, 2, sessions.byServer["server-a"])
+	require.Equal(t, 1, sessions.byServer["server-b"])
+}
+
+func TestResumableUploadAdmissionLimitsAndReleases(t *testing.T) {
+	admissions := newResumableUploadAdmissionRegistry(3, 2, 1)
+
+	releaseA, ok := admissions.acquire("server-a", "token-a")
+	require.True(t, ok)
+	_, ok = admissions.acquire("server-a", "token-a")
+	require.False(t, ok, "the per-token limit must be enforced")
+
+	releaseB, ok := admissions.acquire("server-a", "token-b")
+	require.True(t, ok)
+	_, ok = admissions.acquire("server-a", "token-c")
+	require.False(t, ok, "the per-server limit must be enforced")
+
+	releaseC, ok := admissions.acquire("server-b", "token-c")
+	require.True(t, ok)
+	_, ok = admissions.acquire("server-c", "token-d")
+	require.False(t, ok, "the global limit must be enforced")
+
+	releaseA()
+	releaseA()
+	releaseD, ok := admissions.acquire("server-c", "token-d")
+	require.True(t, ok, "releasing a slot must permit a new upload")
+
+	releaseB()
+	releaseC()
+	releaseD()
+	require.Zero(t, admissions.global)
+	require.Empty(t, admissions.byServer)
+	require.Empty(t, admissions.byToken)
+}
+
+func TestResumableUploadPathLockDoesNotQueue(t *testing.T) {
+	locks := resumableUploadLockRegistry{active: make(map[string]struct{})}
+	release, ok := locks.acquire("server\x00/file.txt")
+	require.True(t, ok)
+	_, ok = locks.acquire("server\x00/file.txt")
+	require.False(t, ok, "a second request for the same path must fail without waiting")
+
+	release()
+	release, ok = locks.acquire("server\x00/file.txt")
+	require.True(t, ok)
+	release()
+}
+
+func TestResumableUploadDeadlineReaderFailsClosedWhenUnsupported(t *testing.T) {
+	reader := newResumableUploadDeadlineReader(httptest.NewRecorder(), bytes.NewBufferString("body"), time.Second)
+	_, err := reader.Read(make([]byte, 1))
+	require.ErrorIs(t, err, http.ErrNotSupported)
+}
+
+func TestResumableUploadIdleBodyTimesOutAndReleasesResources(t *testing.T) {
+	_, s, handler := newBetterFilesHTTPServer(t, 10, 20)
+	token := signBetterFilesUploadToken(t, s.ID())
+	previousActivity := saveUploadActivity
+	saveUploadActivity = func(_ *server.Server, _, _, _, _ string) {}
+	t.Cleanup(func() { saveUploadActivity = previousActivity })
+	timedHandler := http.HandlerFunc(func(writer http.ResponseWriter, request *http.Request) {
+		ctx := context.WithValue(request.Context(), resumableUploadIdleTimeoutContextKey{}, 50*time.Millisecond)
+		handler.ServeHTTP(writer, request.WithContext(ctx))
+	})
+	testServer := httptest.NewServer(timedHandler)
+	t.Cleanup(testServer.Close)
+
+	serverURL, err := url.Parse(testServer.URL)
+	require.NoError(t, err)
+	connection, err := net.DialTimeout("tcp", serverURL.Host, time.Second)
+	require.NoError(t, err)
+	t.Cleanup(func() { _ = connection.Close() })
+	require.NoError(t, connection.SetDeadline(time.Now().Add(2*time.Second)))
+
+	query := url.Values{"token": {token}, "directory": {"/"}, "file": {"stalled.txt"}}
+	requestTarget := "/upload/file?" + query.Encode()
+	_, err = fmt.Fprintf(connection,
+		"PATCH %s HTTP/1.1\r\nHost: %s\r\nContent-Type: application/offset+octet-stream\r\nUpload-Offset: 0\r\nUpload-Length: 5\r\nContent-Length: 5\r\nConnection: close\r\n\r\n",
+		requestTarget,
+		serverURL.Host,
+	)
+	require.NoError(t, err)
+	_, err = connection.Write([]byte("he"))
+	require.NoError(t, err)
+
+	started := time.Now()
+	response, err := http.ReadResponse(bufio.NewReader(connection), &http.Request{Method: http.MethodPatch})
+	require.NoError(t, err)
+	t.Cleanup(func() { _ = response.Body.Close() })
+	require.Equal(t, http.StatusRequestTimeout, response.StatusCode)
+	require.Less(t, time.Since(started), time.Second)
+
+	require.Eventually(t, func() bool {
+		uploadAdmissions.mu.Lock()
+		admissionsReleased := uploadAdmissions.byServer[s.ID()] == 0
+		uploadAdmissions.mu.Unlock()
+		uploadLocks.mu.Lock()
+		_, pathLocked := uploadLocks.active[s.ID()+"\x00/stalled.txt"]
+		uploadLocks.mu.Unlock()
+		return admissionsReleased && !pathLocked
+	}, time.Second, 10*time.Millisecond)
+	require.Empty(t, readServerHTTPFixture(t, s, "/stalled.txt"), "a timed-out partial chunk must be rolled back")
+
+	retryRequest, err := http.NewRequest(http.MethodPatch, testServer.URL+requestTarget, bytes.NewBufferString("hello"))
+	require.NoError(t, err)
+	retryRequest.Header.Set("Content-Type", "application/offset+octet-stream")
+	retryRequest.Header.Set("Upload-Offset", "0")
+	retryRequest.Header.Set("Upload-Length", "5")
+	retryRequest.Header.Set("Upload-Complete", "?1")
+	retryResponse, err := testServer.Client().Do(retryRequest)
+	require.NoError(t, err)
+	t.Cleanup(func() { _ = retryResponse.Body.Close() })
+	require.Equal(t, http.StatusOK, retryResponse.StatusCode)
+	require.Equal(t, []byte("hello"), readServerHTTPFixture(t, s, "/stalled.txt"))
+}
diff --git a/router/router_server_archive_nbt.go b/router/router_server_archive_nbt.go
new file mode 100644
index 00000000..f3a3c19c
--- /dev/null
+++ b/router/router_server_archive_nbt.go
@@ -0,0 +1,496 @@
+package router
+
+import (
+	"archive/tar"
+	"archive/zip"
+	"compress/gzip"
+	"errors"
+	"io"
+	"math"
+	"net/http"
+	"os"
+	"path"
+	"sort"
+	"strings"
+	"unicode/utf8"
+
+	"github.com/gin-gonic/gin"
+	"github.com/pterodactyl/wings/internal/ufs"
+	"github.com/pterodactyl/wings/router/middleware"
+	serverfs "github.com/pterodactyl/wings/server/filesystem"
+)
+
+const (
+	betterFilesArchiveMaxEntries = 5000
+	betterFilesArchiveMaxFile    = 512 * 1024 * 1024
+	betterFilesArchiveMaxExtract = 2000
+)
+
+type betterFilesArchiveEntry struct {
+	Name             string `json:"name"`
+	Path             string `json:"path"`
+	Directory        string `json:"directory"`
+	IsDirectory      bool   `json:"is_directory"`
+	CompressedSize   uint64 `json:"compressed_size"`
+	UncompressedSize uint64 `json:"uncompressed_size"`
+	ModifiedAt       string `json:"modified_at"`
+}
+
+type betterFilesArchiveExtractSelection struct {
+	Path        string `json:"path"`
+	IsDirectory bool   `json:"is_directory"`
+}
+
+type betterFilesArchiveExtractRequest struct {
+	File        string                               `json:"file"`
+	Destination string                               `json:"destination"`
+	Entries     []betterFilesArchiveExtractSelection `json:"entries"`
+}
+
+func getServerArchiveList(c *gin.Context) {
+	s := middleware.ExtractServer(c)
+	file, displayPath, ok := betterFilesOpenServerRegularFile(s.Filesystem(), c.Query("file"))
+	if !ok {
+		c.AbortWithStatusJSON(http.StatusBadRequest, gin.H{"error": "Invalid archive path."})
+		return
+	}
+	defer file.Close()
+
+	stat, err := file.Stat()
+	if err != nil {
+		middleware.CaptureAndAbort(c, err)
+		return
+	}
+	if stat.IsDir() || stat.Size() > betterFilesArchiveMaxFile {
+		c.AbortWithStatusJSON(http.StatusBadRequest, gin.H{"error": "Archive is too large or is not a file."})
+		return
+	}
+	if !betterFilesIsArchiveFile(displayPath) {
+		c.AbortWithStatusJSON(http.StatusBadRequest, gin.H{"error": "Only zip, jar, war, tar, tar.gz, and tgz archives can be viewed inline."})
+		return
+	}
+
+	entries, totalEntries, err := betterFilesListArchiveEntries(file, displayPath)
+	if err != nil {
+		c.AbortWithStatusJSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		return
+	}
+
+	sort.SliceStable(entries, func(i, j int) bool {
+		if entries[i].IsDirectory != entries[j].IsDirectory {
+			return entries[i].IsDirectory
+		}
+		return strings.ToLower(entries[i].Path) < strings.ToLower(entries[j].Path)
+	})
+
+	c.JSON(http.StatusOK, gin.H{
+		"file":          displayPath,
+		"entries":       entries,
+		"truncated":     totalEntries > betterFilesArchiveMaxEntries,
+		"total_entries": totalEntries,
+	})
+}
+
+func postServerArchiveExtract(c *gin.Context) {
+	s := middleware.ExtractServer(c)
+	var request betterFilesArchiveExtractRequest
+	if err := c.ShouldBindJSON(&request); err != nil {
+		c.AbortWithStatusJSON(http.StatusBadRequest, gin.H{"error": "Invalid archive extraction request."})
+		return
+	}
+
+	if len(request.Entries) == 0 || len(request.Entries) > betterFilesArchiveMaxExtract {
+		c.AbortWithStatusJSON(http.StatusBadRequest, gin.H{"error": "Select between 1 and 2000 archive entries to extract."})
+		return
+	}
+
+	file, displayPath, ok := betterFilesOpenServerRegularFile(s.Filesystem(), request.File)
+	if !ok {
+		c.AbortWithStatusJSON(http.StatusBadRequest, gin.H{"error": "Invalid archive path."})
+		return
+	}
+	defer file.Close()
+	destinationDisplay, ok := betterFilesResolveServerDirectory(s.Filesystem(), request.Destination, true)
+	if !ok {
+		c.AbortWithStatusJSON(http.StatusBadRequest, gin.H{"error": "Invalid extraction destination."})
+		return
+	}
+
+	stat, err := file.Stat()
+	if err != nil {
+		middleware.CaptureAndAbort(c, err)
+		return
+	}
+	if stat.IsDir() || stat.Size() > betterFilesArchiveMaxFile || !betterFilesIsArchiveFile(displayPath) {
+		c.AbortWithStatusJSON(http.StatusBadRequest, gin.H{"error": "Archive is too large or is not supported."})
+		return
+	}
+
+	selections, err := betterFilesCleanArchiveSelections(request.Entries)
+	if err != nil {
+		c.AbortWithStatusJSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		return
+	}
+
+	count, err := betterFilesExtractArchiveEntries(s.Filesystem(), file, displayPath, destinationDisplay, selections)
+	if err != nil {
+		c.AbortWithStatusJSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		return
+	}
+
+	c.JSON(http.StatusOK, gin.H{
+		"file":        displayPath,
+		"destination": destinationDisplay,
+		"extracted":   count,
+	})
+}
+
+func betterFilesCleanServerPath(raw string, allowRoot bool) (string, bool) {
+	cleaned := strings.TrimSpace(strings.ReplaceAll(raw, "\\", "/"))
+	if cleaned == "" || strings.Contains(cleaned, "\x00") || !utf8.ValidString(cleaned) || len(cleaned) > 4096 {
+		return "", false
+	}
+	if !strings.HasPrefix(cleaned, "/") {
+		cleaned = "/" + cleaned
+	}
+	for _, segment := range strings.Split(cleaned, "/") {
+		if segment == ".." {
+			return "", false
+		}
+	}
+
+	displayPath := path.Clean(cleaned)
+	if displayPath == "." || (!allowRoot && displayPath == "/") || !strings.HasPrefix(displayPath, "/") {
+		return "", false
+	}
+
+	return displayPath, true
+}
+
+func betterFilesOpenServerRegularFile(fs *serverfs.Filesystem, raw string) (ufs.File, string, bool) {
+	displayPath, ok := betterFilesCleanServerPath(raw, false)
+	if !ok {
+		return nil, "", false
+	}
+
+	file, stat, err := fs.File(displayPath)
+	if err != nil {
+		return nil, "", false
+	}
+	if stat.IsDir() || !stat.Mode().IsRegular() {
+		file.Close()
+		return nil, "", false
+	}
+	return file, displayPath, true
+}
+
+func betterFilesResolveServerDirectory(fs *serverfs.Filesystem, raw string, mustExist bool) (string, bool) {
+	displayPath, ok := betterFilesCleanServerPath(raw, true)
+	if !ok {
+		return "", false
+	}
+
+	stat, err := fs.Stat(displayPath)
+	if err != nil {
+		return displayPath, !mustExist
+	}
+	if !stat.IsDir() {
+		return "", false
+	}
+
+	return displayPath, true
+}
+
+func betterFilesIsArchiveFile(value string) bool {
+	return betterFilesIsZipFile(value) || betterFilesIsTarFile(value)
+}
+
+func betterFilesIsZipFile(value string) bool {
+	ext := strings.ToLower(path.Ext(value))
+	return ext == ".zip" || ext == ".jar" || ext == ".war"
+}
+
+func betterFilesIsTarFile(value string) bool {
+	lower := strings.ToLower(value)
+	return strings.HasSuffix(lower, ".tar") || strings.HasSuffix(lower, ".tar.gz") || strings.HasSuffix(lower, ".tgz")
+}
+
+func betterFilesListArchiveEntries(file ufs.File, displayPath string) ([]betterFilesArchiveEntry, int, error) {
+	if betterFilesIsZipFile(displayPath) {
+		return betterFilesListZipEntries(file)
+	}
+	if betterFilesIsTarFile(displayPath) {
+		return betterFilesListTarEntries(file, displayPath)
+	}
+	return nil, 0, errors.New("unsupported archive type")
+}
+
+func betterFilesListZipEntries(file ufs.File) ([]betterFilesArchiveEntry, int, error) {
+	stat, err := file.Stat()
+	if err != nil {
+		return nil, 0, err
+	}
+	reader, err := zip.NewReader(file, stat.Size())
+	if err != nil {
+		return nil, 0, errors.New("could not open zip archive")
+	}
+
+	entryCapacity := len(reader.File)
+	if entryCapacity > betterFilesArchiveMaxEntries {
+		entryCapacity = betterFilesArchiveMaxEntries
+	}
+	entries := make([]betterFilesArchiveEntry, 0, entryCapacity)
+	for idx, entry := range reader.File {
+		if idx >= betterFilesArchiveMaxEntries {
+			break
+		}
+		normalized, ok := betterFilesCleanArchiveEntryPath(entry.Name)
+		if !ok {
+			continue
+		}
+
+		entries = append(entries, betterFilesArchiveEntry{
+			Name:             path.Base(normalized),
+			Path:             "/" + normalized,
+			Directory:        betterFilesArchiveEntryDirectory(normalized),
+			IsDirectory:      entry.FileInfo().IsDir(),
+			CompressedSize:   uint64(entry.CompressedSize64),
+			UncompressedSize: uint64(entry.UncompressedSize64),
+			ModifiedAt:       entry.Modified.Format("2006-01-02T15:04:05Z07:00"),
+		})
+	}
+
+	return entries, len(reader.File), nil
+}
+
+func betterFilesListTarEntries(file ufs.File, displayPath string) ([]betterFilesArchiveEntry, int, error) {
+	if _, err := file.Seek(0, io.SeekStart); err != nil {
+		return nil, 0, err
+	}
+	var archiveReader io.Reader = file
+	if strings.HasSuffix(strings.ToLower(displayPath), ".tar.gz") || strings.HasSuffix(strings.ToLower(displayPath), ".tgz") {
+		gzipReader, err := gzip.NewReader(file)
+		if err != nil {
+			return nil, 0, errors.New("could not open gzip archive")
+		}
+		defer gzipReader.Close()
+		archiveReader = gzipReader
+	}
+
+	tarReader := tar.NewReader(archiveReader)
+	entries := make([]betterFilesArchiveEntry, 0, 128)
+	totalEntries := 0
+	for {
+		header, err := tarReader.Next()
+		if errors.Is(err, io.EOF) {
+			break
+		}
+		if err != nil {
+			return nil, totalEntries, errors.New("could not read tar archive")
+		}
+		totalEntries++
+		if totalEntries > betterFilesArchiveMaxEntries {
+			continue
+		}
+
+		normalized, ok := betterFilesCleanArchiveEntryPath(header.Name)
+		if !ok {
+			continue
+		}
+		isDirectory := header.FileInfo().IsDir() || header.Typeflag == tar.TypeDir
+		uncompressedSize := uint64(0)
+		if header.Size > 0 {
+			uncompressedSize = uint64(header.Size)
+		}
+
+		entries = append(entries, betterFilesArchiveEntry{
+			Name:             path.Base(normalized),
+			Path:             "/" + normalized,
+			Directory:        betterFilesArchiveEntryDirectory(normalized),
+			IsDirectory:      isDirectory,
+			CompressedSize:   0,
+			UncompressedSize: uncompressedSize,
+			ModifiedAt:       header.ModTime.Format("2006-01-02T15:04:05Z07:00"),
+		})
+	}
+
+	return entries, totalEntries, nil
+}
+
+func betterFilesCleanArchiveEntryPath(value string) (string, bool) {
+	entryPath := path.Clean(strings.ReplaceAll(value, "\\", "/"))
+	entryPath = strings.TrimPrefix(entryPath, "/")
+	if entryPath == "." || entryPath == "" || strings.HasPrefix(entryPath, "../") || strings.Contains(entryPath, "/../") {
+		return "", false
+	}
+	return entryPath, true
+}
+
+func betterFilesArchiveEntryDirectory(entryPath string) string {
+	directory := path.Dir(entryPath)
+	if directory == "." {
+		return "/"
+	}
+	return "/" + directory
+}
+
+func betterFilesCleanArchiveSelections(entries []betterFilesArchiveExtractSelection) ([]betterFilesArchiveExtractSelection, error) {
+	selections := make([]betterFilesArchiveExtractSelection, 0, len(entries))
+	seen := map[string]struct{}{}
+	for _, entry := range entries {
+		cleaned, ok := betterFilesCleanArchiveEntryPath(entry.Path)
+		if !ok {
+			return nil, errors.New("Archive selection contains an invalid path.")
+		}
+		key := cleaned
+		if entry.IsDirectory {
+			key += "/"
+		}
+		if _, exists := seen[key]; exists {
+			continue
+		}
+		seen[key] = struct{}{}
+		selections = append(selections, betterFilesArchiveExtractSelection{
+			Path:        cleaned,
+			IsDirectory: entry.IsDirectory,
+		})
+	}
+	return selections, nil
+}
+
+func betterFilesArchiveSelectionMatches(entryPath string, selections []betterFilesArchiveExtractSelection) bool {
+	for _, selection := range selections {
+		if selection.IsDirectory {
+			if entryPath == selection.Path || strings.HasPrefix(entryPath, selection.Path+"/") {
+				return true
+			}
+			continue
+		}
+		if entryPath == selection.Path {
+			return true
+		}
+	}
+	return false
+}
+
+type betterFilesArchiveWritableFilesystem interface {
+	Write(string, io.Reader, int64, os.FileMode) error
+	CreateDirectory(string, string) error
+}
+
+func betterFilesExtractArchiveEntries(fs betterFilesArchiveWritableFilesystem, file ufs.File, displayPath string, destination string, selections []betterFilesArchiveExtractSelection) (int, error) {
+	if betterFilesIsZipFile(displayPath) {
+		return betterFilesExtractZipEntries(fs, file, destination, selections)
+	}
+	if betterFilesIsTarFile(displayPath) {
+		return betterFilesExtractTarEntries(fs, file, displayPath, destination, selections)
+	}
+	return 0, errors.New("unsupported archive type")
+}
+
+func betterFilesExtractOutputPath(destination string, entryPath string) string {
+	return path.Clean(path.Join(destination, entryPath))
+}
+
+func betterFilesExtractZipEntries(fs betterFilesArchiveWritableFilesystem, file ufs.File, destination string, selections []betterFilesArchiveExtractSelection) (int, error) {
+	stat, err := file.Stat()
+	if err != nil {
+		return 0, err
+	}
+	reader, err := zip.NewReader(file, stat.Size())
+	if err != nil {
+		return 0, errors.New("could not open zip archive")
+	}
+
+	extracted := 0
+	for _, entry := range reader.File {
+		normalized, ok := betterFilesCleanArchiveEntryPath(entry.Name)
+		if !ok || !betterFilesArchiveSelectionMatches(normalized, selections) {
+			continue
+		}
+		outputPath := betterFilesExtractOutputPath(destination, normalized)
+		if entry.FileInfo().IsDir() {
+			if err := fs.CreateDirectory(path.Base(outputPath), path.Dir(outputPath)); err != nil {
+				return extracted, err
+			}
+			continue
+		}
+
+		file, err := entry.Open()
+		if err != nil {
+			return extracted, err
+		}
+		if entry.UncompressedSize64 > uint64(math.MaxInt64) {
+			file.Close()
+			return extracted, errors.New("Archive entry is too large to extract.")
+		}
+		err = fs.Write(outputPath, file, int64(entry.UncompressedSize64), entry.FileInfo().Mode().Perm())
+		file.Close()
+		if err != nil {
+			return extracted, err
+		}
+		extracted++
+		if extracted > betterFilesArchiveMaxExtract {
+			return extracted, errors.New("Too many files matched this extraction request.")
+		}
+	}
+
+	if extracted == 0 {
+		return 0, errors.New("No matching archive entries were found.")
+	}
+	return extracted, nil
+}
+
+func betterFilesExtractTarEntries(fs betterFilesArchiveWritableFilesystem, file ufs.File, displayPath string, destination string, selections []betterFilesArchiveExtractSelection) (int, error) {
+	if _, err := file.Seek(0, io.SeekStart); err != nil {
+		return 0, err
+	}
+	var archiveReader io.Reader = file
+	if strings.HasSuffix(strings.ToLower(displayPath), ".tar.gz") || strings.HasSuffix(strings.ToLower(displayPath), ".tgz") {
+		gzipReader, err := gzip.NewReader(file)
+		if err != nil {
+			return 0, errors.New("could not open gzip archive")
+		}
+		defer gzipReader.Close()
+		archiveReader = gzipReader
+	}
+
+	tarReader := tar.NewReader(archiveReader)
+	extracted := 0
+	for {
+		header, err := tarReader.Next()
+		if errors.Is(err, io.EOF) {
+			break
+		}
+		if err != nil {
+			return extracted, errors.New("could not read tar archive")
+		}
+
+		normalized, ok := betterFilesCleanArchiveEntryPath(header.Name)
+		if !ok || !betterFilesArchiveSelectionMatches(normalized, selections) {
+			continue
+		}
+		outputPath := betterFilesExtractOutputPath(destination, normalized)
+		if header.FileInfo().IsDir() || header.Typeflag == tar.TypeDir {
+			if err := fs.CreateDirectory(path.Base(outputPath), path.Dir(outputPath)); err != nil {
+				return extracted, err
+			}
+			continue
+		}
+		if header.Typeflag != tar.TypeReg && header.Typeflag != tar.TypeRegA {
+			continue
+		}
+		if err := fs.Write(outputPath, tarReader, header.Size, header.FileInfo().Mode().Perm()); err != nil {
+			return extracted, err
+		}
+		extracted++
+		if extracted > betterFilesArchiveMaxExtract {
+			return extracted, errors.New("Too many files matched this extraction request.")
+		}
+	}
+
+	if extracted == 0 {
+		return 0, errors.New("No matching archive entries were found.")
+	}
+	return extracted, nil
+}
diff --git a/router/router_server_betterfiles_collaboration.go b/router/router_server_betterfiles_collaboration.go
new file mode 100644
index 00000000..3b91d185
--- /dev/null
+++ b/router/router_server_betterfiles_collaboration.go
@@ -0,0 +1,39 @@
+package router
+
+import (
+	"net/http"
+	"strings"
+
+	"github.com/gin-gonic/gin"
+
+	"github.com/pterodactyl/wings/router/middleware"
+	"github.com/pterodactyl/wings/router/websocket"
+)
+
+type betterFilesCollaborationRevokeRequest struct {
+	Mode   string `json:"mode"`
+	Reason string `json:"reason"`
+}
+
+func postServerBetterFilesCollaborationRevoke(c *gin.Context) {
+	s := middleware.ExtractServer(c)
+
+	var request betterFilesCollaborationRevokeRequest
+	_ = c.ShouldBindJSON(&request)
+
+	mode := strings.TrimSpace(request.Mode)
+	if mode != "edit" && mode != "view" {
+		mode = ""
+	}
+
+	reason := strings.TrimSpace(request.Reason)
+	if reason == "" {
+		reason = "Live collaboration was revoked by an administrator."
+	}
+	if len(reason) > 160 {
+		reason = reason[:160]
+	}
+
+	closed := websocket.CloseBetterFilesCollaborationSessions(s.ID(), mode, reason)
+	c.JSON(http.StatusOK, gin.H{"closed": closed})
+}
diff --git a/router/router_server_files.go b/router/router_server_files.go
index 75618442..b2e287b0 100644
--- a/router/router_server_files.go
+++ b/router/router_server_files.go
@@ -3,15 +3,18 @@ package router
 import (
 	"bufio"
 	"context"
+	"encoding/json"
+	"github.com/pterodactyl/wings/internal/ufs"
 	"io"
+	"io/fs"
 	"mime/multipart"
 	"net/http"
 	"net/url"
 	"os"
 	"path"
-	"path/filepath"
 	"strconv"
 	"strings"
+	"unicode/utf8"
 
 	"emperror.dev/errors"
 	"github.com/apex/log"
@@ -19,7 +22,6 @@ import (
 	"golang.org/x/sync/errgroup"
 
 	"github.com/pterodactyl/wings/config"
-	"github.com/pterodactyl/wings/internal/models"
 	"github.com/pterodactyl/wings/router/downloader"
 	"github.com/pterodactyl/wings/router/middleware"
 	"github.com/pterodactyl/wings/router/tokens"
@@ -138,6 +140,7 @@ func putServerRenameFiles(c *gin.Context) {
 					}
 					return err
 				}
+				s.RenameFileHistory(pf, pt)
 				return nil
 			}
 		})
@@ -214,7 +217,11 @@ func postServerDeleteFiles(c *gin.Context) {
 			case <-ctx.Done():
 				return ctx.Err()
 			default:
-				return s.Filesystem().Delete(pi)
+				if err := s.Filesystem().Delete(pi); err != nil {
+					return err
+				}
+				s.ForgetFileHistory(pi)
+				return nil
 			}
 		})
 	}
@@ -247,6 +254,12 @@ func postServerWriteFile(c *gin.Context) {
 		return
 	}
 
+	var before []byte
+	trackRevision := server.ShouldRecordFileHistory(f, uint64(c.Request.ContentLength))
+	if trackRevision {
+		before, _ = captureFileRevisionContent(s, f)
+	}
+
 	if err := s.Filesystem().Write(f, c.Request.Body, c.Request.ContentLength, 0o644); err != nil {
 		if filesystem.IsErrorCode(err, filesystem.ErrCodeIsDirectory) {
 			c.AbortWithStatusJSON(http.StatusBadRequest, gin.H{
@@ -259,6 +272,18 @@ func postServerWriteFile(c *gin.Context) {
 		return
 	}
 
+	if trackRevision {
+		after, ok := captureFileRevisionContent(s, f)
+		if ok {
+			revisionID, err := s.RecordFileRevision(f, before, after, strings.TrimSpace(c.Query("user")))
+			if err != nil {
+				s.Log().WithError(err).WithField("path", f).Warn("failed to record file revision")
+			} else if revisionID > 0 {
+				c.Header("X-File-Revision-Id", strconv.FormatInt(revisionID, 10))
+			}
+		}
+	}
+
 	c.Status(http.StatusNoContent)
 }
 
@@ -565,6 +590,16 @@ func postServerChmodFile(c *gin.Context) {
 	c.Status(http.StatusNoContent)
 }
 
+const (
+	maxMultipartUploadFiles    = 512
+	maxMultipartUploadOverhead = int64(8 * 1024 * 1024)
+)
+
+type multipartUploadTarget struct {
+	header *multipart.FileHeader
+	path   string
+}
+
 func postServerUploadFiles(c *gin.Context) {
 	manager := middleware.ExtractManager(c)
 
@@ -575,57 +610,195 @@ func postServerUploadFiles(c *gin.Context) {
 	}
 
 	s, ok := manager.Get(token.ServerUuid)
-	if !ok || token.Denylisted() || !token.IsUniqueRequest() || !token.HasScope(tokens.FileUpload) {
+	if !ok || token.Denylisted() || !token.HasScope(tokens.FileUpload) || !token.IsUniqueRequest() {
 		c.AbortWithStatusJSON(http.StatusNotFound, gin.H{
 			"error": "The requested resource was not found on this server.",
 		})
 		return
 	}
 
+	maxFileSize := config.Get().Api.UploadLimit
+	const maxUploadLimitMB = int64(1<<63-1) / (1024 * 1024)
+	if maxFileSize <= 0 || maxFileSize > maxUploadLimitMB {
+		c.AbortWithStatusJSON(http.StatusInternalServerError, gin.H{"error": "Upload limit is not configured correctly."})
+		return
+	}
+	maxFileSizeBytes := maxFileSize * 1024 * 1024
+	maxBodyBytes := int64(1<<63 - 1)
+	if maxFileSizeBytes <= maxBodyBytes-maxMultipartUploadOverhead {
+		maxBodyBytes = maxFileSizeBytes + maxMultipartUploadOverhead
+	}
+	c.Request.Body = http.MaxBytesReader(c.Writer, c.Request.Body, maxBodyBytes)
 	form, err := c.MultipartForm()
 	if err != nil {
+		var tooLarge *http.MaxBytesError
+		if errors.As(err, &tooLarge) {
+			c.AbortWithStatusJSON(http.StatusRequestEntityTooLarge, gin.H{"error": "The multipart request exceeds the upload limit."})
+			return
+		}
 		c.AbortWithStatusJSON(http.StatusBadRequest, gin.H{
 			"error": "Failed to get multipart form data from request.",
 		})
 		return
 	}
+	defer form.RemoveAll()
 
-	headers, ok := form.File["files"]
-	if !ok {
-		c.AbortWithStatusJSON(http.StatusBadRequest, gin.H{
-			"error": "No files were found on the request body.",
-		})
+	directory, err := normalizeBetterFilesRoot(c.Query("directory"))
+	if err != nil {
+		c.AbortWithStatusJSON(http.StatusBadRequest, gin.H{"error": "Invalid upload directory."})
 		return
 	}
-
-	directory := c.Query("directory")
-
-	maxFileSize := config.Get().Api.UploadLimit
-	maxFileSizeBytes := maxFileSize * 1024 * 1024
-	var totalSize int64
-	for _, header := range headers {
-		if header.Size > maxFileSizeBytes {
-			c.AbortWithStatusJSON(http.StatusBadRequest, gin.H{
-				"error": "File " + header.Filename + " is larger than the maximum file upload size of " + strconv.FormatInt(maxFileSize, 10) + " MB.",
-			})
+	targets, err := multipartUploadTargets(form, directory, maxFileSizeBytes)
+	if err != nil {
+		c.AbortWithStatusJSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		return
+	}
+	// Reject invalid/ignored destinations and insufficient aggregate quota before
+	// creating directories or writing any file. Runtime writes recheck quota atomically.
+	var growth, projectedGrowth int64
+	plannedSizes := make(map[string]int64, len(targets))
+	for _, target := range targets {
+		if err := ensureBetterFilesAllowed(s.Filesystem(), target.path); err != nil {
+			middleware.CaptureAndAbort(c, err)
+			return
+		}
+		oldSize, err := multipartUploadExistingSize(s.Filesystem(), target.path)
+		if err != nil {
+			c.AbortWithStatusJSON(http.StatusBadRequest, gin.H{"error": "An upload destination is not a regular file or contains a symbolic link."})
 			return
 		}
-		totalSize += header.Size
+		if prior, exists := plannedSizes[target.path]; exists {
+			oldSize = prior
+		}
+		plannedSizes[target.path] = target.header.Size
+		delta := target.header.Size - oldSize
+		// Simulate sequential overwrites, including earlier shrinks and repeated
+		// flat filenames. More than one request's worth of shrink credit cannot
+		// affect the peak, so cap it to keep all arithmetic within int64.
+		if delta < 0 && projectedGrowth < -maxFileSizeBytes-delta {
+			projectedGrowth = -maxFileSizeBytes
+		} else {
+			projectedGrowth += delta
+		}
+		if projectedGrowth > growth {
+			growth = projectedGrowth
+		}
 	}
-
-	for _, header := range headers {
-		// We run this in a different method so I can use defer without any of
-		// the consequences caused by calling it in a loop.
-		if err := handleFileUpload(filepath.Join(directory, header.Filename), s, header); err != nil {
+	if err := s.Filesystem().HasSpaceFor(growth); err != nil {
+		middleware.CaptureAndAbort(c, err)
+		return
+	}
+	for _, target := range targets {
+		release, ok := uploadLocks.acquire(s.ID() + "\x00" + target.path)
+		if !ok {
+			c.AbortWithStatusJSON(http.StatusConflict, gin.H{"error": "An upload is already active for this file."})
+			return
+		}
+		err := handleFileUpload(target.path, s, target.header)
+		release()
+		if err != nil {
 			middleware.CaptureAndAbort(c, err)
 			return
-		} else {
-			s.SaveActivity(s.NewRequestActivity(token.UserUuid, c.ClientIP()), server.ActivityFileUploaded, models.ActivityMeta{
-				"file":      header.Filename,
-				"directory": filepath.Clean(directory),
-			})
 		}
+		saveUploadActivity(s, token.UserUuid, c.ClientIP(), path.Base(target.path), path.Dir(target.path))
+	}
+}
+
+// paths is an optional JSON array of relative paths, in files-part order. Never
+// recover paths from FileHeader.Filename: mime/multipart already strips directories.
+func multipartUploadTargets(form *multipart.Form, directory string, limit int64) ([]multipartUploadTarget, error) {
+	headers := form.File["files"]
+	if len(headers) == 0 {
+		return nil, errors.New("No files were found on the request body.")
+	}
+	var paths []string
+	values, hasPaths := form.Value["paths"]
+	if hasPaths && len(headers) > maxMultipartUploadFiles {
+		return nil, errors.New("A folder batch may contain at most 512 files.")
+	}
+	if len(form.File["paths"]) != 0 {
+		return nil, errors.New("paths must be a JSON text field.")
+	}
+	if hasPaths {
+		if len(values) != 1 || len(values[0]) > maxMultipartUploadFiles*(betterFilesMaxPathLength+8) || !utf8.ValidString(values[0]) {
+			return nil, errors.New("Exactly one bounded paths manifest is required.")
+		}
+		if err := json.Unmarshal([]byte(values[0]), &paths); err != nil || len(paths) != len(headers) {
+			return nil, errors.New("paths must be a JSON array with one relative path per file, in the same order.")
+		}
+	}
+	targets := make([]multipartUploadTarget, 0, len(headers))
+	seen := make(map[string]struct{}, len(headers))
+	var total int64
+	for i, header := range headers {
+		if header.Size < 0 || header.Size > limit-total {
+			return nil, errors.New("The files exceed the maximum total upload size.")
+		}
+		total += header.Size
+		name, ok := cleanUploadFilename(header.Filename)
+		if !ok {
+			return nil, errors.New("Invalid upload filename.")
+		}
+		if hasPaths {
+			name = paths[i]
+			// ValidPath rejects empty, absolute, dot, parent and empty components.
+			// Backslashes and Windows drive prefixes are rejected explicitly.
+			if !fs.ValidPath(name) || strings.ContainsAny(name, "\\\x00") ||
+				(len(name) >= 2 && name[1] == ':') || path.Base(name) != header.Filename {
+				return nil, errors.New("Invalid relative upload path or mismatched filename.")
+			}
+		}
+		target, err := joinBetterFilesPath(directory, name)
+		if err != nil {
+			return nil, errors.New("Invalid relative upload path.")
+		}
+		if _, exists := seen[target]; hasPaths && exists {
+			return nil, errors.New("Duplicate upload destination.")
+		}
+		seen[target] = struct{}{}
+		targets = append(targets, multipartUploadTarget{header: header, path: target})
+	}
+	for target := range seen {
+		for parent := path.Dir(target); parent != "/"; parent = path.Dir(parent) {
+			if _, exists := seen[parent]; exists {
+				return nil, errors.New("An upload destination is also used as a directory.")
+			}
+		}
+	}
+	return targets, nil
+}
+
+func multipartUploadExistingSize(files *filesystem.Filesystem, target string) (int64, error) {
+	parts := strings.Split(strings.TrimPrefix(target, "/"), "/")
+	for i := range parts {
+		info, err := files.UnixFS().Lstat(strings.Join(parts[:i+1], "/"))
+		if errors.Is(err, ufs.ErrNotExist) {
+			return 0, nil
+		}
+		if err != nil {
+			return 0, err
+		}
+		if info.Mode()&ufs.ModeSymlink != 0 {
+			return 0, errBetterFilesInvalidPath
+		}
+		if i == len(parts)-1 {
+			if !info.Mode().IsRegular() {
+				return 0, errBetterFilesInvalidPath
+			}
+			return info.Size(), nil
+		}
+		if !info.IsDir() {
+			return 0, errBetterFilesInvalidPath
+		}
+	}
+	return 0, errBetterFilesInvalidPath
+}
+
+func cleanUploadFilename(name string) (string, bool) {
+	if name == "" || name == "." || name == ".." || strings.ContainsAny(name, `/\`) {
+		return "", false
 	}
+	return name, true
 }
 
 func handleFileUpload(p string, s *server.Server, header *multipart.FileHeader) error {
@@ -635,11 +808,11 @@ func handleFileUpload(p string, s *server.Server, header *multipart.FileHeader)
 	}
 	defer file.Close()
 
-	if err := s.Filesystem().IsIgnored(p); err != nil {
+	if err := ensureBetterFilesAllowed(s.Filesystem(), p); err != nil {
 		return err
 	}
 
