fix: Allow plugins to read the embedded Python stdlib (#16669 )

* Stop re-asking for plugin permissions granted in an earlier session * fix: Allow plugins to read the embedded Python stdlib --------- Co-authored-by: SoftFever <softfeverever@gmail.com>
Update GMP to 6.3.0 to Avoid the x18 Register on Apple Silicon (#16686 )
2026-10-20 14:08:20 +00:00 · 2026-10-20 21:31:25 +08:00 · 2026-10-20 19:52:44 +08:00 · 2026-10-20 18:04:42 +08:00
9 changed files with 224 additions and 561 deletions
@@ -59,9 +59,13 @@ else ()
        set(_cross_compile_arg --host=${TOOLCHAIN_PREFIX})
    endif ()

+    # 6.3.0 is the first release whose arm64 assembly avoids x18, which macOS
+    # reserves and zeroes on every return to user space; 6.2.1 crashes on Apple
+    # silicon whenever CGAL falls back to exact arithmetic.
    ExternalProject_Add(dep_GMP
-        URL https://github.com/SoftFever/OrcaSlicer_deps/releases/download/gmp-6.2.1/gmp-6.2.1.tar.bz2
-        URL_HASH SHA256=eae9326beb4158c386e39a356818031bd28f3124cf915f8c5b1dc4c7a36b4d7c
+        URL https://ftp.gnu.org/gnu/gmp/gmp-6.3.0.tar.xz
+            https://github.com/SoftFever/OrcaSlicer_deps/releases/download/gmp-6.3.0/gmp-6.3.0.tar.xz
+        URL_HASH SHA256=a3c2b80201b89e68616f4ad30bc66aee4927c3ce50e33929ca819d5c43538898
        DOWNLOAD_DIR ${DEP_DOWNLOAD_DIR}/GMP
        PATCH_COMMAND git apply ${GMP_DIRECTORY_FLAG} --verbose ${CMAKE_CURRENT_LIST_DIR}/0001-GMP_GCC15.patch
        BUILD_IN_SOURCE ON
@@ -226,10 +226,10 @@ modules:
        sha256: f353e7b99bd0cbfc27ac9082de51acf32a8bc0b3e21ff9661ecca6f205ec1d81
        dest: external-packages/OpenVDB

-      # GMP 6.2.1
+      # GMP 6.3.0
      - type: file
-        url: https://github.com/SoftFever/OrcaSlicer_deps/releases/download/gmp-6.2.1/gmp-6.2.1.tar.bz2
-        sha256: eae9326beb4158c386e39a356818031bd28f3124cf915f8c5b1dc4c7a36b4d7c
+        url: https://ftp.gnu.org/gnu/gmp/gmp-6.3.0.tar.xz
+        sha256: a3c2b80201b89e68616f4ad30bc66aee4927c3ce50e33929ca819d5c43538898
        dest: external-packages/GMP

      # MPFR 4.2.2
@@ -5,13 +5,10 @@
 #include "libslic3r/libslic3r.h" // GCODEVIEWER_APP_KEY, and SLIC3R_APP_KEY via libslic3r_version.h
 #include "libslic3r_version.h"

-#include <boost/algorithm/string/case_conv.hpp>
 #include <boost/algorithm/string/predicate.hpp>
-#include <boost/algorithm/string/trim.hpp>
 #include <boost/filesystem/path.hpp>
 #include <boost/filesystem/operations.hpp>
 #include <boost/log/trivial.hpp>
-#include <boost/system/error_code.hpp>

 #include <algorithm>
 #include <cassert>
@@ -164,180 +161,6 @@ static bool is_fs_category(AuditEventCategory category)
    }
 }

