fix: update api to allow requesting network permissions

2026-10-19 21:51:06 +00:00 · 2026-10-20 01:15:14 +08:00
57 changed files with 10640 additions and 21076 deletions
@@ -1,6 +1,6 @@
 ---
 name: orca-translations
-description: Use when updating, filling, reviewing or fixing OrcaSlicer translations in localization/i18n — running scripts/run_gettext --full, translating empty or new msgids in the .po catalogs, AI translation passes and their "# AI Translated" / "# Needs human review" comments, plural forms, msgctxt homonyms, and keeping catalogs consistent with the localization glossary (OrcaSlicer_WIKI developer_reference/glossary), including adding new glossary terms. Also use for msgfmt or run_gettext failures, placeholder or line-break mismatches, and reviewing a translation PR against the glossary.
+description: Use when updating, filling, reviewing or fixing OrcaSlicer translations in localization/i18n — running scripts/run_gettext --full, translating empty or new msgids in the .po catalogs, AI translation passes and their "# AI Translated" / "# Needs human review" comments, plural forms, msgctxt homonyms, and keeping catalogs consistent with the localization glossary (OrcaSlicer_WIKI localization_glossary.tsv), including adding new glossary terms. Also use for msgfmt or run_gettext failures, placeholder or line-break mismatches, and reviewing a translation PR against the glossary.
 ---

 # OrcaSlicer translations
@@ -9,7 +9,7 @@ The UI strings live in gettext catalogs: `localization/i18n/OrcaSlicer.pot` is t
 `localization/i18n/<lang>/OrcaSlicer_<lang>.po` holds each language. The `en` catalog is empty on
 purpose, so skip it. Recurring terms are fixed by the
 [localization glossary](https://github.com/OrcaSlicer/OrcaSlicer_WIKI/blob/main/developer_reference/localization_glossary.md),
-whose source is the per-language files in `developer_reference/glossary/` (`terms.tsv`, `languages.txt` and one `<lang>.tsv`) in the **OrcaSlicer_WIKI** repository.
+whose source is `developer_reference/localization_glossary.tsv` in the **OrcaSlicer_WIKI** repository.
 A translation pass therefore touches two repositories: the catalogs here, and the glossary there.

 All catalog editing goes through [`scripts/po_tool.py`](scripts/po_tool.py) (standard library only).
@@ -153,7 +153,7 @@ Report:
 - anything left empty, and why;
 - the glossary rows added or filled.

-The catalogs (and `OrcaSlicer.pot`) and the glossary (`developer_reference/glossary/*.tsv` and `localization_glossary.md`) are
+The catalogs (and `OrcaSlicer.pot`) and the glossary (`localization_glossary.tsv` and `.md`) are
 separate changes in separate repositories. The wiki change should land with, or before, the catalog
 change. Commit or open PRs only when asked.

@@ -210,7 +210,7 @@ with the translators, followed by the catalogs.
 When this skill and the checkouts disagree, the checkouts win:
 - `scripts/run_gettext.sh` / `.bat` for extraction and merging;
 - `localization/i18n/list.txt` for the scanned sources;
- the wiki's `localization_guide.md` and `localization_glossary.md` and `glossary/*.tsv` for the rules and terms;
+- the wiki's `localization_guide.md` and `localization_glossary.md` / `.tsv` for the rules and terms;
 - `AGENTS.md` (Localization & translations) for the repository's conventions.

 ## Editing this skill
@@ -28,14 +28,13 @@ import sys
 import tempfile
 import time
 import unicodedata
-import urllib.error
 import urllib.request
 from pathlib import Path

 REPO = Path(__file__).resolve().parents[4]
 I18N = REPO / "localization" / "i18n"
 SKIP_LANGS = {"en"}  # the English catalog is intentionally empty
-GLOSSARY_DIR = Path("developer_reference") / "glossary"  # terms.tsv, languages.txt and one <lang>.tsv per language
+GLOSSARY_TSV = Path("developer_reference") / "localization_glossary.tsv"
 GLOSSARY_MD = Path("developer_reference") / "localization_glossary.md"
 MISSING = {"", "—"}
 RAW_URL = "https://raw.githubusercontent.com/OrcaSlicer/OrcaSlicer_WIKI/main/"
@@ -253,40 +252,30 @@ def all_langs():

 def find_wiki(arg):
    for cand in [arg, os.environ.get("ORCA_WIKI_DIR"), REPO.parent / "OrcaSlicer_WIKI", REPO.parent / "OrcaSlicer.wiki"]:
-        if cand and (Path(cand) / GLOSSARY_DIR / "terms.tsv").exists():
+        if cand and (Path(cand) / GLOSSARY_TSV).exists():
            return Path(cand)
    return None


-def _download(rel, required=True):
-    cache = Path(tempfile.gettempdir()) / "orca_glossary" / rel
+def _download(rel):
+    cache = Path(tempfile.gettempdir()) / ("orca_glossary_" + rel.name)
    if not cache.exists() or time.time() - cache.stat().st_mtime > 3600:
-        try:
-            with urllib.request.urlopen(RAW_URL + rel.as_posix(), timeout=30) as r:
-                data = r.read()
-        except urllib.error.HTTPError:
-            if required:
-                raise
-            return None
-        cache.parent.mkdir(parents=True, exist_ok=True)
-        cache.write_bytes(data)
+        with urllib.request.urlopen(RAW_URL + rel.as_posix(), timeout=30) as r:
+            cache.write_bytes(r.read())
    return cache


 class Glossary:
-    """The glossary: rows of [English, Description, <one translation per language loaded>]."""
-
-    def __init__(self, wiki_arg=None, quiet=False, langs=None):
+    def __init__(self, wiki_arg=None, quiet=False):
        self.wiki = find_wiki(wiki_arg)
-        self.langs = langs  # only these languages' files are read (and downloaded); None means all
        if self.wiki:
-            self.dir, self.md = self.wiki / GLOSSARY_DIR, self.wiki / GLOSSARY_MD
+            self.tsv, self.md = self.wiki / GLOSSARY_TSV, self.wiki / GLOSSARY_MD
            if not quiet:
                self.report_clone_state()
        else:
            if not quiet:
                print("note: no OrcaSlicer_WIKI clone found; using the published glossary read-only", file=sys.stderr)
-            self.dir, self.md = _download(GLOSSARY_DIR / "terms.tsv").parent, _download(GLOSSARY_MD)
+            self.tsv, self.md = _download(GLOSSARY_TSV), _download(GLOSSARY_MD)
        self.load()

    def report_clone_state(self):
@@ -301,23 +290,11 @@ class Glossary:
        if behind and behind != "0":
            print(f"note: the wiki clone is {behind} commits behind origin/main (as of its last fetch)", file=sys.stderr)

-    def _read(self, name, required=True):
-        path = self.dir / name if self.wiki else _download(GLOSSARY_DIR / name, required)
-        return path.read_text(encoding="utf-8-sig").splitlines() if path and path.exists() else None
-
    def load(self):
-        terms = [l.split("	") for l in self._read("terms.tsv")[1:] if l.strip()]
-        langs = [l.strip() for l in self._read("languages.txt") if l.strip()]
-        langs = [l for l in langs if self.langs is None or l in self.langs]
-        self.header = ["English", "Description"] + langs
-        self.rows = [[r[0], r[1] if len(r) > 1 else ""] + [""] * len(langs) for r in terms]
-        index = {r[0]: r for r in self.rows}
-        for col, lang in enumerate(langs, start=2):
-            for line in (self._read(f"{lang}.tsv", required=False) or [])[1:]:
-                cells = line.split("	")
-                # "—" marks a language with no established rendering yet
-                if len(cells) > 2 and cells[0] in index and cells[2].strip() not in MISSING:
-                    index[cells[0]][col] = cells[2].strip()
+        rows = [l.split("\t") for l in self.tsv.read_text(encoding="utf-8-sig").splitlines() if l.strip()]
+        self.header = rows[0]
+        # "—" marks a language with no established rendering yet
+        self.rows = [[c if c.strip() not in MISSING else "" for c in r] + [""] * (len(rows[0]) - len(r)) for r in rows[1:]]
        self.matchers = []
        for row in self.rows:
            base = re.sub(r"\s*\([^)]*\)\s*$", "", row[0]).strip()
@@ -517,7 +494,7 @@ def similar_entries(c, e, pool, cutoff=0.72):

 def cmd_pending(a):
    c = Catalog(catalog_path(a.lang))
-    g = Glossary(a.wiki, langs=[a.lang])
+    g = Glossary(a.wiki)
    todo = [e for e in c.active() if needs_translation(e, c.nplurals, a.include_fuzzy)]
    batch = todo[a.offset:a.offset + a.limit] if a.limit else todo[a.offset:]
    pool = [(x.msgid, x.msgstrs()[0], x.obsolete) for x in c.entries
@@ -556,7 +533,7 @@ def cmd_pending(a):

 def cmd_apply(a):
    c = Catalog(catalog_path(a.lang))
-    g = None if a.no_glossary else Glossary(a.wiki, quiet=True, langs=[a.lang])
+    g = None if a.no_glossary else Glossary(a.wiki, quiet=True)
    data = json.loads(Path(a.input).read_text(encoding="utf-8"))
    items = data["entries"] if isinstance(data, dict) else data
    idx = c.index()
@@ -611,7 +588,7 @@ def find_msgfmt():


 def cmd_check(a):
-    g = None if a.no_glossary else Glossary(a.wiki, quiet=True, langs=a.lang or None)
+    g = None if a.no_glossary else Glossary(a.wiki, quiet=True)
    msgfmt = find_msgfmt()
    status = 0
    for lang in a.lang or all_langs():
@@ -669,7 +646,7 @@ def cmd_lookup(a):


 def cmd_glossary(a):
-    g = Glossary(a.wiki, langs=[a.lang])
+    g = Glossary(a.wiki)
    col = g.column(a.lang)
    if col is None:
        print(f"'{a.lang}' has no glossary column yet; add one with glossary-set --set {a.lang}=...")
@@ -756,17 +733,6 @@ def cmd_candidates(a):
        print(f"{cnt:7} {langs:6}  {text}{'  [label]' if k in labels else ''}  e.g. {ex[:70]}{'…' if len(ex) > 70 else ''}")


-def _edit_tsv(path, edit):
-    """Apply edit(lines) to a glossary TSV, keeping its BOM and line endings."""
-    data = path.read_bytes()
-    bom = data.startswith(b"\xef\xbb\xbf")
-    text = data.decode("utf-8-sig")
-    nl = "\r\n" if "\r\n" in text else "\n"
-    lines = text.splitlines()
-    edit(lines)
-    path.write_bytes((b"\xef\xbb\xbf" if bom else b"") + (nl.join(lines) + nl).encode("utf-8"))
-
-
 def cmd_glossary_set(a):
    wiki = find_wiki(a.wiki)
    if not wiki:
@@ -775,21 +741,8 @@ def cmd_glossary_set(a):
              f"  {a.term}: " + ", ".join(a.set) + "\n"
              "Clone https://github.com/OrcaSlicer/OrcaSlicer_WIKI next to this repository, or pass --wiki.", file=sys.stderr)
        return 2
-    gdir = wiki / GLOSSARY_DIR
-    gen = wiki / "generate_glossary.py"
-    if not gen.exists():
-        sys.exit(f"{gen} not found")
-    run_gen = lambda *args: subprocess.run([sys.executable, str(gen), *args], cwd=wiki, capture_output=True, text=True)
-    langs = [l.strip() for l in (gdir / "languages.txt").read_text(encoding="utf-8-sig").splitlines() if l.strip()]
-    values = {}
-    for s in a.set:
-        lang, _, val = s.partition("=")
-        if lang not in langs:
-            sys.exit(f"no glossary language '{lang}' (add it to {GLOSSARY_DIR.as_posix()}/languages.txt)")
-        if "\t" in val or "\n" in val:
-            sys.exit("values cannot contain tabs or line breaks")
-        values[lang] = val.strip()
-    lock = gdir / ".lock"
+    tsv = wiki / GLOSSARY_TSV
+    lock = tsv.with_suffix(".lock")
    for _ in range(100):
        try:
            fd = os.open(lock, os.O_CREAT | os.O_EXCL)
@@ -799,51 +752,50 @@ def cmd_glossary_set(a):
    else:
        sys.exit(f"could not lock {lock}; remove it if no other run is active")
    try:
-        terms = (gdir / "terms.tsv").read_text(encoding="utf-8-sig").splitlines()
-        new = not any(l.split("\t")[0] == a.term for l in terms[1:])
-        if new and not a.description:
-            sys.exit("a new term needs --description (one sentence saying what it is)")
-        # an established translation is only replaced on request
-        conflicts = []
-        for lang, v in values.items():
-            for line in (gdir / f"{lang}.tsv").read_text(encoding="utf-8-sig").splitlines()[1:]:
-                cells = line.split("\t")
-                if cells[0] == a.term and len(cells) > 2 and cells[2].strip() not in MISSING and cells[2] != v:
-                    conflicts.append(f"{lang}: '{cells[2]}' -> '{v}'")
+        data = tsv.read_bytes()
+        bom = data.startswith(b"\xef\xbb\xbf")
+        text = data.decode("utf-8-sig")
+        nl = "\r\n" if "\r\n" in text else "\n"
+        lines = text.splitlines()
+        header = lines[0].split("\t")
+        values = {}
+        for s in a.set:
+            lang, _, val = s.partition("=")
+            if lang not in header:
+                sys.exit(f"no glossary column '{lang}'")
+            if "\t" in val or "\n" in val:
+                sys.exit("values cannot contain tabs or line breaks")
+            values[header.index(lang)] = val.strip()
+        row_i = next((i for i, l in enumerate(lines[1:], 1) if l.split("\t")[0] == a.term), None)
+        new = row_i is None
+        if new:
+            if not a.description:
+                sys.exit("a new term needs --description (one sentence saying what it is)")
+            row = [a.term, a.description] + [""] * (len(header) - 2)
+            lines.append("")
+            row_i = len(lines) - 1
+        else:
+            row = lines[row_i].split("\t")
+            row += [""] * (len(header) - len(row))
+            if a.description:
+                row[1] = a.description
+        conflicts = [f"{header[i]}: '{row[i]}' -> '{v}'" for i, v in values.items() if row[i].strip() not in MISSING and row[i] != v]
        if conflicts and not a.replace:
            sys.exit("established translations differ (pass --replace, and update the catalogs to match):\n  " + "\n  ".join(conflicts))
-
-        def edit_terms(lines):
-            for i, l in enumerate(lines):
-                if i and l.split("\t")[0] == a.term:
-                    if a.description:
-                        lines[i] = f"{a.term}\t{a.description}"
-                    return
-            lines.append(f"{a.term}\t{a.description}")
-        if new or a.description:
-            _edit_tsv(gdir / "terms.tsv", edit_terms)
-            r = run_gen("--sync")  # copies the term and description into every language file
-            if r.returncode:
-                sys.exit((r.stdout + r.stderr).strip())
-
-        def setter(lang, v):
-            def edit(lines):
-                for i, l in enumerate(lines):
-                    cells = l.split("\t")
-                    if i and cells[0] == a.term:
-                        lines[i] = "\t".join(cells[:2] + [v])
-                        return
-                sys.exit(f"{lang}.tsv has no row for '{a.term}'")
-            return edit
-        for lang, v in values.items():
-            _edit_tsv(gdir / f"{lang}.tsv", setter(lang, v))
+        for i, v in values.items():
+            row[i] = v
+        lines[row_i] = "\t".join(row)
+        tsv.write_bytes((b"\xef\xbb\xbf" if bom else b"") + (nl.join(lines) + nl).encode("utf-8"))
    finally:
        os.close(fd)
        os.unlink(lock)
    print(f"glossary: {'added' if new else 'updated'} '{a.term}'")
-    r = run_gen("--update")
-    print((r.stdout + r.stderr).strip())
-    return r.returncode
+    gen = wiki / "generate_glossary.py"
+    if gen.exists():
+        r = subprocess.run([sys.executable, str(gen), "--update"], cwd=wiki, capture_output=True, text=True)
+        print((r.stdout + r.stderr).strip())
+        return r.returncode
+    return 0


 def main():
@@ -91,7 +91,7 @@ See `.claude/skills/orca-translations/references/source-audit.md` for the full c
 ### Terminology

 - Use the [Localization glossary](https://github.com/OrcaSlicer/OrcaSlicer_WIKI/blob/main/developer_reference/localization_glossary.md) as the source of truth for recurring terms, so the same English term is always rendered the same way within a language, and terms that must stay in English (brand/product names, acronyms, materials, file formats, G-code tokens, macros/variables/identifiers) are not translated.
- If a term's established translation changes, update both the affected `.po` files and the glossary (`developer_reference/glossary/<lang>.tsv` in the wiki, then regenerate) so they stay in sync.
+- If a term's established translation changes, update both the affected `.po` files and the glossary (`localization_glossary.tsv`, then regenerate) so they stay in sync.
 - Translate the *meaning*, not the words. Check what the string actually controls before translating it — English reuses one word for different things. `Flow ratio` (multiplier), `Flow Rate` (throughput) and `Flow Dynamics` (pressure compensation) are three different terms; `extruder` may mean the toolhead, the feeder motor, or the nozzle depending on the string.
 - Reuse one template per recurring message shape (`Failed to connect to …`, `Are you sure you want to …?`), even where the English wording varies.