-	if err := s.Filesystem().Write(p, file, header.Size, 0o644); err != nil {
+	if err := s.Filesystem().WriteUpload(p, file, header.Size); err != nil {
 		return err
 	}
 	return nil
diff --git a/router/router_server_files_copy_many.go b/router/router_server_files_copy_many.go
new file mode 100644
index 00000000..814c57b2
--- /dev/null
+++ b/router/router_server_files_copy_many.go
@@ -0,0 +1,345 @@
+package router
+
+import (
+	"context"
+	"errors"
+	"io"
+	"math"
+	"net/http"
+	pathpkg "path"
+	"strings"
+
+	"github.com/gin-gonic/gin"
+	"github.com/google/uuid"
+
+	"github.com/pterodactyl/wings/internal/ufs"
+	"github.com/pterodactyl/wings/router/middleware"
+	"github.com/pterodactyl/wings/server"
+	serverfs "github.com/pterodactyl/wings/server/filesystem"
+)
+
+const (
+	maxCopyManyItems   = 1000
+	maxCopyWalkEntries = 500000
+	maxCopyWalkDepth   = 256
+)
+
+type copyManyFile struct {
+	From string `json:"from"`
+	To   string `json:"to"`
+}
+
+type copyManyPayload struct {
+	Root       string         `json:"root"`
+	Files      []copyManyFile `json:"files"`
+	Overwrite  bool           `json:"overwrite"`
+	Foreground *bool          `json:"foreground"`
+}
+
+type normalizedCopyManyFile struct {
+	from        string
+	to          string
+	requestedTo string
+}
+
+func postServerCopyMany(c *gin.Context) {
+	s := middleware.ExtractServer(c)
+	var data copyManyPayload
+	if err := c.ShouldBindJSON(&data); err != nil {
+		c.AbortWithStatusJSON(http.StatusBadRequest, gin.H{"error": "Invalid copy request."})
+		return
+	}
+	if len(data.Files) == 0 || len(data.Files) > maxCopyManyItems {
+		c.AbortWithStatusJSON(http.StatusUnprocessableEntity, gin.H{"error": "Between 1 and 1000 copy entries are required."})
+		return
+	}
+
+	root, err := normalizeBetterFilesRoot(data.Root)
+	if err != nil {
+		abortBetterFilesPath(c, err)
+		return
+	}
+	files, skipped, err := prepareCopyMany(s.Filesystem(), root, data.Files, data.Overwrite)
+	if err != nil {
+		abortBetterFilesPath(c, err)
+		return
+	}
+
+	foreground := true
+	if data.Foreground != nil {
+		foreground = *data.Foreground
+	}
+	parent := s.Context()
+	if foreground {
+		parent = c.Request.Context()
+	}
+
+	copied := 0
+	operation, done, err := s.FileOperations().Start(parent, "copy_many", func(ctx context.Context, operation *server.FileOperation) error {
+		total, err := copyManyTotal(ctx, s.Filesystem(), files)
+		if err != nil {
+			return err
+		}
+		operation.SetBytesTotal(total)
+		for _, file := range files {
+			if err := copyManyPath(ctx, s.Filesystem(), file.from, file.to, data.Overwrite, operation); err != nil {
+				return err
+			}
+			copied++
+		}
+		return nil
+	})
+	if err != nil {
+		c.AbortWithStatusJSON(http.StatusTooManyRequests, gin.H{"error": "Too many file operations are active."})
+		return
+	}
+
+	if !foreground {
+		c.JSON(http.StatusAccepted, gin.H{"identifier": operation.Identifier(), "skipped": skipped})
+		return
+	}
+	if err := <-done; err != nil {
+		c.AbortWithStatusJSON(http.StatusExpectationFailed, gin.H{"error": "File copy operation failed or was cancelled."})
+		return
+	}
+	c.JSON(http.StatusOK, gin.H{"copied": copied, "skipped": skipped})
+}
+
+func prepareCopyMany(fs *serverfs.Filesystem, root string, input []copyManyFile, overwrite bool) ([]normalizedCopyManyFile, []betterFilesEntry, error) {
+	files := make([]normalizedCopyManyFile, 0, len(input))
+	skipped := make([]betterFilesEntry, 0)
+	destinations := make(map[string]struct{}, len(input))
+
+	for _, requested := range input {
+		from, err := joinBetterFilesPath(root, requested.From)
+		if err != nil {
+			return nil, nil, err
+		}
+		to, err := joinBetterFilesPath(root, requested.To)
+		if err != nil || from == to {
+			return nil, nil, errBetterFilesInvalidPath
+		}
+		if _, exists := destinations[to]; exists {
+			return nil, nil, errBetterFilesInvalidPath
+		}
+		destinations[to] = struct{}{}
+		if err := ensureBetterFilesAllowed(fs, from, to); err != nil {
+			return nil, nil, err
+		}
+
+		sourceInfo, err := betterFilesLstat(fs, from)
+		if err != nil || (!sourceInfo.IsDir() && !sourceInfo.Mode().IsRegular()) {
+			return nil, nil, errBetterFilesInvalidPath
+		}
+		if sourceInfo.IsDir() && strings.HasPrefix(to+"/", from+"/") {
+			return nil, nil, errBetterFilesInvalidPath
+		}
+
+		destinationInfo, destinationErr := fs.UnixFS().Lstat(to)
+		if destinationErr == nil {
+			if destinationInfo.Mode()&ufs.ModeSymlink != 0 {
+				return nil, nil, errBetterFilesInvalidPath
+			}
+			if !overwrite {
+				skipped = append(skipped, newBetterFilesEntry(requested.To, destinationInfo, betterFilesMime(fs, to, destinationInfo)))
+				continue
+			}
+			if sourceInfo.IsDir() != destinationInfo.IsDir() {
+				return nil, nil, errBetterFilesInvalidPath
+			}
+		} else if !errors.Is(destinationErr, ufs.ErrNotExist) {
+			return nil, nil, destinationErr
+		}
+
+		files = append(files, normalizedCopyManyFile{from: from, to: to, requestedTo: requested.To})
+	}
+	return files, skipped, nil
+}
+
+type copyWalkItem struct {
+	from  string
+	to    string
+	depth int
+}
+
+type copyProgress interface {
+	AddBytesProcessed(uint64)
+	AddFilesProcessed(uint64)
+}
+
+func copyManyTotal(ctx context.Context, fs *serverfs.Filesystem, files []normalizedCopyManyFile) (uint64, error) {
+	var total uint64
+	for _, file := range files {
+		stack := []copyWalkItem{{from: file.from, to: file.to}}
+		visited := 0
+		for len(stack) > 0 {
+			if err := ctx.Err(); err != nil {
+				return 0, err
+			}
+			item := stack[len(stack)-1]
+			stack = stack[:len(stack)-1]
+			visited++
+			if visited > maxCopyWalkEntries || item.depth > maxCopyWalkDepth {
+				return 0, errors.New("copy traversal limit exceeded")
+			}
+
+			info, err := betterFilesLstat(fs, item.from)
+			if err != nil {
+				return 0, err
+			}
+			if info.Mode().IsRegular() {
+				if uint64(info.Size()) > math.MaxUint64-total {
+					return 0, errors.New("copy size overflow")
+				}
+				total += uint64(info.Size())
+				continue
+			}
+			if !info.IsDir() {
+				continue
+			}
+			entries, err := fs.ReadDirStat(item.from)
+			if err != nil {
+				return 0, err
+			}
+			for _, entry := range entries {
+				childFrom := pathpkg.Join(item.from, entry.Name())
+				childTo := pathpkg.Join(item.to, entry.Name())
+				if ensureBetterFilesAllowed(fs, childFrom, childTo) != nil || entry.Mode()&ufs.ModeSymlink != 0 {
+					continue
+				}
+				stack = append(stack, copyWalkItem{from: childFrom, to: childTo, depth: item.depth + 1})
+			}
+		}
+	}
+	return total, nil
+}
+
+func copyManyPath(ctx context.Context, fs *serverfs.Filesystem, from, to string, overwrite bool, operation copyProgress) error {
+	stack := []copyWalkItem{{from: from, to: to}}
+	visited := 0
+	for len(stack) > 0 {
+		if err := ctx.Err(); err != nil {
+			return err
+		}
+		item := stack[len(stack)-1]
+		stack = stack[:len(stack)-1]
+		visited++
+		if visited > maxCopyWalkEntries || item.depth > maxCopyWalkDepth {
+			return errors.New("copy traversal limit exceeded")
+		}
+
+		info, err := betterFilesLstat(fs, item.from)
+		if err != nil {
+			return err
+		}
+		switch {
+		case info.IsDir():
+			if err := ensureCopyDestinationDirectory(fs, item.to); err != nil {
+				return err
+			}
+			entries, err := fs.ReadDirStat(item.from)
+			if err != nil {
+				return err
+			}
+			for i := len(entries) - 1; i >= 0; i-- {
+				entry := entries[i]
+				childFrom := pathpkg.Join(item.from, entry.Name())
+				childTo := pathpkg.Join(item.to, entry.Name())
+				if ensureBetterFilesAllowed(fs, childFrom, childTo) != nil || entry.Mode()&ufs.ModeSymlink != 0 {
+					continue
+				}
+				stack = append(stack, copyWalkItem{from: childFrom, to: childTo, depth: item.depth + 1})
+			}
+		case info.Mode().IsRegular():
+			if !overwrite {
+				if _, err := fs.UnixFS().Lstat(item.to); err == nil {
+					continue
+				} else if !errors.Is(err, ufs.ErrNotExist) {
+					return err
+				}
+			}
+			if err := copyManyRegularFile(ctx, fs, item.from, item.to, info, operation); err != nil {
+				return err
+			}
+		default:
+			continue
+		}
+	}
+	return nil
+}
+
+func ensureCopyDestinationDirectory(fs *serverfs.Filesystem, destination string) error {
+	info, err := fs.UnixFS().Lstat(destination)
+	if err == nil {
+		if !info.IsDir() || info.Mode()&ufs.ModeSymlink != 0 {
+			return errBetterFilesInvalidPath
+		}
+		return nil
+	}
+	if !errors.Is(err, ufs.ErrNotExist) {
+		return err
+	}
+	return fs.CreateDirectory(pathpkg.Base(destination), pathpkg.Dir(destination))
+}
+
+func copyManyRegularFile(ctx context.Context, fs *serverfs.Filesystem, source, destination string, sourceInfo ufs.FileInfo, operation copyProgress) error {
+	file, err := fs.UnixFS().OpenFile(source, ufs.O_RDONLY|ufs.O_NOFOLLOW, 0)
+	if err != nil {
+		return err
+	}
+	openedInfo, err := file.Stat()
+	if err != nil {
+		_ = file.Close()
+		return err
+	}
+	if !openedInfo.Mode().IsRegular() {
+		_ = file.Close()
+		return errBetterFilesInvalidPath
+	}
+
+	temporary := pathpkg.Join(pathpkg.Dir(destination), ".wings-copy-"+uuid.NewString())
+	installed := false
+	defer func() {
+		_ = file.Close()
+		if !installed {
+			_ = fs.Delete(temporary)
+		}
+	}()
+
+	reader := &copyProgressReader{ctx: ctx, reader: io.LimitReader(file, openedInfo.Size()), operation: operation}
+	if err := fs.Write(temporary, reader, openedInfo.Size(), sourceInfo.Mode()&ufs.ModePerm); err != nil {
+		return err
+	}
+	temporaryInfo, err := fs.UnixFS().Lstat(temporary)
+	if err != nil || temporaryInfo.Size() != openedInfo.Size() {
+		return errors.New("source changed while it was copied")
+	}
+	if err := ctx.Err(); err != nil {
+		return err
+	}
+	if err := fs.Replace(temporary, destination); err != nil {
+		return err
+	}
+	installed = true
+	operation.AddFilesProcessed(1)
+	return nil
+}
+
+type copyProgressReader struct {
+	ctx       context.Context
+	reader    io.Reader
+	operation copyProgress
+}
+
+func (r *copyProgressReader) Read(buffer []byte) (int, error) {
+	select {
+	case <-r.ctx.Done():
+		return 0, r.ctx.Err()
+	default:
+	}
+	n, err := r.reader.Read(buffer)
+	if n > 0 {
+		r.operation.AddBytesProcessed(uint64(n))
+	}
+	return n, err
+}
diff --git a/router/router_server_files_copy_many_test.go b/router/router_server_files_copy_many_test.go
new file mode 100644
index 00000000..181e3bf3
--- /dev/null
+++ b/router/router_server_files_copy_many_test.go
@@ -0,0 +1,138 @@
+package router
+
+import (
+	"context"
+	"os"
+	"path/filepath"
+	"strings"
+	"sync"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/require"
+)
+
+type testCopyProgress struct {
+	bytes   atomic.Uint64
+	files   atomic.Uint64
+	started chan struct{}
+	once    sync.Once
+}
+
+func (p *testCopyProgress) AddBytesProcessed(value uint64) {
+	p.bytes.Add(value)
+	if p.started != nil && value > 0 {
+		p.once.Do(func() { close(p.started) })
+	}
+}
+
+func (p *testCopyProgress) AddFilesProcessed(value uint64) {
+	p.files.Add(value)
+}
+
+func TestCopyManyRecursiveMultipleAndOverwrite(t *testing.T) {
+	fs := newBetterFilesTestFilesystem(t, 0)
+	writeBetterFilesFixture(t, fs, "/source/one.txt", []byte("one"))
+	writeBetterFilesFixture(t, fs, "/source/nested/two.txt", []byte("two"))
+	writeBetterFilesFixture(t, fs, "/single.txt", []byte("single"))
+	writeBetterFilesFixture(t, fs, "/destination/one.txt", []byte("old"))
+
+	progress := &testCopyProgress{}
+	require.NoError(t, copyManyPath(context.Background(), fs, "/source", "/destination", true, progress))
+	require.NoError(t, copyManyPath(context.Background(), fs, "/single.txt", "/single-copy.txt", true, progress))
+	require.Equal(t, []byte("one"), readBetterFilesFixture(t, fs, "/destination/one.txt"))
+	require.Equal(t, []byte("two"), readBetterFilesFixture(t, fs, "/destination/nested/two.txt"))
+	require.Equal(t, []byte("single"), readBetterFilesFixture(t, fs, "/single-copy.txt"))
+	require.Equal(t, uint64(3), progress.files.Load())
+}
+
+func TestCopyManySkipsExistingAndRejectsTraversal(t *testing.T) {
+	fs := newBetterFilesTestFilesystem(t, 0)
+	writeBetterFilesFixture(t, fs, "/source.txt", []byte("source"))
+	writeBetterFilesFixture(t, fs, "/existing.txt", []byte("existing"))
+	files, skipped, err := prepareCopyMany(fs, "/", []copyManyFile{{From: "source.txt", To: "existing.txt"}}, false)
+	require.NoError(t, err)
+	require.Empty(t, files)
+	require.Len(t, skipped, 1)
+	require.Equal(t, "existing.txt", skipped[0].Name)
+
+	_, _, err = prepareCopyMany(fs, "/", []copyManyFile{{From: "../source.txt", To: "copy.txt"}}, false)
+	require.Error(t, err)
+}
+
+func TestCopyManyCancellationLeavesExistingDestinationUntouched(t *testing.T) {
+	fs := newBetterFilesTestFilesystem(t, 0)
+	sourcePath := filepath.Join(fs.Path(), "large.bin")
+	file, err := os.Create(sourcePath)
+	require.NoError(t, err)
+	require.NoError(t, file.Truncate(128*1024*1024))
+	require.NoError(t, file.Close())
+	writeBetterFilesFixture(t, fs, "/destination.bin", []byte("original"))
+
+	ctx, cancel := context.WithCancel(context.Background())
+	progress := &testCopyProgress{started: make(chan struct{})}
+	result := make(chan error, 1)
+	go func() {
+		result <- copyManyPath(ctx, fs, "/large.bin", "/destination.bin", true, progress)
+	}()
+	select {
+	case <-progress.started:
+		cancel()
+	case <-time.After(3 * time.Second):
+		cancel()
+		t.Fatal("copy did not begin")
+	}
+	require.Error(t, <-result)
+	require.Equal(t, []byte("original"), readBetterFilesFixture(t, fs, "/destination.bin"))
+	entries, err := os.ReadDir(fs.Path())
+	require.NoError(t, err)
+	for _, entry := range entries {
+		require.False(t, strings.HasPrefix(entry.Name(), ".wings-copy-"))
+	}
+}
+
+func TestPrepareRenameRejectsDuplicatesTraversalAndExistingDestination(t *testing.T) {
+	fs := newBetterFilesTestFilesystem(t, 0)
+	writeBetterFilesFixture(t, fs, "/one.txt", []byte("one"))
+	writeBetterFilesFixture(t, fs, "/existing.txt", []byte("existing"))
+
+	_, err := prepareRenameFiles(fs, "/", []safeRenameFile{{From: "one.txt", To: "same.txt"}, {From: "missing.txt", To: "same.txt"}})
+	require.ErrorIs(t, err, errDuplicateRenameDestination)
+	_, err = prepareRenameFiles(fs, "/", []safeRenameFile{{From: "../one.txt", To: "new.txt"}})
+	require.Error(t, err)
+	_, err = prepareRenameFiles(fs, "/", []safeRenameFile{{From: "one.txt", To: "existing.txt"}})
+	require.ErrorIs(t, err, errRenameDestinationExists)
+
+	require.NoError(t, os.MkdirAll(filepath.Join(fs.Path(), "directory"), 0o755))
+	_, err = prepareRenameFiles(fs, "/", []safeRenameFile{{From: "directory", To: "directory/nested"}})
+	require.Error(t, err)
+	require.NoError(t, os.Symlink("one.txt", filepath.Join(fs.Path(), "link.txt")))
+	_, err = prepareRenameFiles(fs, "/", []safeRenameFile{{From: "link.txt", To: "renamed-link.txt"}})
+	require.Error(t, err)
+}
+
+func TestPrepareRenameSupportsMultipleFiles(t *testing.T) {
+	fs := newBetterFilesTestFilesystem(t, 0)
+	writeBetterFilesFixture(t, fs, "/one.txt", []byte("one"))
+	writeBetterFilesFixture(t, fs, "/two.txt", []byte("two"))
+	files, err := prepareRenameFiles(fs, "/", []safeRenameFile{
+		{From: "one.txt", To: "renamed/one.txt"},
+		{From: "two.txt", To: "renamed/two.txt"},
+	})
+	require.NoError(t, err)
+	for _, file := range files {
+		require.NoError(t, fs.RenameNoReplace(file.from, file.to))
+	}
+	require.Equal(t, []byte("one"), readBetterFilesFixture(t, fs, "/renamed/one.txt"))
+	require.Equal(t, []byte("two"), readBetterFilesFixture(t, fs, "/renamed/two.txt"))
+}
+
+func TestRenameNoReplacePreservesExistingDestination(t *testing.T) {
+	fs := newBetterFilesTestFilesystem(t, 0)
+	writeBetterFilesFixture(t, fs, "/source.txt", []byte("source"))
+	writeBetterFilesFixture(t, fs, "/destination.txt", []byte("destination"))
+	require.ErrorIs(t, fs.RenameNoReplace("/source.txt", "/destination.txt"), os.ErrExist)
+	require.Equal(t, []byte("source"), readBetterFilesFixture(t, fs, "/source.txt"))
+	require.Equal(t, []byte("destination"), readBetterFilesFixture(t, fs, "/destination.txt"))
+}
diff --git a/router/router_server_files_fingerprints.go b/router/router_server_files_fingerprints.go
new file mode 100644
index 00000000..8aa1665c
--- /dev/null
+++ b/router/router_server_files_fingerprints.go
@@ -0,0 +1,269 @@
+package router
+
+import (
+	"context"
+	"crypto/md5"
+	"crypto/sha1"
+	"crypto/sha256"
+	"crypto/sha512"
+	"encoding/hex"
+	"fmt"
+	"hash"
+	"hash/crc32"
+	"io"
+	"net/http"
+	"runtime"
+	"strconv"
+	"sync"
+
+	"github.com/gin-gonic/gin"
+
+	"github.com/pterodactyl/wings/internal/ufs"
+	"github.com/pterodactyl/wings/router/middleware"
+	serverfs "github.com/pterodactyl/wings/server/filesystem"
+)
+
+const maxFingerprintFiles = 100
+
+type fingerprintJob struct {
+	key  string
+	path string
+}
+
+type fingerprintResult struct {
+	key   string
+	value string
+	valid bool
+}
+
+func getServerFileFingerprints(c *gin.Context) {
+	s := middleware.ExtractServer(c)
+	algorithm := c.Query("algorithm")
+	if !validFingerprintAlgorithm(algorithm) {
+		c.AbortWithStatusJSON(http.StatusUnprocessableEntity, gin.H{"error": "Unsupported fingerprint algorithm."})
+		return
+	}
+	requested := c.QueryArray("files")
+	if len(requested) == 0 {
+		requested = c.QueryArray("files[]")
+	}
+	if len(requested) == 0 || len(requested) > maxFingerprintFiles {
+		c.AbortWithStatusJSON(http.StatusUnprocessableEntity, gin.H{"error": "Between 1 and 100 files are required."})
+		return
+	}
+	root, err := normalizeBetterFilesRoot(c.Query("root"))
+	if err != nil || ensureBetterFilesAllowed(s.Filesystem(), root) != nil {
+		abortBetterFilesPath(c, errBetterFilesInvalidPath)
+		return
+	}
+
+	jobs := make([]fingerprintJob, 0, len(requested))
+	for _, key := range requested {
+		filePath, err := joinBetterFilesPath(root, key)
+		if err != nil {
+			abortBetterFilesPath(c, err)
+			return
+		}
+		if ensureBetterFilesAllowed(s.Filesystem(), filePath) != nil {
+			continue
+		}
+		jobs = append(jobs, fingerprintJob{key: key, path: filePath})
+	}
+	fingerprints := fingerprintFiles(c.Request.Context(), s.Filesystem(), algorithm, jobs)
+	c.JSON(http.StatusOK, gin.H{"fingerprints": fingerprints})
+}
+
+func validFingerprintAlgorithm(value string) bool {
+	switch value {
+	case "md5", "crc32", "sha1", "sha224", "sha256", "sha384", "sha512", "curseforge":
+		return true
+	default:
+		return false
+	}
+}
+
+func fingerprintFiles(ctx context.Context, fs *serverfs.Filesystem, algorithm string, jobs []fingerprintJob) map[string]string {
+	workerCount := runtime.NumCPU()
+	if workerCount < 1 {
+		workerCount = 1
+	}
+	if workerCount > 8 {
+		workerCount = 8
+	}
+	if workerCount > len(jobs) {
+		workerCount = len(jobs)
+	}
+	if workerCount == 0 {
+		return map[string]string{}
+	}
+
+	jobChannel := make(chan fingerprintJob)
+	resultChannel := make(chan fingerprintResult, len(jobs))
+	var workers sync.WaitGroup
+	for i := 0; i < workerCount; i++ {
+		workers.Add(1)
+		go func() {
+			defer workers.Done()
+			buffer := make([]byte, 64*1024)
+			for job := range jobChannel {
+				value, err := fingerprintOneFile(ctx, fs, algorithm, job.path, buffer)
+				select {
+				case resultChannel <- fingerprintResult{key: job.key, value: value, valid: err == nil}:
+				case <-ctx.Done():
+					return
+				}
+			}
+		}()
+	}
+	go func() {
+		defer close(jobChannel)
+		for _, job := range jobs {
+			select {
+			case jobChannel <- job:
+			case <-ctx.Done():
+				return
+			}
+		}
+	}()
+	go func() {
+		workers.Wait()
+		close(resultChannel)
+	}()
+
+	result := make(map[string]string, len(jobs))
+	for fingerprint := range resultChannel {
+		if fingerprint.valid {
+			result[fingerprint.key] = fingerprint.value
+		}
+	}
+	return result
+}
+
+func fingerprintOneFile(ctx context.Context, fs *serverfs.Filesystem, algorithm, filePath string, buffer []byte) (string, error) {
+	info, err := betterFilesLstat(fs, filePath)
+	if err != nil || !info.Mode().IsRegular() {
+		return "", errBetterFilesInvalidPath
+	}
+	file, err := fs.UnixFS().OpenFile(filePath, ufs.O_RDONLY|ufs.O_NOFOLLOW, 0)
+	if err != nil {
+		return "", err
+	}
+	defer file.Close()
+	if algorithm == "curseforge" {
+		return curseForgeFingerprint(ctx, file, buffer)
+	}
+
+	hasher, crc, err := newFingerprintHasher(algorithm)
+	if err != nil {
+		return "", err
+	}
+	reader := &fingerprintContextReader{ctx: ctx, reader: file}
+	if _, err := io.CopyBuffer(hasher, reader, buffer); err != nil {
+		return "", err
+	}
+	if crc != nil {
+		return fmt.Sprintf("%08x", crc.Sum32()), nil
+	}
+	return hex.EncodeToString(hasher.Sum(nil)), nil
+}
+
+func newFingerprintHasher(algorithm string) (hash.Hash, hash.Hash32, error) {
+	switch algorithm {
+	case "md5":
+		return md5.New(), nil, nil
+	case "crc32":
+		hasher := crc32.NewIEEE()
+		return hasher, hasher, nil
+	case "sha1":
+		return sha1.New(), nil, nil
+	case "sha224":
+		return sha256.New224(), nil, nil
+	case "sha256":
+		return sha256.New(), nil, nil
+	case "sha384":
+		return sha512.New384(), nil, nil
+	case "sha512":
+		return sha512.New(), nil, nil
+	default:
+		return nil, nil, fmt.Errorf("unsupported fingerprint algorithm")
+	}
+}
+
+func curseForgeFingerprint(ctx context.Context, file ufs.File, buffer []byte) (string, error) {
+	var normalizedLength uint32
+	for {
+		if err := ctx.Err(); err != nil {
+			return "", err
+		}
+		n, err := file.Read(buffer)
+		for _, value := range buffer[:n] {
+			if !curseForgeIgnoredByte(value) {
+				normalizedLength++
+			}
+		}
+		if err == io.EOF {
+			break
+		}
+		if err != nil {
+			return "", err
+		}
+	}
+	if _, err := file.Seek(0, io.SeekStart); err != nil {
+		return "", err
+	}
+
+	const multiplier uint32 = 1540483477
+	hashValue := uint32(1) ^ normalizedLength
+	var tail uint32
+	var shift uint32
+	for {
+		if err := ctx.Err(); err != nil {
+			return "", err
+		}
+		n, err := file.Read(buffer)
+		for _, value := range buffer[:n] {
+			if curseForgeIgnoredByte(value) {
+				continue
+			}
+			tail |= uint32(value) << shift
+			shift += 8
+			if shift == 32 {
+				mixed := tail * multiplier
+				mixed = (mixed ^ (mixed >> 24)) * multiplier
+				hashValue = hashValue*multiplier ^ mixed
+				tail = 0
+				shift = 0
+			}
+		}
+		if err == io.EOF {
+			break
+		}
+		if err != nil {
+			return "", err
+		}
+	}
+	if shift > 0 {
+		hashValue = (hashValue ^ tail) * multiplier
+	}
+	hashValue = (hashValue ^ (hashValue >> 13)) * multiplier
+	hashValue ^= hashValue >> 15
+	return strconv.FormatUint(uint64(hashValue), 10), nil
+}
+
+func curseForgeIgnoredByte(value byte) bool {
+	return value == '\t' || value == '\n' || value == '\r' || value == ' '
+}
+
+type fingerprintContextReader struct {
+	ctx    context.Context
+	reader io.Reader
+}
+
+func (r *fingerprintContextReader) Read(buffer []byte) (int, error) {
+	select {
+	case <-r.ctx.Done():
+		return 0, r.ctx.Err()
+	default:
+		return r.reader.Read(buffer)
+	}
+}
diff --git a/router/router_server_files_fingerprints_test.go b/router/router_server_files_fingerprints_test.go
new file mode 100644
index 00000000..e8343cba
--- /dev/null
+++ b/router/router_server_files_fingerprints_test.go
@@ -0,0 +1,53 @@
+package router
+
+import (
+	"context"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestFileFingerprintsKnownValues(t *testing.T) {
+	fs := newBetterFilesTestFilesystem(t, 0)
+	writeBetterFilesFixture(t, fs, "/fixture.txt", []byte("hello world\n"))
+	expected := map[string]string{
+		"md5":        "6f5902ac237024bdd0c176cb93063dc4",
+		"crc32":      "af083b2d",
+		"sha1":       "22596363b3de40b06f981fb85d82312e8c0ed511",
+		"sha224":     "95041dd60ab08c0bf5636d50be85fe9790300f39eb84602858a9b430",
+		"sha256":     "a948904f2f0f479b8f8197694b30184b0d2ed1c1cd2a1ec0fb85d299a192a447",
+		"sha384":     "6b3b69ff0a404f28d75e98a066d3fc64fffd9940870cc68bece28545b9a75086b343d7a1366838083e4b8f3ca6fd3c80",
+		"sha512":     "db3974a97f2407b7cae1ae637c0030687a11913274d578492558e39c16c017de84eacdc8c62fe34ee4e12b4b1428817f09b6a2760c3f8a664ceae94d2434a593",
+		"curseforge": "2824650221",
+	}
+	for algorithm, expectedValue := range expected {
+		t.Run(algorithm, func(t *testing.T) {
+			result := fingerprintFiles(context.Background(), fs, algorithm, []fingerprintJob{{key: "fixture.txt", path: "/fixture.txt"}})
+			require.Equal(t, expectedValue, result["fixture.txt"])
+		})
+	}
+}
+
+func TestFileFingerprintsMultipleAndInvalidEntries(t *testing.T) {
+	fs := newBetterFilesTestFilesystem(t, 0)
+	writeBetterFilesFixture(t, fs, "/one.txt", []byte("one"))
+	writeBetterFilesFixture(t, fs, "/two.txt", []byte("two"))
+	result := fingerprintFiles(context.Background(), fs, "sha256", []fingerprintJob{
+		{key: "one.txt", path: "/one.txt"},
+		{key: "two.txt", path: "/two.txt"},
+		{key: "missing.txt", path: "/missing.txt"},
+		{key: "directory", path: "/"},
+	})
+	require.Len(t, result, 2)
+	require.Contains(t, result, "one.txt")
+	require.Contains(t, result, "two.txt")
+	require.NotContains(t, result, "missing.txt")
+	require.NotContains(t, result, "directory")
+}
+
+func TestCRC32FingerprintIsAlwaysEightHexDigits(t *testing.T) {
+	fs := newBetterFilesTestFilesystem(t, 0)
+	writeBetterFilesFixture(t, fs, "/empty.txt", nil)
+	result := fingerprintFiles(context.Background(), fs, "crc32", []fingerprintJob{{key: "empty.txt", path: "/empty.txt"}})
+	require.Equal(t, "00000000", result["empty.txt"])
+}
diff --git a/router/router_server_files_largest.go b/router/router_server_files_largest.go
new file mode 100644
index 00000000..030ff1d6
--- /dev/null
+++ b/router/router_server_files_largest.go
@@ -0,0 +1,194 @@
+package router
+
+import (
+	"context"
+	"errors"
+	"net/http"
+	pathpkg "path"
+	"sort"
+
+	"github.com/gin-gonic/gin"
+	"golang.org/x/sys/unix"
+
+	"github.com/pterodactyl/wings/internal/ufs"
+	"github.com/pterodactyl/wings/router/middleware"
+	serverfs "github.com/pterodactyl/wings/server/filesystem"
+)
+
+const (
+	maxLargestDirectoryEntries = 500000
+	maxLargestDirectories      = 100000
+	maxLargestDirectoryDepth   = 256
+)
+
+type largestDirectoryAggregate struct {
+	path          string
+	info          ufs.FileInfo
+	logical       int64
+	physical      int64
+	totalLogical  int64
+	totalPhysical int64
+}
+
+type largestDirectoryWalk struct {
+	path  string
+	depth int
+}
+
+func getServerLargestDirectories(c *gin.Context) {
+	s := middleware.ExtractServer(c)
+	root, err := normalizeBetterFilesRoot(c.Query("directory"))
+	if err != nil || ensureBetterFilesAllowed(s.Filesystem(), root) != nil {
+		abortBetterFilesPath(c, errBetterFilesInvalidPath)
+		return
+	}
+	rootInfo, err := betterFilesLstat(s.Filesystem(), root)
+	if err != nil || !rootInfo.IsDir() {
+		abortBetterFilesPath(c, err)
+		return
+	}
+
+	entries, err := analyzeLargestDirectories(c.Request.Context(), s.Filesystem(), root, rootInfo)
+	if err != nil {
+		if errors.Is(err, errLargestDirectoryTraversalLimit) {
+			c.AbortWithStatusJSON(http.StatusUnprocessableEntity, gin.H{"error": "Directory analysis traversal limit exceeded."})
+			return
+		}
+		middleware.CaptureAndAbort(c, err)
+		return
+	}
+	c.JSON(http.StatusOK, entries)
+}
+
+var errLargestDirectoryTraversalLimit = errors.New("largest directory traversal limit exceeded")
+
+func analyzeLargestDirectories(ctx context.Context, fs *serverfs.Filesystem, root string, rootInfo ufs.FileInfo) ([]betterFilesEntry, error) {
+	aggregates := map[string]*largestDirectoryAggregate{
+		root: {path: root, info: rootInfo},
+	}
+	stack := []largestDirectoryWalk{{path: root}}
+	seenInodes := make(map[[2]uint64]struct{})
+	visitedEntries := 0
+
+	for len(stack) > 0 {
+		if err := ctx.Err(); err != nil {
+			return nil, err
+		}
+		directory := stack[len(stack)-1]
+		stack = stack[:len(stack)-1]
+		if directory.depth > maxLargestDirectoryDepth || len(aggregates) > maxLargestDirectories {
+			return nil, errLargestDirectoryTraversalLimit
+		}
+
+		entries, err := fs.ReadDirStat(directory.path)
+		if err != nil {
+			return nil, err
+		}
+		for _, info := range entries {
+			visitedEntries++
+			if visitedEntries > maxLargestDirectoryEntries {
+				return nil, errLargestDirectoryTraversalLimit
+			}
+			fullPath := pathpkg.Join(directory.path, info.Name())
+			if ensureBetterFilesAllowed(fs, fullPath) != nil || info.Mode()&ufs.ModeSymlink != 0 {
+				continue
+			}
+			if info.IsDir() {
+				aggregates[fullPath] = &largestDirectoryAggregate{path: fullPath, info: info}
+				stack = append(stack, largestDirectoryWalk{path: fullPath, depth: directory.depth + 1})
+				continue
+			}
+			if !info.Mode().IsRegular() {
+				continue
+			}
+			if stat, ok := info.Sys().(*unix.Stat_t); ok && stat.Nlink > 1 {
+				key := [2]uint64{uint64(stat.Dev), stat.Ino}
+				if _, exists := seenInodes[key]; exists {
+					continue
+				}
+				seenInodes[key] = struct{}{}
+			}
+			aggregate := aggregates[directory.path]
+			aggregate.logical = saturatingAddInt64(aggregate.logical, info.Size())
+			aggregate.physical = saturatingAddInt64(aggregate.physical, betterFilesPhysicalSize(info))
+		}
+	}
+
+	candidates := make([]*largestDirectoryAggregate, 0, len(aggregates))
+	var total int64
+	for _, aggregate := range aggregates {
+		aggregate.totalLogical = aggregate.logical
+		aggregate.totalPhysical = aggregate.physical
+	}
+	for path, aggregate := range aggregates {
+		if path == root {
+			continue
+		}
+		for parent := pathpkg.Dir(path); ; parent = pathpkg.Dir(parent) {
+			if ancestor := aggregates[parent]; ancestor != nil {
+				ancestor.totalLogical = saturatingAddInt64(ancestor.totalLogical, aggregate.logical)
+				ancestor.totalPhysical = saturatingAddInt64(ancestor.totalPhysical, aggregate.physical)
+			}
+			if parent == root || parent == "/" || parent == "." {
+				break
+			}
+		}
+	}
+	for path, aggregate := range aggregates {
+		if path == root || aggregate.logical <= 0 {
+			continue
+		}
+		candidates = append(candidates, aggregate)
+		total = saturatingAddInt64(total, aggregate.logical)
+	}
+	sort.Slice(candidates, func(i, j int) bool {
+		if candidates[i].logical == candidates[j].logical {
+			return candidates[i].path < candidates[j].path
+		}
+		return candidates[i].logical > candidates[j].logical
+	})
+	if total == 0 {
+		return []betterFilesEntry{}, nil
+	}
+
+	threshold := total - total/10
+	cutoff := len(candidates)
+	var cumulative int64
+	for i, candidate := range candidates {
+		cumulative = saturatingAddInt64(cumulative, candidate.logical)
+		if cumulative >= threshold {
+			cutoff = i + 1
+			break
+		}
+	}
+	if cutoff < 10 {
+		cutoff = 10
+		if cutoff > len(candidates) {
+			cutoff = len(candidates)
+		}
+	}
+	if cutoff > 50 {
+		cutoff = 50
+	}
+	if cutoff > len(candidates) {
+		cutoff = len(candidates)
+	}
+
+	result := make([]betterFilesEntry, 0, cutoff)
+	for _, candidate := range candidates[:cutoff] {
+		entry := newBetterFilesEntry(betterFilesRelativePath(root, candidate.path), candidate.info, "inode/directory")
+		entry.Size = candidate.totalLogical
+		entry.SizePhysical = candidate.totalPhysical
+		result = append(result, entry)
+	}
+	sort.SliceStable(result, func(i, j int) bool { return result[i].Size > result[j].Size })
+	return result, nil
+}
+
+func saturatingAddInt64(current, value int64) int64 {
+	const maxInt64 = int64(^uint64(0) >> 1)
+	if value > 0 && current > maxInt64-value {
+		return maxInt64
+	}
+	return current + value
+}
diff --git a/router/router_server_files_largest_test.go b/router/router_server_files_largest_test.go
new file mode 100644
index 00000000..193875d5
--- /dev/null
+++ b/router/router_server_files_largest_test.go
@@ -0,0 +1,46 @@
+package router
+
+import (
+	"context"
+	"fmt"
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestLargestDirectoriesOrderingPhysicalSizeAndSafety(t *testing.T) {
+	fs := newBetterFilesTestFilesystem(t, 0, "ignored/**")
+	writeBetterFilesFixture(t, fs, "/large/data.bin", make([]byte, 32*1024))
+	writeBetterFilesFixture(t, fs, "/small/data.bin", make([]byte, 1024))
+	writeBetterFilesFixture(t, fs, "/ignored/data.bin", make([]byte, 64*1024))
+
+	external := t.TempDir()
+	require.NoError(t, os.WriteFile(filepath.Join(external, "outside.bin"), make([]byte, 128*1024), 0o644))
+	require.NoError(t, os.Symlink(external, filepath.Join(fs.Path(), "escape")))
+	rootInfo, err := betterFilesLstat(fs, "/")
+	require.NoError(t, err)
+	results, err := analyzeLargestDirectories(context.Background(), fs, "/", rootInfo)
+	require.NoError(t, err)
+	require.Len(t, results, 2)
+	require.Equal(t, "large", results[0].Name)
+	require.Greater(t, results[0].Size, results[1].Size)
+	require.GreaterOrEqual(t, results[0].SizePhysical, int64(0))
+	for _, result := range results {
+		require.NotEqual(t, "ignored", result.Name)
+		require.NotEqual(t, "escape", result.Name)
+	}
+}
+
+func TestLargestDirectoriesKeepsMinimumWhenFewerThanTenExist(t *testing.T) {
+	fs := newBetterFilesTestFilesystem(t, 0)
+	for i, size := range []int{500, 400, 300, 200, 100} {
+		writeBetterFilesFixture(t, fs, fmt.Sprintf("/directory-%d/data.bin", i), make([]byte, size))
+	}
+	rootInfo, err := betterFilesLstat(fs, "/")
+	require.NoError(t, err)
+	results, err := analyzeLargestDirectories(context.Background(), fs, "/", rootInfo)
+	require.NoError(t, err)
+	require.Len(t, results, 5)
+}
diff --git a/router/router_server_files_rename.go b/router/router_server_files_rename.go
new file mode 100644
index 00000000..60f27fc2
--- /dev/null
+++ b/router/router_server_files_rename.go
@@ -0,0 +1,134 @@
+package router
+
+import (
+	"errors"
+	"net/http"
+	"os"
+	"strings"
+
+	"github.com/gin-gonic/gin"
+
+	"github.com/pterodactyl/wings/internal/ufs"
+	"github.com/pterodactyl/wings/router/middleware"
+	serverfs "github.com/pterodactyl/wings/server/filesystem"
+)
+
+type safeRenameFile struct {
+	To   string `json:"to"`
+	From string `json:"from"`
+}
+
+type normalizedRenameFile struct {
+	from string
+	to   string
+}
+
+var (
+	errDuplicateRenameDestination = errors.New("duplicate rename destination")
+	errRenameDestinationExists    = errors.New("rename destination exists")
+)
+
+func putServerRenameFilesSafe(c *gin.Context) {
+	s := middleware.ExtractServer(c)
+	var data struct {
+		Root  string           `json:"root"`
+		Files []safeRenameFile `json:"files"`
+	}
+	// BindJSON writes the same 400 response used by the existing Pterodactyl
+	// rename handler when the request body cannot be decoded.
+	if err := c.BindJSON(&data); err != nil {
+		return
+	}
+	if len(data.Files) == 0 || len(data.Files) > maxCopyManyItems {
+		c.AbortWithStatusJSON(http.StatusUnprocessableEntity, gin.H{"error": "Between 1 and 1000 rename entries are required."})
+		return
+	}
+	root, err := normalizeBetterFilesRoot(data.Root)
+	if err != nil {
+		abortBetterFilesPath(c, err)
+		return
+	}
+	normalized, err := prepareRenameFiles(s.Filesystem(), root, data.Files)
+	if err != nil {
+		switch {
+		case errors.Is(err, errDuplicateRenameDestination):
+			c.AbortWithStatusJSON(http.StatusUnprocessableEntity, gin.H{"error": "Duplicate rename destinations are not allowed."})
+		case errors.Is(err, errRenameDestinationExists):
+			c.AbortWithStatusJSON(http.StatusBadRequest, gin.H{"error": "Cannot move or rename file, destination already exists."})
+		case errors.Is(err, errBetterFilesInvalidPath):
+			abortBetterFilesPath(c, err)
+		default:
+			middleware.CaptureAndAbort(c, err)
+		}
+		return
+	}
+
+	for _, file := range normalized {
+		if c.Request.Context().Err() != nil {
+			return
+		}
+		if file.from == file.to {
+			continue
+		}
+		if err := s.Filesystem().RenameNoReplace(file.from, file.to); err != nil {
+			if errors.Is(err, os.ErrNotExist) {
+				s.Log().WithError(err).WithField("from_path", file.from).WithField("to_path", file.to).
+					Warn("failed to rename: source or target does not exist")
+				continue
+			}
+			if errors.Is(err, os.ErrExist) {
+				c.AbortWithStatusJSON(http.StatusBadRequest, gin.H{"error": "Cannot move or rename file, destination already exists."})
+				return
+			}
+			middleware.CaptureAndAbort(c, err)
+			return
+		}
+		s.RenameFileHistory(file.from, file.to)
+	}
+	c.Status(http.StatusNoContent)
+}
+
+func prepareRenameFiles(fs *serverfs.Filesystem, root string, input []safeRenameFile) ([]normalizedRenameFile, error) {
+	normalized := make([]normalizedRenameFile, 0, len(input))
+	destinations := make(map[string]struct{}, len(input))
+	for _, requested := range input {
+		from, err := joinBetterFilesPath(root, requested.From)
+		if err != nil {
+			return nil, err
+		}
+		to, err := joinBetterFilesPath(root, requested.To)
+		if err != nil {
+			return nil, err
+		}
+		if _, duplicate := destinations[to]; duplicate {
+			return nil, errDuplicateRenameDestination
+		}
+		destinations[to] = struct{}{}
+		if err := ensureBetterFilesAllowed(fs, from, to); err != nil {
+			return nil, err
+		}
+		sourceInfo, sourceErr := fs.UnixFS().Lstat(from)
+		if sourceErr != nil && !errors.Is(sourceErr, os.ErrNotExist) {
+			return nil, sourceErr
+		}
+		if sourceErr == nil {
+			if sourceInfo.Mode()&ufs.ModeSymlink != 0 || (!sourceInfo.IsDir() && !sourceInfo.Mode().IsRegular()) {
+				return nil, errBetterFilesInvalidPath
+			}
+			if sourceInfo.IsDir() && strings.HasPrefix(to+"/", from+"/") {
+				return nil, errBetterFilesInvalidPath
+			}
+		}
+		if from != to {
+			if sourceErr == nil {
+				if _, destinationErr := fs.UnixFS().Lstat(to); destinationErr == nil {
+					return nil, errRenameDestinationExists
+				} else if !errors.Is(destinationErr, os.ErrNotExist) {
+					return nil, destinationErr
+				}
+			}
+		}
+		normalized = append(normalized, normalizedRenameFile{from: from, to: to})
+	}
+	return normalized, nil
+}
diff --git a/router/router_server_files_revisions.go b/router/router_server_files_revisions.go
new file mode 100644
index 00000000..9ea50002
--- /dev/null
+++ b/router/router_server_files_revisions.go
@@ -0,0 +1,146 @@
+package router
+
+import (
+	"bytes"
+	"database/sql"
+	"io"
+	"net/http"
+	"strconv"
+	"strings"
+
+	"github.com/gin-gonic/gin"
+
+	"github.com/pterodactyl/wings/config"
+	"github.com/pterodactyl/wings/router/middleware"
+	"github.com/pterodactyl/wings/server"
+	"github.com/pterodactyl/wings/server/filesystem"
+)
+
+func getServerFileRevisions(c *gin.Context) {
+	s := ExtractServer(c)
+	filePath := normalizeFileRevisionPath(c.Query("file"))
+	if filePath == "/" {
+		c.AbortWithStatusJSON(http.StatusBadRequest, gin.H{"error": "Invalid file path."})
+		return
+	}
+	if err := s.Filesystem().IsIgnored(filePath); err != nil {
+		middleware.CaptureAndAbort(c, err)
+		return
+	}
+
+	revisions, err := s.ListFileRevisions(filePath)
+	if err != nil {
+		middleware.CaptureAndAbort(c, err)
+		return
+	}
+	c.JSON(http.StatusOK, gin.H{"revisions": revisions})
+}
+
+func getServerFileRevision(c *gin.Context) {
+	s := ExtractServer(c)
+	revisionID, ok := parseFileRevisionID(c)
+	if !ok {
+		return
+	}
+	content, filePath, err := s.FileRevisionContent(revisionID)
+	if err != nil {
+		abortFileRevisionError(c, err)
+		return
+	}
+	if err := s.Filesystem().IsIgnored(filePath); err != nil {
+		middleware.CaptureAndAbort(c, err)
+		return
+	}
+
+	c.Header("Content-Length", strconv.Itoa(len(content)))
+	c.Header("X-File-Path", filePath)
+	c.Data(http.StatusOK, "application/octet-stream", content)
+}
+
+func postServerFileRevisionRestore(c *gin.Context) {
+	s := ExtractServer(c)
+	revisionID, ok := parseFileRevisionID(c)
+	if !ok {
+		return
+	}
+	content, filePath, err := s.FileRevisionContent(revisionID)
+	if err != nil {
+		abortFileRevisionError(c, err)
+		return
+	}
+	if err := s.Filesystem().IsIgnored(filePath); err != nil {
+		middleware.CaptureAndAbort(c, err)
+		return
+	}
+
+	before, _ := captureFileRevisionContent(s, filePath)
+	if err := s.Filesystem().Write(filePath, bytes.NewReader(content), int64(len(content)), 0o644); err != nil {
+		if filesystem.IsErrorCode(err, filesystem.ErrCodeIsDirectory) {
+			c.AbortWithStatusJSON(http.StatusBadRequest, gin.H{
+				"error": "Cannot restore revision, name conflicts with an existing directory by the same name.",
+			})
+			return
+		}
+		middleware.CaptureAndAbort(c, err)
+		return
+	}
+	restored, ok := captureFileRevisionContent(s, filePath)
+	if ok {
+		user := strings.TrimSpace(c.Query("user"))
+		if _, err := s.RecordFileRevision(filePath, before, restored, user); err != nil {
+			s.Log().WithError(err).WithField("path", filePath).Warn("failed to record restored file revision")
+		}
+	}
+
+	c.JSON(http.StatusOK, gin.H{
+		"file":        filePath,
+		"revision_id": revisionID,
+		"restored":    true,
+	})
+}
+
+func parseFileRevisionID(c *gin.Context) (int64, bool) {
+	id, err := strconv.ParseInt(c.Param("revision"), 10, 64)
+	if err != nil || id <= 0 {
+		c.AbortWithStatusJSON(http.StatusBadRequest, gin.H{"error": "Invalid file revision."})
+		return 0, false
+	}
+	return id, true
+}
+
+func abortFileRevisionError(c *gin.Context, err error) {
+	if err == sql.ErrNoRows {
+		c.AbortWithStatusJSON(http.StatusNotFound, gin.H{"error": "File revision was not found."})
+		return
+	}
+	middleware.CaptureAndAbort(c, err)
+}
+
+func normalizeFileRevisionPath(value string) string {
+	value = "/" + strings.TrimLeft(value, "/")
+	if value == "/." {
+		return "/"
+	}
+	return value
+}
+
+func captureFileRevisionContent(s *server.Server, filePath string) ([]byte, bool) {
+	limit := int64(config.Get().System.FileHistory.FileSizeCap)
+	if limit <= 0 {
+		return nil, false
+	}
+
+	f, stat, err := s.Filesystem().File(filePath)
+	if err != nil {
+		return nil, false
+	}
+	defer f.Close()
+	if stat.IsDir() || stat.Size() < 0 || stat.Size() > limit || !server.ShouldRecordFileHistory(filePath, uint64(stat.Size())) {
+		return nil, false
+	}
+	content, err := io.ReadAll(io.LimitReader(f, limit+1))
+	if err != nil || int64(len(content)) > limit {
+		return nil, false
+	}
+	return content, true
+}
diff --git a/router/router_server_files_search.go b/router/router_server_files_search.go
new file mode 100644
index 00000000..43f8d3e3
--- /dev/null
+++ b/router/router_server_files_search.go
@@ -0,0 +1,611 @@
+package router
+
+import (
+	"bytes"
+	"context"
+	"io"
+	"net/http"
+	"path"
+	"runtime"
+	"strconv"
+	"strings"
+	"sync"
+	"sync/atomic"
+	"time"
+	"unicode/utf8"
+
+	"github.com/gin-gonic/gin"
+	"github.com/pterodactyl/wings/router/middleware"
+	serverfs "github.com/pterodactyl/wings/server/filesystem"
+)
+
+type FileSearchResult struct {
+	Name       string `json:"name"`
+	Path       string `json:"path"`
+	Directory  string `json:"directory"`
+	IsFile     bool   `json:"is_file"`
+	Size       int64  `json:"size"`
+	ModifiedAt string `json:"modified_at"`
+}
+
+type FileSearchMeta struct {
+	SearchTimeMs int64  `json:"search_time_ms"`
+	Truncated    bool   `json:"truncated"`
+	Query        string `json:"query"`
+	MaxResults   int    `json:"max_results"`
+	MaxDepth     int    `json:"max_depth"`
+	TotalScanned int64  `json:"total_scanned"`
+}
+
+type FileSearchResponse struct {
+	Data []FileSearchResult `json:"data"`
+	Meta FileSearchMeta     `json:"meta"`
+}
+
+var (
+	sensitiveExtensions = map[string]struct{}{
+		".pem": {},
+		".key": {},
+	}
+
+	contentAllowedExtensions = map[string]struct{}{
+		".txt":        {},
+		".log":        {},
+		".json":       {},
+		".jsonc":      {},
+		".yaml":       {},
+		".yml":        {},
+		".toml":       {},
+		".ini":        {},
+		".conf":       {},
+		".cfg":        {},
+		".properties": {},
+		".env":        {},
+		".md":         {},
+		".xml":        {},
+		".html":       {},
+		".htm":        {},
+		".css":        {},
+		".scss":       {},
+		".sass":       {},
+		".less":       {},
+		".js":         {},
+		".jsx":        {},
+		".ts":         {},
+		".tsx":        {},
+		".php":        {},
+		".go":         {},
+		".java":       {},
+		".cs":         {},
+		".py":         {},
+		".rb":         {},
+		".sh":         {},
+	}
+
+	sensitivePrefixes = []string{
+		".env",
+		".htaccess",
+		".htpasswd",
+		"id_rsa",
+		"id_dsa",
+		"id_ecdsa",
+		"id_ed25519",
+	}
+
+	resultPool = sync.Pool{
+		New: func() any {
+			batch := make([]FileSearchResult, 0, batchSize)
+			return &batch
+		},
+	}
+
+	builderPool = sync.Pool{
+		New: func() any {
+			return &strings.Builder{}
+		},
+	}
+)
+
+const (
+	maxQueryLength  = 256
+	minQueryLength  = 1
+	maxPathLength   = 4096
+	maxFilenameLen  = 255
+	jobChannelSize  = 2048
+	resultChanSize  = 64
+	batchSize       = 16
+	maxContentBytes = 1024 * 1024
+)
+
+type walkJob struct {
+	path  string
+	depth int
+}
+
+type searchContext struct {
+	fs            *serverfs.Filesystem
+	queryLower    string
+	maxResults    int
+	maxDepth      int
+	contentSearch bool
+	results       []FileSearchResult
+	resultCount   atomic.Int64
+	truncated     atomic.Bool
+	totalScanned  atomic.Int64
+	done          chan struct{}
+	jobChan       chan walkJob
+	resultChan    chan []FileSearchResult
+	pendingJobs   atomic.Int64
+	stopOnce      sync.Once
+	closeOnce     sync.Once
+}
+
+func getWorkerCount() int {
+	n := runtime.NumCPU()
+	if n > 8 {
+		return 8
+	}
+	if n < 2 {
+		return 2
+	}
+	return n
+}
+
+func sanitizeQuery(query string) (string, bool) {
+	query = strings.TrimSpace(query)
+
+	if len(query) < minQueryLength || len(query) > maxQueryLength {
+		return "", false
+	}
+
+	if !utf8.ValidString(query) {
+		return "", false
+	}
+
+	if strings.Contains(query, "..") || strings.ContainsAny(query, "\x00\n\r") {
+		return "", false
+	}
+
+	return query, true
+}
+
+func isSensitiveFile(name string) bool {
+	nameLower := strings.ToLower(name)
+
+	for _, prefix := range sensitivePrefixes {
+		if strings.HasPrefix(nameLower, prefix) {
+			return true
+		}
+	}
+
+	if idx := strings.LastIndexByte(name, '.'); idx != -1 {
+		ext := strings.ToLower(name[idx:])
+		if _, ok := sensitiveExtensions[ext]; ok {
+			return true
+		}
+	}
+
+	return false
+}
+
+func allowsContentSearch(name string) bool {
+	nameLower := strings.ToLower(name)
+
+	if strings.HasPrefix(nameLower, ".") {
+		return false
+	}
+
+	if idx := strings.LastIndexByte(nameLower, '.'); idx != -1 {
+		if _, ok := contentAllowedExtensions[nameLower[idx:]]; ok {
+			return true
+		}
+	}
+
+	return false
+}
+
+func contentMatches(fs *serverfs.Filesystem, displayPath string, queryLower string, size int64) bool {
+	if size <= 0 || size > maxContentBytes {
+		return false
+	}
+
+	file, stat, err := fs.File(displayPath)
+	if err != nil {
+		return false
+	}
+	defer file.Close()
+	if stat.IsDir() || !stat.Mode().IsRegular() || stat.Size() <= 0 || stat.Size() > maxContentBytes {
+		return false
+	}
+
+	limited := io.LimitReader(file, maxContentBytes)
+	data, err := io.ReadAll(limited)
+	if err != nil {
+		return false
+	}
+
+	if bytes.IndexByte(data, 0) != -1 {
+		return false
+	}
+
+	if !utf8.Valid(data) {
+		return false
+	}
+
+	contentLower := strings.ToLower(string(data))
+	return strings.Contains(contentLower, queryLower)
+}
+
+func (sc *searchContext) checkDone() bool {
+	select {
+	case <-sc.done:
+		return true
+	default:
+		return false
+	}
+}
+
+func (sc *searchContext) stop() {
+	sc.stopOnce.Do(func() {
+		close(sc.done)
+	})
+}
+
+func (sc *searchContext) hasEnoughResults() bool {
+	if sc.maxResults <= 0 {
+		return false
+	}
+	return int(sc.resultCount.Load()) >= sc.maxResults
+}
+
+func getSearchResultBatch() []FileSearchResult {
+	batch := resultPool.Get().(*[]FileSearchResult)
+	return (*batch)[:0]
+}
+
+func putSearchResultBatch(batch []FileSearchResult) {
+	if batch == nil {
+		return
+	}
+	if cap(batch) > batchSize*4 {
+		return
+	}
+	batch = batch[:0]
+	resultPool.Put(&batch)
+}
+
+func buildSearchPath(dir string, name string) string {
+	builder := builderPool.Get().(*strings.Builder)
+	builder.Reset()
+	defer builderPool.Put(builder)
+
+	if dir == "" || dir == "/" {
+		builder.Grow(len(name) + 1)
+		builder.WriteByte('/')
+		builder.WriteString(name)
+		return builder.String()
+	}
+
+	builder.Grow(len(dir) + len(name) + 1)
+	builder.WriteString(dir)
+	builder.WriteByte('/')
+	builder.WriteString(name)
+	return builder.String()
+}
+
+func (sc *searchContext) submitResults(batch []FileSearchResult) bool {
+	if len(batch) == 0 {
+		return false
+	}
+	sc.resultCount.Add(int64(len(batch)))
+
+	select {
+	case sc.resultChan <- batch:
+		return sc.hasEnoughResults()
+	case <-sc.done:
+		putSearchResultBatch(batch)
+		return true
+	}
+}
+
+func (sc *searchContext) collectResults() {
+	for batch := range sc.resultChan {
+		if sc.maxResults <= 0 {
+			sc.results = append(sc.results, batch...)
+			putSearchResultBatch(batch)
+			continue
+		}
+
+		remaining := sc.maxResults - len(sc.results)
+		if remaining <= 0 {
+			sc.truncated.Store(true)
+			putSearchResultBatch(batch)
+			continue
+		}
+
+		if len(batch) > remaining {
+			sc.results = append(sc.results, batch[:remaining]...)
+			sc.truncated.Store(true)
+		} else {
+			sc.results = append(sc.results, batch...)
+		}
+		putSearchResultBatch(batch)
+	}
+}
+
+func (sc *searchContext) enqueueJob(job walkJob) {
+	if sc.checkDone() || sc.hasEnoughResults() {
+		return
+	}
+
+	sc.pendingJobs.Add(1)
+
+	defer func() {
+		if r := recover(); r != nil {
+			sc.pendingJobs.Add(-1)
+		}
+	}()
+
+	select {
+	case sc.jobChan <- job:
+	case <-sc.done:
+		sc.pendingJobs.Add(-1)
+	}
+}
+
+func (sc *searchContext) finishJob() {
+	if sc.pendingJobs.Add(-1) == 0 {
+		sc.closeOnce.Do(func() {
+			close(sc.jobChan)
+		})
+	}
+}
+
+func getDirectory(path string) string {
+	lastSlash := strings.LastIndexByte(path, '/')
+	if lastSlash <= 0 {
+		return "/"
+	}
+	return path[:lastSlash]
+}
+
+func (sc *searchContext) worker(wg *sync.WaitGroup) {
+	defer wg.Done()
+
+	localBatch := getSearchResultBatch()
+	defer func() {
+		if localBatch != nil && len(localBatch) == 0 {
+			putSearchResultBatch(localBatch)
+		}
+	}()
+
+	for {
+		select {
+		case <-sc.done:
+			if len(localBatch) > 0 {
+				sc.submitResults(localBatch)
+				localBatch = nil
+			}
+			return
+		case job, ok := <-sc.jobChan:
+			if !ok {
+				if len(localBatch) > 0 {
+					sc.submitResults(localBatch)
+					localBatch = nil
+				}
+				return
+			}
+
+			if sc.checkDone() || sc.hasEnoughResults() {
+				sc.finishJob()
+				continue
+			}
+
+			entries, err := sc.fs.ReadDirStat(job.path)
+			if err != nil {
+				sc.finishJob()
+				continue
+			}
+
+			var subDirs []walkJob
+
+			for _, entry := range entries {
+				if sc.checkDone() {
+					sc.truncated.Store(true)
+					break
+				}
+
+				name := entry.Name()
+				nameLen := len(name)
+
+				if nameLen == 0 || nameLen > maxFilenameLen {
+					continue
+				}
+
+				isDir := entry.IsDir()
+
+				sc.totalScanned.Add(1)
+
+				nameLower := strings.ToLower(name)
+				nameMatches := strings.Contains(nameLower, sc.queryLower)
+
+				if nameMatches || (sc.contentSearch && !isDir && allowsContentSearch(name)) {
+					if !isDir && isSensitiveFile(name) {
+						continue
+					}
+
+					fullPath := buildSearchPath(job.path, name)
+
+					if len(fullPath) > maxPathLength {
+						continue
+					}
+
+					if !nameMatches {
+						if !sc.contentSearch || isDir || !entry.Mode().IsRegular() || !contentMatches(sc.fs, fullPath, sc.queryLower, entry.Size()) {
+							goto scanSubdirs
+						}
+					}
+
+					result := FileSearchResult{
+						Name:       name,
+						Path:       fullPath,
+						Directory:  getDirectory(fullPath),
+						IsFile:     !isDir,
+						Size:       entry.Size(),
+						ModifiedAt: entry.ModTime().UTC().Format(time.RFC3339),
+					}
+
+					localBatch = append(localBatch, result)
+
+					if len(localBatch) >= batchSize {
+						if sc.submitResults(localBatch) {
+							localBatch = getSearchResultBatch()
+							sc.stop()
+							break
+						}
+						localBatch = getSearchResultBatch()
+					}
+				}
+
+			scanSubdirs:
+
+				if isDir && (sc.maxDepth <= 0 || job.depth < sc.maxDepth) {
+					subDirs = append(subDirs, walkJob{
+						path:  path.Join(job.path, name),
+						depth: job.depth + 1,
+					})
+				}
+			}
+
+			for _, subDir := range subDirs {
+				if sc.checkDone() || sc.hasEnoughResults() {
+					break
+				}
+				sc.enqueueJob(subDir)
+			}
+
+			if len(localBatch) > 0 {
+				if sc.submitResults(localBatch) {
+					sc.stop()
+				}
+				localBatch = getSearchResultBatch()
+			}
+
+			sc.finishJob()
+		}
+	}
+}
+
+func getServerFilesSearch(c *gin.Context) {
+	s := middleware.ExtractServer(c)
+
+	rawQuery := c.Query("query")
+	query, valid := sanitizeQuery(rawQuery)
+	if !valid {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "invalid or missing query parameter"})
+		return
+	}
+
+	maxResults := 50
+	if v := c.Query("max_results"); v != "" {
+		if parsed, err := strconv.Atoi(v); err == nil {
+			if parsed == 0 {
+				maxResults = 0
+			} else if parsed > 0 && parsed <= 200 {
+				maxResults = parsed
+			}
+		}
+	} else {
+		maxResults = 0
+	}
+
+	maxDepth := 0
+	if v := c.Query("max_depth"); v != "" {
+		if parsed, err := strconv.Atoi(v); err == nil && parsed >= 0 {
+			maxDepth = parsed
+		}
+	}
+
+	timeout := 8
+	if v := c.Query("timeout"); v != "" {
+		if parsed, err := strconv.Atoi(v); err == nil && parsed > 0 && parsed <= 30 {
+			timeout = parsed
+		}
+	}
+
+	contentSearch := false
+	if v := strings.TrimSpace(c.Query("content")); v != "" {
+		if v == "1" || strings.EqualFold(v, "true") {
+			contentSearch = true
+		}
+	}
+
+	ctx, cancel := context.WithTimeout(c.Request.Context(), time.Duration(timeout)*time.Second)
+	defer cancel()
+
+	resultsCap := maxResults
+	if resultsCap <= 0 {
+		resultsCap = 64
+	}
+
+	sc := &searchContext{
+		fs:            s.Filesystem(),
+		queryLower:    strings.ToLower(query),
+		maxResults:    maxResults,
+		maxDepth:      maxDepth,
+		contentSearch: contentSearch,
+		results:       make([]FileSearchResult, 0, resultsCap),
+		done:          make(chan struct{}),
+		jobChan:       make(chan walkJob, jobChannelSize),
+		resultChan:    make(chan []FileSearchResult, resultChanSize),
+	}
+
+	go func() {
+		<-ctx.Done()
+		sc.stop()
+	}()
+
+	startTime := time.Now()
+
+	workerCount := getWorkerCount()
+	var wg sync.WaitGroup
+	var collector sync.WaitGroup
+
+	collector.Add(1)
+	go func() {
+		defer collector.Done()
+		sc.collectResults()
+	}()
+
+	for i := 0; i < workerCount; i++ {
+		wg.Add(1)
+		go sc.worker(&wg)
+	}
+
+	sc.pendingJobs.Store(1)
+	select {
+	case sc.jobChan <- walkJob{path: "/", depth: 0}:
+	case <-sc.done:
+		sc.finishJob()
+	}
+
+	wg.Wait()
+	close(sc.resultChan)
+	collector.Wait()
+
+	searchTimeMs := time.Since(startTime).Milliseconds()
+
+	response := FileSearchResponse{
+		Data: sc.results,
+		Meta: FileSearchMeta{
+			SearchTimeMs: searchTimeMs,
+			Truncated:    sc.truncated.Load(),
+			Query:        query,
+			MaxResults:   maxResults,
+			MaxDepth:     maxDepth,
+			TotalScanned: sc.totalScanned.Load(),
+		},
+	}
+
+	c.JSON(http.StatusOK, response)
+}
diff --git a/router/router_server_files_search_v2.go b/router/router_server_files_search_v2.go
new file mode 100644
index 00000000..f29187c4
--- /dev/null
+++ b/router/router_server_files_search_v2.go
@@ -0,0 +1,740 @@
+package router
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"net/http"
+	"strings"
+	"sync"
+	"time"
+	"unicode"
+	"unicode/utf8"
+
+	"github.com/bmatcuk/doublestar/v4"
+	"github.com/gabriel-vasile/mimetype"
+	"github.com/gin-gonic/gin"
+	"golang.org/x/sys/unix"
+
+	"github.com/pterodactyl/wings/internal/ufs"
+	"github.com/pterodactyl/wings/router/middleware"
+	serverfs "github.com/pterodactyl/wings/server/filesystem"
+)
+
+const (
+	maxSearchV2Results       = 500
+	maxSearchV2Patterns      = 128
+	maxSearchV2PatternBytes  = 64 * 1024
+	maxSearchV2Alternatives  = 64
+	maxSearchV2Entries       = 250000
+	maxSearchV2Directories   = 16384
+	maxSearchV2Depth         = 256
+	searchV2DirectoryBatch   = 128
+	maxSearchV2RequestBytes  = 1024 * 1024
+	defaultSearchV2ReadLimit = int64(2 * 1024 * 1024)
+	maxSearchV2ReadLimit     = int64(1024 * 1024 * 1024)
+	maxSearchV2TotalRead     = int64(1024 * 1024 * 1024)
+	searchV2Timeout          = 30 * time.Second
+	searchV2HeadBytes        = 128
+)
+
+type searchV2Pattern struct {
+	glob          string
+	directoryOnly bool
+	negative      bool
+}
+
+type searchV2PathFilter struct {
+	Include         []string `json:"include"`
+	Exclude         []string `json:"exclude"`
+	CaseInsensitive bool     `json:"case_insensitive"`
+	includes        []searchV2Pattern
+	excludes        []searchV2Pattern
+}
+
+type searchV2SizeFilter struct {
+	Min *int64 `json:"min"`
+	Max *int64 `json:"max"`
+}
+
+type searchV2ContentFilter struct {
+	Query            string `json:"query"`
+	MaxSearchSize    *int64 `json:"max_search_size"`
+	IncludeUnmatched bool   `json:"include_unmatched"`
+	CaseInsensitive  bool   `json:"case_insensitive"`
+}
+
+func (f searchV2ContentFilter) readLimit() int64 {
+	if f.MaxSearchSize == nil {
+		return defaultSearchV2ReadLimit
+	}
+	return *f.MaxSearchSize
+}
+
+type searchV2Payload struct {
+	Root          string                 `json:"root"`
+	PathFilter    *searchV2PathFilter    `json:"path_filter"`
+	SizeFilter    *searchV2SizeFilter    `json:"size_filter"`
+	ContentFilter *searchV2ContentFilter `json:"content_filter"`
+	PerPage       int                    `json:"per_page"`
+}
+
+type searchV2Directory struct {
+	file  ufs.File
+	path  string
+	depth int
+	names []string
+	index int
+	eof   bool
+}
+
+type searchV2Budget struct {
+	entriesVisited     int
+	directoriesVisited int
+	readRemaining      int64
+}
+
+type searchV2Matcher struct {
+	pattern         []byte
+	failure         []int
+	caseInsensitive bool
+}
+
+var (
+	errSearchV2TraversalLimit = errors.New("search traversal limit exceeded")
+	errSearchV2ReadLimit      = errors.New("search total read limit exceeded")
+	errSearchV2Root           = errors.New("invalid search root")
+	searchV2BufferPool        = sync.Pool{New: func() interface{} {
+		buffer := make([]byte, 64*1024)
+		return &buffer
+	}}
+)
+
+func postServerFilesSearch(c *gin.Context) {
+	s := middleware.ExtractServer(c)
+	body, err := io.ReadAll(http.MaxBytesReader(c.Writer, c.Request.Body, maxSearchV2RequestBytes))
+	if err != nil {
+		var tooLarge *http.MaxBytesError
+		if errors.As(err, &tooLarge) {
+			c.AbortWithStatusJSON(http.StatusRequestEntityTooLarge, gin.H{"error": "Search JSON exceeds 1 MiB."})
+		} else {
+			c.AbortWithStatusJSON(http.StatusBadRequest, gin.H{"error": "Could not read search JSON."})
+		}
+		return
+	}
+	data := &searchV2Payload{PerPage: 100}
+	decoder := json.NewDecoder(bytes.NewReader(body))
+	decoder.DisallowUnknownFields()
+	if !utf8.Valid(body) || decoder.Decode(&data) != nil || data == nil {
+		c.AbortWithStatusJSON(http.StatusBadRequest, gin.H{"error": "Invalid search JSON, field type, or unsupported field. Only the documented V2 filters are accepted."})
+		return
+	}
+	var extra interface{}
+	if decoder.Decode(&extra) != io.EOF {
+		c.AbortWithStatusJSON(http.StatusBadRequest, gin.H{"error": "Search requires exactly one JSON object."})
+		return
+	}
+	if err := validateSearchV2Payload(data); err != nil {
+		c.AbortWithStatusJSON(http.StatusUnprocessableEntity, gin.H{"error": err.Error()})
+		return
+	}
+	root, err := normalizeBetterFilesRoot(data.Root)
+	if err != nil {
+		abortBetterFilesPath(c, err)
+		return
+	}
+	if err := ensureBetterFilesAllowed(s.Filesystem(), root); err != nil {
+		c.AbortWithStatusJSON(http.StatusForbidden, gin.H{"error": "The search root is forbidden."})
+		return
+	}
+	ctx, cancel := context.WithTimeout(c.Request.Context(), searchV2Timeout)
+	defer cancel()
+	results, err := runSearchV2(ctx, s.Filesystem(), root, *data, nil)
+	if err != nil {
+		switch {
+		case errors.Is(err, context.Canceled), errors.Is(err, context.DeadlineExceeded):
+			c.AbortWithStatusJSON(http.StatusRequestTimeout, gin.H{"error": "Search canceled or exceeded its 30-second time limit."})
+		case errors.Is(err, errSearchV2TraversalLimit), errors.Is(err, errSearchV2ReadLimit):
+			c.AbortWithStatusJSON(http.StatusUnprocessableEntity, gin.H{"error": err.Error() + "; narrow the search root or filters."})
+		case errors.Is(err, errSearchV2Root):
+			status := http.StatusUnprocessableEntity
+			if errors.Is(err, ufs.ErrNotExist) {
+				status = http.StatusNotFound
+			}
+			c.AbortWithStatusJSON(status, gin.H{"error": "Search root must be an existing directory without symbolic links."})
+		default:
+			middleware.CaptureAndAbort(c, err)
+		}
+		return
+	}
+	c.JSON(http.StatusOK, gin.H{"results": results})
+}
+
+func validateSearchV2Payload(data *searchV2Payload) error {
+	if data.PerPage < 0 {
+		return errors.New("per_page must be non-negative")
+	}
+	if data.PerPage > maxSearchV2Results {
+		data.PerPage = maxSearchV2Results
+	}
+	if data.PathFilter != nil {
+		filter := data.PathFilter
+		if len(filter.Include)+len(filter.Exclude) > maxSearchV2Patterns {
+			return errors.New("too many path patterns (maximum 128)")
+		}
+		total := 0
+		for _, group := range [][]string{filter.Include, filter.Exclude} {
+			for _, pattern := range group {
+				total += len(pattern)
+			}
+		}
+		if total > maxSearchV2PatternBytes {
+			return errors.New("path patterns exceed 64 KiB in total")
+		}
+		var err error
+		if filter.includes, err = compileSearchV2Patterns(filter.Include, filter.CaseInsensitive); err != nil {
+			return err
+		}
+		if filter.excludes, err = compileSearchV2Patterns(filter.Exclude, filter.CaseInsensitive); err != nil {
+			return err
+		}
+	}
+	if data.SizeFilter != nil {
+		f := data.SizeFilter
+		if (f.Min != nil && *f.Min < 0) || (f.Max != nil && *f.Max < 0) {
+			return errors.New("file sizes must be non-negative")
+		}
+		if f.Min != nil && f.Max != nil && *f.Min > *f.Max {
+			return errors.New("minimum file size exceeds maximum file size")
+		}
+	}
+	if data.ContentFilter != nil {
+		f := data.ContentFilter
+		if !utf8.ValidString(f.Query) || len(f.Query) > betterFilesMaxPathLength {
+			return errors.New("content query must be valid UTF-8 and at most 4096 bytes")
+		}
+		if limit := f.readLimit(); limit < 0 || limit > maxSearchV2ReadLimit {
+			return errors.New("max_search_size must be between 0 and 1073741824 bytes")
+		}
+	}
+	return nil
+}
+
+// Match the gitignore-style normalization used by Wings-rs's ignore crate.
+// Globs are relative to the server filesystem root, independently of result names.
+func compileSearchV2Patterns(patterns []string, insensitive bool) ([]searchV2Pattern, error) {
+	result := make([]searchV2Pattern, 0, len(patterns))
+	for _, pattern := range patterns {
+		if !utf8.ValidString(pattern) || len(pattern) > betterFilesMaxPathLength || strings.ContainsAny(pattern, "\x00\r\n") {
+			return nil, errors.New("invalid path pattern")
+		}
+		if strings.HasPrefix(pattern, "#") {
+			continue
+		}
+		if !strings.HasSuffix(pattern, "\\ ") {
+			pattern = strings.TrimRightFunc(pattern, unicode.IsSpace)
+		}
+		if pattern == "" {
+			return nil, errors.New("path patterns must not be empty")
+		}
+		rule := searchV2Pattern{}
+		if strings.HasPrefix(pattern, "\\!") || strings.HasPrefix(pattern, "\\#") {
+			pattern = pattern[1:]
+		} else if strings.HasPrefix(pattern, "!") {
+			rule.negative = true
+			pattern = pattern[1:]
+		}
+		anchored := strings.HasPrefix(pattern, "/")
+		pattern = strings.TrimPrefix(pattern, "/")
+		if strings.HasSuffix(pattern, "/") {
+			rule.directoryOnly = true
+			pattern = strings.TrimSuffix(pattern, "/")
+			pattern = strings.TrimSuffix(pattern, "\\")
+		}
+		if pattern == "" || hasParentPathComponent(pattern) {
+			return nil, errors.New("invalid path pattern")
+		}
+		// Bound doublestar's recursive brace expansion. Nested/empty alternatives
+		// are deliberately rejected rather than changing the requested filter.
+		product, alternatives, inClass := 1, 0, false
+		for i := 0; i < len(pattern); i++ {
+			if pattern[i] == '\\' {
+				i++
+				continue
+			}
+			if pattern[i] == '[' {
+				inClass = true
+			}
+			if pattern[i] == ']' {
+				inClass = false
+				continue
+			}
+			if inClass {
+				continue
+			}
+			switch pattern[i] {
+			case '{':
+				if alternatives != 0 {
+					return nil, errors.New("nested glob alternatives are unsupported")
+				}
+				alternatives = 1
+				if i+1 < len(pattern) && (pattern[i+1] == ',' || pattern[i+1] == '}') {
+					return nil, errors.New("empty glob alternatives are unsupported")
+				}
+			case ',':
+				if alternatives > 0 {
+					alternatives++
+					if i+1 < len(pattern) && (pattern[i+1] == ',' || pattern[i+1] == '}') {
+						return nil, errors.New("empty glob alternatives are unsupported")
+					}
+				}
+			case '/':
+				if alternatives > 0 {
+					return nil, errors.New("glob alternatives must stay within one path component")
+				}
+			case '}':
+				if alternatives > 0 {
+					if product > maxSearchV2Alternatives/alternatives {
+						return nil, errors.New("glob has too many alternatives (maximum 64)")
+					}
+					product *= alternatives
+					alternatives = 0
+				}
+			}
+		}
+		if !anchored && !strings.Contains(pattern, "/") {
+			pattern = "**/" + pattern
+		}
+		if strings.HasSuffix(pattern, "/**") {
+			pattern += "/*"
+		}
+		var err error
+		rule.glob, err = compileSearchV2Glob(pattern, insensitive)
+		if err != nil {
+			return nil, err
+		}
+		result = append(result, rule)
+	}
+	return result, nil
+}
+
+func compileSearchV2Glob(pattern string, insensitive bool) (string, error) {
+	pattern = searchV2GlobBytes(pattern, false)
+	var out strings.Builder
+	for i := 0; i < len(pattern); i++ {
+		if pattern[i] == '\\' {
+			out.WriteByte('\\')
+			i++
+			if i == len(pattern) {
+				return "", errors.New("invalid path pattern escape")
+			}
+		} else if pattern[i] == '[' {
+			start := i + 1
+			negative := start < len(pattern) && (pattern[start] == '!' || pattern[start] == '^')
+			if negative {
+				start++
+			}
+			end := start
+			if end < len(pattern) && pattern[end] == ']' {
+				end++
+			}
+			for end < len(pattern) && pattern[end] != ']' {
+				if pattern[end] == '\\' {
+					end++
+				}
+				end++
+			}
+			if end >= len(pattern) {
+				return "", errors.New("unclosed glob character class")
+			}
+			inner := pattern[start:end]
+			if strings.HasPrefix(inner, "]") {
+				inner = "\\" + inner
+			}
+			positive := "[" + inner + "]"
+			if !doublestar.ValidatePattern(positive) {
+				return "", errors.New("invalid glob character class")
+			}
+			out.WriteByte('[')
+			if negative {
+				out.WriteByte('!')
+			}
+			if insensitive {
+				// Compile the original positive set before ASCII folding. Lowering
+				// endpoints first changes ranges such as [A-z] and [Z-a].
+				var members [256]bool
+				for value := 0; value < len(members); value++ {
+					if doublestar.MatchUnvalidated(positive, string(rune(value))) {
+						members[searchV2LowerASCII(byte(value))] = true
+					}
+				}
+				any := false
+				for value, present := range members {
+					if !present {
+						continue
+					}
+					any = true
+					if strings.ContainsRune("\\[]-!^", rune(value)) {
+						out.WriteByte('\\')
+					}
+					out.WriteRune(rune(value))
+				}
+				if !any {
+					return "", errors.New("empty glob character class")
+				}
+			} else {
+				out.WriteString(inner)
+			}
+			out.WriteByte(']')
+			i = end
+			continue
+		}
+		value := pattern[i]
+		if insensitive {
+			value = searchV2LowerASCII(value)
+		}
+		out.WriteByte(value)
+	}
+	compiled := out.String()
+	if !doublestar.ValidatePattern(compiled) {
+		return "", errors.New("invalid path pattern")
+	}
+	return compiled, nil
+}
+
+// doublestar matches runes, while globset matches bytes. Mapping each byte to a
+// rune preserves upstream '?' and character-class behavior for UTF-8 filenames.
+func searchV2GlobBytes(value string, insensitive bool) string {
+	var out strings.Builder
+	out.Grow(len(value))
+	for i := 0; i < len(value); i++ {
+		b := value[i]
+		if insensitive {
+			b = searchV2LowerASCII(b)
+		}
+		out.WriteRune(rune(b))
+	}
+	return out.String()
+}
+
+func searchV2PathDecision(serverPath string, directory bool, filter *searchV2PathFilter) (bool, bool) {
+	if filter == nil {
+		return true, false
+	}
+	candidate := searchV2GlobBytes(strings.TrimPrefix(serverPath, "/"), filter.CaseInsensitive)
+	matchRules := func(rules []searchV2Pattern) bool {
+		selected := false
+		for _, rule := range rules {
+			if (!rule.directoryOnly || directory) && doublestar.MatchUnvalidated(rule.glob, candidate) {
+				selected = !rule.negative
+			}
+		}
+		return selected
+	}
+	excluded := matchRules(filter.excludes)
+	return !excluded && (len(filter.Include) == 0 || matchRules(filter.includes)), excluded
+}
+
+func openSearchV2Root(ctx context.Context, fs *serverfs.Filesystem, root string) (ufs.File, error) {
+	current, err := fs.UnixFS().OpenFile(".", ufs.O_RDONLY|ufs.O_DIRECTORY|ufs.O_NOFOLLOW, 0)
+	if err != nil {
+		return nil, err
+	}
+	for _, name := range strings.Split(strings.TrimPrefix(root, "/"), "/") {
+		if name == "" {
+			continue
+		}
+		if err := ctx.Err(); err != nil {
+			_ = current.Close()
+			return nil, err
+		}
+		child, err := fs.UnixFS().OpenFileat(int(current.Fd()), name, ufs.O_RDONLY|ufs.O_DIRECTORY|ufs.O_NOFOLLOW, 0)
+		_ = current.Close()
+		if err != nil {
+			return nil, err
+		}
+		current = child
+	}
+	return current, nil
+}
+
+func runSearchV2(ctx context.Context, fs *serverfs.Filesystem, root string, data searchV2Payload, budget *searchV2Budget) ([]betterFilesEntry, error) {
+	if err := ctx.Err(); err != nil {
+		return nil, err
+	}
+	rootFile, err := openSearchV2Root(ctx, fs, root)
+	if err != nil {
+		return nil, fmt.Errorf("%w: %w", errSearchV2Root, err)
+	}
+	stack := []searchV2Directory{{file: rootFile, path: root}}
+	defer func() {
+		for _, frame := range stack {
+			_ = frame.file.Close()
+		}
+	}()
+	results := make([]betterFilesEntry, 0, data.PerPage)
+	if budget == nil {
+		budget = &searchV2Budget{readRemaining: maxSearchV2TotalRead}
+	}
+	budget.directoriesVisited++
+	var matcher *searchV2Matcher
+	if data.ContentFilter != nil {
+		matcher = newSearchV2Matcher(data.ContentFilter.Query, data.ContentFilter.CaseInsensitive)
+	}
+	for len(stack) > 0 && len(results) < data.PerPage {
+		if err := ctx.Err(); err != nil {
+			return nil, err
+		}
+		if budget.directoriesVisited > maxSearchV2Directories {
+			return nil, errSearchV2TraversalLimit
+		}
+		frame := &stack[len(stack)-1]
+		if frame.index == len(frame.names) {
+			if frame.eof {
+				_ = frame.file.Close()
+				stack = stack[:len(stack)-1]
+				continue
+			}
+			frame.names, err = frame.file.Readdirnames(searchV2DirectoryBatch)
+			frame.index = 0
+			frame.eof = errors.Is(err, io.EOF)
+			if err != nil && !frame.eof {
+				return nil, err
+			}
+			if len(frame.names) == 0 {
+				continue
+			}
+		}
+		name := frame.names[frame.index]
+		frame.index++
+		budget.entriesVisited++
+		if budget.entriesVisited > maxSearchV2Entries {
+			return nil, errSearchV2TraversalLimit
+		}
+		fullPath, err := joinBetterFilesPath(frame.path, name)
+		if err != nil || ensureBetterFilesAllowed(fs, fullPath) != nil {
+			continue
+		}
+		info, err := fs.UnixFS().Lstatat(int(frame.file.Fd()), name)
+		if errors.Is(err, ufs.ErrNotExist) {
+			continue
+		}
+		if err != nil {
+			return nil, err
+		}
+		if info.Mode()&ufs.ModeSymlink != 0 {
+			continue
+		}
+		included, excluded := searchV2PathDecision(fullPath, info.IsDir(), data.PathFilter)
+		if info.IsDir() {
+			if excluded {
+				continue
+			}
+			if frame.depth >= maxSearchV2Depth {
+				return nil, errSearchV2TraversalLimit
+			}
+			child, err := fs.UnixFS().OpenFileat(int(frame.file.Fd()), name, ufs.O_RDONLY|ufs.O_DIRECTORY|ufs.O_NOFOLLOW, 0)
+			if errors.Is(err, ufs.ErrNotExist) || errors.Is(err, unix.ELOOP) || errors.Is(err, unix.ENOTDIR) {
+				continue
+			}
+			if err != nil {
+				return nil, err
+			}
+			budget.directoriesVisited++
+			stack = append(stack, searchV2Directory{file: child, path: fullPath, depth: frame.depth + 1})
+			continue
+		}
+		if !included || !info.Mode().IsRegular() {
+			continue
+		}
+		entry, matched, err := searchV2File(ctx, fs, int(frame.file.Fd()), name, betterFilesRelativePath(root, fullPath), data, matcher, budget)
+		if err != nil {
+			return nil, err
+		}
+		if matched {
+			results = append(results, entry)
+		}
+	}
+	return results, nil
+}
+
+func betterFilesRelativePath(root, fullPath string) string {
+	if root == "/" {
+		return strings.TrimPrefix(fullPath, "/")
+	}
+	return strings.TrimPrefix(strings.TrimPrefix(fullPath, root), "/")
+}
+
+func searchV2SizeMatches(size int64, filter *searchV2SizeFilter) bool {
+	if filter == nil {
+		return true
+	}
+	if filter.Min != nil && size < *filter.Min {
+		return false
+	}
+	return filter.Max == nil || size < *filter.Max
+}
+
+type searchV2Reader struct {
+	ctx    context.Context
+	reader io.Reader
+	budget *searchV2Budget
+}
+
+func (r *searchV2Reader) Read(p []byte) (int, error) {
+	if err := r.ctx.Err(); err != nil {
+		return 0, err
+	}
+	if len(p) == 0 {
+		return 0, nil
+	}
+	if r.budget.readRemaining <= 0 {
+		return 0, errSearchV2ReadLimit
+	}
+	if int64(len(p)) > r.budget.readRemaining {
+		p = p[:r.budget.readRemaining]
+	}
+	n, err := r.reader.Read(p)
+	r.budget.readRemaining -= int64(n)
+	return n, err
+}
+
+func searchV2File(ctx context.Context, fs *serverfs.Filesystem, parent int, name, relative string, data searchV2Payload, matcher *searchV2Matcher, budget *searchV2Budget) (betterFilesEntry, bool, error) {
+	var empty betterFilesEntry
+	// A concurrently replaced regular file must not turn this open into a FIFO wait.
+	file, err := fs.UnixFS().OpenFileat(parent, name, ufs.O_RDONLY|ufs.O_NOFOLLOW|unix.O_NONBLOCK, 0)
+	if err != nil {
+		// Like Wings-rs, skip files that disappeared or cannot be opened.
+		return empty, false, ctx.Err()
+	}
+	defer file.Close()
+	info, err := file.Stat()
+	if err != nil {
+		return empty, false, ctx.Err()
+	}
+	if !info.Mode().IsRegular() || !searchV2SizeMatches(info.Size(), data.SizeFilter) {
+		return empty, false, nil
+	}
+	filter := data.ContentFilter
+	scanned := filter != nil && info.Size() <= filter.readLimit()
+	if filter != nil && !scanned && !filter.IncludeUnmatched {
+		return empty, false, nil
+	}
+	limit := int64(searchV2HeadBytes)
+	if scanned {
+		limit = filter.readLimit()
+	}
+	reader := io.LimitReader(&searchV2Reader{ctx: ctx, reader: file, budget: budget}, limit)
+	var head [searchV2HeadBytes]byte
+	n, readErr := io.ReadFull(reader, head[:])
+	if readErr != nil && readErr != io.EOF && readErr != io.ErrUnexpectedEOF {
+		return empty, false, readErr
+	}
+	if scanned {
+		if !validSearchV2TextHead(head[:n]) {
+			return empty, false, nil
+		}
+		matched, err := streamSearchV2Text(ctx, io.MultiReader(bytes.NewReader(head[:n]), reader), limit, matcher)
+		if err != nil {
+			return empty, false, err
+		}
+		if !matched {
+			return empty, false, nil
+		}
+	}
+	mime := mimetype.Detect(head[:n]).String()
+	return newBetterFilesEntry(relative, info, mime), true, nil
+}
+
+// Wings-rs uses a 128-byte UTF-8 head heuristic, not MIME or NUL-byte filtering.
+// An incomplete trailing rune in that head is allowed, as in is_valid_utf8_slice.
+func validSearchV2TextHead(head []byte) bool {
+	for len(head) > 0 {
+		if !utf8.FullRune(head) {
+			return true
+		}
+		value, size := utf8.DecodeRune(head)
+		if value == utf8.RuneError && size == 1 {
+			return false
+		}
+		head = head[size:]
+	}
+	return true
+}
+
+func searchV2LowerASCII(value byte) byte {
+	if value >= 'A' && value <= 'Z' {
+		return value + 'a' - 'A'
+	}
+	return value
+}
+
+func newSearchV2Matcher(query string, caseInsensitive bool) *searchV2Matcher {
+	pattern := []byte(query)
+	if caseInsensitive {
+		for i := range pattern {
+			pattern[i] = searchV2LowerASCII(pattern[i])
+		}
+	}
+	failure := make([]int, len(pattern))
+	for i, matched := 1, 0; i < len(pattern); i++ {
+		for matched > 0 && pattern[i] != pattern[matched] {
+			matched = failure[matched-1]
+		}
+		if pattern[i] == pattern[matched] {
+			matched++
+		}
+		failure[i] = matched
+	}
+	return &searchV2Matcher{pattern: pattern, failure: failure, caseInsensitive: caseInsensitive}
+}
+
+// The KMP state spans read boundaries. Byte matching preserves UTF-8 literals
+// and upstream ASCII-only case folding without allocating whole file contents.
+func streamSearchV2Text(ctx context.Context, reader io.Reader, limit int64, matcher *searchV2Matcher) (bool, error) {
+	if err := ctx.Err(); err != nil {
+		return false, err
+	}
+	if len(matcher.pattern) == 0 {
+		return true, nil
+	}
+	buffer := searchV2BufferPool.Get().(*[]byte)
+	defer searchV2BufferPool.Put(buffer)
+	reader = io.LimitReader(reader, limit)
+	state := 0
+	for {
+		if err := ctx.Err(); err != nil {
+			return false, err
+		}
+		n, readErr := reader.Read(*buffer)
+		if err := ctx.Err(); err != nil {
+			return false, err
+		}
+		for _, value := range (*buffer)[:n] {
+			if matcher.caseInsensitive {
+				value = searchV2LowerASCII(value)
+			}
+			for state > 0 && value != matcher.pattern[state] {
+				state = matcher.failure[state-1]
+			}
+			if value == matcher.pattern[state] {
+				state++
+			}
+			if state == len(matcher.pattern) {
+				return true, nil
+			}
+		}
+		if readErr == io.EOF {
+			return false, nil
+		}
+		if readErr != nil {
+			return false, readErr
+		}
+		if n == 0 {
+			return false, io.ErrNoProgress
+		}
+	}
+}
diff --git a/router/router_server_files_search_v2_test.go b/router/router_server_files_search_v2_test.go
new file mode 100644
index 00000000..1a9b2c36
--- /dev/null
+++ b/router/router_server_files_search_v2_test.go
@@ -0,0 +1,493 @@
+package router
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/require"
+	"golang.org/x/sys/unix"
+
+	"github.com/pterodactyl/wings/config"
+	"github.com/pterodactyl/wings/internal/ufs"
+	serverfs "github.com/pterodactyl/wings/server/filesystem"
+)
+
+func searchV2Number(value int64) *int64 { return &value }
+
+func searchV2Names(results []betterFilesEntry) []string {
+	names := make([]string, 0, len(results))
+	for _, result := range results {
+		names = append(names, result.Name)
+	}
+	return names
+}
+
+func runSearchV2Test(t *testing.T, fs *serverfs.Filesystem, root string, data searchV2Payload) []betterFilesEntry {
+	t.Helper()
+	if data.PerPage == 0 {
+		data.PerPage = 100
+	}
+	require.NoError(t, validateSearchV2Payload(&data))
+	results, err := runSearchV2(context.Background(), fs, root, data, nil)
+	require.NoError(t, err)
+	return results
+}
+
+func requestSearchV2(handler http.Handler, serverID, body string, ctx context.Context, authorized bool) *httptest.ResponseRecorder {
+	request := httptest.NewRequest(http.MethodPost, "/api/servers/"+serverID+"/files/search", strings.NewReader(body))
+	request.Header.Set("Content-Type", "application/json")
+	if authorized {
+		request.Header.Set("Authorization", "Bearer "+config.Get().Token.Token)
+	}
+	if ctx != nil {
+		request = request.WithContext(ctx)
+	}
+	response := httptest.NewRecorder()
+	handler.ServeHTTP(response, request)
+	return response
+}
+
+func TestSearchV2HTTPBFMContractAndRelativePaths(t *testing.T) {
+	_, s, handler := newBetterFilesHTTPServer(t, 10, 10)
+	fs := s.Filesystem()
+	writeBetterFilesFixture(t, fs, "/plugins/a/config.yml", []byte("enabled: true"))
+	writeBetterFilesFixture(t, fs, "/plugins/b/config.yml", []byte("ENABLED: false"))
+	writeBetterFilesFixture(t, fs, "/plugins/b/cache/config.yml", []byte("enabled"))
+	writeBetterFilesFixture(t, fs, "/outside/config.yml", []byte("enabled"))
+	body := `{"root":"/plugins","path_filter":{"include":["**/*.yml"],"exclude":["**/cache/**"],"case_insensitive":true},"size_filter":{"min":0,"max":10485760},"content_filter":{"query":"enabled","max_search_size":2097152,"include_unmatched":false,"case_insensitive":true},"per_page":100}`
+	response := requestSearchV2(handler, s.ID(), body, nil, true)
+	require.Equal(t, http.StatusOK, response.Code, response.Body.String())
+	var payload struct {
+		Results []betterFilesEntry `json:"results"`
+	}
+	require.NoError(t, json.Unmarshal(response.Body.Bytes(), &payload))
+	require.ElementsMatch(t, []string{"a/config.yml", "b/config.yml"}, searchV2Names(payload.Results))
+	for _, entry := range payload.Results {
+		require.True(t, entry.File)
+		require.False(t, entry.Directory)
+		require.False(t, entry.Symlink)
+		require.NotEmpty(t, entry.Mime)
+		require.NotEmpty(t, entry.Modified)
+		require.False(t, strings.HasPrefix(entry.Name, "/"))
+		require.NotContains(t, response.Body.String(), fs.Path())
+	}
+	// Leading-slash and slash-containing patterns are server-root anchored,
+	// independently of the relative names returned for this non-root search.
+	results := runSearchV2Test(t, fs, "/plugins", searchV2Payload{PathFilter: &searchV2PathFilter{Include: []string{"a/*.yml"}}})
+	require.Empty(t, results)
+	results = runSearchV2Test(t, fs, "/plugins", searchV2Payload{PathFilter: &searchV2PathFilter{Include: []string{"/plugins/a/*.yml"}}})
+	require.Equal(t, []string{"a/config.yml"}, searchV2Names(results))
+}
+
+func TestSearchV2OmittedNullFiltersAndEmptyArrays(t *testing.T) {
+	_, s, handler := newBetterFilesHTTPServer(t, 10, 10)
+	for _, body := range []string{`{}`, `{"root":null,"path_filter":null,"size_filter":null,"content_filter":null,"per_page":null}`, `{"path_filter":{"include":null,"exclude":null}}`} {
+		response := requestSearchV2(handler, s.ID(), body, nil, true)
+		require.Equal(t, http.StatusOK, response.Code, response.Body.String())
+		require.JSONEq(t, `{"results":[]}`, response.Body.String())
+	}
+	writeBetterFilesFixture(t, s.Filesystem(), "/nested/file.txt", []byte("test"))
+	response := requestSearchV2(handler, s.ID(), `{}`, nil, true)
+	require.Equal(t, http.StatusOK, response.Code)
+	require.Contains(t, response.Body.String(), "nested/file.txt")
+	require.NotContains(t, response.Body.String(), `"name":"nested"`)
+	response = requestSearchV2(handler, s.ID(), `{"per_page":0}`, nil, true)
+	require.JSONEq(t, `{"results":[]}`, response.Body.String())
+}
+
+func TestSearchV2GlobContentUnicodeAndIgnoredFiles(t *testing.T) {
+	fs := newBetterFilesTestFilesystem(t, 0, "logs/**", "ignored/**")
+	writeBetterFilesFixture(t, fs, "/config/paper.yml", []byte("name: HéLLo 😀\n"))
+	writeBetterFilesFixture(t, fs, "/config/other.yml", []byte("name: other\n"))
+	writeBetterFilesFixture(t, fs, "/logs/server.yml", []byte("name: HéLLo 😀\n"))
+	writeBetterFilesFixture(t, fs, "/ignored/secret.yml", []byte("name: HéLLo 😀\n"))
+	writeBetterFilesFixture(t, fs, "/config/binary.yml", []byte{0xff, 'x'})
+	results := runSearchV2Test(t, fs, "/", searchV2Payload{
+		PathFilter:    &searchV2PathFilter{Include: []string{"**/*.yml"}, Exclude: []string{"**/other.yml"}, CaseInsensitive: true},
+		ContentFilter: &searchV2ContentFilter{Query: "héllo 😀", MaxSearchSize: searchV2Number(1024), CaseInsensitive: true},
+	})
+	require.Equal(t, []string{"config/paper.yml"}, searchV2Names(results))
+}
+
+func TestSearchV2GlobOrderingExclusionsAndByteSemantics(t *testing.T) {
+	fs := newBetterFilesTestFilesystem(t, 0)
+	for _, name := range []string{"/root.yml", "/nested/paper.yml", "/nested/PAPER.YML", "/nested/cache/keep.yml", "/nested/other.yml", "/é.yml", "/😀.yml", "/#literal.yml"} {
+		writeBetterFilesFixture(t, fs, name, []byte("x"))
+	}
+	tests := []struct {
+		name     string
+		filter   searchV2PathFilter
+		expected []string
+	}{
+		{"basename at any depth", searchV2PathFilter{Include: []string{"*.yml"}, Exclude: []string{"cache/"}, CaseInsensitive: true}, []string{"root.yml", "nested/paper.yml", "nested/PAPER.YML", "nested/other.yml", "é.yml", "😀.yml", "#literal.yml"}},
+		{"server root anchor", searchV2PathFilter{Include: []string{"/*.yml"}}, []string{"root.yml", "é.yml", "😀.yml", "#literal.yml"}},
+		{"ordered include negation", searchV2PathFilter{Include: []string{"*.yml", "!**/other.yml"}, Exclude: []string{"cache/"}}, []string{"root.yml", "nested/paper.yml", "é.yml", "😀.yml", "#literal.yml"}},
+		{"ordered exclude reinclude", searchV2PathFilter{Include: []string{"*.yml"}, Exclude: []string{"*.yml", "!/root.yml"}}, []string{"root.yml"}},
+		{"excluded parents stay pruned", searchV2PathFilter{Include: []string{"**"}, Exclude: []string{"cache/", "!nested/cache/keep.yml"}}, []string{"root.yml", "nested/paper.yml", "nested/PAPER.YML", "nested/other.yml", "é.yml", "😀.yml", "#literal.yml"}},
+		{"brace and class", searchV2PathFilter{Include: []string{"**/[pr]*.{yml,yaml}"}, Exclude: []string{"cache/"}}, []string{"root.yml", "nested/paper.yml"}},
+		{"UTF8 byte question marks", searchV2PathFilter{Include: []string{"/??.yml"}}, []string{"é.yml"}},
+		{"emoji four bytes", searchV2PathFilter{Include: []string{"/????.yml"}}, []string{"😀.yml", "root.yml"}},
+		{"escaped leading hash", searchV2PathFilter{Include: []string{"\\#literal.yml"}}, []string{"#literal.yml"}},
+		{"case-sensitive default", searchV2PathFilter{Include: []string{"**/PAPER.YML"}}, []string{"nested/PAPER.YML"}},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			results := runSearchV2Test(t, fs, "/", searchV2Payload{PathFilter: &test.filter})
+			require.ElementsMatch(t, test.expected, searchV2Names(results))
+		})
+	}
+	// A trailing /** matches contents, not the directory node itself.
+	filter := &searchV2PathFilter{Exclude: []string{"**/cache/**"}}
+	require.NoError(t, validateSearchV2Payload(&searchV2Payload{PathFilter: filter}))
+	_, excluded := searchV2PathDecision("/nested/cache", true, filter)
+	require.False(t, excluded)
+	_, excluded = searchV2PathDecision("/nested/cache/child", true, filter)
+	require.True(t, excluded)
+}
+
+func TestSearchV2ASCIIOnlyCaseFolding(t *testing.T) {
+	fs := newBetterFilesTestFilesystem(t, 0)
+	writeBetterFilesFixture(t, fs, "/Ä.TXT", []byte("MiXeD Ä 😀"))
+	for _, query := range []struct {
+		query             string
+		insensitive, want bool
+	}{
+		{"mixed", false, false}, {"mixed", true, true}, {"ä", true, false}, {"Ä 😀", true, true},
+	} {