-// HTTP and raw-socket events are governed by the same network permission: a declared host may be
-// reached through either layer, and the layers nest for one plugin action (urllib -> http.client
-// -> socket).
-static bool is_network_category(AuditEventCategory category)
-{
-    return category == AuditEventCategory::Http || category == AuditEventCategory::Socket;
-}
-
-// ---------------------------------------------------------------------------
-// Network permission identity
-// ---------------------------------------------------------------------------
-
-static std::string ascii_lower(std::string value)
-{
-    boost::algorithm::to_lower(value);
-    return value;
-}
-
-static std::string trim_ascii_space(std::string value)
-{
-    boost::algorithm::trim(value);
-    return value;
-}
-
-// Canonical storage keeps IPv6 literals bracketed (https://[::1]), while a socket address
-// exposes the bare literal (::1). Compare them without the brackets.
-static std::string without_ipv6_brackets(std::string host)
-{
-    if (host.size() >= 2 && host.front() == '[' && host.back() == ']')
-        host = host.substr(1, host.size() - 2);
-    return host;
-}
-
-// Returns the host part of a URL authority, dropping userinfo and port. IPv6 literals keep their
-// brackets so that a URL and a bare address compare consistently.
-static std::string host_from_authority(std::string authority)
-{
-    const size_t at = authority.rfind('@');
-    if (at != std::string::npos)
-        authority.erase(0, at + 1);
-
-    if (authority.empty())
-        return {};
-
-    if (authority.front() == '[') {
-        const size_t close = authority.find(']');
-        if (close == std::string::npos)
-            return {};
-        authority.erase(close + 1);
-        return ascii_lower(authority);
-    }
-
-    const size_t colon = authority.find(':');
-    if (colon != std::string::npos)
-        authority.erase(colon);
-
-    if (authority.find_first_of(" \t\r\n/?#@") != std::string::npos)
-        return {};
-
-    return ascii_lower(authority);
-}
-
-// Extracts a host from a target that is not a URL: "host", "host:443", "[::1]:443", "('host',
-// 443)" (the form older releases persisted for socket address events), or "'host'".
-static std::string network_host_from_target(const std::string& target)
-{
-    std::string value = trim_ascii_space(target);
-    if (value.empty())
-        return {};
-
-    if (value.front() == '(') {
-        // Legacy persisted address tuple: ("host", 443) or ("host", 443, 0, 0).
-        const size_t quote = value.find_first_of("'\"");
-        if (quote != std::string::npos) {
-            const char   delimiter = value[quote];
-            const size_t end       = value.find(delimiter, quote + 1);
-            if (end == std::string::npos)
-                return {};
-            value = value.substr(quote + 1, end - quote - 1);
-        } else {
-            value = value.substr(1);
-            const size_t comma = value.find(',');
-            if (comma != std::string::npos)
-                value.erase(comma);
-        }
-    } else if (value.front() == '[') {
-        const size_t close = value.find(']');
-        if (close == std::string::npos)
-            return {};
-        value.erase(close + 1);
-    } else {
-        // Strip a ":port" suffix, but leave a bare IPv6 literal ("::1") intact.
-        const size_t colon = value.find(':');
-        if (colon != std::string::npos && value.find(':', colon + 1) == std::string::npos)
-            value.erase(colon);
-    }
-
-    value = trim_ascii_space(value);
-    if (value.empty() || value.find_first_of(" \t\r\n/?#@") != std::string::npos)
-        return {};
-
-    return ascii_lower(value);
-}
-
-std::string PluginAuditManager::normalize_network_url(const std::string& url)
-{
-    const size_t scheme_end = url.find("://");
-    if (scheme_end == std::string::npos || scheme_end == 0)
-        return {};
-
-    const std::string scheme = ascii_lower(url.substr(0, scheme_end));
-    if (scheme != "http" && scheme != "https")
-        return {};
-
-    const size_t authority_start = scheme_end + 3;
-    const size_t authority_end   = url.find_first_of("/?#", authority_start);
-    const std::string authority  = url.substr(authority_start, authority_end == std::string::npos
-                                                                    ? std::string::npos
-                                                                    : authority_end - authority_start);
-
-    const std::string host = host_from_authority(authority);
-    if (host.empty())
-        return {};
-
-    return scheme + "://" + host;
-}
-
-bool PluginAuditManager::network_permission_matches(const std::vector<std::string>& granted,
-                                                    const std::string&              target)
-{
-    if (target.empty())
-        return false;
-
-    const bool        target_is_url = target.find("://") != std::string::npos;
-    const std::string target_url    = normalize_network_url(target);
-    if (target_is_url && target_url.empty()) {
-        // A non-http(s) URL has no network identity we can generalize; only an exact grant
-        // recorded by an earlier approval stays valid, so an unrelated scheme never matches.
-        return std::find(granted.begin(), granted.end(), target) != granted.end();
-    }
-
-    const std::string target_host =
-        target_is_url ? std::string{} : without_ipv6_brackets(network_host_from_target(target));
-    if (!target_is_url && target_host.empty())
-        return false;
-
-    for (const std::string& entry : granted) {
-        // Preserve an exact grant recorded by an older release, e.g. a full URL with a query.
-        if (entry == target)
-            return true;
-
-        const std::string entry_url = normalize_network_url(entry);
-        if (target_is_url) {
-            // Canonical scheme://host grants are host-wide. Older grants that persisted a full
-            // URL remain scoped to that exact URL, preserving the operation-root URL check.
-            if (!entry_url.empty() && entry_url == entry && entry_url == target_url)
-                return true;
-            continue;
-        }
-
-        if (!entry_url.empty()) {
-            // Bare hosts carry no scheme: match the host part of a scheme://host grant.
-            const std::string entry_host = entry_url.substr(entry_url.find("://") + 3);
-            if (without_ipv6_brackets(entry_host) == target_host)
-                return true;
-        } else if (without_ipv6_brackets(network_host_from_target(entry)) == target_host) {
-            // Legacy persisted address tuples, e.g. "('host', 443)".
-            return true;
-        }
-    }
-
-    return false;
-}
-
 // The category's name in a saved event grant, e.g. "FsRead" in "FsRead:open".
 static const char* category_name(AuditEventCategory category)
 {
@@ -530,16 +353,18 @@ void PluginAuditManager::add_denied_filename(const std::string& filename)
 std::vector<std::string> PluginAuditManager::default_denied_filenames()
 {
    // AppConfig::config_path() picks .conf vs .ini on the USE_JSON_CONFIG ifdef and the app key
-    // on its mode, and is a non-static member we cannot call without an instance.  Denying all
+    // on its mode, and is a non-static member we cannot call without an instance. Denying all
    // four names is cheaper and more robust than replicating that; the two unused names cost one
-    // string comparison each.  Single-sourced here so install_hook() and the tests seed from the
-    // same list and cannot drift apart.
+    // string comparison each. Keep the plugin install-state sidecar here too: it controls which
+    // packages load on startup and must remain host-managed. Single-sourced so install_hook() and
+    // the tests seed from the same list and cannot drift apart.
    return {
        SLIC3R_APP_KEY ".conf",
        GCODEVIEWER_APP_KEY ".conf",
        SLIC3R_APP_KEY ".ini",
        GCODEVIEWER_APP_KEY ".ini",
        secret_constants::USER_SECRET_FILENAME,
+        ".install_state.json",
    };
 }

@@ -675,6 +500,12 @@ AuditDecision PluginAuditManager::check_path_access(const boost::filesystem::pat
            candidate = absolute_candidate;
    }

+    // Importing Python modules reads their source and may inspect package directories. These
+    // reads are normal interpreter work, not plugin data access; keep the exemption read-only
+    // and exclude third-party packages from the stdlib roots.
+    if (!is_write && is_stdlib_path(candidate))
+        return {true, ""};
+
    // A root that doesn't allow writes only matches a read-shaped request; a write/create/
    // delete-shaped one falls through to "outside allowed root" for that root even though the
    // path is physically inside it.
@@ -705,39 +536,6 @@ AuditDecision PluginAuditManager::check_open(const std::string& path_str, const
    return check_path_access(boost::filesystem::path(path_str), is_write);
 }

-namespace {
-
-// Builds and shows the modal confirmation. Must run on the GUI thread.
-bool show_permission_dialog(const wxString& message, const wxString& title)
-{
-    wxMessageDialog dialog(nullptr, message, title, wxYES_NO | wxICON_WARNING);
-    return dialog.ShowModal() == wxID_YES;
-}
-
-// Shows a permission prompt on the GUI thread and waits for the answer. The caller may be the
-// plugin-load worker, so off the main thread the dialog is marshaled with CallAfter.
-bool ask_permission(const wxString& message)
-{
-    if (wxTheApp == nullptr || GUI::wxGetApp().is_closing())
-        return false;
-
-    if (wxIsMainThread())
-        return show_permission_dialog(message, _L("Plugin permissions"));
-
-    auto result = std::make_shared<std::promise<bool>>();
-    auto future = result->get_future();
-    GUI::wxGetApp().CallAfter([result, message]() {
-        if (wxTheApp == nullptr || GUI::wxGetApp().is_closing()) {
-            result->set_value(false);
-            return;
-        }
-        result->set_value(show_permission_dialog(message, _L("Plugin permissions")));
-    });
-    return future.get();
-}
-
-} // namespace
-
 bool PluginAuditManager::request_filesystem_read_permissions(const std::string&              plugin_key,
                                                              const std::vector<std::string>& paths)
 {
@@ -759,80 +557,60 @@ bool PluginAuditManager::request_filesystem_read_permissions(const std::string&
    if (missing.empty())
        return true;