@@ -16,8 +16,6 @@ else()
 	endif()
 endif()

-set(_openssl_dir ${DESTDIR})
-
 if(WIN32)
    set(_openssl_msvc_env CC=cl CXX=cl RC=rc CL=/FS)
    # OpenSSL's perl Configure honors the CC environment variable, but the
@@ -45,14 +43,6 @@ if(WIN32)
 else()
    if(APPLE)
        set(_conf_cmd export MACOSX_DEPLOYMENT_TARGET=${CMAKE_OSX_DEPLOYMENT_TARGET} && ./Configure -mmacosx-version-min=${CMAKE_OSX_DEPLOYMENT_TARGET})
-        # OPENSSLDIR is only where OpenSSL looks at runtime for cert.pem, certs/
-        # and openssl.cnf; install_sw installs nothing there. Point it at the
-        # system CA bundle, the one libcurl already uses here, so the bundled
-        # Python's ssl module can verify HTTPS. Elsewhere it stays the prefix:
-        # Windows Python reads the system certificate store, and on Linux, where
-        # the bundle's location differs by distro, CurlGlobalInit points
-        # SSL_CERT_FILE at it at startup.
-        set(_openssl_dir /etc/ssl)
    else()
        # A static library that is embedded into a shared object must not export
        # its symbols. On Linux the running process also loads the system OpenSSL
@@ -91,7 +81,7 @@ ExternalProject_Add(dep_OpenSSL
    # URL_HASH SHA256=8c776993154652d0bb393f506d850b811517c8bd8d24b1008aef57fbe55d3f31
    DOWNLOAD_DIR ${DEP_DOWNLOAD_DIR}/OpenSSL
 	CONFIGURE_COMMAND ${_conf_cmd} ${_cross_arch}
-        "--openssldir=${_openssl_dir}"
+        "--openssldir=${DESTDIR}"
        "--prefix=${DESTDIR}"
        # OpenSSL's linux-x86_64 target sets multilib=64, so it installs to
        # <prefix>/lib64 while every other dep uses <prefix>/lib. CPython's
@@ -125,12 +115,12 @@ ExternalProject_Add_Step(dep_OpenSSL install_cmake_files
    WORKING_DIRECTORY "${CMAKE_CURRENT_LIST_DIR}"
 )

-if (NOT WIN32)
-    # OpenSSL's object rules do not depend on the configured flags or paths, so
-    # reconfiguring it (a new compiler flag, a different --openssldir) relinks
-    # the archives from stale objects instead of recompiling them, and the
-    # change silently has no effect. Drop the objects whenever this recipe
-    # changes so the next build actually recompiles them.
+if (NOT WIN32 AND NOT APPLE)
+    # OpenSSL's object rules do not depend on CFLAGS, so reconfiguring it (for
+    # example to add -fvisibility=hidden) relinks the archives from stale
+    # objects instead of recompiling them, and the change silently has no
+    # effect. Drop the objects whenever this recipe changes so the next build
+    # actually recompiles them.
    ExternalProject_Get_Property(dep_OpenSSL SOURCE_DIR)
    ExternalProject_Add_Step(dep_OpenSSL clean_objects
        DEPENDEES configure
@@ -365,11 +365,10 @@ if(TARGET dep_ZLIB)
    add_dependencies(dep_python3 dep_ZLIB)
 endif()

-if (NOT WIN32)
-    # _ssl and _hashlib embed the static OpenSSL built in deps/ (Windows uses
-    # CPython's prebuilt OpenSSL instead). Their Makefile rules depend only on
-    # their own sources, not on the OpenSSL archives, so a rebuilt OpenSSL does
-    # not make them relink and they keep the previous one. On an incremental tree,
+if (NOT WIN32 AND NOT APPLE)
+    # CPython's Makefile rules for _ssl and _hashlib depend only on their own
+    # sources, not on the OpenSSL archives, so a rebuilt OpenSSL does not make
+    # them relink and they keep the previous symbols. On an incremental tree,
    # drop the built modules and relink them against the current OpenSSL; a
    # fresh build is left alone (its PGO target builds them). "make" alone is a
    # no-op once PGO has run, so sharedmods is invoked explicitly.
@@ -8,7 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: PACKAGE VERSION\n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2026-10-19 09:48-0300\n"
+"POT-Creation-Date: 2026-10-15 17:40+0800\n"
 "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: LANGUAGE <LL@li.org>\n"
@@ -1637,16 +1637,16 @@ msgstr ""
 msgid "Stroke of shape (%1%) contains unsupported: %2%."
 msgstr ""

-msgid "Not valid state please report reproduction steps on GitHub"
+msgid "Not valid state please report reproduction steps on github"
 msgstr ""

 msgid "No embossed file"
 msgstr ""

-msgid "Missing SVG file in embossed shape"
+msgid "Missing svg file in embossed shape"
 msgstr ""

-msgid "Missing data of SVG file"
+msgid "Missing data of svg file"
 msgstr ""

 msgid "Face the camera"
@@ -4579,7 +4579,7 @@ msgstr ""
 msgid "Unknown C++ exception."
 msgstr ""

-msgid "Processing G-code from previous file…"
+msgid "Processing G-Code from previous file…"
 msgstr ""

 msgid "Slicing complete"
@@ -6049,7 +6049,7 @@ msgstr ""
 msgid "Size:"
 msgstr ""

-#, possible-c-format, possible-boost-format
+#, possible-boost-format
 msgid "Conflicts of G-code paths have been found at layer %d, Z = %.2lfmm. Please separate the conflicted objects farther (%s <-> %s)."
 msgstr ""

@@ -12318,7 +12318,7 @@ msgstr ""
 msgid "Left mouse"
 msgstr ""

-msgid "Available anywhere in the window."
+msgid "Available anywhere in the window, even while typing in a text field."
 msgstr ""

 msgid "Run favorite 1 to 10"
@@ -12415,6 +12415,9 @@ msgstr ""
 msgid "The default %s is assigned to %s. Reassign it to %s?"
 msgstr ""

+msgid "Global shortcuts also apply while typing."
+msgstr ""
+
 msgid "A key that types a character cannot be a global shortcut."
 msgstr ""

@@ -15645,12 +15648,6 @@ msgstr ""
 msgid "Enable this option to add EXCLUDE OBJECT command in G-code."
 msgstr ""

-msgid "Outline tolerance"
-msgstr ""
-
-msgid "Maximum deviation of the object outline written to EXCLUDE_OBJECT_DEFINE from the original outline. Larger values give fewer points, which helps firmware that stalls while parsing G-code with many objects. 0 keeps every point."
-msgstr ""
-
 msgid "Verbose G-code"
 msgstr ""

@@ -20546,7 +20543,7 @@ msgid "test %s start..."
 msgstr ""

 #, possible-c-format, possible-boost-format
-msgid "test %s IP resolved = %s"
+msgid "test %s ip resolved = %s"
 msgstr ""

 #, possible-c-format, possible-boost-format
@@ -26498,18 +26495,17 @@ msgstr ""
 msgid "Basic Colors"
 msgstr ""

-#. TRN: Keep the brand name "Orca" unchanged; translate only the palette descriptor.
 msgid "Orca Palette"
 msgstr ""

-#. TRN: Keep the standard/brand name "RAL" unchanged.
+#. TRN: Keep the brand name "Orca" unchanged; translate only the palette descriptor.
 msgid "RAL Classic"
 msgstr ""

+#. TRN: Keep the standard/brand name "RAL" unchanged.
 msgid "Gradients"
 msgstr ""

-msgctxt "Color picker"
 msgid "Solid"
 msgstr ""

@@ -26884,7 +26880,7 @@ msgstr ""
 msgid "Medium violet red"
 msgstr ""

-msgid "Pale violet red"
+msgid "PaleV violet red"
 msgstr ""

 msgid "Deep pink"
@@ -27046,7 +27042,7 @@ msgstr ""
 msgid "Shallow sky"
 msgstr ""

-msgid "Electric blue"
+msgid "Electric bel"
 msgstr ""

 msgid "Dolphin"
@@ -27115,7 +27111,7 @@ msgstr ""
 msgid "Maize yellow"
 msgstr ""

-msgid "Daffodil yellow"
+msgid "Dalmatian yellow"
 msgstr ""

 msgid "Brown beige"
@@ -27376,7 +27372,7 @@ msgstr ""
 msgid "Turquoise blue"
 msgstr ""

-msgid "Capri blue"
+msgid "Capsanthin violet"
 msgstr ""

 msgid "Ocean blue"
@@ -27490,7 +27486,7 @@ msgstr ""
 msgid "Silver grey"
 msgstr ""

-msgid "Olive grey"
+msgid "Olivestone"
 msgstr ""

 msgid "Moss grey"
@@ -28078,19 +28074,10 @@ msgstr ""
 msgid "Built-in"
 msgstr ""

-msgid "My textures"
-msgstr ""
-
 msgid "No textures found."
 msgstr ""

-msgid "Texture libraries"
-msgstr ""
-
-msgid "Explore more texture libraries"
-msgstr ""
-
-msgid "Opens OrcaCloud in the Home page to browse for plugins."
+msgid "My textures"
 msgstr ""

 msgid "Import your own image as a height map. It is converted to the format the slicer bakes from and saved to your personal texture folder, kept separate from the textures shipped with OrcaSlicer."
@@ -30143,9 +30130,6 @@ msgstr ""
 msgid "Slicing Pipeline"
 msgstr ""

-msgid "Resource Texture"
-msgstr ""
-
 msgid "The plugin's configuration UI was empty. Showing the default editor."
 msgstr ""

@@ -30261,24 +30245,6 @@ msgstr ""
 msgid "Plugin directory does not contain a .py or .whl entry file"
 msgstr ""

-msgid "Resource texture directory is not set"
-msgstr ""
-
-msgid "Resource texture directory could not be resolved"
-msgstr ""
-
-msgid "Resource texture path is not a directory"
-msgstr ""
-
-msgid "Plugin folder could not be resolved"
-msgstr ""
-
-msgid "Resource texture directory is outside the plugin folder"
-msgstr ""
-
-msgid "Resource texture directory could not be read"
-msgstr ""
-
 #, possible-boost-format
 msgid "Slicing pipeline plugin '%1%' error: %2%"
 msgstr ""
@@ -30635,7 +30601,7 @@ msgstr ""

 #. TRN %1% is the application name.
 #, possible-boost-format
-msgid "Not a G-code file generated by %1%."
+msgid "Not a gcode file generated by %1%."
 msgstr ""

 #. TRN %1% is a tag in the G-code file that must not be translated.
@@ -30723,7 +30689,7 @@ msgstr ""
 msgid "Failed making a temporary copy of G-code file %1% before running a post-processing script: %2%"
 msgstr ""

-msgid "Post-processor can't find exported G-code file"
+msgid "Post-processor can't find exported gcode file"
 msgstr ""

 #, possible-boost-format
@@ -3,7 +3,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: Orca Slicer\n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2026-10-19 09:48-0300\n"
+"POT-Creation-Date: 2026-10-15 17:40+0800\n"
 "PO-Revision-Date: 2026-06-17 15:44-0300\n"
 "Last-Translator: Alexandre Folle de Menezes\n"
 "Language-Team: \n"
@@ -1633,16 +1633,16 @@ msgstr ""
 msgid "Stroke of shape (%1%) contains unsupported: %2%."
 msgstr ""

-msgid "Not valid state please report reproduction steps on GitHub"
+msgid "Not valid state please report reproduction steps on github"
 msgstr ""

 msgid "No embossed file"
 msgstr ""

-msgid "Missing SVG file in embossed shape"
+msgid "Missing svg file in embossed shape"
 msgstr ""

-msgid "Missing data of SVG file"
+msgid "Missing data of svg file"
 msgstr ""

 msgid "Face the camera"
@@ -4575,7 +4575,7 @@ msgstr ""
 msgid "Unknown C++ exception."
 msgstr ""

-msgid "Processing G-code from previous file…"
+msgid "Processing G-Code from previous file…"
 msgstr ""

 msgid "Slicing complete"
@@ -6045,7 +6045,7 @@ msgstr ""
 msgid "Size:"
 msgstr ""

-#, c-format, boost-format
+#, boost-format
 msgid "Conflicts of G-code paths have been found at layer %d, Z = %.2lfmm. Please separate the conflicted objects farther (%s <-> %s)."
 msgstr ""

@@ -10653,9 +10653,6 @@ msgstr ""
 msgid "Send Failed"
 msgstr ""

-msgid "No available printers"
-msgstr ""
-
 msgid "The name length exceeds the limit."
 msgstr ""

@@ -12314,7 +12311,7 @@ msgstr ""
 msgid "Left mouse"
 msgstr ""

-msgid "Available anywhere in the window."
+msgid "Available anywhere in the window, even while typing in a text field."
 msgstr ""

 msgid "Run favorite 1 to 10"
@@ -12411,6 +12408,9 @@ msgstr ""
 msgid "The default %s is assigned to %s. Reassign it to %s?"
 msgstr ""

+msgid "Global shortcuts also apply while typing."
+msgstr ""
+
 msgid "A key that types a character cannot be a global shortcut."
 msgstr ""

@@ -15641,12 +15641,6 @@ msgstr ""
 msgid "Enable this option to add EXCLUDE OBJECT command in G-code."
 msgstr ""

-msgid "Outline tolerance"
-msgstr ""
-
-msgid "Maximum deviation of the object outline written to EXCLUDE_OBJECT_DEFINE from the original outline. Larger values give fewer points, which helps firmware that stalls while parsing G-code with many objects. 0 keeps every point."
-msgstr ""
-
 msgid "Verbose G-code"
 msgstr ""

@@ -20542,7 +20536,7 @@ msgid "test %s start..."
 msgstr ""

 #, c-format, boost-format
-msgid "test %s IP resolved = %s"
+msgid "test %s ip resolved = %s"
 msgstr ""

 #, c-format, boost-format
@@ -26494,18 +26488,17 @@ msgstr ""
 msgid "Basic Colors"
 msgstr ""

-#. TRN: Keep the brand name "Orca" unchanged; translate only the palette descriptor.
 msgid "Orca Palette"
 msgstr ""

-#. TRN: Keep the standard/brand name "RAL" unchanged.
+#. TRN: Keep the brand name "Orca" unchanged; translate only the palette descriptor.
 msgid "RAL Classic"
 msgstr ""

+#. TRN: Keep the standard/brand name "RAL" unchanged.
 msgid "Gradients"
 msgstr ""

-msgctxt "Color picker"
 msgid "Solid"
 msgstr ""

@@ -26880,7 +26873,7 @@ msgstr ""
 msgid "Medium violet red"
 msgstr ""

-msgid "Pale violet red"
+msgid "PaleV violet red"
 msgstr ""

 msgid "Deep pink"
@@ -27042,7 +27035,7 @@ msgstr ""
 msgid "Shallow sky"
 msgstr ""

-msgid "Electric blue"
+msgid "Electric bel"
 msgstr ""

 msgid "Dolphin"
@@ -27111,7 +27104,7 @@ msgstr ""
 msgid "Maize yellow"
 msgstr ""

-msgid "Daffodil yellow"
+msgid "Dalmatian yellow"
 msgstr ""

 msgid "Brown beige"
@@ -27372,7 +27365,7 @@ msgstr ""
 msgid "Turquoise blue"
 msgstr ""

-msgid "Capri blue"
+msgid "Capsanthin violet"
 msgstr ""

 msgid "Ocean blue"
@@ -27486,7 +27479,7 @@ msgstr ""
 msgid "Silver grey"
 msgstr ""

-msgid "Olive grey"
+msgid "Olivestone"
 msgstr ""

 msgid "Moss grey"
@@ -28074,19 +28067,10 @@ msgstr ""
 msgid "Built-in"
 msgstr ""

-msgid "My textures"
-msgstr ""
-
 msgid "No textures found."
 msgstr ""

-msgid "Texture libraries"
-msgstr ""
-
-msgid "Explore more texture libraries"
-msgstr ""
-
-msgid "Opens OrcaCloud in the Home page to browse for plugins."
+msgid "My textures"
 msgstr ""

 msgid "Import your own image as a height map. It is converted to the format the slicer bakes from and saved to your personal texture folder, kept separate from the textures shipped with OrcaSlicer."
@@ -30139,9 +30123,6 @@ msgstr ""
 msgid "Slicing Pipeline"
 msgstr ""

-msgid "Resource Texture"
-msgstr ""
-
 msgid "The plugin's configuration UI was empty. Showing the default editor."
 msgstr ""

@@ -30257,24 +30238,6 @@ msgstr ""
 msgid "Plugin directory does not contain a .py or .whl entry file"
 msgstr ""

-msgid "Resource texture directory is not set"
-msgstr ""
-
-msgid "Resource texture directory could not be resolved"
-msgstr ""
-
-msgid "Resource texture path is not a directory"
-msgstr ""
-
-msgid "Plugin folder could not be resolved"
-msgstr ""
-
-msgid "Resource texture directory is outside the plugin folder"
-msgstr ""
-
-msgid "Resource texture directory could not be read"
-msgstr ""
-
 #, boost-format
 msgid "Slicing pipeline plugin '%1%' error: %2%"
 msgstr ""
@@ -30631,7 +30594,7 @@ msgstr ""

 #. TRN %1% is the application name.
 #, boost-format
-msgid "Not a G-code file generated by %1%."
+msgid "Not a gcode file generated by %1%."
 msgstr ""

 #. TRN %1% is a tag in the G-code file that must not be translated.
@@ -30719,7 +30682,7 @@ msgstr ""
 msgid "Failed making a temporary copy of G-code file %1% before running a post-processing script: %2%"
 msgstr ""

-msgid "Post-processor can't find exported G-code file"
+msgid "Post-processor can't find exported gcode file"
 msgstr ""

 #, boost-format
@@ -6,7 +6,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: Slic3rPE\n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2026-10-19 09:48-0300\n"
+"POT-Creation-Date: 2026-10-15 17:40+0800\n"
 "PO-Revision-Date: 2026-06-11 12:37-0300\n"
 "Last-Translator: Handle <mail@bysb.net>\n"
 "Language-Team: \n"
@@ -1751,7 +1751,7 @@ msgid "Stroke of shape (%1%) contains unsupported: %2%."
 msgstr "形状（%1%）的描边包含不受支持的内容：%2%。"

 # AI Translated
-msgid "Not valid state please report reproduction steps on GitHub"
+msgid "Not valid state please report reproduction steps on github"
 msgstr "状态无效，请在 GitHub 上报告复现步骤"

 # AI Translated
@@ -1759,11 +1759,11 @@ msgid "No embossed file"
 msgstr "没有浮雕文件"

 # AI Translated
-msgid "Missing SVG file in embossed shape"
+msgid "Missing svg file in embossed shape"
 msgstr "浮雕形状中缺少 SVG 文件"

 # AI Translated
-msgid "Missing data of SVG file"
+msgid "Missing data of svg file"
 msgstr "缺少 SVG 文件数据"

 # AI Translated
@@ -5008,7 +5008,7 @@ msgid "Unknown C++ exception."
 msgstr "未知的 C++ 异常。"

 # AI Translated
-msgid "Processing G-code from previous file…"
+msgid "Processing G-Code from previous file…"
 msgstr "正在处理之前文件的 G-code…"

 msgid "Slicing complete"
@@ -6699,7 +6699,7 @@ msgstr "体积："
 msgid "Size:"
 msgstr "尺寸："

-#, c-format, boost-format
+#, boost-format
 msgid "Conflicts of G-code paths have been found at layer %d, Z = %.2lfmm. Please separate the conflicted objects farther (%s <-> %s)."
 msgstr "发现G-code路径在层%d，高度为%.2lf mm处有冲突。请将有冲突的对象分离得更远(%s <-> %s)。"

@@ -12013,10 +12013,6 @@ msgstr "上传文件到打印机存储失败，请重试。"
 msgid "Send Failed"
 msgstr "发送失败"

-# AI Translated
-msgid "No available printers"
-msgstr "没有可用的打印机"
-
 msgid "The name length exceeds the limit."
 msgstr "名称长度超过限制。"

@@ -13926,8 +13922,8 @@ msgid "Left mouse"
 msgstr "鼠标左键"

 # AI Translated
-msgid "Available anywhere in the window."
-msgstr "在窗口任意位置可用。"
+msgid "Available anywhere in the window, even while typing in a text field."
+msgstr "在窗口任意位置可用，即使正在文本框中输入。"

 # AI Translated
 msgid "Run favorite 1 to 10"
@@ -14043,6 +14039,10 @@ msgstr "%s 已分配给 %s。是否将其重新分配给 %s？"
 msgid "The default %s is assigned to %s. Reassign it to %s?"
 msgstr "默认的 %s 已分配给 %s。是否将其重新分配给 %s？"

+# AI Translated
+msgid "Global shortcuts also apply while typing."
+msgstr "全局快捷键在输入文字时同样生效。"
+
 # AI Translated
 msgid "A key that types a character cannot be a global shortcut."
 msgstr "会输入字符的按键不能用作全局快捷键。"
@@ -18086,14 +18086,6 @@ msgstr "对象排除"
 msgid "Enable this option to add EXCLUDE OBJECT command in G-code."
 msgstr "启用此选项以在G-code中添加EXCLUDE OBJECT命令。"

-# AI Translated
-msgid "Outline tolerance"
-msgstr "轮廓线公差"
-
-# AI Translated
-msgid "Maximum deviation of the object outline written to EXCLUDE_OBJECT_DEFINE from the original outline. Larger values give fewer points, which helps firmware that stalls while parsing G-code with many objects. 0 keeps every point."
-msgstr "写入 EXCLUDE_OBJECT_DEFINE 的对象轮廓线与原始轮廓线之间的最大偏差。数值越大，点数越少，有助于避免固件在解析包含大量对象的 G-code 时卡顿。0 表示保留所有点。"
-
 msgid "Verbose G-code"
 msgstr "注释G-code"

@@ -24012,7 +24004,7 @@ msgstr "开始测试 %s..."

