fix: lift audit while reporting errors to log files

src/slic3r/plugin/PluginAuditManager.cpp

@@ -7,8 +7,16 @@
 #include <boost/algorithm/string/predicate.hpp>
 #include <boost/log/trivial.hpp>
 
+#include <algorithm>
 #include <cstdlib>
+#include <future>
+#include <slic3r/GUI/BindDialog.hpp>
+#include <slic3r/GUI/GUI_App.hpp>
+#include <slic3r/plugin/PluginFsUtils.hpp>
+#include <slic3r/plugin/PluginManager.hpp>
 #include <utility>
+#include <wx/event.h>
+#include <wx/msgdlg.h>
 
 namespace Slic3r {
 
@@ -78,24 +86,21 @@ bool is_inside_allowed_root(const boost::filesystem::path& candidate, const boos
 // ScopedPluginAuditContext
 // ---------------------------------------------------------------------------
 
-thread_local std::string PluginAuditManager::m_current_plugin_key           = "";
-thread_local std::string PluginAuditManager::m_current_capability_name     = "";
-thread_local PluginAuditManager::AuditMode PluginAuditManager::m_audit_mode = PluginAuditManager::AuditMode::Loading;
+thread_local std::string PluginAuditManager::m_current_plugin_key = "";
+thread_local std::string PluginAuditManager::m_current_capability_name = "";
 thread_local std::vector<boost::filesystem::path> PluginAuditManager::m_scoped_allowed_roots;
+thread_local bool PluginAuditManager::m_audit_denial_pending = false;
 thread_local bool PluginAuditManager::m_has_last_violation = false;
 thread_local AuditViolation PluginAuditManager::m_last_violation;
 
 ScopedPluginAuditContext::ScopedPluginAuditContext(const std::string& plugin_key,
-                                                   const std::string& capability_name,
-                                                   PluginAuditManager::AuditMode mode)
+                                                   const std::string& capability_name)
     : m_previous_id(PluginAuditManager::instance().current_plugin())
     , m_previous_capability(PluginAuditManager::instance().current_capability())
-    , m_previous_mode(PluginAuditManager::instance().audit_mode())
     , m_previous_scoped_roots(PluginAuditManager::m_scoped_allowed_roots)
 {
     PluginAuditManager::instance().set_current_plugin(plugin_key);
     PluginAuditManager::instance().set_current_capability(capability_name);
-    PluginAuditManager::instance().set_audit_mode(mode);
     PluginAuditManager::m_scoped_allowed_roots.clear();
 }
 
@@ -103,7 +108,6 @@ ScopedPluginAuditContext::~ScopedPluginAuditContext()
 {
     PluginAuditManager::instance().set_current_plugin(m_previous_id);
     PluginAuditManager::instance().set_current_capability(m_previous_capability);
-    PluginAuditManager::instance().set_audit_mode(m_previous_mode);
     PluginAuditManager::m_scoped_allowed_roots = std::move(m_previous_scoped_roots);
 }
 
@@ -198,14 +202,6 @@ bool PluginAuditManager::is_denied_filename(const boost::filesystem::path& candi
     return false;
 }
 
-// ---------------------------------------------------------------------------
-// Audit mode
-// ---------------------------------------------------------------------------
-
-void PluginAuditManager::set_audit_mode(AuditMode mode) { m_audit_mode = mode; }
-
-PluginAuditManager::AuditMode PluginAuditManager::audit_mode() const { return m_audit_mode; }
-
 // ---------------------------------------------------------------------------
 // Policy checks
 // ---------------------------------------------------------------------------
@@ -219,21 +215,15 @@ AuditDecision PluginAuditManager::check_path_access(const boost::filesystem::pat
     if (plugin_key.empty())
         return {true, ""}; // not running inside a plugin context
 