-    wxString requested_paths;
-    for (const std::string& path : missing)
-        requested_paths += wxString::FromUTF8(path.c_str()) + "\n";
-
-    if (!ask_permission(wxString::Format(_L("Plugin \"%s\" requests filesystem read access to:\n%s"),
-                                        wxString::FromUTF8(descriptor.name.c_str()), requested_paths)))
+    if (wxTheApp == nullptr || GUI::wxGetApp().is_closing())
        return false;

-    seed_install_metadata(state, descriptor);
+    auto show_dialog = [&descriptor, &missing]() {
+        wxString requested_paths;
+        for (const std::string& path : missing)
+            requested_paths += wxString::FromUTF8(path.c_str()) + "\n";
+
+        wxMessageDialog dialog(
+            nullptr,
+            wxString::Format(_L("Plugin \"%s\" requests filesystem read access to:\n%s"),
+                             wxString::FromUTF8(descriptor.name.c_str()), requested_paths),
+            _L("Plugin permissions"),
+            wxYES_NO | wxICON_WARNING);
+        return dialog.ShowModal() == wxID_YES;
+    };
+
+    bool granted = false;
+    if (wxIsMainThread()) {
+        granted = show_dialog();
+    } else {
+        auto result = std::make_shared<std::promise<bool>>();
+        auto future = result->get_future();
+        GUI::wxGetApp().CallAfter([result, descriptor_name = descriptor.name, missing]() {
+            wxString requested_paths;
+            for (const std::string& path : missing)
+                requested_paths += wxString::FromUTF8(path.c_str()) + "\n";
+
+            wxMessageDialog dialog(
+                nullptr,
+                wxString::Format(_L("Plugin \"%s\" requests filesystem read access to:\n%s"),
+                                 wxString::FromUTF8(descriptor_name.c_str()), requested_paths),
+                _L("Plugin permissions"),
+                wxYES_NO | wxICON_WARNING);
+            result->set_value(dialog.ShowModal() == wxID_YES);
+        });
+        granted = future.get();
+    }
+
+    if (!granted)
+        return false;
+
+    if (state.plugin_name.empty()) {
+        state.installed_from    = descriptor.is_cloud_plugin() ? "cloud" : "local";
+        state.installed_version = !descriptor.installed_version.empty() ? descriptor.installed_version : descriptor.version;
+        state.plugin_name       = descriptor.name;
+        state.cloud_uuid        = descriptor.cloud_uuid();
+        state.enabled            = true;
+    }

    state.permissions.fs_read.insert(state.permissions.fs_read.end(), missing.begin(), missing.end());
    return write_install_state(boost::filesystem::path(descriptor.plugin_root), state);
 }

-bool PluginAuditManager::request_network_permissions(const std::string&              plugin_key,
-                                                      const std::vector<std::string>& urls)
-{
-    if (plugin_key.empty() || urls.empty())
-        return true;
-
-    PluginDescriptor descriptor;
-    if (!PluginManager::instance().try_get_plugin_descriptor(plugin_key, descriptor) || descriptor.plugin_root.empty())
-        return false;
-
-    // Reduce every request to scheme://host before comparing or persisting it, so a URL with a
-    // path or query cannot create a second grant for the same host.
-    std::vector<std::string> requested;
-    for (const std::string& url : urls) {
-        const std::string normalized = normalize_network_url(url);
-        if (normalized.empty()) {
-            BOOST_LOG_TRIVIAL(warning) << "[AUDIT] Invalid network permission request for plugin " << plugin_key << ": " << url;
-            return false;
-        }
-        if (std::find(requested.begin(), requested.end(), normalized) == requested.end())
-            requested.push_back(normalized);
-    }
-
-    PluginInstallState state;
-    read_install_state(boost::filesystem::path(descriptor.plugin_root), state);
-
-    std::vector<std::string> missing;
-    for (const std::string& entry : requested) {
-        if (!network_permission_matches(state.permissions.network_http, entry) &&
-            !network_permission_matches(state.permissions.network_socket, entry))
-            missing.push_back(entry);
-    }
-    if (missing.empty())
-        return true;
-
-    wxString requested_hosts;
-    for (const std::string& entry : missing)
-        requested_hosts += wxString::FromUTF8(entry.c_str()) + "\n";
-
-    if (!ask_permission(wxString::Format(_L("Plugin \"%s\" requests network access to:\n%s"),
-                                        wxString::FromUTF8(descriptor.name.c_str()), requested_hosts)))
-        return false;
-
-    seed_install_metadata(state, descriptor);
-
-    // A declared host is reachable through both HTTP and raw socket events. Recording the grant in
-    // both existing lists keeps the sidecar self-describing and means either event layer matches
-    // it without relying on the other list.
-    for (const std::string& entry : missing) {
-        if (std::find(state.permissions.network_http.begin(), state.permissions.network_http.end(), entry) ==
-            state.permissions.network_http.end())
-            state.permissions.network_http.push_back(entry);
-        if (std::find(state.permissions.network_socket.begin(), state.permissions.network_socket.end(), entry) ==
-            state.permissions.network_socket.end())
-            state.permissions.network_socket.push_back(entry);
-    }
-
-    return write_install_state(boost::filesystem::path(descriptor.plugin_root), state);
-}
-
 void PluginAuditManager::report_violation(const AuditViolation& violation)
 {
    m_last_violation     = violation;
@@ -875,39 +653,6 @@ PyObject* tuple_item(PyObject* args, Py_ssize_t index)
    return PyTuple_GET_ITEM(args, index);
 }

-std::string python_unicode(PyObject* object)
-{
-    if (!object || !PyUnicode_Check(object))
-        return {};
-    const char* text = PyUnicode_AsUTF8(object);
-    if (!text) {
-        PyErr_Clear();
-        return {};
-    }
-    return text;
-}
-
-// Converts a str/bytes leaf to text, clearing a failed conversion. Returns false when `object` is
-// neither str nor bytes, so callers can apply their own fallback.
-bool python_text(PyObject* object, std::string& out)
-{
-    if (PyUnicode_Check(object)) {
-        out = python_unicode(object);
-        return true;
-    }
-    if (PyBytes_Check(object)) {
-        const char* value = PyBytes_AsString(object);
-        if (!value) {
-            PyErr_Clear();
-            out.clear();
-            return true;
-        }
-        out = value;
-        return true;
-    }
-    return false;
-}
-
 std::string python_path(PyObject* object)
 {
    if (!object)
@@ -919,12 +664,26 @@ std::string python_path(PyObject* object)
        return {};
    }