 # AI Translated
 #, c-format, boost-format
-msgid "test %s IP resolved = %s"
+msgid "test %s ip resolved = %s"
 msgstr "测试 %s：IP 解析结果 = %s"

 # AI Translated
@@ -31506,21 +31498,20 @@ msgid "Basic Colors"
 msgstr "基本颜色"

 # AI Translated
-#. TRN: Keep the brand name "Orca" unchanged; translate only the palette descriptor.
 msgid "Orca Palette"
 msgstr "Orca 调色板"

 # AI Translated
-#. TRN: Keep the standard/brand name "RAL" unchanged.
+#. TRN: Keep the brand name "Orca" unchanged; translate only the palette descriptor.
 msgid "RAL Classic"
 msgstr "RAL 经典色"

 # AI Translated
+#. TRN: Keep the standard/brand name "RAL" unchanged.
 msgid "Gradients"
 msgstr "渐变预设"

 # AI Translated
-msgctxt "Color picker"
 msgid "Solid"
 msgstr "纯色"

@@ -32019,7 +32010,7 @@ msgid "Medium violet red"
 msgstr "中紫罗兰红"

 # AI Translated
-msgid "Pale violet red"
+msgid "PaleV violet red"
 msgstr "浅紫罗兰红"

 # AI Translated
@@ -32235,7 +32226,8 @@ msgid "Shallow sky"
 msgstr "浅空"

 # AI Translated
-msgid "Electric blue"
+# Needs human review: The English “Electric bel” looks like a typo (Electric blue? Electric eel?); the color is #1E90FF, so 电光蓝 was chosen. Recheck once the source name is fixed.
+msgid "Electric bel"
 msgstr "电光蓝"

 # AI Translated
@@ -32327,8 +32319,9 @@ msgid "Maize yellow"
 msgstr "玉米黄"

 # AI Translated
-msgid "Daffodil yellow"
-msgstr "水仙黄"
+# Needs human review: RAL 1007 is “Daffodil yellow” (水仙黄); the English name in the palette looks wrong. Recheck once the source name is fixed.
+msgid "Dalmatian yellow"
+msgstr "达尔马提亚黄"

 # AI Translated
 msgid "Brown beige"
@@ -32675,8 +32668,8 @@ msgid "Turquoise blue"
 msgstr "绿松石蓝"

 # AI Translated
-msgid "Capri blue"
-msgstr "卡普里蓝"
+msgid "Capsanthin violet"
+msgstr "辣椒红素紫"

 # AI Translated
 msgid "Ocean blue"
@@ -32827,8 +32820,8 @@ msgid "Silver grey"
 msgstr "银灰色"

 # AI Translated
-msgid "Olive grey"
-msgstr "橄榄灰"
+msgid "Olivestone"
+msgstr "橄榄石色"

 # AI Translated
 msgid "Moss grey"
@@ -33604,25 +33597,13 @@ msgstr "从“我的纹理”中移除"
 msgid "Built-in"
 msgstr "内置"

-# AI Translated
-msgid "My textures"
-msgstr "我的纹理"
-
 # AI Translated
 msgid "No textures found."
 msgstr "未找到纹理。"

 # AI Translated
-msgid "Texture libraries"
-msgstr "纹理库"
-
-# AI Translated
-msgid "Explore more texture libraries"
-msgstr "探索更多纹理库"
-
-# AI Translated
-msgid "Opens OrcaCloud in the Home page to browse for plugins."
-msgstr "在主页中打开 OrcaCloud，浏览插件。"
+msgid "My textures"
+msgstr "我的纹理"

 # AI Translated
 msgid "Import your own image as a height map. It is converted to the format the slicer bakes from and saved to your personal texture folder, kept separate from the textures shipped with OrcaSlicer."
@@ -36304,10 +36285,6 @@ msgstr "脚本"
 msgid "Slicing Pipeline"
 msgstr "切片流水线"

-# AI Translated
-msgid "Resource Texture"
-msgstr "资源纹理"
-
 # AI Translated
 msgid "The plugin's configuration UI was empty. Showing the default editor."
 msgstr "插件的配置界面为空。正在显示默认编辑器。"
@@ -36456,30 +36433,6 @@ msgstr "插件目录同时包含 .py 和 .whl 入口文件"
 msgid "Plugin directory does not contain a .py or .whl entry file"
 msgstr "插件目录不包含 .py 或 .whl 入口文件"

-# AI Translated
-msgid "Resource texture directory is not set"
-msgstr "未设置资源纹理目录"
-
-# AI Translated
-msgid "Resource texture directory could not be resolved"
-msgstr "无法解析资源纹理目录"
-
-# AI Translated
-msgid "Resource texture path is not a directory"
-msgstr "资源纹理路径不是目录"
-
-# AI Translated
-msgid "Plugin folder could not be resolved"
-msgstr "无法解析插件文件夹"
-
-# AI Translated
-msgid "Resource texture directory is outside the plugin folder"
-msgstr "资源纹理目录位于插件文件夹之外"
-
-# AI Translated
-msgid "Resource texture directory could not be read"
-msgstr "无法读取资源纹理目录"
-
 # AI Translated
 #, boost-format
 msgid "Slicing pipeline plugin '%1%' error: %2%"
@@ -36938,7 +36891,7 @@ msgstr "加载配置文件“%1%”失败：%2%"
 # AI Translated
 #. TRN %1% is the application name.
 #, boost-format
-msgid "Not a G-code file generated by %1%."
+msgid "Not a gcode file generated by %1%."
 msgstr "不是由 %1% 生成的 G-code 文件。"

 # AI Translated
@@ -37058,7 +37011,7 @@ msgid "Failed making a temporary copy of G-code file %1% before running a post-p
 msgstr "运行后处理脚本之前，无法创建 G-code 文件 %1% 的临时副本：%2%"

 # AI Translated
-msgid "Post-processor can't find exported G-code file"
+msgid "Post-processor can't find exported gcode file"
 msgstr "后处理器找不到导出的 G-code 文件"

 # AI Translated
@@ -37447,40 +37400,6 @@ msgstr ""
 "避免翘曲\n"
 "您知道吗？打印ABS这类易翘曲材料时，适当提高热床温度可以降低翘曲的概率。"

-# AI Translated
-# Needs human review: RAL 1007 is “Daffodil yellow” (水仙黄); the English name in the palette looks wrong. Recheck once the source name is fixed.
-#~ msgid "Dalmatian yellow"
-#~ msgstr "达尔马提亚黄"
-
-# AI Translated
-#~ msgid "Capsanthin violet"
-#~ msgstr "辣椒红素紫"
-
-# AI Translated
-#~ msgid "Olivestone"
-#~ msgstr "橄榄石色"
-
-# AI Translated
-#~ msgid "Available anywhere in the window, even while typing in a text field."
-#~ msgstr "在窗口任意位置可用，即使正在文本框中输入。"
-
-# AI Translated
-#~ msgid "Global shortcuts also apply while typing."
-#~ msgstr "全局快捷键在输入文字时同样生效。"
-
-# AI Translated
-#~ msgid "Solid"
-#~ msgstr "纯色"
-
-# AI Translated
-#~ msgid "PaleV violet red"
-#~ msgstr "浅紫罗兰红"
-
-# AI Translated
-# Needs human review: The English “Electric bel” looks like a typo (Electric blue? Electric eel?); the color is #1E90FF, so 电光蓝 was chosen. Recheck once the source name is fixed.
-#~ msgid "Electric bel"
-#~ msgstr "电光蓝"
-
 #~ msgid "Please choose the filament color"
 #~ msgstr "请选择耗材丝颜色"

@@ -37946,6 +37865,9 @@ msgstr ""
 #~ msgid "no configured tool"
 #~ msgstr "未配置的工具头"

+#~ msgid "Add end G-Code when finishing the entire print."
+#~ msgstr "所有打印结束时的结尾G-code"
+
 #~ msgid "Maximum X speed"
 #~ msgstr "X最大速度"

@@ -37962,11 +37884,26 @@ msgstr ""
 #~ msgid "Python plugin(s) invoked at each slicing pipeline step to read and modify intermediate slicing data, including a final G-code post-processing step. Research/experimental."
 #~ msgstr "在每个切片流水线步骤中调用的 Python 插件，用于读取和修改中间切片数据，包括最终的 G-code 后处理步骤。研究/实验性。"

+# AI Translated
+#~ msgid "When enabled, the slicer emits g-code with the primary zone's contents centered on bed origin (0,0). The printer firmware is responsible for placing copies/mirrors at each physical zone position. Enable only on printers whose firmware applies its own zone offsets in copy/mirror mode (e.g. RepRapFirmware IDEX duplication mode). Has no effect in Primary mode."
+#~ msgstr "启用后，切片软件输出的 G-code 会以热床原点 (0,0) 为中心放置主区域的内容，由打印机固件负责把复制件/镜像件放到各个物理区域。仅当打印机固件在复制/镜像模式下会自行应用区域偏移时才启用（例如 RepRapFirmware 的 IDEX 复制模式）。主模式下无效。"
+
 # AI Translated
 # Needs human review: "pem-inversion defaults": confirm pem is the physical extruder map and that the default is its inverse.
 #~ msgid "Per-plate override mapping physical heads to filament slots (1-based). Empty means use pem-inversion defaults."
 #~ msgstr "按盘单独设置物理工具头到耗材丝槽位的映射（从 1 开始编号），覆盖默认映射。留空则使用由物理挤出机映射（pem）反推的默认值。"

+# AI Translated
+#~ msgid "Axis the mesh is rotated about before slicing. This is the belt printer's tilt: an isometric (no distortion) rotation that also drives bed rendering and support gravity tilt, and that the g-code back-transform inverts before the machine-frame shear/scale and remap. X is the typical gantry tilt (belt travels along Y)."
+#~ msgstr "切片前模型网格的旋转轴。这一旋转即传送带打印机的倾斜：它是保距（无畸变）旋转，同时用于热床渲染和支撑的重力倾斜；生成 G-code 时，逆变换会先还原这一旋转，再进行机器坐标系剪切/缩放和重映射。X 是典型的龙门倾斜轴（传送带沿 Y 方向移动）。"
+
+# AI Translated
+#~ msgid "Expert override: set the machine-frame (g-code shear/scale) tilt angle independently of the pre-slice rotation angle. When disabled, the machine-frame transform is derived from the belt tilt angle, so a single angle drives both stages. Enable only to compensate for a machine whose physical gantry tilt differs from the slicing rotation."
+#~ msgstr "专家选项：单独设置机器坐标系（G-code 剪切/缩放）的倾斜角度，与切片前的旋转角度互不影响。禁用时，机器坐标系变换由传送带倾斜角度推导，两个阶段使用同一个角度。仅当机器实际的龙门倾角与切片旋转角度不一致时，才需启用此项进行补偿。"
+
+#~ msgid "The maximum deviation allowed when reducing the resolution for the 'Maximum wall resolution' setting. If you increase this, the print will be less accurate, but the G-Code will be smaller. 'Maximum wall deviation' limits 'Maximum wall resolution', so if the two conflict, 'Maximum wall deviation' takes precedence."
+#~ msgstr "在为“最大墙体分辨率”设置降低分辨率时所允许的最大偏差。如果增大此值，打印精度会降低，但 G-code 会更小。“最大墙体偏差”会限制“最大墙体分辨率”，因此当两者冲突时，以“最大墙体偏差”为准。"
+
 #~ msgid " not in range "
 #~ msgstr " 不在合理范围内"

@@ -9,7 +9,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: Orca Slicer\n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2026-10-19 09:48-0300\n"
+"POT-Creation-Date: 2026-10-15 17:40+0800\n"
 "PO-Revision-Date: 2025-11-28 13:48-0600\n"
 "Last-Translator: tntchn <15895303+tntchn@users.noreply.github.com>\n"
 "Language-Team: \n"
@@ -1826,7 +1826,7 @@ msgid "Stroke of shape (%1%) contains unsupported: %2%."
 msgstr "形狀（%1%）的筆劃包含不支援的內容：%2%。"

 # AI Translated
-msgid "Not valid state please report reproduction steps on GitHub"
+msgid "Not valid state please report reproduction steps on github"
 msgstr "狀態無效，請在 GitHub 上回報重現步驟"

 # AI Translated
@@ -1834,11 +1834,11 @@ msgid "No embossed file"
 msgstr "沒有浮雕檔案"

 # AI Translated
-msgid "Missing SVG file in embossed shape"
+msgid "Missing svg file in embossed shape"
 msgstr "浮雕形狀中缺少 SVG 檔案"

 # AI Translated
-msgid "Missing data of SVG file"
+msgid "Missing data of svg file"
 msgstr "缺少 SVG 檔案的資料"

 msgid "Face the camera"
@@ -5219,7 +5219,7 @@ msgid "Unknown C++ exception."
 msgstr "未知的 C++ 例外。"

 # AI Translated
-msgid "Processing G-code from previous file…"
+msgid "Processing G-Code from previous file…"
 msgstr "正在處理先前檔案的 G-code…"

 msgid "Slicing complete"
@@ -6912,7 +6912,7 @@ msgid "Size:"
 msgstr "尺寸："

 # AI Translated
-#, c-format, boost-format
+#, boost-format
 msgid "Conflicts of G-code paths have been found at layer %d, Z = %.2lfmm. Please separate the conflicted objects farther (%s <-> %s)."
 msgstr "在第 %d 層（Z = %.2lf mm）發現 G-code 路徑衝突。請將有衝突的物件分開得更遠（%s <-> %s）。"

@@ -12298,10 +12298,6 @@ msgstr "無法將檔案上傳至列印裝置的儲存空間，請重試。"
 msgid "Send Failed"
 msgstr "傳送失敗"

-# AI Translated
-msgid "No available printers"
-msgstr "沒有可用的列印裝置"
-
 msgid "The name length exceeds the limit."
 msgstr "名稱長度超過限制。"

@@ -14255,8 +14251,8 @@ msgid "Left mouse"
 msgstr "滑鼠左鍵"

 # AI Translated
-msgid "Available anywhere in the window."
-msgstr "在視窗中任何位置皆可使用。"
+msgid "Available anywhere in the window, even while typing in a text field."
+msgstr "在視窗中任何位置皆可使用，即使正在文字欄位中輸入也可以。"

 # AI Translated
 msgid "Run favorite 1 to 10"
@@ -14376,6 +14372,10 @@ msgstr "%s 已指派給 %s。要改為指派給 %s 嗎？"
 msgid "The default %s is assigned to %s. Reassign it to %s?"
 msgstr "預設的 %s 已指派給 %s。要改為指派給 %s 嗎？"

+# AI Translated
+msgid "Global shortcuts also apply while typing."
+msgstr "全域快速鍵在輸入文字時也會生效。"
+
 # AI Translated
 msgid "A key that types a character cannot be a global shortcut."
 msgstr "會輸入字元的按鍵不能作為全域快速鍵。"
@@ -18513,14 +18513,6 @@ msgstr "物件排除"
 msgid "Enable this option to add EXCLUDE OBJECT command in G-code."
 msgstr "啟用此選項以在 G-code 中加入 EXCLUDE OBJECT 指令。"

-# AI Translated
-msgid "Outline tolerance"
-msgstr "輪廓線公差"
-
-# AI Translated
-msgid "Maximum deviation of the object outline written to EXCLUDE_OBJECT_DEFINE from the original outline. Larger values give fewer points, which helps firmware that stalls while parsing G-code with many objects. 0 keeps every point."
-msgstr "寫入 EXCLUDE_OBJECT_DEFINE 的物件輪廓線與原始輪廓線之間的最大偏差。數值越大，點數越少，有助於避免韌體在解析包含大量物件的 G-code 時卡住。0 表示保留所有點。"
-
 msgid "Verbose G-code"
 msgstr "詳細 G-code"

@@ -24605,7 +24597,7 @@ msgstr "測試 %s 開始..."