-    // Denied filenames are checked first, above both the Loading exemption below and the
-    // allowed roots.  The app config and the cloud refresh token live directly inside
-    // data_dir(), which is a global allowed root, and no scope ever sets Enforcing — so a
-    // deny placed any lower would be unreachable for reads.
+    // Denied filenames are checked before the allowed roots.  The app config and the cloud
+    // refresh token live directly inside data_dir(), which is a global allowed root, so a deny
+    // placed any lower would be unreachable.
     if (is_denied_filename(path)) {
         BOOST_LOG_TRIVIAL(warning) << "[AUDIT] block path=" << path.string() << " is_write=" << is_write
                                    << " plugin=" << plugin_key << " reason=denied filename";
         return {false, "denied filename"};
     }
 
-    // During import/loading, only block writes.  Python must be able to read
-    // stdlib modules and the plugin file itself during import.
-    if (m_audit_mode == AuditMode::Loading && !is_write)
-        return {true, ""};
-
     namespace fs = boost::filesystem;
     fs::path candidate = path;
 
@@ -261,7 +251,6 @@ AuditDecision PluginAuditManager::check_path_access(const boost::filesystem::pat
     }
 
     BOOST_LOG_TRIVIAL(warning) << "[AUDIT] block path=" << candidate.string() << " is_write=" << is_write
-                               << " audit_mode=" << (m_audit_mode == AuditMode::Loading ? "Loading" : "Enforcing")
                                << " plugin=" << plugin_key;
     return {false, "outside allowed root"};
 }
@@ -269,19 +258,99 @@ AuditDecision PluginAuditManager::check_path_access(const boost::filesystem::pat
 AuditDecision PluginAuditManager::check_open(const std::string& path_str, const std::string& mode)
 {
     const bool is_write = mode.find('w') != std::string::npos || mode.find('a') != std::string::npos ||
-                          mode.find('+') != std::string::npos;
+                          mode.find('+') != std::string::npos || mode.find('x') != std::string::npos;
     return check_path_access(boost::filesystem::path(path_str), is_write);
 }
 
+bool PluginAuditManager::request_filesystem_read_permissions(const std::string&              plugin_key,
+                                                              const std::vector<std::string>& paths)
+{
+    if (plugin_key.empty() || paths.empty())
+        return true;
+
+    PluginDescriptor descriptor;
+    if (!PluginManager::instance().try_get_plugin_descriptor(plugin_key, descriptor) || descriptor.plugin_root.empty())
+        return false;
+
+    PluginInstallState state;
+    read_install_state(boost::filesystem::path(descriptor.plugin_root), state);
+
+    std::vector<std::string> missing;
+    for (const std::string& path : paths) {
+        if (std::find(state.permissions.fs_read.begin(), state.permissions.fs_read.end(), path) == state.permissions.fs_read.end())
+            missing.push_back(path);
+    }
+    if (missing.empty())
+        return true;
+
+    if (wxTheApp == nullptr || GUI::wxGetApp().is_closing())
+        return false;
+
+    auto show_dialog = [&descriptor, &missing]() {
+        wxString requested_paths;
+        for (const std::string& path : missing)
+            requested_paths += wxString::FromUTF8(path.c_str()) + "\n";
+
+        wxMessageDialog dialog(
+            nullptr,
+            wxString::Format("Plugin \"%s\" requests filesystem read access to:\n%s",
+                             wxString::FromUTF8(descriptor.name.c_str()), requested_paths),
+            "Plugin permissions",
+            wxYES_NO | wxICON_WARNING);
+        return dialog.ShowModal() == wxID_YES;
+    };
+
+    bool granted = false;
+    if (wxIsMainThread()) {
+        granted = show_dialog();
+    } else {
+        auto result = std::make_shared<std::promise<bool>>();
+        auto future = result->get_future();
+        GUI::wxGetApp().CallAfter([result, descriptor_name = descriptor.name, missing]() {
+            wxString requested_paths;
+            for (const std::string& path : missing)
+                requested_paths += wxString::FromUTF8(path.c_str()) + "\n";
+
+            wxMessageDialog dialog(
+                nullptr,
+                wxString::Format("Plugin \"%s\" requests filesystem read access to:\n%s",
+                                 wxString::FromUTF8(descriptor_name.c_str()), requested_paths),
+                "Plugin permissions",
+                wxYES_NO | wxICON_WARNING);
+            result->set_value(dialog.ShowModal() == wxID_YES);
+        });
+        granted = future.get();
+    }
+
+    if (!granted)
+        return false;
+
+    if (state.plugin_name.empty()) {
+        state.installed_from    = descriptor.is_cloud_plugin() ? "cloud" : "local";
+        state.installed_version = !descriptor.installed_version.empty() ? descriptor.installed_version : descriptor.version;
+        state.plugin_name       = descriptor.name;
+        state.cloud_uuid        = descriptor.cloud_uuid();
+        state.enabled            = true;
+    }
+
+    state.permissions.fs_read.insert(state.permissions.fs_read.end(), missing.begin(), missing.end());
+    return write_install_state(boost::filesystem::path(descriptor.plugin_root), state);
+}
+
 void PluginAuditManager::report_violation(const AuditViolation& violation)
 {
     m_last_violation     = violation;
     m_has_last_violation = true;
+    m_audit_denial_pending = true;
 