-    std::string result;
-    python_text(path_object, result);
+    const char* path = PyUnicode_Check(path_object) ? PyUnicode_AsUTF8(path_object) : PyBytes_AsString(path_object);
+    std::string result = path ? path : "";
    Py_DECREF(path_object);
+    if (!path)
+        PyErr_Clear();
    return result;
 }

+std::string python_unicode(PyObject* object)
+{
+    if (!object || !PyUnicode_Check(object))
+        return {};
+    const char* text = PyUnicode_AsUTF8(object);
+    if (!text) {
+        PyErr_Clear();
+        return {};
+    }
+    return text;
+}
+
 std::string python_str(PyObject* object)
 {
    if (!object)
@@ -1143,20 +902,6 @@ bool has_permission(const std::vector<std::string>& granted, const std::string&
    return std::find(granted.begin(), granted.end(), target) != granted.end();
 }

-// A declared or previously approved network grant may live in either network list: an HTTP grant
-// covers the sockets the same request opens, and a raw socket grant covers a later HTTP call to
-// the same host.
-bool has_network_permission(const PluginPermissions& permissions, const std::string& target)
-{
-    return PluginAuditManager::network_permission_matches(permissions.network_http, target) ||
-           PluginAuditManager::network_permission_matches(permissions.network_socket, target);
-}
-
-bool has_any_network_permission(const PluginPermissions& permissions)
-{
-    return !permissions.network_http.empty() || !permissions.network_socket.empty();
-}
-
 bool persist_permission(const std::string&        plugin_key,
                        PluginInstallState&       state,
                        std::vector<std::string>& permission_list,
@@ -1166,7 +911,15 @@ bool persist_permission(const std::string&        plugin_key,
    if (!PluginManager::instance().try_get_plugin_descriptor(plugin_key, descriptor) || descriptor.plugin_root.empty())
        return false;

-    seed_install_metadata(state, descriptor);
+    // A sandbox plugin may not have a sidecar yet.  Seed the small amount of install metadata
+    // needed by the writer so clicking Yes still creates the JSON file.
+    if (state.plugin_name.empty()) {
+        state.installed_from    = descriptor.is_cloud_plugin() ? "cloud" : "local";
+        state.installed_version = !descriptor.installed_version.empty() ? descriptor.installed_version : descriptor.version;
+        state.plugin_name       = descriptor.name;
+        state.cloud_uuid        = descriptor.cloud_uuid();
+        state.enabled            = true;
+    }

    if (!has_permission(permission_list, target))
        permission_list.push_back(target);
@@ -1245,10 +998,11 @@ bool prompt_for_targets(AuditEventCategory category, const std::string& plugin_n
    for (const auto& target : unresolved)
        target_list += wxString::FromUTF8(target.c_str()) + "\n";

-    return show_permission_dialog(
-        audit_message(category, wxString::FromUTF8(plugin_name.c_str()), wxString::FromUTF8(event_name.c_str()),
-                      target_list, unresolved.size()),
-        _L("Plugin permission request"));
+    wxMessageDialog dialog(nullptr,
+                           audit_message(category, wxString::FromUTF8(plugin_name.c_str()),
+                                        wxString::FromUTF8(event_name.c_str()), target_list, unresolved.size()),
+                           _L("Plugin permission request"), wxYES_NO | wxICON_WARNING);
+    return dialog.ShowModal() == wxID_YES;
 }

 // Records a grant in the plugin's sidecar so it is not asked again. Reads the install state
@@ -1269,6 +1023,22 @@ void persist_grant(const std::string& plugin_key, AuditEventCategory category, b

 static PluginAuditManager::PermissionPrompt s_permission_prompt_for_testing;

+static const char* audit_category_name(AuditEventCategory category)
+{
+    switch (category) {
+    case AuditEventCategory::FsRead: return "FsRead";
+    case AuditEventCategory::FsReadWrite: return "FsReadWrite";
+    case AuditEventCategory::FsCreate: return "FsCreate";
+    case AuditEventCategory::FsDelete: return "FsDelete";
+    case AuditEventCategory::Http: return "Http";
+    case AuditEventCategory::Socket: return "Socket";
+    case AuditEventCategory::ProcessCreate: return "ProcessCreate";
+    case AuditEventCategory::ProcessReplace: return "ProcessReplace";
+    case AuditEventCategory::Threading: return "Threading";
+    default: return "None";
+    }
+}
+
 // Asks the user to grant an audited event, returning true when they approve an inline prompt.
 // `keys` are what a Yes saves: the unresolved targets, or the event-grant key when the event has
 // no target (by_event), which the prompt does not show as a target.
@@ -1286,6 +1056,16 @@ bool request_permission(AuditEventCategory category, const std::string& plugin_k
                        const std::string& event_name, bool by_event, const std::vector<std::string>& keys)
 {
    const std::vector<std::string> shown = by_event ? std::vector<std::string>{} : keys;
+    std::string targets_text = by_event ? "<none>" : "";
+    for (const auto& target : shown) {
+        if (!targets_text.empty())
+            targets_text += ", ";
+        targets_text += target;
+    }
+
+    BOOST_LOG_TRIVIAL(info) << "[AUDIT PROMPT] plugin=" << plugin_key << " event=" << event_name
+                            << " category=" << audit_category_name(category) << " targets=[" << targets_text << "]"
+                            << (by_event && !keys.empty() ? " grant=" + keys.front() : std::string{});

    if (s_permission_prompt_for_testing)
        return s_permission_prompt_for_testing(event_name, shown);
@@ -1320,13 +1100,10 @@ int decide_audited_event(PluginAuditManager&             mgr,
    std::vector<std::string>*      permission_list = permission_list_for(category, by_event, state.permissions);

    std::vector<std::string> unresolved = keys;
-    if (permission_list || is_network_category(category)) {
+    if (permission_list) {
        unresolved.clear();
        for (const auto& key : keys)
-            if (!(permission_list && has_permission(*permission_list, key)) &&
-                !(is_network_category(category) &&
-                  (by_event ? has_any_network_permission(state.permissions)
-                            : has_network_permission(state.permissions, key))))
+            if (!has_permission(*permission_list, key))
                unresolved.push_back(key);
        if (unresolved.empty())
            return 0;
@@ -1455,6 +1232,18 @@ bool PluginAuditManager::is_stdlib_file(const std::string& filename)
    return it->second;
 }