 # AI Translated
 #, c-format, boost-format
-msgid "test %s IP resolved = %s"
+msgid "test %s ip resolved = %s"
 msgstr "測試 %s IP 解析結果 = %s"

 # AI Translated
@@ -32132,22 +32124,21 @@ msgid "Basic Colors"
 msgstr "基本顏色"

 # AI Translated
-#. TRN: Keep the brand name "Orca" unchanged; translate only the palette descriptor.
 msgid "Orca Palette"
 msgstr "Orca 調色盤"

 # AI Translated
-#. TRN: Keep the standard/brand name "RAL" unchanged.
+#. TRN: Keep the brand name "Orca" unchanged; translate only the palette descriptor.
 msgid "RAL Classic"
 msgstr "RAL 經典色"

 # AI Translated
 # Needs human review: Palette dropdown entry for the gradient presets (next to 基本顏色 / Orca 調色盤 / RAL 經典色); 漸層配色 keeps it apart from the Solid/Gradient switch label 漸層. Check it reads right in the dropdown.
+#. TRN: Keep the standard/brand name "RAL" unchanged.
 msgid "Gradients"
 msgstr "漸層配色"

 # AI Translated
-msgctxt "Color picker"
 msgid "Solid"
 msgstr "純色"

@@ -32646,7 +32637,7 @@ msgid "Medium violet red"
 msgstr "中紫羅蘭紅"

 # AI Translated
-msgid "Pale violet red"
+msgid "PaleV violet red"
 msgstr "淡紫羅蘭紅"

 # AI Translated
@@ -32862,7 +32853,8 @@ msgid "Shallow sky"
 msgstr "淺色天空"

 # AI Translated
-msgid "Electric blue"
+# Needs human review: Orca palette: the English is a typo for "Electric blue" (hex #1E90FF); translated as 電光藍. Revisit if the source keeps a different name.
+msgid "Electric bel"
 msgstr "電光藍"

 # AI Translated
@@ -32954,8 +32946,9 @@ msgid "Maize yellow"
 msgstr "玉米黃"

 # AI Translated
-msgid "Daffodil yellow"
-msgstr "水仙黃"
+# Needs human review: RAL 1007 in the RAL Classic list: the English name looks wrong (1007 is Daffodil yellow, 水仙黃); translated literally. Revisit once the source name is fixed.
+msgid "Dalmatian yellow"
+msgstr "達爾馬提亞黃"

 # AI Translated
 msgid "Brown beige"
@@ -33303,8 +33296,9 @@ msgid "Turquoise blue"
 msgstr "綠松石藍"

 # AI Translated
-msgid "Capri blue"
-msgstr "卡布里藍"
+# Needs human review: RAL 5019 in the RAL Classic list: the English name is not a RAL Classic name (5019 is Capri blue); translated literally. Revisit once the source name is fixed.
+msgid "Capsanthin violet"
+msgstr "辣椒紅素紫"

 # AI Translated
 msgid "Ocean blue"
@@ -33455,8 +33449,8 @@ msgid "Silver grey"
 msgstr "銀灰"

 # AI Translated
-msgid "Olive grey"
-msgstr "橄欖灰"
+msgid "Olivestone"
+msgstr "橄欖石色"

 # AI Translated
 msgid "Moss grey"
@@ -34232,25 +34226,13 @@ msgstr "從「我的紋理」移除"
 msgid "Built-in"
 msgstr "內建"

-# AI Translated
-msgid "My textures"
-msgstr "我的紋理"
-
 # AI Translated
 msgid "No textures found."
 msgstr "找不到紋理。"

 # AI Translated
-msgid "Texture libraries"
-msgstr "紋理庫"
-
-# AI Translated
-msgid "Explore more texture libraries"
-msgstr "探索更多紋理庫"
-
-# AI Translated
-msgid "Opens OrcaCloud in the Home page to browse for plugins."
-msgstr "在首頁中開啟 OrcaCloud，瀏覽外掛。"
+msgid "My textures"
+msgstr "我的紋理"

 # AI Translated
 msgid "Import your own image as a height map. It is converted to the format the slicer bakes from and saved to your personal texture folder, kept separate from the textures shipped with OrcaSlicer."
@@ -36946,10 +36928,6 @@ msgstr "指令碼"
 msgid "Slicing Pipeline"
 msgstr "切片管線"

-# AI Translated
-msgid "Resource Texture"
-msgstr "資源紋理"
-
 # AI Translated
 msgid "The plugin's configuration UI was empty. Showing the default editor."
 msgstr "外掛的設定介面為空。將顯示預設編輯器。"
@@ -37097,30 +37075,6 @@ msgstr "外掛目錄同時包含 .py 和 .whl 進入點檔案"
 msgid "Plugin directory does not contain a .py or .whl entry file"
 msgstr "外掛目錄不包含 .py 或 .whl 進入點檔案"

-# AI Translated
-msgid "Resource texture directory is not set"
-msgstr "未設定資源紋理目錄"
-
-# AI Translated
-msgid "Resource texture directory could not be resolved"
-msgstr "無法解析資源紋理目錄"
-
-# AI Translated
-msgid "Resource texture path is not a directory"
-msgstr "資源紋理路徑不是目錄"
-
-# AI Translated
-msgid "Plugin folder could not be resolved"
-msgstr "無法解析外掛資料夾"
-
-# AI Translated
-msgid "Resource texture directory is outside the plugin folder"
-msgstr "資源紋理目錄位於外掛資料夾之外"
-
-# AI Translated
-msgid "Resource texture directory could not be read"
-msgstr "無法讀取資源紋理目錄"
-
 # AI Translated
 #, boost-format
 msgid "Slicing pipeline plugin '%1%' error: %2%"
@@ -37579,7 +37533,7 @@ msgstr "載入設定檔「%1%」失敗：%2%"
 # AI Translated
 #. TRN %1% is the application name.
 #, boost-format
-msgid "Not a G-code file generated by %1%."
+msgid "Not a gcode file generated by %1%."
 msgstr "不是由 %1% 產生的 G-code 檔案。"

 # AI Translated
@@ -37699,7 +37653,7 @@ msgid "Failed making a temporary copy of G-code file %1% before running a post-p
 msgstr "執行後處理腳本前，無法建立 G-code 檔案 %1% 的暫存副本：%2%"

 # AI Translated
-msgid "Post-processor can't find exported G-code file"
+msgid "Post-processor can't find exported gcode file"
 msgstr "後處理程式找不到匯出的 G-code 檔案"

 # AI Translated
@@ -38095,41 +38049,6 @@ msgstr ""
 "避免翹曲\n"
 "您知道嗎？當列印容易翹曲的材料（如 ABS）時，適當提高熱床溫度可以降低翹曲的機率。"

-# AI Translated
-# Needs human review: RAL 1007 in the RAL Classic list: the English name looks wrong (1007 is Daffodil yellow, 水仙黃); translated literally. Revisit once the source name is fixed.
-#~ msgid "Dalmatian yellow"
-#~ msgstr "達爾馬提亞黃"
-
-# AI Translated
-# Needs human review: RAL 5019 in the RAL Classic list: the English name is not a RAL Classic name (5019 is Capri blue); translated literally. Revisit once the source name is fixed.
-#~ msgid "Capsanthin violet"
-#~ msgstr "辣椒紅素紫"
-
-# AI Translated
-#~ msgid "Olivestone"
-#~ msgstr "橄欖石色"
-
-# AI Translated
-#~ msgid "Available anywhere in the window, even while typing in a text field."
-#~ msgstr "在視窗中任何位置皆可使用，即使正在文字欄位中輸入也可以。"
-
-# AI Translated
-#~ msgid "Global shortcuts also apply while typing."
-#~ msgstr "全域快速鍵在輸入文字時也會生效。"
-
-# AI Translated
-#~ msgid "Solid"
-#~ msgstr "純色"
-
-# AI Translated
-#~ msgid "PaleV violet red"
-#~ msgstr "淡紫羅蘭紅"
-
-# AI Translated
-# Needs human review: Orca palette: the English is a typo for "Electric blue" (hex #1E90FF); translated as 電光藍. Revisit if the source keeps a different name.
-#~ msgid "Electric bel"
-#~ msgstr "電光藍"
-
 #~ msgid "Please choose the filament color"
 #~ msgstr "請選擇線材顏色"

@@ -38594,6 +38513,9 @@ msgstr ""
 #~ msgid "no configured tool"
 #~ msgstr "未設定的工具頭"

+#~ msgid "Add end G-Code when finishing the entire print."
+#~ msgstr "所有列印結束時的結尾 G-code"
+
 #~ msgid "Maximum X speed"
 #~ msgstr "X 最大速度"

@@ -38610,10 +38532,25 @@ msgstr ""
 #~ msgid "Python plugin(s) invoked at each slicing pipeline step to read and modify intermediate slicing data, including a final G-code post-processing step. Research/experimental."
 #~ msgstr "在每個切片管線步驟呼叫的 Python 外掛，用於讀取與修改中介切片資料，包括最終的 G-code 後處理步驟。研究／實驗性質。"

+# AI Translated
+#~ msgid "When enabled, the slicer emits g-code with the primary zone's contents centered on bed origin (0,0). The printer firmware is responsible for placing copies/mirrors at each physical zone position. Enable only on printers whose firmware applies its own zone offsets in copy/mirror mode (e.g. RepRapFirmware IDEX duplication mode). Has no effect in Primary mode."
+#~ msgstr "啟用後，切片軟體輸出的 G-code 會將主區域的內容以列印板原點 (0,0) 為中心放置，並由列印裝置韌體負責將複製件／鏡像件放到各個實體區域位置。僅在韌體會於複製／鏡像模式下自行套用區域偏移的列印裝置上啟用（例如 RepRapFirmware 的 IDEX 複製模式）。在主模式下無效。"
+
 # AI Translated
 #~ msgid "Per-plate override mapping physical heads to filament slots (1-based). Empty means use pem-inversion defaults."
 #~ msgstr "依列印板覆寫實體工具頭到線材槽位的映射（從 1 開始編號）。留空表示使用由 pem 反推的預設映射。"

+# AI Translated
+#~ msgid "Axis the mesh is rotated about before slicing. This is the belt printer's tilt: an isometric (no distortion) rotation that also drives bed rendering and support gravity tilt, and that the g-code back-transform inverts before the machine-frame shear/scale and remap. X is the typical gantry tilt (belt travels along Y)."
+#~ msgstr "切片前網格旋轉所繞的軸。這就是輸送帶列印裝置的傾斜：一種等距（無變形）旋轉，同時用於列印板渲染與支撐的重力傾斜；G-code 反向轉換會先還原此旋轉，再進行機器座標系的剪切／縮放與重新映射。X 是典型的龍門傾斜軸（輸送帶沿 Y 方向移動）。"
+
+# AI Translated
+#~ msgid "Expert override: set the machine-frame (g-code shear/scale) tilt angle independently of the pre-slice rotation angle. When disabled, the machine-frame transform is derived from the belt tilt angle, so a single angle drives both stages. Enable only to compensate for a machine whose physical gantry tilt differs from the slicing rotation."
+#~ msgstr "專家覆寫選項：獨立於切片前的旋轉角度，單獨設定機器座標系（G-code 剪切／縮放）的傾斜角度。停用時，機器座標系變換由輸送帶傾斜角度推導，兩個階段使用同一個角度。僅在機器實際的龍門傾角與切片旋轉角度不同時，才啟用此選項進行補償。"
+
+#~ msgid "The maximum deviation allowed when reducing the resolution for the 'Maximum wall resolution' setting. If you increase this, the print will be less accurate, but the G-Code will be smaller. 'Maximum wall deviation' limits 'Maximum wall resolution', so if the two conflict, 'Maximum wall deviation' takes precedence."
+#~ msgstr "「最大牆解析度」設定在降低解析度時所允許的最大偏差。若增加此值，列印會較不精確，但 G-Code 會更小。「最大牆偏差」會限制「最大牆解析度」，因此若兩者衝突，將以「最大牆偏差」為準。"
+
 #~ msgid " not in range "
 #~ msgstr " 不在合理的區間"

@@ -109,7 +109,7 @@ const cssColors = [
  {hex: "#800080", name: "Purple"},
  {hex: "#663399", name: "Rebecca purple"},
  {hex: "#C71585", name: "Medium violet red"},
-  {hex: "#DB7093", name: "Pale violet red"},
+  {hex: "#DB7093", name: "PaleV violet red"},
  {hex: "#FF1493", name: "Deep pink"},
  {hex: "#FF69B4", name: "Hot pink"},
  {hex: "#FFB6C1", name: "Light pink"},
@@ -193,7 +193,7 @@ const palettes = {
    {hex: "#40E0D0", name: "Turquoise bay"},
    {hex: "#2EBDEF", name: "Sky over reef"},
    {hex: "#87CEEB", name: "Shallow sky"},
-    {hex: "#1E90FF", name: "Electric blue"},
+    {hex: "#1E90FF", name: "Electric bel"},
    {hex: "#4169E1", name: "Dolphin"},
    {hex: "#0000CD", name: "Ocean depths"},
    {hex: "#191970", name: "Whale"},
@@ -219,7 +219,7 @@ const palettes = {
    {hex: "#EFBF04", name: "1004 Golden yellow"},
    {hex: "#D7A500", name: "1005 Honey yellow"},
    {hex: "#F2D185", name: "1006 Maize yellow"},
-    {hex: "#FDD185", name: "1007 Daffodil yellow"},
+    {hex: "#FDD185", name: "1007 Dalmatian yellow"},
    {hex: "#8B7D6B", name: "1011 Brown beige"},
    {hex: "#F5DB50", name: "1012 Lemon yellow"},
    {hex: "#F3E5AB", name: "1013 Oyster white"},
@@ -318,7 +318,7 @@ const palettes = {
    {hex: "#0384A7", name: "5015 Sky blue"},
    {hex: "#006A9E", name: "5017 Traffic blue"},
    {hex: "#005F87", name: "5018 Turquoise blue"},
-    {hex: "#1B5583", name: "5019 Capri blue"},
+    {hex: "#5A3D5B", name: "5019 Capsanthin violet"},
    {hex: "#04749F", name: "5020 Ocean blue"},
    {hex: "#009AAA", name: "5021 Water blue"},
    {hex: "#1A3D5F", name: "5022 Night blue"},
@@ -366,7 +366,7 @@ const palettes = {
    {hex: "#00A550", name: "6039 Mint green"},
    {hex: "#7D7D7D", name: "7000 Squirrel grey"},
    {hex: "#A8A9AD", name: "7001 Silver grey"},
-    {hex: "#6F7368", name: "7002 Olive grey"},
+    {hex: "#6F7368", name: "7002 Olivestone"},
    {hex: "#8F9080", name: "7003 Moss grey"},
    {hex: "#8E9291", name: "7004 Signal grey"},
    {hex: "#8B8788", name: "7005 Mouse grey"},
@@ -0,0 +1,39 @@
+# /// script
+# requires-python = ">=3.12"
+#
+# [tool.orcaslicer.plugin]
+# name = "Network Permission Probe"
+# description = "Tests host-based network permission prompts and matching"
+# author = "OrcaSlicer"
+# version = "0.1.0"
+# ///
+"""Local probe for the orca.request_permissions(network=...) API.
+
+Install this file as a local plugin, approve https://example.com, then run the
+script capability more than once. Each run changes the query string; the saved
+scheme/host grant should prevent another prompt for that same host.
+"""
+
+import time
+import urllib.request
+
+import orca
+
+
+class NetworkPermissionProbe(orca.script.ScriptPluginCapabilityBase):
+    def get_name(self):
+        return "Network Permission Probe"
+
+    def execute(self):
+        # User-triggered GET to a reserved example domain; varying the query tests
+        # that permission matching is not tied to the complete URL.
+        url = f"https://example.com/?permission_probe={time.time_ns()}"
+        with urllib.request.urlopen(url, timeout=10) as response:
+            return orca.ExecutionResult.success(f"Network permission probe: HTTP {response.status}")
+
+
+@orca.plugin
+class NetworkPermissionProbePackage(orca.base):
+    def register_capabilities(self):
+        orca.request_permissions(network=["https://example.com"])
+        orca.register_capability(NetworkPermissionProbe)
@@ -1432,7 +1432,7 @@ ConfigSubstitutions ConfigBase::load_from_gcode_file(const std::string &file, Fo
        }
        if (!header_found) {
            // TRN %1% is the application name.
-            std::string error_message = format(_u8L("Not a G-code file generated by %1%."), SLIC3R_APP_FULL_NAME);
+            std::string error_message = format(_u8L("Not a gcode file generated by %1%."), SLIC3R_APP_FULL_NAME);
            BOOST_LOG_TRIVIAL(error) << __FUNCTION__ << error_message;
            throw Slic3r::RuntimeError(error_message.c_str());
        }
@@ -10120,7 +10120,7 @@ bool to_xml(std::stringstream &stream, const EmbossShape::SvgFile &svg, const Mo
    assert(file_data != nullptr);
    if (file_data == nullptr && !svg.path.empty()) file_data = read_from_disk(svg.path);
    if (file_data == nullptr) {
-        BOOST_LOG_TRIVIAL(warning) << "Can't write SVG file no filedata";
+        BOOST_LOG_TRIVIAL(warning) << "Can't write svg file no filedata";
        return false;
    }
    const std::string &file_data_str = *file_data; 
@@ -10136,7 +10136,7 @@ void to_xml(std::stringstream &stream, const EmbossShape &es, const ModelVolume
    stream << "   <" << SHAPE_TAG << " ";
    if (es.svg_file.has_value())
        if (!to_xml(stream, *es.svg_file, volume, archive, export_full_path)) {
-            BOOST_LOG_TRIVIAL(warning) << "Can't write SVG file defiden embossed shape into 3mf";
+            BOOST_LOG_TRIVIAL(warning) << "Can't write svg file defiden embossed shape into 3mf";
        }

    stream << SHAPE_SCALE_ATTR << "=\"" << es.scale << "\" ";
@@ -1421,7 +1421,6 @@ static std::vector<std::string> s_Preset_print_options{
    "initial_layer_travel_acceleration",
    "initial_layer_travel_jerk",
    "exclude_object",
-    "exclude_object_tolerance",
    "slow_down_layers",
    "infill_anchor",
    "infill_anchor_max",
@@ -309,7 +309,6 @@ bool Print::invalidate_state_by_config_options(const ConfigOptionResolver & /* n
        "gcode_comments",
        "gcode_label_objects", 
        "exclude_object",
-        "exclude_object_tolerance",
        "support_material_interface_fan_speed",
        "internal_bridge_fan_speed", // ORCA: Add support for separate internal bridge fan speed control
        "ironing_fan_speed",
@@ -6930,7 +6929,7 @@ BoundingBoxf3 PrintInstance::get_bounding_box() const {

 Polygon PrintInstance::get_convex_hull_2d() {
    Polygon poly = print_object->model_object()->convex_hull_2d(model_instance->get_matrix());
-    poly.douglas_peucker(scale_(print_object->print()->config().exclude_object_tolerance.value));
+    poly.douglas_peucker(scale_(0.1));
    return poly;
 }

@@ -4629,17 +4629,6 @@ void PrintConfigDef::init_fff_params()
    def->mode = comAdvanced;
    def->set_default_value(new ConfigOptionBool(false));

