Scale to Fit Print Volume: fit the area every nozzle reaches

Each nozzle reaches only part of the bed on a multi-nozzle printer (H2D:
left 0-325, right 25-350 in X), but the command fitted the whole 350 mm
bed. A model that filled the bed in X therefore landed outside both
nozzles' printable range, and right after the user asked to fit it the
plater warned "The position or size of the model exceeds the right
nozzle's printable range".

Fit the volume every nozzle shares instead -- the same region Arrange
already places items in -- and centre on it rather than on the bed.

CMakeLists.txt

@@ -123,7 +123,6 @@ option(SLIC3R_ASAN              "Enable ASan on Clang and GCC" 0)
 
 # Python stubgen module
 option(ORCA_BUILD_PYTHON_STUBGEN_MODULE "Build importable Python module for pybind11-stubgen" ON)
-option(ORCA_BUILD_PLUGIN_PERMISSION_PROBE "Build the headless Python plugin permission probe (developer tool)" OFF)
 set(ORCA_BUNDLED_UV_EXECUTABLE "" CACHE FILEPATH "Path to a uv executable to bundle for Python package installation. Leave empty to auto-download.")
 
 # Auto-download uv if not provided by the user.

build_release_macos.sh

@@ -47,7 +47,7 @@ while getopts ":dpa:snt:xbc:i:j:Tuh" opt; do
     u )
         export BUILD_TARGET="universal"
         ;;
-    h ) echo "Usage: ./build_release_macos.sh [-d] [-- CMAKE_ARGS...]"
+    h ) echo "Usage: ./build_release_macos.sh [-d]"
         echo "   -d: Build deps only"
         echo "   -a: Set ARCHITECTURE (arm64 or x86_64 or universal)"
         echo "   -s: Build slicer only"
@@ -60,33 +60,13 @@ while getopts ":dpa:snt:xbc:i:j:Tuh" opt; do
         echo "   -i: Add a prefix to ignore during CMake dependency discovery (repeatable), defaults to /opt/local:/usr/local:/opt/homebrew"
         echo "   -j: Set the number of parallel build jobs (CMAKE_BUILD_PARALLEL_LEVEL)"
         echo "   -T: Build and run tests (set ORCA_TESTS_BUILD_ONLY=1 to build without running)"
-        echo "   -- CMAKE_ARGS...: pass everything after '--' to the cmake configure step of the deps (-d) and slicer (-s) builds,"
-        echo "       e.g. -DDESTDIR=<dir> for the deps, -DCMAKE_PREFIX_PATH=<dir>/usr/local -DSLIC3R_PCH=OFF for the slicer, --fresh."
-        echo "       They come last on the cmake command line. Use absolute paths: cmake runs in the build directory."
         exit 0
         ;;
-    : )
-        echo "Option -${OPTARG} requires an argument, aborting."
-        exit 1
-        ;;
     * )
-        echo "Unknown option -${OPTARG}, aborting. CMake arguments must follow '--'."
-        exit 1
         ;;
   esac
 done
 
-# getopts stops at '--'; whatever follows is handed to cmake unchanged.
-if [[ ${OPTIND} -le $# ]] ; then
-    separator_index=$((OPTIND-1))
-    if [[ "${!separator_index}" != "--" ]] ; then
-        echo "Unexpected argument '${!OPTIND}': cmake arguments must follow '--', aborting."
-        exit 1
-    fi
-fi
-shift $((OPTIND-1))
-EXTRA_CMAKE_ARGS=("$@")
-
 # Set defaults
 
 if [ -z "$ARCH" ]; then
@@ -231,8 +211,7 @@ function build_deps() {
                         -DCMAKE_OSX_DEPLOYMENT_TARGET="${OSX_DEPLOYMENT_TARGET}" \
                         -DCMAKE_IGNORE_PREFIX_PATH="${CMAKE_IGNORE_PREFIX_PATH}" \
                         "${CMAKE_CCACHE_ARGS[@]}" \
-                        ${CMAKE_POLICY_COMPAT} \
-                        "${EXTRA_CMAKE_ARGS[@]}"
+                        ${CMAKE_POLICY_COMPAT}
                 fi
                 cmake --build . --config "$BUILD_CONFIG" --target deps
             )
@@ -335,8 +314,7 @@ function build_slicer() {
                     -DCMAKE_OSX_DEPLOYMENT_TARGET="${OSX_DEPLOYMENT_TARGET}" \
                     -DCMAKE_IGNORE_PREFIX_PATH="${CMAKE_IGNORE_PREFIX_PATH}" \
                     "${CMAKE_CCACHE_ARGS[@]}" \
-                    ${CMAKE_POLICY_COMPAT} \
-                    "${EXTRA_CMAKE_ARGS[@]}"
+                    ${CMAKE_POLICY_COMPAT}
             fi
             cmake --build . --config "$BUILD_CONFIG" --target "$SLICER_BUILD_TARGET"
         )

localization/i18n/list.txt

@@ -366,7 +366,6 @@ src/slic3r/Utils/MoonrakerPrinterAgent.cpp
 src/slic3r/Utils/BBLNetworkPlugin.cpp
 src/slic3r/Utils/OrcaCloudServiceAgent.cpp
 src/slic3r/plugin/PluginAuditManager.cpp
-src/slic3r/plugin/PluginAuditManagerGui.cpp
 src/slic3r/plugin/PluginConfig.cpp
 src/slic3r/plugin/PluginResolver.cpp
 src/slic3r/plugin/CloudPluginService.cpp

scripts/run_gettext.bat

@@ -23,7 +23,7 @@ if %FULL_MODE%==1 (
     call :prepareGettextList "%list_file%" "%filtered_list%" "%missing_list%"
     if "!has_sources!"=="1" (
         if not exist "%generated_i18n%" mkdir "%generated_i18n%"
-        .\tools\xgettext.exe --keyword=L --keyword=_L --keyword=_u8L --keyword=PLUGIN_U8L --keyword=L_CONTEXT:1,2c --keyword=_L_CONTEXT:1,2c --keyword=_u8L_CONTEXT:1,2c --keyword=_L_PLURAL:1,2 --add-comments=TRN --from-code=UTF-8 --no-location --debug --boost --no-wrap -f "%filtered_list%" -o "%generated_pot%"
+        .\tools\xgettext.exe --keyword=L --keyword=_L --keyword=_u8L --keyword=L_CONTEXT:1,2c --keyword=_L_CONTEXT:1,2c --keyword=_u8L_CONTEXT:1,2c --keyword=_L_PLURAL:1,2 --add-comments=TRN --from-code=UTF-8 --no-location --debug --boost --no-wrap -f "%filtered_list%" -o "%generated_pot%"
         if errorlevel 1 (
             set "script_exit_code=1"
         ) else (

scripts/run_gettext.sh

@@ -85,7 +85,7 @@ if $FULL_MODE; then
         generated_pot_file="${generated_i18n_dir}/OrcaSlicer.pot"
 
         mkdir -p "$generated_i18n_dir"
-        xgettext --keyword=L --keyword=_L --keyword=_u8L --keyword=PLUGIN_U8L --keyword=L_CONTEXT:1,2c --keyword=_L_CONTEXT:1,2c --keyword=_u8L_CONTEXT:1,2c --keyword=_L_PLURAL:1,2 --add-comments=TRN --from-code=UTF-8 --no-location --debug --boost --no-wrap -f "$filtered_list" -o "$generated_pot_file"
+        xgettext --keyword=L --keyword=_L --keyword=_u8L --keyword=L_CONTEXT:1,2c --keyword=_L_CONTEXT:1,2c --keyword=_u8L_CONTEXT:1,2c --keyword=_L_PLURAL:1,2 --add-comments=TRN --from-code=UTF-8 --no-location --debug --boost --no-wrap -f "$filtered_list" -o "$generated_pot_file"
         python3 scripts/HintsToPot.py ./resources "$generated_i18n_dir"
 
         if [ -f "$pot_file" ] && files_equal_ignoring_pot_date "$pot_file" "$generated_pot_file"; then

src/libslic3r/Arrange.cpp

@@ -122,8 +122,8 @@ void update_arrange_params(ArrangeParams& params, const DynamicPrintConfig* prin
 
 void update_selected_items_inflation(ArrangePolygons& selected, const DynamicPrintConfig* print_cfg, ArrangeParams& params) {
     // do not inflate brim_width. Objects are allowed to have overlapped brim.
-    Points      bedpts = get_shrink_bedpts(print_cfg, params);
-    BoundingBox bedbb = Polygon(bedpts).bounding_box();
+    // A brim reaching the printable area's edge is fine, so measure against the full bed.
+    BoundingBox bedbb = Polygon(get_bed_shape(*print_cfg)).bounding_box();
     // set obj distance for auto seq_print
     if (params.is_seq_print) {
         bool all_objects_are_short = std::all_of(selected.begin(), selected.end(), [&](ArrangePolygon& ap) { return ap.height < params.nozzle_height; });
@@ -144,14 +144,30 @@ void update_selected_items_inflation(ArrangePolygons& selected, const DynamicPri
         // 3. otherwise, use each object's own brim width
         ap.inflation = params.min_obj_distance != 0 ? params.min_obj_distance / 2 :
             plate_has_tree_support ? scaled(brim_max / 2) : scaled(ap.brim_width);
-        BoundingBox apbb = ap.poly.contour.bounding_box();
-        auto        diffx = bedbb.size().x() - apbb.size().x() - 5;
-        auto        diffy = bedbb.size().y() - apbb.size().y() - 5;
-        if (diffx > 0 && diffy > 0) {
-            auto min_diff = std::min(diffx, diffy);
-            ap.inflation = std::min(min_diff / 2, ap.inflation);
-        }
+        if (params.min_obj_distance != 0)
+            return; // an explicit object distance is the user's call, not ours to shrink
+        // An item cannot be larger than the printable area, inflation included. Inflating
+        // an almost bed filling item would leave it too big to ever be placed.
+        BoundingBox apbb   = ap.poly.contour.bounding_box();
+        auto        diffx  = bedbb.size().x() - apbb.size().x();
+        auto        diffy  = bedbb.size().y() - apbb.size().y();
+        ap.inflation = std::max<coord_t>(0, std::min({ ap.inflation, diffx / 2, diffy / 2 }));
         });
+
+    // Give the bed margin, which the arrange bed keeps from the printable area, back
+    // where the largest item needs it. The skirt keeps its room: pushing a skirt off
+    // the bed is worse than saying the item does not fit.
+    if (!selected.empty()) {
+        coord_t max_width = 0, max_height = 0;
+        for (const ArrangePolygon &ap : selected) {
+            BoundingBox apbb = ap.poly.contour.bounding_box();
+            max_width        = std::max(max_width, apbb.size().x() + 2 * ap.inflation);
+            max_height       = std::max(max_height, apbb.size().y() + 2 * ap.inflation);
+        }
+        auto margin = [](coord_t bed, coord_t item) { return std::max(0., unscale<double>(bed - item) / 2.); };
+        params.bed_shrink_x = std::min<double>(params.bed_shrink_x, std::max<double>(params.brim_skirt_distance, margin(bedbb.size().x(), max_width)));
+        params.bed_shrink_y = std::min<double>(params.bed_shrink_y, std::max<double>(params.brim_skirt_distance, margin(bedbb.size().y(), max_height)));
+    }
 }
 
 void update_unselected_items_inflation(ArrangePolygons& unselected, const DynamicPrintConfig* print_cfg, const ArrangeParams& params)

src/libslic3r/LayOnFace.cpp

@@ -213,13 +213,29 @@ int find_plane_at_point(const std::vector<LayOnFacePlane> &planes, const Transfo
     return -1;
 }
 
+Transform3d lay_on_face_rotation(const Vec3d &normal, const Transform3d &instance_matrix_no_offset)
+{
+    // Normal in instance coordinates: a normal transforms by the inverse transpose.
+    const Vec3d tnormal = (instance_matrix_no_offset.matrix().block(0, 0, 3, 3).inverse().transpose() * normal).normalized();
+    const Vec3d down    = -Vec3d::UnitZ();
+
+    // A face already pointing straight up needs a half turn, and every horizontal axis does
+    // that equally well. setFromTwoVectors() resolves the choice through an SVD whose null
+    // space is the whole XY plane, so the axis follows rounding noise and the object lands at
+    // an arbitrary angle in the plate plane. Turn it over about X instead, which keeps the
+    // footprint the object already had.
+    if (tnormal.dot(down) < -1. + 1e-9)
+        return Transform3d(Eigen::AngleAxisd(PI, Vec3d::UnitX()));
+
+    return Transform3d(Eigen::Quaterniond().setFromTwoVectors(tnormal, down));
+}
+
 void lay_on_face(ModelObject &object, size_t instance_idx, const Vec3d &normal)
 {
     ModelInstance                  &instance = *object.instances[instance_idx];
     const Geometry::Transformation &trafo    = instance.get_transformation();
-    // Same rotation as Selection::flattening_rotate(): turn the transformed normal to point down.
-    const Vec3d       tnormal  = trafo.get_matrix().matrix().block(0, 0, 3, 3).inverse().transpose() * normal;
-    const Transform3d rotation = Transform3d(Eigen::Quaterniond().setFromTwoVectors(tnormal, -Vec3d::UnitZ()));
+    // Same rotation as Selection::flattening_rotate(), which the gizmo uses.
+    const Transform3d rotation = lay_on_face_rotation(normal, trafo.get_matrix_no_offset());
     instance.set_transformation(Geometry::Transformation(trafo.get_offset_matrix() * rotation * trafo.get_matrix_no_offset()));
     // Drop this instance only: ensure_on_bed() skips instances without auto_drop and measures the first instance.
     object.translate_instance(instance_idx, -object.instance_bounding_box(instance_idx).min.z() * Vec3d::UnitZ());

src/libslic3r/LayOnFace.hpp

@@ -46,4 +46,10 @@ int find_plane_at_point(const std::vector<LayOnFacePlane> &planes, const Transfo
 // the gizmo applies, then drops the instance so its lowest point is at z = 0.
 void lay_on_face(ModelObject &object, size_t instance_idx, const Vec3d &normal);
 
+// The rotation that turns `normal` (object coordinates) to point down, given the instance's
+// rotation, scale and mirror. A face that already points straight up is turned over about X:
+// the axis setFromTwoVectors() picks there is arbitrary, and it lands the object at a random
+// angle in the plate plane.
+Transform3d lay_on_face_rotation(const Vec3d &normal, const Transform3d &instance_matrix_no_offset);
+
 } // namespace Slic3r

src/slic3r/CMakeLists.txt

@@ -707,10 +707,6 @@ set(SLIC3R_GUI_SOURCES
     plugin/PluginManager.hpp
     plugin/PluginAuditManager.cpp
     plugin/PluginAuditManager.hpp
-    plugin/PluginAuditManagerGui.cpp
-    plugin/PluginAuditManagerInternal.hpp
-    plugin/PluginModule.cpp
-    plugin/PluginText.hpp
     plugin/PluginResolver.cpp
     plugin/PluginResolver.hpp
     plugin/pluginTypes/printerAgent/PrinterAgentPluginCapability.hpp
@@ -1096,61 +1092,3 @@ if (ORCA_BUILD_PYTHON_STUBGEN_MODULE)
         PREFIX ""
     )
 endif()
-
-# Headless plugin permission probe. A distinct executable so normal GUI loading and prompt
-# behavior stay untouched. It compiles the GUI-free plugin sources directly instead of linking
-# libslic3r_gui, so neither the GUI library nor wx is pulled into the probe. The permission
-# front end is selected by source composition: PluginAuditManagerGui.cpp for the GUI app and
-# probe/PluginAuditManagerHeadless.cpp here.
-#
-# Residual cost: the probe still links libslic3r (the large core library) for Utils,
-# LifecycleEvents, the model/print types used by the GUI-free host bindings and libslic3r's own
-# transitive dependencies. It does not link libslic3r_gui, wx or the GUI-only host/plugin sources.
-# Developer/security-analysis tool, so it is off by default.
-if (ORCA_BUILD_PLUGIN_PERMISSION_PROBE)
-    add_executable(orca-plugin-probe
-        plugin/PluginPermissionProbe.cpp
-        plugin/PluginProbeCollector.hpp
-        plugin/probe/NanoSvgImplementation.cpp
-        plugin/PluginAuditManager.cpp
-        plugin/PluginAuditManagerInternal.hpp
-        plugin/PluginModule.cpp
-        plugin/PluginText.hpp
-        plugin/probe/PluginAuditManagerHeadless.cpp
-        plugin/PluginFsUtils.cpp
-        plugin/PluginLoader.cpp
-        plugin/PythonInterpreter.cpp
-        plugin/PythonPluginBridge.cpp
-        plugin/probe/PluginHostProbe.cpp
-        plugin/probe/PluginProbeConfig.cpp
-        plugin/host/PluginHostGeometry.cpp
-        plugin/host/PluginHostMesh.cpp
-        plugin/host/PluginHostModel.cpp
-        plugin/host/PluginHostSlicing.cpp
-        plugin/pluginTypes/printerAgent/PrinterAgentPluginCapability.cpp
-        plugin/pluginTypes/pages/PagesPluginCapability.cpp
-        plugin/pluginTypes/resourceTexture/ResourceTexturePluginCapability.cpp
-        plugin/pluginTypes/script/ScriptPluginCapability.cpp
-        plugin/pluginTypes/slicingPipeline/SlicingPipelinePluginCapability.cpp
-    )
-
-    target_compile_definitions(orca-plugin-probe PRIVATE ORCA_PLUGIN_PROBE_BUILD)
-
-    target_include_directories(orca-plugin-probe PRIVATE
-        ${CMAKE_CURRENT_SOURCE_DIR}
-        ${CMAKE_CURRENT_BINARY_DIR}
-        ${CMAKE_SOURCE_DIR}/src
-        Utils
-    )
-
-    target_link_libraries(orca-plugin-probe PRIVATE
-        libslic3r
-        nanosvg
-        pybind11::embed
-    )
-
-    set_target_properties(orca-plugin-probe PROPERTIES
-        OUTPUT_NAME orca-plugin-probe
-        FOLDER "tools"
-    )
-endif()

src/slic3r/GUI/Jobs/ArrangeJob.cpp

@@ -771,6 +771,17 @@ void ArrangeJob::finalize(bool canceled, std::exception_ptr &eptr) {
     if (canceled || eptr)
         return;
 