+bool PluginAuditManager::is_stdlib_path(const boost::filesystem::path& path)
+{
+    if (path.empty())
+        return false;
+
+    const auto inside_any = [&path](const std::vector<boost::filesystem::path>& dirs) {
+        return std::any_of(dirs.begin(), dirs.end(),
+                           [&path](const boost::filesystem::path& dir) { return is_inside_allowed_root(path, dir); });
+    };
+    return inside_any(PluginAuditDetail::s_stdlib_dirs) && !inside_any(PluginAuditDetail::s_site_package_dirs);
+}
+
 void PluginAuditManager::release_frames(std::vector<PyObject*>& frames)
 {
    if (frames.empty())
@@ -1523,7 +1312,7 @@ int PluginAuditManager::audit_hook(const char* event, PyObject* args, void* user

 void PluginAuditManager::install_hook()
 {
-    // Tells the stdlib's own frames apart, for the operation-root frames (see record_root_frame).
+    // Identifies stdlib frames for operation roots and stdlib paths for read-only access.
    PluginAuditDetail::collect_stdlib_dirs();

    // data_dir() is the primary globally-allowed root during plugin execution: read+write. It
@@ -1540,8 +1329,9 @@ void PluginAuditManager::install_hook()
    // "cert" denied-path keyword seeded below.
    add_global_allowed_root(resources_dir(), /*allow_write=*/false);

-    // The user's app config and cloud credentials live directly inside data_dir(), so the
-    // root just granted would otherwise expose them to any plugin.  Deny them by name.
+    // The user's app config and cloud credentials live directly inside data_dir(), and plugin
+    // install state lives beneath it, so the root just granted would otherwise expose them to
+    // plugins. Deny them by name.
    //
    // Seeded here rather than by each secret's owner because install_hook() runs during lazy
    // interpreter init and therefore provably precedes any plugin bytecode, whereas
@@ -137,29 +137,6 @@ public:
    bool request_filesystem_read_permissions(const std::string& plugin_key,
                                             const std::vector<std::string>& paths);

-    // Ask the user to grant network access to the given http(s) URLs. Each URL is reduced to its
-    // scheme and host before prompting and persisting, so one approval covers every path, query
-    // and port on that host. The grant is written to both network_http and network_socket: the
-    // same declared host can surface through HTTP events (urllib/http.client) and raw socket
-    // events. Like request_filesystem_read_permissions, the request may originate on a plugin
-    // load worker; denial aborts the plugin load without adding a permission.
-    bool request_network_permissions(const std::string& plugin_key,
-                                     const std::vector<std::string>& urls);
-
-    // Canonical scheme://host form used to store and match network permissions. Returns an empty
-    // string unless `url` is an absolute http(s) URL with a host. The path, query, fragment,
-    // userinfo and port are discarded; scheme and host are lowercased.
-    static std::string normalize_network_url(const std::string& url);
-
-    // True when a granted scheme://host entry covers `target`. `target` is a URL (urllib.Request),
-    // a bare host (http.client.connect, socket.getaddrinfo) or an address as exposed by the audit
-    // event (a hostname, a host:port pair, or a legacy persisted tuple such as "('host', 443)").
-    // URL targets must match both scheme and host. Canonical scheme://host grants cover all paths;
-    // older full-URL grants remain exact. A bare host carries no scheme, so it matches the host
-    // part of any grant; it never matches a different host.
-    static bool network_permission_matches(const std::vector<std::string>& granted,
-                                           const std::string& target);
-
    void report_violation(const AuditViolation& violation);
    bool audit_denial_pending() const;
    void clear_audit_denial();
@@ -196,6 +173,11 @@ private:

    static int audit_hook(const char* event, PyObject* args, void* user_data);

+    // True for paths inside the interpreter's stdlib, excluding site-packages. Unlike
+    // is_stdlib_file(), this query is not cached because filesystem paths may resolve through
+    // symlinks that can change.
+    static bool is_stdlib_path(const boost::filesystem::path& path);
+
    // Drops the references in `frames`, keeping the caller's error and denial state intact.
    void release_frames(std::vector<PyObject*>& frames);

@@ -210,7 +192,6 @@ private:

    // mutable: is_denied_filename() is a const query that must lock.
    mutable std::mutex m_mutex;
-
    std::vector<AllowedRoot>             m_global_allowed_roots;
    std::vector<std::string>             m_denied_filenames;
    std::vector<std::string>             m_denied_path_keywords;
@@ -833,29 +833,6 @@ bool read_install_state(const boost::filesystem::path& plugin_dir, PluginInstall
    }
 }

-namespace {
-
-// The single descriptor -> sidecar metadata mapping. Prefer installed_version (fetched at install
-// time and preserved across rewrites) over a possibly stale manifest version.
-void apply_install_metadata(PluginInstallState& state, const PluginDescriptor& entry)
-{
-    state.installed_from    = entry.is_cloud_plugin() ? "cloud" : "local";
-    state.installed_version = !entry.installed_version.empty() ? entry.installed_version : entry.version;
-    state.plugin_name       = entry.name;
-    state.cloud_uuid        = entry.cloud_uuid();
-}
-
-} // namespace
-
-void seed_install_metadata(PluginInstallState& state, const PluginDescriptor& entry)
-{
-    if (!state.plugin_name.empty())
-        return;
-
-    apply_install_metadata(state, entry);
-    state.enabled = true;
-}
-
 bool write_install_state(const boost::filesystem::path& plugin_dir, const PluginInstallState& state)
 {
    namespace fs                = boost::filesystem;
@@ -899,9 +876,16 @@ bool write_install_state(const boost::filesystem::path& plugin_dir, const Plugin
    // Loading a plugin updates its lifecycle/capability state, but must retain permissions granted
    // during register_capabilities() or by a previous runtime audit prompt.
    read_install_state(plugin_dir, state);
-    apply_install_metadata(state, entry);
-    state.enabled      = enabled;
-    state.capabilities = capabilities;
+    state.installed_from    = entry.is_cloud_plugin() ? "cloud" : "local";
+    // Prefer the descriptor's recorded installed_version (the version fetched from the cloud
+    // at install time, preserved across sidecar re-writes) so a stale manifest/PEP723 header
+    // never overwrites the source-of-truth version. Fall back to the manifest version for
+    // first-time/local installs where installed_version is not yet populated.
+    state.installed_version = !entry.installed_version.empty() ? entry.installed_version : entry.version;
+    state.plugin_name       = entry.name;
+    state.cloud_uuid        = entry.cloud_uuid();
+    state.enabled           = enabled;
+    state.capabilities      = capabilities;
    return write_install_state(plugin_dir, state);
 }