-    def = this->add("exclude_object_tolerance", coFloat);
-    def->label = L("Outline tolerance");
-    def->tooltip = L("Maximum deviation of the object outline written to EXCLUDE_OBJECT_DEFINE from the "
-                     "original outline. Larger values give fewer points, which helps firmware that stalls "
-                     "while parsing G-code with many objects. 0 keeps every point.");
-    def->sidetext = L("mm");
-    def->min = 0;
-    def->max = 5;
-    def->mode = comExpert;
-    def->set_default_value(new ConfigOptionFloat(0.1));
-
    def = this->add("gcode_comments", coBool);
    def->label = L("Verbose G-code");
    def->tooltip = L("Enable this to get a commented G-code file, with each line explained by a descriptive text. "
@@ -2130,7 +2130,6 @@ PRINT_CONFIG_CLASS_DERIVED_DEFINE(
    ((ConfigOptionPercents,            filament_shrinkage_compensation_z))
    ((ConfigOptionBool,                gcode_label_objects))
    ((ConfigOptionBool,                exclude_object))
-    ((ConfigOptionFloat,               exclude_object_tolerance))
    ((ConfigOptionFloats,             grab_length))
    ((ConfigOptionBool,                gcode_comments))
    ((ConfigOptionInt,                 slow_down_layers))
@@ -225,7 +225,7 @@ void BackgroundSlicingProcess::process_fff()
    // BBS: add the logic to process from an existed gcode file
    if (m_print->finished()) {
        BOOST_LOG_TRIVIAL(info) << __FUNCTION__ << boost::format(" %1%: skip slicing, to process previous gcode file") % __LINE__;
-        m_fff_print->set_status(80, _utf8(L("Processing G-code from previous file\u2026" /* \u2026 -> ... */)));
+        m_fff_print->set_status(80, _utf8(L("Processing G-Code from previous file\u2026")));
        wxCommandEvent evt(m_event_slicing_completed_id);
        // Post the Slicing Finished message for the G-code viewer to update.
        // Passing the timestamp
@@ -303,12 +303,10 @@ nlohmann::json color_picker_ui_strings()
    return {
        {"Color Picker", _u8L("Color Picker")},
        {"Basic Colors", _u8L("Basic Colors")},
-        // TRN: Keep the brand name "Orca" unchanged; translate only the palette descriptor.
-        {"Orca Palette", _u8L("Orca Palette")},
-        // TRN: Keep the standard/brand name "RAL" unchanged.
-        {"RAL Classic", _u8L("RAL Classic")},
+        {"Orca Palette", _u8L("Orca Palette")},// TRN: Keep the brand name "Orca" unchanged; translate only the palette descriptor.
+        {"RAL Classic", _u8L("RAL Classic")},  // TRN: Keep the standard/brand name "RAL" unchanged.
        {"Gradients", _u8L("Gradients")},
-        {"Solid", _u8L_CONTEXT("Solid", "Color picker")},
+        {"Solid", _u8L("Solid")},
        {"Gradient", _u8L("Gradient")},
        {"Gradient start", _u8L("Gradient start")},
        {"Gradient end", _u8L("Gradient end")},
@@ -442,7 +440,7 @@ nlohmann::json color_picker_ui_strings()
        {"Purple", _u8L("Purple")},
        {"Rebecca purple", _u8L("Rebecca purple")},
        {"Medium violet red", _u8L("Medium violet red")},
-        {"Pale violet red", _u8L("Pale violet red")},
+        {"PaleV violet red", _u8L("PaleV violet red")},
        {"Deep pink", _u8L("Deep pink")},
        {"Hot pink", _u8L("Hot pink")},
        {"Light pink", _u8L("Light pink")},
@@ -498,7 +496,7 @@ nlohmann::json color_picker_ui_strings()
        {"Turquoise bay", _u8L("Turquoise bay")},
        {"Sky over reef", _u8L("Sky over reef")},
        {"Shallow sky", _u8L("Shallow sky")},
-        {"Electric blue", _u8L("Electric blue")},
+        {"Electric bel", _u8L("Electric bel")},
        {"Dolphin", _u8L("Dolphin")},
        {"Ocean depths", _u8L("Ocean depths")},
        {"Whale", _u8L("Whale")},
@@ -521,7 +519,7 @@ nlohmann::json color_picker_ui_strings()
        {"Golden yellow", _u8L("Golden yellow")},
        {"Honey yellow", _u8L("Honey yellow")},
        {"Maize yellow", _u8L("Maize yellow")},
-        {"Daffodil yellow", _u8L("Daffodil yellow")},
+        {"Dalmatian yellow", _u8L("Dalmatian yellow")},
        {"Brown beige", _u8L("Brown beige")},
        {"Lemon yellow", _u8L("Lemon yellow")},
        {"Oyster white", _u8L("Oyster white")},
@@ -608,7 +606,7 @@ nlohmann::json color_picker_ui_strings()
        {"Pigeon blue", _u8L("Pigeon blue")},
        {"Traffic blue", _u8L("Traffic blue")},
        {"Turquoise blue", _u8L("Turquoise blue")},
-        {"Capri blue", _u8L("Capri blue")},
+        {"Capsanthin violet", _u8L("Capsanthin violet")},
        {"Ocean blue", _u8L("Ocean blue")},
        {"Water blue", _u8L("Water blue")},
        {"Night blue", _u8L("Night blue")},
@@ -646,7 +644,7 @@ nlohmann::json color_picker_ui_strings()
        {"Luminous green", _u8L("Luminous green")},
        {"Squirrel grey", _u8L("Squirrel grey")},
        {"Silver grey", _u8L("Silver grey")},
-        {"Olive grey", _u8L("Olive grey")},
+        {"Olivestone", _u8L("Olivestone")},
        {"Moss grey", _u8L("Moss grey")},
        {"Signal grey", _u8L("Signal grey")},
        {"Mouse grey", _u8L("Mouse grey")},
@@ -1245,8 +1245,6 @@ void ConfigManipulation::toggle_print_fff_options(DynamicPrintConfig *config, in
    if(gcf_is_klipper)
        toggle_field("accel_to_decel_factor", config->opt_bool("accel_to_decel_enable"));

-    toggle_line("exclude_object_tolerance", gcf_is_klipper && config->opt_bool("exclude_object"));
-
    bool have_make_overhang_printable = config->opt_bool("make_overhang_printable");
    toggle_line("make_overhang_printable_angle", have_make_overhang_printable);
    toggle_line("make_overhang_printable_hole_size", have_make_overhang_printable);
@@ -1350,7 +1350,7 @@ void GLGizmoSVG::draw_window()
    assert(m_volume_id.valid());
    if (m_volume == nullptr ||
        m_volume_id.invalid()) {
-        ImGui::Text("%s", _u8L("Not valid state please report reproduction steps on GitHub").c_str());
+        ImGui::Text("%s", _u8L("Not valid state please report reproduction steps on github").c_str());
        return;
    }

@@ -1362,13 +1362,13 @@ void GLGizmoSVG::draw_window()

    assert(m_volume->emboss_shape->svg_file.has_value());
    if (!m_volume->emboss_shape->svg_file.has_value()){
-        ImGui::Text("%s", _u8L("Missing SVG file in embossed shape").c_str());
+        ImGui::Text("%s", _u8L("Missing svg file in embossed shape").c_str());
        return;
    }

    assert(m_volume->emboss_shape->svg_file->file_data != nullptr);
    if (m_volume->emboss_shape->svg_file->file_data == nullptr){
-        ImGui::Text("%s", _u8L("Missing data of SVG file").c_str());
+        ImGui::Text("%s", _u8L("Missing data of svg file").c_str());
        return;
    }

@@ -295,7 +295,7 @@ void NetworkTestDialog::start_test_url(TestJob job, wxString name, wxString url)
 			}
 		})
 		.on_ip_resolve([this,name,job](std::string ip) {
-			wxString ip_report = wxString::Format(_L("test %s IP resolved = %s"), name, ip);
+			wxString ip_report = wxString::Format(_L("test %s ip resolved = %s"), name, ip);
 			update_status(job, ip_report);
 		})
 		.on_error([this,name,job](std::string body, std::string error, unsigned int status) {
@@ -395,7 +395,7 @@ bool run_post_process_scripts(

    auto gcode_file = boost::filesystem::path(path);
    if (!boost::filesystem::exists(gcode_file))
-        throw Slic3r::RuntimeError(_u8L("Post-processor can't find exported G-code file"));
+        throw Slic3r::RuntimeError(_u8L("Post-processor can't find exported gcode file"));

    // Store print configuration into environment variables.
    config.setenv_();
@@ -3269,7 +3269,6 @@ void TabPrint::build()
        optgroup->append_single_option_line("gcode_comments", "others_settings_g_code_output#verbose-g-code");
        optgroup->append_single_option_line("gcode_label_objects", "others_settings_g_code_output#label-objects");
        optgroup->append_single_option_line("exclude_object", "others_settings_g_code_output#exclude-objects");
-        optgroup->append_single_option_line("exclude_object_tolerance", "others_settings_g_code_output#outline-tolerance");
        option = optgroup->get_option("filename_format");
        // option.opt.full_width = true;
        option.opt.is_code = true;
@@ -5279,7 +5278,7 @@ void TabPrinter::build_fff()
                option.opt.width = Field::def_width_wider();
                option.opt.tooltip = L("Select the network agent implementation for printer communication. "
                    "Available agents are registered at startup.");
-                optgroup->append_single_option_line(option, "printer_basic_information_advanced#printer-agent");
+                optgroup->append_single_option_line(option);
            }
        }

@@ -4,9 +4,10 @@
 // Via pybind11 so this file requests the same python3xx.lib as everything else.
 #include <boost/filesystem/path.hpp>
 #include <pybind11/conduit/wrap_include_python_h.h>
-#include <functional>
 #include <mutex>
 #include <string>
+#include <unordered_map>
+#include <unordered_set>
 #include <vector>

 #include <boost/filesystem.hpp>
@@ -137,32 +138,59 @@ public:
    bool request_filesystem_read_permissions(const std::string& plugin_key,
                                             const std::vector<std::string>& paths);

+    // Ask the user to grant network access to the given http(s) URLs. Each URL is reduced to its
+    // scheme and host before prompting and persisting, so one approval covers every path, query
+    // and port on that host. The grant is written to both network_http and network_socket: the
+    // same declared host can surface through HTTP events (urllib/http.client) and raw socket
+    // events. Like request_filesystem_read_permissions, the request may originate on a plugin
+    // load worker; denial aborts the plugin load without adding a permission.
+    bool request_network_permissions(const std::string& plugin_key,
+                                     const std::vector<std::string>& urls);
+
+    // Canonical scheme://host form used to store and match network permissions. Returns an empty
+    // string unless `url` is an absolute http(s) URL with a host. The path, query, fragment,
+    // userinfo and port are discarded; scheme and host are lowercased.
+    static std::string normalize_network_url(const std::string& url);
+
+    // True when a granted scheme://host entry covers `target`. `target` is a URL (urllib.Request),
+    // a bare host (http.client.connect, socket.getaddrinfo) or an address as exposed by the audit
+    // event (a hostname, a host:port pair, or a legacy persisted tuple such as "('host', 443)").
+    // URL targets must match both scheme and host. A bare host carries no scheme, so it matches
+    // the host part of any grant; it never matches a different host.
+    static bool network_permission_matches(const std::vector<std::string>& granted,
+                                           const std::string& target);
+
+    // True when `target` is a bare IPv4/IPv6 literal (optionally bracketed). A network event
+    // carrying an IP literal has no hostname the audit hook can match, so it is the only kind of
+    // network event allowed to use an approved network call-site ancestor.
+    static bool is_ip_address_target(const std::string& target);
+
    void report_violation(const AuditViolation& violation);
    bool audit_denial_pending() const;
    void clear_audit_denial();
    void clear_last_violation();
    bool last_violation(AuditViolation& violation) const;

-    // --- operation-root frames ---
-    // One stdlib operation fires several nested audit events as it passes through lower layers:
-    // urlopen() raises urllib.Request, then http.client and socket events. When an operation's
-    // own root event is granted (by a saved grant or the user), the stdlib frame that raised it
-    // is held, and a later event whose stack reaches that frame through stdlib frames only is
-    // part of the same operation, so it is allowed without a prompt of its own. Plugin or
-    // library code the operation calls back into is judged on its own. A frame is let go once it
-    // returns, a suspended generator's (os.walk) when the audit scope ends. Letting a frame go may
-    // run finalizers of objects its locals held; they are judged as the plugin and never prompt.
-    void record_root_frame();
-    bool covered_by_root_frame() const;
-    bool releasing_frames() const;
+    // --- call-site cascade cache ---
+    // A single plugin action often fires several nested CPython audit events as it passes
+    // through stdlib layers (urllib.request calling http.client calling socket, for example).
+    // Once the user approves one event, every stdlib frame still on the stack for that call
+    // is recorded here by (filename, function, first line) identity. A later event whose own
+    // ancestor chain still contains one of those frames is the same logical action seen from
+    // a deeper layer, so it is auto-approved instead of prompting again.
+    //
+    // Network events do not use this general cache: see the network call-site cache below.
+    bool has_approved_ancestor(const std::string& plugin_key, const std::vector<std::string>& call_site_ids) const;
+    void record_approved_call_sites(const std::string& plugin_key, const std::vector<std::string>& call_site_ids);

-    // True when code from `filename` (a code object's co_filename) is the interpreter's own
-    // stdlib: the only code a root frame's coverage passes through. Valid after install_hook().
-    static bool is_stdlib_file(const std::string& filename);
-
-    // Answers permission prompts in place of the dialog, for tests. Production never sets it.
-    using PermissionPrompt = std::function<bool(const std::string& event_name, const std::vector<std::string>& targets)>;
-    static void set_permission_prompt_for_testing(PermissionPrompt prompt);
+    // --- network call-site cache ---
+    // Separate from the general cascade above so a network approval can only suppress a later
+    // network event with no hostname to check: a resolved address (socket.connect/sendto with an
+    // IP literal). Hostname and URL events are never auto-approved by an ancestor; they must
+    // match their own grant. Targetless events are handled by the "any network grant" rule and
+    // never record an entry here.
+    bool has_approved_network_ancestor(const std::string& plugin_key, const std::vector<std::string>& call_site_ids) const;
+    void record_approved_network_call_sites(const std::string& plugin_key, const std::vector<std::string>& call_site_ids);

    bool verbose_events = true;

@@ -173,32 +201,35 @@ private:

    static int audit_hook(const char* event, PyObject* args, void* user_data);

-    // Drops the references in `frames`, keeping the caller's error and denial state intact.
-    void release_frames(std::vector<PyObject*>& frames);
-
    static thread_local std::string                   m_current_plugin_key;
    static thread_local std::string                   m_current_capability_name;
    static thread_local std::vector<AllowedRoot>       m_scoped_allowed_roots;
-    static thread_local std::vector<PyObject*>         m_root_frames; // strong references
-    static thread_local int                            m_releasing_frames;
    static thread_local bool                           m_audit_denial_pending;
    static thread_local bool                           m_has_last_violation;
    static thread_local AuditViolation                 m_last_violation;

-    // mutable: is_denied_filename() is a const query that must lock.
+    // mutable: the deny and ancestor queries are const but must lock.
    mutable std::mutex m_mutex;
+
+    using CallSiteRegistry = std::unordered_map<std::string, std::unordered_set<std::string>>;
+
+    // Shared lookup/insert mechanics for the two registries below. The caller selects the
+    // registry, so the general and network approvals remain independent.
+    bool has_call_site(const CallSiteRegistry& registry, const std::string& plugin_key,
+                       const std::vector<std::string>& call_site_ids) const;
+    void record_call_sites(CallSiteRegistry& registry, const std::string& plugin_key,
+                           const std::vector<std::string>& call_site_ids);
+
    std::vector<AllowedRoot>             m_global_allowed_roots;
    std::vector<std::string>             m_denied_filenames;
    std::vector<std::string>             m_denied_path_keywords;
+    CallSiteRegistry                     m_approved_call_sites;
+    CallSiteRegistry                     m_approved_network_call_sites;
 };

 // RAII guard that sets the current plugin key and capability name, restoring the previous
 // pair on scope exit. `capability_name` may be empty for calls that are not scoped to a
 // single capability.
-//
-// Each scope owns the root frames recorded inside it and lets them go, as its own plugin, before
-// restoring the outer context. That needs the GIL whenever a frame is still held, so construct
-// the scope after the GIL guard, to be destroyed before it.
 class ScopedPluginAuditContext
 {
 public:
@@ -212,12 +243,9 @@ public:
    ScopedPluginAuditContext& operator=(const ScopedPluginAuditContext&) = delete;

 private:
-    std::string                   m_plugin_key;
-    std::string                   m_capability;
    std::string                   m_previous_id;
    std::string                   m_previous_capability;
    std::vector<AllowedRoot>      m_previous_scoped_roots;
-    std::vector<PyObject*>        m_previous_root_frames;
 };

 } // namespace Slic3r
@@ -808,7 +808,6 @@ bool read_install_state(const boost::filesystem::path& plugin_dir, PluginInstall
            read_string_list("network_socket", parsed.permissions.network_socket);
            read_string_list("process", parsed.permissions.process);
            read_string_list("threading", parsed.permissions.threading);
-            read_string_list("events", parsed.permissions.events);
        }

        if (state.contains("enabled") && state["enabled"].is_boolean())
@@ -833,6 +832,29 @@ bool read_install_state(const boost::filesystem::path& plugin_dir, PluginInstall
    }
 }

+namespace {
+
+// The single descriptor -> sidecar metadata mapping. Prefer installed_version (fetched at install
+// time and preserved across rewrites) over a possibly stale manifest version.
+void apply_install_metadata(PluginInstallState& state, const PluginDescriptor& entry)
+{
+    state.installed_from    = entry.is_cloud_plugin() ? "cloud" : "local";
+    state.installed_version = !entry.installed_version.empty() ? entry.installed_version : entry.version;
+    state.plugin_name       = entry.name;
+    state.cloud_uuid        = entry.cloud_uuid();
+}
+
+} // namespace
+
+void seed_install_metadata(PluginInstallState& state, const PluginDescriptor& entry)
+{
+    if (!state.plugin_name.empty())
+        return;
+
+    apply_install_metadata(state, entry);
+    state.enabled = true;
+}
+
 bool write_install_state(const boost::filesystem::path& plugin_dir, const PluginInstallState& state)
 {
    namespace fs                = boost::filesystem;
@@ -853,7 +875,6 @@ bool write_install_state(const boost::filesystem::path& plugin_dir, const Plugin
        {"network_socket", state.permissions.network_socket},
        {"process", state.permissions.process},
        {"threading", state.permissions.threading},
-        {"events", state.permissions.events},
    };

    nlohmann::json capabilities = nlohmann::json::array();
@@ -876,16 +897,9 @@ bool write_install_state(const boost::filesystem::path& plugin_dir, const Plugin
    // Loading a plugin updates its lifecycle/capability state, but must retain permissions granted
    // during register_capabilities() or by a previous runtime audit prompt.
    read_install_state(plugin_dir, state);
-    state.installed_from    = entry.is_cloud_plugin() ? "cloud" : "local";
-    // Prefer the descriptor's recorded installed_version (the version fetched from the cloud
-    // at install time, preserved across sidecar re-writes) so a stale manifest/PEP723 header
-    // never overwrites the source-of-truth version. Fall back to the manifest version for
-    // first-time/local installs where installed_version is not yet populated.
-    state.installed_version = !entry.installed_version.empty() ? entry.installed_version : entry.version;
-    state.plugin_name       = entry.name;
-    state.cloud_uuid        = entry.cloud_uuid();
-    state.enabled           = enabled;
-    state.capabilities      = capabilities;
+    apply_install_metadata(state, entry);
+    state.enabled      = enabled;
+    state.capabilities = capabilities;
    return write_install_state(plugin_dir, state);
 }

@@ -896,11 +910,7 @@ bool write_install_state(const boost::filesystem::path& plugin_dir, const Plugin
    // permissions on a fresh install/reinstall. PluginManager writes the real per-capability flags
    // while preserving permissions once the package is loaded, via the overload above.
    PluginInstallState state;
-    state.installed_from    = entry.is_cloud_plugin() ? "cloud" : "local";
-    state.installed_version = !entry.installed_version.empty() ? entry.installed_version : entry.version;
-    state.plugin_name       = entry.name;
-    state.cloud_uuid        = entry.cloud_uuid();
-    state.enabled           = true;
+    seed_install_metadata(state, entry);
    return write_install_state(plugin_dir, state);
 }

@@ -104,8 +104,6 @@ struct PluginPermissions
    std::vector<std::string> network_socket;
    std::vector<std::string> process;
    std::vector<std::string> threading;
-    // Grants for audit events that expose no target, keyed "<category>:<event>" (e.g. "Socket:socket.__new__").
-    std::vector<std::string> events;
 };

 struct PluginInstallState {
@@ -186,12 +184,19 @@ std::vector<std::string> collect_resource_texture_files(const std::string& dir,

 // Canonical writer: emits the .install_state.json schema for the given state.
 bool write_install_state(const boost::filesystem::path& plugin_dir, const PluginInstallState& state);
+
 // Builds a PluginInstallState from the descriptor and delegates to the canonical writer.
 bool write_install_state(const boost::filesystem::path& plugin_dir, const PluginDescriptor& entry, bool enabled,
                         const std::vector<std::pair<std::string, bool>>& capabilities);
 // Convenience overload: write(dir, entry, /*enabled=*/true, /*capabilities=*/{}).
 bool write_install_state(const boost::filesystem::path& plugin_dir, const PluginDescriptor& entry);