     BOOST_LOG_TRIVIAL(warning) << "[AUDIT BLOCKED] plugin=" << violation.plugin_key << " event=" << violation.event_name
                                << " path=" << violation.path.string() << " reason=" << violation.reason;
 }
 
+bool PluginAuditManager::audit_denial_pending() const { return m_audit_denial_pending; }
+
+void PluginAuditManager::clear_audit_denial() { m_audit_denial_pending = false; }
+
 void PluginAuditManager::clear_last_violation()
 {
     m_has_last_violation = false;
@@ -301,27 +370,106 @@ bool PluginAuditManager::last_violation(AuditViolation& violation) const
 // The C-level audit hook
 // ---------------------------------------------------------------------------
 
-namespace {
+namespace PluginAuditDetail {
 
-// Records a blocked event and raises PermissionError in the calling interpreter.  Returns -1
-// so an event branch can `return report_denied(...)` directly.
+PyObject* tuple_item(PyObject* args, Py_ssize_t index)
+{
+    if (!args || !PyTuple_Check(args) || index < 0 || index >= PyTuple_GET_SIZE(args))
+        return nullptr;
+    return PyTuple_GET_ITEM(args, index);
+}
+
+std::string python_path(PyObject* object)
+{
+    if (!object)
+        return {};
+
+    PyObject* path_object = PyOS_FSPath(object);
+    if (!path_object) {
+        PyErr_Clear();
+        return {};
+    }
+
+    const char* path = PyUnicode_Check(path_object) ? PyUnicode_AsUTF8(path_object) : PyBytes_AsString(path_object);
+    std::string result = path ? path : "";
+    Py_DECREF(path_object);
+    if (!path)
+        PyErr_Clear();
+    return result;
+}
+
+void add_filesystem_path(std::vector<boost::filesystem::path>& paths, PyObject* object)
+{
+    const std::string path = python_path(object);
+    if (!path.empty())
+        paths.emplace_back(path);
+}
+
+std::vector<boost::filesystem::path> filesystem_paths(const std::string& event_name, PyObject* args)
+{
+    std::vector<boost::filesystem::path> paths;
+
+    if (event_name == "open") {
+        add_filesystem_path(paths, tuple_item(args, 0));
+    } else if (event_name == "os.rename") {
+        add_filesystem_path(paths, tuple_item(args, 0));
+        add_filesystem_path(paths, tuple_item(args, 1));
+    } else if (event_name == "os.remove") {
+        add_filesystem_path(paths, tuple_item(args, 0));
+    }
+
+    return paths;
+}
+
+bool has_filesystem_permission(const PluginInstallState& state, const boost::filesystem::path& path)
+{
+    return std::find(state.permissions.fs_read.begin(), state.permissions.fs_read.end(), path.string()) !=
+           state.permissions.fs_read.end();
+}
+
+bool persist_filesystem_permission(const std::string& plugin_key,
+                                   PluginInstallState& state,
+                                   const boost::filesystem::path& path)
+{
+    PluginDescriptor descriptor;
+    if (!PluginManager::instance().try_get_plugin_descriptor(plugin_key, descriptor) || descriptor.plugin_root.empty())
+        return false;
+
+    // A sandbox plugin may not have a sidecar yet.  Seed the small amount of install metadata
+    // needed by the writer so clicking Yes still creates the JSON file.
+    if (state.plugin_name.empty()) {
+        state.installed_from    = descriptor.is_cloud_plugin() ? "cloud" : "local";
+        state.installed_version = !descriptor.installed_version.empty() ? descriptor.installed_version : descriptor.version;
+        state.plugin_name       = descriptor.name;
+        state.cloud_uuid        = descriptor.cloud_uuid();
+        state.enabled            = true;
+    }
+
+    const std::string path_string = path.string();
+    if (std::find(state.permissions.fs_read.begin(), state.permissions.fs_read.end(), path_string) ==
+        state.permissions.fs_read.end())
+        state.permissions.fs_read.push_back(path_string);
+    return write_install_state(boost::filesystem::path(descriptor.plugin_root), state);
+}
+
+// Records a blocked event and raises PermissionError in the calling interpreter.
 int report_denied(PluginAuditManager&            mgr,
                   const std::string&             event_name,
-                  const boost::filesystem::path& path,
+                  const boost::filesystem::path& target,
                   const AuditDecision&           decision)
 {
     AuditViolation violation;
     violation.plugin_key = mgr.current_plugin();
     violation.event_name = event_name;
-    violation.path       = path;
+    violation.path       = target;
     violation.reason     = decision.reason;
     mgr.report_violation(violation);
 