@@ -912,7 +896,11 @@ bool write_install_state(const boost::filesystem::path& plugin_dir, const Plugin
    // permissions on a fresh install/reinstall. PluginManager writes the real per-capability flags
    // while preserving permissions once the package is loaded, via the overload above.
    PluginInstallState state;
-    seed_install_metadata(state, entry);
+    state.installed_from    = entry.is_cloud_plugin() ? "cloud" : "local";
+    state.installed_version = !entry.installed_version.empty() ? entry.installed_version : entry.version;
+    state.plugin_name       = entry.name;
+    state.cloud_uuid        = entry.cloud_uuid();
+    state.enabled           = true;
    return write_install_state(plugin_dir, state);
 }

@@ -186,19 +186,12 @@ std::vector<std::string> collect_resource_texture_files(const std::string& dir,

 // Canonical writer: emits the .install_state.json schema for the given state.
 bool write_install_state(const boost::filesystem::path& plugin_dir, const PluginInstallState& state);
-
 // Builds a PluginInstallState from the descriptor and delegates to the canonical writer.
 bool write_install_state(const boost::filesystem::path& plugin_dir, const PluginDescriptor& entry, bool enabled,
                         const std::vector<std::pair<std::string, bool>>& capabilities);
 // Convenience overload: write(dir, entry, /*enabled=*/true, /*capabilities=*/{}).
 bool write_install_state(const boost::filesystem::path& plugin_dir, const PluginDescriptor& entry);

-// Fill the descriptor-derived install metadata into a sidecar state that does not describe an
-// installed plugin yet, and mark it enabled. Leaves permissions and capabilities untouched.
-// Single source for the metadata mapping used by the install writer and by the audit prompt path
-// that creates a sidecar on demand.
-void seed_install_metadata(PluginInstallState& state, const PluginDescriptor& entry);
-
 // Reads install state back into the descriptor; plugin_key is always derived. Returns whether the
 // sidecar was present and valid.
 bool read_install_state(const boost::filesystem::path& plugin_dir, PluginDescriptor& entry);
@@ -1180,8 +1180,12 @@ void PluginManager::mark_plugin_install_state_disabled(const std::string& plugin

    const boost::filesystem::path root(descriptor.plugin_root);
    PluginInstallState state;
-    if (!read_install_state(root, state))
-        seed_install_metadata(state, descriptor);
+    if (!read_install_state(root, state)) {
+        state.installed_from    = descriptor.is_cloud_plugin() ? "cloud" : "local";
+        state.installed_version = !descriptor.installed_version.empty() ? descriptor.installed_version : descriptor.version;
+        state.plugin_name       = descriptor.name;
+        state.cloud_uuid        = descriptor.cloud_uuid();
+    }
    state.enabled = false;
    if (!write_install_state(root, state))
        return;
@@ -50,7 +50,6 @@ std::mutex g_registry_mutex;
 std::unordered_map<std::string, std::vector<py::object>> g_pending_capabilities;
 std::unordered_map<std::string, py::object> g_pending_package;
 std::unordered_map<std::string, std::vector<std::string>> g_pending_fs_read_permissions;
-std::unordered_map<std::string, std::vector<std::string>> g_pending_network_permissions;
 struct PluginInstanceHandle
 {
    // The C++ plugin interface points into a Python object. Keep both alive through one
@@ -90,7 +89,6 @@ void discard_pending_capture_without_python(const std::string& plugin_key)
    }

    g_pending_fs_read_permissions.erase(plugin_key);
-    g_pending_network_permissions.erase(plugin_key);
 }

 } // namespace
@@ -116,7 +114,6 @@ void PythonPluginBridge::begin_plugin_capture(const std::string& plugin_key)
        g_pending_capabilities.erase(plugin_key);
        g_pending_package.erase(plugin_key);
        g_pending_fs_read_permissions.erase(plugin_key);
-        g_pending_network_permissions.erase(plugin_key);
    }
    // From now until finalize/cancel, @orca.plugin and register_capability() calls made by
    // Python code on this thread are attributed to this plugin.
@@ -148,7 +145,6 @@ std::vector<CapturedCapability> PythonPluginBridge::finalize_plugin_capture(cons
            g_pending_capabilities.erase(capture_key);
            g_pending_package.erase(capture_key);
            g_pending_fs_read_permissions.erase(capture_key);
-            g_pending_network_permissions.erase(capture_key);
        };

        try {
@@ -204,30 +200,6 @@ std::vector<CapturedCapability> PythonPluginBridge::finalize_plugin_capture(cons
                    return {};
                }
            }
-
-            std::vector<std::string> network_permissions;
-            {
-                std::lock_guard<std::mutex> lock(g_registry_mutex);
-                auto it = g_pending_network_permissions.find(capture_key);
-                if (it != g_pending_network_permissions.end()) {
-                    network_permissions = std::move(it->second);
-                    g_pending_network_permissions.erase(it);
-                }
-            }
-            if (!network_permissions.empty()) {
-                bool granted = false;
-                {
-                    py::gil_scoped_release release;
-                    granted = PluginAuditManager::instance().request_network_permissions(plugin_key, network_permissions);
-                }
-                if (!granted) {
-                    error = _u8L("Plugin network permission request denied");
-                    BOOST_LOG_TRIVIAL(warning) << error << " for key " << plugin_key;
-                    discard_pending_for_key();
-                    clear_active_key();
-                    return {};
-                }
-            }
        } catch (py::error_already_set& err) {
            log_python_exception_keep(err);
            error = err.what();
@@ -351,7 +323,6 @@ void PythonPluginBridge::cancel_plugin_capture(const std::string& plugin_key)
        g_pending_capabilities.erase(plugin_key);
        g_pending_package.erase(plugin_key);
        g_pending_fs_read_permissions.erase(plugin_key);
-        g_pending_network_permissions.erase(plugin_key);
    }

    if (g_active_plugin_key == plugin_key)
@@ -379,7 +350,6 @@ void PythonPluginBridge::clear_pending_captures()
        }
        g_pending_package.clear();
        g_pending_fs_read_permissions.clear();
-        g_pending_network_permissions.clear();
        g_active_plugin_key.clear();
        return;
    }
@@ -389,7 +359,6 @@ void PythonPluginBridge::clear_pending_captures()
    g_pending_capabilities.clear();
    g_pending_package.clear();
    g_pending_fs_read_permissions.clear();
-    g_pending_network_permissions.clear();
    g_active_plugin_key.clear();
 }