+// Fill the descriptor-derived install metadata into a sidecar state that does not describe an
+// installed plugin yet, and mark it enabled. Leaves permissions and capabilities untouched.
+// Single source for the metadata mapping used by the install writer and by the audit prompt path
+// that creates a sidecar on demand.
+void seed_install_metadata(PluginInstallState& state, const PluginDescriptor& entry);
+
 // Reads install state back into the descriptor; plugin_key is always derived. Returns whether the
 // sidecar was present and valid.
 bool read_install_state(const boost::filesystem::path& plugin_dir, PluginDescriptor& entry);
@@ -1180,12 +1180,8 @@ void PluginManager::mark_plugin_install_state_disabled(const std::string& plugin

    const boost::filesystem::path root(descriptor.plugin_root);
    PluginInstallState state;
-    if (!read_install_state(root, state)) {
-        state.installed_from    = descriptor.is_cloud_plugin() ? "cloud" : "local";
-        state.installed_version = !descriptor.installed_version.empty() ? descriptor.installed_version : descriptor.version;
-        state.plugin_name       = descriptor.name;
-        state.cloud_uuid        = descriptor.cloud_uuid();
-    }
+    if (!read_install_state(root, state))
+        seed_install_metadata(state, descriptor);
    state.enabled = false;
    if (!write_install_state(root, state))
        return;
@@ -102,9 +102,9 @@ public:
    // mistake), both fall back to the base's empty object rather than writing `"cap_config": null`.
    nlohmann::json get_default_config() const override
    {
-        pybind11::gil_scoped_acquire gil;
        ORCA_PY_AUDIT_SCOPE();
        try {
+            pybind11::gil_scoped_acquire gil;
            pybind11::function override = pybind11::get_override(static_cast<const Base*>(this), "get_default_config");
            if (!override)
                return Base::get_default_config();
@@ -50,6 +50,7 @@ std::mutex g_registry_mutex;
 std::unordered_map<std::string, std::vector<py::object>> g_pending_capabilities;
 std::unordered_map<std::string, py::object> g_pending_package;
 std::unordered_map<std::string, std::vector<std::string>> g_pending_fs_read_permissions;
+std::unordered_map<std::string, std::vector<std::string>> g_pending_network_permissions;
 struct PluginInstanceHandle
 {
    // The C++ plugin interface points into a Python object. Keep both alive through one
@@ -89,6 +90,7 @@ void discard_pending_capture_without_python(const std::string& plugin_key)
    }

    g_pending_fs_read_permissions.erase(plugin_key);
+    g_pending_network_permissions.erase(plugin_key);
 }

 } // namespace
@@ -114,6 +116,7 @@ void PythonPluginBridge::begin_plugin_capture(const std::string& plugin_key)
        g_pending_capabilities.erase(plugin_key);
        g_pending_package.erase(plugin_key);
        g_pending_fs_read_permissions.erase(plugin_key);
+        g_pending_network_permissions.erase(plugin_key);
    }
    // From now until finalize/cancel, @orca.plugin and register_capability() calls made by
    // Python code on this thread are attributed to this plugin.
@@ -145,6 +148,7 @@ std::vector<CapturedCapability> PythonPluginBridge::finalize_plugin_capture(cons
            g_pending_capabilities.erase(capture_key);
            g_pending_package.erase(capture_key);
            g_pending_fs_read_permissions.erase(capture_key);
+            g_pending_network_permissions.erase(capture_key);
        };

        try {
@@ -200,6 +204,30 @@ std::vector<CapturedCapability> PythonPluginBridge::finalize_plugin_capture(cons
                    return {};
                }
            }
+
+            std::vector<std::string> network_permissions;
+            {
+                std::lock_guard<std::mutex> lock(g_registry_mutex);
+                auto it = g_pending_network_permissions.find(capture_key);
+                if (it != g_pending_network_permissions.end()) {
+                    network_permissions = std::move(it->second);
+                    g_pending_network_permissions.erase(it);
+                }
+            }
+            if (!network_permissions.empty()) {
+                bool granted = false;
+                {
+                    py::gil_scoped_release release;
+                    granted = PluginAuditManager::instance().request_network_permissions(plugin_key, network_permissions);
+                }
+                if (!granted) {
+                    error = _u8L("Plugin network permission request denied");
+                    BOOST_LOG_TRIVIAL(warning) << error << " for key " << plugin_key;
+                    discard_pending_for_key();
+                    clear_active_key();
+                    return {};
+                }
+            }
        } catch (py::error_already_set& err) {
            log_python_exception_keep(err);
            error = err.what();
@@ -323,6 +351,7 @@ void PythonPluginBridge::cancel_plugin_capture(const std::string& plugin_key)
        g_pending_capabilities.erase(plugin_key);
        g_pending_package.erase(plugin_key);
        g_pending_fs_read_permissions.erase(plugin_key);
+        g_pending_network_permissions.erase(plugin_key);
    }

    if (g_active_plugin_key == plugin_key)
@@ -350,6 +379,7 @@ void PythonPluginBridge::clear_pending_captures()
        }
        g_pending_package.clear();
        g_pending_fs_read_permissions.clear();
+        g_pending_network_permissions.clear();
        g_active_plugin_key.clear();
        return;
    }
@@ -359,6 +389,7 @@ void PythonPluginBridge::clear_pending_captures()
    g_pending_capabilities.clear();
    g_pending_package.clear();
    g_pending_fs_read_permissions.clear();
+    g_pending_network_permissions.clear();
    g_active_plugin_key.clear();
 }

@@ -558,24 +589,50 @@ void bind_python_api(pybind11::module_& m)

    m.def(
        "request_permissions",
-        [](const std::vector<std::string>& fs_read) {
+        [](const std::vector<std::string>& fs_read, const std::vector<std::string>& network) {
            if (g_active_plugin_key.empty())
                throw py::value_error("request_permissions() called outside plugin discovery context");

-            std::lock_guard<std::mutex> lock(g_registry_mutex);
-            auto& requested = g_pending_fs_read_permissions[g_active_plugin_key];
+            // Validate and canonicalize everything before touching the pending registry, so a
+            // partially invalid call cannot leave a half-recorded request behind.
+            std::vector<std::string> normalized_network;
+            normalized_network.reserve(network.size());
+            for (const std::string& url : network) {
+                const std::string normalized = PluginAuditManager::normalize_network_url(url);
+                if (normalized.empty())
+                    throw py::value_error(
+                        "request_permissions(network=...) requires an http:// or https:// URL with a host");
+                if (std::find(normalized_network.begin(), normalized_network.end(), normalized) == normalized_network.end())
+                    normalized_network.push_back(normalized);
+            }
+
            for (const std::string& path : fs_read) {
                if (path.empty())
                    throw py::value_error("request_permissions(fs_read=...) does not accept empty paths");
-                if (std::find(requested.begin(), requested.end(), path) == requested.end())
-                    requested.push_back(path);
+            }
+
+            std::lock_guard<std::mutex> lock(g_registry_mutex);
+            auto& requested_fs = g_pending_fs_read_permissions[g_active_plugin_key];
+            for (const std::string& path : fs_read) {
+                if (std::find(requested_fs.begin(), requested_fs.end(), path) == requested_fs.end())
+                    requested_fs.push_back(path);
+            }
+
+            if (!normalized_network.empty()) {
+                auto& requested_network = g_pending_network_permissions[g_active_plugin_key];
+                for (const std::string& entry : normalized_network) {
+                    if (std::find(requested_network.begin(), requested_network.end(), entry) == requested_network.end())
+                        requested_network.push_back(entry);
+                }
            }
        },
-        py::arg("fs_read") = std::vector<std::string>{},
-        R"pbdoc(Request filesystem read permissions while OrcaSlicer loads your module.
+        py::arg("fs_read") = std::vector<std::string>{}, py::arg("network") = std::vector<std::string>{},
+        R"pbdoc(Request permissions while OrcaSlicer loads your module.

-The host presents the request to the user after register_capabilities() returns. Denying the
-request aborts the plugin load.)pbdoc");
+`fs_read` lists filesystem paths to read. `network` lists http(s) URLs; each is reduced to its
+scheme and host, so one grant covers every path, query and port on that host. The host presents
+the requests to the user after register_capabilities() returns. Denying a request aborts the
+plugin load.)pbdoc");

    m.def("plugin", [](py::object cls) {
        if (g_active_plugin_key.empty())
@@ -282,11 +282,11 @@ public:
    int request_bind_ticket(std::string* ticket) override
    {
        try {
+            ORCA_PY_AUDIT_SCOPE();
            ::Slic3r::PluginCapabilityInterface::RefCounter _orca_ref_counter(*this);
            ::Slic3r::PythonGILState gil;
            if (!gil)
                throw std::runtime_error("Python interpreter is shutting down");
-            ORCA_PY_AUDIT_SCOPE();
            pybind11::function override =
                pybind11::get_override(static_cast<const PrinterAgentPluginCapability*>(this), "request_bind_ticket");
            if (!override)
@@ -51,44 +51,6 @@ TEST_CASE("Klipper object labels name each copy without the characters Klipper c
    }
 }

-// The outline written to EXCLUDE_OBJECT_DEFINE is simplified with exclude_object_tolerance. A larger value must
-// leave fewer points, which keeps the exclude-object array small on printers that stall while parsing it.
-TEST_CASE("A larger exclude object tolerance writes fewer outline points", "[GCode]")
-{
-    const auto slice_with_tolerance = [](const std::string &tolerance) {
-        DynamicPrintConfig config = DynamicPrintConfig::full_print_config();
-        config.set_deserialize_strict({{"gcode_flavor", "klipper"}, {"exclude_object", "1"},
-                                       {"exclude_object_tolerance", tolerance}});
-        // Default facet angle (2 degrees): 180 hull points, well inside either tolerance.
-        return Test::slice({make_cylinder(20., 5.)}, config);
-    };
-    // Points of the POLYGON=[[x,y],...] on the first EXCLUDE_OBJECT_DEFINE line.
-    const auto polygon_points = [](const std::string &gcode) {
-        const size_t define = gcode.find("EXCLUDE_OBJECT_DEFINE");
-        REQUIRE(define != std::string::npos);
-        const size_t begin = gcode.find("POLYGON=", define);
-        REQUIRE(begin != std::string::npos);
-        const std::string polygon = gcode.substr(begin, gcode.find('\n', begin) - begin);
-        size_t points = 1;
-        for (size_t pos = polygon.find("],["); pos != std::string::npos; pos = polygon.find("],[", pos + 1))
-            ++points;
-        return points;
-    };
-
-    const size_t fine   = polygon_points(slice_with_tolerance("0.1"));
-    const size_t coarse = polygon_points(slice_with_tolerance("0.4"));
-    INFO("points at 0.1 mm: " << fine << ", at 0.4 mm: " << coarse);
-    CHECK(coarse >= 4);
-    CHECK(coarse < fine);
-}
-
-// Existing profiles must keep writing the outlines they wrote when the tolerance was a constant 0.1 mm.
-TEST_CASE("The exclude object tolerance defaults to the former fixed 0.1 mm", "[GCode]")
-{
-    CHECK_THAT(DynamicPrintConfig::full_print_config().opt_float("exclude_object_tolerance"),
-               Catch::Matchers::WithinAbs(0.1, 1e-9));
-}
-
 // Firmwares read the compatibility header lines (Anycubic's GoKlipper heats the bed with
 // first_layer_bed_temperature), so they must describe the filament the plate prints, not filament 1.
 TEST_CASE("The G-code header names the first layer temperatures of the filament the plate prints", "[GCode]")
@@ -12,6 +12,7 @@
 #include <boost/asio/write.hpp>
 #include <boost/filesystem.hpp>
 #include <boost/filesystem/fstream.hpp>
+#include <boost/nowide/cstdlib.hpp>
 #include <boost/system/error_code.hpp>

 #include <atomic>
@@ -22,6 +23,7 @@
 #include <istream>
 #include <memory>
 #include <mutex>
+#include <optional>
 #include <string>
 #include <string_view>
 #include <thread>
@@ -194,6 +196,29 @@ private:
    std::vector<std::shared_ptr<Connection>> m_connections;
 };

+// Sets an environment variable for the lifetime of the guard and restores the previous value.
+class ScopedEnvVar
+{
+public:
+    ScopedEnvVar(std::string name, const std::string& value) : m_name(std::move(name))
+    {
+        if (const char* old = boost::nowide::getenv(m_name.c_str()))
+            m_previous = old;
+        boost::nowide::setenv(m_name.c_str(), value.c_str(), 1);
+    }
+    ~ScopedEnvVar()
+    {
+        if (m_previous)
+            boost::nowide::setenv(m_name.c_str(), m_previous->c_str(), 1);
+        else
+            boost::nowide::unsetenv(m_name.c_str());
+    }
+
+private:
+    std::string                m_name;
+    std::optional<std::string> m_previous;
+};
+
 // What the agent reported through its callbacks, recorded on whichever thread delivers it so the
 // assertions can run on the test thread.
 struct CallbackLog
@@ -1,48 +1,23 @@
 #include <boost/filesystem/path.hpp>
 #include <boost/filesystem/operations.hpp>
-#include <boost/system/error_code.hpp>
 #include <catch2/catch_all.hpp>

 #include <libslic3r/Utils.hpp>
 #include <libslic3r/libslic3r.h>         // GCODEVIEWER_APP_KEY, SLIC3R_APP_KEY (via libslic3r_version.h)
 #include <slic3r/plugin/PluginAuditManager.hpp>
-#include <slic3r/plugin/PluginFsUtils.hpp>
-#include <slic3r/plugin/PluginManager.hpp>
-#include <slic3r/plugin/PythonInterpreter.hpp>
-#include <slic3r/plugin/PythonPluginBridge.hpp>
-#include <slic3r/plugin/PythonPluginInterface.hpp>
-#include <slic3r/Utils/IPrinterAgent.hpp>
 #include <slic3r/Utils/OrcaCloudServiceAgent.hpp> // secret_constants::USER_SECRET_FILENAME

-#include <catch2/catch_message.hpp>
 #include <catch2/catch_test_macros.hpp>
-#include <catch2/matchers/catch_matchers.hpp>
-#include <catch2/matchers/catch_matchers_string.hpp>
 #include "libslic3r_version.h"
 #include "plugin_test_utils.hpp"
-#include "test_utils.hpp"

 #include <boost/filesystem.hpp>
-#include <nlohmann/json.hpp>
-#include <pybind11/cast.h>
-#include <pybind11/embed.h>
-#include <pybind11/eval.h>
-#include <pybind11/gil.h>
-#include <pybind11/pybind11.h>
-#include <pybind11/pytypes.h>
-#include <pybind11/stl.h>

-#include <fstream>
-#include <functional>
-#include <ios>
-#include <memory>
 #include <string>
-#include <utility>
 #include <vector>

 using namespace Slic3r;
 namespace fs = boost::filesystem;
-namespace py = pybind11;

 namespace {

@@ -351,6 +326,117 @@ TEST_CASE("Plugin audit a read-only allowed root blocks writes but not reads", "
    }
 }

