# Description
This is an initial draft of the plugin audit workflow.
It focuses on the user experience and developer-facing permission
workflow. It does not yet include the complete implementation of every
operation that should be audited, such as the full filesystem,
networking, and process-spawning event coverage.
## User workflow
When a plugin is loaded:
1. The plugin’s register_capabilities() function is executed.
2. The plugin declares the permissions it requires.
3. OrcaSlicer displays a permission dialog listing the requested
resources.
4. If the user grants access:
- The permission is persisted in the plugin’s .install_state.json.
- Capability registration continues.
- The plugin is materialized and loaded.
5. If the user denies access:
- Plugin loading fails before capabilities are materialized.
- on_load() is not called.
- The plugin’s install state is marked with "enabled": false to prevent
repeated automatic load attempts.
At runtime, if a plugin accesses a resource that was not approved during
loading, the audit hook displays another permission dialog. For
filesystem requests, the dialog identifies the requested filepath.
- Granting access persists the permission and allows the operation.
- Denying access raises a Python PermissionError.
- The error propagates to the host, which records the failure and
unloads the plugin.
Host-side traceback logging is performed outside the plugin audit
context so that logging does not generate additional permission dialogs.
## Developer-facing API
Plugins can declare filesystem read permissions through the new API:
```python
import orca
AUDIT_PATH = __file__
@orca.plugin
class ExamplePackage(orca.base):
def register_capabilities(self):
orca.request_permissions(
fs_read=[AUDIT_PATH],
)
orca.register_capability(ExampleCapability)
```
orca.request_permissions() must be called from register_capabilities()
while the plugin is being loaded.
Currently supported permission:
orca.request_permissions(fs_read=[...])
The paths should be explicit filesystem paths that the plugin intends to
read. The host deduplicates repeated paths, presents the request after
registration completes, and persists granted paths in the plugin
install-state sidecar. This API is still experimental, and is by no
means the final implementation.
Support for additional permission categories, including filesystem write
access, networking, and process spawning, is reserved for subsequent
work.
# Screenshots/Recordings/Graphs
<!--
> Please attach relevant screenshots to showcase the UI changes.
> Please attach images that can help explain the changes.
-->
<img width="869" height="799" alt="image"
src="https://github.com/user-attachments/assets/8a5903cc-0cbb-45a8-b88a-706d6cba790f"
/>
## Tests
<!--
> Please describe the tests that you have conducted to verify the
changes made in this PR.
-->
<!--
> A guide for users on how to download the artifacts from this PR.
-->
[How to Download Pull Requests Artifacts for
Testing](https://www.orcaslicer.com/wiki/how_to_download_pr_artifacts)
# Description
Printers discovered/bound under one printer agent (e.g. built-in BBL)
were leaking into another, independent agent's "My Device"/"Other
Device" lists and inheriting its saved access code, since neither the
device list nor bind state was ever scoped by which agent found them.
- Add printer_agent_id to MachineObject/BBLocalMachine, stamped at
discovery/bind time; filter get_my_machine_list(),
get_my_cloud_machine_list(), and update_other_devices() by it.
- clear_other_devices() now drops entries stamped by the outgoing
agent on swap, so the incoming agent's own discovery re-inserts and
re-stamps them fresh instead of leaving them stale-tagged forever.
- Scope access_code by (dev_id, printer_agent_id) on BBLocalMachine
(LAN only since cloud's userMachineList is always refreshed live from
the account API, so it isn't at risk the same way), with a
BBL-only legacy fallback to the old flat access_code/user_access_code
keys so existing bindings keep working.
# Screenshots/Recordings/Graphs
<!--
> Please attach relevant screenshots to showcase the UI changes.
> Please attach images that can help explain the changes.
-->
## Tests
<!--
> Please describe the tests that you have conducted to verify the
changes made in this PR.
-->
<!--
> A guide for users on how to download the artifacts from this PR.
-->
[How to Download Pull Requests Artifacts for
Testing](https://www.orcaslicer.com/wiki/how_to_download_pr_artifacts)
# Description
Break the recursive include dependency by moving GUI_App.hpp from
HMS.hpp into HMS.cpp. Add the required standard headers and use explicit
std/nlohmann types to remove reliance on transitive includes.