+		results := runSearchV2Test(t, fs, "/", searchV2Payload{ContentFilter: &searchV2ContentFilter{Query: query.query, CaseInsensitive: query.insensitive}})
+		require.Equal(t, query.want, len(results) == 1)
+	}
+	for _, pattern := range []struct {
+		pattern string
+		want    bool
+	}{{"ä.txt", false}, {"Ä.txt", true}} {
+		results := runSearchV2Test(t, fs, "/", searchV2Payload{PathFilter: &searchV2PathFilter{Include: []string{pattern.pattern}, CaseInsensitive: true}})
+		require.Equal(t, pattern.want, len(results) == 1)
+	}
+}
+
+func TestSearchV2CharacterClassesPreserveRangesAndLiteralBrackets(t *testing.T) {
+	fs := newBetterFilesTestFilesystem(t, 0)
+	for _, name := range []string{"_.txt", "].txt", "A.txt", "a.txt", "Z.txt", "z.txt", "b.txt"} {
+		writeBetterFilesFixture(t, fs, "/"+name, nil)
+	}
+	for _, test := range []struct {
+		pattern     string
+		insensitive bool
+		expected    []string
+	}{
+		{"[A-z].txt", true, []string{"_.txt", "].txt", "A.txt", "a.txt", "Z.txt", "z.txt", "b.txt"}},
+		{"[Z-a].txt", true, []string{"_.txt", "].txt", "A.txt", "a.txt", "Z.txt", "z.txt"}},
+		{"[]a].txt", false, []string{"].txt", "a.txt"}},
+		{"[]a].txt", true, []string{"].txt", "a.txt", "A.txt"}},
+		{"[!A-Z].txt", true, []string{"_.txt", "].txt"}},
+	} {
+		results := runSearchV2Test(t, fs, "/", searchV2Payload{PathFilter: &searchV2PathFilter{Include: []string{test.pattern}, CaseInsensitive: test.insensitive}})
+		require.ElementsMatch(t, test.expected, searchV2Names(results), test.pattern)
+	}
+}
+
+func TestSearchV2UnreadableFileDoesNotAbortReadableMatches(t *testing.T) {
+	if os.Geteuid() == 0 {
+		t.Skip("root can read mode-000 files")
+	}
+	_, s, handler := newBetterFilesHTTPServer(t, 10, 10)
+	writeBetterFilesFixture(t, s.Filesystem(), "/good.txt", []byte("match"))
+	writeBetterFilesFixture(t, s.Filesystem(), "/blocked.txt", []byte("match"))
+	blocked := filepath.Join(s.Filesystem().Path(), "blocked.txt")
+	require.NoError(t, os.Chmod(blocked, 0))
+	t.Cleanup(func() { _ = os.Chmod(blocked, 0o600) })
+	response := requestSearchV2(handler, s.ID(), `{"content_filter":{"query":"match"}}`, nil, true)
+	require.Equal(t, http.StatusOK, response.Code, response.Body.String())
+	var payload struct {
+		Results []betterFilesEntry `json:"results"`
+	}
+	require.NoError(t, json.Unmarshal(response.Body.Bytes(), &payload))
+	require.Equal(t, []string{"good.txt"}, searchV2Names(payload.Results))
+}
+
+func TestSearchV2SizeBoundaries(t *testing.T) {
+	fs := newBetterFilesTestFilesystem(t, 0)
+	for _, size := range []int{0, 4, 5, 6} {
+		writeBetterFilesFixture(t, fs, fmt.Sprintf("/size%d", size), bytes.Repeat([]byte("x"), size))
+	}
+	results := runSearchV2Test(t, fs, "/", searchV2Payload{SizeFilter: &searchV2SizeFilter{Min: searchV2Number(4), Max: searchV2Number(6)}})
+	require.ElementsMatch(t, []string{"size4", "size5"}, searchV2Names(results))
+	results = runSearchV2Test(t, fs, "/", searchV2Payload{SizeFilter: &searchV2SizeFilter{Min: searchV2Number(5), Max: searchV2Number(5)}})
+	require.Empty(t, results)
+	results = runSearchV2Test(t, fs, "/", searchV2Payload{SizeFilter: &searchV2SizeFilter{Max: searchV2Number(0)}})
+	require.Empty(t, results)
+	require.NoError(t, validateSearchV2Payload(&searchV2Payload{SizeFilter: &searchV2SizeFilter{}}))
+}
+
+func TestSearchV2IncludeUnmatchedBinaryAndEmptyQueries(t *testing.T) {
+	fs := newBetterFilesTestFilesystem(t, 0)
+	writeBetterFilesFixture(t, fs, "/match.txt", []byte("match"))
+	writeBetterFilesFixture(t, fs, "/other.txt", []byte("other"))
+	writeBetterFilesFixture(t, fs, "/large.txt", []byte("a large file without the needle"))
+	writeBetterFilesFixture(t, fs, "/binary-small", []byte{0xff, 'm', 'a', 't', 'c', 'h'})
+	writeBetterFilesFixture(t, fs, "/binary-large", append([]byte{0xff}, bytes.Repeat([]byte("x"), 30)...))
+	writeBetterFilesFixture(t, fs, "/nul.bin", []byte{'m', 'a', 0, 't', 'c', 'h'})
+	writeBetterFilesFixture(t, fs, "/empty.txt", nil)
+	results := runSearchV2Test(t, fs, "/", searchV2Payload{ContentFilter: &searchV2ContentFilter{Query: "match", MaxSearchSize: searchV2Number(6), IncludeUnmatched: true}})
+	require.ElementsMatch(t, []string{"match.txt", "large.txt", "binary-large"}, searchV2Names(results))
+	results = runSearchV2Test(t, fs, "/", searchV2Payload{ContentFilter: &searchV2ContentFilter{Query: "", MaxSearchSize: searchV2Number(6)}})
+	require.ElementsMatch(t, []string{"match.txt", "other.txt", "nul.bin", "empty.txt"}, searchV2Names(results))
+	results = runSearchV2Test(t, fs, "/", searchV2Payload{ContentFilter: &searchV2ContentFilter{Query: "", MaxSearchSize: searchV2Number(0)}})
+	require.Equal(t, []string{"empty.txt"}, searchV2Names(results))
+	results = runSearchV2Test(t, fs, "/", searchV2Payload{ContentFilter: &searchV2ContentFilter{Query: "absent", MaxSearchSize: searchV2Number(0), IncludeUnmatched: true}})
+	require.ElementsMatch(t, []string{"match.txt", "other.txt", "large.txt", "binary-small", "binary-large", "nul.bin"}, searchV2Names(results))
+	// The upstream heuristic examines the head only; later non-UTF8 bytes and
+	// MIME labels do not turn a valid head into a rejected content search.
+	writeBetterFilesFixture(t, fs, "/late-binary", append(bytes.Repeat([]byte("a"), 128), 0xff, 'm', 'a', 't', 'c', 'h'))
+	results = runSearchV2Test(t, fs, "/", searchV2Payload{PathFilter: &searchV2PathFilter{Include: []string{"late-binary"}}, ContentFilter: &searchV2ContentFilter{Query: "match"}})
+	require.Len(t, results, 1)
+	for _, input := range []struct {
+		head  []byte
+		valid bool
+	}{
+		{[]byte{0}, true}, {[]byte{0xff}, false}, {[]byte{0xe2, 0x82}, true}, {[]byte{0xe2, 'x'}, false}, {[]byte("�"), true},
+	} {
+		require.Equal(t, input.valid, validSearchV2TextHead(input.head))
+	}
+}
+
+type searchV2CountingReader struct {
+	io.Reader
+	bytes      int
+	maxRequest int
+	cancel     context.CancelFunc
+}
+
+func (r *searchV2CountingReader) Read(p []byte) (int, error) {
+	if len(p) > r.maxRequest {
+		r.maxRequest = len(p)
+	}
+	n, err := r.Reader.Read(p)
+	r.bytes += n
+	if r.cancel != nil {
+		r.cancel()
+	}
+	return n, err
+}
+
+func TestStreamSearchV2TextAcrossBufferBoundariesAndReadLimits(t *testing.T) {
+	content := append(bytes.Repeat([]byte("a"), 64*1024-2), []byte("a😀Target")...)
+	reader := &searchV2CountingReader{Reader: bytes.NewReader(content)}
+	matched, err := streamSearchV2Text(context.Background(), reader, int64(len(content)), newSearchV2Matcher("a😀target", true))
+	require.NoError(t, err)
+	require.True(t, matched)
+	require.LessOrEqual(t, reader.maxRequest, 64*1024)
+	reader = &searchV2CountingReader{Reader: strings.NewReader("a needle beyond the limit")}
+	matched, err = streamSearchV2Text(context.Background(), reader, 3, newSearchV2Matcher("needle", false))
+	require.NoError(t, err)
+	require.False(t, matched)
+	require.Equal(t, 3, reader.bytes)
+	matched, err = streamSearchV2Text(context.Background(), strings.NewReader("match"), 5, newSearchV2Matcher("match", false))
+	require.NoError(t, err)
+	require.True(t, matched)
+	ctx, cancel := context.WithCancel(context.Background())
+	reader = &searchV2CountingReader{Reader: strings.NewReader("match"), cancel: cancel}
+	_, err = streamSearchV2Text(ctx, reader, 5, newSearchV2Matcher("match", false))
+	require.ErrorIs(t, err, context.Canceled)
+}
+
+func TestSearchV2HeadAndTotalReadBudget(t *testing.T) {
+	fs := newBetterFilesTestFilesystem(t, 0)
+	writeBetterFilesFixture(t, fs, "/large", bytes.Repeat([]byte("x"), 1024*1024))
+	data := searchV2Payload{ContentFilter: &searchV2ContentFilter{Query: "absent", MaxSearchSize: searchV2Number(0), IncludeUnmatched: true}, PerPage: 100}
+	require.NoError(t, validateSearchV2Payload(&data))
+	budget := &searchV2Budget{readRemaining: searchV2HeadBytes}
+	results, err := runSearchV2(context.Background(), fs, "/", data, budget)
+	require.NoError(t, err)
+	require.Len(t, results, 1)
+	require.Equal(t, int64(0), budget.readRemaining)
+	data.ContentFilter.MaxSearchSize = searchV2Number(1024 * 1024)
+	budget = &searchV2Budget{readRemaining: 256}
+	_, err = runSearchV2(context.Background(), fs, "/", data, budget)
+	require.ErrorIs(t, err, errSearchV2ReadLimit)
+	data.ContentFilter.MaxSearchSize = searchV2Number(1024 * 1024 * 1024)
+	require.NoError(t, validateSearchV2Payload(&data), "BFM allows up to 1 GiB")
+	require.Equal(t, defaultSearchV2ReadLimit, (searchV2ContentFilter{}).readLimit())
+}
+
+func TestSearchV2HTTPInvalidInputsAndAuthorization(t *testing.T) {
+	_, s, handler := newBetterFilesHTTPServer(t, 10, 10, "private/**")
+	cases := []struct {
+		body   string
+		status int
+	}{
+		{`null`, 400}, {`[]`, 400}, {`{} {}`, 400}, {`{"include":["*.txt"]}`, 400},
+		{`{"path_filter":{"unknown":true}}`, 400}, {`{"content_filter":{"max_search_size":"5"}}`, 400},
+		{`{"match_context":{"before":1}}`, 400}, {`{"per_page":-1}`, 422},
+		{`{"size_filter":{"min":-1}}`, 422}, {`{"size_filter":{"min":5,"max":4}}`, 422},
+		{`{"content_filter":{"max_search_size":-1}}`, 422}, {`{"content_filter":{"max_search_size":1073741825}}`, 422},
+		{`{"path_filter":{"include":["["]}}`, 422}, {`{"path_filter":{"include":["../*"]}}`, 422},
+		{`{"path_filter":{"include":["{a,{b,c}}"]}}`, 422}, {`{"path_filter":{"include":["{a,}"]}}`, 422},
+		{`{"root":"/../plugins"}`, 422}, {`{"root":"/private/deep"}`, 403}, {`{"root":"/missing"}`, 404},
+	}
+	for _, test := range cases {
+		t.Run(test.body, func(t *testing.T) {
+			response := requestSearchV2(handler, s.ID(), test.body, nil, true)
+			require.Equal(t, test.status, response.Code, response.Body.String())
+			require.Contains(t, response.Body.String(), `"error"`)
+		})
+	}
+	response := requestSearchV2(handler, s.ID(), `{}`, nil, false)
+	require.Equal(t, 401, response.Code)
+	response = requestSearchV2(handler, s.ID(), strings.Repeat(" ", maxSearchV2RequestBytes)+`{}`, nil, true)
+	require.Equal(t, 413, response.Code)
+	response = requestSearchV2(handler, s.ID(), "{\"root\":\"/\xff\"}", nil, true)
+	require.Equal(t, 400, response.Code)
+	ctx, cancel := context.WithCancel(context.Background())
+	cancel()
+	response = requestSearchV2(handler, s.ID(), `{}`, ctx, true)
+	require.Equal(t, 408, response.Code)
+}
+
+func TestSearchV2PatternAndQueryLimits(t *testing.T) {
+	cases := []struct {
+		name     string
+		patterns []string
+		valid    bool
+	}{
+		{"maximum count", strings.Split(strings.Repeat("a,", maxSearchV2Patterns-1)+"a", ","), true},
+		{"too many", strings.Split(strings.Repeat("a,", maxSearchV2Patterns)+"a", ","), false},
+		{"maximum bytes", strings.Split(strings.Repeat(strings.Repeat("a", 4096)+",", 15)+strings.Repeat("a", 4096), ","), true},
+		{"too many bytes", strings.Split(strings.Repeat(strings.Repeat("a", 4096)+",", 16)+"a", ","), false},
+		{"pattern too long", []string{strings.Repeat("a", 4097)}, false},
+		{"64 combinations", []string{strings.Repeat("{a,b}", 6)}, true},
+		{"128 combinations", []string{strings.Repeat("{a,b}", 7)}, false},
+		{"cross-directory alternative", []string{"{plugins/a,config/b}.yml"}, false},
+		{"empty pattern", []string{""}, false},
+	}
+	for _, test := range cases {
+		t.Run(test.name, func(t *testing.T) {
+			data := searchV2Payload{PathFilter: &searchV2PathFilter{Include: test.patterns}}
+			err := validateSearchV2Payload(&data)
+			if test.valid {
+				require.NoError(t, err)
+			} else {
+				require.Error(t, err)
+			}
+		})
+	}
+	data := searchV2Payload{ContentFilter: &searchV2ContentFilter{Query: strings.Repeat("é", 2048)}}
+	require.NoError(t, validateSearchV2Payload(&data))
+	data.ContentFilter.Query += "a"
+	require.Error(t, validateSearchV2Payload(&data))
+}
+
+func TestSearchV2RejectsSymlinkRootsAndTraversal(t *testing.T) {
+	for _, openat2 := range []bool{false, true} {
+		t.Run(fmt.Sprint(openat2), func(t *testing.T) {
+			_, s, handler := newBetterFilesHTTPServer(t, 10, 10, "protected/**")
+			fs := s.Filesystem()
+			native, err := ufs.NewUnixFS(fs.Path(), openat2)
+			require.NoError(t, err)
+			*fs.UnixFS() = *native
+			writeBetterFilesFixture(t, fs, "/protected/nested/deep/secret.txt", []byte("secret"))
+			writeBetterFilesFixture(t, fs, "/safe/file.txt", []byte("safe"))
+			require.NoError(t, os.Symlink("protected", filepath.Join(fs.Path(), "alias")))
+			response := requestSearchV2(handler, s.ID(), `{"root":"/alias/nested/deep"}`, nil, true)
+			require.Equal(t, 422, response.Code, response.Body.String())
+			outside := t.TempDir()
+			require.NoError(t, os.WriteFile(filepath.Join(outside, "outside.txt"), []byte("secret"), 0o600))
+			require.NoError(t, os.Symlink(outside, filepath.Join(fs.Path(), "escape")))
+			require.NoError(t, os.Symlink("../protected/nested/deep/secret.txt", filepath.Join(fs.Path(), "safe", "link")))
+			results := runSearchV2Test(t, fs, "/", searchV2Payload{})
+			require.Equal(t, []string{"safe/file.txt"}, searchV2Names(results))
+		})
+	}
+}
+
+func TestSearchV2PinnedDirectoryAndNonblockingFileOpen(t *testing.T) {
+	fs := newBetterFilesTestFilesystem(t, 0, "protected/**")
+	writeBetterFilesFixture(t, fs, "/safe/file.txt", []byte("safe"))
+	writeBetterFilesFixture(t, fs, "/protected/file.txt", []byte("secret"))
+	parent, err := openSearchV2Root(context.Background(), fs, "/safe")
+	require.NoError(t, err)
+	defer parent.Close()
+	require.NoError(t, os.Rename(filepath.Join(fs.Path(), "safe"), filepath.Join(fs.Path(), "original")))
+	require.NoError(t, os.Symlink("protected", filepath.Join(fs.Path(), "safe")))
+	entry, matched, err := searchV2File(context.Background(), fs, int(parent.Fd()), "file.txt", "file.txt", searchV2Payload{ContentFilter: &searchV2ContentFilter{Query: "safe"}}, newSearchV2Matcher("safe", false), &searchV2Budget{readRemaining: 1024})
+	require.NoError(t, err)
+	require.True(t, matched)
+	require.Equal(t, "file.txt", entry.Name)
+	fifo := filepath.Join(fs.Path(), "original", "fifo")
+	require.NoError(t, unix.Mkfifo(fifo, 0o600))
+	done := make(chan error, 1)
+	go func() {
+		_, matched, err := searchV2File(context.Background(), fs, int(parent.Fd()), "fifo", "fifo", searchV2Payload{}, nil, &searchV2Budget{readRemaining: 1024})
+		if err == nil && matched {
+			err = errors.New("FIFO incorrectly included")
+		}
+		done <- err
+	}()
+	select {
+	case err := <-done:
+		require.NoError(t, err)
+	case <-time.After(time.Second):
+		fd, err := unix.Open(fifo, unix.O_RDWR|unix.O_NONBLOCK, 0)
+		if err == nil {
+			defer unix.Close(fd)
+		}
+		t.Fatal("search open blocked on a FIFO")
+	}
+}
+
+func TestSearchV2ResultTraversalDepthAndCancellationLimits(t *testing.T) {
+	fs := newBetterFilesTestFilesystem(t, 0)
+	for i := 0; i < maxSearchV2Results+5; i++ {
+		writeBetterFilesFixture(t, fs, fmt.Sprintf("/file-%03d", i), nil)
+	}
+	data := searchV2Payload{PerPage: 5000}
+	require.NoError(t, validateSearchV2Payload(&data))
+	require.Equal(t, 500, data.PerPage)
+	results, err := runSearchV2(context.Background(), fs, "/", data, nil)
+	require.NoError(t, err)
+	require.Len(t, results, 500)
+	budget := &searchV2Budget{entriesVisited: maxSearchV2Entries - 1, readRemaining: 1024}
+	_, err = runSearchV2(context.Background(), fs, "/", searchV2Payload{PerPage: 100}, budget)
+	require.ErrorIs(t, err, errSearchV2TraversalLimit)
+	ctx, cancel := context.WithCancel(context.Background())
+	cancel()
+	_, err = runSearchV2(ctx, fs, "/", data, nil)
+	require.ErrorIs(t, err, context.Canceled)
+	fs = newBetterFilesTestFilesystem(t, 0)
+	writeBetterFilesFixture(t, fs, "/dir/file.txt", nil)
+	budget = &searchV2Budget{directoriesVisited: maxSearchV2Directories - 1, readRemaining: 1024}
+	_, err = runSearchV2(context.Background(), fs, "/", searchV2Payload{PerPage: 100}, budget)
+	require.ErrorIs(t, err, errSearchV2TraversalLimit)
+	fs = newBetterFilesTestFilesystem(t, 0)
+	writeBetterFilesFixture(t, fs, "/"+strings.Repeat("d/", maxSearchV2Depth+1)+"file.txt", nil)
+	_, err = runSearchV2(context.Background(), fs, "/", searchV2Payload{PerPage: 100}, nil)
+	require.ErrorIs(t, err, errSearchV2TraversalLimit)
+}
+
+func TestLegacyGETSearchStillUsesLegacyResponse(t *testing.T) {
+	_, s, handler := newBetterFilesHTTPServer(t, 10, 10)
+	writeBetterFilesFixture(t, s.Filesystem(), "/config/paper.yml", []byte("legacy"))
+	request := httptest.NewRequest(http.MethodGet, "/api/servers/"+s.ID()+"/files/search?"+url.Values{"query": {"paper"}}.Encode(), nil)
+	request.Header.Set("Authorization", "Bearer "+config.Get().Token.Token)
+	response := httptest.NewRecorder()
+	handler.ServeHTTP(response, request)
+	require.Equal(t, http.StatusOK, response.Code, response.Body.String())
+	var legacy FileSearchResponse
+	require.NoError(t, json.Unmarshal(response.Body.Bytes(), &legacy))
+	require.Len(t, legacy.Data, 1)
+	require.Equal(t, "paper.yml", legacy.Data[0].Name)
+	require.Equal(t, "paper", legacy.Meta.Query)
+}
diff --git a/router/router_server_git.go b/router/router_server_git.go
new file mode 100644
index 00000000..55461106
--- /dev/null
+++ b/router/router_server_git.go
@@ -0,0 +1,1648 @@
+package router
+
+import (
+	"bytes"
+	"context"
+	"crypto/rand"
+	"encoding/hex"
+	"fmt"
+	"io"
+	"net"
+	"net/http"
+	"net/url"
+	"os"
+	"path"
+	"regexp"
+	"strconv"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/apex/log"
+	"github.com/docker/docker/api/types/container"
+	"github.com/docker/docker/api/types/image"
+	"github.com/docker/docker/api/types/mount"
+	"github.com/docker/docker/pkg/stdcopy"
+	"github.com/gin-gonic/gin"
+	"github.com/pterodactyl/wings/config"
+	"github.com/pterodactyl/wings/environment/docker"
+	"github.com/pterodactyl/wings/router/middleware"
+	wserver "github.com/pterodactyl/wings/server"
+	serverfs "github.com/pterodactyl/wings/server/filesystem"
+)
+
+const gitContainerRoot = "/home/container"
+const gitHelperRoot = "/mnt/server"
+const gitBetterFilesTrashDir = ".trash-bin"
+const gitRootUser = "0"
+const gitMinimumMajorVersion = 2
+const gitMinimumMinorVersion = 37
+
+type gitCloneTargetMode int
+
+const (
+	gitCloneTargetEmpty gitCloneTargetMode = iota
+	gitCloneTargetInternalOnly
+)
+
+var (
+	gitPathCache       sync.Map
+	gitLocks           sync.Map
+	gitHelperImagePull sync.Mutex
+
+	gitHelperImages = []string{
+		"alpine/git:2.49.1",
+	}
+
+	gitTrustedBinaries = []string{
+		"/usr/bin/git",
+		"/usr/local/bin/git",
+		"/bin/git",
+	}
+
+	gitSafeEnv = []string{
+		"GIT_TERMINAL_PROMPT=0",
+		"GIT_ASKPASS=/bin/false",
+		"SSH_ASKPASS=/bin/false",
+		"GIT_CONFIG_NOSYSTEM=1",
+		"GIT_CONFIG_GLOBAL=/dev/null",
+		"GIT_CONFIG_SYSTEM=/dev/null",
+		"GIT_CONFIG_COUNT=0",
+		"GIT_CONFIG_PARAMETERS=",
+		"GIT_NO_LAZY_FETCH=1",
+		"GIT_ALLOW_PROTOCOL=https",
+		"HTTP_PROXY=",
+		"HTTPS_PROXY=",
+		"ALL_PROXY=",
+		"http_proxy=",
+		"https_proxy=",
+		"all_proxy=",
+		"HOME=/tmp",
+	}
+
+	gitBlockedNetworks = []*net.IPNet{
+		mustParseGitCIDR("0.0.0.0/8"),
+		mustParseGitCIDR("10.0.0.0/8"),
+		mustParseGitCIDR("100.64.0.0/10"),
+		mustParseGitCIDR("127.0.0.0/8"),
+		mustParseGitCIDR("169.254.0.0/16"),
+		mustParseGitCIDR("172.16.0.0/12"),
+		mustParseGitCIDR("192.0.0.0/24"),
+		mustParseGitCIDR("192.0.2.0/24"),
+		mustParseGitCIDR("192.168.0.0/16"),
+		mustParseGitCIDR("198.18.0.0/15"),
+		mustParseGitCIDR("198.51.100.0/24"),
+		mustParseGitCIDR("203.0.113.0/24"),
+		mustParseGitCIDR("224.0.0.0/4"),
+		mustParseGitCIDR("240.0.0.0/4"),
+		mustParseGitCIDR("255.255.255.255/32"),
+		mustParseGitCIDR("::/128"),
+		mustParseGitCIDR("::1/128"),
+		mustParseGitCIDR("2001:db8::/32"),
+		mustParseGitCIDR("fc00::/7"),
+		mustParseGitCIDR("fe80::/10"),
+		mustParseGitCIDR("fec0::/10"),
+		mustParseGitCIDR("ff00::/8"),
+	}
+
+	gitTargetDirectoryPattern = regexp.MustCompile(`^[A-Za-z0-9._-]{1,128}$`)
+	gitRemoteNamePattern      = regexp.MustCompile(`^[A-Za-z0-9._-]{1,128}$`)
+	gitCredentialPattern      = regexp.MustCompile(`(?i)(https://)([^/@\s]+)@`)
+	gitVersionPattern         = regexp.MustCompile(`(?i)^git version (\d+)\.(\d+)(?:\.|$)`)
+)
+
+const gitUnsafeLocalConfigPattern = `(?i)^(filter\..*\.(process|smudge|clean)|merge\..*\.driver|diff\..*\.(command|textconv)|core\.(sshCommand|fsmonitor|alternateRefsCommand)|credential\.helper|url\..*\.(insteadOf|pushInsteadOf)|remote\..*\.(proxy|proxyauthmethod|vcs|promisor|partialCloneFilter)|extensions\.partialClone|fetch\.bundleURI|transfer\.bundleURI|gc\.auto|maintenance\.auto|include.*|http\..*)$`
+
+type gitCloneRequest struct {
+	RepositoryURL   string `json:"repository_url" binding:"required"`
+	TargetDirectory string `json:"target_directory"`
+	WorkDir         string `json:"work_dir"`
+}
+
+type gitPullRequest struct {
+	WorkDir string `json:"work_dir"`
+}
+
+type gitDiffRequest struct {
+	WorkDir string `json:"work_dir"`
+	File    string `json:"file"`
+}
+
+type gitResponse struct {
+	Stdout   string `json:"stdout"`
+	Stderr   string `json:"stderr"`
+	ExitCode int    `json:"exit_code"`
+}
+
+type gitInstallResponse struct {
+	Installed        bool   `json:"installed"`
+	AlreadyInstalled bool   `json:"already_installed"`
+	PackageManager   string `json:"package_manager"`
+	GitPath          string `json:"git_path"`
+	Version          string `json:"version"`
+	Stdout           string `json:"stdout"`
+	Stderr           string `json:"stderr"`
+}
+
+type gitPackageManager struct {
+	Name     string
+	Paths    []string
+	Commands [][]string
+	Env      []string
+}
+
+type gitRunner struct {
+	env                   *docker.Environment
+	serverID              string
+	fsRoot                string
+	bin                   string
+	helper                bool
+	helperUser            string
+	helperNetworkDisabled bool
+}
+
+type validatedGitRepositoryURL struct {
+	URL            string
+	CurlOptResolve string
+	RemoteName     string
+}
+
+func findGitBinary(ctx context.Context, env *docker.Environment) string {
+	if cached, ok := gitPathCache.Load(env.Id); ok {
+		p := cached.(string)
+		if gitBinaryWorks(ctx, env, p) {
+			return p
+		}
+		gitPathCache.Delete(env.Id)
+	}
+
+	for _, p := range gitTrustedBinaries {
+		if gitBinaryWorks(ctx, env, p) {
+			gitPathCache.Store(env.Id, p)
+			return p
+		}
+	}
+
+	return ""
+}
+
+func gitBinaryWorks(ctx context.Context, env *docker.Environment, gitBin string) bool {
+	res, err := execInContainer(ctx, env, []string{gitBin, "--version"}, gitContainerRoot)
+	return err == nil && res.ExitCode == 0 && gitVersionSupportsPinnedResolution(res.Stdout)
+}
+
+func gitVersionSupportsPinnedResolution(output string) bool {
+	matches := gitVersionPattern.FindStringSubmatch(strings.TrimSpace(output))
+	if len(matches) != 3 {
+		return false
+	}
+	major, majorErr := strconv.Atoi(matches[1])
+	minor, minorErr := strconv.Atoi(matches[2])
+	if majorErr != nil || minorErr != nil {
+		return false
+	}
+	return major > gitMinimumMajorVersion || major == gitMinimumMajorVersion && minor >= gitMinimumMinorVersion
+}
+
+func newGitRunner(ctx context.Context, s *wserver.Server, env *docker.Environment) *gitRunner {
+	runner := &gitRunner{
+		env:        env,
+		serverID:   s.ID(),
+		fsRoot:     s.Filesystem().Path(),
+		helperUser: getContainerUser(),
+	}
+	if gitBin := findGitBinary(ctx, env); gitBin != "" {
+		runner.bin = gitBin
+		return runner
+	}
+
+	runner.bin = "git"
+	runner.helper = true
+	return runner
+}
+
+func (r *gitRunner) exec(ctx context.Context, args []string, workDir string, remotes ...validatedGitRepositoryURL) (*gitResponse, error) {
+	// Network commands always run in the isolated helper. In the server container,
+	// a tenant can observe the command line and race a matching .git/config entry
+	// into place before Git reads it. The helper has its own PID namespace, keeping
+	// the per-command remote identity below secret until configuration is loaded.
+	if len(remotes) > 0 && !r.helper {
+		helperRunner := *r
+		helperRunner.bin = "git"
+		helperRunner.helper = true
+		result, err := execGitInHelperContainer(ctx, &helperRunner, gitCommand(helperRunner.bin, args, remotes...), workDir)
+		hideGitRemoteIdentities(result, remotes)
+		return result, err
+	}
+
+	cmd := gitCommand(r.bin, args, remotes...)
+
+	if r.helper {
+		result, err := execGitInHelperContainer(ctx, r, cmd, workDir)
+		hideGitRemoteIdentities(result, remotes)
+		return result, err
+	}
+
+	return execInContainer(ctx, r.env, cmd, workDir)
+}
+
+func (r *gitRunner) execOffline(ctx context.Context, args []string, workDir string) (*gitResponse, error) {
+	helperRunner := *r
+	helperRunner.bin = "git"
+	helperRunner.helper = true
+	helperRunner.helperNetworkDisabled = true
+	return execGitInHelperContainer(ctx, &helperRunner, gitCommand(helperRunner.bin, args), workDir)
+}
+
+func hideGitRemoteIdentities(result *gitResponse, remotes []validatedGitRepositoryURL) {
+	if result == nil {
+		return
+	}
+	for _, remote := range remotes {
+		if remote.RemoteName == "" {
+			continue
+		}
+		alias := gitRemoteAlias(remote.RemoteName)
+		result.Stdout = strings.ReplaceAll(result.Stdout, alias, "[remote]")
+		result.Stderr = strings.ReplaceAll(result.Stderr, alias, "[remote]")
+		result.Stdout = strings.ReplaceAll(result.Stdout, remote.RemoteName, "[remote]")
+		result.Stderr = strings.ReplaceAll(result.Stderr, remote.RemoteName, "[remote]")
+	}
+}
+
+func gitCommand(gitBin string, args []string, remotes ...validatedGitRepositoryURL) []string {
+	cmd := gitBaseCommand(gitBin)
+	for _, remote := range remotes {
+		if remote.RemoteName != "" {
+			alias := gitRemoteAlias(remote.RemoteName)
+			cmd = append(cmd,
+				// Git applies insteadOf only once. Resolving a secret alias to the validated
+				// URL prevents a local insteadOf rule for that URL from being applied later.
+				"-c", "url."+remote.URL+".insteadOf="+alias,
+				"-c", "remote."+remote.RemoteName+".url="+alias,
+				"-c", "remote."+remote.RemoteName+".proxy=",
+			)
+		}
+		for _, requestURL := range gitRemoteConfigURLs(remote.URL) {
+			prefix := "http." + requestURL + "."
+			cmd = append(cmd,
+				"-c", prefix+"followRedirects=false",
+				"-c", prefix+"proxy=",
+				"-c", prefix+"curloptResolve=",
+			)
+			if remote.CurlOptResolve != "" {
+				cmd = append(cmd, "-c", prefix+"curloptResolve="+remote.CurlOptResolve)
+			}
+		}
+	}
+	return append(cmd, args...)
+}
+
+func newGitRemoteName() (string, error) {
+	random := make([]byte, 24)
+	if _, err := rand.Read(random); err != nil {
+		return "", fmt.Errorf("could not generate a secure Git remote identity: %w", err)
+	}
+	return hex.EncodeToString(random), nil
+}
+
+func gitRemoteAlias(remoteName string) string {
+	return remoteName + ":"
+}
+
+func gitRemoteConfigURLs(repositoryURL string) []string {
+	if strings.HasSuffix(repositoryURL, "/") {
+		return []string{repositoryURL}
+	}
+	return []string{repositoryURL, repositoryURL + "/"}
+}
+
+func gitCloneNetworkArgs(remote validatedGitRepositoryURL, targetPath string) []string {
+	return []string{
+		"clone",
+		"--depth=1",
+		"--single-branch",
+		"--no-tags",
+		"--no-recurse-submodules",
+		"--no-checkout",
+		gitRemoteAlias(remote.RemoteName),
+		targetPath,
+	}
+}
+
+func gitClonePersistRemoteArgs(remote validatedGitRepositoryURL) []string {
+	return []string{"config", "--local", "--replace-all", "remote.origin.url", remote.URL}
+}
+
+func gitCloneCheckoutArgs() []string {
+	return []string{"checkout", "--force"}
+}
+
+func gitPullFetchArgs(remote validatedGitRepositoryURL, branch string) []string {
+	// Depth is intentionally explicit: remote-curl refuses dumb HTTP when a
+	// shallow fetch is requested, preventing objects/info/http-alternates from
+	// introducing unvalidated destinations.
+	return []string{"fetch", "--deepen=1", "--no-recurse-submodules", remote.RemoteName, branch}
+}
+
+func gitPullMergeArgs() []string {
+	return []string{"merge", "--ff-only", "--no-edit", "FETCH_HEAD"}
+}
+
+func combineGitResponses(first *gitResponse, second *gitResponse) *gitResponse {
+	if first == nil {
+		return second
+	}
+	if second == nil {
+		return first
+	}
+	return &gitResponse{
+		Stdout:   first.Stdout + second.Stdout,
+		Stderr:   first.Stderr + second.Stderr,
+		ExitCode: second.ExitCode,
+	}
+}
+
+func (r *gitRunner) version(ctx context.Context) string {
+	var result *gitResponse
+	var err error
+	if r.helper {
+		result, err = execGitInHelperContainer(ctx, r, []string{r.bin, "--version"}, gitContainerRoot)
+	} else {
+		result, err = execInContainer(ctx, r.env, []string{r.bin, "--version"}, gitContainerRoot)
+	}
+	if err != nil || result.ExitCode != 0 {
+		return ""
+	}
+	return strings.TrimSpace(result.Stdout)
+}
+
+func gitRuntimeName(runner *gitRunner) string {
+	if runner.helper {
+		return "helper"
+	}
+	return "container"
+}
+
+func postServerGitInstall(c *gin.Context) {
+	s := middleware.ExtractServer(c)
+
+	env, ok := s.Environment.(*docker.Environment)
+	if !ok {
+		c.AbortWithStatusJSON(http.StatusConflict, gin.H{
+			"error": "Git operations are only supported in Docker environments.",
+		})
+		return
+	}
+
+	lock := gitLockFor(env.Id)
+	if !lock.TryLock() {
+		c.AbortWithStatusJSON(http.StatusConflict, gin.H{"error": "A Git operation is already running for this server."})
+		return
+	}
+	defer lock.Unlock()
+
+	ctx, cancel := context.WithTimeout(c.Request.Context(), 3*time.Minute)
+	defer cancel()
+
+	if gitBin := findGitBinary(ctx, env); gitBin != "" {
+		c.JSON(http.StatusOK, gitInstallResponse{
+			Installed:        true,
+			AlreadyInstalled: true,
+			PackageManager:   "none",
+			GitPath:          gitBin,
+			Version:          gitVersion(ctx, env, gitBin),
+		})
+		return
+	}
+
+	pm, binaryPath := detectGitPackageManager(ctx, env)
+	if pm == nil {
+		runner := newGitRunner(ctx, s, env)
+		version := runner.version(ctx)
+		if version == "" {
+			c.AbortWithStatusJSON(http.StatusConflict, gin.H{
+				"error": "No supported package manager was found in this container, and the Git helper container could not run. Use an image that includes Git.",
+			})
+			return
+		}
+		c.JSON(http.StatusOK, gitInstallResponse{
+			Installed:        true,
+			AlreadyInstalled: false,
+			PackageManager:   "helper",
+			GitPath:          "git",
+			Version:          version,
+		})
+		return
+	}
+
+	var combinedStdout, combinedStderr strings.Builder
+	for _, args := range pm.Commands {
+		cmd := append([]string{binaryPath}, args...)
+		result, err := execInContainerAsUser(ctx, env, cmd, "/", gitRootUser, append(gitInstallEnv(), pm.Env...))
+		if err != nil {
+			middleware.CaptureAndAbort(c, err)
+			return
+		}
+		combinedStdout.WriteString(result.Stdout)
+		combinedStderr.WriteString(result.Stderr)
+		if result.ExitCode != 0 {
+			c.AbortWithStatusJSON(http.StatusConflict, gin.H{
+				"installed":       false,
+				"package_manager": pm.Name,
+				"error":           "Git installation failed.",
+				"stdout":          strings.TrimSpace(maskGitOutput(combinedStdout.String())),
+				"stderr":          strings.TrimSpace(maskGitOutput(combinedStderr.String())),
+				"exit_code":       result.ExitCode,
+			})
+			return
+		}
+	}
+
+	gitPathCache.Delete(env.Id)
+	gitBin := findGitBinary(ctx, env)
+	if gitBin == "" {
+		c.AbortWithStatusJSON(http.StatusConflict, gin.H{
+			"installed":       false,
+			"package_manager": pm.Name,
+			"error":           "Package install completed, but Git still was not found in a trusted path.",
+			"stdout":          strings.TrimSpace(maskGitOutput(combinedStdout.String())),
+			"stderr":          strings.TrimSpace(maskGitOutput(combinedStderr.String())),
+		})
+		return
+	}
+
+	c.JSON(http.StatusOK, gitInstallResponse{
+		Installed:        true,
+		AlreadyInstalled: false,
+		PackageManager:   pm.Name,
+		GitPath:          gitBin,
+		Version:          gitVersion(ctx, env, gitBin),
+		Stdout:           strings.TrimSpace(maskGitOutput(combinedStdout.String())),
+		Stderr:           strings.TrimSpace(maskGitOutput(combinedStderr.String())),
+	})
+}
+
+func getServerGitStatus(c *gin.Context) {
+	s := middleware.ExtractServer(c)
+
+	env, ok := s.Environment.(*docker.Environment)
+	if !ok {
+		c.AbortWithStatusJSON(http.StatusConflict, gin.H{
+			"error": "Git operations are only supported in Docker environments.",
+		})
+		return
+	}
+
+	workDir, err := normalizeGitWorkDir(c.Query("work_dir"))
+	if err != nil {
+		c.AbortWithStatusJSON(http.StatusForbidden, gin.H{"error": err.Error()})
+		return
+	}
+
+	ctx, cancel := context.WithTimeout(c.Request.Context(), 90*time.Second)
+	defer cancel()
+
+	runner := newGitRunner(ctx, s, env)
+
+	checkResult, err := runner.exec(ctx, []string{"rev-parse", "--is-inside-work-tree"}, workDir)
+	if err != nil {
+		middleware.CaptureAndAbort(c, err)
+		return
+	}
+	if checkResult.ExitCode != 0 {
+		c.JSON(http.StatusOK, gin.H{
+			"available": true,
+			"is_repo":   false,
+			"runtime":   gitRuntimeName(runner),
+			"error":     strings.TrimSpace(maskGitOutput(checkResult.Stderr + checkResult.Stdout)),
+		})
+		return
+	}
+
+	statusResult, _ := runner.exec(ctx, []string{"status", "--porcelain", "-b"}, workDir)
+	branchResult, _ := runner.exec(ctx, []string{"rev-parse", "--abbrev-ref", "HEAD"}, workDir)
+	remoteResult, _ := runner.exec(ctx, []string{"remote", "-v"}, workDir)
+	logResult, _ := runner.exec(ctx, []string{"log", "--oneline", "-20"}, workDir)
+
+	c.JSON(http.StatusOK, gin.H{
+		"available": true,
+		"is_repo":   true,
+		"runtime":   gitRuntimeName(runner),
+		"branch":    strings.TrimSpace(branchResult.Stdout),
+		"status":    statusResult.Stdout,
+		"remotes":   maskGitOutput(remoteResult.Stdout),
+		"log":       logResult.Stdout,
+	})
+}
+
+func postServerGitClone(c *gin.Context) {
+	s := middleware.ExtractServer(c)
+
+	var req gitCloneRequest
+	if err := c.BindJSON(&req); err != nil {
+		return
+	}
+
+	env, ok := s.Environment.(*docker.Environment)
+	if !ok {
+		c.AbortWithStatusJSON(http.StatusConflict, gin.H{
+			"error": "Git operations are only supported in Docker environments.",
+		})
+		return
+	}
+
+	workDir, err := normalizeGitWorkDir(req.WorkDir)
+	if err != nil {
+		c.AbortWithStatusJSON(http.StatusForbidden, gin.H{"error": err.Error()})
+		return
+	}
+
+	ctx, cancel := context.WithTimeout(c.Request.Context(), 2*time.Minute)
+	defer cancel()
+
+	repositoryURL, err := validateGitRepositoryURL(ctx, req.RepositoryURL)
+	if err != nil {
+		c.AbortWithStatusJSON(http.StatusForbidden, gin.H{"error": err.Error()})
+		return
+	}
+
+	targetDirectory := strings.TrimSpace(req.TargetDirectory)
+	targetPath := workDir
+	if targetDirectory != "" {
+		if err := validateGitTargetDirectory(targetDirectory); err != nil {
+			c.AbortWithStatusJSON(http.StatusUnprocessableEntity, gin.H{"error": err.Error()})
+			return
+		}
+		targetPath = path.Join(workDir, targetDirectory)
+	}
+
+	if !isInsideGitRoot(targetPath) {
+		c.AbortWithStatusJSON(http.StatusForbidden, gin.H{"error": "Target directory must stay inside the server files."})
+		return
+	}
+
+	targetServerPath := containerPathToServerPath(targetPath)
+
+	runner := newGitRunner(ctx, s, env)
+
+	lock := gitLockFor(env.Id)
+	if !lock.TryLock() {
+		middleware.ExtractLogger(c).WithFields(log.Fields{
+			"operation":      "clone",
+			"container_id":   env.Id,
+			"repository_url": maskGitOutput(repositoryURL.URL),
+			"repo_host":      gitRepositoryHost(repositoryURL.URL),
+			"work_dir":       workDir,
+			"target":         targetPath,
+		}).Warn("git operation rejected because another git operation is already running")
+		c.AbortWithStatusJSON(http.StatusConflict, gin.H{"error": "A Git operation is already running for this server."})
+		return
+	}
+	defer lock.Unlock()
+
+	started := time.Now()
+	logger := middleware.ExtractLogger(c).WithFields(log.Fields{
+		"operation":      "clone",
+		"container_id":   env.Id,
+		"repository_url": maskGitOutput(repositoryURL.URL),
+		"repo_host":      gitRepositoryHost(repositoryURL.URL),
+		"work_dir":       workDir,
+		"target":         targetPath,
+	})
+	logger.Info("starting git operation")
+
+	targetMode, err := inspectGitCloneTarget(s.Filesystem(), targetServerPath)
+	if err != nil {
+		c.AbortWithStatusJSON(http.StatusConflict, gin.H{"error": err.Error()})
+		return
+	}
+
+	cloneTargetPath := targetPath
+	var tempServerPath string
+	if targetMode == gitCloneTargetInternalOnly {
+		var err error
+		cloneTargetPath, tempServerPath, err = makeGitCloneTempTarget(s.Filesystem(), targetPath)
+		if err != nil {
+			c.AbortWithStatusJSON(http.StatusConflict, gin.H{"error": err.Error()})
+			return
+		}
+		defer func() {
+			_ = s.Filesystem().Delete(tempServerPath)
+		}()
+	}
+
+	// Transfer objects without populating the worktree. A tenant can race local
+	// filter configuration into the new repository, so checkout happens later in
+	// a helper container that has no network namespace.
+	result, err := runner.exec(ctx, gitCloneNetworkArgs(repositoryURL, cloneTargetPath), workDir, repositoryURL)
+	if err != nil {
+		middleware.CaptureAndAbort(c, err)
+		return
+	}
+	if result.ExitCode == 0 {
+		persistResult, err := runner.execOffline(ctx, gitClonePersistRemoteArgs(repositoryURL), cloneTargetPath)
+		if err != nil {
+			middleware.CaptureAndAbort(c, err)
+			return
+		}
+		result = combineGitResponses(result, persistResult)
+	}
+	if result.ExitCode == 0 {
+		checkoutResult, err := runner.execOffline(ctx, gitCloneCheckoutArgs(), cloneTargetPath)
+		if err != nil {
+			middleware.CaptureAndAbort(c, err)
+			return
+		}
+		result = combineGitResponses(result, checkoutResult)
+	}
+
+	if result.ExitCode == 0 {
+		if targetMode == gitCloneTargetInternalOnly {
+			if err := promoteGitCloneTempTarget(s.Filesystem(), tempServerPath, targetServerPath); err != nil {
+				c.AbortWithStatusJSON(http.StatusConflict, gin.H{"error": err.Error()})
+				return
+			}
+		}
+		_ = addGitInternalExcludes(s.Filesystem(), targetServerPath)
+	}
+	if cloneTargetPath != targetPath {
+		result.Stdout = strings.ReplaceAll(result.Stdout, cloneTargetPath, targetPath)
+		result.Stderr = strings.ReplaceAll(result.Stderr, cloneTargetPath, targetPath)
+	}
+
+	logger.WithFields(log.Fields{
+		"duration":  time.Since(started),
+		"exit_code": result.ExitCode,
+	}).Info("completed git operation")
+
+	c.JSON(http.StatusOK, maskGitResponse(result))
+}
+
+func postServerGitPull(c *gin.Context) {
+	s := middleware.ExtractServer(c)
+
+	var req gitPullRequest
+	if err := c.BindJSON(&req); err != nil {
+		return
+	}
+
+	env, ok := s.Environment.(*docker.Environment)
+	if !ok {
+		c.AbortWithStatusJSON(http.StatusConflict, gin.H{
+			"error": "Git operations are only supported in Docker environments.",
+		})
+		return
+	}
+
+	workDir, err := normalizeGitWorkDir(req.WorkDir)
+	if err != nil {
+		c.AbortWithStatusJSON(http.StatusForbidden, gin.H{"error": err.Error()})
+		return
+	}
+
+	ctx, cancel := context.WithTimeout(c.Request.Context(), time.Minute)
+	defer cancel()
+
+	runner := newGitRunner(ctx, s, env)
+
+	checkResult, err := runner.exec(ctx, []string{"rev-parse", "--is-inside-work-tree"}, workDir)
+	if err != nil {
+		middleware.CaptureAndAbort(c, err)
+		return
+	}
+	if checkResult.ExitCode != 0 {
+		c.AbortWithStatusJSON(http.StatusConflict, gin.H{"error": "This directory is not a Git repository."})
+		return
+	}
+
+	if err := ensureNoDangerousLocalGitConfig(ctx, runner, workDir); err != nil {
+		c.AbortWithStatusJSON(http.StatusForbidden, gin.H{"error": err.Error()})
+		return
+	}
+
+	branchResult, err := runner.exec(ctx, []string{"rev-parse", "--abbrev-ref", "HEAD"}, workDir)
+	if err != nil {
+		middleware.CaptureAndAbort(c, err)
+		return
+	}
+	branch := strings.TrimSpace(branchResult.Stdout)
+	if branch == "" || branch == "HEAD" || !isSafeGitRef(branch) {
+		c.AbortWithStatusJSON(http.StatusConflict, gin.H{"error": "Cannot pull while the repository is detached or has an invalid branch."})
+		return
+	}
+
+	remoteNameResult, err := runner.exec(ctx, []string{"config", "--get", "branch." + branch + ".remote"}, workDir)
+	if err != nil {
+		middleware.CaptureAndAbort(c, err)
+		return
+	}
+	remoteName := strings.TrimSpace(remoteNameResult.Stdout)
+	if remoteName == "" {
+		remoteName = "origin"
+	}
+	if !gitRemoteNamePattern.MatchString(remoteName) {
+		c.AbortWithStatusJSON(http.StatusForbidden, gin.H{"error": "Repository remote name is not allowed."})
+		return
+	}
+
+	mergeRefResult, _ := runner.exec(ctx, []string{"config", "--get", "branch." + branch + ".merge"}, workDir)
+	remoteBranch := strings.TrimSpace(mergeRefResult.Stdout)
+	remoteBranch = strings.TrimPrefix(remoteBranch, "refs/heads/")
+	if remoteBranch == "" {
+		remoteBranch = branch
+	}
+	if !isSafeGitRef(remoteBranch) {
+		c.AbortWithStatusJSON(http.StatusForbidden, gin.H{"error": "Repository upstream branch is not allowed."})
+		return
+	}
+
+	remoteURLResult, err := runner.exec(ctx, []string{"remote", "get-url", remoteName}, workDir)
+	if err != nil {
+		middleware.CaptureAndAbort(c, err)
+		return
+	}
+	remoteURL, err := validateGitRepositoryURL(ctx, remoteURLResult.Stdout)
+	if err != nil {
+		c.AbortWithStatusJSON(http.StatusForbidden, gin.H{"error": "Repository remote is not allowed: " + err.Error()})
+		return
+	}
+
+	lock := gitLockFor(env.Id)
+	if !lock.TryLock() {
+		middleware.ExtractLogger(c).WithFields(log.Fields{
+			"operation":      "pull",
+			"container_id":   env.Id,
+			"repository_url": maskGitOutput(remoteURL.URL),
+			"repo_host":      gitRepositoryHost(remoteURL.URL),
+			"work_dir":       workDir,
+			"branch":         remoteBranch,
+		}).Warn("git operation rejected because another git operation is already running")
+		c.AbortWithStatusJSON(http.StatusConflict, gin.H{"error": "A Git operation is already running for this server."})
+		return
+	}
+	defer lock.Unlock()
+
+	started := time.Now()
+	logger := middleware.ExtractLogger(c).WithFields(log.Fields{
+		"operation":      "pull",
+		"container_id":   env.Id,
+		"repository_url": maskGitOutput(remoteURL.URL),
+		"repo_host":      gitRepositoryHost(remoteURL.URL),
+		"work_dir":       workDir,
+		"branch":         remoteBranch,
+	})
+	logger.Info("starting git operation")
+
+	// Fetch does not update the worktree, so it cannot invoke checkout filters.
+	// The fast-forward worktree update then runs without network access, containing
+	// any raced local filter process even if the config changes after validation.
+	result, err := runner.exec(ctx, gitPullFetchArgs(remoteURL, remoteBranch), workDir, remoteURL)
+	if err != nil {
+		middleware.CaptureAndAbort(c, err)
+		return
+	}
+	if result.ExitCode == 0 {
+		mergeResult, err := runner.execOffline(ctx, gitPullMergeArgs(), workDir)
+		if err != nil {
+			middleware.CaptureAndAbort(c, err)
+			return
+		}
+		result = combineGitResponses(result, mergeResult)
+	}
+
+	logger.WithFields(log.Fields{
+		"duration":  time.Since(started),
+		"exit_code": result.ExitCode,
+	}).Info("completed git operation")
+
+	c.JSON(http.StatusOK, maskGitResponse(result))
+}
+
+func postServerGitDiff(c *gin.Context) {
+	s := middleware.ExtractServer(c)
+
+	var req gitDiffRequest
+	if err := c.BindJSON(&req); err != nil {
+		return
+	}
+
+	env, ok := s.Environment.(*docker.Environment)
+	if !ok {
+		c.AbortWithStatusJSON(http.StatusConflict, gin.H{
+			"error": "Git operations are only supported in Docker environments.",
+		})
+		return
+	}
+
+	workDir, err := normalizeGitWorkDir(req.WorkDir)
+	if err != nil {
+		c.AbortWithStatusJSON(http.StatusForbidden, gin.H{"error": err.Error()})
+		return
+	}
+
+	diffPath, err := normalizeGitDiffPath(req.File)
+	if err != nil {
+		c.AbortWithStatusJSON(http.StatusUnprocessableEntity, gin.H{"error": err.Error()})
+		return
+	}
+
+	ctx, cancel := context.WithTimeout(c.Request.Context(), time.Minute)
+	defer cancel()
+
+	runner := newGitRunner(ctx, s, env)
+
+	checkResult, err := runner.exec(ctx, []string{"rev-parse", "--is-inside-work-tree"}, workDir)
+	if err != nil {
+		middleware.CaptureAndAbort(c, err)
+		return
+	}
+	if checkResult.ExitCode != 0 {
+		c.AbortWithStatusJSON(http.StatusConflict, gin.H{"error": "This directory is not a Git repository."})
+		return
+	}
+
+	if err := ensureNoDangerousLocalGitConfig(ctx, runner, workDir); err != nil {
+		c.AbortWithStatusJSON(http.StatusForbidden, gin.H{"error": err.Error()})
+		return
+	}
+
+	cachedArgs := gitDiffArgs(true, diffPath)
+	unstagedArgs := gitDiffArgs(false, diffPath)
+
+	cachedResult, err := runner.exec(ctx, cachedArgs, workDir)
+	if err != nil {
+		middleware.CaptureAndAbort(c, err)
+		return
+	}
+
+	unstagedResult, err := runner.exec(ctx, unstagedArgs, workDir)
+	if err != nil {
+		middleware.CaptureAndAbort(c, err)
+		return
+	}
+
+	result := &gitResponse{
+		Stdout:   combineGitDiffOutput(cachedResult.Stdout, unstagedResult.Stdout),
+		Stderr:   strings.TrimSpace(cachedResult.Stderr + "\n" + unstagedResult.Stderr),
+		ExitCode: 0,
+	}
+	if cachedResult.ExitCode != 0 {
+		result.ExitCode = cachedResult.ExitCode
+	} else if unstagedResult.ExitCode != 0 {
+		result.ExitCode = unstagedResult.ExitCode
+	}
+	if result.Stdout == "" && result.Stderr == "" {
+		result.Stdout = "(no tracked diff)"
+	}
+
+	c.JSON(http.StatusOK, maskGitResponse(result))
+}
+
+func gitVersion(ctx context.Context, env *docker.Environment, gitBin string) string {
+	result, err := execInContainer(ctx, env, []string{gitBin, "--version"}, gitContainerRoot)
+	if err != nil || result.ExitCode != 0 {
+		return ""
+	}
+	return strings.TrimSpace(result.Stdout)
+}
+
+func detectGitPackageManager(ctx context.Context, env *docker.Environment) (*gitPackageManager, string) {
+	managers := []gitPackageManager{
+		{
+			Name:  "apt",
+			Paths: []string{"/usr/bin/apt-get", "/bin/apt-get"},
+			Commands: [][]string{
+				{"-o", "Dpkg::Use-Pty=0", "update"},
+				{
+					"-o", "Dpkg::Use-Pty=0",
+					"-o", "Dpkg::Options::=--force-confold",
+					"install", "-y", "--no-install-recommends", "git", "ca-certificates",
+				},
+			},
+			Env: []string{
+				"DEBIAN_FRONTEND=noninteractive",
+				"APT_LISTCHANGES_FRONTEND=none",
+			},
+		},
+		{
+			Name:     "apk",
+			Paths:    []string{"/sbin/apk", "/usr/sbin/apk", "/bin/apk", "/usr/bin/apk"},
+			Commands: [][]string{{"add", "--no-cache", "--no-progress", "git", "ca-certificates"}},
+		},
+		{
+			Name:     "dnf",
+			Paths:    []string{"/usr/bin/dnf", "/bin/dnf"},
+			Commands: [][]string{{"install", "-y", "git", "ca-certificates"}},
+		},
+		{
+			Name:     "microdnf",
+			Paths:    []string{"/usr/bin/microdnf", "/bin/microdnf"},
+			Commands: [][]string{{"install", "-y", "git", "ca-certificates"}},
+		},
+		{
+			Name:     "yum",
+			Paths:    []string{"/usr/bin/yum", "/bin/yum"},
+			Commands: [][]string{{"install", "-y", "git", "ca-certificates"}},
+		},
+	}
+
+	for i := range managers {
+		for _, p := range managers[i].Paths {
+			res, err := execInContainerAsUser(ctx, env, []string{p, "--version"}, "/", gitRootUser, gitInstallEnv())
+			if err == nil && res.ExitCode == 0 {
+				return &managers[i], p
+			}
+		}
+	}
+
+	return nil, ""
+}
+
+func gitInstallEnv() []string {
+	return []string{
+		"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
+		"HOME=/root",
+		"LC_ALL=C",
+		"GIT_TERMINAL_PROMPT=0",
+	}
+}
+
+func execGitInHelperContainer(ctx context.Context, runner *gitRunner, cmd []string, workDir string) (*gitResponse, error) {
+	helperImage, err := ensureGitHelperImage(ctx, runner.env)
+	if err != nil {
+		return nil, err
+	}
+
+	cli := runner.env.Client()
+	helperCmd := append([]string(nil), cmd...)
+	for i := range helperCmd {
+		helperCmd[i] = gitHelperPath(helperCmd[i])
+	}
+
+	script := strings.Join([]string{
+		`if ! command -v git >/dev/null 2>&1 || [ ! -e /etc/ssl/certs/ca-certificates.crt ]; then echo "The Git helper image is missing required HTTPS support." >&2; exit 126; fi`,
+		`git_version="$(git --version 2>/dev/null)" || exit 126`,
+		`git_version="${git_version#git version }"`,
+		`git_major="${git_version%%.*}"`,
+		`git_minor_version="${git_version#*.}"`,
+		`git_minor="${git_minor_version%%.*}"`,
+		fmt.Sprintf(`case "$git_major" in ''|*[!0-9]*) echo "Git %d.%d or newer is required." >&2; exit 126 ;; esac`, gitMinimumMajorVersion, gitMinimumMinorVersion),
+		fmt.Sprintf(`case "$git_minor" in ''|*[!0-9]*) echo "Git %d.%d or newer is required." >&2; exit 126 ;; esac`, gitMinimumMajorVersion, gitMinimumMinorVersion),
+		fmt.Sprintf(`if [ "$git_major" -lt %d ] || { [ "$git_major" -eq %d ] && [ "$git_minor" -lt %d ]; }; then echo "Git %d.%d or newer is required." >&2; exit 126; fi`, gitMinimumMajorVersion, gitMinimumMajorVersion, gitMinimumMinorVersion, gitMinimumMajorVersion, gitMinimumMinorVersion),
+		`exec "$@"`,
+	}, "\n")
+
+	containerName := fmt.Sprintf("%s_bfm_git_%d", runner.serverID, time.Now().UnixNano())
+	conf := &container.Config{
+		Hostname:     "bfm-git",
+		User:         runner.helperUser,
+		AttachStdout: true,
+		AttachStderr: true,
+		Entrypoint:   []string{"sh", "-lc", script, "bfm-git"},
+		Cmd:          helperCmd,
+		Image:        helperImage,
+		WorkingDir:   gitHelperPath(workDir),
+		Env: append(append([]string(nil), gitSafeEnv...),
+			"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
+		),
+		Labels: map[string]string{
+			"Service":       "Pterodactyl",
+			"ContainerType": "betterfiles_git_helper",
+			"ServerID":      runner.serverID,
+		},
+	}
+
+	cfg := config.Get()
+	hostConf := &container.HostConfig{
+		Mounts: []mount.Mount{
+			{
+				Target:   gitHelperRoot,
+				Source:   runner.fsRoot,
+				Type:     mount.TypeBind,
+				ReadOnly: false,
+			},
+		},
+		Tmpfs: map[string]string{
+			"/tmp": "rw,exec,nosuid,size=" + strconv.Itoa(int(cfg.Docker.TmpfsSize)) + "M",
+		},
+		DNS:         cfg.Docker.Network.Dns,
+		LogConfig:   cfg.Docker.ContainerLogConfig(),
+		NetworkMode: gitHelperNetworkMode(container.NetworkMode(cfg.Docker.Network.Mode), runner.helperNetworkDisabled),
+		UsernsMode:  container.UsernsMode(cfg.Docker.UsernsMode),
+		Resources: container.Resources{
+			Memory:    cfg.Docker.InstallerLimits.Memory * 1024 * 1024,
+			CPUQuota:  cfg.Docker.InstallerLimits.Cpu * 1000,
+			CPUPeriod: 100000,
+		},
+		SecurityOpt:    []string{"no-new-privileges"},
+		ReadonlyRootfs: true,
+		CapDrop: []string{
+			"setpcap", "mknod", "audit_write", "net_raw", "dac_override",
+			"fowner", "fsetid", "net_bind_service", "sys_chroot", "setfcap",
+		},
+	}
+
+	created, err := cli.ContainerCreate(ctx, conf, hostConf, nil, nil, containerName)
+	if err != nil {
+		return nil, err
+	}
+	defer func() {
+		_ = cli.ContainerRemove(context.Background(), created.ID, container.RemoveOptions{Force: true, RemoveVolumes: true})
+	}()
+
+	if err := cli.ContainerStart(ctx, created.ID, container.StartOptions{}); err != nil {
+		return nil, err
+	}
+
+	wait, waitErr := cli.ContainerWait(ctx, created.ID, container.WaitConditionNotRunning)
+	var statusCode int64
+	select {
+	case err := <-waitErr:
+		if err != nil {
+			return nil, err
+		}
+	case result := <-wait:
+		statusCode = result.StatusCode
+	case <-ctx.Done():
+		return &gitResponse{Stderr: "command timed out", ExitCode: 124}, nil
+	}
+
+	logs, err := cli.ContainerLogs(ctx, created.ID, container.LogsOptions{ShowStdout: true, ShowStderr: true})
+	if err != nil {
+		return nil, err
+	}
+	defer logs.Close()
+
+	var stdout, stderr bytes.Buffer
+	if _, err := stdcopy.StdCopy(&stdout, &stderr, logs); err != nil {
+		return nil, err
+	}
+
+	output := gitContainerPath(stdout.String())
+	errOutput := gitContainerPath(stderr.String())
+	if len(output) > 512*1024 {
+		output = output[:512*1024] + "\n...(truncated)"
+	}
+	if len(errOutput) > 64*1024 {
+		errOutput = errOutput[:64*1024] + "\n...(truncated)"
+	}
+
+	return &gitResponse{
+		Stdout:   output,
+		Stderr:   errOutput,
+		ExitCode: int(statusCode),
+	}, nil
+}
+
+func gitHelperNetworkMode(configured container.NetworkMode, disabled bool) container.NetworkMode {
+	if disabled {
+		return container.NetworkMode("none")
+	}
+	return configured
+}
+
+func ensureGitHelperImage(ctx context.Context, env *docker.Environment) (string, error) {
+	cli := env.Client()
+	for _, helperImage := range gitHelperImages {
+		if _, err := cli.ImageInspect(ctx, helperImage); err == nil {
+			return helperImage, nil
+		}
+	}
+
+	gitHelperImagePull.Lock()
+	defer gitHelperImagePull.Unlock()
+
+	var failures []string
+	for _, helperImage := range gitHelperImages {
+		if _, err := cli.ImageInspect(ctx, helperImage); err == nil {
+			return helperImage, nil
+		}
+
+		_, registryAuth := config.Get().Docker.RegistryCredentialsForImage(helperImage)
+		pullOptions := image.PullOptions{}
+		if registryAuth != nil {
+			if encoded, err := registryAuth.Base64(); err == nil {
+				pullOptions.RegistryAuth = encoded
+			}
+		}
+		reader, err := cli.ImagePull(ctx, helperImage, pullOptions)
+		if err != nil {
+			failures = append(failures, fmt.Sprintf("%s: %s", helperImage, err.Error()))
+			continue
+		}
+		_, copyErr := io.Copy(io.Discard, reader)
+		_ = reader.Close()
+		if copyErr != nil {
+			failures = append(failures, fmt.Sprintf("%s: %s", helperImage, copyErr.Error()))
+			continue
+		}
+		return helperImage, nil
+	}
+
+	if len(failures) == 0 {
+		return "", fmt.Errorf("no Git helper images are configured")
+	}
+	return "", fmt.Errorf("failed to pull any Git helper image: %s", strings.Join(failures, "; "))
+}
+
+func gitHelperPath(value string) string {
+	if value == gitContainerRoot {
+		return gitHelperRoot
+	}
+	if strings.HasPrefix(value, gitContainerRoot+"/") {
+		return gitHelperRoot + strings.TrimPrefix(value, gitContainerRoot)
+	}
+	return value
+}
+
+func gitContainerPath(value string) string {
+	return strings.ReplaceAll(value, gitHelperRoot, gitContainerRoot)
+}
+
+func gitBaseCommand(gitBin string) []string {
+	return []string{
+		gitBin,
+		"-c", "core.hooksPath=/dev/null",
+		"-c", "protocol.file.allow=never",
+		"-c", "protocol.ext.allow=never",
+		"-c", "protocol.git.allow=never",
+		"-c", "protocol.ssh.allow=never",
+		// Redirect targets bypass the DNS validation and address pinning applied to the original remote.
+		"-c", "http.followRedirects=false",
+		"-c", "http.proxy=",
+		"-c", "http.curloptResolve=",
+		"-c", "remote.origin.proxy=",
+		"-c", "fetch.bundleURI=",
+		"-c", "transfer.bundleURI=false",
+		"-c", "credential.helper=",
+		"-c", "core.askPass=",
+		"-c", "core.fsmonitor=false",
+		"-c", "core.alternateRefsCommand=/bin/true",
+		"-c", "core.untrackedCache=false",
+		"-c", "gc.auto=0",
+		"-c", "maintenance.auto=false",
+		"-c", "submodule.recurse=false",
+		"-c", "diff.external=",
+		"-c", "advice.detachedHead=false",
+	}
+}
+
+func ensureNoDangerousLocalGitConfig(ctx context.Context, runner *gitRunner, workDir string) error {
+	result, err := runner.exec(ctx, []string{
+		"config",
+		"--local",
+		"--get-regexp",
+		gitUnsafeLocalConfigPattern,
+	}, workDir)
+	if err != nil {
+		return err
+	}
+
+	if result.ExitCode == 0 && strings.TrimSpace(result.Stdout) != "" {
+		return fmt.Errorf("Repository local Git config contains unsafe settings.")
+	}
+
+	return nil
+}
+
+func normalizeGitWorkDir(raw string) (string, error) {
+	cleaned := strings.TrimSpace(raw)
+	if cleaned == "" || cleaned == "/" {
+		return gitContainerRoot, nil
+	}
+	if strings.ContainsAny(cleaned, "\x00\n\r\\") {
+		return "", fmt.Errorf("Invalid work directory.")
+	}
+
+	var normalized string
+	if strings.HasPrefix(cleaned, gitContainerRoot) {
+		normalized = path.Clean(cleaned)
+	} else {
+		normalized = path.Join(gitContainerRoot, strings.TrimPrefix(cleaned, "/"))
+	}
+
+	if !isInsideGitRoot(normalized) {
+		return "", fmt.Errorf("Work directory must stay inside the server files.")
+	}
+
+	return normalized, nil
+}
+
+func normalizeGitDiffPath(raw string) (string, error) {
+	cleaned := strings.TrimSpace(raw)
+	if cleaned == "" {
+		return "", nil
+	}
+	if len(cleaned) > 4096 || strings.ContainsAny(cleaned, "\x00\n\r\\") {
+		return "", fmt.Errorf("Diff path is invalid.")
+	}
+	if strings.HasPrefix(cleaned, "/") || strings.HasPrefix(cleaned, "-") || strings.HasPrefix(cleaned, ":") {
+		return "", fmt.Errorf("Diff path is not allowed.")
+	}
+
+	normalized := path.Clean(cleaned)
+	if normalized == "." || normalized == ".." || strings.HasPrefix(normalized, "../") || strings.Contains(normalized, "/../") {
+		return "", fmt.Errorf("Diff path must stay inside the repository.")
+	}
+
+	return normalized, nil
+}
+
+func isInsideGitRoot(p string) bool {
+	cleaned := path.Clean(p)
+	return cleaned == gitContainerRoot || strings.HasPrefix(cleaned, gitContainerRoot+"/")
+}
+
+func validateGitRepositoryURL(ctx context.Context, raw string) (validatedGitRepositoryURL, error) {
+	cleaned := strings.TrimSpace(raw)
+	cleaned = strings.Trim(cleaned, "\x00\r\n\t ")
+	if strings.ContainsAny(cleaned, "\x00\n\r\t") {
+		return validatedGitRepositoryURL{}, fmt.Errorf("Repository URL is invalid.")
+	}
+	if cleaned == "" || len(cleaned) > 2048 {
+		return validatedGitRepositoryURL{}, fmt.Errorf("Repository URL is invalid.")
+	}
+
+	parsed, err := url.Parse(cleaned)
+	if err != nil {
+		return validatedGitRepositoryURL{}, fmt.Errorf("Repository URL is invalid.")
+	}
+	if parsed.Scheme != "https" {
+		return validatedGitRepositoryURL{}, fmt.Errorf("Only HTTPS Git remotes are allowed.")
+	}
+	if parsed.User != nil {
+		return validatedGitRepositoryURL{}, fmt.Errorf("Credentials in Git remote URLs are not allowed.")
+	}
+	if parsed.RawQuery != "" || parsed.Fragment != "" {
+		return validatedGitRepositoryURL{}, fmt.Errorf("Repository URL must not include query strings or fragments.")
+	}
+	if parsed.Path == "" || parsed.Path == "/" {
+		return validatedGitRepositoryURL{}, fmt.Errorf("Repository URL is missing a repository path.")
+	}
+
+	host := strings.ToLower(parsed.Hostname())
+	if host == "" || host == "localhost" || strings.HasSuffix(host, ".localhost") {
+		return validatedGitRepositoryURL{}, fmt.Errorf("Repository host is not allowed.")
+	}
+	repositoryURL := gitCanonicalRepositoryURL(parsed)
+
+	if ip := net.ParseIP(host); ip != nil {
+		if isBlockedGitIP(ip) {
+			return validatedGitRepositoryURL{}, fmt.Errorf("Repository host resolves to an internal network.")
+		}
+		return newValidatedGitRepositoryURL(repositoryURL, gitCurlOptResolve(host, parsed.Port(), ip))
+	}
+
+	lookupCtx, cancel := context.WithTimeout(ctx, 3*time.Second)
+	defer cancel()
+	addrs, err := net.DefaultResolver.LookupIPAddr(lookupCtx, host)
+	if err != nil || len(addrs) == 0 {
+		return validatedGitRepositoryURL{}, fmt.Errorf("Repository host could not be resolved.")
+	}
+	var resolved net.IP
+	for _, addr := range addrs {
+		if isBlockedGitIP(addr.IP) {
+			return validatedGitRepositoryURL{}, fmt.Errorf("Repository host resolves to an internal network.")
+		}
+		if resolved == nil {
+			resolved = addr.IP
+		}
+	}
+	if resolved == nil {
+		return validatedGitRepositoryURL{}, fmt.Errorf("Repository host could not be resolved.")
+	}
+
+	return newValidatedGitRepositoryURL(repositoryURL, gitCurlOptResolve(host, parsed.Port(), resolved))
+}
+
+func newValidatedGitRepositoryURL(repositoryURL string, curlOptResolve string) (validatedGitRepositoryURL, error) {
+	remoteName, err := newGitRemoteName()
+	if err != nil {
+		return validatedGitRepositoryURL{}, err
+	}
+	return validatedGitRepositoryURL{
+		URL:            repositoryURL,
+		CurlOptResolve: curlOptResolve,
+		RemoteName:     remoteName,
+	}, nil
+}
+
+func gitCanonicalRepositoryURL(parsed *url.URL) string {
+	escapedPath := parsed.EscapedPath()
+	if !strings.ContainsRune(escapedPath, '=') {
+		return parsed.String()
+	}
+	canonical := *parsed
+	canonical.RawPath = strings.ReplaceAll(escapedPath, "=", "%3D")
+	return canonical.String()
+}
+
+func gitCurlOptResolve(host string, port string, ip net.IP) string {
+	if port == "" {
+		port = "443"
+	}
+	if strings.Contains(host, ":") {
+		host = "[" + host + "]"
+	}
+	address := ip.String()
+	if strings.Contains(address, ":") {
+		address = "[" + address + "]"
+	}
+	return host + ":" + port + ":" + address
+}
+
+func validateGitTargetDirectory(name string) error {
+	if name == "." || name == ".." || strings.Contains(name, "..") || strings.HasPrefix(name, "-") || strings.HasPrefix(name, ".") {
+		return fmt.Errorf("Target directory name is not allowed.")
+	}
+	if !gitTargetDirectoryPattern.MatchString(name) {
+		return fmt.Errorf("Target directory can only contain letters, numbers, dots, underscores, and dashes.")
+	}
+	return nil
+}
+
+func inspectGitCloneTarget(fs *serverfs.Filesystem, targetPath string) (gitCloneTargetMode, error) {
+	info, err := fs.Stat(targetPath)
+	if os.IsNotExist(err) {
+		return gitCloneTargetEmpty, nil
+	}
+	if err != nil {
+		return gitCloneTargetEmpty, fmt.Errorf("Could not inspect the clone target.")
+	}
+	if info.Mode()&os.ModeSymlink != 0 {
+		return gitCloneTargetEmpty, fmt.Errorf("Clone target must not be a symlink.")
+	}
+	if !info.IsDir() {
+		return gitCloneTargetEmpty, fmt.Errorf("Clone target already exists and is not a directory.")
+	}
+
+	entries, err := fs.ReadDirStat(targetPath)
+	if err != nil {
+		return gitCloneTargetEmpty, fmt.Errorf("Could not inspect the clone target.")
+	}
+	if len(entries) == 0 {
+		return gitCloneTargetEmpty, nil
+	}
+
+	for _, entry := range entries {
+		if !isAllowedGitCloneInternalEntry(entry) {
+			return gitCloneTargetEmpty, fmt.Errorf("Clone target must be empty except for Better Files internal folders.")
+		}
+	}
+
+	return gitCloneTargetInternalOnly, nil
+}
+
+func isAllowedGitCloneInternalEntry(entry os.FileInfo) bool {
+	return entry.Name() == gitBetterFilesTrashDir && entry.IsDir()
+}
+
+func makeGitCloneTempTarget(fs *serverfs.Filesystem, containerTargetPath string) (string, string, error) {
+	for i := 0; i < 10; i++ {
+		name := fmt.Sprintf(".betterfiles-git-clone-%d-%d", time.Now().UnixNano(), i)
+		containerPath := path.Join(containerTargetPath, name)
+		serverPath := containerPathToServerPath(containerPath)
+
+		if _, err := fs.Stat(serverPath); os.IsNotExist(err) {
+			return containerPath, serverPath, nil
+		}
+	}
+
+	return "", "", fmt.Errorf("Could not allocate a temporary clone directory.")
+}
+
+func promoteGitCloneTempTarget(fs *serverfs.Filesystem, tempPath string, targetPath string) error {
+	entries, err := fs.ReadDirStat(tempPath)
+	if err != nil {
+		return fmt.Errorf("Could not inspect the cloned repository.")
+	}
+
+	for _, entry := range entries {
+		if _, err := fs.Stat(path.Join(targetPath, entry.Name())); err == nil {
+			return fmt.Errorf("Clone output would overwrite %s.", entry.Name())
+		} else if !os.IsNotExist(err) {
+			return fmt.Errorf("Could not inspect the clone output.")
+		}
+	}
+
+	for _, entry := range entries {
+		if err := fs.Rename(path.Join(tempPath, entry.Name()), path.Join(targetPath, entry.Name())); err != nil {
+			return fmt.Errorf("Could not move cloned files into the target directory.")
+		}
+	}
+
+	return nil
+}
+
+func addGitInternalExcludes(fs *serverfs.Filesystem, targetPath string) error {
+	gitPath := path.Join(targetPath, ".git")
+	infoPath := path.Join(gitPath, "info")
+	excludePath := path.Join(infoPath, "exclude")
+
+	stat, err := fs.Stat(gitPath)
+	if err != nil {
+		return err
+	}
+	if !stat.IsDir() {
+		return fmt.Errorf("Git metadata path is not a directory.")
+	}
+	if err := fs.CreateDirectory("info", gitPath); err != nil {
+		return err
+	}
+
+	content := ""
+	if file, _, err := fs.File(excludePath); err == nil {
+		raw, readErr := io.ReadAll(io.LimitReader(file, 64*1024))
+		_ = file.Close()
+		if readErr != nil {
+			return readErr
+		}
+		content = string(raw)
+	}
+
+	var additions []string
+	for _, line := range []string{gitBetterFilesTrashDir + "/", ".betterfiles-git-clone-*"} {
+		if !strings.Contains(content, line) {
+			additions = append(additions, line)
+		}
+	}
+	if len(additions) == 0 {
+		return nil
+	}
+
+	if content != "" && !strings.HasSuffix(content, "\n") {
+		content += "\n"
+	}
+	content += strings.Join(additions, "\n") + "\n"
+
+	return fs.Write(excludePath, strings.NewReader(content), int64(len(content)), 0640)
+}
+
+func gitDiffArgs(cached bool, diffPath string) []string {
+	args := []string{"diff", "--no-ext-diff", "--no-textconv", "--no-color", "--minimal"}
+	if cached {
+		args = append(args, "--cached")
+	}
+
+	args = append(args, "--")
+	if diffPath != "" {
+		args = append(args, diffPath)
+	}
+
+	return args
+}
+
+func combineGitDiffOutput(cached string, unstaged string) string {
+	var sections []string
+	if strings.TrimSpace(cached) != "" {
+		sections = append(sections, "Staged changes:\n"+cached)
+	}
+	if strings.TrimSpace(unstaged) != "" {
+		sections = append(sections, "Unstaged changes:\n"+unstaged)
+	}
+
+	output := strings.Join(sections, "\n")
+	if len(output) > 512*1024 {
+		output = output[:512*1024] + "\n...(truncated)"
+	}
+
+	return output
+}
+
+func isSafeGitRef(ref string) bool {
+	if ref == "" || len(ref) > 255 || strings.HasPrefix(ref, "-") {
+		return false
+	}
+	if strings.Contains(ref, "..") || strings.Contains(ref, "@{") || strings.Contains(ref, "\\") {
+		return false
+	}
+	return !strings.ContainsAny(ref, "\x00\n\r ~^:?*[")
+}
+
+func containerPathToServerPath(containerPath string) string {
+	relative := strings.TrimPrefix(path.Clean(containerPath), gitContainerRoot)
+	relative = strings.TrimPrefix(relative, "/")
+	if relative == "" {
+		return "/"
+	}
+	return "/" + relative
+}
+
+func gitLockFor(id string) *sync.Mutex {
+	actual, _ := gitLocks.LoadOrStore(id, &sync.Mutex{})
+	return actual.(*sync.Mutex)
+}
+
+func maskGitResponse(result *gitResponse) *gitResponse {
+	return &gitResponse{
+		Stdout:   maskGitOutput(result.Stdout),
+		Stderr:   maskGitOutput(result.Stderr),
+		ExitCode: result.ExitCode,
+	}
+}
+
+func maskGitOutput(output string) string {
+	return gitCredentialPattern.ReplaceAllString(output, "${1}****@")
+}
+
+func gitRepositoryHost(raw string) string {
+	parsed, err := url.Parse(strings.TrimSpace(raw))
+	if err != nil {
+		return ""
+	}
+	return parsed.Hostname()
+}
+
+func isBlockedGitIP(ip net.IP) bool {
+	if ip == nil || ip.IsLoopback() || ip.IsPrivate() || ip.IsLinkLocalUnicast() || ip.IsLinkLocalMulticast() || ip.IsInterfaceLocalMulticast() || ip.IsMulticast() || ip.IsUnspecified() {
+		return true
+	}
+	for _, block := range gitBlockedNetworks {
+		if block.Contains(ip) {
+			return true
+		}
+	}
+	return false
+}
+
+func mustParseGitCIDR(ip string) *net.IPNet {
+	_, block, err := net.ParseCIDR(ip)
+	if err != nil {
+		panic(fmt.Errorf("failed to parse Git CIDR: %s", ip))
+	}
+	return block
+}
+
+func getContainerUser() string {
+	cfg := config.Get()
+	if cfg.System.User.Rootless.Enabled {
+		return fmt.Sprintf("%d:%d", cfg.System.User.Rootless.ContainerUID, cfg.System.User.Rootless.ContainerGID)
+	}
+	return strconv.Itoa(cfg.System.User.Uid) + ":" + strconv.Itoa(cfg.System.User.Gid)
+}
+
+func execInContainer(ctx context.Context, env *docker.Environment, cmd []string, workDir string) (*gitResponse, error) {
+	return execInContainerAsUser(ctx, env, cmd, workDir, getContainerUser(), gitSafeEnv)
+}
+
+func execInContainerAsUser(ctx context.Context, env *docker.Environment, cmd []string, workDir string, user string, execEnv []string) (*gitResponse, error) {
+	cli := env.Client()
+
+	execConfig := container.ExecOptions{
+		Cmd:          cmd,
+		WorkingDir:   workDir,
+		AttachStdout: true,
+		AttachStderr: true,
+		Env:          execEnv,
+		User:         user,
+	}
+
+	exec, err := cli.ContainerExecCreate(ctx, env.Id, execConfig)
+	if err != nil {
+		return nil, err
+	}
+
+	resp, err := cli.ContainerExecAttach(ctx, exec.ID, container.ExecStartOptions{})
+	if err != nil {
+		return nil, err
+	}
+	defer resp.Close()
+
+	var stdout, stderr bytes.Buffer
+	done := make(chan error, 1)
+	go func() {
+		_, err := stdcopy.StdCopy(&stdout, &stderr, resp.Reader)
+		done <- err
+	}()
+
+	select {
+	case <-ctx.Done():
+		return &gitResponse{Stderr: "command timed out", ExitCode: 124}, nil
+	case err := <-done:
+		if err != nil {
+			return nil, err
+		}
+	}
+
+	inspect, err := cli.ContainerExecInspect(ctx, exec.ID)
+	if err != nil {
+		return nil, err
+	}
+
+	output := stdout.String()
+	errOutput := stderr.String()
+
+	if len(output) > 512*1024 {
+		output = output[:512*1024] + "\n...(truncated)"
+	}
+	if len(errOutput) > 64*1024 {
+		errOutput = errOutput[:64*1024] + "\n...(truncated)"
+	}
+
+	return &gitResponse{
+		Stdout:   output,
+		Stderr:   errOutput,
+		ExitCode: inspect.ExitCode,
+	}, nil
+}
diff --git a/router/router_server_git_test.go b/router/router_server_git_test.go
new file mode 100644
index 00000000..a0383495
--- /dev/null
+++ b/router/router_server_git_test.go
@@ -0,0 +1,444 @@
+package router
+
+import (
+	"net"
+	"net/url"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"regexp"
+	"strings"
+	"testing"
+
+	"github.com/docker/docker/api/types/container"
+	"github.com/stretchr/testify/require"
+)
+
+func TestGitBaseCommandDisablesHTTPRedirects(t *testing.T) {
+	command := gitBaseCommand("git")
+
+	require.Contains(t, command, "http.followRedirects=false")
+	require.Contains(t, command, "remote.origin.proxy=")
+	require.Contains(t, command, "core.hooksPath=/dev/null")
+	require.Contains(t, command, "fetch.bundleURI=")
+	require.Contains(t, command, "transfer.bundleURI=false")
+	require.Contains(t, command, "core.alternateRefsCommand=/bin/true")
+	require.Contains(t, command, "gc.auto=0")
+	require.Contains(t, command, "maintenance.auto=false")
+}
+
+func TestGitVersionSupportsPinnedResolution(t *testing.T) {
+	tests := map[string]bool{
+		"git version 2.36.9":           false,
+		"git version 2.37":             true,
+		"git version 2.37.0":           true,
+		"git version 2.37.0.windows.1": true,
+		"git version 3.0.0":            true,
+		"git version 1.99.9":           false,
+		"git version 2.37invalid":      false,
+		"not a git version":            false,
+	}
+
+	for version, expected := range tests {
+		t.Run(version, func(t *testing.T) {
+			require.Equal(t, expected, gitVersionSupportsPinnedResolution(version))
+		})
+	}
+}
+
+func TestGitUnsafeLocalConfigPolicyRejectsHTTPSettings(t *testing.T) {
+	pattern := regexp.MustCompile(gitUnsafeLocalConfigPattern)
+
+	for _, key := range []string{
+		"http.followRedirects",
+		"http.proxy",
+		"http.https://git.example.com/repository.git.followRedirects",
+		"http.https://git.example.com/repository.git.curloptResolve",
+		"remote.origin.proxy",
+		"remote.origin.proxyauthmethod",
+		"remote.origin.vcs",
+		"remote.origin.promisor",
+		"remote.origin.partialCloneFilter",
+		"extensions.partialClone",
+		"core.alternateRefsCommand",
+		"Core.SSHCOMMAND",
+		"fetch.bundleURI",
+		"transfer.bundleURI",
+		"gc.auto",
+		"maintenance.auto",
+		"filter.assets.process",
+		"url.https://git.example.com/.insteadOf",
+	} {
+		require.Truef(t, pattern.MatchString(key), "expected %q to be rejected", key)
+	}
+
+	for _, key := range []string{"user.name", "remote.origin.url", "branch.main.merge"} {
+		require.Falsef(t, pattern.MatchString(key), "expected %q to remain allowed", key)
+	}
+}
+
+func TestGitCommandPinsExactRemoteAndDisablesProxyAndRedirects(t *testing.T) {
+	remote := validatedGitRepositoryURL{
+		URL:            "https://git.example.com/owner/repository.git",
+		CurlOptResolve: "git.example.com:443:8.8.8.8",
+		RemoteName:     "8e6df22c742447f39e91a18de42f28c646b080226ebe642f",
+	}
+	command := gitCommand("git", []string{"ls-remote", remote.RemoteName}, remote)
+	alias := gitRemoteAlias(remote.RemoteName)
+
+	requireGitCommandConfig(t, command, "url."+remote.URL+".insteadOf="+alias)
+	requireGitCommandConfig(t, command, "remote."+remote.RemoteName+".url="+alias)
+	requireGitCommandConfig(t, command, "remote."+remote.RemoteName+".proxy=")
+
+	for _, requestURL := range []string{
+		remote.URL,
+		remote.URL + "/",
+	} {
+		prefix := "http." + requestURL + "."
+		requireGitCommandConfig(t, command, prefix+"followRedirects=false")
+		requireGitCommandConfig(t, command, prefix+"proxy=")
+		requireGitCommandConfig(t, command, prefix+"curloptResolve=")
+		requireGitCommandConfig(t, command, prefix+"curloptResolve="+remote.CurlOptResolve)
+	}
+	require.Equal(t, []string{"ls-remote", remote.RemoteName}, command[len(command)-2:])
+}
+
+func TestGitRemoteNameIsUnpredictableAndConfigSafe(t *testing.T) {
+	first, err := newGitRemoteName()
+	require.NoError(t, err)
+	second, err := newGitRemoteName()
+	require.NoError(t, err)
+
+	require.Regexp(t, `^[0-9a-f]{48}$`, first)
+	require.Regexp(t, `^[0-9a-f]{48}$`, second)
+	require.NotEqual(t, first, second)
+	require.Equal(t, first+":", gitRemoteAlias(first))
+}
+
+func TestHideGitRemoteIdentities(t *testing.T) {
+	remote := validatedGitRepositoryURL{RemoteName: "8e6df22c742447f39e91a18de42f28c646b080226ebe642f"}
+	result := &gitResponse{
+		Stdout: "fetching " + remote.RemoteName,
+		Stderr: "failed " + gitRemoteAlias(remote.RemoteName),
+	}
+
+	hideGitRemoteIdentities(result, []validatedGitRepositoryURL{remote})
+	require.NotContains(t, result.Stdout, remote.RemoteName)
+	require.NotContains(t, result.Stderr, remote.RemoteName)
+	require.Contains(t, result.Stdout, "[remote]")
+	require.Contains(t, result.Stderr, "[remote]")
+}
+
+func TestGitOpaqueRemoteCannotBeReplacedByKnownLocalMappings(t *testing.T) {
+	gitBin, err := exec.LookPath("git")
+	if err != nil {
+		t.Skip("Git is not installed")
+	}
+
+	repository := t.TempDir()
+	runGitTestCommand(t, repository, gitBin, "init", "--quiet")
+
+	validatedURL := "https://git.example.com/owner/repository.git"
+	maliciousURL := "https://127.0.0.1/internal.git"
+	runGitTestCommand(t, repository, gitBin, "config", "--local", "url."+maliciousURL+".insteadOf", validatedURL)
+	runGitTestCommand(t, repository, gitBin, "config", "--local", "url.https://127.0.0.2/.insteadOf", "https://")
+	runGitTestCommand(t, repository, gitBin, "config", "--local", "remote."+validatedURL+".url", maliciousURL)
+	runGitTestCommand(t, repository, gitBin, "config", "--local", "remote.origin.url", maliciousURL)
+
+	remote, err := newValidatedGitRepositoryURL(validatedURL, "git.example.com:443:8.8.8.8")
+	require.NoError(t, err)
+	command := gitCommand(gitBin, []string{"remote", "-v"}, remote)
+	cmd := exec.Command(command[0], command[1:]...)
+	cmd.Dir = repository
+	cmd.Env = append(os.Environ(), gitSafeEnv...)
+	output, err := cmd.CombinedOutput()
+	require.NoError(t, err, string(output))
+	remoteOutput := strings.TrimSpace(string(output))
+	require.Contains(t, remoteOutput, remote.RemoteName+"\t"+validatedURL+" (fetch)")
+	require.NotContains(t, remoteOutput, remote.RemoteName+"\t"+maliciousURL)
+}
+
+func TestGitFetchDoesNotRunWorkingTreeFilters(t *testing.T) {
+	gitBin, err := exec.LookPath("git")
+	if err != nil {
+		t.Skip("Git is not installed")
+	}
+	falseBin, err := exec.LookPath("false")
+	if err != nil {
+		t.Skip("a failing filter command is not available")
+	}
+
+	source := t.TempDir()
+	runGitTestCommand(t, source, gitBin, "init", "--quiet", "--initial-branch=main")
+	require.NoError(t, os.WriteFile(filepath.Join(source, ".gitattributes"), []byte("*.txt filter=race\n"), 0o600))
+	require.NoError(t, os.WriteFile(filepath.Join(source, "data.txt"), []byte("first\n"), 0o600))
+	runGitTestCommand(t, source, gitBin, "add", ".")
+	runGitTestCommand(t, source, gitBin, "-c", "user.name=Test", "-c", "user.email=test@example.com", "commit", "--quiet", "-m", "initial")
+
+	cloneParent := t.TempDir()
+	clone := filepath.Join(cloneParent, "clone")
+	runGitTestCommand(t, cloneParent, gitBin, "clone", "--quiet", source, clone)
+	runGitTestCommand(t, clone, gitBin, "config", "--local", "filter.race.required", "true")
+	runGitTestCommand(t, clone, gitBin, "config", "--local", "filter.race.smudge", falseBin)
+
+	require.NoError(t, os.WriteFile(filepath.Join(source, "data.txt"), []byte("second\n"), 0o600))
+	runGitTestCommand(t, source, gitBin, "add", "data.txt")
+	runGitTestCommand(t, source, gitBin, "-c", "user.name=Test", "-c", "user.email=test@example.com", "commit", "--quiet", "-m", "update")
+
+	// Fetch only transfers objects and updates FETCH_HEAD; it must not invoke the
+	// deliberately failing worktree filter. Checkout proves the filter is armed.
+	remote, err := newValidatedGitRepositoryURL(source, "")
+	require.NoError(t, err)
+	fetchArgs := append([]string{"-c", "protocol.file.allow=always", "--no-pager"}, gitPullFetchArgs(remote, "main")...)
+	command := gitCommand(gitBin, fetchArgs, remote)
+	cmd := exec.Command(command[0], command[1:]...)
+	cmd.Dir = clone
+	cmd.Env = gitTestEnvironment()
+	output, err := cmd.CombinedOutput()
+	require.NoError(t, err, string(output))
+	runGitTestCommandMustFail(t, clone, gitBin, "checkout", "FETCH_HEAD", "--", "data.txt")
+}
+
+func TestGitCloneFinalizationPersistsValidatedURL(t *testing.T) {
+	gitBin, err := exec.LookPath("git")
+	if err != nil {
+		t.Skip("Git is not installed")
+	}
+
+	source := t.TempDir()
+	runGitTestCommand(t, source, gitBin, "init", "--quiet", "--initial-branch=main")
+	require.NoError(t, os.WriteFile(filepath.Join(source, "README.md"), []byte("test\n"), 0o600))
+	runGitTestCommand(t, source, gitBin, "add", "README.md")
+	runGitTestCommand(t, source, gitBin, "-c", "user.name=Test", "-c", "user.email=test@example.com", "commit", "--quiet", "-m", "initial")
+
+	remote, err := newValidatedGitRepositoryURL("https://git.example.com/owner/repository.git", "git.example.com:443:8.8.8.8")
+	require.NoError(t, err)
+	cloneParent := t.TempDir()
+	clone := filepath.Join(cloneParent, "clone")
+	alias := gitRemoteAlias(remote.RemoteName)
+	runGitTestCommand(t, cloneParent, gitBin,
+		"-c", "url."+source+".insteadOf="+alias,
+		"clone", "--quiet", "--no-checkout", alias, clone,
+	)
+	runGitTestCommand(t, clone, gitBin, gitClonePersistRemoteArgs(remote)...)
+	runGitTestCommand(t, clone, gitBin, gitCloneCheckoutArgs()...)
+
+	config, err := os.ReadFile(filepath.Join(clone, ".git", "config"))
+	require.NoError(t, err)
+	require.Contains(t, string(config), remote.URL)
+	require.NotContains(t, string(config), alias)
+	require.NotContains(t, string(config), remote.RemoteName)
+	_, err = os.Stat(filepath.Join(clone, "README.md"))
+	require.NoError(t, err)
+}
+
+func TestGitFetchThenFastForwardMerge(t *testing.T) {
+	for _, test := range []struct {
+		name    string
+		shallow bool
+	}{
+		{name: "shallow clone", shallow: true},
+		{name: "complete clone", shallow: false},
+	} {
+		t.Run(test.name, func(t *testing.T) {
+			testGitFetchThenFastForwardMerge(t, test.shallow)
+		})
+	}
+}
+
+func testGitFetchThenFastForwardMerge(t *testing.T, shallow bool) {
+	gitBin, err := exec.LookPath("git")
+	if err != nil {
+		t.Skip("Git is not installed")
+	}
+
+	source := t.TempDir()
+	runGitTestCommand(t, source, gitBin, "init", "--quiet", "--initial-branch=main")
+	require.NoError(t, os.WriteFile(filepath.Join(source, "data.txt"), []byte("first\n"), 0o600))
+	runGitTestCommand(t, source, gitBin, "add", "data.txt")
+	runGitTestCommand(t, source, gitBin, "-c", "user.name=Test", "-c", "user.email=test@example.com", "commit", "--quiet", "-m", "initial")
+
+	remoteURL := (&url.URL{Scheme: "file", Path: filepath.ToSlash(source)}).String()
+	cloneParent := t.TempDir()
+	clone := filepath.Join(cloneParent, "clone")
+	cloneArgs := []string{"-c", "protocol.file.allow=always", "clone", "--quiet"}
+	if shallow {
+		cloneArgs = append(cloneArgs, "--depth=1")
+	}
+	cloneArgs = append(cloneArgs, remoteURL, clone)
+	runGitTestCommand(t, cloneParent, gitBin, cloneArgs...)
+
+	for _, content := range []string{"second\n", "third\n", "fourth\n"} {
+		require.NoError(t, os.WriteFile(filepath.Join(source, "data.txt"), []byte(content), 0o600))
+		runGitTestCommand(t, source, gitBin, "add", "data.txt")
+		runGitTestCommand(t, source, gitBin, "-c", "user.name=Test", "-c", "user.email=test@example.com", "commit", "--quiet", "-m", strings.TrimSpace(content))
+	}
+
+	remote, err := newValidatedGitRepositoryURL(remoteURL, "")
+	require.NoError(t, err)
+	fetchArgs := append([]string{"-c", "protocol.file.allow=always"}, gitPullFetchArgs(remote, "main")...)
+	runGitCommandVector(t, clone, gitCommand(gitBin, fetchArgs, remote))
+	runGitCommandVector(t, clone, gitCommand(gitBin, gitPullMergeArgs()))
+
+	data, err := os.ReadFile(filepath.Join(clone, "data.txt"))
+	require.NoError(t, err)
+	require.Equal(t, "fourth\n", string(data))
+}
+
+func runGitTestCommand(t *testing.T, workDir string, gitBin string, args ...string) {
+	t.Helper()
+	cmd := exec.Command(gitBin, args...)
+	cmd.Dir = workDir
+	cmd.Env = gitTestEnvironment()
+	output, err := cmd.CombinedOutput()
+	require.NoError(t, err, string(output))
+}
+
+func runGitTestCommandMustFail(t *testing.T, workDir string, gitBin string, args ...string) {
+	t.Helper()
+	cmd := exec.Command(gitBin, args...)
+	cmd.Dir = workDir
+	cmd.Env = gitTestEnvironment()
+	output, err := cmd.CombinedOutput()
+	require.Error(t, err, string(output))
+}
+
+func runGitCommandVector(t *testing.T, workDir string, command []string) {
+	t.Helper()
+	cmd := exec.Command(command[0], command[1:]...)
+	cmd.Dir = workDir
+	cmd.Env = gitTestEnvironment()
+	output, err := cmd.CombinedOutput()
+	require.NoError(t, err, string(output))
+}
+
+func gitTestEnvironment() []string {
+	return append(os.Environ(),
+		"GIT_CONFIG_NOSYSTEM=1",
+		"GIT_CONFIG_GLOBAL=/dev/null",
+		"GIT_CONFIG_SYSTEM=/dev/null",
+	)
+}
+
+func TestGitRemoteConfigURLsCoverNormalizedTrailingSlash(t *testing.T) {
+	require.Equal(t, []string{
+		"https://git.example.com/owner/repository.git",
+		"https://git.example.com/owner/repository.git/",
+	}, gitRemoteConfigURLs("https://git.example.com/owner/repository.git"))
+	require.Equal(t, []string{
+		"https://git.example.com/owner/repository.git/",
+	}, gitRemoteConfigURLs("https://git.example.com/owner/repository.git/"))
+}
+
+func TestGitNetworkAndOfflineCommandShapes(t *testing.T) {
+	remote := validatedGitRepositoryURL{
+		URL:        "https://git.example.com/owner/repository.git",
+		RemoteName: "8e6df22c742447f39e91a18de42f28c646b080226ebe642f",
+	}
+
+	clone := gitCloneNetworkArgs(remote, "/home/container/repository")
+	require.Equal(t, "clone", clone[0])
+	require.Contains(t, clone, "--no-checkout")
+	require.Contains(t, clone, gitRemoteAlias(remote.RemoteName))
+	require.NotContains(t, clone, remote.URL)
+
+	persist := gitClonePersistRemoteArgs(remote)
+	require.Equal(t, []string{"config", "--local", "--replace-all", "remote.origin.url", remote.URL}, persist)
+	require.NotContains(t, persist, gitRemoteAlias(remote.RemoteName))
+	require.Equal(t, []string{"checkout", "--force"}, gitCloneCheckoutArgs())
+
+	fetch := gitPullFetchArgs(remote, "main")
+	require.Equal(t, "fetch", fetch[0])
+	require.Contains(t, fetch, "--deepen=1")
+	require.Contains(t, fetch, "--no-recurse-submodules")
+	require.Equal(t, []string{remote.RemoteName, "main"}, fetch[len(fetch)-2:])
+	require.NotContains(t, fetch, "pull")
+
+	merge := gitPullMergeArgs()
+	require.Equal(t, []string{"merge", "--ff-only", "--no-edit", "FETCH_HEAD"}, merge)
+	require.Equal(t, container.NetworkMode("none"), gitHelperNetworkMode(container.NetworkMode("bridge"), true))
+	require.Equal(t, container.NetworkMode("bridge"), gitHelperNetworkMode(container.NetworkMode("bridge"), false))
+}
+
+func TestCombineGitResponsesUsesFinalExitCode(t *testing.T) {
+	combined := combineGitResponses(
+		&gitResponse{Stdout: "fetch stdout\n", Stderr: "fetch stderr\n", ExitCode: 0},
+		&gitResponse{Stdout: "merge stdout\n", Stderr: "merge stderr\n", ExitCode: 1},
+	)
+	require.Equal(t, "fetch stdout\nmerge stdout\n", combined.Stdout)
+	require.Equal(t, "fetch stderr\nmerge stderr\n", combined.Stderr)
+	require.Equal(t, 1, combined.ExitCode)
+}
+
+func TestGitSafeEnvironmentClearsConfigAndProxyInjection(t *testing.T) {
+	for _, setting := range []string{
+		"GIT_CONFIG_COUNT=0",
+		"GIT_CONFIG_PARAMETERS=",
+		"GIT_NO_LAZY_FETCH=1",
+		"HTTP_PROXY=",
+		"HTTPS_PROXY=",
+		"ALL_PROXY=",
+		"http_proxy=",
+		"https_proxy=",
+		"all_proxy=",
+	} {
+		require.Contains(t, gitSafeEnv, setting)
+	}
+}
+
+func TestGitCanonicalRepositoryURLEscapesCommandConfigDelimiter(t *testing.T) {
+	parsed, err := url.Parse("https://git.example.com/owner/repository=name.git")
+	require.NoError(t, err)
+	require.Equal(t, "https://git.example.com/owner/repository%3Dname.git", gitCanonicalRepositoryURL(parsed))
+
+	alreadyEscaped, err := url.Parse("https://git.example.com/owner/repository%3Dname.git")
+	require.NoError(t, err)
+	require.Equal(t, "https://git.example.com/owner/repository%3Dname.git", gitCanonicalRepositoryURL(alreadyEscaped))
+}
+
+func requireGitCommandConfig(t *testing.T, command []string, expected string) {
+	t.Helper()
+	for index := 1; index < len(command); index++ {
+		if command[index-1] == "-c" && command[index] == expected {
+			return
+		}
+	}
+	t.Fatalf("Git command does not contain config %q: %#v", expected, command)
+}
+
+func TestGitCurlOptResolvePinsValidatedAddress(t *testing.T) {
+	tests := map[string]struct {
+		host     string
+		port     string
+		ip       net.IP
+		expected string
+	}{
+		"default HTTPS port": {
+			host:     "git.example.com",
+			ip:       net.ParseIP("8.8.8.8"),
+			expected: "git.example.com:443:8.8.8.8",
+		},
+		"explicit port": {
+			host:     "git.example.com",
+			port:     "8443",
+			ip:       net.ParseIP("8.8.8.8"),
+			expected: "git.example.com:8443:8.8.8.8",
+		},
+		"IPv6 address": {
+			host:     "git.example.com",
+			ip:       net.ParseIP("2001:4860:4860::8888"),
+			expected: "git.example.com:443:[2001:4860:4860::8888]",
+		},
+		"IPv6 literal host": {
+			host:     "2001:4860:4860::8888",
+			ip:       net.ParseIP("2001:4860:4860::8888"),
+			expected: "[2001:4860:4860::8888]:443:[2001:4860:4860::8888]",
+		},
+	}
+
+	for name, test := range tests {
+		t.Run(name, func(t *testing.T) {
+			require.Equal(t, test.expected, gitCurlOptResolve(test.host, test.port, test.ip))
+		})
+	}
+}
diff --git a/router/router_server_ws.go b/router/router_server_ws.go
index b0ba3a4c..15d0a31f 100644
--- a/router/router_server_ws.go
+++ b/router/router_server_ws.go
@@ -106,13 +106,33 @@ func getServerWebsocket(c *gin.Context) {
 	}
 