@@ -589,50 +558,24 @@ void bind_python_api(pybind11::module_& m)

    m.def(
        "request_permissions",
-        [](const std::vector<std::string>& fs_read, const std::vector<std::string>& network) {
+        [](const std::vector<std::string>& fs_read) {
            if (g_active_plugin_key.empty())
                throw py::value_error("request_permissions() called outside plugin discovery context");

-            // Validate and canonicalize everything before touching the pending registry, so a
-            // partially invalid call cannot leave a half-recorded request behind.
-            std::vector<std::string> normalized_network;
-            normalized_network.reserve(network.size());
-            for (const std::string& url : network) {
-                const std::string normalized = PluginAuditManager::normalize_network_url(url);
-                if (normalized.empty())
-                    throw py::value_error(
-                        "request_permissions(network=...) requires an http:// or https:// URL with a host");
-                if (std::find(normalized_network.begin(), normalized_network.end(), normalized) == normalized_network.end())
-                    normalized_network.push_back(normalized);
-            }
-
+            std::lock_guard<std::mutex> lock(g_registry_mutex);
+            auto& requested = g_pending_fs_read_permissions[g_active_plugin_key];
            for (const std::string& path : fs_read) {
                if (path.empty())
                    throw py::value_error("request_permissions(fs_read=...) does not accept empty paths");
-            }
-
-            std::lock_guard<std::mutex> lock(g_registry_mutex);
-            auto& requested_fs = g_pending_fs_read_permissions[g_active_plugin_key];
-            for (const std::string& path : fs_read) {
-                if (std::find(requested_fs.begin(), requested_fs.end(), path) == requested_fs.end())
-                    requested_fs.push_back(path);
-            }
-
-            if (!normalized_network.empty()) {
-                auto& requested_network = g_pending_network_permissions[g_active_plugin_key];
-                for (const std::string& entry : normalized_network) {
-                    if (std::find(requested_network.begin(), requested_network.end(), entry) == requested_network.end())
-                        requested_network.push_back(entry);
-                }
+                if (std::find(requested.begin(), requested.end(), path) == requested.end())
+                    requested.push_back(path);
            }
        },
-        py::arg("fs_read") = std::vector<std::string>{}, py::arg("network") = std::vector<std::string>{},
-        R"pbdoc(Request permissions while OrcaSlicer loads your module.
+        py::arg("fs_read") = std::vector<std::string>{},
+        R"pbdoc(Request filesystem read permissions while OrcaSlicer loads your module.

-`fs_read` lists filesystem paths to read. `network` lists http(s) URLs; each is reduced to its
-scheme and host, so one grant covers every path, query and port on that host. The host presents
-the requests to the user after register_capabilities() returns. Denying a request aborts the
-plugin load.)pbdoc");
+The host presents the request to the user after register_capabilities() returns. Denying the
+request aborts the plugin load.)pbdoc");

    m.def("plugin", [](py::object cls) {
        if (g_active_plugin_key.empty())
@@ -69,7 +69,7 @@ void seed_denied_keywords()

 } // namespace

-TEST_CASE("Plugin audit denies app config and token filenames anywhere", "[audit]")
+TEST_CASE("Plugin audit denies host-managed filenames anywhere", "[audit]")
 {
    seed_denied_names();
    const PluginAuditManager& mgr = PluginAuditManager::instance();
@@ -81,6 +81,7 @@ TEST_CASE("Plugin audit denies app config and token filenames anywhere", "[audit
        CHECK(mgr.is_denied_filename(fs::path(SLIC3R_APP_KEY ".ini")));
        CHECK(mgr.is_denied_filename(fs::path(GCODEVIEWER_APP_KEY ".ini")));
        CHECK(mgr.is_denied_filename(fs::path(secret_constants::USER_SECRET_FILENAME)));
+        CHECK(mgr.is_denied_filename(fs::path(".install_state.json")));
    }

    SECTION("companions holding the same secrets are denied by the prefix rule")
@@ -136,6 +137,7 @@ TEST_CASE("Plugin audit deny beats allowed roots", "[audit]")

    const fs::path conf  = fs::path(data_dir()) / (SLIC3R_APP_KEY ".conf");
    const fs::path token = fs::path(data_dir()) / secret_constants::USER_SECRET_FILENAME;
+    const fs::path install_state = fs::path(data_dir()) / "plugins" / "example" / ".install_state.json";

    SECTION("a non-denied file inside the allowed root is writable (root really grants writes)")
    {
@@ -176,6 +178,17 @@ TEST_CASE("Plugin audit deny beats allowed roots", "[audit]")
        CHECK_FALSE(decision.allowed);
    }

+    SECTION("plugin install state is blocked for reads and writes despite the allowed root")
+    {
+        AuditDecision read_decision = mgr.check_open(install_state.string(), "r");
+        CHECK_FALSE(read_decision.allowed);
+        CHECK(read_decision.reason == "denied filename");
+
+        AuditDecision write_decision = mgr.check_open(install_state.string(), "w");
+        CHECK_FALSE(write_decision.allowed);
+        CHECK(write_decision.reason == "denied filename");
+    }
+
    SECTION("a traversal path resolving to the config is blocked")
    {
        const fs::path traversal = fs::path(data_dir()) / "plugins" / ".." / (SLIC3R_APP_KEY ".conf");
@@ -351,93 +364,6 @@ TEST_CASE("Plugin audit a read-only allowed root blocks writes but not reads", "
    }
 }