+TEST_CASE("Plugin audit network permissions match by scheme and host", "[audit]")
+{
+    SECTION("a URL is reduced to its scheme and host")
+    {
+        CHECK(PluginAuditManager::normalize_network_url("https://API.Example.com:8443/v1/items?page=2#top") ==
+              "https://api.example.com");
+        CHECK(PluginAuditManager::normalize_network_url("http://example.com") == "http://example.com");
+        CHECK(PluginAuditManager::normalize_network_url("https://[2001:db8::1]:443/path") == "https://[2001:db8::1]");
+    }
+
+    SECTION("non-http schemes and targets without a scheme are not network URLs")
+    {
+        CHECK(PluginAuditManager::normalize_network_url("ftp://example.com").empty());
+        CHECK(PluginAuditManager::normalize_network_url("api.example.com").empty());
+        CHECK(PluginAuditManager::normalize_network_url("https://").empty());
+    }
+
+    SECTION("a URL target matches the same scheme and host regardless of path and port")
+    {
+        const std::vector<std::string> granted{"https://api.example.com"};
+        CHECK(PluginAuditManager::network_permission_matches(granted, "https://api.example.com/v1/items?page=2"));
+        CHECK(PluginAuditManager::network_permission_matches(granted, "https://api.example.com:8443/upload"));
+    }
+
+    SECTION("a URL target does not match a different host or a different scheme")
+    {
+        const std::vector<std::string> granted{"https://api.example.com"};
+        CHECK_FALSE(PluginAuditManager::network_permission_matches(granted, "https://evil.example.com/v1"));
+        CHECK_FALSE(PluginAuditManager::network_permission_matches(granted, "http://api.example.com/v1"));
+    }
+
+    SECTION("a bare host target matches the host of a grant")
+    {
+        const std::vector<std::string> granted{"https://api.example.com"};
+        CHECK(PluginAuditManager::network_permission_matches(granted, "api.example.com"));
+        CHECK(PluginAuditManager::network_permission_matches(granted, "api.example.com:443"));
+        CHECK_FALSE(PluginAuditManager::network_permission_matches(granted, "other.example.com"));
+    }
+
+    SECTION("legacy persisted address tuples keep matching their host")
+    {
+        const std::vector<std::string> legacy_granted{"('api.example.com', 443)"};
+        CHECK(PluginAuditManager::network_permission_matches(legacy_granted, "api.example.com"));
+
+        const std::vector<std::string> granted{"https://api.example.com"};
+        CHECK(PluginAuditManager::network_permission_matches(granted, "('api.example.com', 443)"));
+        CHECK_FALSE(PluginAuditManager::network_permission_matches(granted, "('93.184.216.34', 443)"));
+    }
+
+    SECTION("an IPv6 literal matches across bracketed and bare forms")
+    {
+        const std::vector<std::string> granted{"https://[2001:db8::1]"};
+        CHECK(PluginAuditManager::network_permission_matches(granted, "2001:db8::1"));
+        CHECK(PluginAuditManager::network_permission_matches(granted, "[2001:db8::1]:443"));
+        CHECK_FALSE(PluginAuditManager::network_permission_matches(granted, "2001:db8::2"));
+    }
+
+    SECTION("a non-http URL only matches an exact grant")
+    {
+        const std::vector<std::string> granted{"ftp://example.com/file"};
+        CHECK(PluginAuditManager::network_permission_matches(granted, "ftp://example.com/file"));
+        CHECK_FALSE(PluginAuditManager::network_permission_matches(granted, "ftp://example.com/other"));
+
+        const std::vector<std::string> https{"https://api.example.com"};
+        CHECK_FALSE(PluginAuditManager::network_permission_matches(https, "ftp://api.example.com/file"));
+    }
+
+    SECTION("an empty grant list or an empty target never matches")
+    {
+        const std::vector<std::string> granted{};
+        CHECK_FALSE(PluginAuditManager::network_permission_matches(granted, "https://api.example.com"));
+
+        const std::vector<std::string> any{"https://api.example.com"};
+        CHECK_FALSE(PluginAuditManager::network_permission_matches(any, ""));
+    }
+}
+
+TEST_CASE("Plugin audit limits network ancestor approvals to resolved addresses", "[audit]")
+{
+    SECTION("IP literals are distinguished from hostnames and URLs")
+    {
+        CHECK(PluginAuditManager::is_ip_address_target("127.0.0.1"));
+        CHECK(PluginAuditManager::is_ip_address_target("93.184.216.34"));
+        CHECK(PluginAuditManager::is_ip_address_target("::1"));
+        CHECK(PluginAuditManager::is_ip_address_target("2001:db8::1"));
+        CHECK(PluginAuditManager::is_ip_address_target("[2001:db8::1]"));
+
+        CHECK_FALSE(PluginAuditManager::is_ip_address_target("api.example.com"));
+        CHECK_FALSE(PluginAuditManager::is_ip_address_target("localhost"));
+        CHECK_FALSE(PluginAuditManager::is_ip_address_target("https://api.example.com"));
+        CHECK_FALSE(PluginAuditManager::is_ip_address_target(""));
+    }
+
+    SECTION("a network approval is kept apart from the general call-site cascade")
+    {
+        PluginAuditManager& mgr = PluginAuditManager::instance();
+        const std::string   plugin_key = "plugin-audit-network-ancestor";
+        const std::string   other_key  = "plugin-audit-network-ancestor-other";
+
+        mgr.record_approved_network_call_sites(plugin_key, {"frame:network"});
+        mgr.record_approved_call_sites(plugin_key, {"frame:general"});
+
+        CHECK(mgr.has_approved_network_ancestor(plugin_key, {"frame:network"}));
+        CHECK_FALSE(mgr.has_approved_network_ancestor(plugin_key, {"frame:general"}));
+        CHECK_FALSE(mgr.has_approved_network_ancestor(other_key, {"frame:network"}));
+
+        // The network approval must not leak into the general cascade used by other categories.
+        CHECK_FALSE(mgr.has_approved_ancestor(plugin_key, {"frame:network"}));
+    }
+}
+
 TEST_CASE("Plugin audit a scoped root can also be registered read-only", "[audit]")
 {
    ScopedDataDir data_dir_guard("plugin-audit-scoped-readonly");
@@ -375,747 +461,3 @@ TEST_CASE("Plugin audit a scoped root can also be registered read-only", "[audit
        CHECK_FALSE(mgr.check_open((readonly_dir / "vendor.json").string(), "w").allowed);
    }
 }
-
-// ---------------------------------------------------------------------------
-// The audit hook, run in the embedded interpreter
-// ---------------------------------------------------------------------------
-//
-// Each TEST_CASE runs in its own process (catch_discover_tests), so each brings the plugin system
-// up with the audit hook installed, once, and shuts it down at the end. The tests loop over their
-// cases instead of using SECTIONs, which would restart the interpreter for every section.
-
-namespace {
-
-// Discovered, never loaded: the hook only needs the plugin's root and its sidecar.
-const char* const AUDIT_PLUGIN_SOURCE = R"PY(# /// script
-# requires-python = ">=3.12"
-#
-# [tool.orcaslicer.plugin]
-# name = "Audit Plugin"
-# description = "Plugin audit hook fixture"
-# author = "OrcaSlicer"
-# version = "1.0"
-# type = "script"
-# ///
-)PY";
-
-// A third-party library, installed outside the stdlib and outside the plugin.
-const char* const LIBRARY_SOURCE = R"PY(
-import socket
-import urllib.request
-
-def read_all(paths):
-    for path in paths:
-        with open(path) as f:
-            f.read()
-
-def connect_from_host(port):
-    socket.gethostname()
-    socket.create_connection(("127.0.0.1", port)).close()
-
-def fetch(url):
-    with urllib.request.urlopen(url) as response:
-        return response.read()
-
-def fetch_each(urls):
-    for url in urls:
-        yield fetch(url)
-
-class ReadingHandler(urllib.request.BaseHandler):
-    """Reads a file while each response is processed."""
-    def __init__(self, path):
-        self.path = path
-        self.outcome = None
-
-    def http_response(self, request, response):
-        try:
-            open(self.path).close()
-            self.outcome = "ok"
-        except PermissionError:
-            self.outcome = "denied"
-        return response
-)PY";
-
-// Test-side Python, run outside any plugin context: files outside every allowed root, a local
-// HTTP server, the library, and every module the tests use imported up front, so that no import
-// happens inside a plugin context. Code from exec() runs as "<string>", which is not stdlib, so
-// attempt() and fetch() stand in for plugin code.
-const char* const AUDIT_SETUP = R"PY(
-import http.client, http.server, os, pathlib, shutil, socket, subprocess, sys, tempfile, threading
-import urllib.request, zipfile
-if os.name != "nt":
-    import pty
-
-APPROVED = os.path.join(OUTSIDE, "approved.txt")
-PRIVATE = os.path.join(OUTSIDE, "private.txt")
-MISSING = os.path.join(OUTSIDE, "missing")
-TREE = os.path.join(OUTSIDE, "tree")
-TRUE_COMMAND = ["cmd", "/c", "exit 0"] if os.name == "nt" else ["true"]
-for path in (APPROVED, PRIVATE):
-    with open(path, "w") as f:
-        f.write("x")
-for sub in ("one", "two"):
-    os.makedirs(os.path.join(TREE, sub))
-    with open(os.path.join(TREE, sub, "f.txt"), "w") as f:
-        f.write("x")
-
-LIBRARY = os.path.join(OUTSIDE, "library")
-os.makedirs(LIBRARY)
-with open(os.path.join(LIBRARY, "netlib.py"), "w") as f:
-    f.write(LIBRARY_SOURCE)
-sys.path.insert(0, LIBRARY)
-import netlib
-
-class Handler(http.server.BaseHTTPRequestHandler):
-    def do_GET(self):
-        if self.path == "/redirect":
-            self.send_response(302)
-            self.send_header("Location", URL_B)
-            body = b""
-        else:
-            self.send_response(200)
-            body = b"ok"
-        self.send_header("Content-Length", str(len(body)))
-        self.end_headers()
-        self.wfile.write(body)
-
-    def log_message(self, *args):
-        pass
-
-server = http.server.ThreadingHTTPServer(("127.0.0.1", 0), Handler)
-threading.Thread(target=server.serve_forever, daemon=True).start()
-PORT = server.server_address[1]
-BASE = "http://127.0.0.1:%d" % PORT
-URL_A, URL_B, URL_REDIRECT = BASE + "/a", BASE + "/b", BASE + "/redirect"
-urllib.request.install_opener(urllib.request.build_opener(urllib.request.ProxyHandler({})))
-
-def fetch(url):
-    with urllib.request.urlopen(url) as response:
-        return response.read()
-
-fetch(URL_A)  # urllib imports some modules on its first request
-
-def attempt(action):
-    try:
-        action()
-        return "ok"
-    except PermissionError:
-        return "denied"
-
-def spawn_checked(argv):
-    parent = os.getpid()
-    try:
-        return pty.spawn(argv)
-    finally:
-        if os.getpid() != parent:
-            os._exit(1)  # a child whose exec was refused must not go on running the tests
-
-finalizer_outcomes = []
-
-class TrackedRequest(urllib.request.Request):
-    def __del__(self):
-        finalizer_outcomes.append(attempt(lambda: open(PRIVATE).close()))
-)PY";
-
-struct Prompt
-{
-    std::string              plugin;
-    std::string              event;
-    std::vector<std::string> targets;
-};
-
-// One line per prompt, "event: target ...", so a failed check shows every prompt.
-std::string describe(const std::vector<Prompt>& prompts)
-{
-    std::string text;
-    for (const Prompt& prompt : prompts) {
-        text += prompt.event + ":";
-        for (const std::string& target : prompt.targets)
-            text += " " + target;
-        text += "\n";
-    }
-    return text;
-}
-
-// The plugin system with the audit hook installed, and the permission dialog replaced by a
-// recorder that answers with `approve`. Declare it first in a test, so it is destroyed last.
-struct AuditHarness
-{
-    // Before initialize(): the interpreter creates {data_dir}/python/packages and {data_dir}/log.
-    // data_dir() is a global allowed root from then on, so the test files live in `outside`.
-    ScopedDataDir                      data{"plugin-audit-hook"};
-    bool                               initialized = PluginManager::instance().initialize();
-    ScopedTemporaryDir                 outside{"orca-plugin-audit-outside"};
-    std::vector<Prompt>                prompts;
-    std::function<bool(const Prompt&)> approve = [](const Prompt&) { return false; };
-
-    AuditHarness()
-    {
-        PluginAuditManager::set_permission_prompt_for_testing(
-            [this](const std::string& event, const std::vector<std::string>& targets) {
-                prompts.push_back({PluginAuditManager::instance().current_plugin(), event, targets});
-                return approve(prompts.back());
-            });
-    }
-
-    ~AuditHarness()
-    {
-        PluginAuditManager::set_permission_prompt_for_testing(nullptr);
-        PluginManager::instance().shutdown();
-        PythonInterpreter::instance().shutdown();
-    }
-
-    // Call before taking the GIL: discovery is not Python work.
-    void add_plugin(const std::string& key)
-    {
-        const fs::path root = data.plugins_dir() / key;
-        fs::create_directories(root);
-        std::ofstream((root / (key + ".py")).string(), std::ios::binary) << AUDIT_PLUGIN_SOURCE;
-        save_permissions(key, {});
-        PluginManager::instance().discover_plugins(/*async=*/false, /*clear=*/true);
-    }
-
-    // Grants as if saved in an earlier session.
-    void save_permissions(const std::string& key, const PluginPermissions& permissions)
-    {
-        PluginInstallState state;
-        state.installed_from    = "local";
-        state.installed_version = "1.0";
-        state.plugin_name       = key;
-        state.permissions       = permissions;
-        REQUIRE(write_install_state(data.plugins_dir() / key, state));
-    }
-
-    PluginPermissions saved_permissions(const std::string& key) const
-    {
-        PluginInstallState state;
-        read_install_state(data.plugins_dir() / key, state);
-        return state.permissions;
-    }
-};
-
-// The test-side Python globals. Construct and destroy it with the GIL held; it stops the HTTP
-// server before the interpreter shuts down.
-struct PythonSide
-{
-    py::dict globals;
-
-    explicit PythonSide(const AuditHarness& harness)
-    {
-        globals["OUTSIDE"]        = harness.outside.path().string();
-        globals["LIBRARY_SOURCE"] = LIBRARY_SOURCE;
-        exec(AUDIT_SETUP);
-    }
-
-    // A Python error fails the test here, as text: an error_already_set left to propagate would
-    // outlive the interpreter the harness shuts down.
-    void exec(const char* code)
-    {
-        std::string error;
-        try {
-            py::exec(code, globals);
-        } catch (py::error_already_set& raised) {
-            error = raised.what();
-        }
-        if (!error.empty())
-            FAIL(error);
-    }
-
-    ~PythonSide()
-    {
-        try {
-            globals["server"].attr("shutdown")();
-            globals["server"].attr("server_close")();
-        } catch (...) {
-        }
-    }
-
-    std::string              str(const char* name) const { return py::str(globals[name]).cast<std::string>(); }
-    std::string              eval(const char* expression) const { return py::str(py::eval(expression, globals)).cast<std::string>(); }
-    std::vector<std::string> strings(const char* name) const { return globals[name].cast<std::vector<std::string>>(); }
-
-    // Runs `code` as `plugin_key`, as a trampoline call does: inside the caller's GIL, in an
-    // audit scope of its own.
-    void run_as(const std::string& plugin_key, const char* code)
-    {
-        ScopedPluginAuditContext audit(plugin_key);
-        exec(code);
-    }
-};
-
-PluginPermissions http_grants(std::vector<std::string> urls)
-{
-    PluginPermissions permissions;
-    permissions.network_http = std::move(urls);
-    return permissions;
-}
-
-const char* const PLUGIN = "AuditPlugin";
-
-} // namespace
-
-TEST_CASE("A saved request grant covers the request's own connection in a later session", "[audit][Python]")
-{
-    AuditHarness harness;
-    if (!harness.initialized)
-        SKIP("Bundled Python interpreter unavailable: " + PythonInterpreter::instance().last_error());
-    harness.add_plugin(PLUGIN);
-    py::gil_scoped_acquire gil;
-    PythonSide python(harness);
-    harness.save_permissions(PLUGIN, http_grants({python.str("URL_A")}));
-
-    python.run_as(PLUGIN, "outcome = attempt(lambda: fetch(URL_A))");
-
-    CHECK(python.str("outcome") == "ok");
-    CHECK(describe(harness.prompts).empty());
-}
-
-TEST_CASE("A saved request grant does not cover another URL or a redirect", "[audit][Python]")
-{
-    AuditHarness harness;
-    if (!harness.initialized)
-        SKIP("Bundled Python interpreter unavailable: " + PythonInterpreter::instance().last_error());
-    harness.add_plugin(PLUGIN);
-    py::gil_scoped_acquire gil;
-    PythonSide python(harness);
-    harness.save_permissions(PLUGIN, http_grants({python.str("URL_A"), python.str("URL_REDIRECT")}));
-
-    python.run_as(PLUGIN, R"PY(
-outcomes = [attempt(lambda: fetch(url)) for url in (URL_A, URL_B, URL_REDIRECT)]
-outcomes += [attempt(lambda: netlib.fetch(url)) for url in (URL_A, URL_B)]
-outcomes.append(attempt(lambda: list(netlib.fetch_each([URL_A, URL_B]))))
-)PY");
-
-    // The redirect target is asked for inside the approved redirecting request, and a library's
-    // wrapper or generator asks for the second URL as plain code does.
-    CHECK(python.strings("outcomes") == std::vector<std::string>{"ok", "denied", "denied", "ok", "denied", "denied"});
-    const std::string url_b = "urllib.Request: " + python.str("URL_B") + "\n";
-    CHECK(describe(harness.prompts) == url_b + url_b + url_b + url_b);
-}
-
-TEST_CASE("Code an approved operation calls back into is judged on its own", "[audit][Python]")
-{
-    AuditHarness harness;
-    if (!harness.initialized)
-        SKIP("Bundled Python interpreter unavailable: " + PythonInterpreter::instance().last_error());
-    harness.add_plugin(PLUGIN);
-    py::gil_scoped_acquire gil;
-    PythonSide python(harness);
-    python.exec(R"PY(
-CALLBACK_COPY = os.path.join(OUTSIDE, "callback-copy")
-handler = netlib.ReadingHandler(PRIVATE)
-handler_opener = urllib.request.build_opener(urllib.request.ProxyHandler({}), handler)
-walk_outcomes = []
-copy_outcomes = []
-
-def on_walk_error(error):
-    walk_outcomes.append(attempt(lambda: open(PRIVATE).close()))
-
-def copy_file(source, destination):
-    copy_outcomes.append(attempt(lambda: open(PRIVATE).close()))
-)PY");
-    PluginPermissions permissions = http_grants({python.str("URL_A")});
-    permissions.fs_read           = {python.str("APPROVED"), python.str("MISSING")};
-    permissions.fs_readwrite      = {python.str("TREE"), python.str("CALLBACK_COPY")};
-    harness.save_permissions(PLUGIN, permissions);
-
-    // A library handler that urllib calls while the approved request runs, the plugin's own
-    // os.walk error callback and copytree copy function (called once per file), and a library
-    // loop over a saved file and an unsaved one.
-    python.run_as(PLUGIN, R"PY(
-request_outcome = attempt(lambda: handler_opener.open(URL_A).read())
-for _ in os.walk(MISSING, onerror=on_walk_error):
-    pass
-shutil.copytree(TREE, CALLBACK_COPY, copy_function=copy_file)
-loop_outcome = attempt(lambda: netlib.read_all([APPROVED, PRIVATE]))
-)PY");
-
-    CHECK(python.str("request_outcome") == "ok");
-    CHECK(python.eval("handler.outcome") == "denied");
-    CHECK(python.strings("walk_outcomes") == std::vector<std::string>{"denied"});
-    CHECK(python.strings("copy_outcomes") == std::vector<std::string>{"denied", "denied"});
-    CHECK(python.str("loop_outcome") == "denied");
-    const std::string private_file = "open: " + python.str("PRIVATE") + "\n";
-    CHECK(describe(harness.prompts) == private_file + private_file + private_file + private_file + private_file);
-}
-
-TEST_CASE("A saved directory walk covers each directory it lists", "[audit][Python]")
-{
-    AuditHarness harness;
-    if (!harness.initialized)
-        SKIP("Bundled Python interpreter unavailable: " + PythonInterpreter::instance().last_error());
-    harness.add_plugin(PLUGIN);
-    py::gil_scoped_acquire gil;
-    PythonSide python(harness);
-    PluginPermissions permissions;
-    permissions.fs_read = {python.str("TREE"), python.str("APPROVED")};
-    harness.save_permissions(PLUGIN, permissions);
-
-    // The walk lists the tree's two subdirectories on later resumes, after the plugin's own
-    // audited reads in between. Abandoned walks leave frames whose generator is gone, which the
-    // next audited event lets go.
-    python.run_as(PLUGIN, R"PY(
-walked = []
-for root, dirs, files in os.walk(TREE):
-    walked.append(root)
-    open(APPROVED).close()
-globbed = list(pathlib.Path(TREE).glob("**/*"))
-
-abandoned = os.walk(TREE)
-next(abandoned)
-del abandoned
-open(APPROVED).close()
-for _ in pathlib.Path(TREE).glob("*"):
-    break
-open(APPROVED).close()
-)PY");
-
-    CHECK(py::len(python.globals["walked"]) == 3);
-    CHECK(py::len(python.globals["globbed"]) == 4);
-    CHECK(describe(harness.prompts).empty());
-}
-
-TEST_CASE("A freshly approved operation covers its nested events", "[audit][Python]")
-{
-    AuditHarness harness;
-    if (!harness.initialized)
-        SKIP("Bundled Python interpreter unavailable: " + PythonInterpreter::instance().last_error());
-    harness.add_plugin(PLUGIN);
-    py::gil_scoped_acquire gil;
-    PythonSide python(harness);
-
-    struct Case
-    {
-        const char* prompts;
-        const char* code;
-    };
-    // Each operation names targets no earlier one saved, so each is asked once. FsCreate and
-    // FsDelete grants are never saved, so those operations are asked every time. Only the
-    // expected prompts are approved, so a nested event left uncovered fails the operation.
-    std::vector<Case> cases = {
-        {"shutil.copytree", "shutil.copytree(TREE, os.path.join(OUTSIDE, 'copy'))"},
-        {"shutil.copyfile", "shutil.copyfile(APPROVED, os.path.join(OUTSIDE, 'copied.txt'))"},
-        {"shutil.move", "shutil.move(os.path.join(OUTSIDE, 'copied.txt'), os.path.join(OUTSIDE, 'moved.txt'))"},
-        {"shutil.copystat", "shutil.copystat(os.path.join(TREE, 'one', 'f.txt'), PRIVATE)"},
-        {"shutil.make_archive", "shutil.make_archive(os.path.join(OUTSIDE, 'archive'), 'zip', root_dir=TREE)"},
-        {"shutil.unpack_archive", "shutil.unpack_archive(os.path.join(OUTSIDE, 'archive.zip'), os.path.join(OUTSIDE, 'unpacked'))"},
-        {"pathlib.Path.glob", "list(pathlib.Path(TREE).glob('**/*'))"},
-        {"subprocess.Popen", "subprocess.run(TRUE_COMMAND, check=True)"},
-        {"tempfile.mkdtemp", "tempfile.mkdtemp(dir=OUTSIDE)"},
-        {"tempfile.mkstemp", "os.close(tempfile.mkstemp(dir=OUTSIDE)[0])"},
-        {"shutil.rmtree", "shutil.rmtree(os.path.join(OUTSIDE, 'copy'))"},
-        // send() runs after connect() has returned, so its own grant is asked once.
-        {"http.client.connect\nhttp.client.send",
-         "connection = http.client.HTTPConnection('127.0.0.1', PORT)\n"
-         "connection.request('GET', '/a')\n"
-         "connection.getresponse().read()\n"
-         "connection.close()"},
-    };
-#ifndef _WIN32
-    cases.push_back({"os.fwalk", "list(os.fwalk(os.path.join(OUTSIDE, 'unpacked')))"});
-    // The forked child's exec is covered by the spawn too: had it prompted, the child's own
-    // denial would end it with status 1.
-    cases.push_back({"pty.spawn", "spawn_status = spawn_checked(TRUE_COMMAND + ['spawned'])"});
-#endif
-
-    for (const Case& operation : cases) {
-        INFO(operation.code);
-        const std::string expected = std::string(operation.prompts) + "\n";
-        harness.approve = [&expected](const Prompt& prompt) {
-            return expected.find(prompt.event + "\n") != std::string::npos;
-        };
-        harness.prompts.clear();
-        python.run_as(PLUGIN, operation.code);
-
-        std::string asked;
-        for (const Prompt& prompt : harness.prompts)
-            asked += (asked.empty() ? "" : "\n") + prompt.event;
-        CHECK(asked == operation.prompts);
-    }
-#ifndef _WIN32
-    CHECK(python.eval("spawn_status") == "0");
-#endif
-}
-
-TEST_CASE("An event with no target is granted by name and remembered", "[audit][Python]")
-{
-    AuditHarness harness;
-    if (!harness.initialized)
-        SKIP("Bundled Python interpreter unavailable: " + PythonInterpreter::instance().last_error());
-    harness.add_plugin(PLUGIN);
-    harness.approve = [](const Prompt& prompt) { return prompt.event != "socket.sendto"; };
-    py::gil_scoped_acquire gil;
-    PythonSide python(harness);
-
-    python.run_as(PLUGIN, R"PY(
-socket.socket().close()
-udp = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
-sendto_outcome = attempt(lambda: udp.sendto(b"x", ("127.0.0.1", 9)))
-udp.close()
-)PY");
-
-    // The socket is asked for once, without a target to show; the datagram's address is a target.
-    CHECK(python.str("sendto_outcome") == "denied");
-    CHECK(describe(harness.prompts) == "socket.__new__:\nsocket.sendto: ('127.0.0.1', 9)\n");
-    CHECK(harness.saved_permissions(PLUGIN).events == std::vector<std::string>{"Socket:socket.__new__"});
-    CHECK(harness.saved_permissions(PLUGIN).network_socket.empty());
-
-    harness.prompts.clear();
-    python.run_as(PLUGIN, "socket.socket().close()");
-    CHECK(describe(harness.prompts).empty());
-
-    // A grant for an event with no target covers nothing else: a library's approved
-    // gethostname() does not carry the connection it makes next.
-    harness.approve = [](const Prompt& prompt) { return prompt.event == "socket.gethostname"; };
-    python.run_as(PLUGIN, "connect_outcome = attempt(lambda: netlib.connect_from_host(PORT))");
-    CHECK(python.str("connect_outcome") == "denied");
-    CHECK(describe(harness.prompts) == "socket.gethostname:\nsocket.getaddrinfo: 127.0.0.1\n");
-    harness.prompts.clear();
-    harness.approve = [](const Prompt&) { return true; };
-
-#ifndef _WIN32
-    // sendmsg() without an address names no target either.
-    python.run_as(PLUGIN, R"PY(
-left, right = socket.socketpair()
-left.sendmsg([b"x"])
-left.close()
-right.close()
-)PY");
-    CHECK(describe(harness.prompts) == "socket.sendmsg:\n");
-    CHECK(harness.saved_permissions(PLUGIN).events ==
-          std::vector<std::string>{"Socket:socket.__new__", "Socket:socket.gethostname", "Socket:socket.sendmsg"});
-#endif
-}
-
-TEST_CASE("An event grant does not stand in for another access or a target of the same name", "[audit][Python]")
-{
-    AuditHarness harness;
-    if (!harness.initialized)
-        SKIP("Bundled Python interpreter unavailable: " + PythonInterpreter::instance().last_error());
-    harness.add_plugin(PLUGIN);
-    harness.approve = [asked = 0](const Prompt&) mutable { return asked++ == 0; };
-    py::gil_scoped_acquire gil;
-    PythonSide python(harness);
-    python.exec(R"PY(
-READ_FD = os.open(APPROVED, os.O_RDONLY)
-WRITE_FD = os.open(os.path.join(OUTSIDE, "scratch.txt"), os.O_WRONLY | os.O_CREAT)
-)PY");
-
-    // A file descriptor has no path to show or save: a granted read of one is not a write.
-    python.run_as(PLUGIN, R"PY(
-fd_outcomes = [attempt(lambda: open(READ_FD, "r", closefd=False).close()),
-               attempt(lambda: open(WRITE_FD, "w", closefd=False).close())]
-)PY");
-    CHECK(python.strings("fd_outcomes") == std::vector<std::string>{"ok", "denied"});
-    CHECK(describe(harness.prompts) == "open:\nopen:\n");
-    CHECK(harness.saved_permissions(PLUGIN).events == std::vector<std::string>{"FsRead:open"});
-
-    // A saved os.fork event grant is not an os.system command named "os.fork".
-    PluginPermissions permissions;
-    permissions.events = {"FsRead:open", "ProcessCreate:os.fork"};
-    harness.save_permissions(PLUGIN, permissions);
-    harness.prompts.clear();
-    python.run_as(PLUGIN, R"PY(
-reread_outcome = attempt(lambda: open(READ_FD, "r", closefd=False).close())
-system_outcome = attempt(lambda: os.system("os.fork"))
-os.close(READ_FD)
-os.close(WRITE_FD)
-)PY");
-    CHECK(python.str("reread_outcome") == "ok");
-    CHECK(python.str("system_outcome") == "denied");
-    REQUIRE(harness.prompts.size() == 1);
-    CHECK(harness.prompts.front().event == "os.system");
-    CHECK(harness.saved_permissions(PLUGIN).process.empty());
-}
-
-TEST_CASE("A finalizer run when a root frame is let go is judged as the plugin without a prompt", "[audit][Python]")
-{
-    AuditHarness harness;
-    if (!harness.initialized)
-        SKIP("Bundled Python interpreter unavailable: " + PythonInterpreter::instance().last_error());
-    harness.add_plugin(PLUGIN);
-    py::gil_scoped_acquire gil;
-    PythonSide python(harness);
-    PluginPermissions permissions = http_grants({python.str("URL_A")});
-    permissions.fs_read           = {python.str("APPROVED")};
-    harness.save_permissions(PLUGIN, permissions);
-    PluginAuditManager& mgr = PluginAuditManager::instance();
-
-    // Once the request returns, only its held frame keeps the request object alive, and the
-    // request's finalizer reads a file the plugin was never granted.
-    python.run_as(PLUGIN, "fetch(TrackedRequest(URL_A))");
-    CHECK(python.strings("finalizer_outcomes") == std::vector<std::string>{"denied"}); // at scope end
-    CHECK(describe(harness.prompts).empty());
-    CHECK_FALSE(mgr.audit_denial_pending());
-
-    python.exec("finalizer_outcomes.clear()");
-    python.run_as(PLUGIN, R"PY(
-fetch(TrackedRequest(URL_A))
-open(APPROVED).close()  # the next event lets the returned request's frame go
-outcomes_before_scope_end = list(finalizer_outcomes)
-)PY");
-    CHECK(python.strings("outcomes_before_scope_end") == std::vector<std::string>{"denied"});
-    CHECK(describe(harness.prompts).empty());
-
-    // The finalizer's denial during another event's decision leaves that event's own denial intact.
-    python.exec("finalizer_outcomes.clear()");
-    python.run_as(PLUGIN, R"PY(
-fetch(TrackedRequest(URL_A))
-try:
-    os.listdir(OUTSIDE)
-    outer_error = ""
-except PermissionError as error:
-    outer_error = str(error)
-)PY");
-    CHECK(python.strings("finalizer_outcomes") == std::vector<std::string>{"denied"});
-    CHECK_THAT(python.str("outer_error"), Catch::Matchers::ContainsSubstring("os.listdir"));
-    CHECK(describe(harness.prompts) == "os.listdir: " + python.str("OUTSIDE") + "\n");
-    AuditViolation violation;
-    REQUIRE(mgr.last_violation(violation));
-    CHECK(violation.event_name == "os.listdir");
-    CHECK(mgr.audit_denial_pending());
-}
-
-TEST_CASE("A nested audit scope does not see the outer scope's running operations", "[audit][Python]")
-{
-    AuditHarness harness;
-    if (!harness.initialized)
-        SKIP("Bundled Python interpreter unavailable: " + PythonInterpreter::instance().last_error());
-    harness.add_plugin("PluginA");
-    harness.add_plugin("PluginB");
-    py::gil_scoped_acquire gil;
-    PythonSide python(harness);
-    PluginPermissions permissions;
-    permissions.fs_read = {python.str("TREE")};
-    harness.save_permissions("PluginA", permissions);
-
-    {
-        // Two walks plugin A started and suspended after listing the tree itself.
-        ScopedPluginAuditContext plugin_a("PluginA");
-        python.exec("first = os.walk(TREE)\nnext(first)\nsecond = os.walk(TREE)\nnext(second)");
-        {
-            // Plugin B resuming one of them is asked for each subdirectory, as plugin B.
-            ScopedPluginAuditContext plugin_b("PluginB");
-            python.exec("listed_by_b = len(list(first))");
-        }
-        // Back in plugin A's scope, its walks are covered again.
-        python.exec("listed_by_a = len(list(second))");
-    }
-
-    CHECK(python.globals["listed_by_b"].cast<int>() == 0);
-    CHECK(python.globals["listed_by_a"].cast<int>() == 2);
-    REQUIRE(harness.prompts.size() == 2);
-    for (const Prompt& prompt : harness.prompts) {
-        CHECK(prompt.plugin == "PluginB");
-        CHECK(prompt.event == "os.scandir");
-    }
-}
-
-TEST_CASE("Root frames held when a capability call ends are let go with the GIL, as the plugin", "[audit][Python]")
-{
-    AuditHarness harness;
-    if (!harness.initialized)
-        SKIP("Bundled Python interpreter unavailable: " + PythonInterpreter::instance().last_error());
-    harness.approve = [](const Prompt& prompt) { return prompt.event == "os.walk"; };
-    py::gil_scoped_acquire gil;
-    PythonSide python(harness);
-    (void) PythonPluginBridge::instance(); // force the embedded module registration into the binary
-    python.globals["orca"] = py::module_::import("orca");
-
-    // walk_and_drop() leaves a returned walk's frame held by the audit scope alone, with a marker
-    // in its locals; the frame is let go when the capability call ends, which runs the marker's
-    // finalizer.
-    python.exec(R"PY(
-class Marker:
-    def __init__(self, action=None):
-        self.action = action
-    def __del__(self):
-        finalized.append(self.action() if self.action else "ran")
-
-finalized = []
-
-def walk_and_drop(marker):
-    walker = os.walk(TREE, onerror=marker)
-    next(walker)
-    del walker
-
-class ConfigCapability(orca.PythonPluginBase):
-    def get_name(self):
-        return "config_cap"
-    def get_default_config(self):
-        walk_and_drop(Marker())
-        return {"finalized_during_call": len(finalized)}
-    def has_config_ui(self):
-        walker = os.walk(TREE, onerror=Marker(lambda: attempt(lambda: open(PRIVATE).close())))
-        next(walker)
-        attempt(lambda: os.listdir(OUTSIDE))  # denied: the trampoline clears the plugin key
-        del walker  # the walk's frame is now held by the audit scope alone
-        raise RuntimeError("the capability fails after a denial")
-
-class TicketAgent(orca.printer_agent.PrinterAgentBase):
-    def get_name(self):
-        return "ticket_agent"
-    def request_bind_ticket(self):
-        walk_and_drop(Marker())
-        return (0, "ticket")
-)PY");
-
-    py::object config_instance = python.globals["ConfigCapability"]();
-    auto       config_cap      = config_instance.cast<std::shared_ptr<PluginCapabilityInterface>>();
-    config_cap->set_audit_plugin_key("GilPlugin");
-    config_cap->set_resolved_identity("config_cap", PluginCapabilityType::Script);
-
-    py::object agent_instance = python.globals["TicketAgent"]();
-    auto       agent_cap      = agent_instance.cast<std::shared_ptr<PluginCapabilityInterface>>();
-    agent_cap->set_audit_plugin_key("GilPlugin");
-    agent_cap->set_resolved_identity("ticket_agent", PluginCapabilityType::PrinterConnection);
-    auto agent = std::dynamic_pointer_cast<IPrinterAgent>(agent_cap);
-    REQUIRE(agent);
-
-    // A host call arrives without the GIL; both calls take it before their audit scope.
-    nlohmann::json config;
-    int            ticket_result = -1;
-    std::string    ticket;
-    {
-        py::gil_scoped_release released;
-        config        = config_cap->get_default_config();
-        ticket_result = agent->request_bind_ticket(&ticket);
-    }
-    CHECK(config == nlohmann::json{{"finalized_during_call", 0}});
-    CHECK(ticket_result == 0);
-    CHECK(ticket == "ticket");
-    CHECK(python.strings("finalized") == std::vector<std::string>{"ran", "ran"});
-
-    // On the trampoline's denial path the frame is let go as the plugin, though the ambient key
-    // was cleared: the finalizer's read is audited and denied without a prompt.
-    python.exec("finalized.clear()");
-    harness.prompts.clear();
-    CHECK_THROWS_AS(config_cap->has_config_ui(), py::error_already_set);
-    CHECK(python.strings("finalized") == std::vector<std::string>{"denied"});
-    CHECK(describe(harness.prompts) == "os.walk: " + python.str("TREE") + "\nos.listdir: " + python.str("OUTSIDE") + "\n");
-}
-
-TEST_CASE("Stdlib code is recognized through a symlinked Python home", "[audit][Python]")
-{
-    AuditHarness harness;
-    if (!harness.initialized)
-        SKIP("Bundled Python interpreter unavailable: " + PythonInterpreter::instance().last_error());
-    py::gil_scoped_acquire gil;
-
-    const py::dict paths   = py::module_::import("sysconfig").attr("get_paths")();
-    const fs::path stdlib  = py::str(paths["stdlib"]).cast<std::string>();
-    const fs::path purelib = py::str(paths["purelib"]).cast<std::string>();
-    const fs::path link    = harness.outside.path() / "linked-stdlib";
-    boost::system::error_code ec;
-    fs::create_directory_symlink(stdlib, link, ec);
-    if (ec)
-        SKIP("Cannot create a directory symlink here: " + ec.message());
-
-    CHECK(PluginAuditManager::is_stdlib_file((stdlib / "os.py").string()));
-    CHECK(PluginAuditManager::is_stdlib_file((link / "urllib" / "request.py").string()));
-    CHECK(PluginAuditManager::is_stdlib_file("<frozen os>"));
-    CHECK_FALSE(PluginAuditManager::is_stdlib_file((purelib / "requests" / "api.py").string()));
-    CHECK_FALSE(PluginAuditManager::is_stdlib_file((link / "site-packages" / "requests" / "api.py").string()));
-    CHECK_FALSE(PluginAuditManager::is_stdlib_file((harness.outside.path() / "plugin.py").string()));
-    CHECK_FALSE(PluginAuditManager::is_stdlib_file("<string>"));
-}
@@ -5,7 +5,6 @@
 #include <ios>
 #include <libslic3r/LifecycleEvents.hpp>
 #include <memory>
-#include <slic3r/Utils/Http.hpp>
 #include <slic3r/Utils/NetworkAgentFactory.hpp>
 #include <slic3r/plugin/PluginDescriptor.hpp>
 #include <slic3r/plugin/PluginManager.hpp>
@@ -15,13 +14,8 @@
 #include <catch2/catch_test_macros.hpp>
 #include <catch2/catch_message.hpp>
 #include "plugin_test_utils.hpp"
-#include "test_utils.hpp"