 	// There is a separate rate limiter that applies to individual message types
-	// within the actual websocket logic handler. _This_ rate limiter just exists
-	// to avoid enormous floods of data through the socket since we need to parse
-	// JSON each time. This rate limit realistically should never be hit since this
-	// would require sending 50+ messages a second over the websocket (no more than
-	// 10 per 200ms).
+	// within the actual websocket logic handler. This limiter protects ordinary
+	// control traffic. Stateful collaboration events bypass both limiters and are
+	// processed synchronously below, matching Wings-rs behavior. Silently dropping
+	// one collaboration chunk would desynchronize the document.
 	var throttled bool
 	rl := rate.NewLimiter(rate.Every(time.Millisecond*200), 10)
+	allowOrdinaryMessage := func() bool {
+		if !rl.Allow() {
+			if !throttled {
+				throttled = true
+				_ = handler.Connection.WriteJSON(websocket.Message{Event: websocket.ThrottledEvent, Args: []string{"global"}})
+			}
+			return false
+		}
+
+		throttled = false
+		return true
+	}
+	handleMessage := func(msg websocket.Message) {
+		if err := handler.HandleInbound(ctx, msg); err != nil {
+			if errors.Is(err, server.ErrSuspended) {
+				cancel()
+			} else {
+				_ = handler.SendErrorJson(msg, err)
+			}
+		}
+	}
 