This prevents recursive header inclusion while preserving HMS
functionality.
# Screenshots/Recordings/Graphs
<!--
> Please attach relevant screenshots to showcase the UI changes.
> Please attach images that can help explain the changes.
-->
## Tests
<!--
> Please describe the tests that you have conducted to verify the
changes made in this PR.
-->
<!--
> A guide for users on how to download the artifacts from this PR.
-->
[How to Download Pull Requests Artifacts for
Testing](https://www.orcaslicer.com/wiki/how_to_download_pr_artifacts)
# Description
This PR enables building OrcaSlicer on Windows with the **clang-cl
(LLVM)**
toolchain and the **Ninja** generator, in addition to the existing MSVC
path.
Clang is already supported on Linux with this codebase, so this extends
that
support to Windows.
The changes fall into three categories. All are either no-ops on the
existing
MSVC/Visual Studio path or Windows/clang-cl-specific, so the standard
build is
not affected.
### 1. C++ conformance fixes
clang-cl is stricter than MSVC and rejects several constructs that
cl.exe
silently accepted. Each of these is non-conforming code that MSVC
tolerated:
* **Explicit template instantiation in `BoundingBox.cpp`** — clang-cl
does not
instantiate `BoundingBoxBase<Point, Points>::construct` through the same
transitive path MSVC uses; added the explicit instantiation.
* **Eigen cast materialization in `AABBTreeLines.hpp`** — `.cast<T>()`
returns a
lazy `CwiseUnaryOp`, not a concrete `Matrix`; materialized it before
passing to
`distance_to_squared`, which expects a concrete type.
* **`LabelItemType` underlying type in `PresetComboBoxes.hpp`** — gave
the enum
the same `std::size_t` underlying type as `Marker` to resolve a
narrowing
conversion in a switch.
* **`T2A_` cast in `BaseException.cpp`** — explicit `static_cast<const
char*>` on
the ATL conversion helper result.
* **Wide string literals in `GUI_App.cpp`** — used `L""` literals where
concatenated with a `std::wstring` (`url_prefix`).
### 2. Build system / dependencies
* **Exclude clang-cl from MSVC-only CMake guards** — `if(MSVC)` is true
for
clang-cl, so blocks applying cl.exe-only flags now exclude Clang.
* **Disable TBB LTCG** — oneTBB enables MSVC IPO/LTCG by default,
emitting
proprietary `/GL` bitcode objects that `lld-link` cannot consume.
Disabling IPO
produces native COFF, linkable by both `link.exe` and `lld-link`. TBB is
threading infrastructure, so the runtime impact of disabling LTCG is
negligible.
* **wxWidgets target path** — clang-cl uses the MSVC frontend variant on
Windows
but reports compiler id `Clang`, so wxWidgets looked under
`clang_x64_lib`
instead of the `vc_x64_lib` layout the deps are built with.
### 3. Ninja generator support
* **Runtime DLL copy** — the DLL copy step was nested under
`CMAKE_CONFIGURATION_TYPES` (multi-config only), so single-config Ninja
skipped
copying OCCT/GMP/MPFR/WebView2/freetype DLLs next to the executable. Now
runs
for both generator styles, guarded by `if(WIN32)`.
* **`build_release_vs.bat` Ninja target** — `ALL_BUILD` is a Visual
Studio
target; Ninja uses `all`. The script failed with
`ninja: error: unknown target 'ALL_BUILD'` when invoked with `-x`.
## Tests
Built from a clean checkout on Windows with:
* clang-cl 22 (LLVM toolchain bundled with Visual Studio 18)
* Ninja Multi-Config generator
* lld-link as the linker
The full build (deps + slicer) compiles, `OrcaSlicer.dll` links with
`lld-link`,
and `orca-slicer.exe` runs. Verified end-to-end by loading a model,
slicing it,
and generating valid G-code (screenshot below).
The existing MSVC / Visual Studio build path is unaffected — all changes
are
guarded by compiler/generator/platform checks or are conformance fixes
that
compile identically under MSVC.
# Screenshots
<img width="1919" height="1079" alt="image"
src="https://github.com/user-attachments/assets/02082437-db36-4696-a91a-d9acf57d4a52"
/>
Ian Chua