+    // Nothing could be placed: leave the plates and the instances exactly as they were.
+    // Rebuilding the plates would only re-home the instances by their bounds, which moves
+    // a too large item to whichever plate it happens to reach over.
+    const bool nothing_arranged = !m_selected.empty() &&
+        std::all_of(m_selected.begin(), m_selected.end(), [](const ArrangePolygon &ap) { return !ap.is_arranged(); });
+    if (nothing_arranged) {
+        m_plater->get_notification_manager()->close_notification_of_type(NotificationType::ArrangeOngoing);
+        m_plater->m_arrange_running.store(false);
+        return;
+    }
+
     // Unprintable items go to the last virtual bed
     int beds = 0;
 
@@ -870,12 +881,13 @@ void ArrangeJob::finalize(bool canceled, std::exception_ptr &eptr) {
     }
     m_plater->get_notification_manager()->close_notification_of_type(NotificationType::ArrangeOngoing);
 
-    //BBS: reload all objects due to arrange
+    //BBS: reload all objects due to arrange. Plates are never recycled here: arranging
+    // must not remove a plate the user created, even when the arrange left it empty.
     if (only_on_partplate) {
-        plate_list.rebuild_plates_after_arrangement(!only_on_partplate, true, current_plate_index);
+        plate_list.rebuild_plates_after_arrangement(false, true, current_plate_index);
     }
     else {
-        plate_list.rebuild_plates_after_arrangement(!only_on_partplate, true);
+        plate_list.rebuild_plates_after_arrangement(false, true);
     }
 
     // unlock the plates we just locked

src/slic3r/GUI/Jobs/FillBedJob.cpp

@@ -248,7 +248,6 @@ void FillBedJob::process(Ctl &ctl)
     if (m_object_idx == -1 || m_selected.empty()) return;
 
     update_arrange_params(params, m_plater->config(), m_selected);
-    m_bedpts = get_shrink_bedpts(m_plater->config(), params);
 
     auto &partplate_list               = m_plater->get_partplate_list();
     auto &print                        = wxGetApp().plater()->get_partplate_list().get_current_fff_print();
@@ -260,6 +259,8 @@ void FillBedJob::process(Ctl &ctl)
 
     update_selected_items_inflation(m_selected, m_plater->config(), params);
     update_unselected_items_inflation(m_unselected, m_plater->config(), params);
+    // After the inflation, which may give back part of the bed margin.
+    m_bedpts = get_shrink_bedpts(m_plater->config(), params);
 
     bool do_stop = false;
     params.stopcondition = [&ctl, &do_stop]() {

src/slic3r/GUI/PartPlate.cpp

@@ -7048,19 +7048,14 @@ void PartPlateList::postprocess_arrange_polygon(arrangement::ArrangePolygon& arr
 {
 	BOOST_LOG_TRIVIAL(debug) << __FUNCTION__ << boost::format(": bed_idx %1%, selected %2%, translation(x) %3%, (y) %4%") % arrange_polygon.bed_idx % selected % unscale<double>(arrange_polygon.translation(X)) % unscale<double>(arrange_polygon.translation(Y));
 
+	// UNARRANGED means the item could not be placed, so it has no bed to map onto and
+	// must be left where the user had it. Moving it to a virtual bed here would shift
+	// it off the plate, because no such plate is created for it afterwards.
+	if (arrange_polygon.bed_idx == arrangement::UNARRANGED)
+		return;
+
 	if ((selected) || (arrange_polygon.bed_idx != PartPlateList::MAX_PLATES_COUNT))
 	{
-		if (arrange_polygon.bed_idx == -1)
-		{
-			// outarea for large object
-			arrange_polygon.bed_idx = m_plate_list.size();
-			BoundingBox apbox = get_extents(arrange_polygon.transformed_poly());  // the item may have been rotated
-			auto        apbox_size = apbox.size();
-
-			arrange_polygon.translation(X) = 0.5 * apbox_size[0];
-			arrange_polygon.translation(Y) = scaled<double>(static_cast<double>(m_plate_depth)) - 0.5 * apbox_size[1];
-		}
-
 		arrange_polygon.row = arrange_polygon.bed_idx / m_plate_cols;
 		arrange_polygon.col = arrange_polygon.bed_idx % m_plate_cols;
 		arrange_polygon.translation(X) += scaled<double>(plate_stride_x() * arrange_polygon.col);

src/slic3r/GUI/Plater.cpp

@@ -11034,7 +11034,17 @@ void Plater::priv::split_volume()
 void Plater::priv::scale_selection_to_fit_print_volume()
 {
 #if ENABLE_ENHANCED_PRINT_VOLUME_FIT
-    this->view3D->get_canvas3d()->get_selection().scale_to_fit_print_volume(this->bed.build_volume());
+    const BuildVolume volume = this->bed.build_volume();
+    // Every plate shares the bed size, but each sits at its own origin: fit onto the
+    // plate the selection is on instead of always onto the first one.
+    PartPlate*    plate      = this->partplate_list.get_curr_plate();
+    const Vec3d   bed_center = plate != nullptr ? plate->get_center_origin() :
+                                                  Vec3d(volume.bed_center().x(), volume.bed_center().y(), 0.);
+    // On a multi-nozzle printer each nozzle reaches only part of the bed, so a model fitted
+    // to the bed can still exceed a nozzle's printable range. Fit into the volume every
+    // nozzle shares, which is also the area Arrange places items in.
+    const BoundingBoxf3 print_volume = plate != nullptr ? plate->get_build_volume(true) : volume.bounding_volume();
+    this->view3D->get_canvas3d()->get_selection().scale_to_fit_print_volume(volume, Vec2d(bed_center.x(), bed_center.y()), print_volume);
 #else
     this->view3D->get_canvas3d()->get_selection().scale_to_fit_print_volume(*config);
 #endif // ENABLE_ENHANCED_PRINT_VOLUME_FIT

src/slic3r/GUI/Selection.cpp

@@ -17,6 +17,7 @@
 #include "libslic3r/Color.hpp"
 #include "libslic3r/Point.hpp"
 #include "libslic3r/Geometry.hpp"
+#include "libslic3r/LayOnFace.hpp"
 #include "slic3r/GUI/GLModel.hpp"
 #include <string>
 #include <vector>
@@ -1472,11 +1473,9 @@ void Selection::flattening_rotate(const Vec3d& normal)
 
     for (unsigned int i : m_list) {
         GLVolume& v = *(*m_volumes)[i];
-        // Normal transformed from the object coordinate space to the world coordinate space.
+        // Additional rotation to align the face normal with the down vector in the world coordinate space.
         const Geometry::Transformation& old_inst_trafo = v.get_instance_transformation();
-        const Vec3d tnormal = old_inst_trafo.get_matrix().matrix().block(0, 0, 3, 3).inverse().transpose() * normal;
-        // Additional rotation to align tnormal with the down vector in the world coordinate space.
-        const Transform3d rotation_matrix = Transform3d(Eigen::Quaterniond().setFromTwoVectors(tnormal, -Vec3d::UnitZ()));
+        const Transform3d rotation_matrix = lay_on_face_rotation(normal, old_inst_trafo.get_matrix_no_offset());
         v.set_instance_transformation(old_inst_trafo.get_offset_matrix() * rotation_matrix * old_inst_trafo.get_matrix_no_offset());
     }
 
@@ -1496,7 +1495,7 @@ void Selection::scale(const Vec3d& scale, TransformationType transformation_type
 }
 
 #if ENABLE_ENHANCED_PRINT_VOLUME_FIT
-void Selection::scale_to_fit_print_volume(const BuildVolume& volume)
+void Selection::scale_to_fit_print_volume(const BuildVolume& volume, const Vec2d& bed_center, const BoundingBoxf3& print_volume)
 {
     auto fit = [this](double s, Vec3d offset) {
         if (s <= 0.0 || s == 1.0)
@@ -1526,8 +1525,7 @@ void Selection::scale_to_fit_print_volume(const BuildVolume& volume)
         //wxGetApp().obj_manipul()->set_dirty();
     };
 
-    auto fit_rectangle = [this, fit](const BuildVolume& volume) {
-        const BoundingBoxf3 print_volume = volume.bounding_volume();
+    auto fit_rectangle = [this, fit, &print_volume]() {
         const Vec3d print_volume_size = print_volume.size();
 
         // adds 1/100th of a mm on all sides to avoid false out of print volume detections due to floating-point roundings
@@ -1541,7 +1539,7 @@ void Selection::scale_to_fit_print_volume(const BuildVolume& volume)
             fit(std::min(sx, std::min(sy, sz)), print_volume.center() - get_bounding_box().center());
     };
 
-    auto fit_circle = [this, fit](const BuildVolume& volume) {
+    auto fit_circle = [this, fit, &bed_center](const BuildVolume& volume) {
         const Geometry::Circled& print_circle = volume.circle();
         double print_circle_radius = unscale<double>(print_circle.radius);
 
@@ -1572,7 +1570,9 @@ void Selection::scale_to_fit_print_volume(const BuildVolume& volume)
         const double s = std::min(print_circle_radius / circle_radius, volume.printable_height() / max_z);
         const Vec3d sel_center = get_bounding_box().center();
         const Vec3d offset = s * (Vec3d(unscale<double>(circle.center.x()), unscale<double>(circle.center.y()), 0.5 * max_z) - sel_center);
-        const Vec3d print_center = { unscale<double>(print_circle.center.x()), unscale<double>(print_circle.center.y()), 0.5 * volume.printable_height() };
+        // The active plate's bed is the same circle, moved by its centre.
+        const Vec3d plate_shift = Vec3d(bed_center.x() - volume.bed_center().x(), bed_center.y() - volume.bed_center().y(), 0.);
+        const Vec3d print_center = Vec3d(unscale<double>(print_circle.center.x()), unscale<double>(print_circle.center.y()), 0.5 * volume.printable_height()) + plate_shift;
         fit(s, print_center - (sel_center + offset));
     };
 
@@ -1581,7 +1581,7 @@ void Selection::scale_to_fit_print_volume(const BuildVolume& volume)
 
     switch (volume.type())
     {
-    case BuildVolume_Type::Rectangle: { fit_rectangle(volume); break; }
+    case BuildVolume_Type::Rectangle: { fit_rectangle(); break; }
     case BuildVolume_Type::Circle:    { fit_circle(volume); break; }
     default: { break; }
     }

src/slic3r/GUI/Selection.hpp

@@ -354,7 +354,10 @@ public:
     void flattening_rotate(const Vec3d& normal);
     void scale(const Vec3d& scale, TransformationType transformation_type);
 #if ENABLE_ENHANCED_PRINT_VOLUME_FIT
-    void scale_to_fit_print_volume(const BuildVolume& volume);
+    // bed_center is the centre of the plate the selection is on: every plate shares the
+    // bed size, but each sits at its own origin. print_volume is the box the selection must
+    // fit in, which is the area every nozzle reaches rather than the whole bed.
+    void scale_to_fit_print_volume(const BuildVolume& volume, const Vec2d& bed_center, const BoundingBoxf3& print_volume);
 #else
     void scale_to_fit_print_volume(const DynamicPrintConfig& config);
 #endif // ENABLE_ENHANCED_PRINT_VOLUME_FIT

src/slic3r/plugin/PluginAuditManager.cpp

@@ -1,5 +1,4 @@
 #include "PluginAuditManager.hpp"
-#include "PluginAuditManagerInternal.hpp"
 
 #include "../Utils/OrcaCloudServiceAgent.hpp"
 #include "libslic3r/Utils.hpp"
@@ -16,12 +15,25 @@
 #include <cctype>
 #include <cstddef>
 #include <cstdlib>
+#include <future>
 #include <mutex>
+#include <memory>
+#include <slic3r/GUI/BindDialog.hpp>
+#include <slic3r/GUI/GUI_App.hpp>
+#include <slic3r/plugin/PluginFsUtils.hpp>
+#include <slic3r/plugin/PluginManager.hpp>
 #include <string>
 #include <unordered_map>
 #include <unordered_set>
 #include <utility>
 #include <vector>
+#include <wx/app.h>
+#include <wx/event.h>
+#include <wx/msgdlg.h>
+#include <wx/string.h>
+#include <wx/thread.h>
+#include "slic3r/GUI/I18N.hpp"
+#include "slic3r/plugin/PluginDescriptor.hpp"
 #include <Python.h>
 
 namespace Slic3r {
@@ -149,10 +161,8 @@ static bool is_fs_category(AuditEventCategory category)
     }
 }
 
-namespace plugin_audit {
-
 // The category's name in a saved event grant, e.g. "FsRead" in "FsRead:open".
-const char* category_name(AuditEventCategory category)
+static const char* category_name(AuditEventCategory category)
 {
     switch (category) {
     case AuditEventCategory::FsRead:         return "FsRead";
@@ -169,29 +179,6 @@ const char* category_name(AuditEventCategory category)
     return "None";
 }
 
-int report_denied(PluginAuditManager&       mgr,
-                  const std::string&        event_name,
-                  const AuditDecision&      decision,
-                  const std::string&        target)
-{
-    AuditViolation violation;
-    violation.plugin_key = mgr.current_plugin();
-    violation.event_name = event_name;
-    violation.reason     = decision.reason;
-    mgr.report_violation(violation);
-
-    std::string message = "Plugin attempted audited operation \"" + event_name + "\" without permission";
-    if (!decision.reason.empty())
-        message += ": " + decision.reason;
-    if (!target.empty())
-        message += ": " + target;
-
-    PyErr_SetString(PyExc_PermissionError, message.c_str());
-    return -1;
-}
-
-} // namespace plugin_audit
-
 // ---------------------------------------------------------------------------
 // Path safety
 // ---------------------------------------------------------------------------
@@ -260,7 +247,6 @@ bool is_inside_allowed_root(const boost::filesystem::path& candidate, const boos
 
 thread_local std::string PluginAuditManager::m_current_plugin_key = "";
 thread_local std::string PluginAuditManager::m_current_capability_name = "";
-thread_local std::string PluginAuditManager::m_current_audit_phase = "";
 thread_local std::vector<AllowedRoot> PluginAuditManager::m_scoped_allowed_roots;
 thread_local std::vector<PyObject*> PluginAuditManager::m_root_frames;
 thread_local int PluginAuditManager::m_releasing_frames = 0;
@@ -330,76 +316,6 @@ std::string PluginAuditManager::current_capability() const { return m_current_ca
 
 void PluginAuditManager::clear_current_capability() { m_current_capability_name.clear(); }
 
-void PluginAuditManager::set_current_audit_phase(const std::string& phase) { m_current_audit_phase = phase; }
-
-const std::string& PluginAuditManager::current_audit_phase() const { return m_current_audit_phase; }
-
-void PluginAuditManager::clear_current_audit_phase() { m_current_audit_phase.clear(); }
-
-void PluginAuditManager::set_observation_observer(AuditObserver observer)
-{
-    std::lock_guard<std::mutex> lock(m_observer_mutex);
-    m_observation_observer = std::move(observer);
-}
-
-void PluginAuditManager::clear_observation_observer()
-{
-    std::lock_guard<std::mutex> lock(m_observer_mutex);
-    m_observation_observer = nullptr;
-}
-
-bool PluginAuditManager::observation_mode() const
-{
-    std::lock_guard<std::mutex> lock(m_observer_mutex);
-    return static_cast<bool>(m_observation_observer);
-}
-
-// The audit hook holds the GIL here. Copy the observer out before invoking it so a callback that
-// reads the manager cannot deadlock on m_observer_mutex.
-bool PluginAuditManager::record_observation(const std::string&              event_name,
-                                            const std::string&              category,
-                                            const std::vector<std::string>& targets)
-{
-    AuditObserver observer;
-    {
-        std::lock_guard<std::mutex> lock(m_observer_mutex);
-        observer = m_observation_observer;
-    }
-    if (!observer)
-        return false;
-
-    // The observer is called from a CPython C callback; a C++ exception must not unwind through
-    // the audit hook. The probe's collector only allocates, so a throw here is a lost observation,
-    // not a reason to abort the audited operation.
-    try {
-        AuditObservation observation;
-        observation.plugin_key = m_current_plugin_key;
-        observation.capability = m_current_capability_name;
-        observation.phase      = m_current_audit_phase;
-        observation.event_name = event_name;
-        observation.category   = category;
-        observation.targets    = targets;
-        // Probe mode never denies: the hook returns 0 after recording. A later failure of the
-        // surrounding Python operation is reported by the probe's callback/load result, not here.
-        observation.continued = true;
-        observer(observation);
-    } catch (...) {
-    }
-    return true;
-}
-
-ScopedPluginAuditPhase::ScopedPluginAuditPhase(std::string phase)
-    : m_phase(std::move(phase))
-    , m_previous_phase(PluginAuditManager::instance().current_audit_phase())
-{
-    PluginAuditManager::instance().set_current_audit_phase(m_phase);
-}
-
-ScopedPluginAuditPhase::~ScopedPluginAuditPhase()
-{
-    PluginAuditManager::instance().set_current_audit_phase(m_previous_phase);
-}
-
 void PluginAuditManager::add_global_allowed_root(const boost::filesystem::path& root, bool allow_write)
 {
     if (root.empty())
@@ -437,18 +353,16 @@ void PluginAuditManager::add_denied_filename(const std::string& filename)
 std::vector<std::string> PluginAuditManager::default_denied_filenames()
 {
     // AppConfig::config_path() picks .conf vs .ini on the USE_JSON_CONFIG ifdef and the app key
-    // on its mode, and is a non-static member we cannot call without an instance. Denying all
+    // on its mode, and is a non-static member we cannot call without an instance.  Denying all
     // four names is cheaper and more robust than replicating that; the two unused names cost one
-    // string comparison each. Keep the plugin install-state sidecar here too: it controls which
-    // packages load on startup and must remain host-managed. Single-sourced so install_hook() and
-    // the tests seed from the same list and cannot drift apart.
+    // string comparison each.  Single-sourced here so install_hook() and the tests seed from the
+    // same list and cannot drift apart.
     return {
         SLIC3R_APP_KEY ".conf",
         GCODEVIEWER_APP_KEY ".conf",
         SLIC3R_APP_KEY ".ini",
         GCODEVIEWER_APP_KEY ".ini",
         secret_constants::USER_SECRET_FILENAME,
-        ".install_state.json",
     };
 }
 