 	for {
 		t, p, err := handler.Connection.ReadMessage()
@@ -123,16 +143,6 @@ func getServerWebsocket(c *gin.Context) {
 			break
 		}
 
-		if !rl.Allow() {
-			if !throttled {
-				throttled = true
-				_ = handler.Connection.WriteJSON(websocket.Message{Event: websocket.ThrottledEvent, Args: []string{"global"}})
-			}
-			continue
-		}
-
-		throttled = false
-
 		// If the message isn't a format we expect, or the length of the message is far larger
 		// than we'd ever expect, drop it. The websocket upgrader logic does enforce a maximum
 		// _compressed_ message size of 4Kb but that could decompress to a much larger amount
@@ -146,17 +156,20 @@ func getServerWebsocket(c *gin.Context) {
 		// from the socket, which is NOT what we want to do.
 		var j websocket.Message
 		if err := json.Unmarshal(p, &j); err != nil {
+			allowOrdinaryMessage()
 			continue
 		}
 
-		go func(msg websocket.Message) {
-			if err := handler.HandleInbound(ctx, msg); err != nil {
-				if errors.Is(err, server.ErrSuspended) {
-					cancel()
-				} else {
-					_ = handler.SendErrorJson(msg, err)
-				}
-			}
-		}(j)
+		if !websocket.IsFileCollaborationEvent(j.Event) && !allowOrdinaryMessage() {
+			continue
+		}
+
+		// Authentication and collaboration messages are stateful protocols. Keep
+		// their WebSocket wire order instead of racing them in separate goroutines.
+		if j.Event == websocket.AuthenticationEvent || websocket.IsFileCollaborationEvent(j.Event) {
+			handleMessage(j)
+			continue
+		}
+		go handleMessage(j)
 	}
 }
diff --git a/router/router_system_config.go b/router/router_system_config.go
new file mode 100644
index 00000000..430efccf
--- /dev/null
+++ b/router/router_system_config.go
@@ -0,0 +1,26 @@
+package router
+
+import (
+	"net/http"
+
+	"github.com/gin-gonic/gin"
+	ws "github.com/pterodactyl/wings/router/websocket"
+)
+
+type systemConfigurationResponse struct {
+	System struct {
+		FileCollaboration struct {
+			Enabled     bool `json:"enabled"`
+			FileSizeCap int  `json:"file_size_cap"`
+		} `json:"file_collaboration"`
+	} `json:"system"`
+}
+
+// getSystemConfiguration reports optional daemon capabilities to the Panel.
+// This route is protected by the same daemon-token middleware as /api/system.
+func getSystemConfiguration(c *gin.Context) {
+	var response systemConfigurationResponse
+	response.System.FileCollaboration.Enabled = ws.NativeFileCollaborationConfigured()
+	response.System.FileCollaboration.FileSizeCap = ws.NativeFileCollaborationFileSizeCap()
+	c.JSON(http.StatusOK, response)
+}
diff --git a/router/router_system_config_test.go b/router/router_system_config_test.go
new file mode 100644
index 00000000..7143a8b4
--- /dev/null
+++ b/router/router_system_config_test.go
@@ -0,0 +1,62 @@
+package router
+
+import (
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/gin-gonic/gin"
+	"github.com/pterodactyl/wings/config"
+	"github.com/pterodactyl/wings/router/middleware"
+	"github.com/pterodactyl/wings/server"
+	"github.com/stretchr/testify/require"
+)
+
+func TestConfigureRegistersSystemConfigurationRoute(t *testing.T) {
+	r := Configure(server.NewEmptyManager(nil), nil)
+	for _, route := range r.Routes() {
+		if route.Method == http.MethodGet && route.Path == "/api/system/config" {
+			return
+		}
+	}
+	t.Fatal("GET /api/system/config is not registered")
+}
+
+func TestSystemConfigurationCapabilityRoute(t *testing.T) {
+	gin.SetMode(gin.TestMode)
+	previous := config.Get()
+	next := *previous
+	next.AuthenticationToken = "native-collaboration-test-token"
+	next.Token.Token = "native-collaboration-test-token"
+	next.System.FileCollaboration.Enabled = true
+	config.Set(&next)
+	t.Cleanup(func() { config.Set(previous) })
+
+	r := gin.New()
+	protected := r.Group("/api", middleware.RequireAuthorization())
+	protected.GET("/system/config", getSystemConfiguration)
+
+	request := func(token string) *httptest.ResponseRecorder {
+		w := httptest.NewRecorder()
+		req := httptest.NewRequest(http.MethodGet, "/api/system/config", nil)
+		if token != "" {
+			req.Header.Set("Authorization", "Bearer "+token)
+		}
+		r.ServeHTTP(w, req)
+		return w
+	}
+
+	require.Equal(t, http.StatusUnauthorized, request("").Code)
+	require.Equal(t, http.StatusForbidden, request("wrong-token").Code)
+
+	w := request("native-collaboration-test-token")
+	require.Equal(t, http.StatusOK, w.Code)
+	var response map[string]any
+	require.NoError(t, json.Unmarshal(w.Body.Bytes(), &response))
+	require.Equal(t, map[string]any{
+		"system": map[string]any{
+			"file_collaboration": map[string]any{"enabled": true, "file_size_cap": float64(10 * 1024 * 1024)},
+		},
+	}, response)
+}
diff --git a/router/router_upload_batch_test.go b/router/router_upload_batch_test.go
new file mode 100644
index 00000000..fea81bee
--- /dev/null
+++ b/router/router_upload_batch_test.go
@@ -0,0 +1,241 @@
+package router
+
+import (
+	"bytes"
+	"encoding/json"
+	"math"
+	"mime/multipart"
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"github.com/pterodactyl/wings/server"
+	"github.com/stretchr/testify/require"
+)
+
+type multipartTestFile struct {
+	name string
+	data []byte
+}
+
+func performMultipartUpload(t *testing.T, handler http.Handler, token, directory string, files []multipartTestFile, fields [][2]string, manifestFirst bool) *httptest.ResponseRecorder {
+	t.Helper()
+	var body bytes.Buffer
+	w := multipart.NewWriter(&body)
+	writeFields := func() {
+		for _, field := range fields {
+			require.NoError(t, w.WriteField(field[0], field[1]))
+		}
+	}
+	if manifestFirst {
+		writeFields()
+	}
+	for _, file := range files {
+		part, err := w.CreateFormFile("files", file.name)
+		require.NoError(t, err)
+		_, err = part.Write(file.data)
+		require.NoError(t, err)
+	}
+	if !manifestFirst {
+		writeFields()
+	}
+	require.NoError(t, w.Close())
+	request := httptest.NewRequest(http.MethodPost, "/upload/file?"+url.Values{"token": {token}, "directory": {directory}, "total_size": {"0"}}.Encode(), &body)
+	request.Header.Set("Content-Type", w.FormDataContentType())
+	recorder := httptest.NewRecorder()
+	handler.ServeHTTP(recorder, request)
+	return recorder
+}
+
+func batchPaths(t *testing.T, paths ...string) [][2]string {
+	t.Helper()
+	encoded, err := json.Marshal(paths)
+	require.NoError(t, err)
+	return [][2]string{{"paths", string(encoded)}}
+}
+
+func quietUploadActivity(t *testing.T) {
+	t.Helper()
+	previous := saveUploadActivity
+	saveUploadActivity = func(*server.Server, string, string, string, string) {}
+	t.Cleanup(func() { saveUploadActivity = previous })
+}
+
+func TestMultipartFolderBatchPreservesPathsAndDuplicateBasenames(t *testing.T) {
+	quietUploadActivity(t)
+	for _, first := range []bool{true, false} {
+		_, s, handler := newBetterFilesHTTPServer(t, 10, 10)
+		var activities [][2]string
+		saveUploadActivity = func(_ *server.Server, _, _, name, directory string) {
+			activities = append(activities, [2]string{directory, name})
+		}
+		files := []multipartTestFile{{"config.yml", []byte("one")}, {"mods/b/config.yml", []byte("two")}, {"empty.txt", nil}}
+		response := performMultipartUpload(t, handler, signBetterFilesUploadToken(t, s.ID()), "/uploads", files, batchPaths(t, "mods/a/config.yml", "mods/b/config.yml", "資料/empty.txt"), first)
+		require.Equal(t, http.StatusOK, response.Code, response.Body.String())
+		require.Equal(t, []byte("one"), readServerHTTPFixture(t, s, "uploads/mods/a/config.yml"))
+		require.Equal(t, []byte("two"), readServerHTTPFixture(t, s, "uploads/mods/b/config.yml"))
+		require.Empty(t, readServerHTTPFixture(t, s, "uploads/資料/empty.txt"))
+		require.NoFileExists(t, filepath.Join(s.Filesystem().Path(), "uploads/config.yml"))
+		require.Equal(t, [][2]string{{"/uploads/mods/a", "config.yml"}, {"/uploads/mods/b", "config.yml"}, {"/uploads/資料", "empty.txt"}}, activities)
+		require.Equal(t, int64(6), s.Filesystem().CachedUsage())
+	}
+}
+
+func TestMultipartFlatUploadsAndSingleUseTokensRemainCompatible(t *testing.T) {
+	quietUploadActivity(t)
+	_, s, handler := newBetterFilesHTTPServer(t, 10, 10)
+	token := signBetterFilesUploadToken(t, s.ID())
+	files := []multipartTestFile{{"file.txt", []byte("first")}, {"folder/other.txt", []byte("second")}}
+	response := performMultipartUpload(t, handler, token, "/existing", files, nil, false)
+	require.Equal(t, http.StatusOK, response.Code, response.Body.String())
+	require.Equal(t, []byte("first"), readServerHTTPFixture(t, s, "existing/file.txt"))
+	require.Equal(t, []byte("second"), readServerHTTPFixture(t, s, "existing/other.txt"))
+	response = performMultipartUpload(t, handler, token, "/existing", files, nil, false)
+	require.Equal(t, http.StatusNotFound, response.Code)
+	require.Equal(t, http.StatusNotFound, performResumableRequest(handler, http.MethodHead, token, "/existing", "file.txt", 0, nil, false, nil).Code)
+	newToken := signBetterFilesUploadToken(t, s.ID())
+	require.Equal(t, http.StatusOK, performResumableRequest(handler, http.MethodHead, newToken, "/existing", "file.txt", 0, nil, false, nil).Code)
+	response = performMultipartUpload(t, handler, newToken, "/existing", files, nil, false)
+	require.Equal(t, http.StatusNotFound, response.Code)
+}
+
+func TestMultipartFlatQuotaPreservesSequentialOverwriteBehavior(t *testing.T) {
+	quietUploadActivity(t)
+	_, s, handler := newBetterFilesHTTPServer(t, 10, 10)
+	s.Filesystem().SetDiskLimit(10)
+	require.NoError(t, s.Filesystem().WriteUpload("a", bytes.NewBufferString("1234567890"), 10))
+	response := performMultipartUpload(t, handler, signBetterFilesUploadToken(t, s.ID()), "/", []multipartTestFile{{"a", nil}, {"b", []byte("1234567890")}}, nil, false)
+	require.Equal(t, http.StatusOK, response.Code, response.Body.String())
+	require.Empty(t, readServerHTTPFixture(t, s, "a"))
+	require.Equal(t, []byte("1234567890"), readServerHTTPFixture(t, s, "b"))
+	require.Equal(t, int64(10), s.Filesystem().CachedUsage())
+
+	_, s, handler = newBetterFilesHTTPServer(t, 10, 10)
+	s.Filesystem().SetDiskLimit(10)
+	response = performMultipartUpload(t, handler, signBetterFilesUploadToken(t, s.ID()), "/", []multipartTestFile{{"a", []byte("1234567890")}, {"a", []byte("abcdefghij")}}, nil, false)
+	require.Equal(t, http.StatusOK, response.Code, response.Body.String())
+	require.Equal(t, []byte("abcdefghij"), readServerHTTPFixture(t, s, "a"))
+	require.Equal(t, int64(10), s.Filesystem().CachedUsage())
+}
+
+func TestMultipartFolderBatchRejectsInvalidManifestBeforeWrites(t *testing.T) {
+	quietUploadActivity(t)
+	tests := []struct {
+		name   string
+		fields [][2]string
+	}{
+		{"empty", [][2]string{{"paths", ""}}}, {"null", [][2]string{{"paths", "null"}}},
+		{"object", [][2]string{{"paths", `{"file.txt":"folder/file.txt"}`}}},
+		{"short", batchPaths(t, "good.txt")}, {"long", batchPaths(t, "good.txt", "folder/file.txt", "extra.txt")},
+		{"duplicate field", [][2]string{{"paths", `["good.txt","file.txt"]`}, {"paths", `["good.txt","file.txt"]`}}},
+		{"duplicate destination", batchPaths(t, "same/good.txt", "same/good.txt")},
+		{"null entry", [][2]string{{"paths", `["good.txt",null]`}}},
+		{"invalid UTF8", [][2]string{{"paths", "[\"good.txt\",\"\xff/file.txt\"]"}}},
+		{"mismatched basename", batchPaths(t, "good.txt", "folder/wrong.txt")},
+		{"extra JSON", [][2]string{{"paths", `["good.txt","file.txt"] []`}}},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			_, s, handler := newBetterFilesHTTPServer(t, 10, 10)
+			response := performMultipartUpload(t, handler, signBetterFilesUploadToken(t, s.ID()), "/new", []multipartTestFile{{"good.txt", []byte("good")}, {"file.txt", []byte("bad")}}, test.fields, false)
+			require.Equal(t, http.StatusBadRequest, response.Code, response.Body.String())
+			require.NoDirExists(t, filepath.Join(s.Filesystem().Path(), "new"))
+		})
+	}
+}
+
+func TestMultipartFolderBatchRejectsTraversalAndPathAliases(t *testing.T) {
+	quietUploadActivity(t)
+	for _, value := range []string{"../file.txt", "/file.txt", "a/../../file.txt", "a\\file.txt", "C:/file.txt", "a//file.txt", "a/./file.txt", "a/../file.txt", "./file.txt", "a/\x00/file.txt", "", ".", strings.Repeat("a", 256) + "/file.txt", strings.Repeat("dir/", 1100) + "file.txt"} {
+		t.Run(value, func(t *testing.T) {
+			_, s, handler := newBetterFilesHTTPServer(t, 10, 10)
+			response := performMultipartUpload(t, handler, signBetterFilesUploadToken(t, s.ID()), "/new", []multipartTestFile{{"good.txt", []byte("good")}, {"file.txt", []byte("bad")}}, batchPaths(t, "good.txt", value), false)
+			require.Equal(t, http.StatusBadRequest, response.Code, response.Body.String())
+			require.NoDirExists(t, filepath.Join(s.Filesystem().Path(), "new"))
+		})
+	}
+}
+
+func TestMultipartFolderBatchRejectsDuplicatesAndFileDirectoryConflicts(t *testing.T) {
+	quietUploadActivity(t)
+	for _, paths := range [][]string{{"a/file.txt", "a/file.txt"}, {"a", "a/file.txt"}, {"a/file.txt", "a"}} {
+		_, s, handler := newBetterFilesHTTPServer(t, 10, 10)
+		files := []multipartTestFile{}
+		for _, p := range paths {
+			files = append(files, multipartTestFile{filepath.Base(p), []byte("data")})
+		}
+		response := performMultipartUpload(t, handler, signBetterFilesUploadToken(t, s.ID()), "/new", files, batchPaths(t, paths...), false)
+		require.Equal(t, http.StatusBadRequest, response.Code, response.Body.String())
+		require.NoDirExists(t, filepath.Join(s.Filesystem().Path(), "new"))
+	}
+}
+
+func TestMultipartFolderBatchIgnoredPathsAndSymlinks(t *testing.T) {
+	quietUploadActivity(t)
+	for _, rule := range []string{"secret", "/secret", "secret/*"} {
+		_, s, handler := newBetterFilesHTTPServer(t, 10, 10, rule)
+		response := performMultipartUpload(t, handler, signBetterFilesUploadToken(t, s.ID()), "/", []multipartTestFile{{"good.txt", []byte("good")}, {"file.txt", []byte("bad")}}, batchPaths(t, "good.txt", "secret/nested/file.txt"), false)
+		require.Equal(t, http.StatusForbidden, response.Code, response.Body.String())
+		require.NoFileExists(t, filepath.Join(s.Filesystem().Path(), "good.txt"))
+	}
+	for _, target := range []string{"link/file.txt", "link/nested/file.txt", "file.txt"} {
+		_, s, handler := newBetterFilesHTTPServer(t, 10, 10)
+		outside := t.TempDir()
+		require.NoError(t, os.WriteFile(filepath.Join(outside, "file.txt"), []byte("protected"), 0o600))
+		if target == "file.txt" {
+			require.NoError(t, os.Symlink(filepath.Join(outside, "file.txt"), filepath.Join(s.Filesystem().Path(), "file.txt")))
+		} else {
+			require.NoError(t, os.Symlink(outside, filepath.Join(s.Filesystem().Path(), "link")))
+		}
+		response := performMultipartUpload(t, handler, signBetterFilesUploadToken(t, s.ID()), "/", []multipartTestFile{{"good.txt", []byte("good")}, {"file.txt", []byte("bad")}}, batchPaths(t, "good.txt", target), false)
+		require.Equal(t, http.StatusBadRequest, response.Code, response.Body.String())
+		require.NoFileExists(t, filepath.Join(s.Filesystem().Path(), "good.txt"))
+		data, err := os.ReadFile(filepath.Join(outside, "file.txt"))
+		require.NoError(t, err)
+		require.Equal(t, "protected", string(data))
+		require.NoDirExists(t, filepath.Join(outside, "nested"))
+	}
+}
+
+func TestMultipartFolderBatchLimitsQuotaAndRejectedTokenReuse(t *testing.T) {
+	quietUploadActivity(t)
+	for _, limits := range [][2]int64{{1, 10}, {10, 1}} {
+		_, s, handler := newBetterFilesHTTPServer(t, limits[0], limits[1])
+		token := signBetterFilesUploadToken(t, s.ID())
+		files := []multipartTestFile{{"a", bytes.Repeat([]byte("a"), 600*1024)}, {"b", bytes.Repeat([]byte("b"), 600*1024)}}
+		response := performMultipartUpload(t, handler, token, "/new", files, batchPaths(t, "a", "nested/b"), false)
+		require.Equal(t, http.StatusBadRequest, response.Code, response.Body.String())
+		require.NoDirExists(t, filepath.Join(s.Filesystem().Path(), "new"))
+		response = performMultipartUpload(t, handler, token, "/", []multipartTestFile{{"a", []byte("x")}}, nil, false)
+		require.Equal(t, http.StatusNotFound, response.Code)
+	}
+	_, s, handler := newBetterFilesHTTPServer(t, 1, 10)
+	response := performMultipartUpload(t, handler, signBetterFilesUploadToken(t, s.ID()), "/", []multipartTestFile{{"big", bytes.Repeat([]byte("x"), 10*1024*1024)}}, batchPaths(t, "folder/big"), false)
+	require.Equal(t, http.StatusRequestEntityTooLarge, response.Code, response.Body.String())
+	require.NoDirExists(t, filepath.Join(s.Filesystem().Path(), "folder"))
+}
+
+func TestMultipartFolderBatchPlanRejectsSizeOverflowAndFileCount(t *testing.T) {
+	for _, sizes := range [][]int64{{-1}, {math.MaxInt64, 1}, {math.MaxInt64/2 + 1, math.MaxInt64/2 + 1}} {
+		form := &multipart.Form{File: map[string][]*multipart.FileHeader{"files": {}}}
+		for _, size := range sizes {
+			form.File["files"] = append(form.File["files"], &multipart.FileHeader{Filename: "file.txt", Size: size})
+		}
+		_, err := multipartUploadTargets(form, "/", math.MaxInt64)
+		require.Error(t, err)
+	}
+	form := &multipart.Form{Value: map[string][]string{"paths": {"[]"}}, File: map[string][]*multipart.FileHeader{"files": make([]*multipart.FileHeader, maxMultipartUploadFiles+1)}}
+	_, err := multipartUploadTargets(form, "/", 10)
+	require.Error(t, err)
+	delete(form.Value, "paths")
+	for i := range form.File["files"] {
+		form.File["files"][i] = &multipart.FileHeader{Filename: "file.txt"}
+	}
+	targets, err := multipartUploadTargets(form, "/", 10)
+	require.NoError(t, err, "flat uploads retain the multipart parser's original file-count limit")
+	require.Len(t, targets, maxMultipartUploadFiles+1)
+}
diff --git a/router/tokens/websocket.go b/router/tokens/websocket.go
index 07ad8f4e..c896adee 100644
--- a/router/tokens/websocket.go
+++ b/router/tokens/websocket.go
@@ -85,6 +85,8 @@ type WebsocketPayload struct {
 	Scoped
 