 #include <boost/filesystem.hpp>
-#include <pybind11/cast.h>
-#include <pybind11/gil.h>
-#include <pybind11/pybind11.h>
-#include <pybind11/pytypes.h>

 #include <algorithm>
 #include <chrono>
@@ -1074,43 +1068,3 @@ TEST_CASE("Unloading a plugin that is not loaded is a no-op", "[PluginLifecycle]
    CHECK(manager.unload_plugin("No_Such_Plugin"));
    CHECK_FALSE(manager.is_plugin_loaded("No_Such_Plugin"));
 }
-
-namespace {
-
-// CA certificates in the default client context, as a plugin's urllib or http.client request would
-// verify against.
-int default_context_ca_count()
-{
-    pybind11::gil_scoped_acquire gil;
-    const pybind11::dict stats = pybind11::module_::import("ssl").attr("create_default_context")().attr("cert_store_stats")();
-    return stats["x509_ca"].cast<int>();
-}
-
-} // namespace
-
-TEST_CASE("The bundled Python trusts the system CA certificates", "[PluginLifecycle][Python]")
-{
-    // The app runs this before plugins load; on Linux it is what points OpenSSL at the distro bundle.
-    Http::tls_global_init();
-    ScopedPluginManager plugin_system;
-    if (!plugin_system.initialized)
-        SKIP("Bundled Python interpreter unavailable: " + PythonInterpreter::instance().last_error());
-
-    CHECK(default_context_ca_count() > 0);
-}
-
-#ifndef _WIN32 // Windows adds its system store whatever SSL_CERT_FILE names.
-TEST_CASE("SSL_CERT_FILE still overrides the bundled Python's default CA certificates", "[PluginLifecycle][Python]")
-{
-    // Existing but empty: Linux's CurlGlobalInit replaces an SSL_CERT_FILE that names a missing file.
-    ScopedTemporaryFile empty_bundle(".pem");
-    std::ofstream(empty_bundle.string()).close();
-    ScopedEnvVar ssl_cert_file{"SSL_CERT_FILE", empty_bundle.string()};
-
-    ScopedPluginManager plugin_system;
-    if (!plugin_system.initialized)
-        SKIP("Bundled Python interpreter unavailable: " + PythonInterpreter::instance().last_error());
-
-    CHECK(default_context_ca_count() == 0);
-}
-#endif
@@ -10,13 +10,10 @@
 #include <libslic3r/Utils.hpp>

 #include <boost/filesystem.hpp>
-#include <boost/nowide/cstdlib.hpp>

 #include <cstdio>
 #include <fstream>
-#include <optional>
 #include <string>
-#include <utility>

 #if defined(WIN32) || defined(_WIN32)
 #define PATH_SEPARATOR R"(\)"
@@ -200,27 +197,4 @@ private:
    boost::filesystem::path m_previous;
 };

-// Sets an environment variable for the lifetime of the guard and restores the previous value.
-class ScopedEnvVar
-{
-public:
-    ScopedEnvVar(std::string name, const std::string& value) : m_name(std::move(name))
-    {
-        if (const char* old = boost::nowide::getenv(m_name.c_str()))
-            m_previous = old;
-        boost::nowide::setenv(m_name.c_str(), value.c_str(), 1);
-    }
-    ~ScopedEnvVar()
-    {
-        if (m_previous)
-            boost::nowide::setenv(m_name.c_str(), m_previous->c_str(), 1);
-        else
-            boost::nowide::unsetenv(m_name.c_str());
-    }
-
-private:
-    std::string                m_name;
-    std::optional<std::string> m_previous;
-};
-
 #endif // SLIC3R_TEST_UTILS