@@ -620,14 +534,73 @@ bool PluginAuditManager::request_filesystem_read_permissions(const std::string&
     if (plugin_key.empty() || paths.empty())
         return true;
 
-    // Probe mode records the declaration and proceeds. It must not consult the install state,
-    // open the permission dialog, or persist a grant.
-    if (observation_mode()) {
-        record_observation("orca.request_permissions", "FsRead", paths);
+    PluginDescriptor descriptor;
+    if (!PluginManager::instance().try_get_plugin_descriptor(plugin_key, descriptor) || descriptor.plugin_root.empty())
+        return false;
+
+    PluginInstallState state;
+    read_install_state(boost::filesystem::path(descriptor.plugin_root), state);
+
+    std::vector<std::string> missing;
+    for (const std::string& path : paths) {
+        if (std::find(state.permissions.fs_read.begin(), state.permissions.fs_read.end(), path) == state.permissions.fs_read.end())
+            missing.push_back(path);
+    }
+    if (missing.empty())
         return true;
+
+    if (wxTheApp == nullptr || GUI::wxGetApp().is_closing())
+        return false;
+
+    auto show_dialog = [&descriptor, &missing]() {
+        wxString requested_paths;
+        for (const std::string& path : missing)
+            requested_paths += wxString::FromUTF8(path.c_str()) + "\n";
+
+        wxMessageDialog dialog(
+            nullptr,
+            wxString::Format(_L("Plugin \"%s\" requests filesystem read access to:\n%s"),
+                             wxString::FromUTF8(descriptor.name.c_str()), requested_paths),
+            _L("Plugin permissions"),
+            wxYES_NO | wxICON_WARNING);
+        return dialog.ShowModal() == wxID_YES;
+    };
+
+    bool granted = false;
+    if (wxIsMainThread()) {
+        granted = show_dialog();
+    } else {
+        auto result = std::make_shared<std::promise<bool>>();
+        auto future = result->get_future();
+        GUI::wxGetApp().CallAfter([result, descriptor_name = descriptor.name, missing]() {
+            wxString requested_paths;
+            for (const std::string& path : missing)
+                requested_paths += wxString::FromUTF8(path.c_str()) + "\n";
+
+            wxMessageDialog dialog(
+                nullptr,
+                wxString::Format(_L("Plugin \"%s\" requests filesystem read access to:\n%s"),
+                                 wxString::FromUTF8(descriptor_name.c_str()), requested_paths),
+                _L("Plugin permissions"),
+                wxYES_NO | wxICON_WARNING);
+            result->set_value(dialog.ShowModal() == wxID_YES);
+        });
+        granted = future.get();
     }
 
-    return plugin_audit::request_filesystem_read_permissions(plugin_key, paths);
+    if (!granted)
+        return false;
+
+    if (state.plugin_name.empty()) {
+        state.installed_from    = descriptor.is_cloud_plugin() ? "cloud" : "local";
+        state.installed_version = !descriptor.installed_version.empty() ? descriptor.installed_version : descriptor.version;
+        state.plugin_name       = descriptor.name;
+        state.cloud_uuid        = descriptor.cloud_uuid();
+        state.enabled            = true;
+    }
+
+    state.permissions.fs_read.insert(state.permissions.fs_read.end(), missing.begin(), missing.end());
+    return write_install_state(boost::filesystem::path(descriptor.plugin_root), state);
 }
 
 void PluginAuditManager::report_violation(const AuditViolation& violation)
@@ -889,18 +862,239 @@ std::vector<std::string> audit_targets(const std::string& event_name, AuditEvent
     return targets;
 }
 
+// The saved list that grants an event: its category's target list, or the event-grant list for
+// an event with no target. Kept apart, so that no grant doubles as a target of the same name (an
+// os.fork grant is not an os.exec of a command named "os.fork").
+std::vector<std::string>* permission_list_for(AuditEventCategory category, bool by_event, PluginPermissions& permissions)
+{
+    if (by_event)
+        return &permissions.events;
+
+    switch (category) {
+    case AuditEventCategory::FsRead:        return &permissions.fs_read;
+    case AuditEventCategory::FsReadWrite:   return &permissions.fs_readwrite;
+    case AuditEventCategory::Http:          return &permissions.network_http;
+    case AuditEventCategory::Socket:        return &permissions.network_socket;
+    case AuditEventCategory::ProcessCreate: return &permissions.process;
+    case AuditEventCategory::Threading:     return &permissions.threading;
+    case AuditEventCategory::ProcessReplace: return &permissions.process;
+    default:                                return nullptr;
+    }
+}
+
+// An event with no target is granted by its effective category and name, e.g. "FsRead:open"
+// for a read of a file descriptor, which does not grant a write of one ("FsReadWrite:open").
+std::string event_grant_key(AuditEventCategory category, const std::string& event_name)
+{
+    return std::string(category_name(category)) + ":" + event_name;
+}
+
+bool has_permission(const std::vector<std::string>& granted, const std::string& target)
+{
+    return std::find(granted.begin(), granted.end(), target) != granted.end();
+}
+
+bool persist_permission(const std::string&        plugin_key,
+                        PluginInstallState&       state,
+                        std::vector<std::string>& permission_list,
+                        const std::string&        target)
+{
+    PluginDescriptor descriptor;
+    if (!PluginManager::instance().try_get_plugin_descriptor(plugin_key, descriptor) || descriptor.plugin_root.empty())
+        return false;
+
+    // A sandbox plugin may not have a sidecar yet.  Seed the small amount of install metadata
+    // needed by the writer so clicking Yes still creates the JSON file.
+    if (state.plugin_name.empty()) {
+        state.installed_from    = descriptor.is_cloud_plugin() ? "cloud" : "local";
+        state.installed_version = !descriptor.installed_version.empty() ? descriptor.installed_version : descriptor.version;
+        state.plugin_name       = descriptor.name;
+        state.cloud_uuid        = descriptor.cloud_uuid();
+        state.enabled            = true;
+    }
+
+    if (!has_permission(permission_list, target))
+        permission_list.push_back(target);
+    return write_install_state(boost::filesystem::path(descriptor.plugin_root), state);
+}
+
+int report_denied(PluginAuditManager&            mgr,
+                  const std::string&             event_name,
+                  const AuditDecision&           decision,
+                  const std::string&             target = {})
+{
+    AuditViolation violation;
+    violation.plugin_key = mgr.current_plugin();
+    violation.event_name = event_name;
+    violation.reason     = decision.reason;
+    mgr.report_violation(violation);
+
+    std::string message = "Plugin attempted audited operation \"" + event_name + "\" without permission";
+    if (!decision.reason.empty())
+        message += ": " + decision.reason;
+    if (!target.empty())
+        message += ": " + target;
+
+    PyErr_SetString(PyExc_PermissionError, message.c_str());
+    return -1;
+}
+
+wxString audit_message(AuditEventCategory category, const wxString& plugin_name, const wxString& event_name,
+                       const wxString& target_list, size_t target_count)
+{
+    if (target_list.IsEmpty())
+        return wxString::Format(
+            _L("Plugin \"%s\" is requesting permission for the Python audit event \"%s\".\n\n"
+                "This operation does not expose a target the audit hook can display."),
+            plugin_name, event_name);
+
+    switch (category) {
+    case AuditEventCategory::FsRead:
+        return wxString::Format(_L_PLURAL("Plugin \"%s\" is requesting to read the following file:\n%s",
+                                          "Plugin \"%s\" is requesting to read the following files:\n%s", target_count),
+                                plugin_name, target_list);
+    case AuditEventCategory::FsReadWrite:
+        return wxString::Format(_L_PLURAL("Plugin \"%s\" is requesting to read/write the following file:\n%s",
+                                          "Plugin \"%s\" is requesting to read/write the following files:\n%s", target_count),
+                                plugin_name, target_list);
+    case AuditEventCategory::FsCreate:
+        return wxString::Format(_L_PLURAL("Plugin \"%s\" is requesting to create the following file:\n%s",
+                                          "Plugin \"%s\" is requesting to create the following files:\n%s", target_count),
+                                plugin_name, target_list);
+    case AuditEventCategory::FsDelete:
+        return wxString::Format(_L_PLURAL("Plugin \"%s\" is requesting to delete the following file:\n%s",
+                                          "Plugin \"%s\" is requesting to delete the following files:\n%s", target_count),
+                                plugin_name, target_list);
+    case AuditEventCategory::Http:
+        return wxString::Format(_L("Plugin \"%s\" is requesting to make an HTTP request to:\n%s"), plugin_name, target_list);
+    case AuditEventCategory::Socket:
+        return wxString::Format(_L("Plugin \"%s\" is requesting to open a network connection to:\n%s"), plugin_name, target_list);
+    case AuditEventCategory::ProcessCreate:
+        return wxString::Format(_L_PLURAL("Plugin \"%s\" is requesting to run the following command:\n%s",
+                                          "Plugin \"%s\" is requesting to run the following commands:\n%s", target_count),
+                                plugin_name, target_list);
+    case AuditEventCategory::Threading:
+        return wxString::Format(_L("Plugin \"%s\" is requesting permission to create a thread."), plugin_name);
+    case AuditEventCategory::ProcessReplace:
+        return wxString::Format(_L("Plugin \"%s\" is requesting to replace the running application with:\n%s"), plugin_name, target_list);
+    default:
+        return wxString::Format(_L("Plugin \"%s\" is requesting permission for the Python audit event \"%s\"."), plugin_name, event_name);
+    }
+}
+
+// Builds and shows the modal permission prompt. Must run on the GUI thread.
+bool prompt_for_targets(AuditEventCategory category, const std::string& plugin_name, const std::string& event_name,
+                        const std::vector<std::string>& unresolved)
+{
+    wxString target_list;
+    for (const auto& target : unresolved)
+        target_list += wxString::FromUTF8(target.c_str()) + "\n";
+
+    wxMessageDialog dialog(nullptr,
+                           audit_message(category, wxString::FromUTF8(plugin_name.c_str()),
+                                        wxString::FromUTF8(event_name.c_str()), target_list, unresolved.size()),
+                           _L("Plugin permission request"), wxYES_NO | wxICON_WARNING);
+    return dialog.ShowModal() == wxID_YES;
+}
+
+// Records a grant in the plugin's sidecar so it is not asked again. Reads the install state
+// freshly because the async prompt outlives the caller's stack copy of it.
+void persist_grant(const std::string& plugin_key, AuditEventCategory category, bool by_event, const std::vector<std::string>& keys)
+{
+    PluginInstallState state;
+    if (!PluginManager::instance().get_install_state(plugin_key, state))
+        return;
+
+    std::vector<std::string>* permission_list = permission_list_for(category, by_event, state.permissions);
+    if (!permission_list)
+        return;
+
+    for (const auto& key : keys)
+        persist_permission(plugin_key, state, *permission_list, key);
+}
+
+static PluginAuditManager::PermissionPrompt s_permission_prompt_for_testing;
+
+// Asks the user to grant an audited event, returning true when they approve an inline prompt.
+// `keys` are what a Yes saves: the unresolved targets, or the event-grant key when the event has
+// no target (by_event), which the prompt does not show as a target.
+//
+// An audited event can fire on a thread the UI thread may itself be blocked waiting on: the
+// SlicingPipeline hook runs on the slicing worker thread (see PluginHooks.cpp), and
+// BackgroundSlicingProcess::stop()/stop_internal() park the UI thread until that worker stops.
+// Blocking the worker on a marshaled modal -- which is safe for the plugin-load worker that
+// request_filesystem_read_permissions runs on -- would therefore deadlock the application (the
+// invariant PluginHostUi.cpp documents for slicing-hook UI calls). Off the main thread the prompt
+// is therefore posted asynchronously and the current event denied (fail closed, like an unanswered
+// prompt); the grant is persisted once the user accepts, so a later attempt succeeds without
+// re-prompting.
+bool request_permission(AuditEventCategory category, const std::string& plugin_key, const std::string& plugin_name,
+                        const std::string& event_name, bool by_event, const std::vector<std::string>& keys)
+{
+    const std::vector<std::string> shown = by_event ? std::vector<std::string>{} : keys;
+
+    if (s_permission_prompt_for_testing)
+        return s_permission_prompt_for_testing(event_name, shown);
+
+    if (wxTheApp == nullptr || GUI::wxGetApp().is_closing())
+        return false;
+
+    if (wxIsMainThread())
+        return prompt_for_targets(category, plugin_name, event_name, shown);
+
+    GUI::wxGetApp().CallAfter([category, plugin_key, plugin_name, event_name, by_event, keys, shown]() {
+        if (wxTheApp == nullptr || GUI::wxGetApp().is_closing())
+            return;
+        if (prompt_for_targets(category, plugin_name, event_name, shown))
+            persist_grant(plugin_key, category, by_event, keys);
+    });
+    return false;
+}
+
+// Decides an event that no allowed root or running operation covers: a saved grant allows it,
+// otherwise the user is asked and a Yes is saved.
+int decide_audited_event(PluginAuditManager&             mgr,
+                         PluginInstallState&              state,
+                         const std::string&                plugin_key,
+                         const std::string&                plugin_name,
+                         const std::string&                event_name,
+                         AuditEventCategory                category,
+                         const std::vector<std::string>&   targets)
+{
+    const bool                     by_event = targets.empty();
+    const std::vector<std::string> keys     = by_event ? std::vector<std::string>{event_grant_key(category, event_name)} : targets;
+    std::vector<std::string>*      permission_list = permission_list_for(category, by_event, state.permissions);
+
+    std::vector<std::string> unresolved = keys;
+    if (permission_list) {
+        unresolved.clear();
+        for (const auto& key : keys)
+            if (!has_permission(*permission_list, key))
+                unresolved.push_back(key);
+        if (unresolved.empty())
+            return 0;
+    }
+
+    // Letting a root frame go runs finalizers inside a scope destructor or another event's hook,
+    // where no dialog may open: what they do must already be granted.
+    if (mgr.releasing_frames())
+        return report_denied(mgr, event_name, {false, "audit permission required"});
+
+    if (!request_permission(category, plugin_key, plugin_name, event_name, by_event, unresolved))
+        return report_denied(mgr, event_name, {false, "audit permission required"});
+
+    if (permission_list)
+        for (const auto& key : unresolved)
+            persist_permission(plugin_key, state, *permission_list, key);
+    return 0;
+}
+
 // Judges an audited event raised while a plugin context is active.
 int audit_plugin_event(PluginAuditManager& mgr, const std::string& event_name, AuditEventCategory event_type, PyObject* args)
 {
     const bool                      fs_category = is_fs_category(event_type);
     const std::vector<std::string>  targets      = audit_targets(event_name, event_type, args);
 
-    // Probe mode: report the classified event and let it through. Deliberately before the deny
-    // registry and allowed-root checks, so the report covers operations that production would
-    // block as well as those it would allow. No grant is read or written.
-    if (mgr.record_observation(event_name, plugin_audit::category_name(event_type), targets))
-        return 0;
-
     // A denied path (secrets, certificates, config files -- see is_denied_path) is an
     // unconditional block: checked before the running-operation check below, so no granted
     // operation can launder access to one, and before the allowed-root shortcut further down,
@@ -909,7 +1103,7 @@ int audit_plugin_event(PluginAuditManager& mgr, const std::string& event_name, A
     if (fs_category) {
         for (const auto& target : targets) {
             if (mgr.is_denied_path(boost::filesystem::path(target)))
-                return plugin_audit::report_denied(mgr, event_name, {false, "denied path"}, target);
+                return report_denied(mgr, event_name, {false, "denied path"}, target);
         }
     }
 
@@ -934,7 +1128,15 @@ int audit_plugin_event(PluginAuditManager& mgr, const std::string& event_name, A
             return 0;
     }
 