 	UserUUID    string   `json:"user_uuid"`
+	UserName    string   `json:"user_name,omitempty"`
+	UserAvatar  *string  `json:"user_avatar,omitempty"`
 	ServerUUID  string   `json:"server_uuid"`
 	Permissions []string `json:"permissions"`
 }
diff --git a/router/websocket/betterfiles_collaboration.go b/router/websocket/betterfiles_collaboration.go
new file mode 100644
index 00000000..e74ea9c2
--- /dev/null
+++ b/router/websocket/betterfiles_collaboration.go
@@ -0,0 +1,1269 @@
+package websocket
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	pathpkg "path"
+	"strings"
+	"sync"
+	"time"
+	"unicode/utf8"
+
+	"github.com/gbrlsnchs/jwt/v3"
+	"github.com/pterodactyl/wings/router/tokens"
+)
+
+const (
+	BetterFilesCollabJoinEvent         = Event("betterfiles:collab:join")
+	BetterFilesCollabLeaveEvent        = Event("betterfiles:collab:leave")
+	BetterFilesCollabCloseEvent        = Event("betterfiles:collab:close")
+	BetterFilesCollabFileOpenEvent     = Event("betterfiles:collab:file:open")
+	BetterFilesCollabFileCloseEvent    = Event("betterfiles:collab:file:close")
+	BetterFilesCollabPresenceEvent     = Event("betterfiles:collab:presence")
+	BetterFilesCollabPatchEvent        = Event("betterfiles:collab:patch")
+	BetterFilesCollabSnapshotEvent     = Event("betterfiles:collab:snapshot")
+	BetterFilesCollabFileSavedEvent    = Event("betterfiles:collab:file:saved")
+	BetterFilesCollabFileCheckEvent    = Event("betterfiles:collab:file:check")
+	BetterFilesCollabExternalEditEvent = Event("betterfiles:collab:file:external-modified")
+
+	betterFilesCollabJoinedEvent          = Event("betterfiles:collab:joined")
+	betterFilesCollabClosedEvent          = Event("betterfiles:collab:closed")
+	betterFilesCollabLeftEvent            = Event("betterfiles:collab:left")
+	betterFilesCollabMembersEvent         = Event("betterfiles:collab:members")
+	betterFilesCollabFileUsersEvent       = Event("betterfiles:collab:file:users")
+	betterFilesCollabPresenceOut          = Event("betterfiles:collab:presence")
+	betterFilesCollabPatchOut             = Event("betterfiles:collab:patch")
+	betterFilesCollabSnapshotOut          = Event("betterfiles:collab:snapshot")
+	betterFilesCollabFileSavedOut         = Event("betterfiles:collab:file:saved")
+	betterFilesCollabFileCheckResultEvent = Event("betterfiles:collab:file:check:result")
+	betterFilesCollabExternalEditOut      = Event("betterfiles:collab:file:external-modified")
+	betterFilesCollabErrorEvent           = Event("betterfiles:collab:error")
+
+	betterFilesCollabReadPermission  = "file.read-content"
+	betterFilesCollabWritePermission = "file.update"
+	betterFilesCollabMaxPayloadBytes = 10 * 1024 * 1024
+	betterFilesCollabMaxMessageBytes = betterFilesCollabMaxPayloadBytes*2 + 8192
+	betterFilesCollabMaxUsers        = 20
+	betterFilesCollabMaxPatchChanges = 64
+	betterFilesCollabMaxPathBytes    = 4096
+	betterFilesCollabMaxCursorValue  = 1000000
+	betterFilesCollabMaxDocuments    = 32
+	betterFilesCollabMaxSessionBytes = 32 * 1024 * 1024
+)
+
+type betterFilesCollabUser struct {
+	UUID         string `json:"uuid"`
+	Username     string `json:"username"`
+	Image        string `json:"image"`
+	ConnectionID string `json:"connection_id,omitempty"`
+}
+
+type betterFilesCollabSessionInfo struct {
+	Code         string `json:"code"`
+	ServerUUID   string `json:"server_uuid"`
+	OwnerUUID    string `json:"owner_uuid"`
+	Mode         string `json:"mode"`
+	MaxUsers     int    `json:"max_users"`
+	MaxFileBytes int    `json:"max_file_bytes"`
+	Token        string `json:"socket_token"`
+	ExpiresAt    int64  `json:"-"`
+}
+
+type betterFilesCollabToken struct {
+	jwt.Payload
+	ServerUUID   string `json:"server_uuid"`
+	UserUUID     string `json:"user_uuid"`
+	Enabled      bool   `json:"better_files_collaboration"`
+	Code         string `json:"collaboration_code"`
+	OwnerUUID    string `json:"collaboration_owner_uuid"`
+	Mode         string `json:"collaboration_mode"`
+	MaxUsers     int    `json:"collaboration_max_users"`
+	MaxFileBytes int    `json:"collaboration_max_file_bytes"`
+	UserCanEdit  bool   `json:"collaboration_user_can_edit"`
+	ExpiresAt    int64  `json:"collaboration_expires_at"`
+}
+
+func (p *betterFilesCollabToken) GetPayload() *jwt.Payload {
+	return &p.Payload
+}
+
+type betterFilesCollabJoinPayload struct {
+	Session betterFilesCollabSessionInfo `json:"session"`
+	User    betterFilesCollabUser        `json:"user"`
+}
+
+type betterFilesCollabFilePayload struct {
+	Code string `json:"code"`
+	Path string `json:"path"`
+}
+
+type betterFilesCollabCodePayload struct {
+	Code string `json:"code"`
+}
+
+type betterFilesCollabPresencePayload struct {
+	Code      string `json:"code"`
+	Path      string `json:"path"`
+	Line      int    `json:"line"`
+	Column    int    `json:"column"`
+	Selection string `json:"selection,omitempty"`
+}
+
+type betterFilesCollabSnapshotPayload struct {
+	Code    string `json:"code"`
+	Path    string `json:"path"`
+	Content string `json:"content"`
+	Version int64  `json:"version"`
+	Line    int    `json:"line,omitempty"`
+	Column  int    `json:"column,omitempty"`
+}
+
+type betterFilesCollabTextEdit struct {
+	RangeOffset int    `json:"rangeOffset"`
+	RangeLength int    `json:"rangeLength"`
+	Text        string `json:"text"`
+	BaseHash    string `json:"baseHash,omitempty"`
+	BaseLength  int    `json:"baseLength,omitempty"`
+}
+
+type betterFilesCollabPatchPayload struct {
+	Code    string                      `json:"code"`
+	Path    string                      `json:"path"`
+	Changes []betterFilesCollabTextEdit `json:"changes"`
+	Version int64                       `json:"version"`
+	Line    int                         `json:"line,omitempty"`
+	Column  int                         `json:"column,omitempty"`
+}
+
+type betterFilesCollabSavedPayload struct {
+	Code    string `json:"code"`
+	Path    string `json:"path"`
+	Content string `json:"content"`
+	Version int64  `json:"version"`
+}
+
+type betterFilesCollabFileCheckPayload struct {
+	Path      string `json:"path"`
+	RequestID string `json:"request_id,omitempty"`
+}
+
+type betterFilesCollabExternalEditPayload struct {
+	Path string                `json:"path"`
+	User betterFilesCollabUser `json:"user"`
+}
+
+type betterFilesCollabFileConflict struct {
+	Code  string                  `json:"code"`
+	Mode  string                  `json:"mode"`
+	Users []betterFilesCollabUser `json:"users"`
+}
+
+type betterFilesCollabMember struct {
+	HandlerID   string                `json:"handler_id"`
+	User        betterFilesCollabUser `json:"user"`
+	FilePath    string                `json:"file_path,omitempty"`
+	JoinedAt    time.Time             `json:"joined_at"`
+	LastVersion int64                 `json:"-"`
+	handler     *Handler
+}
+
+type betterFilesCollabSession struct {
+	sync.RWMutex
+	Code         string
+	ServerUUID   string
+	OwnerUUID    string
+	Mode         string
+	MaxUsers     int
+	MaxFileBytes int
+	ExpiresAt    time.Time
+	Members      map[string]*betterFilesCollabMember
+	Documents    map[string]*betterFilesCollabDocument
+}
+
+var (
+	betterFilesCollabMu       sync.Mutex
+	betterFilesCollabSessions = map[string]*betterFilesCollabSession{}
+)
+
+// HandleBetterFilesCollaboration handles Better Files live collaboration socket messages.
+// Add this near the top of Handler.HandleInbound after TokenValid succeeds:
+//
+//	if handled, err := h.HandleBetterFilesCollaboration(ctx, m); handled {
+//	    return err
+//	}
+func (h *Handler) HandleBetterFilesCollaboration(ctx context.Context, m Message) (bool, error) {
+	switch m.Event {
+	case BetterFilesCollabJoinEvent:
+		return true, h.betterFilesCollabJoin(ctx, m)
+	case BetterFilesCollabLeaveEvent:
+		h.betterFilesCollabLeaveAll()
+		return true, nil
+	case BetterFilesCollabCloseEvent:
+		return true, h.betterFilesCollabClose(m)
+	case BetterFilesCollabFileOpenEvent:
+		return true, h.betterFilesCollabSetFile(m, true)
+	case BetterFilesCollabFileCloseEvent:
+		return true, h.betterFilesCollabSetFile(m, false)
+	case BetterFilesCollabPresenceEvent:
+		return true, h.betterFilesCollabPresence(m)
+	case BetterFilesCollabPatchEvent:
+		return true, h.betterFilesCollabPatch(m)
+	case BetterFilesCollabSnapshotEvent:
+		return true, h.betterFilesCollabSnapshot(m)
+	case BetterFilesCollabFileSavedEvent:
+		return true, h.betterFilesCollabFileSaved(m)
+	case BetterFilesCollabFileCheckEvent:
+		return true, h.betterFilesCollabFileCheck(m)
+	case BetterFilesCollabExternalEditEvent:
+		return true, h.betterFilesCollabExternalEdit(m)
+	default:
+		return false, nil
+	}
+}
+
+func (h *Handler) betterFilesCollabJoin(ctx context.Context, m Message) error {
+	if !h.betterFilesCollabCanRead() {
+		return h.betterFilesCollabError("missing file read permission")
+	}
+
+	var payload betterFilesCollabJoinPayload
+	if !betterFilesCollabDecode(m, &payload) {
+		return h.betterFilesCollabError("invalid collaboration join payload")
+	}
+
+	jwt := h.GetJwt()
+	verifiedSession, tokenUserUUID, ok := betterFilesCollabVerifiedSession(payload.Session)
+	if !ok {
+		return h.betterFilesCollabError("invalid or expired collaboration session token")
+	}
+
+	if jwt == nil || verifiedSession.ServerUUID != jwt.GetServerUuid() || tokenUserUUID != jwt.UserUUID {
+		return h.betterFilesCollabError("collaboration session does not match this server")
+	}
+	if verifiedSession.Mode == "edit" && !h.betterFilesCollabCanWrite() {
+		return h.betterFilesCollabError("missing file write permission")
+	}
+
+	code := betterFilesCollabCode(verifiedSession.Code)
+	if code == "" {
+		return h.betterFilesCollabError("invalid collaboration session code")
+	}
+
+	user := payload.User
+	user.UUID = jwt.UserUUID
+	user.Username = betterFilesCollabSafeText(user.Username, 48)
+	user.Image = betterFilesCollabSafeImage(user.Image)
+	user.ConnectionID = betterFilesCollabSafeText(user.ConnectionID, 80)
+	if user.Username == "" {
+		user.Username = "User"
+	}
+	if user.ConnectionID == "" {
+		user.ConnectionID = h.Uuid().String()
+	}
+
+	h.betterFilesCollabLeaveAll()
+
+	session := betterFilesCollabGetOrCreateSession(verifiedSession)
+	if session.ServerUUID != verifiedSession.ServerUUID || session.Mode != verifiedSession.Mode {
+		return h.betterFilesCollabError("collaboration session metadata changed")
+	}
+
+	session.Lock()
+	if len(session.Members) >= session.MaxUsers {
+		session.Unlock()
+		return h.betterFilesCollabError("collaboration session is full")
+	}
+	session.Members[h.Uuid().String()] = &betterFilesCollabMember{
+		HandlerID: h.Uuid().String(),
+		User:      user,
+		JoinedAt:  time.Now(),
+		handler:   h,
+	}
+	session.Unlock()
+
+	go func(handlerID string, sessionCode string) {
+		<-ctx.Done()
+		betterFilesCollabRemoveMember(sessionCode, handlerID)
+	}(h.Uuid().String(), code)
+
+	h.betterFilesCollabSend(betterFilesCollabJoinedEvent, map[string]any{
+		"code": code,
+		"user": user,
+		"mode": session.Mode,
+	})
+	betterFilesCollabBroadcastMembers(session)
+	betterFilesCollabBroadcastFileUsers(session)
+
+	return nil
+}
+
+func (h *Handler) betterFilesCollabSetFile(m Message, open bool) error {
+	var payload betterFilesCollabFilePayload
+	if !betterFilesCollabDecode(m, &payload) {
+		return h.betterFilesCollabError("invalid collaboration file payload")
+	}
+
+	session, member := betterFilesCollabMemberFor(h, payload.Code)
+	if session == nil || member == nil {
+		return h.betterFilesCollabError("not joined to this collaboration session")
+	}
+
+	path, ok := betterFilesCollabPath(payload.Path)
+	if !ok {
+		return h.betterFilesCollabError("file is not allowed in live collaboration")
+	}
+	session.Lock()
+	if open {
+		member.FilePath = path
+	} else if member.FilePath == path {
+		member.FilePath = ""
+	}
+	session.Unlock()
+
+	betterFilesCollabBroadcastFileUsers(session)
+	if open {
+		document, err := h.betterFilesCollabDocumentFor(session, path)
+		if err != nil {
+			return h.betterFilesCollabError(err.Error())
+		}
+		return h.betterFilesCollabSendDocument(session, document, path)
+	}
+	return nil
+}
+
+func (h *Handler) betterFilesCollabClose(m Message) error {
+	var payload betterFilesCollabCodePayload
+	if !betterFilesCollabDecode(m, &payload) {
+		return h.betterFilesCollabError("invalid collaboration close payload")
+	}
+
+	session, member := betterFilesCollabMemberFor(h, payload.Code)
+	if session == nil || member == nil {
+		return h.betterFilesCollabError("not joined to this collaboration session")
+	}
+	if session.OwnerUUID != "" && member.User.UUID != session.OwnerUUID {
+		return h.betterFilesCollabError("only the live session owner can close it")
+	}
+
+	code := session.Code
+	betterFilesCollabBroadcast(session, h.Uuid().String(), betterFilesCollabClosedEvent, map[string]any{
+		"code": code,
+	})
+
+	betterFilesCollabMu.Lock()
+	delete(betterFilesCollabSessions, code)
+	betterFilesCollabMu.Unlock()
+
+	return nil
+}
+
+func (h *Handler) betterFilesCollabPresence(m Message) error {
+	var payload betterFilesCollabPresencePayload
+	if !betterFilesCollabDecode(m, &payload) {
+		return h.betterFilesCollabError("invalid collaboration presence payload")
+	}
+
+	session, member := betterFilesCollabMemberFor(h, payload.Code)
+	if session == nil || member == nil {
+		return h.betterFilesCollabError("not joined to this collaboration session")
+	}
+
+	path, ok := betterFilesCollabPath(payload.Path)
+	if !ok {
+		return h.betterFilesCollabError("file is not allowed in live collaboration")
+	}
+	payload.Path = path
+	payload.Line = betterFilesCollabClampCursor(payload.Line)
+	payload.Column = betterFilesCollabClampCursor(payload.Column)
+	if betterFilesCollabSetMemberPath(session, member, payload.Path) {
+		betterFilesCollabBroadcastFileUsers(session)
+	}
+
+	betterFilesCollabBroadcast(session, h.Uuid().String(), betterFilesCollabPresenceOut, map[string]any{
+		"code":      payload.Code,
+		"path":      payload.Path,
+		"line":      payload.Line,
+		"column":    payload.Column,
+		"selection": betterFilesCollabSafeText(payload.Selection, 120),
+		"user":      member.User,
+	})
+	return nil
+}
+
+func (h *Handler) betterFilesCollabPatch(m Message) error {
+	if !h.betterFilesCollabCanWrite() {
+		return h.betterFilesCollabError("missing file write permission")
+	}
+
+	var payload betterFilesCollabPatchPayload
+	if !betterFilesCollabDecode(m, &payload) {
+		return h.betterFilesCollabError("invalid collaboration patch payload")
+	}
+	session, member := betterFilesCollabMemberFor(h, payload.Code)
+	if session == nil || member == nil {
+		return h.betterFilesCollabError("not joined to this collaboration session")
+	}
+	if session.Mode != "edit" {
+		return h.betterFilesCollabError("collaboration session is view-only")
+	}
+	if len(payload.Changes) == 0 || len(payload.Changes) > betterFilesCollabMaxPatchChanges {
+		return h.betterFilesCollabError("invalid collaboration patch size")
+	}
+
+	totalTextBytes := 0
+	for _, change := range payload.Changes {
+		if change.RangeOffset < 0 || change.RangeLength < 0 || change.BaseLength < 0 || !utf8.ValidString(change.Text) {
+			return h.betterFilesCollabError("invalid collaboration patch change")
+		}
+		if change.RangeOffset > betterFilesCollabMaxPayloadBytes || change.RangeLength > betterFilesCollabMaxPayloadBytes || change.BaseLength > betterFilesCollabMaxPayloadBytes {
+			return h.betterFilesCollabError("invalid collaboration patch change")
+		}
+		totalTextBytes += len(change.Text)
+	}
+
+	maxPayloadBytes := session.MaxFileBytes
+	if maxPayloadBytes <= 0 || maxPayloadBytes > betterFilesCollabMaxPayloadBytes {
+		maxPayloadBytes = betterFilesCollabMaxPayloadBytes
+	}
+	if totalTextBytes > maxPayloadBytes {
+		return h.betterFilesCollabError("collaboration patch is too large")
+	}
+
+	path, ok := betterFilesCollabPath(payload.Path)
+	if !ok {
+		return h.betterFilesCollabError("file is not allowed in live collaboration")
+	}
+	payload.Path = path
+	payload.Line = betterFilesCollabClampCursor(payload.Line)
+	payload.Column = betterFilesCollabClampCursor(payload.Column)
+	if !betterFilesCollabAcceptVersion(session, member, payload.Version) {
+		return nil
+	}
+	if betterFilesCollabSetMemberPath(session, member, payload.Path) {
+		betterFilesCollabBroadcastFileUsers(session)
+	}
+	document, err := h.betterFilesCollabDocumentFor(session, payload.Path)
+	if err != nil {
+		return h.betterFilesCollabError(err.Error())
+	}
+
+	current, _ := document.snapshot()
+	availableSessionBytes := betterFilesCollabMaxSessionBytes - (betterFilesCollabSessionDocumentBytes(session) - len(current))
+	if availableSessionBytes < maxPayloadBytes {
+		maxPayloadBytes = availableSessionBytes
+	}
+	if maxPayloadBytes <= 0 {
+		return h.betterFilesCollabError("collaboration session document memory limit reached")
+	}
+
+	result, err := document.applyMonacoChanges(payload.Changes, maxPayloadBytes)
+	if err != nil {
+		if errors.Is(err, errBetterFilesCollabBaseNotFound) {
+			return h.betterFilesCollabSendDocument(session, document, payload.Path)
+		}
+		if errors.Is(err, errBetterFilesCollabTooLarge) {
+			return h.betterFilesCollabError("collaboration document is too large")
+		}
+		return h.betterFilesCollabError("invalid collaboration patch")
+	}
+	if len(result.Changes) == 0 {
+		return h.betterFilesCollabSendDocument(session, document, payload.Path)
+	}
+
+	betterFilesCollabBroadcast(session, h.Uuid().String(), betterFilesCollabPatchOut, map[string]any{
+		"code":     payload.Code,
+		"path":     payload.Path,
+		"changes":  result.Changes,
+		"version":  payload.Version,
+		"revision": result.Revision,
+		"line":     payload.Line,
+		"column":   payload.Column,
+		"user":     member.User,
+	})
+	if result.Transformed {
+		return h.betterFilesCollabSendDocument(session, document, payload.Path)
+	}
+	return nil
+}
+
+func (h *Handler) betterFilesCollabSnapshot(m Message) error {
+	if !h.betterFilesCollabCanWrite() {
+		return h.betterFilesCollabError("missing file write permission")
+	}
+
+	var payload betterFilesCollabSnapshotPayload
+	if !betterFilesCollabDecode(m, &payload) {
+		return h.betterFilesCollabError("invalid collaboration snapshot payload")
+	}
+	session, member := betterFilesCollabMemberFor(h, payload.Code)
+	if session == nil || member == nil {
+		return h.betterFilesCollabError("not joined to this collaboration session")
+	}
+	if session.Mode != "edit" {
+		return h.betterFilesCollabError("collaboration session is view-only")
+	}
+	maxPayloadBytes := session.MaxFileBytes
+	if maxPayloadBytes <= 0 || maxPayloadBytes > betterFilesCollabMaxPayloadBytes {
+		maxPayloadBytes = betterFilesCollabMaxPayloadBytes
+	}
+	if len(payload.Content) > maxPayloadBytes || !utf8.ValidString(payload.Content) {
+		return h.betterFilesCollabError("collaboration snapshot is too large or invalid")
+	}
+
+	path, ok := betterFilesCollabPath(payload.Path)
+	if !ok {
+		return h.betterFilesCollabError("file is not allowed in live collaboration")
+	}
+	payload.Path = path
+	payload.Line = betterFilesCollabClampCursor(payload.Line)
+	payload.Column = betterFilesCollabClampCursor(payload.Column)
+	if !betterFilesCollabAcceptVersion(session, member, payload.Version) {
+		return nil
+	}
+	if betterFilesCollabSetMemberPath(session, member, payload.Path) {
+		betterFilesCollabBroadcastFileUsers(session)
+	}
+	document, err := h.betterFilesCollabDocumentFor(session, payload.Path)
+	if err != nil {
+		return h.betterFilesCollabError(err.Error())
+	}
+	current, revision := document.snapshot()
+	if current != payload.Content {
+		if revision == 0 && len(betterFilesCollabUsersForPath(session, payload.Path, h.Uuid().String())) == 0 {
+			document.replace(payload.Content)
+			current, revision = document.snapshot()
+		} else {
+			return h.betterFilesCollabSendDocument(session, document, payload.Path)
+		}
+	}
+
+	betterFilesCollabBroadcast(session, h.Uuid().String(), betterFilesCollabSnapshotOut, map[string]any{
+		"code":     payload.Code,
+		"path":     payload.Path,
+		"content":  current,
+		"version":  payload.Version,
+		"revision": revision,
+		"line":     payload.Line,
+		"column":   payload.Column,
+		"user":     member.User,
+	})
+	return nil
+}
+
+func (h *Handler) betterFilesCollabFileSaved(m Message) error {
+	if !h.betterFilesCollabCanWrite() {
+		return h.betterFilesCollabError("missing file write permission")
+	}
+
+	var payload betterFilesCollabSavedPayload
+	if !betterFilesCollabDecode(m, &payload) {
+		return h.betterFilesCollabError("invalid collaboration save payload")
+	}
+
+	session, member := betterFilesCollabMemberFor(h, payload.Code)
+	if session == nil || member == nil {
+		return h.betterFilesCollabError("not joined to this collaboration session")
+	}
+	if session.Mode != "edit" {
+		return h.betterFilesCollabError("collaboration session is view-only")
+	}
+
+	maxPayloadBytes := session.MaxFileBytes
+	if maxPayloadBytes <= 0 || maxPayloadBytes > betterFilesCollabMaxPayloadBytes {
+		maxPayloadBytes = betterFilesCollabMaxPayloadBytes
+	}
+	if len(payload.Content) > maxPayloadBytes || !utf8.ValidString(payload.Content) {
+		return h.betterFilesCollabError("collaboration save payload is too large or invalid")
+	}
+
+	path, ok := betterFilesCollabPath(payload.Path)
+	if !ok {
+		return h.betterFilesCollabError("file is not allowed in live collaboration")
+	}
+	payload.Path = path
+	if !betterFilesCollabAcceptVersion(session, member, payload.Version) {
+		return nil
+	}
+	if betterFilesCollabSetMemberPath(session, member, payload.Path) {
+		betterFilesCollabBroadcastFileUsers(session)
+	}
+	document, err := h.betterFilesCollabDocumentFor(session, payload.Path)
+	if err != nil {
+		return h.betterFilesCollabError(err.Error())
+	}
+	document.replace(payload.Content)
+	_, revision := document.snapshot()
+
+	betterFilesCollabBroadcast(session, h.Uuid().String(), betterFilesCollabFileSavedOut, map[string]any{
+		"code":     payload.Code,
+		"path":     payload.Path,
+		"content":  payload.Content,
+		"version":  payload.Version,
+		"revision": revision,
+		"user":     member.User,
+	})
+	return nil
+}
+
+func (h *Handler) betterFilesCollabFileCheck(m Message) error {
+	if !h.betterFilesCollabCanRead() {
+		return h.betterFilesCollabError("missing file read permission")
+	}
+
+	var payload betterFilesCollabFileCheckPayload
+	if !betterFilesCollabDecode(m, &payload) {
+		return h.betterFilesCollabError("invalid collaboration file check payload")
+	}
+
+	path, ok := betterFilesCollabPath(payload.Path)
+	if !ok {
+		return h.betterFilesCollabError("file is not allowed in live collaboration")
+	}
+	conflicts := betterFilesCollabConflictsForPath(h, path)
+	users := make([]betterFilesCollabUser, 0)
+	for _, conflict := range conflicts {
+		users = append(users, conflict.Users...)
+	}
+
+	return h.betterFilesCollabSend(betterFilesCollabFileCheckResultEvent, map[string]any{
+		"path":       path,
+		"request_id": betterFilesCollabSafeText(payload.RequestID, 80),
+		"conflicts":  conflicts,
+		"users":      users,
+	})
+}
+
+func (h *Handler) betterFilesCollabExternalEdit(m Message) error {
+	if !h.betterFilesCollabCanWrite() {
+		return h.betterFilesCollabError("missing file write permission")
+	}
+
+	var payload betterFilesCollabExternalEditPayload
+	if !betterFilesCollabDecode(m, &payload) {
+		return h.betterFilesCollabError("invalid external edit payload")
+	}
+
+	jwt := h.GetJwt()
+	if jwt == nil {
+		return h.betterFilesCollabError("missing websocket identity")
+	}
+
+	path, ok := betterFilesCollabPath(payload.Path)
+	if !ok {
+		return h.betterFilesCollabError("file is not allowed in live collaboration")
+	}
+	user := payload.User
+	user.UUID = jwt.UserUUID
+	user.Username = betterFilesCollabSafeText(user.Username, 48)
+	user.Image = betterFilesCollabSafeImage(user.Image)
+	user.ConnectionID = betterFilesCollabSafeText(user.ConnectionID, 80)
+	if user.Username == "" {
+		user.Username = "User"
+	}
+	if user.ConnectionID == "" {
+		user.ConnectionID = h.Uuid().String()
+	}
+
+	for _, session := range betterFilesCollabSessionsForServer(jwt.GetServerUuid()) {
+		if session.Mode != "edit" {
+			continue
+		}
+
+		users := betterFilesCollabUsersForPath(session, path, h.Uuid().String())
+		if len(users) == 0 {
+			continue
+		}
+
+		betterFilesCollabBroadcast(session, "", betterFilesCollabExternalEditOut, map[string]any{
+			"code":          session.Code,
+			"path":          path,
+			"user":          user,
+			"editing_users": users,
+		})
+	}
+
+	return nil
+}
+
+func (h *Handler) betterFilesCollabCanRead() bool {
+	jwt := h.GetJwt()
+	return jwt != nil && jwt.HasPermission(betterFilesCollabReadPermission)
+}
+
+func (h *Handler) betterFilesCollabCanWrite() bool {
+	jwt := h.GetJwt()
+	return jwt != nil && jwt.HasPermission(betterFilesCollabWritePermission)
+}
+
+func (h *Handler) betterFilesCollabLeaveAll() {
+	betterFilesCollabMu.Lock()
+	sessions := make([]*betterFilesCollabSession, 0, len(betterFilesCollabSessions))
+	for _, session := range betterFilesCollabSessions {
+		sessions = append(sessions, session)
+	}
+	betterFilesCollabMu.Unlock()
+
+	for _, session := range sessions {
+		betterFilesCollabRemoveMember(session.Code, h.Uuid().String())
+	}
+}
+
+func (h *Handler) betterFilesCollabError(message string) error {
+	return h.betterFilesCollabSend(betterFilesCollabErrorEvent, map[string]string{"error": message})
+}
+
+func (h *Handler) betterFilesCollabSend(event Event, payload any) error {
+	data, err := json.Marshal(payload)
+	if err != nil {
+		return err
+	}
+	return h.SendJson(Message{Event: event, Args: []string{string(data)}})
+}
+
+func betterFilesCollabDecode(m Message, dst any) bool {
+	if len(m.Args) == 0 || len(m.Args[0]) > betterFilesCollabMaxMessageBytes {
+		return false
+	}
+	return json.Unmarshal([]byte(m.Args[0]), dst) == nil
+}
+
+func betterFilesCollabVerifiedSession(info betterFilesCollabSessionInfo) (betterFilesCollabSessionInfo, string, bool) {
+	if strings.TrimSpace(info.Token) == "" {
+		return betterFilesCollabSessionInfo{}, "", false
+	}
+
+	var token betterFilesCollabToken
+	if err := tokens.ParseToken([]byte(info.Token), &token); err != nil {
+		return betterFilesCollabSessionInfo{}, "", false
+	}
+	if !token.Enabled {
+		return betterFilesCollabSessionInfo{}, "", false
+	}
+
+	code := betterFilesCollabCode(token.Code)
+	if code == "" || code != betterFilesCollabCode(info.Code) {
+		return betterFilesCollabSessionInfo{}, "", false
+	}
+
+	mode := token.Mode
+	if mode != "edit" {
+		mode = "view"
+	}
+	maxUsers := token.MaxUsers
+	if maxUsers < 2 || maxUsers > betterFilesCollabMaxUsers {
+		maxUsers = 10
+	}
+
+	maxFileBytes := token.MaxFileBytes
+	if maxFileBytes < 1 || maxFileBytes > betterFilesCollabMaxPayloadBytes {
+		maxFileBytes = betterFilesCollabMaxPayloadBytes
+	}
+	expiresAt := token.ExpiresAt
+	if expiresAt <= 0 {
+		expiresAt = time.Now().Add(15 * time.Minute).Unix()
+	}
+	if expiresAt <= time.Now().Unix() {
+		return betterFilesCollabSessionInfo{}, "", false
+	}
+
+	return betterFilesCollabSessionInfo{
+		Code:         code,
+		ServerUUID:   token.ServerUUID,
+		OwnerUUID:    token.OwnerUUID,
+		Mode:         mode,
+		MaxUsers:     maxUsers,
+		MaxFileBytes: maxFileBytes,
+		Token:        info.Token,
+		ExpiresAt:    expiresAt,
+	}, token.UserUUID, true
+}
+
+func betterFilesCollabGetOrCreateSession(info betterFilesCollabSessionInfo) *betterFilesCollabSession {
+	code := betterFilesCollabCode(info.Code)
+	betterFilesCollabMu.Lock()
+	defer betterFilesCollabMu.Unlock()
+
+	if session, ok := betterFilesCollabSessions[code]; ok {
+		if betterFilesCollabSessionExpired(session) {
+			delete(betterFilesCollabSessions, code)
+		} else {
+			session.Lock()
+			if info.ExpiresAt > 0 && session.ExpiresAt.Before(time.Unix(info.ExpiresAt, 0)) {
+				session.ExpiresAt = time.Unix(info.ExpiresAt, 0)
+			}
+			session.Unlock()
+			return session
+		}
+	}
+
+	mode := info.Mode
+	if mode != "edit" {
+		mode = "view"
+	}
+	maxUsers := info.MaxUsers
+	if maxUsers < 2 || maxUsers > betterFilesCollabMaxUsers {
+		maxUsers = 10
+	}
+	maxFileBytes := info.MaxFileBytes
+	if maxFileBytes < 1 || maxFileBytes > betterFilesCollabMaxPayloadBytes {
+		maxFileBytes = betterFilesCollabMaxPayloadBytes
+	}
+
+	session := &betterFilesCollabSession{
+		Code:         code,
+		ServerUUID:   info.ServerUUID,
+		OwnerUUID:    info.OwnerUUID,
+		Mode:         mode,
+		MaxUsers:     maxUsers,
+		MaxFileBytes: maxFileBytes,
+		ExpiresAt:    time.Unix(info.ExpiresAt, 0),
+		Members:      map[string]*betterFilesCollabMember{},
+		Documents:    map[string]*betterFilesCollabDocument{},
+	}
+	betterFilesCollabSessions[code] = session
+
+	return session
+}
+
+func (h *Handler) betterFilesCollabDocumentFor(session *betterFilesCollabSession, path string) (*betterFilesCollabDocument, error) {
+	session.RLock()
+	document := session.Documents[path]
+	session.RUnlock()
+	if document != nil {
+		return document, nil
+	}
+
+	file, stat, err := h.server.Filesystem().File(path)
+	if err != nil {
+		return nil, fmt.Errorf("could not open collaboration file")
+	}
+	defer file.Close()
+	if stat.IsDir() {
+		return nil, fmt.Errorf("collaboration path is not a file")
+	}
+
+	maxBytes := session.MaxFileBytes
+	if maxBytes <= 0 || maxBytes > betterFilesCollabMaxPayloadBytes {
+		maxBytes = betterFilesCollabMaxPayloadBytes
+	}
+	if stat.Size() > int64(maxBytes) {
+		return nil, fmt.Errorf("collaboration file is too large")
+	}
+	content, err := io.ReadAll(io.LimitReader(file, int64(maxBytes)+1))
+	if err != nil {
+		return nil, fmt.Errorf("could not read collaboration file")
+	}
+	if len(content) > maxBytes || !utf8.Valid(content) {
+		return nil, fmt.Errorf("collaboration file is too large or is not UTF-8 text")
+	}
+
+	document = newBetterFilesCollabDocument(string(content))
+	session.Lock()
+	defer session.Unlock()
+	if existing := session.Documents[path]; existing != nil {
+		return existing, nil
+	}
+	if len(session.Documents) >= betterFilesCollabMaxDocuments {
+		return nil, fmt.Errorf("collaboration session has too many open documents")
+	}
+	currentBytes := 0
+	for _, existing := range session.Documents {
+		existingContent, _ := existing.snapshot()
+		currentBytes += len(existingContent)
+	}
+	if currentBytes+len(content) > betterFilesCollabMaxSessionBytes {
+		return nil, fmt.Errorf("collaboration session document memory limit reached")
+	}
+	session.Documents[path] = document
+	return document, nil
+}
+
+func (h *Handler) betterFilesCollabSendDocument(session *betterFilesCollabSession, document *betterFilesCollabDocument, path string) error {
+	content, revision := document.snapshot()
+	return h.betterFilesCollabSend(betterFilesCollabSnapshotOut, map[string]any{
+		"code":     session.Code,
+		"path":     path,
+		"content":  content,
+		"version":  revision + 1,
+		"revision": revision,
+	})
+}
+
+func betterFilesCollabSessionDocumentBytes(session *betterFilesCollabSession) int {
+	session.RLock()
+	documents := make([]*betterFilesCollabDocument, 0, len(session.Documents))
+	for _, document := range session.Documents {
+		documents = append(documents, document)
+	}
+	session.RUnlock()
+
+	total := 0
+	for _, document := range documents {
+		content, _ := document.snapshot()
+		total += len(content)
+	}
+	return total
+}
+
+func betterFilesCollabMemberFor(h *Handler, code string) (*betterFilesCollabSession, *betterFilesCollabMember) {
+	code = betterFilesCollabCode(code)
+	betterFilesCollabMu.Lock()
+	session := betterFilesCollabSessions[code]
+	betterFilesCollabMu.Unlock()
+	if session == nil {
+		return nil, nil
+	}
+	if betterFilesCollabSessionExpired(session) {
+		betterFilesCollabMu.Lock()
+		if betterFilesCollabSessions[code] == session {
+			delete(betterFilesCollabSessions, code)
+		}
+		betterFilesCollabMu.Unlock()
+		return nil, nil
+	}
+
+	session.RLock()
+	member := session.Members[h.Uuid().String()]
+	session.RUnlock()
+	return session, member
+}
+
+func betterFilesCollabRemoveMember(code string, handlerID string) {
+	code = betterFilesCollabCode(code)
+	betterFilesCollabMu.Lock()
+	session := betterFilesCollabSessions[code]
+	betterFilesCollabMu.Unlock()
+	if session == nil {
+		return
+	}
+
+	session.Lock()
+	if _, ok := session.Members[handlerID]; !ok {
+		session.Unlock()
+		return
+	}
+	delete(session.Members, handlerID)
+	empty := len(session.Members) == 0
+	session.Unlock()
+
+	if empty {
+		betterFilesCollabMu.Lock()
+		delete(betterFilesCollabSessions, code)
+		betterFilesCollabMu.Unlock()
+		return
+	}
+
+	betterFilesCollabBroadcastMembers(session)
+	betterFilesCollabBroadcastFileUsers(session)
+}
+
+func betterFilesCollabAcceptVersion(session *betterFilesCollabSession, member *betterFilesCollabMember, version int64) bool {
+	if version < 1 {
+		return false
+	}
+
+	session.Lock()
+	defer session.Unlock()
+
+	if version <= member.LastVersion {
+		return false
+	}
+
+	member.LastVersion = version
+	return true
+}
+
+func betterFilesCollabSetMemberPath(session *betterFilesCollabSession, member *betterFilesCollabMember, path string) bool {
+	session.Lock()
+	defer session.Unlock()
+
+	if member.FilePath == path {
+		return false
+	}
+
+	member.FilePath = path
+	return true
+}
+
+func betterFilesCollabSessionsForServer(serverUUID string) []*betterFilesCollabSession {
+	betterFilesCollabMu.Lock()
+	sessions := make([]*betterFilesCollabSession, 0, len(betterFilesCollabSessions))
+	for _, session := range betterFilesCollabSessions {
+		if betterFilesCollabSessionExpired(session) {
+			delete(betterFilesCollabSessions, session.Code)
+			continue
+		}
+		if session.ServerUUID == serverUUID {
+			sessions = append(sessions, session)
+		}
+	}
+	betterFilesCollabMu.Unlock()
+
+	return sessions
+}
+
+// CloseBetterFilesCollaborationSessions closes active in-memory Better Files
+// collaboration sessions for a server. It is called by the protected Wings API
+// when panel settings revoke collaboration access.
+func CloseBetterFilesCollaborationSessions(serverUUID string, mode string, reason string) int {
+	mode = strings.TrimSpace(mode)
+	if mode != "edit" && mode != "view" {
+		mode = ""
+	}
+	reason = betterFilesCollabSafeText(reason, 160)
+	if reason == "" {
+		reason = "Live collaboration was revoked by an administrator."
+	}
+
+	betterFilesCollabMu.Lock()
+	sessions := make([]*betterFilesCollabSession, 0, len(betterFilesCollabSessions))
+	for code, session := range betterFilesCollabSessions {
+		if betterFilesCollabSessionExpired(session) {
+			delete(betterFilesCollabSessions, code)
+			continue
+		}
+		if session.ServerUUID != serverUUID {
+			continue
+		}
+		if mode != "" && session.Mode != mode {
+			continue
+		}
+
+		delete(betterFilesCollabSessions, code)
+		sessions = append(sessions, session)
+	}
+	betterFilesCollabMu.Unlock()
+
+	for _, session := range sessions {
+		betterFilesCollabBroadcast(session, "", betterFilesCollabClosedEvent, map[string]any{
+			"code":   session.Code,
+			"reason": reason,
+		})
+
+		session.Lock()
+		session.Members = map[string]*betterFilesCollabMember{}
+		session.Unlock()
+	}
+
+	return len(sessions)
+}
+
+func betterFilesCollabUsersForPath(session *betterFilesCollabSession, path string, exceptHandlerID string) []betterFilesCollabUser {
+	users := make([]betterFilesCollabUser, 0)
+
+	session.RLock()
+	for _, member := range session.Members {
+		if exceptHandlerID != "" && member.HandlerID == exceptHandlerID {
+			continue
+		}
+		if member.FilePath == path {
+			users = append(users, member.User)
+		}
+	}
+	session.RUnlock()
+
+	return users
+}
+
+func betterFilesCollabConflictsForPath(h *Handler, path string) []betterFilesCollabFileConflict {
+	jwt := h.GetJwt()
+	if jwt == nil {
+		return nil
+	}
+
+	conflicts := make([]betterFilesCollabFileConflict, 0)
+	for _, session := range betterFilesCollabSessionsForServer(jwt.GetServerUuid()) {
+		if session.Mode != "edit" {
+			continue
+		}
+
+		users := betterFilesCollabUsersForPath(session, path, h.Uuid().String())
+		if len(users) == 0 {
+			continue
+		}
+
+		conflicts = append(conflicts, betterFilesCollabFileConflict{
+			Code:  session.Code,
+			Mode:  session.Mode,
+			Users: users,
+		})
+	}
+
+	return conflicts
+}
+
+func betterFilesCollabBroadcastMembers(session *betterFilesCollabSession) {
+	members := betterFilesCollabMembers(session)
+	betterFilesCollabBroadcast(session, "", betterFilesCollabMembersEvent, map[string]any{
+		"code":    session.Code,
+		"members": members,
+		"mode":    session.Mode,
+	})
+}
+
+func betterFilesCollabBroadcastFileUsers(session *betterFilesCollabSession) {
+	fileUsers := map[string][]betterFilesCollabUser{}
+
+	session.RLock()
+	for _, member := range session.Members {
+		if member.FilePath == "" {
+			continue
+		}
+		fileUsers[member.FilePath] = append(fileUsers[member.FilePath], member.User)
+	}
+	session.RUnlock()
+
+	betterFilesCollabBroadcast(session, "", betterFilesCollabFileUsersEvent, map[string]any{
+		"code":  session.Code,
+		"files": fileUsers,
+	})
+}
+
+func betterFilesCollabMembers(session *betterFilesCollabSession) []betterFilesCollabUser {
+	session.RLock()
+	defer session.RUnlock()
+
+	members := make([]betterFilesCollabUser, 0, len(session.Members))
+	for _, member := range session.Members {
+		members = append(members, member.User)
+	}
+	return members
+}
+
+func betterFilesCollabBroadcast(session *betterFilesCollabSession, exceptHandlerID string, event Event, payload any) {
+	data, err := json.Marshal(payload)
+	if err != nil {
+		return
+	}
+	msg := Message{Event: event, Args: []string{string(data)}}
+
+	session.RLock()
+	members := make([]*betterFilesCollabMember, 0, len(session.Members))
+	for _, member := range session.Members {
+		if exceptHandlerID != "" && member.HandlerID == exceptHandlerID {
+			continue
+		}
+		members = append(members, member)
+	}
+	session.RUnlock()
+
+	for _, member := range members {
+		_ = member.handler.SendJson(msg)
+	}
+}
+
+func betterFilesCollabCode(code string) string {
+	code = strings.ToUpper(strings.TrimSpace(code))
+	code = strings.ReplaceAll(code, " ", "")
+	if len(code) == 8 {
+		code = code[:4] + "-" + code[4:]
+	}
+	if len(code) != 9 || code[4] != '-' {
+		return ""
+	}
+	for i, r := range code {
+		if i == 4 {
+			continue
+		}
+		if (r < 'A' || r > 'Z') && (r < '0' || r > '9') {
+			return ""
+		}
+	}
+	return code
+}
+
+func betterFilesCollabSessionExpired(session *betterFilesCollabSession) bool {
+	session.RLock()
+	expiresAt := session.ExpiresAt
+	session.RUnlock()
+
+	return expiresAt.IsZero() || !expiresAt.After(time.Now())
+}
+
+func betterFilesCollabPath(path string) (string, bool) {
+	path = strings.TrimSpace(strings.ReplaceAll(path, "\\", "/"))
+	if path == "" || len(path) > betterFilesCollabMaxPathBytes || strings.Contains(path, "\x00") || !utf8.ValidString(path) {
+		return "", false
+	}
+	for _, r := range path {
+		if r < 0x20 || r == 0x7f {
+			return "", false
+		}
+	}
+	if !strings.HasPrefix(path, "/") {
+		path = "/" + path
+	}
+	for _, segment := range strings.Split(path, "/") {
+		if segment == ".." {
+			return "", false
+		}
+	}
+	path = pathpkg.Clean(path)
+	if !strings.HasPrefix(path, "/") {
+		path = "/" + path
+	}
+	if path == "." || path == "/" || len(path) > betterFilesCollabMaxPathBytes || betterFilesCollabSensitivePath(path) {
+		return "", false
+	}
+	return path, true
+}
+
+func betterFilesCollabSensitivePath(path string) bool {
+	parts := strings.Split(strings.ToLower(strings.Trim(path, "/")), "/")
+	for _, part := range parts {
+		if part == "" {
+			continue
+		}
+		if part == ".env" || strings.HasPrefix(part, ".env.") || part == ".npmrc" || part == "composer.auth.json" {
+			return true
+		}
+		if part == "id_rsa" || part == "id_ed25519" || part == "id_ecdsa" {
+			return true
+		}
+		if strings.HasSuffix(part, ".pem") || strings.HasSuffix(part, ".key") || strings.HasSuffix(part, ".p12") || strings.HasSuffix(part, ".pfx") {
+			return true
+		}
+		if strings.HasPrefix(part, "secret") || strings.HasPrefix(part, "credential") {
+			return true
+		}
+	}
+	return false
+}
+
+func betterFilesCollabClampCursor(value int) int {
+	if value < 1 {
+		return 1
+	}
+	if value > betterFilesCollabMaxCursorValue {
+		return betterFilesCollabMaxCursorValue
+	}
+	return value
+}
+
+func betterFilesCollabSafeImage(value string) string {
+	value = betterFilesCollabSafeText(value, 240)
+	if value == "" {
+		return ""
+	}
+	if strings.HasPrefix(value, "https://") {
+		return value
+	}
+	return ""
+}
+
+func betterFilesCollabSafeText(value string, max int) string {
+	value = strings.TrimSpace(value)
+	if !utf8.ValidString(value) {
+		return ""
+	}
+	if len(value) > max {
+		runes := []rune(value)
+		if len(runes) > max {
+			return string(runes[:max])
+		}
+	}
+	return value
+}
diff --git a/router/websocket/betterfiles_collaboration_ot.go b/router/websocket/betterfiles_collaboration_ot.go
new file mode 100644
index 00000000..b9c6811e
--- /dev/null
+++ b/router/websocket/betterfiles_collaboration_ot.go
@@ -0,0 +1,292 @@
+package websocket
+
+import (
+	"errors"
+	"fmt"
+	"sort"
+	"sync"
+	"unicode/utf16"
+	"unicode/utf8"
+
+	ot "github.com/shiv248/operational-transformation-go"
+)
+
+const betterFilesCollabHistoryLimit = 128
+
+var (
+	errBetterFilesCollabBaseNotFound = errors.New("collaboration patch base is no longer available")
+	errBetterFilesCollabInvalidEdit  = errors.New("invalid collaboration text edit")
+	errBetterFilesCollabTooLarge     = errors.New("collaboration document is too large")
+)
+
+type betterFilesCollabDocument struct {
+	sync.Mutex
+	Content  string
+	Revision int64
+	History  []betterFilesCollabOperation
+}
+
+type betterFilesCollabOperation struct {
+	Revision   int64
+	BaseHash   string
+	BaseLength int
+	TargetHash string
+	TargetLen  int
+	Forward    *ot.OperationSeq
+	Inverse    *ot.OperationSeq
+}
+
+type betterFilesCollabApplyResult struct {
+	Changes     []betterFilesCollabTextEdit
+	Revision    int64
+	Transformed bool
+}
+
+func newBetterFilesCollabDocument(content string) *betterFilesCollabDocument {
+	return &betterFilesCollabDocument{Content: content}
+}
+
+func (d *betterFilesCollabDocument) replace(content string) {
+	d.Lock()
+	d.Content = content
+	d.Revision++
+	d.History = nil
+	d.Unlock()
+}
+
+func (d *betterFilesCollabDocument) snapshot() (string, int64) {
+	d.Lock()
+	defer d.Unlock()
+	return d.Content, d.Revision
+}
+
+func (d *betterFilesCollabDocument) applyMonacoChanges(changes []betterFilesCollabTextEdit, maxBytes int) (betterFilesCollabApplyResult, error) {
+	d.Lock()
+	defer d.Unlock()
+
+	baseRevision, baseContent, err := d.resolveBase(changes)
+	if err != nil {
+		return betterFilesCollabApplyResult{}, err
+	}
+
+	incoming, err := betterFilesCollabChangesToOperation(baseContent, changes)
+	if err != nil {
+		return betterFilesCollabApplyResult{}, err
+	}
+
+	for _, historical := range d.History {
+		if historical.Revision <= baseRevision {
+			continue
+		}
+
+		transformed, _, transformErr := incoming.Transform(historical.Forward)
+		if transformErr != nil {
+			return betterFilesCollabApplyResult{}, fmt.Errorf("transform collaboration patch: %w", transformErr)
+		}
+		incoming = transformed
+	}
+
+	current := d.Content
+	normalized, err := betterFilesCollabOperationToChanges(current, incoming)
+	if err != nil {
+		return betterFilesCollabApplyResult{}, err
+	}
+	next, err := incoming.Apply(current)
+	if err != nil {
+		return betterFilesCollabApplyResult{}, fmt.Errorf("apply collaboration patch: %w", err)
+	}
+	if maxBytes > 0 && len(next) > maxBytes {
+		return betterFilesCollabApplyResult{}, errBetterFilesCollabTooLarge
+	}
+
+	d.Revision++
+	d.History = append(d.History, betterFilesCollabOperation{
+		Revision:   d.Revision,
+		BaseHash:   betterFilesCollabContentHash(current),
+		BaseLength: betterFilesCollabUTF16Len(current),
+		TargetHash: betterFilesCollabContentHash(next),
+		TargetLen:  betterFilesCollabUTF16Len(next),
+		Forward:    incoming,
+		Inverse:    incoming.Invert(current),
+	})
+	if len(d.History) > betterFilesCollabHistoryLimit {
+		d.History = append([]betterFilesCollabOperation(nil), d.History[len(d.History)-betterFilesCollabHistoryLimit:]...)
+	}
+	d.Content = next
+
+	return betterFilesCollabApplyResult{
+		Changes:     normalized,
+		Revision:    d.Revision,
+		Transformed: baseRevision != d.Revision-1,
+	}, nil
+}
+
+func (d *betterFilesCollabDocument) resolveBase(changes []betterFilesCollabTextEdit) (int64, string, error) {
+	if len(changes) == 0 {
+		return 0, "", errBetterFilesCollabInvalidEdit
+	}
+
+	baseHash := changes[0].BaseHash
+	baseLength := changes[0].BaseLength
+	for _, change := range changes[1:] {
+		if change.BaseHash != baseHash || change.BaseLength != baseLength {
+			return 0, "", errBetterFilesCollabInvalidEdit
+		}
+	}
+
+	// Older clients omit the base fingerprint for larger files. Those edits can
+	// only be applied to the current revision because a stale base is ambiguous.
+	if baseHash == "" {
+		return d.Revision, d.Content, nil
+	}
+	if baseLength < 0 {
+		return 0, "", errBetterFilesCollabInvalidEdit
+	}
+	if betterFilesCollabContentHash(d.Content) == baseHash && betterFilesCollabUTF16Len(d.Content) == baseLength {
+		return d.Revision, d.Content, nil
+	}
+
+	baseRevision := int64(-1)
+	for _, historical := range d.History {
+		if historical.BaseHash == baseHash && historical.BaseLength == baseLength {
+			baseRevision = historical.Revision - 1
+			break
+		}
+		if historical.TargetHash == baseHash && historical.TargetLen == baseLength {
+			baseRevision = historical.Revision
+			break
+		}
+	}
+	if baseRevision < 0 {
+		return 0, "", errBetterFilesCollabBaseNotFound
+	}
+
+	baseContent := d.Content
+	for i := len(d.History) - 1; i >= 0 && d.History[i].Revision > baseRevision; i-- {
+		var err error
+		baseContent, err = d.History[i].Inverse.Apply(baseContent)
+		if err != nil {
+			return 0, "", fmt.Errorf("reconstruct collaboration patch base: %w", err)
+		}
+	}
+	if betterFilesCollabContentHash(baseContent) != baseHash || betterFilesCollabUTF16Len(baseContent) != baseLength {
+		return 0, "", errBetterFilesCollabBaseNotFound
+	}
+
+	return baseRevision, baseContent, nil
+}
+
+func betterFilesCollabChangesToOperation(content string, changes []betterFilesCollabTextEdit) (*ot.OperationSeq, error) {
+	if !utf8.ValidString(content) || len(changes) == 0 {
+		return nil, errBetterFilesCollabInvalidEdit
+	}
+
+	sorted := append([]betterFilesCollabTextEdit(nil), changes...)
+	sort.SliceStable(sorted, func(i, j int) bool {
+		return sorted[i].RangeOffset < sorted[j].RangeOffset
+	})
+
+	runes := []rune(content)
+	prefix := betterFilesCollabUTF16Prefix(runes)
+	op := ot.WithCapacity(len(sorted)*3 + 1)
+	cursor := 0
+	for _, change := range sorted {
+		if change.RangeOffset < 0 || change.RangeLength < 0 || !utf8.ValidString(change.Text) {
+			return nil, errBetterFilesCollabInvalidEdit
+		}
+		start, ok := betterFilesCollabRuneOffset(prefix, change.RangeOffset)
+		if !ok {
+			return nil, errBetterFilesCollabInvalidEdit
+		}
+		end, ok := betterFilesCollabRuneOffset(prefix, change.RangeOffset+change.RangeLength)
+		if !ok || start < cursor || end < start {
+			return nil, errBetterFilesCollabInvalidEdit
+		}
+
+		op.Retain(uint64(start - cursor))
+		op.Delete(uint64(end - start))
+		op.Insert(change.Text)
+		cursor = end
+	}
+	op.Retain(uint64(len(runes) - cursor))
+	return op, nil
+}
+
+func betterFilesCollabOperationToChanges(content string, operation *ot.OperationSeq) ([]betterFilesCollabTextEdit, error) {
+	if operation == nil || operation.BaseLen() != utf8.RuneCountInString(content) {
+		return nil, errBetterFilesCollabInvalidEdit
+	}
+
+	runes := []rune(content)
+	prefix := betterFilesCollabUTF16Prefix(runes)
+	baseHash := betterFilesCollabContentHash(content)
+	baseLength := prefix[len(prefix)-1]
+	changes := make([]betterFilesCollabTextEdit, 0, len(operation.Ops()))
+	sourceRune := 0
+	var pending *betterFilesCollabTextEdit
+	flush := func() {
+		if pending != nil && (pending.RangeLength != 0 || pending.Text != "") {
+			changes = append(changes, *pending)
+		}
+		pending = nil
+	}
+
+	for _, raw := range operation.Ops() {
+		switch value := raw.(type) {
+		case ot.Retain:
+			flush()
+			sourceRune += int(value.N)
+		case ot.Insert:
+			if pending == nil {
+				pending = &betterFilesCollabTextEdit{RangeOffset: prefix[sourceRune], BaseHash: baseHash, BaseLength: baseLength}
+			}
+			pending.Text += value.Text
+		case ot.Delete:
+			end := sourceRune + int(value.N)
+			if end > len(runes) {
+				return nil, errBetterFilesCollabInvalidEdit
+			}
+			if pending == nil {
+				pending = &betterFilesCollabTextEdit{RangeOffset: prefix[sourceRune], BaseHash: baseHash, BaseLength: baseLength}
+			}
+			pending.RangeLength += prefix[end] - prefix[sourceRune]
+			sourceRune = end
+		default:
+			return nil, errBetterFilesCollabInvalidEdit
+		}
+	}
+	flush()
+	if sourceRune != len(runes) {
+		return nil, errBetterFilesCollabInvalidEdit
+	}
+	return changes, nil
+}
+
+func betterFilesCollabUTF16Prefix(runes []rune) []int {
+	prefix := make([]int, len(runes)+1)
+	for i, value := range runes {
+		prefix[i+1] = prefix[i] + 1
+		if value > 0xffff {
+			prefix[i+1]++
+		}
+	}
+	return prefix
+}
+
+func betterFilesCollabRuneOffset(prefix []int, utf16Offset int) (int, bool) {
+	index := sort.SearchInts(prefix, utf16Offset)
+	return index, index < len(prefix) && prefix[index] == utf16Offset
+}
+
+func betterFilesCollabUTF16Len(content string) int {
+	return len(utf16.Encode([]rune(content)))
+}
+
+// betterFilesCollabContentHash matches the panel's JavaScript charCodeAt hash.
+func betterFilesCollabContentHash(content string) string {
+	var hash uint32
+	for _, unit := range utf16.Encode([]rune(content)) {
+		hash = hash*31 + uint32(unit)
+	}
+	return fmt.Sprintf("%08x", hash)
+}
diff --git a/router/websocket/betterfiles_collaboration_ot_test.go b/router/websocket/betterfiles_collaboration_ot_test.go
new file mode 100644
index 00000000..461c1ca9
--- /dev/null
+++ b/router/websocket/betterfiles_collaboration_ot_test.go
@@ -0,0 +1,128 @@
+package websocket
+
+import (
+	"errors"
+	"fmt"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func betterFilesTestEdit(base string, offset int, length int, text string) betterFilesCollabTextEdit {
+	return betterFilesCollabTextEdit{
+		RangeOffset: offset,
+		RangeLength: length,
+		Text:        text,
+		BaseHash:    betterFilesCollabContentHash(base),
+		BaseLength:  betterFilesCollabUTF16Len(base),
+	}
+}
+
+func betterFilesTestContent(document *betterFilesCollabDocument) string {
+	content, _ := document.snapshot()
+	return content
+}
+
+func TestBetterFilesCollabAppliesMonacoReplacement(t *testing.T) {
+	document := newBetterFilesCollabDocument("first line\nold line\nlast line")
+	result, err := document.applyMonacoChanges([]betterFilesCollabTextEdit{
+		betterFilesTestEdit(document.Content, 11, 8, "new line"),
+	}, 0)
+
+	require.NoError(t, err)
+	require.Equal(t, "first line\nnew line\nlast line", betterFilesTestContent(document))
+	require.False(t, result.Transformed)
+	require.Equal(t, int64(1), result.Revision)
+	require.Equal(t, []betterFilesCollabTextEdit{{
+		RangeOffset: 11,
+		RangeLength: 8,
+		Text:        "new line",
+		BaseHash:    betterFilesCollabContentHash("first line\nold line\nlast line"),
+		BaseLength:  betterFilesCollabUTF16Len("first line\nold line\nlast line"),
+	}}, result.Changes)
+}
+
+func TestBetterFilesCollabTransformsConcurrentInserts(t *testing.T) {
+	const base = "ab"
+	document := newBetterFilesCollabDocument(base)
+
+	_, err := document.applyMonacoChanges([]betterFilesCollabTextEdit{betterFilesTestEdit(base, 1, 0, "X")}, 0)
+	require.NoError(t, err)
+	require.Equal(t, "aXb", betterFilesTestContent(document))
+
+	second, err := document.applyMonacoChanges([]betterFilesCollabTextEdit{betterFilesTestEdit(base, 1, 0, "Y")}, 0)
+	require.NoError(t, err)
+	require.True(t, second.Transformed)
+	require.Equal(t, "aXYb", betterFilesTestContent(document))
+	require.Equal(t, 2, second.Changes[0].RangeOffset)
+	require.Equal(t, betterFilesCollabContentHash("aXb"), second.Changes[0].BaseHash)
+}
+
+func TestBetterFilesCollabTransformsStaleEditAcrossSeveralRevisions(t *testing.T) {
+	const base = "hello world"
+	document := newBetterFilesCollabDocument(base)
+
+	_, err := document.applyMonacoChanges([]betterFilesCollabTextEdit{betterFilesTestEdit(base, 0, 0, "A ")}, 0)
+	require.NoError(t, err)
+	current := document.Content
+	_, err = document.applyMonacoChanges([]betterFilesCollabTextEdit{betterFilesTestEdit(current, betterFilesCollabUTF16Len(current), 0, "!")}, 0)
+	require.NoError(t, err)
+
+	result, err := document.applyMonacoChanges([]betterFilesCollabTextEdit{betterFilesTestEdit(base, 6, 5, "Wings")}, 0)
+	require.NoError(t, err)
+	require.True(t, result.Transformed)
+	require.Equal(t, "A hello Wings!", betterFilesTestContent(document))
+}
+
+func TestBetterFilesCollabConvertsMonacoUTF16Offsets(t *testing.T) {
+	const base = "a😀b"
+	document := newBetterFilesCollabDocument(base)
+
+	_, err := document.applyMonacoChanges([]betterFilesCollabTextEdit{betterFilesTestEdit(base, 3, 1, "c")}, 0)
+	require.NoError(t, err)
+	require.Equal(t, "a😀c", betterFilesTestContent(document))
+
+	document = newBetterFilesCollabDocument(base)
+	_, err = document.applyMonacoChanges([]betterFilesCollabTextEdit{betterFilesTestEdit(base, 2, 0, "x")}, 0)
+	require.ErrorIs(t, err, errBetterFilesCollabInvalidEdit)
+}
+
+func TestBetterFilesCollabRejectsOverlappingChanges(t *testing.T) {
+	const base = "abcdef"
+	document := newBetterFilesCollabDocument(base)
+
+	_, err := document.applyMonacoChanges([]betterFilesCollabTextEdit{
+		betterFilesTestEdit(base, 1, 3, "x"),
+		betterFilesTestEdit(base, 2, 1, "y"),
+	}, 0)
+	require.ErrorIs(t, err, errBetterFilesCollabInvalidEdit)
+}
+
+func TestBetterFilesCollabRejectsExpiredPatchBase(t *testing.T) {
+	const base = "x"
+	document := newBetterFilesCollabDocument(base)
+
+	for i := 0; i < betterFilesCollabHistoryLimit+1; i++ {
+		current := document.Content
+		_, err := document.applyMonacoChanges([]betterFilesCollabTextEdit{
+			betterFilesTestEdit(current, betterFilesCollabUTF16Len(current), 0, fmt.Sprint(i%10)),
+		}, 0)
+		require.NoError(t, err)
+	}
+
+	_, err := document.applyMonacoChanges([]betterFilesCollabTextEdit{betterFilesTestEdit(base, 0, 1, "y")}, 0)
+	require.True(t, errors.Is(err, errBetterFilesCollabBaseNotFound), "unexpected error: %v", err)
+}
+
+func TestBetterFilesCollabReplaceResetsOperationHistory(t *testing.T) {
+	document := newBetterFilesCollabDocument("before")
+	_, err := document.applyMonacoChanges([]betterFilesCollabTextEdit{betterFilesTestEdit("before", 0, 0, "x")}, 0)
+	require.NoError(t, err)
+	require.NotEmpty(t, document.History)
+
+	document.replace("saved")
+	content, revision := document.snapshot()
+	require.Equal(t, "saved", content)
+	require.Equal(t, int64(2), revision)
+	require.Empty(t, document.History)
+}
diff --git a/router/websocket/file_collaboration_yjs.go b/router/websocket/file_collaboration_yjs.go
new file mode 100644
index 00000000..622fd79c
--- /dev/null
+++ b/router/websocket/file_collaboration_yjs.go
@@ -0,0 +1,611 @@
+package websocket
+
+import (
+	"bytes"
+	"context"
+	"crypto/sha256"
+	"encoding/base64"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"strings"
+	"sync"
+	"time"
+	"unicode/utf8"
+
+	"github.com/pterodactyl/wings/config"
+	"github.com/pterodactyl/wings/server"
+	"github.com/reearth/ygo/crdt"
+)
+
+const (
+	// NativeFileCollaborationEnabled is consumed by the authenticated system
+	// capability endpoint. Keep it coupled to this implementation so the daemon
+	// does not advertise a transport that was omitted from the build.
+	NativeFileCollaborationEnabled = true
+
+	FileCollabSubscribeEvent   = Event("file collab subscribe")
+	FileCollabUnsubscribeEvent = Event("file collab unsubscribe")
+	FileCollabUpdateEvent      = Event("file collab update")
+	FileCollabAwarenessEvent   = Event("file collab awareness")
+	FileCollabSaveEvent        = Event("file collab save")
+
+	fileCollabSyncEvent         = Event("file collab sync")
+	fileCollabParticipantsEvent = Event("file collab participants")
+	fileCollabSavedEvent        = Event("file collab saved")
+	fileCollabErrorEvent        = Event("file collab error")
+
+	fileCollabMaxAwarenessBytes    = 16 * 1024
+	fileCollabMaxSessionsPerServer = 32
+	fileCollabMaxSessionsPerSocket = 32
+	fileCollabSessionGracePeriod   = 30 * time.Second
+	fileCollabDefaultFileSizeCap   = 10 * 1024 * 1024
+	fileCollabMinimumFileSizeCap   = 1 * 1024 * 1024
+	fileCollabMaximumFileSizeCap   = 64 * 1024 * 1024
+)
+
+func NativeFileCollaborationFileSizeCap() int {
+	return normalizeNativeFileCollaborationFileSizeCap(config.Get().System.FileCollaboration.FileSizeCap)
+}
+
+func NativeFileCollaborationConfigured() bool {
+	return NativeFileCollaborationEnabled && config.Get().System.FileCollaboration.Enabled
+}
+
+func normalizeNativeFileCollaborationFileSizeCap(configured uint64) int {
+	if configured == 0 {
+		return fileCollabDefaultFileSizeCap
+	}
+	// Older panel settings commonly express this value as whole MiB. Preserve
+	// that intent instead of interpreting values such as 1 as one byte.
+	if configured <= 64 {
+		configured *= 1024 * 1024
+	}
+	if configured < fileCollabMinimumFileSizeCap {
+		return fileCollabMinimumFileSizeCap
+	}
+	if configured > fileCollabMaximumFileSizeCap {
+		return fileCollabMaximumFileSizeCap
+	}
+	return int(configured)
+}
+
+var (
+	errFileCollabInvalidRequest = errors.New("invalid collaborative editing request")
+	errFileCollabNotSubscribed  = errors.New("not subscribed to this file")
+	errFileCollabTooLarge       = errors.New("file is too large for collaborative editing")
+)
+
+type nativeFileCollabParticipant struct {
+	User   string  `json:"user"`
+	Name   string  `json:"name"`
+	Avatar *string `json:"avatar"`
+}
+
+type nativeFileCollabMember struct {
+	handler *Handler
+	user    nativeFileCollabParticipant
+	pending []byte
+}
+
+type nativeFileCollabSession struct {
+	mu sync.Mutex
+
+	serverUUID         string
+	path               string
+	doc                *crdt.Doc
+	text               *crdt.YText
+	dirty              bool
+	diskHash           [sha256.Size]byte
+	appliedUpdateBytes int64
+	members            map[string]*nativeFileCollabMember
+	teardownGeneration uint64
+	saveMu             sync.Mutex
+}
+
+type nativeFileCollabSyncMeta struct {
+	Dirty bool `json:"dirty"`
+}
+
+type nativeFileCollabSaved struct {
+	User       string `json:"user"`
+	RevisionID *int64 `json:"revision_id"`
+}
+
+var nativeFileCollabRegistry = struct {
+	sync.Mutex
+	sessions map[string]*nativeFileCollabSession
+}{sessions: map[string]*nativeFileCollabSession{}}
+
+// IsNativeFileCollaborationEvent reports whether an event belongs to the
+// Wings-rs-compatible Yjs collaboration protocol.
+func IsNativeFileCollaborationEvent(event Event) bool {
+	switch event {
+	case FileCollabSubscribeEvent, FileCollabUnsubscribeEvent, FileCollabUpdateEvent, FileCollabAwarenessEvent, FileCollabSaveEvent:
+		return true
+	default:
+		return false
+	}
+}
+
+// HandleNativeFileCollaboration implements the native Wings-rs collaboration
+// wire protocol using Yjs V1 updates. It intentionally remains separate from
+// the legacy Better Files OT protocol while clients migrate.
+func (h *Handler) HandleNativeFileCollaboration(ctx context.Context, message Message) (bool, error) {
+	switch message.Event {
+	case FileCollabSubscribeEvent, FileCollabUnsubscribeEvent, FileCollabUpdateEvent, FileCollabAwarenessEvent, FileCollabSaveEvent:
+	default:
+		return false, nil
+	}
+	if !NativeFileCollaborationConfigured() {
+		return true, h.nativeFileCollabError("", "collaborative editing is disabled")
+	}
+
+	h.fileCollabCleanup.Do(func() {
+		go func() {
+			<-ctx.Done()
+			nativeFileCollabDisconnect(h)
+		}()
+	})
+
+	if !nativeFileCollabValidArgs(message) {
+		errorPath := ""
+		if len(message.Args) > 0 {
+			errorPath = message.Args[0]
+			if normalized, ok := betterFilesCollabPath(errorPath); ok {
+				errorPath = normalized
+			}
+		}
+		return true, h.nativeFileCollabError(errorPath, errFileCollabInvalidRequest.Error())
+	}
+	path, ok := betterFilesCollabPath(message.Args[0])
+	if !ok {
+		return true, h.nativeFileCollabError(message.Args[0], "file not found")
+	}
+
+	requiredPermission := betterFilesCollabReadPermission
+	if message.Event == FileCollabUpdateEvent || message.Event == FileCollabSaveEvent {
+		requiredPermission = betterFilesCollabWritePermission
+	}
+	jwt := h.GetJwt()
+	if jwt == nil || !jwt.HasPermission(requiredPermission) {
+		return true, h.nativeFileCollabError(path, "missing permission")
+	}
+
+	var err error
+	switch message.Event {
+	case FileCollabSubscribeEvent:
+		err = nativeFileCollabSubscribe(h, path)
+	case FileCollabUnsubscribeEvent:
+		err = nativeFileCollabUnsubscribe(h, path)
+	case FileCollabUpdateEvent:
+		err = nativeFileCollabApplyUpdate(h, path, message.Args[1] == "1", message.Args[2])
+	case FileCollabAwarenessEvent:
+		err = nativeFileCollabRelayAwareness(h, path, message.Args[1])
+	case FileCollabSaveEvent:
+		err = nativeFileCollabSave(h, path)
+	}
+	if err != nil {
+		return true, h.nativeFileCollabError(path, err.Error())
+	}
+	return true, nil
+}
+
+func nativeFileCollabValidArgs(message Message) bool {
+	switch message.Event {
+	case FileCollabSubscribeEvent, FileCollabUnsubscribeEvent, FileCollabSaveEvent:
+		return len(message.Args) == 1
+	case FileCollabUpdateEvent:
+		return len(message.Args) == 3 && (message.Args[1] == "0" || message.Args[1] == "1") && message.Args[2] != ""
+	case FileCollabAwarenessEvent:
+		return len(message.Args) == 2 && message.Args[1] != ""
+	default:
+		return false
+	}
+}
+
+func (h *Handler) nativeFileCollabError(path string, message string) error {
+	return h.SendJson(Message{Event: fileCollabErrorEvent, Args: []string{path, message}})
+}
+
+func nativeFileCollabSubscribe(h *Handler, path string) error {
+	key := nativeFileCollabKey(h.server.ID(), path)
+	if nativeFileCollabSubscriptionCount(h) >= fileCollabMaxSessionsPerSocket {
+		nativeFileCollabRegistry.Lock()
+		existing := nativeFileCollabRegistry.sessions[key]
+		nativeFileCollabRegistry.Unlock()
+		if existing == nil || !nativeFileCollabHasMember(existing, h) {
+			return errors.New("too many collaborative sessions open on this connection")
+		}
+	}
+
+	content, err := nativeFileCollabReadFile(h, path)
+	if err != nil {
+		return err
+	}
+
+	nativeFileCollabRegistry.Lock()
+	session := nativeFileCollabRegistry.sessions[key]
+	if session == nil {
+		count := 0
+		for _, existing := range nativeFileCollabRegistry.sessions {
+			if existing.serverUUID == h.server.ID() {
+				count++
+			}
+		}
+		if count >= fileCollabMaxSessionsPerServer {
+			nativeFileCollabRegistry.Unlock()
+			return errors.New("too many collaborative sessions open on this server")
+		}
+		session = nativeFileCollabNewSession(h.server.ID(), path, content)
+		nativeFileCollabRegistry.sessions[key] = session
+	}
+	nativeFileCollabRegistry.Unlock()
+
+	jwt := h.GetJwt()
+	name := strings.TrimSpace(jwt.UserName)
+	if name == "" {
+		name = jwt.UserUUID
+	}
+	name = betterFilesCollabSafeText(name, 80)
+	avatar := nativeFileCollabSafeAvatar(jwt.UserAvatar)
+
+	session.mu.Lock()
+	session.teardownGeneration++
+	if !session.dirty && session.diskHash != sha256.Sum256([]byte(content)) {
+		session.resetDocument(content)
+	}
+	session.members[h.Uuid().String()] = &nativeFileCollabMember{
+		handler: h,
+		user: nativeFileCollabParticipant{
+			User:   jwt.UserUUID,
+			Name:   name,
+			Avatar: avatar,
+		},
+	}
+	state := session.doc.EncodeStateAsUpdate()
+	dirty := session.dirty
+	session.mu.Unlock()
+
+	meta, _ := json.Marshal(nativeFileCollabSyncMeta{Dirty: dirty})
+	if err := h.SendJson(Message{Event: fileCollabSyncEvent, Args: []string{
+		path,
+		base64.StdEncoding.EncodeToString(state),
+		string(meta),
+	}}); err != nil {
+		return err
+	}
+	nativeFileCollabBroadcastParticipants(session)
+	return nil
+}
+
+func nativeFileCollabApplyUpdate(h *Handler, path string, finished bool, encoded string) error {
+	session, member := nativeFileCollabSubscribedSession(h, path)
+	if session == nil || member == nil {
+		return errFileCollabNotSubscribed
+	}
+	chunk, err := base64.StdEncoding.DecodeString(encoded)
+	if err != nil {
+		return errors.New("invalid update encoding")
+	}
+
+	session.mu.Lock()
+	member = session.members[h.Uuid().String()]
+	if member == nil {
+		session.mu.Unlock()
+		return errFileCollabNotSubscribed
+	}
+	if len(member.pending)+len(chunk) > NativeFileCollaborationFileSizeCap() {
+		member.pending = nil
+		session.mu.Unlock()
+		return errors.New("update is too large")
+	}
+	member.pending = append(member.pending, chunk...)
+	if !finished {
+		session.mu.Unlock()
+		return nil
+	}
+	update := append([]byte(nil), member.pending...)
+	member.pending = nil
+	if len(update) == 0 {
+		session.mu.Unlock()
+		return errFileCollabInvalidRequest
+	}
+	session.mu.Unlock()
+	needsResync, err := session.applyUpdate(update, h.Uuid().String())
+	if err != nil {
+		return err
+	}
+
+	if needsResync {
+		nativeFileCollabBroadcast(session, "", Message{Event: fileCollabErrorEvent, Args: []string{path, "resync"}})
+		return nil
+	}
+	nativeFileCollabBroadcast(session, h.Uuid().String(), Message{Event: FileCollabUpdateEvent, Args: []string{
+		path,
+		base64.StdEncoding.EncodeToString(update),
+	}})
+	return nil
+}
+
+func nativeFileCollabRelayAwareness(h *Handler, path string, payload string) error {
+	session, member := nativeFileCollabSubscribedSession(h, path)
+	if session == nil || member == nil {
+		return errFileCollabNotSubscribed
+	}
+	decoded, err := base64.StdEncoding.DecodeString(payload)
+	if err != nil || len(decoded) > fileCollabMaxAwarenessBytes {
+		return errors.New("invalid awareness update")
+	}
+	nativeFileCollabBroadcast(session, h.Uuid().String(), Message{Event: FileCollabAwarenessEvent, Args: []string{path, payload}})
+	return nil
+}
+
+func nativeFileCollabSave(h *Handler, path string) error {
+	session, member := nativeFileCollabSubscribedSession(h, path)
+	if session == nil || member == nil {
+		return errFileCollabNotSubscribed
+	}
+	session.saveMu.Lock()
+	defer session.saveMu.Unlock()
+
+	session.mu.Lock()
+	content := session.text.ToString()
+	session.mu.Unlock()
+
+	before, err := nativeFileCollabReadFile(h, path)
+	if err != nil {
+		return err
+	}
+	if err := h.server.Filesystem().Write(path, bytes.NewReader([]byte(content)), int64(len(content)), 0o644); err != nil {
+		return fmt.Errorf("failed to write file: %w", err)
+	}
+
+	var revisionID *int64
+	if server.ShouldRecordFileHistory(path, uint64(len(content))) {
+		id, revisionErr := h.server.RecordFileRevision(path, []byte(before), []byte(content), member.user.User)
+		if revisionErr != nil {
+			h.server.Log().WithError(revisionErr).WithField("path", path).Warn("failed to record collaborative file revision")
+		} else if id > 0 {
+			revisionID = &id
+		}
+	}
+
+	session.mu.Lock()
+	session.diskHash = sha256.Sum256([]byte(content))
+	session.dirty = session.text.ToString() != content
+	session.mu.Unlock()
+
+	payload, _ := json.Marshal(nativeFileCollabSaved{User: member.user.User, RevisionID: revisionID})
+	nativeFileCollabBroadcast(session, "", Message{Event: fileCollabSavedEvent, Args: []string{path, string(payload)}})
+	return nil
+}
+
+func nativeFileCollabUnsubscribe(h *Handler, path string) error {
+	key := nativeFileCollabKey(h.server.ID(), path)
+	nativeFileCollabRegistry.Lock()
+	session := nativeFileCollabRegistry.sessions[key]
+	nativeFileCollabRegistry.Unlock()
+	if session == nil {
+		return nil
+	}
+	nativeFileCollabRemoveMember(session, h.Uuid().String())
+	return nil
+}
+
+func nativeFileCollabDisconnect(h *Handler) {
+	nativeFileCollabRegistry.Lock()
+	sessions := make([]*nativeFileCollabSession, 0)
+	for _, session := range nativeFileCollabRegistry.sessions {
+		if session.serverUUID == h.server.ID() {
+			sessions = append(sessions, session)
+		}
+	}
+	nativeFileCollabRegistry.Unlock()
+	for _, session := range sessions {
+		nativeFileCollabRemoveMember(session, h.Uuid().String())
+	}
+}
+
+func nativeFileCollabRemoveMember(session *nativeFileCollabSession, handlerID string) {
+	session.mu.Lock()
+	if session.members[handlerID] == nil {
+		session.mu.Unlock()
+		return
+	}
+	delete(session.members, handlerID)
+	empty := len(session.members) == 0
+	session.teardownGeneration++
+	generation := session.teardownGeneration
+	session.mu.Unlock()
+
+	if !empty {
+		nativeFileCollabBroadcastParticipants(session)
+		return
+	}
+	time.AfterFunc(fileCollabSessionGracePeriod, func() {
+		key := nativeFileCollabKey(session.serverUUID, session.path)
+		nativeFileCollabRegistry.Lock()
+		session.mu.Lock()
+		remove := len(session.members) == 0 && session.teardownGeneration == generation && nativeFileCollabRegistry.sessions[key] == session
+		if remove {
+			delete(nativeFileCollabRegistry.sessions, key)
+			session.doc.Destroy()
+		}
+		session.mu.Unlock()
+		nativeFileCollabRegistry.Unlock()
+	})
+}
+
+func nativeFileCollabSubscribedSession(h *Handler, path string) (*nativeFileCollabSession, *nativeFileCollabMember) {
+	key := nativeFileCollabKey(h.server.ID(), path)
+	nativeFileCollabRegistry.Lock()
+	session := nativeFileCollabRegistry.sessions[key]
+	nativeFileCollabRegistry.Unlock()
+	if session == nil {
+		return nil, nil
+	}
+	session.mu.Lock()
+	member := session.members[h.Uuid().String()]
+	session.mu.Unlock()
+	return session, member
+}
+
+func nativeFileCollabSubscriptionCount(h *Handler) int {
+	nativeFileCollabRegistry.Lock()
+	sessions := make([]*nativeFileCollabSession, 0, len(nativeFileCollabRegistry.sessions))
+	for _, session := range nativeFileCollabRegistry.sessions {
+		if session.serverUUID == h.server.ID() {
+			sessions = append(sessions, session)
+		}
+	}
+	nativeFileCollabRegistry.Unlock()
+	count := 0
+	for _, session := range sessions {
+		if nativeFileCollabHasMember(session, h) {
+			count++
+		}
+	}
+	return count
+}
+
+func nativeFileCollabHasMember(session *nativeFileCollabSession, h *Handler) bool {
+	session.mu.Lock()
+	defer session.mu.Unlock()
+	return session.members[h.Uuid().String()] != nil
+}
+
+func nativeFileCollabBroadcastParticipants(session *nativeFileCollabSession) {
+	session.mu.Lock()
+	participants := make([]nativeFileCollabParticipant, 0, len(session.members))
+	seen := map[string]struct{}{}
+	for _, member := range session.members {
+		if _, ok := seen[member.user.User]; ok {
+			continue
+		}
+		seen[member.user.User] = struct{}{}
+		participants = append(participants, member.user)
+	}
+	session.mu.Unlock()
+	payload, _ := json.Marshal(participants)
+	nativeFileCollabBroadcast(session, "", Message{Event: fileCollabParticipantsEvent, Args: []string{session.path, string(payload)}})
+}
+
+func nativeFileCollabBroadcast(session *nativeFileCollabSession, exceptHandlerID string, message Message) {
+	session.mu.Lock()
+	handlers := make([]*Handler, 0, len(session.members))
+	for id, member := range session.members {
+		if id != exceptHandlerID {
+			handlers = append(handlers, member.handler)
+		}
+	}
+	session.mu.Unlock()
+	for _, handler := range handlers {
+		_ = handler.SendJson(message)
+	}
+}
+
+func nativeFileCollabReadFile(h *Handler, path string) (string, error) {
+	fileSizeCap := NativeFileCollaborationFileSizeCap()
+	if err := h.server.Filesystem().IsIgnored(path); err != nil {
+		return "", errors.New("file not found")
+	}
+	file, stat, err := h.server.Filesystem().File(path)
+	if err != nil {
+		return "", errors.New("file not found")
+	}
+	defer file.Close()
+	if stat.IsDir() {
+		return "", errors.New("file is not a file")
+	}
+	if stat.Size() > int64(fileSizeCap) {
+		return "", errFileCollabTooLarge
+	}
+	content, err := io.ReadAll(io.LimitReader(file, int64(fileSizeCap)+1))
+	if err != nil {
+		return "", errors.New("file not found")
+	}
+	if len(content) > fileSizeCap {
+		return "", errFileCollabTooLarge
+	}
+	if !utf8.Valid(content) {
+		return "", errors.New("file is not editable as text")
+	}
+	return string(content), nil
+}
+
+func nativeFileCollabNewSession(serverUUID string, path string, content string) *nativeFileCollabSession {
+	session := &nativeFileCollabSession{
+		serverUUID: serverUUID,
+		path:       path,
+		members:    map[string]*nativeFileCollabMember{},
+	}
+	session.resetDocument(content)
+	return session
+}
+
+func (session *nativeFileCollabSession) resetDocument(content string) {
+	if session.doc != nil {
+		session.doc.Destroy()
+	}
+	doc := crdt.New()
+	text := doc.GetText("content")
+	if content != "" {
+		doc.Transact(func(transaction *crdt.Transaction) {
+			text.Insert(transaction, 0, content, nil)
+		})
+	}
+	session.doc = doc
+	session.text = text
+	session.diskHash = sha256.Sum256([]byte(content))
+	session.appliedUpdateBytes = 0
+}
+
+func (session *nativeFileCollabSession) applyUpdate(update []byte, origin any) (bool, error) {
+	session.mu.Lock()
+	defer session.mu.Unlock()
+	if err := crdt.ApplyUpdateV1(session.doc, update, origin); err != nil {
+		return false, errors.New("invalid update")
+	}
+	content := session.text.ToString()
+	session.dirty = true
+	session.appliedUpdateBytes += int64(len(update))
+	fileSizeCap := NativeFileCollaborationFileSizeCap()
+	needsResync := len(content) > fileSizeCap || session.appliedUpdateBytes > int64(fileSizeCap)*8
+	if !needsResync {
+		return false, nil
+	}
+	if len(content) > fileSizeCap {
+		content = nativeFileCollabTruncateUTF8(content, fileSizeCap)
+	}
+	session.resetDocument(content)
+	session.dirty = true
+	return true, nil
+}
+
+func nativeFileCollabKey(serverUUID string, path string) string {
+	return serverUUID + "\x00" + path
+}
+
+func nativeFileCollabSafeAvatar(avatar *string) *string {
+	if avatar == nil {
+		return nil
+	}
+	value := betterFilesCollabSafeImage(*avatar)
+	if value == "" {
+		return nil
+	}
+	return &value
+}
+
+func nativeFileCollabTruncateUTF8(content string, maxBytes int) string {
+	if len(content) <= maxBytes {
+		return content
+	}
+	content = content[:maxBytes]
+	for !utf8.ValidString(content) {
+		content = content[:len(content)-1]
+	}
+	return content
+}
diff --git a/router/websocket/file_collaboration_yjs_test.go b/router/websocket/file_collaboration_yjs_test.go
new file mode 100644
index 00000000..b370dd18
--- /dev/null
+++ b/router/websocket/file_collaboration_yjs_test.go
@@ -0,0 +1,339 @@
+package websocket
+
+import (
+	"context"
+	"encoding/base64"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+	"os"
+	"path/filepath"
+	"testing"
+	"time"
+
+	"github.com/gbrlsnchs/jwt/v3"
+	"github.com/google/uuid"
+	gws "github.com/gorilla/websocket"
+	"github.com/pterodactyl/wings/config"
+	"github.com/pterodactyl/wings/remote"
+	"github.com/pterodactyl/wings/router/tokens"
+	"github.com/pterodactyl/wings/server"
+	"github.com/reearth/ygo/crdt"
+	"github.com/stretchr/testify/require"
+)
+
+// Generated by yjs@13.6.30 using Y.encodeStateAsUpdate on Y.Text("content").
+const nativeFileCollabYjsFixture = "AQHZqLZjAAQBB2NvbnRlbnQWYnJvd3NlciDwn5iACnNlbGVjdGlvbgA="
+
+func nativeFileCollabTestPeer(t *testing.T, state []byte) (*crdt.Doc, *crdt.YText) {
+	t.Helper()
+	doc := crdt.New()
+	text := doc.GetText("content")
+	require.NoError(t, crdt.ApplyUpdateV1(doc, state, "test-sync"))
+	return doc, text
+}
+
+func nativeFileCollabTestInsert(t *testing.T, doc *crdt.Doc, text *crdt.YText, stateVector crdt.StateVector, index int, value string) []byte {
+	t.Helper()
+	doc.Transact(func(transaction *crdt.Transaction) {
+		text.Insert(transaction, index, value, nil)
+	})
+	return crdt.EncodeStateAsUpdateV1(doc, stateVector)
+}
+
+func TestNativeFileCollabUsesWingsRsWireEvents(t *testing.T) {
+	require.True(t, NativeFileCollaborationEnabled)
+	require.True(t, IsNativeFileCollaborationEvent(FileCollabSubscribeEvent))
+	require.True(t, IsNativeFileCollaborationEvent(FileCollabUpdateEvent))
+	require.True(t, IsNativeFileCollaborationEvent(FileCollabAwarenessEvent))
+	require.False(t, IsNativeFileCollaborationEvent(fileCollabSyncEvent))
+	require.False(t, IsNativeFileCollaborationEvent(BetterFilesCollabPatchEvent))
+	require.True(t, IsFileCollaborationEvent(FileCollabUpdateEvent))
+	require.True(t, IsFileCollaborationEvent(BetterFilesCollabPatchEvent))
+	require.False(t, IsFileCollaborationEvent(SendCommandEvent))
+}
+
+func TestNativeFileCollaborationFileSizeCap(t *testing.T) {
+	require.Equal(t, 10*1024*1024, normalizeNativeFileCollaborationFileSizeCap(0))
+	require.Equal(t, 1*1024*1024, normalizeNativeFileCollaborationFileSizeCap(1))
+	require.Equal(t, 8*1024*1024, normalizeNativeFileCollaborationFileSizeCap(8))
+	require.Equal(t, 1*1024*1024, normalizeNativeFileCollaborationFileSizeCap(1024))
+	require.Equal(t, 12*1024*1024, normalizeNativeFileCollaborationFileSizeCap(12*1024*1024))
+	require.Equal(t, 64*1024*1024, normalizeNativeFileCollaborationFileSizeCap(128*1024*1024))
+}
+
+func TestNativeFileCollabValidatesExactPositionalArguments(t *testing.T) {
+	require.True(t, nativeFileCollabValidArgs(Message{Event: FileCollabSubscribeEvent, Args: []string{"/file.txt"}}))
+	require.True(t, nativeFileCollabValidArgs(Message{Event: FileCollabUpdateEvent, Args: []string{"/file.txt", "1", "AQ=="}}))
+	require.True(t, nativeFileCollabValidArgs(Message{Event: FileCollabAwarenessEvent, Args: []string{"/file.txt", "AQ=="}}))
+	require.False(t, nativeFileCollabValidArgs(Message{Event: FileCollabSaveEvent, Args: []string{"/file.txt", "unexpected-content"}}))
+	require.False(t, nativeFileCollabValidArgs(Message{Event: FileCollabUpdateEvent, Args: []string{"/file.txt", "2", "AQ=="}}))
+	require.False(t, nativeFileCollabValidArgs(Message{Event: FileCollabAwarenessEvent, Args: []string{"/file.txt", ""}}))
+}
+
+func nativeFileCollabTestServer(t *testing.T, serverUUID string) *server.Server {
+	t.Helper()
+	root := t.TempDir()
+	next, err := config.NewAtPath(filepath.Join(root, "config.yml"))
+	require.NoError(t, err)
+	next.AuthenticationToken = "native-collaboration-test-token"
+	next.System.Data = filepath.Join(root, "volumes")
+	next.System.User.Uid = os.Getuid()
+	next.System.User.Gid = os.Getgid()
+	next.System.FileHistory.Enabled = false
+	config.Set(next)
+
+	settings, err := json.Marshal(map[string]any{
+		"uuid":      serverUUID,
+		"build":     map[string]any{"disk_space": 100},
+		"container": map[string]any{"image": "alpine:3.20"},
+	})
+	require.NoError(t, err)
+	manager := server.NewEmptyManager(nil)
+	s, err := manager.InitServer(remote.ServerConfigurationResponse{Settings: settings})
+	require.NoError(t, err)
+	t.Cleanup(s.CtxCancel)
+	return s
+}
+
+func nativeFileCollabTestSocket(t *testing.T) (*gws.Conn, *gws.Conn) {
+	t.Helper()
+	serverConn := make(chan *gws.Conn, 1)
+	httpServer := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		conn, err := (&gws.Upgrader{CheckOrigin: func(*http.Request) bool { return true }}).Upgrade(w, r, nil)
+		if err != nil {
+			return
+		}
+		serverConn <- conn
+	}))
+	t.Cleanup(httpServer.Close)
+
+	u, err := url.Parse(httpServer.URL)
+	require.NoError(t, err)
+	u.Scheme = "ws"
+	client, _, err := gws.DefaultDialer.Dial(u.String(), nil)
+	require.NoError(t, err)
+	serverSide := <-serverConn
+	t.Cleanup(func() {
+		_ = client.Close()
+		_ = serverSide.Close()
+	})
+	return serverSide, client
+}
+
+func nativeFileCollabTestHandler(t *testing.T, s *server.Server, user string) (*Handler, *gws.Conn, context.Context) {
+	t.Helper()
+	serverSide, client := nativeFileCollabTestSocket(t)
+	// NumericDate has second precision; move issuance to the next second so it
+	// cannot compare before the package boot timestamp due to truncation.
+	now := time.Now().Add(time.Second)
+	h := &Handler{
+		Connection: serverSide,
+		server:     s,
+		uuid:       uuid.New(),
+		limiter:    NewLimiter(),
+		jwt: &tokens.WebsocketPayload{
+			Payload: jwt.Payload{
+				IssuedAt:       jwt.NumericDate(now),
+				ExpirationTime: jwt.NumericDate(now.Add(time.Hour)),
+			},
+			Scoped:      tokens.Scoped{Scope: string(tokens.Websocket)},
+			UserUUID:    user,
+			UserName:    user,
+			ServerUUID:  s.ID(),
+			Permissions: []string{PermissionConnect, betterFilesCollabReadPermission, betterFilesCollabWritePermission},
+		},
+	}
+	ctx, cancel := context.WithCancel(context.Background())
+	t.Cleanup(cancel)
+	return h, client, ctx
+}
+
+func nativeFileCollabReadMessage(t *testing.T, conn *gws.Conn) Message {
+	t.Helper()
+	require.NoError(t, conn.SetReadDeadline(time.Now().Add(2*time.Second)))
+	defer conn.SetReadDeadline(time.Time{})
+	var message Message
+	require.NoError(t, conn.ReadJSON(&message))
+	return message
+}
+
+func nativeFileCollabRequireEvent(t *testing.T, conn *gws.Conn, event Event, argCount int) Message {
+	t.Helper()
+	message := nativeFileCollabReadMessage(t, conn)
+	require.Equal(t, event, message.Event, "unexpected websocket message args: %v", message.Args)
+	require.Len(t, message.Args, argCount)
+	return message
+}
+
+func TestNativeFileCollabWebsocketFlow(t *testing.T) {
+	const (
+		serverUUID = "11111111-1111-1111-1111-111111111111"
+		path       = "/config.txt"
+		otherPath  = "/other.txt"
+	)
+	s := nativeFileCollabTestServer(t, serverUUID)
+	require.NoError(t, os.WriteFile(filepath.Join(s.Filesystem().Path(), "config.txt"), []byte("hello"), 0o644))
+	require.NoError(t, os.WriteFile(filepath.Join(s.Filesystem().Path(), "other.txt"), []byte("isolated"), 0o644))
+
+	sender, senderConn, senderCtx := nativeFileCollabTestHandler(t, s, "sender")
+	recipient, recipientConn, recipientCtx := nativeFileCollabTestHandler(t, s, "recipient")
+	isolated, isolatedConn, isolatedCtx := nativeFileCollabTestHandler(t, s, "isolated")
+
+	require.NoError(t, sender.HandleInbound(senderCtx, Message{Event: FileCollabSubscribeEvent, Args: []string{path}}))
+	syncMessage := nativeFileCollabRequireEvent(t, senderConn, fileCollabSyncEvent, 3)
+	require.Equal(t, path, syncMessage.Args[0])
+	require.JSONEq(t, `{"dirty":false}`, syncMessage.Args[2])
+	nativeFileCollabRequireEvent(t, senderConn, fileCollabParticipantsEvent, 2)
+
+	require.NoError(t, recipient.HandleInbound(recipientCtx, Message{Event: FileCollabSubscribeEvent, Args: []string{path}}))
+	nativeFileCollabRequireEvent(t, recipientConn, fileCollabSyncEvent, 3)
+	nativeFileCollabRequireEvent(t, senderConn, fileCollabParticipantsEvent, 2)
+	participants := nativeFileCollabRequireEvent(t, recipientConn, fileCollabParticipantsEvent, 2)
+	var participantList []nativeFileCollabParticipant
+	require.NoError(t, json.Unmarshal([]byte(participants.Args[1]), &participantList))
+	require.Len(t, participantList, 2)
+
+	require.NoError(t, isolated.HandleInbound(isolatedCtx, Message{Event: FileCollabSubscribeEvent, Args: []string{otherPath}}))
+	nativeFileCollabRequireEvent(t, isolatedConn, fileCollabSyncEvent, 3)
+	nativeFileCollabRequireEvent(t, isolatedConn, fileCollabParticipantsEvent, 2)
+
+	initialState, err := base64.StdEncoding.DecodeString(syncMessage.Args[1])
+	require.NoError(t, err)
+	browser, browserText := nativeFileCollabTestPeer(t, initialState)
+	defer browser.Destroy()
+	vector := browser.StateVector()
+	update := nativeFileCollabTestInsert(t, browser, browserText, vector, browserText.Len(), " world")
+	split := len(update) / 2
+	require.Greater(t, split, 0)
+
+	require.NoError(t, sender.HandleInbound(senderCtx, Message{Event: FileCollabUpdateEvent, Args: []string{
+		path, "0", base64.StdEncoding.EncodeToString(update[:split]),
+	}}))
+	session := nativeFileCollabRegistry.sessions[nativeFileCollabKey(serverUUID, path)]
+	require.NotNil(t, session)
+	require.Equal(t, "hello", session.text.ToString(), "an incomplete chunk must not mutate the document")
+
+	require.NoError(t, sender.HandleInbound(senderCtx, Message{Event: FileCollabUpdateEvent, Args: []string{
+		path, "1", base64.StdEncoding.EncodeToString(update[split:]),
+	}}))
+	updateMessage := nativeFileCollabRequireEvent(t, recipientConn, FileCollabUpdateEvent, 2)
+	require.Equal(t, path, updateMessage.Args[0])
+	require.Equal(t, base64.StdEncoding.EncodeToString(update), updateMessage.Args[1])
+	require.Equal(t, "hello world", session.text.ToString())
+
+	require.NoError(t, sender.HandleInbound(senderCtx, Message{Event: FileCollabAwarenessEvent, Args: []string{path, "not-base64"}}))
+	awarenessError := nativeFileCollabRequireEvent(t, senderConn, fileCollabErrorEvent, 2)
+	require.Equal(t, path, awarenessError.Args[0])
+	require.Equal(t, "invalid awareness update", awarenessError.Args[1])
+
+	awareness := base64.StdEncoding.EncodeToString([]byte{1, 2, 3, 4})
+	require.NoError(t, sender.HandleInbound(senderCtx, Message{Event: FileCollabAwarenessEvent, Args: []string{path, awareness}}))
+	awarenessMessage := nativeFileCollabRequireEvent(t, recipientConn, FileCollabAwarenessEvent, 2)
+	require.Equal(t, []string{path, awareness}, awarenessMessage.Args)
+
+	require.NoError(t, sender.HandleInbound(senderCtx, Message{Event: FileCollabSaveEvent, Args: []string{path}}))
+	senderSaved := nativeFileCollabRequireEvent(t, senderConn, fileCollabSavedEvent, 2)
+	recipientSaved := nativeFileCollabRequireEvent(t, recipientConn, fileCollabSavedEvent, 2)
+	require.Equal(t, senderSaved.Args, recipientSaved.Args)
+	require.Equal(t, path, senderSaved.Args[0])
+	savedContent, err := os.ReadFile(filepath.Join(s.Filesystem().Path(), "config.txt"))
+	require.NoError(t, err)
+	require.Equal(t, "hello world", string(savedContent))
+
+	require.NoError(t, sender.HandleInbound(senderCtx, Message{Event: FileCollabUnsubscribeEvent, Args: []string{path}}))
+	remaining := nativeFileCollabRequireEvent(t, recipientConn, fileCollabParticipantsEvent, 2)
+	require.JSONEq(t, `[{"user":"recipient","name":"recipient","avatar":null}]`, remaining.Args[1])
+
+	require.NotEqual(t, nativeFileCollabKey(serverUUID, path), nativeFileCollabKey("other-server", path))
+	require.NotEqual(t, nativeFileCollabKey(serverUUID, path), nativeFileCollabKey(serverUUID, otherPath))
+	require.NoError(t, isolatedConn.SetReadDeadline(time.Now().Add(100*time.Millisecond)))
+	var unexpected Message
+	require.Error(t, isolatedConn.ReadJSON(&unexpected), "a different file session must receive no collaboration broadcasts")
+}
+
+func TestNativeFileCollabYjsFullStateRoundTrip(t *testing.T) {
+	session := nativeFileCollabNewSession("server", "/config.yml", "hello 😀\nworld")
+	state := session.doc.EncodeStateAsUpdate()
+	peer, peerText := nativeFileCollabTestPeer(t, state)
+	defer peer.Destroy()
+
+	require.Equal(t, "hello 😀\nworld", peerText.ToString())
+	require.Equal(t, "hello 😀\nworld", session.text.ToString())
+}
+
+func TestNativeFileCollabAppliesBrowserYjsV1Update(t *testing.T) {
+	session := nativeFileCollabNewSession("server", "/config.yml", "")
+	update, err := base64.StdEncoding.DecodeString(nativeFileCollabYjsFixture)
+	require.NoError(t, err)
+
+	resync, err := session.applyUpdate(update, "browser")
+	require.NoError(t, err)
+	require.False(t, resync)
+	require.Equal(t, "browser 😀\nselection", session.text.ToString())
+}
+
+func TestNativeFileCollabConcurrentYjsUpdatesConverge(t *testing.T) {
+	session := nativeFileCollabNewSession("server", "/config.yml", "ab")
+	initialState := session.doc.EncodeStateAsUpdate()
+	initialVector := session.doc.StateVector()
+
+	peerA, textA := nativeFileCollabTestPeer(t, initialState)
+	defer peerA.Destroy()
+	peerB, textB := nativeFileCollabTestPeer(t, initialState)
+	defer peerB.Destroy()
+
+	updateA := nativeFileCollabTestInsert(t, peerA, textA, initialVector, 1, "😀")
+	updateB := nativeFileCollabTestInsert(t, peerB, textB, initialVector, 1, "Y\nZ")
+
+	_, err := session.applyUpdate(updateA, "peer-a")
+	require.NoError(t, err)
+	_, err = session.applyUpdate(updateB, "peer-b")
+	require.NoError(t, err)
+	require.NoError(t, crdt.ApplyUpdateV1(peerA, updateB, "peer-b"))
+	require.NoError(t, crdt.ApplyUpdateV1(peerB, updateA, "peer-a"))
+
+	require.Equal(t, session.text.ToString(), textA.ToString())
+	require.Equal(t, session.text.ToString(), textB.ToString())
+}
+
+func TestNativeFileCollabCompactionRequestsResyncWithoutChangingContent(t *testing.T) {
+	session := nativeFileCollabNewSession("server", "/config.yml", "before")
+	peer, peerText := nativeFileCollabTestPeer(t, session.doc.EncodeStateAsUpdate())
+	defer peer.Destroy()
+	vector := session.doc.StateVector()
+	update := nativeFileCollabTestInsert(t, peer, peerText, vector, peerText.Len(), " after")
+
+	session.appliedUpdateBytes = int64(NativeFileCollaborationFileSizeCap()) * 8
+	resync, err := session.applyUpdate(update, "peer")
+	require.NoError(t, err)
+	require.True(t, resync)
+	require.Equal(t, "before after", session.text.ToString())
+	require.Zero(t, session.appliedUpdateBytes)
+}
+
+func TestNativeFileCollabRejectsMalformedYjsUpdate(t *testing.T) {
+	session := nativeFileCollabNewSession("server", "/config.yml", "before")
+	resync, err := session.applyUpdate([]byte("not a yjs update"), "peer")
+	require.Error(t, err)
+	require.False(t, resync)
+	require.Equal(t, "before", session.text.ToString())
+}
+
+func TestNativeFileCollabParticipantMatchesWingsRsShape(t *testing.T) {
+	avatar := "https://panel.example/avatar.png"
+	payload, err := json.Marshal([]nativeFileCollabParticipant{{
+		User:   "user-uuid",
+		Name:   "Panel User",
+		Avatar: &avatar,
+	}})
+	require.NoError(t, err)
+	require.JSONEq(t, `[{"user":"user-uuid","name":"Panel User","avatar":"https://panel.example/avatar.png"}]`, string(payload))
+}
+
+func TestNativeFileCollabTruncateUTF8KeepsValidBoundary(t *testing.T) {
+	content := "ab😀cd"
+	truncated := nativeFileCollabTruncateUTF8(content, 5)
+	require.Equal(t, "ab", truncated)
+}
diff --git a/router/websocket/limiter.go b/router/websocket/limiter.go
index 57315a96..436ca497 100644
--- a/router/websocket/limiter.go
+++ b/router/websocket/limiter.go
@@ -1,6 +1,7 @@
 package websocket
 