-TEST_CASE("Plugin audit network permissions match by scheme and host", "[audit]")
-{
-    SECTION("a URL is reduced to its scheme and host")
-    {
-        CHECK(PluginAuditManager::normalize_network_url("https://API.Example.com:8443/v1/items?page=2#top") ==
-              "https://api.example.com");
-        CHECK(PluginAuditManager::normalize_network_url("http://example.com") == "http://example.com");
-        CHECK(PluginAuditManager::normalize_network_url("https://[2001:db8::1]:443/path") == "https://[2001:db8::1]");
-    }
-
-    SECTION("non-http schemes and targets without a scheme are not network URLs")
-    {
-        CHECK(PluginAuditManager::normalize_network_url("ftp://example.com").empty());
-        CHECK(PluginAuditManager::normalize_network_url("api.example.com").empty());
-        CHECK(PluginAuditManager::normalize_network_url("https://").empty());
-    }
-
-    SECTION("a URL target matches the same scheme and host regardless of path and port")
-    {
-        const std::vector<std::string> granted{"https://api.example.com"};
-        CHECK(PluginAuditManager::network_permission_matches(granted, "https://api.example.com/v1/items?page=2"));
-        CHECK(PluginAuditManager::network_permission_matches(granted, "https://api.example.com:8443/upload"));
-    }
-
-    SECTION("canonical host grants are broad but persisted full-URL grants stay exact")
-    {
-        const std::vector<std::string> declared_host{"https://api.example.com"};
-        CHECK(PluginAuditManager::network_permission_matches(declared_host, "https://api.example.com/v1"));
-
-        const std::vector<std::string> saved_url{"https://api.example.com/v1"};
-        CHECK(PluginAuditManager::network_permission_matches(saved_url, "https://api.example.com/v1"));
-        CHECK_FALSE(PluginAuditManager::network_permission_matches(saved_url, "https://api.example.com/v2"));
-    }
-
-    SECTION("a URL target does not match a different host or a different scheme")
-    {
-        const std::vector<std::string> granted{"https://api.example.com"};
-        CHECK_FALSE(PluginAuditManager::network_permission_matches(granted, "https://evil.example.com/v1"));
-        CHECK_FALSE(PluginAuditManager::network_permission_matches(granted, "http://api.example.com/v1"));
-    }
-
-    SECTION("a bare host target matches the host of a grant")
-    {
-        const std::vector<std::string> granted{"https://api.example.com"};
-        CHECK(PluginAuditManager::network_permission_matches(granted, "api.example.com"));
-        CHECK(PluginAuditManager::network_permission_matches(granted, "api.example.com:443"));
-        CHECK_FALSE(PluginAuditManager::network_permission_matches(granted, "other.example.com"));
-    }
-
-    SECTION("legacy persisted address tuples keep matching their host")
-    {
-        const std::vector<std::string> legacy_granted{"('api.example.com', 443)"};
-        CHECK(PluginAuditManager::network_permission_matches(legacy_granted, "api.example.com"));
-
-        const std::vector<std::string> granted{"https://api.example.com"};
-        CHECK(PluginAuditManager::network_permission_matches(granted, "('api.example.com', 443)"));
-        CHECK_FALSE(PluginAuditManager::network_permission_matches(granted, "('93.184.216.34', 443)"));
-    }
-
-    SECTION("an IPv6 literal matches across bracketed and bare forms")
-    {
-        const std::vector<std::string> granted{"https://[2001:db8::1]"};
-        CHECK(PluginAuditManager::network_permission_matches(granted, "2001:db8::1"));
-        CHECK(PluginAuditManager::network_permission_matches(granted, "[2001:db8::1]:443"));
-        CHECK_FALSE(PluginAuditManager::network_permission_matches(granted, "2001:db8::2"));
-    }
-
-    SECTION("a non-http URL only matches an exact grant")
-    {
-        const std::vector<std::string> granted{"ftp://example.com/file"};
-        CHECK(PluginAuditManager::network_permission_matches(granted, "ftp://example.com/file"));
-        CHECK_FALSE(PluginAuditManager::network_permission_matches(granted, "ftp://example.com/other"));
-
-        const std::vector<std::string> https{"https://api.example.com"};
-        CHECK_FALSE(PluginAuditManager::network_permission_matches(https, "ftp://api.example.com/file"));
-    }
-
-    SECTION("an empty grant list or an empty target never matches")
-    {
-        const std::vector<std::string> granted{};
-        CHECK_FALSE(PluginAuditManager::network_permission_matches(granted, "https://api.example.com"));
-
-        const std::vector<std::string> any{"https://api.example.com"};
-        CHECK_FALSE(PluginAuditManager::network_permission_matches(any, ""));
-    }
-}
-
 TEST_CASE("Plugin audit a scoped root can also be registered read-only", "[audit]")
 {
    ScopedDataDir data_dir_guard("plugin-audit-scoped-readonly");
@@ -1206,3 +1132,37 @@ TEST_CASE("Stdlib code is recognized through a symlinked Python home", "[audit][
    CHECK_FALSE(PluginAuditManager::is_stdlib_file((harness.outside.path() / "plugin.py").string()));
    CHECK_FALSE(PluginAuditManager::is_stdlib_file("<string>"));
 }
+
+TEST_CASE("A plugin may read the CPython stdlib without a prompt, but not site-packages or for writing", "[audit][Python]")
+{
+    AuditHarness harness;
+    if (!harness.initialized)
+        SKIP("Bundled Python interpreter unavailable: " + PythonInterpreter::instance().last_error());
+    harness.add_plugin(PLUGIN);
+    py::gil_scoped_acquire gil;
+    PythonSide python(harness);
+
+    const py::dict paths   = py::module_::import("sysconfig").attr("get_paths")();
+    const fs::path stdlib  = py::str(paths["stdlib"]).cast<std::string>();
+    const fs::path purelib = py::str(paths["purelib"]).cast<std::string>();
+    // os.py ships with every CPython installation. A site-packages path is third-party code even
+    // when the directory is empty: the prompt must come before the missing file is noticed.
+    const fs::path stdlib_file = stdlib / "os.py";
+    REQUIRE(fs::exists(stdlib_file));
+
+    python.globals["STDLIB_FILE"]       = stdlib_file.string();
+    python.globals["SITE_PACKAGE_FILE"] = (purelib / "regression_probe.py").string();
+    python.run_as(PLUGIN, R"PY(
+read_outcome = attempt(lambda: open(STDLIB_FILE).read())
+write_outcome = attempt(lambda: open(STDLIB_FILE, "r+").close())
+site_packages_outcome = attempt(lambda: open(SITE_PACKAGE_FILE).close())
+)PY");
+
+    CHECK(python.str("read_outcome") == "ok");
+    CHECK(python.str("write_outcome") == "denied");
+    CHECK(python.str("site_packages_outcome") == "denied");
+    // Only the write and the site-packages read are asked about; the stdlib read is implicit.
+    const std::string write_prompt         = "open: " + python.str("STDLIB_FILE") + "\n";
+    const std::string site_packages_prompt = "open: " + python.str("SITE_PACKAGE_FILE") + "\n";
+    CHECK(describe(harness.prompts) == write_prompt + site_packages_prompt);
+}