-    const int result = plugin_audit::decide_event(mgr, event_name, event_type, targets);
+    PluginInstallState state;
+    const bool have_install_state = PluginManager::instance().get_install_state(mgr.current_plugin(), state);
+    if (!have_install_state) {
+        BOOST_LOG_TRIVIAL(warning) << __FUNCTION__ << " Failed to get install state for " << mgr.current_plugin();
+    }
+
+    const std::string plugin_name = state.plugin_name.empty() ? mgr.current_plugin() : state.plugin_name;
+
+    const int result = decide_audited_event(mgr, state, mgr.current_plugin(), plugin_name, event_name, event_type, targets);
 
     // A granted operation covers its nested events while it runs. A targetless grant names no
     // operation, so it covers nothing else.
@@ -1021,6 +1223,11 @@ void PluginAuditManager::release_frames(std::vector<PyObject*>& frames)
     PyErr_SetRaisedException(error);
 }
 
+void PluginAuditManager::set_permission_prompt_for_testing(PermissionPrompt prompt)
+{
+    PluginAuditDetail::s_permission_prompt_for_testing = std::move(prompt);
+}
+
 int PluginAuditManager::audit_hook(const char* event, PyObject* args, void* user_data)
 {
     auto* mgr = static_cast<PluginAuditManager*>(user_data);
@@ -1076,9 +1283,8 @@ void PluginAuditManager::install_hook()
     // "cert" denied-path keyword seeded below.
     add_global_allowed_root(resources_dir(), /*allow_write=*/false);
 
-    // The user's app config and cloud credentials live directly inside data_dir(), and plugin
-    // install state lives beneath it, so the root just granted would otherwise expose them to
-    // plugins. Deny them by name.
+    // The user's app config and cloud credentials live directly inside data_dir(), so the
+    // root just granted would otherwise expose them to any plugin.  Deny them by name.
     //
     // Seeded here rather than by each secret's owner because install_hook() runs during lazy
     // interpreter init and therefore provably precedes any plugin bytecode, whereas

src/slic3r/plugin/PluginAuditManager.hpp

@@ -24,19 +24,6 @@ struct AuditViolation {
     std::string            reason;
 };
 
-// One classified CPython audit event observed while the probe is in record-only mode. This is
-// evidence about the code path that ran, not a grant request: the hook allowed the operation to
-// continue and did not consult the permission dialog or the persisted install state.
-struct AuditObservation {
-    std::string              plugin_key;
-    std::string              capability;
-    std::string              phase;
-    std::string              event_name;
-    std::string              category;
-    std::vector<std::string> targets;
-    bool                     continued = true;
-};
-
 // A filesystem root a plugin may access while an audit context is active. allow_write is
 // false for a root that only grants reads (e.g. the bundled, shared resources folder) --
 // a write-shaped event never matches such a root, even though a read-shaped one does.
@@ -150,30 +137,6 @@ public:
     bool request_filesystem_read_permissions(const std::string& plugin_key,
                                              const std::vector<std::string>& paths);
 
-    // --- probe observation mode (thread-safe, never used by the GUI) ---
-    // When an observer is installed, every classified event raised by plugin-authored code is
-    // reported to it and then allowed through (the hook returns 0). The permission dialogs, saved
-    // grants and .install_state.json are never consulted, so this is not a containment boundary.
-    // The observer must not touch Python objects: it runs inside the audit hook with the GIL held.
-    using AuditObserver = std::function<void(const AuditObservation&)>;
-    void set_observation_observer(AuditObserver observer);
-    void clear_observation_observer();
-    bool observation_mode() const;
-
-    // Stop after classification/target extraction; true means an observer consumed the event.
-    // Exposed for the probe and its tests, not for production callers.
-    bool record_observation(const std::string& event_name,
-                            const std::string& category,
-                            const std::vector<std::string>& targets);
-
-    // --- probe phase attribution (thread_local) ---
-    // Labels events for the probe's report. Production leaves it empty. A Python thread spawned by
-    // plugin code inherits no phase, so its events are reported as unattributed rather than being
-    // guessed at.
-    void               set_current_audit_phase(const std::string& phase);
-    const std::string& current_audit_phase() const;
-    void               clear_current_audit_phase();
-
     void report_violation(const AuditViolation& violation);
     bool audit_denial_pending() const;
     void clear_audit_denial();
@@ -215,7 +178,6 @@ private:
 
     static thread_local std::string                   m_current_plugin_key;
     static thread_local std::string                   m_current_capability_name;
-    static thread_local std::string                   m_current_audit_phase;
     static thread_local std::vector<AllowedRoot>       m_scoped_allowed_roots;
     static thread_local std::vector<PyObject*>         m_root_frames; // strong references
     static thread_local int                            m_releasing_frames;
@@ -228,11 +190,6 @@ private:
     std::vector<AllowedRoot>             m_global_allowed_roots;
     std::vector<std::string>             m_denied_filenames;
     std::vector<std::string>             m_denied_path_keywords;
-
-    // Kept apart from m_mutex: observation_mode() is queried from the audit hook while the hook
-    // already holds the GIL, and the setter runs before plugin code starts.
-    mutable std::mutex m_observer_mutex;
-    AuditObserver      m_observation_observer;
 };
 
 // RAII guard that sets the current plugin key and capability name, restoring the previous
@@ -263,22 +220,6 @@ private:
     std::vector<PyObject*>        m_previous_root_frames;
 };
 
-// Sets the probe's phase label on the current thread and restores the previous one on scope exit.
-// Empty in production, where no phase is ever set.
-class ScopedPluginAuditPhase
-{
-public:
-    explicit ScopedPluginAuditPhase(std::string phase);
-    ~ScopedPluginAuditPhase();
-
-    ScopedPluginAuditPhase(const ScopedPluginAuditPhase&)            = delete;
-    ScopedPluginAuditPhase& operator=(const ScopedPluginAuditPhase&) = delete;
-
-private:
-    std::string m_phase;
-    std::string m_previous_phase;
-};
-
 } // namespace Slic3r
 
 #endif // slic3r_PluginAuditManager_hpp_

src/slic3r/plugin/PluginAuditManagerGui.cpp

@@ -1,332 +0,0 @@
-#include "PluginAuditManagerInternal.hpp"
-
-#include "PluginDescriptor.hpp"
-#include "PluginFsUtils.hpp"
-#include "PluginManager.hpp"
-
-#include <boost/filesystem.hpp>
-#include <boost/filesystem/path.hpp>
-#include <boost/log/trivial.hpp>
-
-#include <algorithm>
-#include <cstddef>
-#include <future>
-#include <memory>
-#include <slic3r/plugin/PluginAuditManager.hpp>
-#include <string>
-#include <utility>
-#include <vector>
-
-#include <slic3r/GUI/GUI_App.hpp>
-#include <slic3r/GUI/I18N.hpp>
-
-#include <wx/app.h>
-#include <wx/msgdlg.h>
-#include <wx/string.h>
-#include <wx/thread.h>
-
-namespace Slic3r {
-namespace {
-
-// The saved list that grants an event: its category's target list, or the event-grant list for
-// an event with no target. Kept apart, so that no grant doubles as a target of the same name (an
-// os.fork grant is not an os.exec of a command named "os.fork").
-std::vector<std::string>* permission_list_for(AuditEventCategory category, bool by_event, PluginPermissions& permissions)
-{
-    if (by_event)
-        return &permissions.events;
-
-    switch (category) {
-    case AuditEventCategory::FsRead:        return &permissions.fs_read;
-    case AuditEventCategory::FsReadWrite:   return &permissions.fs_readwrite;
-    case AuditEventCategory::Http:          return &permissions.network_http;
-    case AuditEventCategory::Socket:        return &permissions.network_socket;
-    case AuditEventCategory::ProcessCreate: return &permissions.process;
-    case AuditEventCategory::Threading:     return &permissions.threading;
-    case AuditEventCategory::ProcessReplace: return &permissions.process;
-    default:                                return nullptr;
-    }
-}
-
-// An event with no target is granted by its effective category and name, e.g. "FsRead:open"
-// for a read of a file descriptor, which does not grant a write of one ("FsReadWrite:open").
-std::string event_grant_key(AuditEventCategory category, const std::string& event_name)
-{
-    return std::string(plugin_audit::category_name(category)) + ":" + event_name;
-}
-
-bool has_permission(const std::vector<std::string>& granted, const std::string& target)
-{
-    return std::find(granted.begin(), granted.end(), target) != granted.end();
-}
-
-bool persist_permission(const std::string&        plugin_key,
-                        PluginInstallState&       state,
-                        std::vector<std::string>& permission_list,
-                        const std::string&        target)
-{
-    PluginDescriptor descriptor;
-    if (!PluginManager::instance().try_get_plugin_descriptor(plugin_key, descriptor) || descriptor.plugin_root.empty())
-        return false;
-
-    // A sandbox plugin may not have a sidecar yet.  Seed the small amount of install metadata
-    // needed by the writer so clicking Yes still creates the JSON file.
-    if (state.plugin_name.empty()) {
-        state.installed_from    = descriptor.is_cloud_plugin() ? "cloud" : "local";
-        state.installed_version = !descriptor.installed_version.empty() ? descriptor.installed_version : descriptor.version;
-        state.plugin_name       = descriptor.name;
-        state.cloud_uuid        = descriptor.cloud_uuid();
-        state.enabled            = true;
-    }
-
-    if (!has_permission(permission_list, target))
-        permission_list.push_back(target);
-    return write_install_state(boost::filesystem::path(descriptor.plugin_root), state);
-}
-
-wxString audit_message(AuditEventCategory category, const wxString& plugin_name, const wxString& event_name,
-                       const wxString& target_list, size_t target_count)
-{
-    if (target_list.IsEmpty())
-        return wxString::Format(
-            _L("Plugin \"%s\" is requesting permission for the Python audit event \"%s\".\n\n"
-                "This operation does not expose a target the audit hook can display."),
-            plugin_name, event_name);
-
-    switch (category) {
-    case AuditEventCategory::FsRead:
-        return wxString::Format(_L_PLURAL("Plugin \"%s\" is requesting to read the following file:\n%s",
-                                          "Plugin \"%s\" is requesting to read the following files:\n%s", target_count),
-                                plugin_name, target_list);
-    case AuditEventCategory::FsReadWrite:
-        return wxString::Format(_L_PLURAL("Plugin \"%s\" is requesting to read/write the following file:\n%s",
-                                          "Plugin \"%s\" is requesting to read/write the following files:\n%s", target_count),
-                                plugin_name, target_list);
-    case AuditEventCategory::FsCreate:
-        return wxString::Format(_L_PLURAL("Plugin \"%s\" is requesting to create the following file:\n%s",
-                                          "Plugin \"%s\" is requesting to create the following files:\n%s", target_count),
-                                plugin_name, target_list);
-    case AuditEventCategory::FsDelete:
-        return wxString::Format(_L_PLURAL("Plugin \"%s\" is requesting to delete the following file:\n%s",
-                                          "Plugin \"%s\" is requesting to delete the following files:\n%s", target_count),
-                                plugin_name, target_list);
-    case AuditEventCategory::Http:
-        return wxString::Format(_L("Plugin \"%s\" is requesting to make an HTTP request to:\n%s"), plugin_name, target_list);
-    case AuditEventCategory::Socket:
-        return wxString::Format(_L("Plugin \"%s\" is requesting to open a network connection to:\n%s"), plugin_name, target_list);
-    case AuditEventCategory::ProcessCreate:
-        return wxString::Format(_L_PLURAL("Plugin \"%s\" is requesting to run the following command:\n%s",
-                                          "Plugin \"%s\" is requesting to run the following commands:\n%s", target_count),
-                                plugin_name, target_list);
-    case AuditEventCategory::Threading:
-        return wxString::Format(_L("Plugin \"%s\" is requesting permission to create a thread."), plugin_name);
-    case AuditEventCategory::ProcessReplace:
-        return wxString::Format(_L("Plugin \"%s\" is requesting to replace the running application with:\n%s"), plugin_name, target_list);
-    default:
-        return wxString::Format(_L("Plugin \"%s\" is requesting permission for the Python audit event \"%s\"."), plugin_name, event_name);
-    }
-}
-
-// Builds and shows the modal permission prompt. Must run on the GUI thread.
-bool prompt_for_targets(AuditEventCategory category, const std::string& plugin_name, const std::string& event_name,
-                        const std::vector<std::string>& unresolved)
-{
-    wxString target_list;
-    for (const auto& target : unresolved)
-        target_list += wxString::FromUTF8(target.c_str()) + "\n";
-
-    wxMessageDialog dialog(nullptr,
-                           audit_message(category, wxString::FromUTF8(plugin_name.c_str()),
-                                        wxString::FromUTF8(event_name.c_str()), target_list, unresolved.size()),
-                           _L("Plugin permission request"), wxYES_NO | wxICON_WARNING);
-    return dialog.ShowModal() == wxID_YES;
-}
-
-// Records a grant in the plugin's sidecar so it is not asked again. Reads the install state
-// freshly because the async prompt outlives the caller's stack copy of it.
-void persist_grant(const std::string& plugin_key, AuditEventCategory category, bool by_event, const std::vector<std::string>& keys)
-{
-    PluginInstallState state;
-    if (!PluginManager::instance().get_install_state(plugin_key, state))
-        return;
-
-    std::vector<std::string>* permission_list = permission_list_for(category, by_event, state.permissions);
-    if (!permission_list)
-        return;
-
-    for (const auto& key : keys)
-        persist_permission(plugin_key, state, *permission_list, key);
-}
-
-PluginAuditManager::PermissionPrompt s_permission_prompt_for_testing;
-
-// Asks the user to grant an audited event, returning true when they approve an inline prompt.
-// `keys` are what a Yes saves: the unresolved targets, or the event-grant key when the event has
-// no target (by_event), which the prompt does not show as a target.
-//
-// An audited event can fire on a thread the UI thread may itself be blocked waiting on: the
-// SlicingPipeline hook runs on the slicing worker thread (see PluginHooks.cpp), and
-// BackgroundSlicingProcess::stop()/stop_internal() park the UI thread until that worker stops.
-// Blocking the worker on a marshaled modal -- which is safe for the plugin-load worker that
-// request_filesystem_read_permissions runs on -- would therefore deadlock the application (the
-// invariant PluginHostUi.cpp documents for slicing-hook UI calls). Off the main thread the prompt
-// is therefore posted asynchronously and the current event denied (fail closed, like an unanswered
-// prompt); the grant is persisted once the user accepts, so a later attempt succeeds without
-// re-prompting.
-bool request_permission(AuditEventCategory category, const std::string& plugin_key, const std::string& plugin_name,
-                        const std::string& event_name, bool by_event, const std::vector<std::string>& keys)
-{
-    const std::vector<std::string> shown = by_event ? std::vector<std::string>{} : keys;
-
-    if (s_permission_prompt_for_testing)
-        return s_permission_prompt_for_testing(event_name, shown);
-
-    if (wxTheApp == nullptr || GUI::wxGetApp().is_closing())
-        return false;
-
-    if (wxIsMainThread())
-        return prompt_for_targets(category, plugin_name, event_name, shown);
-
-    GUI::wxGetApp().CallAfter([category, plugin_key, plugin_name, event_name, by_event, keys, shown]() {
-        if (wxTheApp == nullptr || GUI::wxGetApp().is_closing())
-            return;
-        if (prompt_for_targets(category, plugin_name, event_name, shown))
-            persist_grant(plugin_key, category, by_event, keys);
-    });
-    return false;
-}
-
-// Decides an event that no allowed root or running operation covers: a saved grant allows it,
-// otherwise the user is asked and a Yes is saved.
-int decide_audited_event(PluginAuditManager&             mgr,
-                         PluginInstallState&              state,
-                         const std::string&                plugin_key,
-                         const std::string&                plugin_name,
-                         const std::string&                event_name,
-                         AuditEventCategory                category,
-                         const std::vector<std::string>&   targets)
-{
-    const bool                     by_event = targets.empty();
-    const std::vector<std::string> keys     = by_event ? std::vector<std::string>{event_grant_key(category, event_name)} : targets;
-    std::vector<std::string>*      permission_list = permission_list_for(category, by_event, state.permissions);
-
-    std::vector<std::string> unresolved = keys;
-    if (permission_list) {
-        unresolved.clear();
-        for (const auto& key : keys)
-            if (!has_permission(*permission_list, key))
-                unresolved.push_back(key);
-        if (unresolved.empty())
-            return 0;
-    }
-
-    // Letting a root frame go runs finalizers inside a scope destructor or another event's hook,
-    // where no dialog may open: what they do must already be granted.
-    if (mgr.releasing_frames())
-        return plugin_audit::report_denied(mgr, event_name, {false, "audit permission required"});
-
-    if (!request_permission(category, plugin_key, plugin_name, event_name, by_event, unresolved))
-        return plugin_audit::report_denied(mgr, event_name, {false, "audit permission required"});
-
-    if (permission_list)
-        for (const auto& key : unresolved)
-            persist_permission(plugin_key, state, *permission_list, key);
-    return 0;
-}
-
-} // namespace
-
-bool plugin_audit::request_filesystem_read_permissions(const std::string&              plugin_key,
-                                                       const std::vector<std::string>& paths)
-{
-    PluginDescriptor descriptor;
-    if (!PluginManager::instance().try_get_plugin_descriptor(plugin_key, descriptor) || descriptor.plugin_root.empty())
-        return false;
-
-    PluginInstallState state;
-    read_install_state(boost::filesystem::path(descriptor.plugin_root), state);
-
-    std::vector<std::string> missing;
-    for (const std::string& path : paths) {
-        if (std::find(state.permissions.fs_read.begin(), state.permissions.fs_read.end(), path) == state.permissions.fs_read.end())
-            missing.push_back(path);
-    }
-    if (missing.empty())
-        return true;
-
-    if (wxTheApp == nullptr || GUI::wxGetApp().is_closing())
-        return false;
-
-    auto show_dialog = [&descriptor, &missing]() {
-        wxString requested_paths;
-        for (const std::string& path : missing)
-            requested_paths += wxString::FromUTF8(path.c_str()) + "\n";
-
-        wxMessageDialog dialog(
-            nullptr,
-            wxString::Format(_L("Plugin \"%s\" requests filesystem read access to:\n%s"),
-                             wxString::FromUTF8(descriptor.name.c_str()), requested_paths),
-            _L("Plugin permissions"),
-            wxYES_NO | wxICON_WARNING);
-        return dialog.ShowModal() == wxID_YES;
-    };
-
-    bool granted = false;
-    if (wxIsMainThread()) {
-        granted = show_dialog();
-    } else {
-        auto result = std::make_shared<std::promise<bool>>();
-        auto future = result->get_future();
-        GUI::wxGetApp().CallAfter([result, descriptor_name = descriptor.name, missing]() {
-            wxString requested_paths;
-            for (const std::string& path : missing)
-                requested_paths += wxString::FromUTF8(path.c_str()) + "\n";
-
-            wxMessageDialog dialog(
-                nullptr,
-                wxString::Format(_L("Plugin \"%s\" requests filesystem read access to:\n%s"),
-                                 wxString::FromUTF8(descriptor_name.c_str()), requested_paths),
-                _L("Plugin permissions"),
-                wxYES_NO | wxICON_WARNING);
-            result->set_value(dialog.ShowModal() == wxID_YES);
-        });
-        granted = future.get();
-    }
-
-    if (!granted)
-        return false;
-
-    if (state.plugin_name.empty()) {
-        state.installed_from    = descriptor.is_cloud_plugin() ? "cloud" : "local";
-        state.installed_version = !descriptor.installed_version.empty() ? descriptor.installed_version : descriptor.version;
-        state.plugin_name       = descriptor.name;
-        state.cloud_uuid        = descriptor.cloud_uuid();
-        state.enabled            = true;
-    }
-
-    state.permissions.fs_read.insert(state.permissions.fs_read.end(), missing.begin(), missing.end());
-    return write_install_state(boost::filesystem::path(descriptor.plugin_root), state);
-}
-
-int plugin_audit::decide_event(PluginAuditManager&             mgr,
-                               const std::string&              event_name,
-                               AuditEventCategory              category,
-                               const std::vector<std::string>& targets)
-{
-    PluginInstallState state;
-    const bool have_install_state = PluginManager::instance().get_install_state(mgr.current_plugin(), state);
-    if (!have_install_state) {
-        BOOST_LOG_TRIVIAL(warning) << __FUNCTION__ << " Failed to get install state for " << mgr.current_plugin();
-    }
-
-    const std::string plugin_name = state.plugin_name.empty() ? mgr.current_plugin() : state.plugin_name;
-
-    return decide_audited_event(mgr, state, mgr.current_plugin(), plugin_name, event_name, category, targets);
-}
-
-void PluginAuditManager::set_permission_prompt_for_testing(PermissionPrompt prompt)
-{
-    s_permission_prompt_for_testing = std::move(prompt);
-}
-
-} // namespace Slic3r