-    PyErr_SetString(PyExc_PermissionError, "Plugin attempted to access a blocked file path");
+    PyErr_SetString(PyExc_PermissionError, "Plugin attempted an audited operation without permission");
     return -1;
 }
 
-} // namespace
+} // namespace PluginAuditDetail
 
 int PluginAuditManager::audit_hook(const char* event, PyObject* args, void* user_data)
 {
@@ -336,73 +484,53 @@ int PluginAuditManager::audit_hook(const char* event, PyObject* args, void* user
         BOOST_LOG_TRIVIAL(debug) << "[AUDIT EVENT] " << event_name;
     }
 
-    // extensive list of audit events can be found at https://docs.python.org/3/library/audit_events.html
-
-    // --- open event ---
-    if (event_name == "open") {
-        const char* path_cstr = nullptr;
-        const char* mode_cstr = nullptr;
-        int flags             = 0;
-
-        // open(path, mode, flags) — path may be str, bytes, or int fd
-        if (!PyArg_ParseTuple(args, "s|si", &path_cstr, &mode_cstr, &flags)) {
-            PyErr_Clear(); // couldn't parse; allow
-            return 0;
-        }
-
-        std::string path_str(path_cstr ? path_cstr : "");
-        std::string mode_str(mode_cstr ? mode_cstr : "r");
-
-        AuditDecision decision = mgr->check_open(path_str, mode_str);
-        if (!decision.allowed)
-            return report_denied(*mgr, event_name, path_str, decision);
+    if (mgr->current_plugin().empty())
         return 0;
+
+    PluginInstallState state;
+    const bool have_install_state = PluginManager::instance().get_install_state(mgr->current_plugin(), state);
+    if (!have_install_state) {
+        BOOST_LOG_TRIVIAL(warning) << __FUNCTION__ << " Failed to get install state for " << mgr->current_plugin();
     }
 
-    // --- os.rename event (raised by os.rename and os.replace) ---
-    if (event_name == "os.rename") {
-        const char* src_cstr   = nullptr;
-        const char* dst_cstr   = nullptr;
-        PyObject*   src_dir_fd = nullptr;
-        PyObject*   dst_dir_fd = nullptr;
+    const std::string plugin_name = state.plugin_name.empty() ? mgr->current_plugin() : state.plugin_name;
+    const std::vector<boost::filesystem::path> paths = PluginAuditDetail::filesystem_paths(event_name, args);
+    for (const auto& path : paths) {
+        if (PluginAuditDetail::has_filesystem_permission(state, path))
+            continue;
 