 import (
+	"strings"
 	"sync"
 	"time"
 
@@ -89,3 +90,16 @@ func limiterName(e Event) Event {
 
 	return "_default"
 }
+
+// IsBetterFilesCollaborationEvent reports whether an event belongs to the
+// ordered Better Files collaboration protocol.
+func IsBetterFilesCollaborationEvent(e Event) bool {
+	return strings.HasPrefix(string(e), "betterfiles:collab:")
+}
+
+// IsFileCollaborationEvent reports whether an event is part of either file
+// collaboration protocol. These stateful events must never be individually
+// discarded by a rate limiter because doing so desynchronizes the document.
+func IsFileCollaborationEvent(e Event) bool {
+	return IsBetterFilesCollaborationEvent(e) || IsNativeFileCollaborationEvent(e)
+}
diff --git a/router/websocket/listeners.go b/router/websocket/listeners.go
index 12e5f816..b79ddc18 100644
--- a/router/websocket/listeners.go
+++ b/router/websocket/listeners.go
@@ -78,6 +78,25 @@ var e = []string{
 	server.BackupRestoreCompletedEvent,
 	server.TransferLogsEvent,
 	server.TransferStatusEvent,
+	server.OperationProgressEvent,
+	server.OperationErrorEvent,
+	server.OperationCompletedEvent,
+}
+
+func websocketEventArgs(data interface{}) ([]string, bool) {
+	values, ok := data.([]interface{})
+	if !ok {
+		return nil, false
+	}
+	args := make([]string, len(values))
+	for i, value := range values {
+		arg, ok := value.(string)
+		if !ok {
+			return nil, false
+		}
+		args[i] = arg
+	}
+	return args, true
 }
 
 // ListenForServerEvents will listen for different events happening on a server
@@ -132,7 +151,9 @@ func (h *Handler) listenForServerEvents(ctx context.Context) error {
 			}
 			var sendErr error
 			message := Message{Event: Event(e.Topic)}
-			if str, ok := e.Data.(string); ok {
+			if args, ok := websocketEventArgs(e.Data); ok {
+				message.Args = args
+			} else if str, ok := e.Data.(string); ok {
 				message.Args = []string{str}
 			} else if b, ok := e.Data.([]byte); ok {
 				message.Args = []string{string(b)}
diff --git a/router/websocket/listeners_operation_test.go b/router/websocket/listeners_operation_test.go
new file mode 100644
index 00000000..e05c740a
--- /dev/null
+++ b/router/websocket/listeners_operation_test.go
@@ -0,0 +1,15 @@
+package websocket
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestWebsocketEventArgsPreservesOperationWireArguments(t *testing.T) {
+	args, ok := websocketEventArgs([]interface{}{"operation-id", `{"type":"copy_many"}`})
+	require.True(t, ok)
+	require.Equal(t, []string{"operation-id", `{"type":"copy_many"}`}, args)
+	_, ok = websocketEventArgs([]interface{}{"operation-id", 1})
+	require.False(t, ok)
+}
diff --git a/router/websocket/websocket.go b/router/websocket/websocket.go
index 4482667e..e08e07ac 100644
--- a/router/websocket/websocket.go
+++ b/router/websocket/websocket.go
@@ -39,13 +39,14 @@ const (
 )
 
 type Handler struct {
-	sync.RWMutex `json:"-"`
-	Connection   *websocket.Conn `json:"-"`
-	jwt          *tokens.WebsocketPayload
-	server       *server.Server
-	ra           server.RequestActivity
-	uuid         uuid.UUID
-	limiter      *LimiterBucket
+	sync.RWMutex      `json:"-"`
+	Connection        *websocket.Conn `json:"-"`
+	jwt               *tokens.WebsocketPayload
+	server            *server.Server
+	ra                server.RequestActivity
+	uuid              uuid.UUID
+	limiter           *LimiterBucket
+	fileCollabCleanup sync.Once
 }
 
 var (
@@ -111,7 +112,10 @@ func GetHandler(s *server.Server, w http.ResponseWriter, r *http.Request, c *gin
 		return nil, err
 	}
 
-	conn.SetReadLimit(4096)
+	// Collaboration updates are chunked, but their base64 and JSON framing can
+	// exceed the historical 4 KiB console-message limit. The router applies the
+	// same 32 KiB bound before dispatching a decoded message.
+	conn.SetReadLimit(32_768)
 	_ = conn.SetCompressionLevel(5)
 
 	return &Handler{
@@ -286,7 +290,9 @@ func (h *Handler) HandleInbound(ctx context.Context, m Message) error {
 		return server.ErrSuspended
 	}
 
-	if h.IsThrottled(m.Event) {
+	// Collaboration messages are bounded and processed synchronously by the
+	// router. Dropping one update or chunk here would corrupt protocol state.
+	if !IsFileCollaborationEvent(m.Event) && h.IsThrottled(m.Event) {
 		return nil
 	}
 
@@ -300,6 +306,13 @@ func (h *Handler) HandleInbound(ctx context.Context, m Message) error {
 		}
 	}
 
+	if handled, err := h.HandleBetterFilesCollaboration(ctx, m); handled {
+		return err
+	}
+	if handled, err := h.HandleNativeFileCollaboration(ctx, m); handled {
+		return err
+	}
+
 	switch m.Event {
 	case AuthenticationEvent:
 		{
diff --git a/server/events.go b/server/events.go
index d08411cc..c4a31cb5 100644
--- a/server/events.go
+++ b/server/events.go
@@ -19,6 +19,9 @@ const (
 	TransferLogsEvent           = "transfer logs"
 	TransferStatusEvent         = "transfer status"
 	DeletedEvent                = "deleted"
+	OperationProgressEvent      = "operation progress"
+	OperationErrorEvent         = "operation error"
+	OperationCompletedEvent     = "operation completed"
 )
 