src/slic3r/plugin/PluginAuditManagerInternal.hpp

@@ -1,38 +0,0 @@
-#ifndef slic3r_PluginAuditManagerInternal_hpp_
-#define slic3r_PluginAuditManagerInternal_hpp_
-
-// Internal seam between the GUI-free audit core and the permission front end. The GUI library
-// supplies the dialogs, prompts and .install_state.json persistence; the headless probe supplies
-// a fail-closed implementation that never links wx. Production behavior lives in the GUI
-// implementation, which is the code that used to be part of PluginAuditManager.cpp.
-
-#include "PluginAuditManager.hpp"
-
-#include <string>
-#include <vector>
-
-namespace Slic3r::plugin_audit {
-
-const char* category_name(AuditEventCategory category);
-
-int report_denied(PluginAuditManager&       mgr,
-                  const std::string&        event_name,
-                  const AuditDecision&      decision,
-                  const std::string&        target = {});
-
-// Used only when the manager is not in observation mode. The GUI implementation consults the
-// install state, prompts and persists; the probe implementation fails closed.
-bool request_filesystem_read_permissions(const std::string&              plugin_key,
-                                         const std::vector<std::string>& paths);
-
-// Decides an event that no allowed root or running operation covered. The GUI implementation
-// reads the install state and prompts; the probe implementation fails closed. In observation
-// mode the audit hook records and returns before reaching this seam.
-int decide_event(PluginAuditManager&             mgr,
-                 const std::string&              event_name,
-                 AuditEventCategory              category,
-                 const std::vector<std::string>& targets);
-
-} // namespace Slic3r::plugin_audit
-
-#endif // slic3r_PluginAuditManagerInternal_hpp_

src/slic3r/plugin/PluginFsUtils.cpp

@@ -14,7 +14,8 @@
 
 #include "PluginAuditManager.hpp"
 #include "PythonInterpreter.hpp"
-#include "PluginText.hpp"
+#include "slic3r/GUI/I18N.hpp"
+#include "slic3r/GUI/format.hpp"
 
 #include <exception>
 #include <miniz.h>
@@ -91,7 +92,7 @@ bool resolve_allowed_plugin_root(const PluginDescriptor& descriptor,
 
     const fs::path plugin_root = resolve_plugin_root_from_descriptor(descriptor);
     if (plugin_root.empty()) {
-        error = PLUGIN_U8L("Plugin folder could not be determined.");
+        error = _u8L("Plugin folder could not be determined.");
         return false;
     }
 
@@ -102,7 +103,7 @@ bool resolve_allowed_plugin_root(const PluginDescriptor& descriptor,
         resolved_root = fs::absolute(plugin_root, ec);
     }
     if (ec || resolved_root.empty()) {
-        error = PLUGIN_FORMAT(PLUGIN_U8L("Failed to resolve plugin folder: %1%"), plugin_root.string());
+        error = GUI::format(_u8L("Failed to resolve plugin folder: %1%"), plugin_root.string());
         return false;
     }
 
@@ -122,7 +123,7 @@ bool delete_plugin_root(const boost::filesystem::path& resolved_root, const std:
     const auto removed_count = fs::remove_all(resolved_root, ec);
     if (ec) {
         // TRN %1% is a folder path, %2% the system error message.
-        error = PLUGIN_FORMAT(PLUGIN_U8L("Failed to delete plugin folder %1%: %2%"), resolved_root.string(), ec.message());
+        error = GUI::format(_u8L("Failed to delete plugin folder %1%: %2%"), resolved_root.string(), ec.message());
         return false;
     }
 
@@ -1198,7 +1199,7 @@ boost::filesystem::path find_installed_plugin_entry(const boost::filesystem::pat
     namespace fs = boost::filesystem;
 
     if (!fs::exists(plugin_dir) || !fs::is_directory(plugin_dir)) {
-        error = PLUGIN_FORMAT(PLUGIN_U8L("Plugin directory does not exist: %1%"), plugin_dir.string());
+        error = GUI::format(_u8L("Plugin directory does not exist: %1%"), plugin_dir.string());
         return {};
     }
 
@@ -1215,7 +1216,7 @@ boost::filesystem::path find_installed_plugin_entry(const boost::filesystem::pat
         if (ext == ".py") {
             if (!py_entry.empty()) {
                 // TRN %1% and %2% are file names.
-                error = PLUGIN_FORMAT(PLUGIN_U8L("Plugin directory contains multiple .py files: %1% and %2%"),
+                error = GUI::format(_u8L("Plugin directory contains multiple .py files: %1% and %2%"),
                                     py_entry.filename().string(), it->path().filename().string());
                 return {};
             }
@@ -1223,7 +1224,7 @@ boost::filesystem::path find_installed_plugin_entry(const boost::filesystem::pat
         } else if (ext == ".whl") {
             if (!whl_entry.empty()) {
                 // TRN %1% and %2% are file names.
-                error = PLUGIN_FORMAT(PLUGIN_U8L("Plugin directory contains multiple .whl files: %1% and %2%"),
+                error = GUI::format(_u8L("Plugin directory contains multiple .whl files: %1% and %2%"),
                                     whl_entry.filename().string(), it->path().filename().string());
                 return {};
             }
@@ -1232,7 +1233,7 @@ boost::filesystem::path find_installed_plugin_entry(const boost::filesystem::pat
     }
 
     if (!py_entry.empty() && !whl_entry.empty()) {
-        error = PLUGIN_U8L("Plugin directory contains both .py and .whl entry files");
+        error = _u8L("Plugin directory contains both .py and .whl entry files");
         return {};
     }
 
@@ -1242,7 +1243,7 @@ boost::filesystem::path find_installed_plugin_entry(const boost::filesystem::pat
     if (!whl_entry.empty())
         return whl_entry;
 
-    error = PLUGIN_U8L("Plugin directory does not contain a .py or .whl entry file");
+    error = _u8L("Plugin directory does not contain a .py or .whl entry file");
     return {};
 }
 
@@ -1259,34 +1260,34 @@ std::vector<std::string> collect_resource_texture_files(const std::string& dir,
     error.clear();
 
     if (dir.empty()) {
-        error = PLUGIN_U8L("Resource texture directory is not set");
+        error = _u8L("Resource texture directory is not set");
         return files;
     }
     if (plugin_root.empty()) {
-        error = PLUGIN_U8L("Plugin folder could not be determined.");
+        error = _u8L("Plugin folder could not be determined.");
         return files;
     }
 
     boost::system::error_code ec;
     const fs::path resolved_dir = fs::weakly_canonical(fs::path(dir), ec);
     if (ec) {
-        error = PLUGIN_U8L("Resource texture directory could not be resolved");
+        error = _u8L("Resource texture directory could not be resolved");
         return files;
     }
 
     if (!fs::is_directory(resolved_dir, ec) || ec) {
-        error = PLUGIN_U8L("Resource texture path is not a directory");
+        error = _u8L("Resource texture path is not a directory");
         return files;
     }
 
     const fs::path resolved_root = fs::weakly_canonical(fs::path(plugin_root), ec);
     if (ec) {
-        error = PLUGIN_U8L("Plugin folder could not be resolved");
+        error = _u8L("Plugin folder could not be resolved");
         return files;
     }
 
     if (!is_inside_allowed_root(resolved_dir, resolved_root)) {
-        error = PLUGIN_U8L("Resource texture directory is outside the plugin folder");
+        error = _u8L("Resource texture directory is outside the plugin folder");
         return files;
     }
 
@@ -1311,7 +1312,7 @@ std::vector<std::string> collect_resource_texture_files(const std::string& dir,
     }
 
     if (ec) {
-        error = PLUGIN_U8L("Resource texture directory could not be read");
+        error = _u8L("Resource texture directory could not be read");
         return {};
     }
 

src/slic3r/plugin/PluginLoader.cpp

@@ -11,7 +11,8 @@
 #include "PythonPluginBridge.hpp"
 #include "pluginTypes/resourceTexture/ResourceTexturePluginCapability.hpp"
 #include "libslic3r/Utils.hpp"
-#include "PluginText.hpp"
+#include "slic3r/GUI/I18N.hpp"
+#include "slic3r/GUI/format.hpp"
 
 #include <boost/algorithm/string.hpp>
 #include <boost/algorithm/string/case_conv.hpp>
@@ -101,7 +102,7 @@ bool read_local_plugin_package_metadata(const boost::filesystem::path& source_pa
 
     const std::string ext = plugin_package_extension(source_path);
     if (ext != ".py" && ext != ".whl") {
-        error = PLUGIN_FORMAT(PLUGIN_U8L("Plugin package must be a .py or .whl file, got: %1%"), ext);
+        error = GUI::format(_u8L("Plugin package must be a .py or .whl file, got: %1%"), ext);
         return false;
     }
 
@@ -178,14 +179,14 @@ bool add_wheel_dependencies_to_sys_path(const PluginDescriptor& descriptor,
             std::string extract_error;
             if (!extract_zip_to_directory(it->path(), dep_dir, extract_error)) {
                 // TRN %1% is the dependency file, %2% the error detail.
-                error = PLUGIN_FORMAT(PLUGIN_U8L("Failed to extract plugin .whl dependency %1%: %2%"), it->path().string(), extract_error);
+                error = GUI::format(_u8L("Failed to extract plugin .whl dependency %1%: %2%"), it->path().string(), extract_error);
                 return false;
             }
         }
 
         std::string syspath_error;
         if (!interpreter.add_plugin_sys_path(dep_dir.string(), syspath_error)) {
-            error = PLUGIN_FORMAT(PLUGIN_U8L("Failed to add .whl dependency to sys.path: %1%"), syspath_error);
+            error = GUI::format(_u8L("Failed to add .whl dependency to sys.path: %1%"), syspath_error);
             return false;
         }
         plugin_paths.push_back(dep_dir.string());
@@ -247,12 +248,12 @@ bool load(const PluginDescriptor&                          descriptor,
 
     PythonInterpreter& interpreter = PythonInterpreter::instance();
     if (!interpreter.is_initialized()) {
-        error = PLUGIN_FORMAT(PLUGIN_U8L("Python interpreter not initialized: %1%"), interpreter.last_error());
+        error = GUI::format(_u8L("Python interpreter not initialized: %1%"), interpreter.last_error());
         return false;
     }
 
     if (!descriptor.is_metadata_valid()) {
-        error = PLUGIN_FORMAT(PLUGIN_U8L("Plugin manifest is invalid: %1%"), descriptor.plugin_key);
+        error = GUI::format(_u8L("Plugin manifest is invalid: %1%"), descriptor.plugin_key);
         if (descriptor.has_error())
             error += " - " + descriptor.normalized_error();
         return false;
@@ -273,7 +274,7 @@ bool load(const PluginDescriptor&                          descriptor,
     if (!skip_deps) {
         std::string pkg_install_error;
         if (!install_packages(descriptor.dependencies, pkg_install_error)) {
-            error = PLUGIN_FORMAT(PLUGIN_U8L("Failed to install plugin dependencies: %1%"), pkg_install_error);
+            error = GUI::format(_u8L("Failed to install plugin dependencies: %1%"), pkg_install_error);
             return false;
         }
     }
@@ -292,7 +293,7 @@ bool load(const PluginDescriptor&                          descriptor,
     PyObject*   module = import_plugin_module(descriptor, plugin.plugin_sys_paths, plugin.plugin_modules, load_error);
     if (module == nullptr) {
         bridge.cancel_plugin_capture(descriptor.entry_path);
-        error = PLUGIN_FORMAT(PLUGIN_U8L("Failed to load plugin module: %1%"), load_error);
+        error = GUI::format(_u8L("Failed to load plugin module: %1%"), load_error);
         return false;
     }
 
@@ -307,13 +308,13 @@ bool load(const PluginDescriptor&                          descriptor,
     auto        capabilities_found = bridge.finalize_plugin_capture(descriptor.entry_path, descriptor.plugin_key, bridge_error);
     if (!bridge_error.empty()) {
         capabilities_found.clear();
-        error = PLUGIN_FORMAT(PLUGIN_U8L("Plugin registration failed: %1%"), bridge_error);
+        error = GUI::format(_u8L("Plugin registration failed: %1%"), bridge_error);
         if (registration_failed != nullptr)
             *registration_failed = true;
         return false;
     }
     if (capabilities_found.empty()) {
-        error = PLUGIN_U8L("Plugin module did not register any capabilities");
+        error = _u8L("Plugin module did not register any capabilities");
         return false;
     }
 
@@ -365,7 +366,7 @@ bool load(const PluginDescriptor&                          descriptor,
 
                     if (!seen_capabilities[type].insert(found.name).second) {
                         // TRN %1% is the capability name, %2% the capability type (e.g. Script).
-                        materialization_error = PLUGIN_FORMAT(PLUGIN_U8L("Plugin declares duplicate capability '%1%' for type %2%"),
+                        materialization_error = GUI::format(_u8L("Plugin declares duplicate capability '%1%' for type %2%"),
                                                             found.name, PluginConfig::capability_type_label(type));
                         break;
                     }
@@ -421,9 +422,9 @@ bool load(const PluginDescriptor&                          descriptor,
                     capabilities.push_back(std::move(instance));
                 }
             } catch (const std::exception& ex) {
-                materialization_error = PLUGIN_FORMAT(PLUGIN_U8L("Plugin capability materialization failed: %1%"), ex.what());
+                materialization_error = GUI::format(_u8L("Plugin capability materialization failed: %1%"), ex.what());
             } catch (...) {
-                materialization_error = PLUGIN_U8L("Plugin capability materialization failed");
+                materialization_error = _u8L("Plugin capability materialization failed");
             }
         }
 
@@ -465,11 +466,11 @@ bool load(const PluginDescriptor&                          descriptor,
     } catch (const std::exception& ex) {
         teardown_capabilities(plugin.capabilities, lifecycle_count);
         // TRN on_load is the name of the plugin's startup function; keep it untranslated.
-        error = PLUGIN_FORMAT(PLUGIN_U8L("Plugin on_load failed: %1%"), ex.what());
+        error = GUI::format(_u8L("Plugin on_load failed: %1%"), ex.what());
         return false;
     } catch (...) {
         teardown_capabilities(plugin.capabilities, lifecycle_count);
-        error = PLUGIN_U8L("Plugin on_load failed");
+        error = _u8L("Plugin on_load failed");
         return false;
     }
 