 // Events returns the server's emitter instance.
diff --git a/server/file_history.go b/server/file_history.go
new file mode 100644
index 00000000..98f3cf3c
--- /dev/null
+++ b/server/file_history.go
@@ -0,0 +1,783 @@
+package server
+
+import (
+	"bytes"
+	"crypto/sha256"
+	"database/sql"
+	"encoding/hex"
+	"fmt"
+	"os"
+	"path/filepath"
+	"strings"
+	"sync"
+	"time"
+
+	_ "github.com/glebarez/sqlite"
+	"github.com/klauspost/compress/zstd"
+
+	"github.com/pterodactyl/wings/config"
+)
+
+const fileHistorySchema = `
+CREATE TABLE IF NOT EXISTS files (
+    id   INTEGER PRIMARY KEY,
+    path TEXT UNIQUE NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS revisions (
+    id           INTEGER PRIMARY KEY,
+    file_id      INTEGER NOT NULL REFERENCES files(id) ON DELETE CASCADE,
+    chain_id     INTEGER NOT NULL,
+    size         INTEGER NOT NULL,
+    user_id      TEXT,
+    base_id      INTEGER,
+    payload      BLOB NOT NULL,
+    content_hash TEXT NOT NULL,
+    created      INTEGER NOT NULL
+);
+
+CREATE INDEX IF NOT EXISTS idx_revisions_file_created ON revisions(file_id, created DESC);
+CREATE INDEX IF NOT EXISTS idx_revisions_file_chain   ON revisions(file_id, chain_id);
+CREATE INDEX IF NOT EXISTS idx_revisions_created      ON revisions(created);
+`
+
+const fileHistoryZstdDictID uint32 = 0
+
+var fileHistorySkippedExtensions = map[string]struct{}{
+	".7z":      {},
+	".a":       {},
+	".avi":     {},
+	".bin":     {},
+	".br":      {},
+	".bz2":     {},
+	".class":   {},
+	".dat":     {},
+	".db":      {},
+	".dll":     {},
+	".dylib":   {},
+	".exe":     {},
+	".gif":     {},
+	".gz":      {},
+	".idx":     {},
+	".jar":     {},
+	".jpeg":    {},
+	".jpg":     {},
+	".ldb":     {},
+	".lz4":     {},
+	".m4a":     {},
+	".m4v":     {},
+	".mca":     {},
+	".mcc":     {},
+	".mcr":     {},
+	".mdb":     {},
+	".mkv":     {},
+	".mov":     {},
+	".mp3":     {},
+	".mp4":     {},
+	".o":       {},
+	".ogg":     {},
+	".ogv":     {},
+	".pak":     {},
+	".pack":    {},
+	".png":     {},
+	".rar":     {},
+	".rdb":     {},
+	".so":      {},
+	".sqlite":  {},
+	".sqlite3": {},
+	".sst":     {},
+	".tar":     {},
+	".tgz":     {},
+	".war":     {},
+	".wav":     {},
+	".webm":    {},
+	".webp":    {},
+	".xz":      {},
+	".zip":     {},
+	".zst":     {},
+}
+
+type FileRevision struct {
+	ID         int64     `json:"id"`
+	Size       uint64    `json:"size"`
+	StoredSize uint64    `json:"stored_size"`
+	User       string    `json:"user,omitempty"`
+	IsSnapshot bool      `json:"is_snapshot"`
+	Created    time.Time `json:"created"`
+}
+
+type fileRevisionRow struct {
+	id          int64
+	chainID     int64
+	size        uint64
+	storedSize  uint64
+	user        string
+	baseID      sql.NullInt64
+	contentHash string
+	createdMs   int64
+}
+
+type historyRevisionStep struct {
+	id      int64
+	baseID  sql.NullInt64
+	payload []byte
+	hash    string
+}
+
+type fileHistoryStore struct {
+	mu sync.Mutex
+	db *sql.DB
+}
+
+var fileHistoryStores sync.Map
+
+func (s *Server) RecordFileRevision(path string, before []byte, after []byte, user string) (int64, error) {
+	cfg := config.Get().System.FileHistory
+	if !ShouldRecordFileHistory(path, uint64(len(after))) || isLikelyBinaryHistoryContent(after) {
+		return 0, nil
+	}
+	store, err := s.fileHistoryStore()
+	if err != nil {
+		return 0, err
+	}
+	return store.record(path, before, after, user, cfg)
+}
+
+func ShouldRecordFileHistory(path string, size uint64) bool {
+	cfg := config.Get().System.FileHistory
+	return cfg.Enabled && size <= cfg.FileSizeCap && isFileHistoryPathAllowed(path)
+}
+
+func (s *Server) ListFileRevisions(path string) ([]FileRevision, error) {
+	if !config.Get().System.FileHistory.Enabled {
+		return nil, nil
+	}
+	store, err := s.fileHistoryStore()
+	if err != nil {
+		return nil, err
+	}
+	return store.list(path)
+}
+
+func (s *Server) FileRevisionContent(id int64) ([]byte, string, error) {
+	if !config.Get().System.FileHistory.Enabled {
+		return nil, "", sql.ErrNoRows
+	}
+	store, err := s.fileHistoryStore()
+	if err != nil {
+		return nil, "", err
+	}
+	return store.content(id)
+}
+
+func (s *Server) ForgetFileHistory(path string) {
+	if !config.Get().System.FileHistory.Enabled {
+		return
+	}
+	store, err := s.fileHistoryStore()
+	if err != nil {
+		s.Log().WithError(err).Warn("failed to open file history store")
+		return
+	}
+	if err := store.deleteFile(path); err != nil {
+		s.Log().WithError(err).WithField("path", path).Warn("failed to delete file history")
+	}
+}
+
+func (s *Server) RenameFileHistory(oldPath string, newPath string) {
+	if !config.Get().System.FileHistory.Enabled {
+		return
+	}
+	store, err := s.fileHistoryStore()
+	if err != nil {
+		s.Log().WithError(err).Warn("failed to open file history store")
+		return
+	}
+	if err := store.renameFile(oldPath, newPath); err != nil {
+		s.Log().WithError(err).WithField("from_path", oldPath).WithField("to_path", newPath).Warn("failed to rename file history")
+	}
+}
+
+func (s *Server) fileHistoryStore() (*fileHistoryStore, error) {
+	actual, ok := fileHistoryStores.Load(s.ID())
+	if ok {
+		return actual.(*fileHistoryStore), nil
+	}
+
+	dir := filepath.Join(config.Get().System.RootDirectory, "diffs")
+	if err := os.MkdirAll(dir, 0o700); err != nil {
+		return nil, err
+	}
+	dbPath := filepath.Join(dir, s.ID()+".db")
+	db, err := sql.Open("sqlite", dbPath)
+	if err != nil {
+		return nil, err
+	}
+	store := &fileHistoryStore{db: db}
+	if err := store.init(); err != nil {
+		_ = db.Close()
+		return nil, err
+	}
+	actual, loaded := fileHistoryStores.LoadOrStore(s.ID(), store)
+	if loaded {
+		_ = db.Close()
+		return actual.(*fileHistoryStore), nil
+	}
+	return store, nil
+}
+
+func (s *fileHistoryStore) init() error {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+
+	if _, err := s.db.Exec("PRAGMA journal_mode=WAL;"); err != nil {
+		return err
+	}
+	if _, err := s.db.Exec("PRAGMA synchronous=NORMAL;"); err != nil {
+		return err
+	}
+	if _, err := s.db.Exec("PRAGMA foreign_keys=ON;"); err != nil {
+		return err
+	}
+	_, err := s.db.Exec(fileHistorySchema)
+	return err
+}
+
+func (s *fileHistoryStore) record(path string, before []byte, after []byte, user string, cfg config.FileHistoryConfiguration) (int64, error) {
+	if bytes.Equal(before, after) {
+		return 0, nil
+	}
+
+	s.mu.Lock()
+	defer s.mu.Unlock()
+
+	tx, err := s.db.Begin()
+	if err != nil {
+		return 0, err
+	}
+	defer tx.Rollback()
+
+	fileID, err := upsertHistoryFile(tx, path)
+	if err != nil {
+		return 0, err
+	}
+
+	nowMs := time.Now().UTC().UnixMilli()
+	latest, err := latestFileRevision(tx, fileID)
+	if err != nil {
+		return 0, err
+	}
+
+	var revisionID int64
+	switch {
+	case latest == nil && len(before) > 0:
+		baseID, err := insertHistorySnapshot(tx, fileID, "", before, nowMs-1, cfg.ZstdLevel)
+		if err != nil {
+			return 0, err
+		}
+		revisionID, err = insertCompactHistoryRevision(tx, fileID, baseID, baseID, before, user, after, nowMs, cfg.ZstdLevel)
+		if err != nil {
+			return 0, err
+		}
+	case latest == nil:
+		revisionID, err = insertHistorySnapshot(tx, fileID, user, after, nowMs, cfg.ZstdLevel)
+		if err != nil {
+			return 0, err
+		}
+	default:
+		if latest.contentHash == contentHash(after) {
+			return latest.id, tx.Commit()
+		}
+		chainLength, err := currentHistoryChainLength(tx, fileID, latest.chainID)
+		if err != nil {
+			return 0, err
+		}
+		if chainLength >= int64(maxUint64(cfg.AnchorInterval, 1)) {
+			revisionID, err = insertHistorySnapshot(tx, fileID, user, after, nowMs, cfg.ZstdLevel)
+			if err != nil {
+				return 0, err
+			}
+			break
+		}
+		previous, err := reconstructHistoryRevision(tx, latest.id, cfg.ZstdLevel)
+		if err != nil {
+			revisionID, err = insertHistorySnapshot(tx, fileID, user, after, nowMs, cfg.ZstdLevel)
+			if err != nil {
+				return 0, err
+			}
+			break
+		}
+		revisionID, err = insertCompactHistoryRevision(tx, fileID, latest.id, latest.chainID, previous, user, after, nowMs, cfg.ZstdLevel)
+		if err != nil {
+			return 0, err
+		}
+	}
+
+	protectedChain, err := latestHistoryChainID(tx, fileID)
+	if err != nil {
+		return 0, err
+	}
+	if err := pruneHistory(tx, fileID, protectedChain, cfg); err != nil {
+		return 0, err
+	}
+	if err := pruneServerHistory(tx, fileID, protectedChain, cfg); err != nil {
+		return 0, err
+	}
+	if err := tx.Commit(); err != nil {
+		return 0, err
+	}
+	return revisionID, nil
+}
+
+func (s *fileHistoryStore) list(path string) ([]FileRevision, error) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+
+	fileID, err := findHistoryFile(s.db, path)
+	if err != nil || fileID == 0 {
+		return nil, err
+	}
+	rows, err := s.db.Query(`
+		SELECT id, chain_id, created, size, COALESCE(user_id, ''), base_id, LENGTH(payload), content_hash
+		FROM revisions WHERE file_id = ?
+		ORDER BY id DESC`, fileID)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+
+	revisions := make([]FileRevision, 0)
+	for rows.Next() {
+		row, err := scanHistoryRevision(rows)
+		if err != nil {
+			return nil, err
+		}
+		revisions = append(revisions, FileRevision{
+			ID:         row.id,
+			Size:       row.size,
+			StoredSize: row.storedSize,
+			User:       row.user,
+			IsSnapshot: !row.baseID.Valid,
+			Created:    time.UnixMilli(row.createdMs).UTC(),
+		})
+	}
+	return revisions, rows.Err()
+}
+
+func (s *fileHistoryStore) content(id int64) ([]byte, string, error) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+
+	content, err := reconstructHistoryRevision(s.db, id, config.Get().System.FileHistory.ZstdLevel)
+	if err != nil {
+		return nil, "", err
+	}
+	var p string
+	if err := s.db.QueryRow(`
+		SELECT files.path
+		FROM revisions
+		JOIN files ON files.id = revisions.file_id
+		WHERE revisions.id = ?`, id).Scan(&p); err != nil {
+		return nil, "", err
+	}
+	return content, p, nil
+}
+
+func (s *fileHistoryStore) deleteFile(path string) error {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	_, err := s.db.Exec("DELETE FROM files WHERE path = ?", path)
+	return err
+}
+
+func (s *fileHistoryStore) renameFile(oldPath string, newPath string) error {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	_, err := s.db.Exec("UPDATE files SET path = ? WHERE path = ?", newPath, oldPath)
+	return err
+}
+
+type historyQuerier interface {
+	QueryRow(query string, args ...any) *sql.Row
+	Query(query string, args ...any) (*sql.Rows, error)
+}
+
+func upsertHistoryFile(tx *sql.Tx, path string) (int64, error) {
+	var id int64
+	err := tx.QueryRow("SELECT id FROM files WHERE path = ?", path).Scan(&id)
+	if err == nil {
+		return id, nil
+	}
+	if err != sql.ErrNoRows {
+		return 0, err
+	}
+	res, err := tx.Exec("INSERT INTO files(path) VALUES (?)", path)
+	if err != nil {
+		return 0, err
+	}
+	return res.LastInsertId()
+}
+
+func findHistoryFile(db *sql.DB, path string) (int64, error) {
+	var id int64
+	err := db.QueryRow("SELECT id FROM files WHERE path = ?", path).Scan(&id)
+	if err == sql.ErrNoRows {
+		return 0, nil
+	}
+	return id, err
+}
+
+func latestFileRevision(q historyQuerier, fileID int64) (*fileRevisionRow, error) {
+	row := q.QueryRow(`
+		SELECT id, chain_id, created, size, COALESCE(user_id, ''), base_id, LENGTH(payload), content_hash
+		FROM revisions WHERE file_id = ?
+		ORDER BY id DESC LIMIT 1`, fileID)
+	revision, err := scanHistoryRevision(row)
+	if err == sql.ErrNoRows {
+		return nil, nil
+	}
+	if err != nil {
+		return nil, err
+	}
+	return &revision, nil
+}
+
+func latestHistoryChainID(q historyQuerier, fileID int64) (sql.NullInt64, error) {
+	var chainID sql.NullInt64
+	err := q.QueryRow("SELECT chain_id FROM revisions WHERE file_id = ? ORDER BY id DESC LIMIT 1", fileID).Scan(&chainID)
+	if err == sql.ErrNoRows {
+		return sql.NullInt64{}, nil
+	}
+	return chainID, err
+}
+
+func currentHistoryChainLength(q historyQuerier, fileID int64, chainID int64) (int64, error) {
+	var count int64
+	err := q.QueryRow("SELECT COUNT(*) FROM revisions WHERE file_id = ? AND chain_id = ?", fileID, chainID).Scan(&count)
+	return count, err
+}
+
+func insertHistorySnapshot(tx *sql.Tx, fileID int64, user string, content []byte, createdMs int64, level int) (int64, error) {
+	payload, err := encodeHistorySnapshot(content, level)
+	if err != nil {
+		return 0, err
+	}
+	return insertEncodedHistorySnapshot(tx, fileID, user, content, payload, createdMs)
+}
+
+func insertEncodedHistorySnapshot(tx *sql.Tx, fileID int64, user string, content []byte, payload []byte, createdMs int64) (int64, error) {
+	res, err := tx.Exec(`
+		INSERT INTO revisions(file_id, chain_id, created, size, user_id, base_id, payload, content_hash)
+		VALUES (?, 0, ?, ?, NULLIF(?, ''), NULL, ?, ?)`,
+		fileID, createdMs, len(content), user, payload, contentHash(content))
+	if err != nil {
+		return 0, err
+	}
+	id, err := res.LastInsertId()
+	if err != nil {
+		return 0, err
+	}
+	if _, err := tx.Exec("UPDATE revisions SET chain_id = ? WHERE id = ?", id, id); err != nil {
+		return 0, err
+	}
+	return id, nil
+}
+
+func insertCompactHistoryRevision(tx *sql.Tx, fileID int64, baseID int64, chainID int64, base []byte, user string, content []byte, createdMs int64, level int) (int64, error) {
+	snapshotPayload, err := encodeHistorySnapshot(content, level)
+	if err != nil {
+		return 0, err
+	}
+	deltaPayload, deltaErr := encodeHistoryDelta(base, content, level)
+	if deltaErr != nil || len(deltaPayload)*10 >= len(snapshotPayload)*9 {
+		return insertEncodedHistorySnapshot(tx, fileID, user, content, snapshotPayload, createdMs)
+	}
+	return insertEncodedHistoryDelta(tx, fileID, baseID, chainID, user, content, deltaPayload, createdMs)
+}
+
+func insertEncodedHistoryDelta(tx *sql.Tx, fileID int64, baseID int64, chainID int64, user string, content []byte, payload []byte, createdMs int64) (int64, error) {
+	res, err := tx.Exec(`
+		INSERT INTO revisions(file_id, chain_id, created, size, user_id, base_id, payload, content_hash)
+		VALUES (?, ?, ?, ?, NULLIF(?, ''), ?, ?, ?)`,
+		fileID, chainID, createdMs, len(content), user, baseID, payload, contentHash(content))
+	if err != nil {
+		return 0, err
+	}
+	return res.LastInsertId()
+}
+
+func pruneHistory(tx *sql.Tx, fileID int64, protectedChain sql.NullInt64, cfg config.FileHistoryConfiguration) error {
+	if err := pruneOldHistoryChains(tx, fileID, maxUint64(cfg.KeepChains, 1)); err != nil {
+		return err
+	}
+	for {
+		size, err := historyFilePayloadBytes(tx, fileID)
+		if err != nil || size <= cfg.PerFileDiskBudget {
+			return err
+		}
+		freed, err := dropOldestHistoryChain(tx, fileID, protectedChain, maxUint64(cfg.KeepChains, 1))
+		if err != nil || freed == 0 {
+			return err
+		}
+	}
+}
+
+func pruneServerHistory(tx *sql.Tx, protectedFileID int64, protectedChain sql.NullInt64, cfg config.FileHistoryConfiguration) error {
+	if cfg.PerServerDiskBudget == 0 {
+		return nil
+	}
+	for {
+		size, err := historyTotalPayloadBytes(tx)
+		if err != nil || size <= cfg.PerServerDiskBudget {
+			return err
+		}
+		freed, err := dropGloballyOldestHistoryChain(tx, protectedFileID, protectedChain)
+		if err != nil || freed == 0 {
+			return err
+		}
+	}
+}
+
+func pruneOldHistoryChains(tx *sql.Tx, fileID int64, keepChains uint64) error {
+	rows, err := tx.Query(`
+		SELECT DISTINCT chain_id FROM revisions
+		WHERE file_id = ?
+		ORDER BY chain_id DESC LIMIT ?`, fileID, keepChains)
+	if err != nil {
+		return err
+	}
+	defer rows.Close()
+
+	chains := make([]int64, 0, keepChains)
+	for rows.Next() {
+		var id int64
+		if err := rows.Scan(&id); err != nil {
+			return err
+		}
+		chains = append(chains, id)
+	}
+	if err := rows.Err(); err != nil {
+		return err
+	}
+	if uint64(len(chains)) < keepChains || len(chains) == 0 {
+		return nil
+	}
+	_, err = tx.Exec("DELETE FROM revisions WHERE file_id = ? AND chain_id < ?", fileID, chains[len(chains)-1])
+	return err
+}
+
+func dropOldestHistoryChain(tx *sql.Tx, fileID int64, protected sql.NullInt64, minChains uint64) (uint64, error) {
+	var count int64
+	if err := tx.QueryRow("SELECT COUNT(DISTINCT chain_id) FROM revisions WHERE file_id = ?", fileID).Scan(&count); err != nil {
+		return 0, err
+	}
+	if uint64(count) <= maxUint64(minChains, 1) {
+		return 0, nil
+	}
+
+	query := "SELECT MIN(chain_id) FROM revisions WHERE file_id = ?"
+	args := []any{fileID}
+	if protected.Valid {
+		query += " AND chain_id <> ?"
+		args = append(args, protected.Int64)
+	}
+	var chainID sql.NullInt64
+	if err := tx.QueryRow(query, args...).Scan(&chainID); err != nil || !chainID.Valid {
+		return 0, err
+	}
+	var freed uint64
+	if err := tx.QueryRow("SELECT COALESCE(SUM(LENGTH(payload)), 0) FROM revisions WHERE file_id = ? AND chain_id = ?", fileID, chainID.Int64).Scan(&freed); err != nil {
+		return 0, err
+	}
+	_, err := tx.Exec("DELETE FROM revisions WHERE file_id = ? AND chain_id = ?", fileID, chainID.Int64)
+	return freed, err
+}
+
+func dropGloballyOldestHistoryChain(tx *sql.Tx, protectedFileID int64, protectedChain sql.NullInt64) (uint64, error) {
+	query := `
+		SELECT r.file_id, r.chain_id
+		FROM revisions r
+		WHERE (SELECT COUNT(DISTINCT chain_id) FROM revisions WHERE file_id = r.file_id) > 1`
+	args := []any{}
+	if protectedChain.Valid {
+		query += " AND NOT (r.file_id = ? AND r.chain_id = ?)"
+		args = append(args, protectedFileID, protectedChain.Int64)
+	}
+	query += `
+		GROUP BY r.file_id, r.chain_id
+		ORDER BY MIN(r.created) ASC, r.chain_id ASC
+		LIMIT 1`
+
+	var fileID int64
+	var chainID int64
+	if err := tx.QueryRow(query, args...).Scan(&fileID, &chainID); err != nil {
+		if err == sql.ErrNoRows {
+			return 0, nil
+		}
+		return 0, err
+	}
+
+	var freed uint64
+	if err := tx.QueryRow("SELECT COALESCE(SUM(LENGTH(payload)), 0) FROM revisions WHERE file_id = ? AND chain_id = ?", fileID, chainID).Scan(&freed); err != nil {
+		return 0, err
+	}
+	_, err := tx.Exec("DELETE FROM revisions WHERE file_id = ? AND chain_id = ?", fileID, chainID)
+	return freed, err
+}
+
+func historyFilePayloadBytes(tx *sql.Tx, fileID int64) (uint64, error) {
+	var size uint64
+	err := tx.QueryRow("SELECT COALESCE(SUM(LENGTH(payload)), 0) FROM revisions WHERE file_id = ?", fileID).Scan(&size)
+	return size, err
+}
+
+func historyTotalPayloadBytes(tx *sql.Tx) (uint64, error) {
+	var size uint64
+	err := tx.QueryRow("SELECT COALESCE(SUM(LENGTH(payload)), 0) FROM revisions").Scan(&size)
+	return size, err
+}
+
+func reconstructHistoryRevision(q historyQuerier, id int64, level int) ([]byte, error) {
+	chain := make([]historyRevisionStep, 0, 8)
+	current := sql.NullInt64{Int64: id, Valid: true}
+	for current.Valid && len(chain) < 1000 {
+		var row historyRevisionStep
+		if err := q.QueryRow("SELECT id, base_id, payload, content_hash FROM revisions WHERE id = ?", current.Int64).
+			Scan(&row.id, &row.baseID, &row.payload, &row.hash); err != nil {
+			return nil, err
+		}
+		chain = append(chain, row)
+		current = row.baseID
+		if !row.baseID.Valid {
+			break
+		}
+	}
+	if len(chain) == 0 || chain[len(chain)-1].baseID.Valid {
+		return nil, fmt.Errorf("revision %d has no snapshot anchor", id)
+	}
+
+	reverseHistoryChain(chain)
+	content, err := decodeHistorySnapshot(chain[0].payload)
+	if err != nil {
+		return nil, err
+	}
+	if contentHash(content) != chain[0].hash {
+		return nil, fmt.Errorf("content hash mismatch at revision %d", chain[0].id)
+	}
+	for _, next := range chain[1:] {
+		content, err = decodeHistoryDelta(next.payload, content, level)
+		if err != nil {
+			return nil, err
+		}
+		if contentHash(content) != next.hash {
+			return nil, fmt.Errorf("content hash mismatch at revision %d", next.id)
+		}
+	}
+	return content, nil
+}
+
+func reverseHistoryChain(chain []historyRevisionStep) {
+	for i, j := 0, len(chain)-1; i < j; i, j = i+1, j-1 {
+		chain[i], chain[j] = chain[j], chain[i]
+	}
+}
+
+type revisionScanner interface {
+	Scan(dest ...any) error
+}
+
+func scanHistoryRevision(scanner revisionScanner) (fileRevisionRow, error) {
+	var row fileRevisionRow
+	err := scanner.Scan(&row.id, &row.chainID, &row.createdMs, &row.size, &row.user, &row.baseID, &row.storedSize, &row.contentHash)
+	return row, err
+}
+
+func encodeHistorySnapshot(content []byte, level int) ([]byte, error) {
+	encoder, err := zstd.NewWriter(nil, zstd.WithEncoderLevel(zstd.EncoderLevelFromZstd(level)), zstd.WithEncoderConcurrency(1))
+	if err != nil {
+		return nil, err
+	}
+	defer encoder.Close()
+	return encoder.EncodeAll(content, nil), nil
+}
+
+func decodeHistorySnapshot(payload []byte) ([]byte, error) {
+	decoder, err := zstd.NewReader(nil, zstd.WithDecoderConcurrency(1))
+	if err != nil {
+		return nil, err
+	}
+	defer decoder.Close()
+	return decoder.DecodeAll(payload, nil)
+}
+
+func encodeHistoryDelta(base []byte, content []byte, level int) ([]byte, error) {
+	encoder, err := zstd.NewWriter(nil, zstd.WithEncoderLevel(zstd.EncoderLevelFromZstd(level)), zstd.WithEncoderConcurrency(1), zstd.WithEncoderDictRaw(fileHistoryZstdDictID, base))
+	if err != nil {
+		return nil, err
+	}
+	defer encoder.Close()
+	payload := encoder.EncodeAll(content, nil)
+	decoded, err := decodeHistoryDelta(payload, base, level)
+	if err != nil {
+		return nil, err
+	}
+	if !bytes.Equal(decoded, content) {
+		return nil, fmt.Errorf("zstd delta round-trip mismatch")
+	}
+	return payload, nil
+}
+
+func decodeHistoryDelta(payload []byte, base []byte, level int) ([]byte, error) {
+	decoder, err := zstd.NewReader(nil, zstd.WithDecoderConcurrency(1), zstd.WithDecoderDictRaw(fileHistoryZstdDictID, base))
+	if err != nil {
+		return nil, err
+	}
+	defer decoder.Close()
+	return decoder.DecodeAll(payload, nil)
+}
+
+func contentHash(content []byte) string {
+	sum := sha256.Sum256(content)
+	return hex.EncodeToString(sum[:])
+}
+
+func maxUint64(value uint64, fallback uint64) uint64 {
+	if value == 0 {
+		return fallback
+	}
+	return value
+}
+
+func isFileHistoryPathAllowed(path string) bool {
+	ext := strings.ToLower(filepath.Ext(path))
+	if ext == "" {
+		return true
+	}
+	_, skipped := fileHistorySkippedExtensions[ext]
+	return !skipped
+}
+
+func isLikelyBinaryHistoryContent(content []byte) bool {
+	if len(content) == 0 {
+		return false
+	}
+	sample := content
+	if len(sample) > 8192 {
+		sample = sample[:8192]
+	}
+
+	controlBytes := 0
+	for _, b := range sample {
+		switch b {
+		case 0:
+			return true
+		case '\n', '\r', '\t', '\f':
+			continue
+		default:
+			if b < 0x20 {
+				controlBytes++
+			}
+		}
+	}
+	return controlBytes*100 > len(sample)*5
+}
diff --git a/server/file_history_test.go b/server/file_history_test.go
new file mode 100644
index 00000000..32cabc52
--- /dev/null
+++ b/server/file_history_test.go
@@ -0,0 +1,140 @@
+package server
+
+import (
+	"bytes"
+	"database/sql"
+	"testing"
+	"time"
+
+	_ "github.com/glebarez/sqlite"
+
+	"github.com/pterodactyl/wings/config"
+)
+
+func TestFileHistoryDeltaRoundTrip(t *testing.T) {
+	base := bytes.Repeat([]byte("server-start-line=old\n"), 128)
+	content := bytes.ReplaceAll(base, []byte("old"), []byte("new"))
+
+	payload, err := encodeHistoryDelta(base, content, 3)
+	if err != nil {
+		t.Fatalf("encodeHistoryDelta returned error: %v", err)
+	}
+
+	decoded, err := decodeHistoryDelta(payload, base, 3)
+	if err != nil {
+		t.Fatalf("decodeHistoryDelta returned error: %v", err)
+	}
+	if !bytes.Equal(decoded, content) {
+		t.Fatal("decoded delta does not match original content")
+	}
+}
+
+func TestFileHistorySnapshotRoundTrip(t *testing.T) {
+	content := []byte("echo starting server\njava -jar server.jar\n")
+
+	payload, err := encodeHistorySnapshot(content, 3)
+	if err != nil {
+		t.Fatalf("encodeHistorySnapshot returned error: %v", err)
+	}
+
+	decoded, err := decodeHistorySnapshot(payload)
+	if err != nil {
+		t.Fatalf("decodeHistorySnapshot returned error: %v", err)
+	}
+	if !bytes.Equal(decoded, content) {
+		t.Fatal("decoded snapshot does not match original content")
+	}
+}
+
+func TestFileHistoryPathFilter(t *testing.T) {
+	allowed := []string{
+		"/ServerStart.bat",
+		"/server.properties",
+		"/config/custom.dat.txt",
+		"/no-extension",
+	}
+	for _, path := range allowed {
+		if !isFileHistoryPathAllowed(path) {
+			t.Fatalf("expected %s to be tracked", path)
+		}
+	}
+
+	skipped := []string{
+		"/server.jar",
+		"/world/region/r.0.0.mca",
+		"/backup.tar.gz",
+		"/database.sqlite",
+		"/image.PNG",
+	}
+	for _, path := range skipped {
+		if isFileHistoryPathAllowed(path) {
+			t.Fatalf("expected %s to be skipped", path)
+		}
+	}
+}
+
+func TestFileHistoryBinaryContentFilter(t *testing.T) {
+	if isLikelyBinaryHistoryContent([]byte("line one\nline two\n")) {
+		t.Fatal("expected text content to be tracked")
+	}
+	if !isLikelyBinaryHistoryContent([]byte{0x50, 0x4b, 0x03, 0x04, 0x00}) {
+		t.Fatal("expected nul-containing content to be skipped")
+	}
+	if !isLikelyBinaryHistoryContent([]byte{0x01, 0x02, 0x03, 0x04, 't', 'e', 'x', 't'}) {
+		t.Fatal("expected control-heavy content to be skipped")
+	}
+}
+
+func TestFileHistoryRecordStartsSnapshotAfterCorruptLatestRevision(t *testing.T) {
+	db, err := sql.Open("sqlite", ":memory:")
+	if err != nil {
+		t.Fatalf("failed to open sqlite: %v", err)
+	}
+	defer db.Close()
+
+	store := &fileHistoryStore{db: db}
+	if err := store.init(); err != nil {
+		t.Fatalf("failed to init store: %v", err)
+	}
+
+	cfg := config.FileHistoryConfiguration{
+		Enabled:             true,
+		ZstdLevel:           3,
+		AnchorInterval:      4,
+		KeepChains:          2,
+		FileSizeCap:         1024 * 1024,
+		PerFileDiskBudget:   1024 * 1024,
+		PerServerDiskBudget: 1024 * 1024,
+	}
+
+	first := []byte("motd=first\n")
+	firstID, err := store.record("/server.properties", nil, first, "user-a", cfg)
+	if err != nil {
+		t.Fatalf("failed to record initial revision: %v", err)
+	}
+
+	fileID, err := findHistoryFile(db, "/server.properties")
+	if err != nil {
+		t.Fatalf("failed to find file: %v", err)
+	}
+	if _, err := db.Exec(`
+		INSERT INTO revisions(file_id, chain_id, created, size, user_id, base_id, payload, content_hash)
+		VALUES (?, ?, ?, ?, ?, ?, ?, ?)`,
+		fileID, firstID, time.Now().UTC().UnixMilli(), len(first), "user-a", firstID, []byte("not a zstd delta"), contentHash(first)); err != nil {
+		t.Fatalf("failed to insert corrupt revision: %v", err)
+	}
+
+	after := []byte("motd=recovered\n")
+	recoveredID, err := store.record("/server.properties", first, after, "user-b", cfg)
+	if err != nil {
+		t.Fatalf("failed to record after corrupt latest revision: %v", err)
+	}
+
+	content, err := reconstructHistoryRevision(db, recoveredID, cfg.ZstdLevel)
+	if err != nil {
+		t.Fatalf("failed to reconstruct recovered revision: %v", err)
+	}
+	if !bytes.Equal(content, after) {
+		t.Fatal("recovered revision content does not match")
+	}
+}
diff --git a/server/file_operations.go b/server/file_operations.go
new file mode 100644
index 00000000..75a73a9d
--- /dev/null
+++ b/server/file_operations.go
@@ -0,0 +1,213 @@
+package server
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"sync"
+	"sync/atomic"
+	"time"
+
+	"github.com/google/uuid"
+)
+
+const maxFileOperationsPerServer = 64
+
+var (
+	ErrFileOperationLimit    = errors.New("too many file operations are active")
+	ErrFileOperationCanceled = errors.New("operation cancelled")
+)
+
+type FileOperationSnapshot struct {
+	Type           string    `json:"type"`
+	ServerUUID     string    `json:"server_uuid"`
+	StartTime      time.Time `json:"start_time"`
+	BytesProcessed uint64    `json:"bytes_processed"`
+	BytesTotal     uint64    `json:"bytes_total"`
+	FilesProcessed uint64    `json:"files_processed"`
+	Cancelled      bool      `json:"cancelled"`
+}
+
+type FileOperation struct {
+	identifier string
+	typ        string
+	serverUUID string
+	startTime  time.Time
+	cancel     context.CancelFunc
+
+	bytesProcessed atomic.Uint64
+	bytesTotal     atomic.Uint64
+	filesProcessed atomic.Uint64
+	cancelled      atomic.Bool
+}
+
+func (o *FileOperation) Identifier() string { return o.identifier }
+
+func (o *FileOperation) AddBytesProcessed(value uint64) {
+	o.bytesProcessed.Add(value)
+}
+
+func (o *FileOperation) SetBytesTotal(value uint64) {
+	o.bytesTotal.Store(value)
+}
+
+func (o *FileOperation) AddFilesProcessed(value uint64) {
+	o.filesProcessed.Add(value)
+}
+
+func (o *FileOperation) Snapshot() FileOperationSnapshot {
+	return FileOperationSnapshot{
+		Type:           o.typ,
+		ServerUUID:     o.serverUUID,
+		StartTime:      o.startTime,
+		BytesProcessed: o.bytesProcessed.Load(),
+		BytesTotal:     o.bytesTotal.Load(),
+		FilesProcessed: o.filesProcessed.Load(),
+		Cancelled:      o.cancelled.Load(),
+	}
+}
+
+type FileOperationManager struct {
+	server *Server
+
+	mu         sync.RWMutex
+	operations map[string]*FileOperation
+}
+
+func NewFileOperationManager(server *Server) *FileOperationManager {
+	return &FileOperationManager{server: server, operations: make(map[string]*FileOperation)}
+}
+
+// Start registers and runs one bounded, server-local file operation. The
+// returned channel always receives exactly one terminal result.
+func (m *FileOperationManager) Start(
+	parent context.Context,
+	typ string,
+	work func(context.Context, *FileOperation) error,
+) (*FileOperation, <-chan error, error) {
+	if parent == nil {
+		parent = m.server.Context()
+	}
+
+	ctx, cancel := context.WithCancel(m.server.Context())
+	stopParent := context.AfterFunc(parent, cancel)
+	op := &FileOperation{
+		identifier: uuid.NewString(),
+		typ:        typ,
+		serverUUID: m.server.ID(),
+		startTime:  time.Now().UTC(),
+		cancel:     cancel,
+	}
+
+	m.mu.Lock()
+	if len(m.operations) >= maxFileOperationsPerServer {
+		m.mu.Unlock()
+		stopParent()
+		cancel()
+		return nil, nil, ErrFileOperationLimit
+	}
+	m.operations[op.identifier] = op
+	m.mu.Unlock()
+
+	result := make(chan error, 1)
+	go func() {
+		defer stopParent()
+		defer cancel()
+
+		progressDone := make(chan struct{})
+		progressStopped := make(chan struct{})
+		go m.publishProgressUntilDone(op, progressDone, progressStopped)
+		err := work(ctx, op)
+		close(progressDone)
+		<-progressStopped
+
+		m.mu.Lock()
+		delete(m.operations, op.identifier)
+		cancelled := op.cancelled.Load() || ctx.Err() != nil
+		m.mu.Unlock()
+
+		switch {
+		case cancelled:
+			err = ErrFileOperationCanceled
+			m.publishArgs(OperationErrorEvent, op.identifier, ErrFileOperationCanceled.Error())
+		case err != nil:
+			m.server.Log().WithError(err).WithField("operation", op.identifier).Warn("file operation failed")
+			m.publishArgs(OperationErrorEvent, op.identifier, safeFileOperationError(err))
+		default:
+			m.publishArgs(OperationCompletedEvent, op.identifier)
+		}
+
+		result <- err
+		close(result)
+	}()
+
+	return op, result, nil
+}
+
+func (m *FileOperationManager) publishProgressUntilDone(op *FileOperation, done <-chan struct{}, stopped chan<- struct{}) {
+	defer close(stopped)
+	m.publishProgress(op)
+	ticker := time.NewTicker(time.Second)
+	defer ticker.Stop()
+	for {
+		select {
+		case <-done:
+			return
+		case <-ticker.C:
+			m.publishProgress(op)
+		}
+	}
+}
+
+func (m *FileOperationManager) publishProgress(op *FileOperation) {
+	payload, err := json.Marshal(op.Snapshot())
+	if err != nil {
+		return
+	}
+	m.publishArgs(OperationProgressEvent, op.identifier, string(payload))
+}
+
+func (m *FileOperationManager) publishArgs(event string, args ...string) {
+	m.server.Events().Publish(event, args)
+}
+
+func (m *FileOperationManager) Cancel(identifier string) bool {
+	m.mu.RLock()
+	op, ok := m.operations[identifier]
+	if ok {
+		op.cancelled.Store(true)
+		op.cancel()
+	}
+	m.mu.RUnlock()
+	return ok
+}
+
+func (m *FileOperationManager) CancelAll() {
+	m.mu.RLock()
+	for _, op := range m.operations {
+		op.cancelled.Store(true)
+		op.cancel()
+	}
+	m.mu.RUnlock()
+}
+
+func (m *FileOperationManager) Has(identifier string) bool {
+	m.mu.RLock()
+	_, ok := m.operations[identifier]
+	m.mu.RUnlock()
+	return ok
+}
+
+func (m *FileOperationManager) Count() int {
+	m.mu.RLock()
+	count := len(m.operations)
+	m.mu.RUnlock()
+	return count
+}
+
+func safeFileOperationError(err error) string {
+	if errors.Is(err, context.Canceled) || errors.Is(err, ErrFileOperationCanceled) {
+		return ErrFileOperationCanceled.Error()
+	}
+	return "file operation failed"
+}
diff --git a/server/file_operations_test.go b/server/file_operations_test.go
new file mode 100644
index 00000000..727a06c8
--- /dev/null
+++ b/server/file_operations_test.go
@@ -0,0 +1,150 @@
+package server
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/require"
+
+	wingsevents "github.com/pterodactyl/wings/events"
+)
+
+func testOperationServer(t *testing.T, id string) *Server {
+	t.Helper()
+	s, err := New(nil)
+	require.NoError(t, err)
+	s.cfg.Uuid = id
+	t.Cleanup(s.CtxCancel)
+	return s
+}
+
+func waitForOperationEvent(t *testing.T, events <-chan []byte, topic string) wingsevents.Event {
+	t.Helper()
+	timer := time.NewTimer(3 * time.Second)
+	defer timer.Stop()
+	for {
+		select {
+		case raw := <-events:
+			event := wingsevents.MustDecode(raw)
+			if event.Topic == topic {
+				return event
+			}
+		case <-timer.C:
+			t.Fatalf("timed out waiting for %q", topic)
+		}
+	}
+}
+
+func operationEventArgs(t *testing.T, event wingsevents.Event) []string {
+	t.Helper()
+	values, ok := event.Data.([]interface{})
+	require.True(t, ok)
+	args := make([]string, len(values))
+	for index, value := range values {
+		args[index], ok = value.(string)
+		require.True(t, ok)
+	}
+	return args
+}
+
+func TestFileOperationProgressCompletionAndCleanup(t *testing.T) {
+	s := testOperationServer(t, "server-a")
+	eventChannel := make(chan []byte, 16)
+	s.Events().On(eventChannel)
+	t.Cleanup(func() { s.Events().Off(eventChannel) })
+
+	op, done, err := s.FileOperations().Start(context.Background(), "copy_many", func(_ context.Context, operation *FileOperation) error {
+		operation.SetBytesTotal(500)
+		operation.AddBytesProcessed(100)
+		operation.AddFilesProcessed(2)
+		return nil
+	})
+	require.NoError(t, err)
+	require.NoError(t, <-done)
+
+	progress := waitForOperationEvent(t, eventChannel, OperationProgressEvent)
+	args := operationEventArgs(t, progress)
+	require.Len(t, args, 2)
+	require.Equal(t, op.Identifier(), args[0])
+	var snapshot FileOperationSnapshot
+	require.NoError(t, json.Unmarshal([]byte(args[1]), &snapshot))
+	require.Equal(t, "copy_many", snapshot.Type)
+	require.Equal(t, "server-a", snapshot.ServerUUID)
+
+	completed := waitForOperationEvent(t, eventChannel, OperationCompletedEvent)
+	require.Equal(t, []string{op.Identifier()}, operationEventArgs(t, completed))
+	require.Eventually(t, func() bool { return s.FileOperations().Count() == 0 }, time.Second, time.Millisecond)
+}
+
+func TestFileOperationErrorAndCleanup(t *testing.T) {
+	s := testOperationServer(t, "server-errors")
+	eventChannel := make(chan []byte, 16)
+	s.Events().On(eventChannel)
+	t.Cleanup(func() { s.Events().Off(eventChannel) })
+
+	op, done, err := s.FileOperations().Start(context.Background(), "copy_many", func(context.Context, *FileOperation) error {
+		return errors.New("/host/private/path")
+	})
+	require.NoError(t, err)
+	require.Error(t, <-done)
+	event := waitForOperationEvent(t, eventChannel, OperationErrorEvent)
+	require.Equal(t, []string{op.Identifier(), "file operation failed"}, operationEventArgs(t, event))
+	require.Zero(t, s.FileOperations().Count())
+}
+
+func TestFileOperationCancellationAndServerIsolation(t *testing.T) {
+	first := testOperationServer(t, "server-first")
+	second := testOperationServer(t, "server-second")
+	eventChannel := make(chan []byte, 16)
+	first.Events().On(eventChannel)
+	t.Cleanup(func() { first.Events().Off(eventChannel) })
+
+	started := make(chan struct{})
+	op, done, err := first.FileOperations().Start(context.Background(), "copy_many", func(ctx context.Context, operation *FileOperation) error {
+		close(started)
+		for {
+			select {
+			case <-ctx.Done():
+				return ctx.Err()
+			default:
+				operation.AddBytesProcessed(1)
+			}
+		}
+	})
+	require.NoError(t, err)
+	<-started
+	require.False(t, second.FileOperations().Cancel(op.Identifier()))
+	require.True(t, first.FileOperations().Cancel(op.Identifier()))
+	require.ErrorIs(t, <-done, ErrFileOperationCanceled)
+	event := waitForOperationEvent(t, eventChannel, OperationErrorEvent)
+	require.Equal(t, []string{op.Identifier(), "operation cancelled"}, operationEventArgs(t, event))
+	require.Zero(t, first.FileOperations().Count())
+}
+
+func TestFileOperationRaceSafeProgress(t *testing.T) {
+	s := testOperationServer(t, "server-race")
+	var readers sync.WaitGroup
+	op, done, err := s.FileOperations().Start(context.Background(), "copy_many", func(_ context.Context, operation *FileOperation) error {
+		for i := 0; i < 10000; i++ {
+			operation.AddBytesProcessed(1)
+			operation.AddFilesProcessed(1)
+		}
+		return nil
+	})
+	require.NoError(t, err)
+	for i := 0; i < 8; i++ {
+		readers.Add(1)
+		go func() {
+			defer readers.Done()
+			for j := 0; j < 1000; j++ {
+				_ = op.Snapshot()
+			}
+		}()
+	}
+	readers.Wait()
+	require.NoError(t, <-done)
+}
diff --git a/server/filesystem/replace.go b/server/filesystem/replace.go
new file mode 100644
index 00000000..e13edc4b
--- /dev/null
+++ b/server/filesystem/replace.go
@@ -0,0 +1,124 @@
+package filesystem
+
+import (
+	"errors"
+	"path/filepath"
+
+	"golang.org/x/sys/unix"
+
+	"github.com/pterodactyl/wings/internal/ufs"
+)
+
+// RenameNoReplace atomically moves a regular file or directory while refusing
+// to replace any destination that appears concurrently. This closes the
+// lstat-then-rename race in bulk rename requests.
+func (fs *Filesystem) RenameNoReplace(oldpath, newpath string) error {
+	if oldpath == newpath {
+		return nil
+	}
+
+	olddirfd, oldname, closeOld, err := fs.unixFS.SafePath(oldpath)
+	defer closeOld()
+	if err != nil {
+		return err
+	}
+	if oldname == "." {
+		return ufs.ErrBadPathResolution
+	}
+	oldInfo, err := fs.unixFS.Lstatat(olddirfd, oldname)
+	if err != nil {
+		return err
+	}
+	if oldInfo.Mode()&ufs.ModeSymlink != 0 || (!oldInfo.IsDir() && !oldInfo.Mode().IsRegular()) {
+		return ufs.ErrBadPathResolution
+	}
+
+	newdirfd, newname, closeNew, err := fs.unixFS.SafePath(newpath)
+	if err != nil {
+		closeNew()
+		if !errors.Is(err, ufs.ErrNotExist) {
+			return err
+		}
+		if err := fs.mkdirAll(filepath.Dir(newpath), 0o755); err != nil {
+			return err
+		}
+		newdirfd, newname, closeNew, err = fs.unixFS.SafePath(newpath)
+		if err != nil {
+			closeNew()
+			return err
+		}
+	}
+	defer closeNew()
+	if newname == "." {
+		return ufs.ErrBadPathResolution
+	}
+
+	for {
+		err = unix.Renameat2(olddirfd, oldname, newdirfd, newname, unix.RENAME_NOREPLACE)
+		if err == unix.EINTR {
+			continue
+		}
+		if err != nil {
+			return &ufs.LinkError{Op: "rename", Old: oldpath, New: newpath, Err: err}
+		}
+		return nil
+	}
+}
+
+// Replace atomically renames a regular temporary file over a regular target.
+// It is used by streamed copies so a cancelled or failed copy never exposes a
+// partially written destination. Quota usage for the replaced inode is removed
+// only after the atomic rename succeeds.
+func (fs *Filesystem) Replace(oldpath, newpath string) error {
+	olddirfd, oldname, closeOld, err := fs.unixFS.SafePath(oldpath)
+	defer closeOld()
+	if err != nil {
+		return err
+	}
+	if oldname == "." {
+		return ufs.ErrBadPathResolution
+	}
+	oldInfo, err := fs.unixFS.Lstatat(olddirfd, oldname)
+	if err != nil {
+		return err
+	}
+	if !oldInfo.Mode().IsRegular() {
+		return ufs.ErrBadPathResolution
+	}
+
+	newdirfd, newname, closeNew, err := fs.unixFS.SafePath(newpath)
+	defer closeNew()
+	if err != nil {
+		return err
+	}
+	if newname == "." {
+		return ufs.ErrBadPathResolution
+	}
+
+	var replacedSize int64
+	newInfo, statErr := fs.unixFS.Lstatat(newdirfd, newname)
+	switch {
+	case statErr == nil:
+		if !newInfo.Mode().IsRegular() {
+			return ufs.ErrBadPathResolution
+		}
+		replacedSize = newInfo.Size()
+	case !errors.Is(statErr, ufs.ErrNotExist):
+		return statErr
+	}
+
+	for {
+		err = unix.Renameat(olddirfd, oldname, newdirfd, newname)
+		if err == unix.EINTR {
+			continue
+		}
+		if err != nil {
+			return &ufs.LinkError{Op: "replace", Old: oldpath, New: newpath, Err: err}
+		}
+		break
+	}
+	if replacedSize > 0 {
+		fs.adjustDisk(-replacedSize)
+	}
+	return nil
+}
diff --git a/server/filesystem/upload.go b/server/filesystem/upload.go
new file mode 100644
index 00000000..64f20bae
--- /dev/null
+++ b/server/filesystem/upload.go
@@ -0,0 +1,112 @@
+package filesystem
+
+import (
+	"errors"
+	"io"
+	"io/fs"
+	"strings"
+
+	"golang.org/x/sys/unix"
+
+	"github.com/pterodactyl/wings/config"
+	"github.com/pterodactyl/wings/internal/ufs"
+)
+
+// WriteUpload writes a regular upload through pinned directory descriptors.
+// Every component is opened separately with O_NOFOLLOW, including on kernels
+// without openat2. Quota growth is reserved before truncating the destination.
+func (f *Filesystem) WriteUpload(name string, source io.Reader, size int64) (err error) {
+	name = strings.TrimPrefix(name, "/")
+	if size < 0 || !fs.ValidPath(name) || name == "." || strings.ContainsAny(name, "\\\x00") {
+		return ufs.ErrBadPathResolution
+	}
+	parts := strings.Split(name, "/")
+	for i := range parts {
+		prefix := strings.Join(parts[:i+1], "/")
+		if err := f.IsIgnored(prefix, "/"+prefix); err != nil {
+			return err
+		}
+	}
+	if err := f.HasSpaceFor(0); err != nil {
+		return err
+	}
+	parent, err := f.unixFS.OpenFile(".", ufs.O_DIRECTORY|ufs.O_RDONLY, 0)
+	if err != nil {
+		return err
+	}
+	defer func() { _ = parent.Close() }()
+	uid, gid := config.Get().System.User.Uid, config.Get().System.User.Gid
+	for _, component := range parts[:len(parts)-1] {
+		child, openErr := f.unixFS.OpenFileat(int(parent.Fd()), component, ufs.O_DIRECTORY|ufs.O_RDONLY|ufs.O_NOFOLLOW, 0)
+		if errors.Is(openErr, ufs.ErrNotExist) {
+			created := false
+			if mkdirErr := f.unixFS.Mkdirat(int(parent.Fd()), component, 0o755); mkdirErr == nil {
+				created = true
+			} else if !errors.Is(mkdirErr, ufs.ErrExist) {
+				return mkdirErr
+			}
+			child, openErr = f.unixFS.OpenFileat(int(parent.Fd()), component, ufs.O_DIRECTORY|ufs.O_RDONLY|ufs.O_NOFOLLOW, 0)
+			if openErr == nil && created && !f.isTest {
+				if err := unix.Fchown(int(child.Fd()), uid, gid); err != nil {
+					_ = child.Close()
+					return err
+				}
+			}
+		}
+		if openErr != nil {
+			return openErr
+		}
+		_ = parent.Close()
+		parent = child
+	}
+	// O_NONBLOCK avoids blocking on a raced-in FIFO. Do not truncate until the
+	// opened inode is verified as regular and its quota growth is reserved.
+	file, err := f.unixFS.OpenFileat(int(parent.Fd()), parts[len(parts)-1], ufs.O_CREATE|ufs.O_RDWR|ufs.O_NOFOLLOW|unix.O_NONBLOCK, 0o644)
+	if err != nil {
+		return err
+	}
+	defer func() {
+		if closeErr := file.Close(); err == nil {
+			err = closeErr
+		}
+	}()
+	info, err := file.Stat()
+	if err != nil {
+		return err
+	}
+	var stat unix.Stat_t
+	if err := unix.Fstat(int(file.Fd()), &stat); err != nil {
+		return err
+	}
+	if !info.Mode().IsRegular() || stat.Nlink != 1 {
+		return ufs.ErrBadPathResolution
+	}
+	growth := size - info.Size()
+	if err := f.HasSpaceFor(growth); err != nil {
+		return err
+	}
+	reserved := int64(0)
+	if growth > 0 {
+		if err := f.reserveDisk(growth); err != nil {
+			return err
+		}
+		reserved = growth
+	}
+	defer func() {
+		if after, statErr := file.Stat(); statErr == nil {
+			f.adjustDisk(after.Size() - info.Size() - reserved)
+		} else if err == nil {
+			err = statErr
+		}
+	}()
+	if err := file.Truncate(0); err != nil {
+		return err
+	}
+	if _, err := io.CopyN(file, source, size); err != nil {
+		return err
+	}
+	if !f.isTest {
+		return unix.Fchown(int(file.Fd()), uid, gid)
+	}
+	return nil
+}
diff --git a/server/filesystem/upload_test.go b/server/filesystem/upload_test.go
new file mode 100644
index 00000000..dbf937f7
--- /dev/null
+++ b/server/filesystem/upload_test.go
@@ -0,0 +1,111 @@
+package filesystem
+
+import (
+	"bytes"
+	"io"
+	"os"
+	"path/filepath"
+	"sync"
+	"sync/atomic"
+	"testing"
+
+	"github.com/pterodactyl/wings/config"
+	"github.com/pterodactyl/wings/internal/ufs"
+	"github.com/stretchr/testify/require"
+	"golang.org/x/sys/unix"
+)
+
+func uploadTestFilesystem(t *testing.T, openat2 bool, limit int64, ignored ...string) *Filesystem {
+	t.Helper()
+	config.Set(&config.Configuration{AuthenticationToken: "upload-test"})
+	f, err := New(t.TempDir(), limit, ignored)
+	require.NoError(t, err)
+	f.unixFS.UnixFS, err = ufs.NewUnixFS(f.Path(), openat2)
+	require.NoError(t, err)
+	f.isTest = true
+	return f
+}
+
+func TestWriteUploadRejectsLinksAndSpecialFilesAtTheSink(t *testing.T) {
+	for _, openat2 := range []bool{false, true} {
+		t.Run(map[bool]string{true: "openat2", false: "openat"}[openat2], func(t *testing.T) {
+			f := uploadTestFilesystem(t, openat2, 100, "protected")
+			outside := t.TempDir()
+			require.NoError(t, os.WriteFile(filepath.Join(outside, "file"), []byte("outside"), 0o600))
+			require.NoError(t, os.MkdirAll(filepath.Join(f.Path(), "protected/nested"), 0o755))
+			require.NoError(t, os.WriteFile(filepath.Join(f.Path(), "protected/nested/file"), []byte("inside"), 0o600))
+			require.NoError(t, os.Symlink(outside, filepath.Join(f.Path(), "escape")))
+			require.NoError(t, os.Symlink("protected", filepath.Join(f.Path(), "alias")))
+			require.NoError(t, os.Symlink(filepath.Join(outside, "file"), filepath.Join(f.Path(), "leaf")))
+			require.NoError(t, os.Link(filepath.Join(f.Path(), "protected/nested/file"), filepath.Join(f.Path(), "hardlink")))
+			require.NoError(t, unix.Mkfifo(filepath.Join(f.Path(), "fifo"), 0o600))
+			for _, name := range []string{"escape/file", "escape/new/file", "alias/nested/file", "leaf", "hardlink", "fifo", "protected/nested/file"} {
+				require.Error(t, f.WriteUpload(name, bytes.NewBufferString("bad"), 3), name)
+			}
+			data, err := os.ReadFile(filepath.Join(outside, "file"))
+			require.NoError(t, err)
+			require.Equal(t, "outside", string(data))
+			data, err = os.ReadFile(filepath.Join(f.Path(), "protected/nested/file"))
+			require.NoError(t, err)
+			require.Equal(t, "inside", string(data))
+			require.NoDirExists(t, filepath.Join(outside, "new"))
+		})
+	}
+}
+
+func TestWriteUploadReservesQuotaAcrossConcurrentFiles(t *testing.T) {
+	f := uploadTestFilesystem(t, false, 10)
+	start := make(chan struct{})
+	var successes atomic.Int32
+	var wg sync.WaitGroup
+	for _, name := range []string{"a", "b", "c", "d"} {
+		wg.Add(1)
+		go func(name string) {
+			defer wg.Done()
+			<-start
+			if err := f.WriteUpload(name, bytes.NewBufferString("1234567890"), 10); err == nil {
+				successes.Add(1)
+			}
+		}(name)
+	}
+	close(start)
+	wg.Wait()
+	require.Equal(t, int32(1), successes.Load())
+	require.Equal(t, int64(10), f.CachedUsage())
+	var actual int64
+	entries, err := os.ReadDir(f.Path())
+	require.NoError(t, err)
+	for _, entry := range entries {
+		info, err := entry.Info()
+		require.NoError(t, err)
+		actual += info.Size()
+	}
+	require.Equal(t, int64(10), actual)
+}
+
+func TestWriteUploadTracksOverwriteShortReadAndParentOwnership(t *testing.T) {
+	f := uploadTestFilesystem(t, false, 10)
+	settings := config.Get()
+	settings.System.User.Uid = os.Getuid()
+	settings.System.User.Gid = os.Getgid()
+	config.Set(settings)
+	f.isTest = false
+	require.NoError(t, f.WriteUpload("a/b/file", bytes.NewBufferString("1234567890"), 10))
+	for _, name := range []string{"a", "a/b", "a/b/file"} {
+		var stat unix.Stat_t
+		require.NoError(t, unix.Stat(filepath.Join(f.Path(), name), &stat))
+		require.Equal(t, uint32(os.Getuid()), stat.Uid)
+		require.Equal(t, uint32(os.Getgid()), stat.Gid)
+	}
+	require.NoError(t, f.WriteUpload("a/b/file", bytes.NewBufferString("12"), 2))
+	require.Equal(t, int64(2), f.CachedUsage())
+	require.ErrorIs(t, f.WriteUpload("a/b/short", bytes.NewBufferString("123"), 8), io.EOF)
+	require.Equal(t, int64(5), f.CachedUsage())
+	require.Error(t, f.WriteUpload("a/b/file", bytes.NewBufferString("1234567890"), 10))
+	data, err := os.ReadFile(filepath.Join(f.Path(), "a/b/file"))
+	require.NoError(t, err)
+	require.Equal(t, "12", string(data))
+	f.SetDiskLimit(-1)
+	require.Error(t, f.WriteUpload("disabled/file", bytes.NewReader(nil), 0))
+	require.NoDirExists(t, filepath.Join(f.Path(), "disabled"))
+}
diff --git a/server/server.go b/server/server.go
index a1777b04..073ec76f 100644
--- a/server/server.go
+++ b/server/server.go
@@ -46,7 +46,8 @@ type Server struct {
 	resources   ResourceUsage
 	Environment environment.ProcessEnvironment `json:"-"`
 
-	fs *filesystem.Filesystem
+	fs             *filesystem.Filesystem
+	fileOperations *FileOperationManager
 
 	// Events emitted by the server instance.
 	emitter *events.Bus
@@ -103,6 +104,7 @@ func New(client remote.Client) (*Server, error) {
 		return nil, errors.Wrap(err, "server: could not set defaults for server configuration")
 	}
 	s.resources.State = system.NewAtomicString(environment.ProcessOfflineState)
+	s.fileOperations = NewFileOperationManager(&s)
 	return &s, nil
 }
 
@@ -111,12 +113,20 @@ func New(client remote.Client) (*Server, error) {
 // processes for the server as well.
 func (s *Server) CleanupForDestroy() {
 	s.CtxCancel()
+	if s.fileOperations != nil {
+		s.fileOperations.CancelAll()
+	}
 	s.Events().Destroy()
 	s.DestroyAllSinks()
 	s.Websockets().CancelAll()
 	s.powerLock.Destroy()
 }
 
+// FileOperations returns the server-isolated manager for cancellable filesystem work.
+func (s *Server) FileOperations() *FileOperationManager {
+	return s.fileOperations
+}
+
 // ID returns the UUID for the server instance.
 func (s *Server) ID() string {
 	return s.Config().GetUuid()