@@ -650,7 +651,7 @@ bool install_plugin(const boost::filesystem::path& filepath,
     bool     backup_created = false;
 
     auto fail = [&error](const std::string& message) {
-        error = PLUGIN_FORMAT(PLUGIN_U8L("Plugin installation failed: %1%"), message);
+        error = GUI::format(_u8L("Plugin installation failed: %1%"), message);
         return false;
     };
 
@@ -658,23 +659,23 @@ bool install_plugin(const boost::filesystem::path& filepath,
     const fs::path            source_path = canonical_or_absolute(filepath);
 
     if (!fs::exists(source_path, ec) || !fs::is_regular_file(source_path, ec))
-        return fail(PLUGIN_FORMAT(PLUGIN_U8L("Plugin package is not a file: %1%"), filepath.string()));
+        return fail(GUI::format(_u8L("Plugin package is not a file: %1%"), filepath.string()));
 
     const std::string ext = plugin_package_extension(source_path);
     if (ext != ".py" && ext != ".whl")
-        return fail(PLUGIN_FORMAT(PLUGIN_U8L("Plugin package must be a .py or .whl file, got: %1%"), ext));
+        return fail(GUI::format(_u8L("Plugin package must be a .py or .whl file, got: %1%"), ext));
     // The cloud UUID is concatenated into the install path (final_dir = plugin_root / cloud_uuid).
     // It comes verbatim from the server's catalog JSON, so reject anything that could escape the
     // per-user plugin root (traversal, leading dots, separators) before touching the filesystem.
     if (is_cloud_install && !is_valid_plugin_id(cloud_uuid))
-        return fail(PLUGIN_FORMAT(PLUGIN_U8L("Cloud plugin UUID is not a valid identifier: %1%"), cloud_uuid));
+        return fail(GUI::format(_u8L("Cloud plugin UUID is not a valid identifier: %1%"), cloud_uuid));
 
     const fs::path plugin_root = is_cloud_install && !cloud_user_id.empty() ? fs::path(get_cloud_plugin_dir(cloud_user_id)) :
                                                                              local_plugin_root();
     fs::create_directories(plugin_root, ec);
     if (ec)
         // TRN %1% is a folder path, %2% the system error message.
-        return fail(PLUGIN_FORMAT(PLUGIN_U8L("Failed to create plugin directory %1%: %2%"), plugin_root.string(), ec.message()));
+        return fail(GUI::format(_u8L("Failed to create plugin directory %1%: %2%"), plugin_root.string(), ec.message()));
 
     std::string meta_error;
     if (is_cloud_install) {
@@ -717,7 +718,7 @@ bool install_plugin(const boost::filesystem::path& filepath,
         fs::rename(final_dir, backup_dir, ec);
         if (ec)
             // TRN %1% is a folder path, %2% the system error message.
-            return fail(PLUGIN_FORMAT(PLUGIN_U8L("Failed to back up existing plugin %1%: %2%"), final_dir.string(), ec.message()));
+            return fail(GUI::format(_u8L("Failed to back up existing plugin %1%: %2%"), final_dir.string(), ec.message()));
         backup_created = true;
     }
 
@@ -728,7 +729,7 @@ bool install_plugin(const boost::filesystem::path& filepath,
             boost::system::error_code restore_ec;
             fs::rename(backup_dir, final_dir, restore_ec);
         }
-        return fail(PLUGIN_FORMAT(PLUGIN_U8L("Failed to create plugin directory %1%: %2%"), final_dir.string(), ec.message()));
+        return fail(GUI::format(_u8L("Failed to create plugin directory %1%: %2%"), final_dir.string(), ec.message()));
     }
 
     fs::copy_file(source_path, dest_file, ec);
@@ -739,7 +740,7 @@ bool install_plugin(const boost::filesystem::path& filepath,
             fs::rename(backup_dir, final_dir, restore_ec);
         }
         // TRN %1% is a file path, %2% the system error message.
-        return fail(PLUGIN_FORMAT(PLUGIN_U8L("Failed to copy plugin file to %1%: %2%"), dest_file.string(), ec.message()));
+        return fail(GUI::format(_u8L("Failed to copy plugin file to %1%: %2%"), dest_file.string(), ec.message()));
     }
 
     // Update entry_path to the installed location.
@@ -759,7 +760,7 @@ bool install_plugin(const boost::filesystem::path& filepath,
             fs::remove_all(final_dir, rollback_ec);
             if (backup_created)
                 fs::rename(backup_dir, final_dir, rollback_ec);
-            return fail(PLUGIN_FORMAT(PLUGIN_U8L("Failed to write plugin install state: %1%"), (final_dir / INSTALL_STATE_FILE).string()));
+            return fail(GUI::format(_u8L("Failed to write plugin install state: %1%"), (final_dir / INSTALL_STATE_FILE).string()));
         }
     }
 

src/slic3r/plugin/PluginManager.cpp

@@ -53,6 +53,18 @@ const char* const LOAD_CANCELLED = "__plugin_load_cancelled__";
 
 } // namespace
 
+void Plugin::release_module()
+{
+    if (module == nullptr && plugin_sys_paths.empty() && plugin_modules.empty())
+        return;
+
+    PythonInterpreter::instance().unload_module(module, module_name, plugin_sys_paths, plugin_modules);
+    module = nullptr;
+    module_name.clear();
+    plugin_sys_paths.clear();
+    plugin_modules.clear();
+}
+
 PluginManager& PluginManager::instance()
 {
     // Touch the interpreter first so its static outlives this one: ~Plugin needs it alive to

src/slic3r/plugin/PluginModule.cpp

@@ -1,22 +0,0 @@
-// Plugin module ownership is part of the loader's contract, not of the registry's GUI-facing
-// surface. Kept in its own translation unit so the headless probe can link the loader without
-// pulling PluginManager.cpp (and therefore wx/GUI) into the probe.
-
-#include "PluginManager.hpp"
-#include "PythonInterpreter.hpp"
-
-namespace Slic3r {
-
-void Plugin::release_module()
-{
-    if (module == nullptr && plugin_sys_paths.empty() && plugin_modules.empty())
-        return;
-
-    PythonInterpreter::instance().unload_module(module, module_name, plugin_sys_paths, plugin_modules);
-    module = nullptr;
-    module_name.clear();
-    plugin_sys_paths.clear();
-    plugin_modules.clear();
-}
-
-} // namespace Slic3r

src/slic3r/plugin/PluginPermissionProbe.cpp

@@ -1,565 +0,0 @@
-// Headless, record-only plugin permission probe.
-//
-// This is a developer/security-analysis tool, not a second production loader. It reuses the
-// embedded interpreter, the production plugin_loader sequence and the GUI-free `orca` bindings
-// (capability types plus the geometry/model/slicing host domains), so the observations come from
-// the same audit classification and target extraction as the GUI. It then lets every audited
-// operation continue instead of consulting permission grants or dialogs. Host domains that need
-// the live GUI (app, presets, ui) and plugin.storage are registered as explicit unsupported
-// errors; the config API reports an empty config and refuses writes.
-//
-// It is NOT a sandbox. Plugin code runs with the probe's filesystem, network and process
-// privileges. The temporary data directory only keeps OrcaSlicer's own state out of the user's
-// tree; it does not confine plugin-authored code. Use OS-level restrictions (container, user,
-// seccomp/AppArmor, firewall) when the package is not trusted.
-//
-// The report describes only the paths this run exercised. CPython audit events are observations of
-// particular operations, not a notification for every Python call, so absence of a category in the
-// report is not evidence that the plugin cannot perform it.
-
-#include "PluginAuditManager.hpp"
-#include "PluginDescriptor.hpp"
-#include "PluginFsUtils.hpp"
-#include "PluginLoader.hpp"
-#include "PluginManager.hpp"
-#include "PluginProbeCollector.hpp"
-#include "PythonInterpreter.hpp"
-#include "PythonPluginInterface.hpp"
-
-#include "libslic3r/LifecycleEvents.hpp"
-#include "libslic3r/Utils.hpp"
-
-#include <boost/algorithm/string/case_conv.hpp>
-#include <boost/filesystem.hpp>
-#include <boost/filesystem/operations.hpp>
-#include <boost/filesystem/path.hpp>
-#include <boost/system/error_code.hpp>
-#include <nlohmann/json.hpp>
-#include <pybind11/embed.h>
-#include <pybind11/gil.h>
-#include <pybind11/pytypes.h>
-
-#include <cstdlib>
-#include <exception>
-#include <iostream>
-#include <memory>
-#include <string>
-#include <utility>
-#include <vector>
-
-namespace fs = boost::filesystem;
-namespace py = pybind11;
-
-using namespace Slic3r;
-
-namespace {
-
-constexpr const char* kLoadPhase = "load:import+registration+on_load";
-
-struct Options
-{
-    fs::path plugin_path;
-    bool json = false;
-};
-
-void print_usage(std::ostream& out)
-{
-    out << "Usage: orca-plugin-probe [--json] <plugin.py|plugin.whl>\n"
-           "\n"
-           "Runs a plugin in a temporary data/working directory and reports the CPython audit\n"
-           "events observed while its import, registration, on_load and discoverable callbacks\n"
-           "execute. The probe does not prompt for permissions, write grants, install dependencies,\n"
-           "or start the OrcaSlicer GUI.\n"
-           "\n"
-           "  --json   Emit the report as JSON (default: human-readable text)\n"
-           "  --help   Show this message\n"
-           "\n"
-           "WARNING: this is not a sandbox. Plugin Python code runs with this process's privileges.\n"
-           "Results are observational and non-exhaustive. Use OS-level restrictions for untrusted\n"
-           "packages.\n"
-           "\n"
-           "Exit status: 0 plugin loaded, 1 initialization/load failure, 2 usage error.\n";
-}
-
-bool parse_options(int argc, char** argv, Options& options, std::string& error)
-{
-    for (int index = 1; index < argc; ++index) {
-        const std::string argument = argv[index];
-        if (argument == "--help" || argument == "-h") {
-            print_usage(std::cout);
-            std::exit(0);
-        }
-        if (argument == "--json") {
-            options.json = true;
-            continue;
-        }
-        if (!argument.empty() && argument.front() == '-') {
-            error = "Unknown option: " + argument;
-            return false;
-        }
-        if (!options.plugin_path.empty()) {
-            error = "Only one plugin package may be probed at a time.";
-            return false;
-        }
-        options.plugin_path = fs::path(argument);
-    }
-
-    if (options.plugin_path.empty()) {
-        error = "No plugin package given.";
-        return false;
-    }
-    return true;
-}
-
-// Keep every write OrcaSlicer makes during the run inside a throwaway tree, and keep relative
-// paths opened by plugin code out of the caller's working directory. This is hygiene, not
-// confinement: an absolute path supplied by the plugin is still opened normally.
-class ScopedProbeWorkspace
-{
-public:
-    ScopedProbeWorkspace()
-        : m_root(fs::temp_directory_path() / fs::unique_path("orca-plugin-probe-%%%%-%%%%-%%%%"))
-        , m_previous_data_dir(data_dir())
-        , m_previous_working_dir(fs::current_path())
-    {
-        fs::create_directories(m_root);
-        set_data_dir(m_root.string());
-        fs::current_path(m_root);
-        m_moved = true;
-    }
-
-    ~ScopedProbeWorkspace()
-    {
-        boost::system::error_code ec;
-        set_data_dir(m_previous_data_dir);
-        if (m_moved)
-            fs::current_path(m_previous_working_dir, ec);
-        fs::remove_all(m_root, ec);
-    }
-
-    const fs::path& root() const { return m_root; }
-
-private:
-    fs::path m_root;
-    std::string m_previous_data_dir;
-    fs::path m_previous_working_dir;
-    bool m_moved = false;
-};
-
-class ScopedObservationObserver
-{
-public:
-    explicit ScopedObservationObserver(PluginProbeCollector& collector) : m_collector(collector)
-    {
-        PluginAuditManager::instance().set_observation_observer(
-            [this](const AuditObservation& observation) { m_collector.record(observation); });
-    }
-
-    ~ScopedObservationObserver() { PluginAuditManager::instance().clear_observation_observer(); }
-
-    ScopedObservationObserver(const ScopedObservationObserver&)            = delete;
-    ScopedObservationObserver& operator=(const ScopedObservationObserver&) = delete;
-
-private:
-    PluginProbeCollector& m_collector;
-};
-
-bool prepare_descriptor(const fs::path& plugin_path, PluginDescriptor& descriptor, std::string& error)
-{
-    boost::system::error_code ec;
-    const fs::path canonical = fs::weakly_canonical(plugin_path, ec);
-    if (ec || !fs::exists(canonical) || !fs::is_regular_file(canonical)) {
-        error = "Plugin package is not a readable file: " + plugin_path.string();
-        return false;
-    }
-
-    std::string extension = canonical.extension().string();
-    boost::algorithm::to_lower(extension);
-    if (extension != ".py" && extension != ".whl") {
-        error = "Plugin package must be a .py or .whl file, got: " + extension;
-        return false;
-    }
-
-    if (extension == ".whl") {
-        if (!read_wheel_plugin_metadata(canonical, descriptor, error))
-            return false;
-    } else {
-        if (!read_python_plugin_metadata(canonical, descriptor, error))
-            return false;
-    }
-
-    descriptor.entry_path     = canonical.string();
-    descriptor.plugin_key     = make_local_plugin_key(canonical.stem().string());
-    descriptor.metadata_valid = true;
-    // Leaving plugin_root empty keeps the probe independent of any .install_state.json next to
-    // the package and avoids the production sidecar path.
-    descriptor.plugin_root.clear();
-    if (descriptor.name.empty())
-        descriptor.name = descriptor.plugin_key;
-    return true;
-}
-
-void redirect_python_stdout()
-{
-    py::gil_scoped_acquire gil;
-    py::object sys = py::module_::import("sys");
-    // Keep plugin prints from corrupting the C++ report on stdout. sys.stderr is the interpreter's
-    // tee to the temporary log, so plugin output remains available there.
-    sys.attr("stdout") = sys.attr("stderr");
-}
-
-template<class Function>
-void invoke_callback(const std::shared_ptr<PluginCapabilityInterface>& capability,
-                     const std::string& phase,
-                     const std::string& callback,
-                     PluginProbeCollector& collector,
-                     Function&& function)
-{
-    ScopedPluginAuditPhase phase_scope(phase);
-    try {
-        std::forward<Function>(function)();
-        collector.record_callback({capability ? capability->name() : std::string{}, phase, callback, "invoked", {}});
-    } catch (const std::exception& error) {
-        collector.record_callback({capability ? capability->name() : std::string{}, phase, callback, "failed", error.what()});
-    } catch (...) {
-        collector.record_callback({capability ? capability->name() : std::string{}, phase, callback, "failed", "non-standard exception"});
-    }
-}
-
-struct ProbeCapability
-{
-    std::string name;
-    std::string type;
-    bool enabled = true;
-};
-
-std::vector<ProbeCapability> describe_capabilities(const Plugin& plugin)
-{
-    std::vector<ProbeCapability> capabilities;
-    capabilities.reserve(plugin.capabilities.size());
-    for (const auto& capability : plugin.capabilities) {
-        if (!capability)
-            continue;
-        capabilities.push_back({capability->name(), plugin_capability_type_to_string(capability->type()), capability->is_enabled()});
-    }
-    return capabilities;
-}
-
-void exercise_callbacks(const Plugin& plugin, PluginProbeCollector& collector)
-{
-    // on_load() already ran inside plugin_loader::load. The callbacks below are the additional
-    // entry points a loaded capability exposes to the host. Synthetic inputs are used; a callback
-    // may behave differently with a real application state, which the report cannot capture.
-    static constexpr LifecycleEvent lifecycle_events[] = {
-        LifecycleEvent::NewProject,          LifecycleEvent::ProjectOpened,         LifecycleEvent::ProjectBeforeSave,
-        LifecycleEvent::ProjectAfterSave,    LifecycleEvent::ProjectClosed,         LifecycleEvent::ProjectDirtyChanged,
-        LifecycleEvent::SliceStarted,        LifecycleEvent::SliceGeometryFinished, LifecycleEvent::GCodeExportStarted,
-        LifecycleEvent::GCodeExportFinished, LifecycleEvent::SlicingJobComplete,    LifecycleEvent::ObjectAdded,
-        LifecycleEvent::ObjectDeleted,       LifecycleEvent::ObjectTransformed,     LifecycleEvent::ObjectChanged,
-        LifecycleEvent::ObjectRenamed,       LifecycleEvent::PlateCreated,          LifecycleEvent::PlateDeleted,
-        LifecycleEvent::PlateSelected,       LifecycleEvent::PlateRenamed,          LifecycleEvent::PresetSelected,
-        LifecycleEvent::PresetSaved,         LifecycleEvent::PrintStateChanged,     LifecycleEvent::DeviceOnline,
-        LifecycleEvent::DeviceOffline,       LifecycleEvent::DeviceDiscovered,      LifecycleEvent::DeviceSelected,
-        LifecycleEvent::UploadStarted,       LifecycleEvent::UploadFinished,        LifecycleEvent::PrintJobStarted,
-        LifecycleEvent::PrintJobFinished,    LifecycleEvent::SendJobStarted,        LifecycleEvent::SendJobFinished,
-    };
-
-    for (const auto& capability : plugin.capabilities) {
-        if (!capability)
-            continue;
-
-        invoke_callback(capability, "callback:get_default_config", "get_default_config", collector,
-                        [&capability]() { (void) capability->get_default_config(); });
-
-        if (capability->config_ui_available()) {
-            invoke_callback(capability, "callback:get_config_ui", "get_config_ui", collector,
-                            [&capability]() { (void) capability->get_config_ui(); });
-        } else {
-            collector.record_callback(
-                {capability->name(), "callback:get_config_ui", "get_config_ui", "skipped", "has_config_ui() is false"});
-        }
-
-        for (const LifecycleEvent event : lifecycle_events) {
-            const std::string event_name = lifecycle_event_to_string(event);
-            const std::string phase      = "callback:on_lifecycle_event(" + event_name + ")";
-            LifecycleEventContext context;
-            context.source = "orca-plugin-probe";
-            context.msg    = "synthetic event generated by the permission probe";
-            invoke_callback(capability, phase, "on_lifecycle_event(" + event_name + ")", collector,
-                            [&capability, event, &context]() { capability->on_lifecycle_event(event, context); });
-        }
-
-        // Cancellation is a load-time path; calling it after a successful load would misrepresent
-        // the capability's real lifecycle. Report it as skipped instead.
-        collector.record_callback(
-            {capability->name(), "callback:on_cancelled", "on_cancelled", "skipped", "not invoked after a successful load"});
-    }
-}
-
-nlohmann::json observation_json(const AuditObservation& observation)
-{
-    return {
-        {"plugin", observation.plugin_key},
-        {"capability", observation.capability},
-        {"phase", observation.phase.empty() ? "unattributed" : observation.phase},
-        {"event", observation.event_name},
-        {"category", observation.category},
-        {"targets", observation.targets},
-        {"continued", observation.continued},
-    };
-}
-
-nlohmann::json callback_json(const ProbeCallbackRecord& callback)
-{
-    return {
-        {"capability", callback.capability}, {"phase", callback.phase},   {"callback", callback.callback},
-        {"status", callback.status},         {"detail", callback.detail},
-    };
-}
-
-nlohmann::json capability_json(const ProbeCapability& capability)
-{
-    return {
-        {"name", capability.name},
-        {"type", capability.type},
-        {"enabled", capability.enabled},
-    };
-}
-
-nlohmann::json build_report(const Options& options,
-                            const PluginProbeCollector& collector,
-                            const std::vector<ProbeCapability>& capabilities,
-                            const std::string& plugin_key,
-                            bool python_initialized,
-                            const std::string& python_error,
-                            bool loaded,
-                            const std::string& load_error,
-                            const std::string& data_dir)
-{
-    nlohmann::json observations = nlohmann::json::array();
-    for (const AuditObservation& observation : collector.observations())
-        observations.push_back(observation_json(observation));
-
-    nlohmann::json callbacks = nlohmann::json::array();
-    for (const ProbeCallbackRecord& callback : collector.callbacks())
-        callbacks.push_back(callback_json(callback));
-
-    nlohmann::json capability_list = nlohmann::json::array();
-    for (const ProbeCapability& capability : capabilities)
-        capability_list.push_back(capability_json(capability));
-
-    return {
-        {"tool", "orca-plugin-permission-probe"},
-        {"mode", "record-only"},
-        {"observed_by_this_run_only", true},
-        {"plugin",
-         {
-             {"path", options.plugin_path.string()},
-             {"key", plugin_key},
-         }},
-        {"environment",
-         {
-             {"python_initialized", python_initialized},
-             {"python_error", python_error},
-             {"temporary_data_dir", data_dir},
-             {"temporary_data_dir_removed_on_exit", true},
-             {"working_directory", data_dir},
-             {"interactive_prompts", false},
-             {"grants_persisted", false},
-         }},
-        {"load", {{"ok", loaded}, {"error", load_error}, {"capabilities", capability_list}}},
-        {"callbacks", callbacks},
-        {"observations", observations},
-        {"summary", collector.summary()},
-        {"coverage",
-         {
-             {"exhaustive", false},
-             {"sandbox", false},
-             {"plugin_code_executed", true},
-             {"notes",
-              {
-                  "Only the code paths this probe exercised are represented. Audit events cover "
-                  "particular operations, not every Python call.",
-                  "The probe does not start the GUI. Host APIs that require a live application or "
-                  "UI (orca.host.app/presets/ui) and plugin.storage report an explicit unsupported "
-                  "error and are reported as failed callbacks.",
-                  "The probe links libslic3r for core geometry/print types, but not libslic3r_gui "
-                  "or wx.",
-                  "The temporary data directory isolates OrcaSlicer state, not plugin-authored file, "
-                  "network or process access. Use OS-level restrictions for untrusted packages.",
-                  "The loader may extract adjacent .whl dependencies into the package's directory; "
-                  "probe a copy of the package when that side effect is unwanted.",
-                  "Import, registration and on_load share one loader phase; the production loader "
-                  "does not expose a finer boundary without changing its behavior.",
-                  "Callbacks run with synthetic inputs, which can change plugin control flow "
-                  "compared with a real application session.",
-                  "continued=true means the audit hook did not block the operation. A surrounding "
-                  "callback or load step can still fail afterwards, as reported in callbacks/load.",
-                  "Events raised on a plugin-spawned thread carry no phase label and are reported "
-                  "as unattributed.",
-                  "Plugin code can spawn threads/processes, write anywhere this process can, or "
-                  "terminate the process. None of that is contained by the probe.",
-              }},
-         }},
-    };
-}
-
-void print_text_report(const nlohmann::json& report)
-{
-    std::cout << "OrcaSlicer plugin permission probe (record-only)\n"
-                 "WARNING: observational only; not exhaustive and not a sandbox.\n\n";
-    std::cout << "Plugin: " << report["plugin"]["path"].get<std::string>() << "\n";
-    std::cout << "Python initialized: " << (report["environment"]["python_initialized"].get<bool>() ? "yes" : "no") << "\n";
-    if (!report["environment"]["python_error"].get<std::string>().empty())
-        std::cout << "Python error: " << report["environment"]["python_error"].get<std::string>() << "\n";
-    std::cout << "Load: " << (report["load"]["ok"].get<bool>() ? "ok" : "failed") << "\n";
-    if (!report["load"]["error"].get<std::string>().empty())
-        std::cout << "Load error: " << report["load"]["error"].get<std::string>() << "\n";
-
-    std::cout << "\nCapabilities (" << report["load"]["capabilities"].size() << "):\n";
-    for (const auto& capability : report["load"]["capabilities"])
-        std::cout << "  " << capability["name"].get<std::string>() << " [" << capability["type"].get<std::string>()
-                  << "] enabled=" << (capability["enabled"].get<bool>() ? "yes" : "no") << "\n";
-
-    std::cout << "\nCallbacks (" << report["callbacks"].size() << "):\n";
-    for (const auto& callback : report["callbacks"]) {
-        std::cout << "  " << callback["status"].get<std::string>() << " " << callback["callback"].get<std::string>();
-        if (!callback["capability"].get<std::string>().empty())
-            std::cout << " capability=" << callback["capability"].get<std::string>();
-        if (!callback["detail"].get<std::string>().empty())
-            std::cout << " - " << callback["detail"].get<std::string>();
-        std::cout << "\n";
-    }
-
-    std::cout << "\nObserved audit events (" << report["observations"].size() << "):\n";
-    for (const auto& observation : report["observations"]) {
-        std::cout << "  phase=" << observation["phase"].get<std::string>() << " event=" << observation["event"].get<std::string>()
-                  << " category=" << observation["category"].get<std::string>();
-        if (!observation["capability"].get<std::string>().empty())
-            std::cout << " capability=" << observation["capability"].get<std::string>();
-        if (!observation["targets"].empty()) {
-            std::cout << " targets=";
-            bool first = true;
-            for (const auto& target : observation["targets"]) {
-                if (!first)
-                    std::cout << ",";
-                std::cout << target.get<std::string>();
-                first = false;
-            }
-        }
-        std::cout << " continued=" << (observation["continued"].get<bool>() ? "yes" : "no") << "\n";
-    }
-
-    std::cout << "\nObserved permission categories:\n";
-    for (const auto& [category, detail] : report["summary"]["categories"].items()) {
-        std::cout << "  " << category << ":";
-        for (const auto& event : detail["events"])
-            std::cout << " " << event.get<std::string>();
-        if (!detail["targets"].empty()) {
-            std::cout << " -> ";
-            bool first = true;
-            for (const auto& target : detail["targets"]) {
-                if (!first)
-                    std::cout << ", ";
-                std::cout << target.get<std::string>();
-                first = false;
-            }
-        }
-        std::cout << "\n";
-    }
-    if (report["summary"]["categories"].empty())
-        std::cout << "  (none observed)\n";
-
-    std::cout << "\nCoverage limits:\n";
-    for (const auto& note : report["coverage"]["notes"])
-        std::cout << "  - " << note.get<std::string>() << "\n";
-}
-
-} // namespace
-
-int main(int argc, char** argv)
-{
-    Options options;
-    std::string option_error;
-    if (!parse_options(argc, argv, options, option_error)) {
-        std::cerr << "orca-plugin-probe: " << option_error << "\n\n";
-        print_usage(std::cerr);
-        return 2;
-    }
-
-    boost::system::error_code ec;
-    const fs::path canonical_plugin = fs::weakly_canonical(options.plugin_path, ec);
-    if (!ec)
-        options.plugin_path = canonical_plugin;
-
-    ScopedProbeWorkspace workspace;
-    PluginProbeCollector collector;
-    ScopedObservationObserver observer(collector);
-
-    PluginDescriptor descriptor;
-    std::string descriptor_error;
-    const bool descriptor_ready = prepare_descriptor(options.plugin_path, descriptor, descriptor_error);
-
-    PythonInterpreter& interpreter = PythonInterpreter::instance();
-    bool python_initialized        = false;
-    std::string python_error;
-    if (descriptor_ready) {
-        python_initialized = interpreter.initialize();
-        if (!python_initialized)
-            python_error = interpreter.last_error();
-    }
-
-    if (python_initialized) {
-        try {
-            redirect_python_stdout();
-        } catch (const std::exception& error) {
-            python_error = std::string("Could not redirect Python stdout: ") + error.what();
-        }
-    }
-
-    bool loaded            = false;
-    std::string load_error = descriptor_error;
-    Plugin plugin;
-    std::vector<ProbeCapability> capabilities;
-
-    if (python_initialized && descriptor_ready) {
-        // The outer context covers import, registration and on_load in plugin_loader::load; the
-        // per-callback scopes below cover the follow-up calls. The production loader is unchanged.
-        ScopedPluginAuditContext audit_context(descriptor.plugin_key);
-        {
-            ScopedPluginAuditPhase load_phase(kLoadPhase);
-            loaded = plugin_loader::load(descriptor, /*skip_deps=*/true, /*capabilities_to_enable=*/{}, nullptr, plugin, load_error);
-            collector.record_callback({std::string{}, kLoadPhase, "plugin_loader::load", loaded ? "invoked" : "failed", load_error});
-            collector.record_callback({std::string{}, "callback:on_load", "on_load", loaded ? "invoked" : "skipped",
-                                       loaded ? "invoked by plugin_loader::load for each materialized capability" :
-                                                "plugin_loader::load failed before completing on_load"});
-        }
-
-        capabilities = describe_capabilities(plugin);
-
-        if (loaded)
-            exercise_callbacks(plugin, collector);
-
-        if (loaded) {
-            ScopedPluginAuditPhase unload_phase("callback:on_unload");
-            plugin_loader::unload(plugin);
-            collector.record_callback({std::string{}, "callback:on_unload", "on_unload", "invoked",
-                                       "invoked by plugin_loader::unload; per-capability failures are logged by the loader"});
-        }
-    }
-
-    if (interpreter.is_initialized())
-        interpreter.shutdown();
-
-    const nlohmann::json report = build_report(options, collector, capabilities,
-                                               descriptor.plugin_key.empty() ? make_local_plugin_key(options.plugin_path.stem().string()) :
-                                                                               descriptor.plugin_key,
-                                               python_initialized, python_error, loaded, load_error, workspace.root().string());
-
-    if (options.json)
-        std::cout << report.dump(2, ' ', false, nlohmann::json::error_handler_t::replace) << "\n";
-    else
-        print_text_report(report);
-
-    return loaded ? 0 : 1;
-}

src/slic3r/plugin/PluginProbeCollector.hpp

@@ -1,97 +0,0 @@
-#ifndef slic3r_PluginProbeCollector_hpp_
-#define slic3r_PluginProbeCollector_hpp_
-
-// Record-only collection for the headless plugin permission probe. This is deliberately a plain
-// in-memory store: it has no dialog, grant or persistence path, and it never decides whether an
-// audited operation may proceed. Keeping it independent of wx/Python also makes its grouping and
-// phase attribution testable without starting the interpreter.
-
-#include "PluginAuditManager.hpp"
-
-#include <nlohmann/json.hpp>
-
-#include <map>
-#include <mutex>
-#include <set>
-#include <string>
-#include <utility>
-#include <vector>
-
-namespace Slic3r {
-
-// What the probe attempted and what came back. `status` is one of "invoked", "failed" or
-// "skipped"; a skipped callback is reported so the absence of observations is not mistaken for a
-// clean result.
-struct ProbeCallbackRecord
-{
-    std::string capability;
-    std::string phase;
-    std::string callback;
-    std::string status;
-    std::string detail;
-};
-
-class PluginProbeCollector
-{
-public:
-    void record(const AuditObservation& observation)
-    {
-        std::lock_guard<std::mutex> lock(m_mutex);
-        m_observations.push_back(observation);
-    }
-
-    void record_callback(ProbeCallbackRecord record)
-    {
-        std::lock_guard<std::mutex> lock(m_mutex);
-        m_callbacks.push_back(std::move(record));
-    }
-
-    std::vector<AuditObservation> observations() const
-    {
-        std::lock_guard<std::mutex> lock(m_mutex);
-        return m_observations;
-    }
-
-    std::vector<ProbeCallbackRecord> callbacks() const
-    {
-        std::lock_guard<std::mutex> lock(m_mutex);
-        return m_callbacks;
-    }
-
-    // Groups the run by the permission categories the audit hook already assigned, and lists the
-    // distinct targets and event names seen in each. This is a view of this run only; it says
-    // nothing about code paths the plugin did not exercise.
-    nlohmann::json summary() const
-    {
-        std::lock_guard<std::mutex> lock(m_mutex);
-
-        std::map<std::string, std::set<std::string>> events;
-        std::map<std::string, std::set<std::string>> targets;
-        for (const AuditObservation& observation : m_observations) {
-            events[observation.category].insert(observation.event_name);
-            targets[observation.category].insert(observation.targets.begin(), observation.targets.end());
-        }
-
-        nlohmann::json categories = nlohmann::json::object();
-        for (const auto& [category, category_events] : events) {
-            categories[category] = {
-                {"events", category_events},
-                {"targets", targets[category]},
-            };
-        }
-
-        return {
-            {"observed_event_count", m_observations.size()},
-            {"categories", categories},
-        };
-    }
-
-private:
-    mutable std::mutex m_mutex;
-    std::vector<AuditObservation> m_observations;
-    std::vector<ProbeCallbackRecord> m_callbacks;
-};
-
-} // namespace Slic3r
-
-#endif // slic3r_PluginProbeCollector_hpp_

src/slic3r/plugin/PluginText.hpp

@@ -1,44 +0,0 @@
-#pragma once
-
-// User-facing plugin messages are translated in the GUI build. The headless probe links neither
-// libslic3r_gui nor wx, so it formats the same English text without wxGetTranslation. The GUI path
-// expands to exactly the calls the plugin sources used before this header existed.
-
-#if defined(ORCA_PLUGIN_PROBE_BUILD)
-
-#include "libslic3r/format.hpp"
-
-#include <string>
-#include <utility>
-
-namespace Slic3r::plugin_text {
-
-inline std::string translate_utf8(const char* text) { return text == nullptr ? std::string{} : std::string(text); }
-inline std::string translate_utf8(const std::string& text) { return text; }
-
-template<typename... TArgs>
-inline std::string format(const char* fmt, TArgs&&... args)
-{
-    return Slic3r::format(fmt, std::forward<TArgs>(args)...);
-}
-
-template<typename... TArgs>
-inline std::string format(const std::string& fmt, TArgs&&... args)
-{
-    return Slic3r::format(fmt, std::forward<TArgs>(args)...);
-}
-
-} // namespace Slic3r::plugin_text
-
-#define PLUGIN_U8L(text) ::Slic3r::plugin_text::translate_utf8(text)
-#define PLUGIN_FORMAT(...) ::Slic3r::plugin_text::format(__VA_ARGS__)
-
-#else
-
-#include "slic3r/GUI/I18N.hpp"
-#include "slic3r/GUI/format.hpp"
-
-#define PLUGIN_U8L(text) _u8L(text)
-#define PLUGIN_FORMAT(...) GUI::format(__VA_ARGS__)
-
-#endif

src/slic3r/plugin/PythonPluginBridge.cpp

@@ -30,7 +30,7 @@
 #include "pluginTypes/slicingPipeline/SlicingPipelinePluginCapability.hpp"
 #include <pybind11/pytypes.h>
 #include <pybind11/gil.h>
-#include "PluginText.hpp"
+#include "slic3r/GUI/I18N.hpp"
 
 namespace py = pybind11;
 
@@ -193,7 +193,7 @@ std::vector<CapturedCapability> PythonPluginBridge::finalize_plugin_capture(cons
                     granted = PluginAuditManager::instance().request_filesystem_read_permissions(plugin_key, fs_read_permissions);
                 }
                 if (!granted) {
-                    error = PLUGIN_U8L("Plugin filesystem read permission request denied");
+                    error = _u8L("Plugin filesystem read permission request denied");
                     BOOST_LOG_TRIVIAL(warning) << error << " for key " << plugin_key;
                     discard_pending_for_key();
                     clear_active_key();

src/slic3r/plugin/probe/NanoSvgImplementation.cpp

@@ -1,4 +0,0 @@
-// libslic3r references NanoSVG without carrying its header-only implementation. This probe links
-// libslic3r without the GUI BitmapCache.cpp that supplies the implementation in the application.
-#define NANOSVG_IMPLEMENTATION
-#include "nanosvg/nanosvg.h"

src/slic3r/plugin/probe/PluginAuditManagerHeadless.cpp

@@ -1,32 +0,0 @@
-// Headless replacement for the GUI permission front end. The probe installs an observation
-// observer, so the audit hook records and returns before reaching this seam. If that observer is
-// ever absent, permission decisions fail closed instead of consulting GUI or install state.
-
-#include "slic3r/plugin/PluginAuditManagerInternal.hpp"
-
-#include <boost/log/trivial.hpp>
-
-#include <string>
-#include <vector>
-
-namespace Slic3r::plugin_audit {
-
-bool request_filesystem_read_permissions(const std::string&              plugin_key,
-                                         const std::vector<std::string>& paths)
-{
-    BOOST_LOG_TRIVIAL(warning) << "[PROBE] Refusing filesystem read permission request for " << plugin_key
-                               << " (" << paths.size() << " path(s)): the headless probe does not evaluate grants";
-    return false;
-}
-
-int decide_event(PluginAuditManager&             mgr,
-                 const std::string&              event_name,
-                 AuditEventCategory              category,
-                 const std::vector<std::string>& targets)
-{
-    (void) category;
-    (void) targets;
-    return report_denied(mgr, event_name, {false, "permission decisions are unavailable in the headless probe"});
-}
-
-} // namespace Slic3r::plugin_audit

src/slic3r/plugin/probe/PluginHostProbe.cpp

@@ -1,75 +0,0 @@
-// Probe-only `orca.host` registration. The GUI-free domains use the production bindings; the
-// domains that need a live GUI application, main window or preset bundle are exposed as explicit
-// unsupported submodules instead of being compiled (and linked) into the probe.
-//
-// A plugin that touches one of those domains fails its own callback with a clear message; the
-// failure is recorded by the probe's callback report rather than becoming a link dependency.
-
-#include "slic3r/plugin/host/PluginHost.hpp"
-#include "slic3r/plugin/host/PluginHostBindings.hpp"
-
-#include <pybind11/pybind11.h>
-#include <pybind11/pytypes.h>
-
-#include <stdexcept>
-#include <string>
-
-namespace py = pybind11;
-
-namespace Slic3r {
-namespace {
-
-void add_unavailable_domain(py::module_& host, const char* name, const char* description)
-{
-    py::module_ domain = host.def_submodule(name, description);
-    const std::string prefix = std::string("orca.host.") + name + ".";
-    domain.attr("__getattr__") = py::cpp_function([prefix](const std::string& attribute) -> py::object {
-        throw std::runtime_error(prefix + attribute +
-                                 " is not available in the headless plugin permission probe because it needs the GUI application");
-    });
-}
-
-void add_unavailable_function(py::module_& host, const char* name)
-{
-    // Production registers these in PluginHostApp::register_app(). Do not overwrite a slot that
-    // another registrar already claimed (the model domain binds the Model class through
-    // register_model); the probe only fills the GUI-backed accessors that are absent here.
-    if (py::hasattr(host, name))
-        return;
-
-    const std::string detail = std::string("orca.host.") + name +
-                               " is not available in the headless plugin permission probe because it needs the GUI application";
-    host.def(name, [detail](py::args, py::kwargs) -> py::object { throw std::runtime_error(detail); }, detail.c_str());
-}
-
-} // namespace
-
-void PluginHost::RegisterBindings(py::module_& module)
-{
-    auto host = module.def_submodule("host", "Host application API");
-
-    // Value types first so the docstring signatures of later registrars resolve to the bound names.
-    host_bindings::register_geometry(host);
-    host_bindings::register_mesh(host);
-    host_bindings::register_model(host);
-    host_bindings::register_slicing(host);
-
-    // These domains are backed by the live GUI, its Plater/MainFrame and the preset bundle.
-    add_unavailable_domain(host, "presets", "Preset bundle access (headless probe: unavailable)");
-    add_unavailable_domain(host, "app", "Live application and Plater access (headless probe: unavailable)");
-    add_unavailable_domain(host, "ui", "Native dialogs and HTML windows (headless probe: unavailable)");
-    for (const char* name : {"plater", "model", "preset_bundle", "app_info", "gl_info", "selected_printer"})
-        add_unavailable_function(host, name);
-
-    // Storage needs the PluginManager registry, which is not part of the headless probe.
-    auto plugin_host = host.def_submodule("plugin", "Plugin host API (headless probe: storage unavailable)");
-    plugin_host.def("storage", []() -> std::string {
-        throw std::runtime_error("orca.host.plugin.storage() is not available in the headless plugin permission probe");
-    }, "Return the installed folder of the current plugin.");
-    plugin_host.attr("__getattr__") = py::cpp_function([](const std::string& attribute) -> py::object {
-        throw std::runtime_error("orca.host.plugin." + attribute +
-                                 " is not available in the headless plugin permission probe");
-    });
-}
-
-} // namespace Slic3r

src/slic3r/plugin/probe/PluginProbeConfig.cpp

@@ -1,32 +0,0 @@
-// Minimal replacement for the config API PythonPluginBridge binds into `orca`.
-//
-// The production implementation (PluginConfig.cpp) resolves presets, reads the sidebar's effective
-// config and writes config.json through PluginManager, all of which pull in the GUI and the
-// registry. The probe has neither: a capability reports an empty config, an empty version and a
-// refused save. That keeps the bridge's Python surface intact without pretending to reproduce
-// application state the probe does not have.
-
-#include "slic3r/plugin/PluginConfig.hpp"
-#include "slic3r/plugin/PythonPluginInterface.hpp"
-
-#include <nlohmann/json.hpp>
-
-#include <string>
-
-namespace Slic3r {
-
-nlohmann::json capability_get_config(const PluginCapabilityInterface&)
-{
-    return nlohmann::json::object();
-}
-
-std::string capability_get_config_version(const PluginCapabilityInterface&) { return {}; }
-
-bool capability_save_config(const PluginCapabilityInterface&, const nlohmann::json&) { return false; }
-
-std::string PluginConfig::capability_type_label(PluginCapabilityType type)
-{
-    return plugin_capability_type_display_name(type);
-}
-
-} // namespace Slic3r

tests/libslic3r/test_arrange.cpp

@@ -220,11 +220,39 @@ TEST_CASE("An item larger than the bed cannot be placed", "[Arrange]")
     ArrangePolygons items;
     items.emplace_back(make_square(scaled(20.)));
     items.emplace_back(make_square(scaled(400.))); // far bigger than the bed
+    // An item that cannot be placed keeps the position it came in with, so the
+    // caller can leave it where the user had it.
+    items[1].translation = {scaled(10.), scaled(20.)};
 
     arrange(items, bed(200, 200), quiet_params(scaled(1.)));
 
     REQUIRE(items[0].bed_idx == 0);
     REQUIRE(items[1].bed_idx == UNARRANGED);
+    REQUIRE(items[1].translation.x() == scaled(10.));
+    REQUIRE(items[1].translation.y() == scaled(20.));
+}
+
+TEST_CASE("An item filling the printable area is arranged", "[Arrange]")
+{
+    // The arrange bed keeps a margin from the printable area and the item is widened by
+    // its brim. Neither may keep an item that fits the printable area from being placed.
+    DynamicPrintConfig cfg   = bed_config(); // 200 x 200
+    ArrangeParams      p     = quiet_params();
+
+    ArrangePolygons items = squares(1, 197.);
+    items.front().brim_width = 1.;
+    update_arrange_params(p, &cfg, items);
+    update_selected_items_inflation(items, &cfg, p);
+    arrange(items, get_shrink_bedpts(&cfg, p), p);
+    REQUIRE(items.front().bed_idx == 0);
+
+    // Larger than the printable area is still refused.
+    ArrangeParams   p_large = quiet_params();
+    ArrangePolygons large   = squares(1, 201.);
+    update_arrange_params(p_large, &cfg, large);
+    update_selected_items_inflation(large, &cfg, p_large);
+    arrange(large, get_shrink_bedpts(&cfg, p_large), p_large);
+    REQUIRE(large.front().bed_idx == UNARRANGED);
 }
 
 TEST_CASE("Items overflowing one bed spill onto virtual beds", "[Arrange]")

tests/libslic3r/test_lay_on_face.cpp

@@ -187,6 +187,23 @@ TEST_CASE("A part rests on its largest hull face even when parallel inner faces
     check_on_bed(plate);
 }
 
+TEST_CASE("A box laid on its top face is turned over about X", "[LayOnFace]")
+{
+    // A face pointing straight up leaves the half turn's axis open to every horizontal
+    // direction. It must be the fixed X flip both times, keep the footprint and not follow
+    // rounding noise to an arbitrary angle.
+    Model        model;
+    ModelObject &box = add_box_object(model, { 40, 20, 10 });
+    lay_on_face(box, 0, { 0, 0, 1 });
+
+    check_size(box, { 40, 20, 10 });
+    check_on_bed(box);
+    const Matrix3d rotation = box.instances.front()->get_matrix_no_offset().linear();
+    CHECK_THAT(rotation(0, 0), WithinAbs(1., 1e-9));
+    CHECK_THAT(rotation(1, 1), WithinAbs(-1., 1e-9));
+    CHECK_THAT(rotation(2, 2), WithinAbs(-1., 1e-9));
+}
+
 TEST_CASE("Faces are selected in object coordinates whatever the instance rotation", "[LayOnFace]")
 {
     Model        model;

tests/slic3rutils/test_plugin_audit.cpp

@@ -3,13 +3,11 @@
 #include <boost/system/error_code.hpp>
 #include <catch2/catch_all.hpp>
 
-#include <cstddef>
 #include <libslic3r/Utils.hpp>
 #include <libslic3r/libslic3r.h>         // GCODEVIEWER_APP_KEY, SLIC3R_APP_KEY (via libslic3r_version.h)
 #include <slic3r/plugin/PluginAuditManager.hpp>
 #include <slic3r/plugin/PluginFsUtils.hpp>
 #include <slic3r/plugin/PluginManager.hpp>
-#include <slic3r/plugin/PluginProbeCollector.hpp>
 #include <slic3r/plugin/PythonInterpreter.hpp>
 #include <slic3r/plugin/PythonPluginBridge.hpp>
 #include <slic3r/plugin/PythonPluginInterface.hpp>
@@ -34,7 +32,6 @@
 #include <pybind11/pytypes.h>
 #include <pybind11/stl.h>
 
-#include <algorithm>
 #include <fstream>
 #include <functional>
 #include <ios>
@@ -70,29 +67,9 @@ void seed_denied_keywords()
         mgr.add_denied_path_keyword(keyword);
 }
 
-// Installs the record-only observer for a test and always clears it, so a failed CHECK cannot
-// leave a callback pointing at a destroyed collector for the next test in this process.
-struct ScopedTestObservationObserver
-{
-    explicit ScopedTestObservationObserver(PluginProbeCollector& collector)
-        : m_collector(collector)
-    {
-        PluginAuditManager::instance().set_observation_observer(
-            [this](const AuditObservation& observation) { m_collector.record(observation); });
-    }
-
-    ~ScopedTestObservationObserver() { PluginAuditManager::instance().clear_observation_observer(); }
-
-    ScopedTestObservationObserver(const ScopedTestObservationObserver&)            = delete;
-    ScopedTestObservationObserver& operator=(const ScopedTestObservationObserver&) = delete;
-
-private:
-    PluginProbeCollector& m_collector;
-};
-
 } // namespace
 
-TEST_CASE("Plugin audit denies host-managed filenames anywhere", "[audit]")
+TEST_CASE("Plugin audit denies app config and token filenames anywhere", "[audit]")
 {
     seed_denied_names();
     const PluginAuditManager& mgr = PluginAuditManager::instance();
@@ -104,7 +81,6 @@ TEST_CASE("Plugin audit denies host-managed filenames anywhere", "[audit]")
         CHECK(mgr.is_denied_filename(fs::path(SLIC3R_APP_KEY ".ini")));
         CHECK(mgr.is_denied_filename(fs::path(GCODEVIEWER_APP_KEY ".ini")));
         CHECK(mgr.is_denied_filename(fs::path(secret_constants::USER_SECRET_FILENAME)));
-        CHECK(mgr.is_denied_filename(fs::path(".install_state.json")));
     }
 
     SECTION("companions holding the same secrets are denied by the prefix rule")
@@ -160,7 +136,6 @@ TEST_CASE("Plugin audit deny beats allowed roots", "[audit]")
 
     const fs::path conf  = fs::path(data_dir()) / (SLIC3R_APP_KEY ".conf");
     const fs::path token = fs::path(data_dir()) / secret_constants::USER_SECRET_FILENAME;
-    const fs::path install_state = fs::path(data_dir()) / "plugins" / "example" / ".install_state.json";
 
     SECTION("a non-denied file inside the allowed root is writable (root really grants writes)")
     {
@@ -201,17 +176,6 @@ TEST_CASE("Plugin audit deny beats allowed roots", "[audit]")
         CHECK_FALSE(decision.allowed);
     }
 
-    SECTION("plugin install state is blocked for reads and writes despite the allowed root")
-    {
-        AuditDecision read_decision = mgr.check_open(install_state.string(), "r");
-        CHECK_FALSE(read_decision.allowed);
-        CHECK(read_decision.reason == "denied filename");
-
-        AuditDecision write_decision = mgr.check_open(install_state.string(), "w");
-        CHECK_FALSE(write_decision.allowed);
-        CHECK(write_decision.reason == "denied filename");
-    }
-
     SECTION("a traversal path resolving to the config is blocked")
     {
         const fs::path traversal = fs::path(data_dir()) / "plugins" / ".." / (SLIC3R_APP_KEY ".conf");
@@ -690,71 +654,6 @@ const char* const PLUGIN = "AuditPlugin";
 
 } // namespace
 
-TEST_CASE("Probe phase scope restores the previous phase", "[audit]")
-{
-    PluginAuditManager& mgr = PluginAuditManager::instance();
-    mgr.set_current_audit_phase("outer");
-    {
-        ScopedPluginAuditPhase inner("inner");
-        CHECK(mgr.current_audit_phase() == "inner");
-    }
-    CHECK(mgr.current_audit_phase() == "outer");
-    mgr.clear_current_audit_phase();
-    CHECK(mgr.current_audit_phase().empty());
-}
-
-TEST_CASE("Record-only probe observations bypass prompts and retain phase attribution", "[audit][Python]")
-{
-    AuditHarness harness;
-    if (!harness.initialized)
-        SKIP("Bundled Python interpreter unavailable: " + PythonInterpreter::instance().last_error());
-    harness.add_plugin(PLUGIN);
-    py::gil_scoped_acquire gil;
-    PythonSide              python(harness);
-
-    PluginProbeCollector          collector;
-    ScopedTestObservationObserver observer(collector);
-
-    // A declared read permission is recorded and allowed, but must not be written to the sidecar.
-    {
-        ScopedPluginAuditContext context(PLUGIN);
-        CHECK(PluginAuditManager::instance().request_filesystem_read_permissions(PLUGIN, {"/tmp/probe-declared"}));
-    }
-
-    {
-        ScopedPluginAuditPhase phase("probe:callback");
-        python.run_as(PLUGIN, "outcome = attempt(lambda: open(PRIVATE).close())");
-    }
-
-    CHECK(python.str("outcome") == "ok");
-    CHECK(harness.prompts.empty());
-    CHECK(harness.saved_permissions(PLUGIN).fs_read.empty());
-
-    const std::vector<AuditObservation> observations = collector.observations();
-    const auto                          open_event   = std::find_if(
-        observations.begin(), observations.end(), [](const AuditObservation& observation) {
-            return observation.event_name == "open";
-        });
-    REQUIRE(open_event != observations.end());
-    CHECK(open_event->plugin_key == PLUGIN);
-    CHECK(open_event->phase == "probe:callback");
-    CHECK(open_event->category == "FsRead");
-    CHECK(open_event->continued);
-    CHECK(std::find(open_event->targets.begin(), open_event->targets.end(), python.str("PRIVATE")) !=
-          open_event->targets.end());
-
-    const auto declared = std::find_if(observations.begin(), observations.end(), [](const AuditObservation& observation) {
-        return observation.event_name == "orca.request_permissions";
-    });
-    REQUIRE(declared != observations.end());
-    CHECK(declared->category == "FsRead");
-    CHECK(std::find(declared->targets.begin(), declared->targets.end(), "/tmp/probe-declared") != declared->targets.end());
-
-    const nlohmann::json summary = collector.summary();
-    CHECK(summary["categories"].contains("FsRead"));
-    CHECK(summary["observed_event_count"].get<std::size_t>() == observations.size());
-}
-
 TEST_CASE("A saved request grant covers the request's own connection in a later session", "[audit][Python]")
 {
     AuditHarness harness;