-        // os.rename(src, dst, src_dir_fd, dst_dir_fd) — paths may be str, bytes, or int fd.
-        // The dir_fd arguments are unused, but must be accepted for the tuple to parse.
-        if (!PyArg_ParseTuple(args, "ss|OO", &src_cstr, &dst_cstr, &src_dir_fd, &dst_dir_fd)) {
-            PyErr_Clear(); // couldn't parse; allow
-            return 0;
-        }
+        wxMessageDialog dialog(
+            nullptr,
+            wxString::Format(_L("Plugin \"%s\" is requesting filesystem access to:\n%s"),
+                             wxString::FromUTF8(plugin_name.c_str()),
+                             wxString::FromUTF8(path.string().c_str())),
+            _L("Plugin permission request"),
+            wxYES_NO | wxICON_WARNING);
+        if (dialog.ShowModal() == wxID_YES &&
+            PluginAuditDetail::persist_filesystem_permission(mgr->current_plugin(), state, path))
+            continue;
 
-        // A rename writes at both ends, so either end being denied blocks the call.
-        for (const char* path_cstr : {src_cstr, dst_cstr}) {
-            std::string   path_str(path_cstr ? path_cstr : "");
-            AuditDecision decision = mgr->check_path_access(path_str, /* is_write */ true);
-            if (!decision.allowed)
-                return report_denied(*mgr, event_name, path_str, decision);
-        }
-        return 0;
+        return PluginAuditDetail::report_denied(
+            *mgr, event_name, path, {false, "filesystem permission required"});
     }
 
-    // --- os.remove event (raised by os.remove and os.unlink) ---
-    if (event_name == "os.remove") {
-        const char* path_cstr = nullptr;
-        PyObject*   dir_fd    = nullptr;
-
-        // os.remove(path, dir_fd) — path may be str, bytes, or int fd
-        if (!PyArg_ParseTuple(args, "s|O", &path_cstr, &dir_fd)) {
-            PyErr_Clear(); // couldn't parse; allow
-            return 0;
-        }
-
-        std::string   path_str(path_cstr ? path_cstr : "");
-        AuditDecision decision = mgr->check_path_access(path_str, /* is_write */ true);
-        if (!decision.allowed)
-            return report_denied(*mgr, event_name, path_str, decision);
+    if (!paths.empty())
         return 0;
-    }
 
-    // Unknown event — allow by default
-    return 0;
+    wxMessageDialog dialog(
+        nullptr,
+        wxString::Format(
+            _L("Plugin \"%s\" is requesting permission for the Python audit event \"%s\".\n\n"
+                "This operation does not expose a filesystem path to the audit hook."),
+            wxString::FromUTF8(plugin_name.c_str()),
+            wxString::FromUTF8(event_name.c_str())),
+        _L("Plugin permission request"),
+        wxYES_NO | wxICON_WARNING);
+    if (dialog.ShowModal() == wxID_YES)
+        return 0;
+
+    return PluginAuditDetail::report_denied(
+        *mgr, event_name, boost::filesystem::path(), {false, "audit permission required"});
 }
 
 void PluginAuditManager::install_hook()
@@ -413,10 +541,10 @@ void PluginAuditManager::install_hook()
     }
     BOOST_LOG_TRIVIAL(info) << "[AUDIT] CPython audit hook installed successfully";
 
-    // data_dir() is the only globally-allowed root during enforced plugin execution.
+    // data_dir() is the only globally-allowed root during plugin execution.
     // The executable directory and resources directory are intentionally NOT allowed
-    // here: plugins must not write outside data_dir() (G-code plugins additionally get
-    // the temp G-code folder via a scoped root). Reads remain permissive in Loading mode.
+    // here: plugins must not access outside data_dir() (G-code plugins additionally get
+    // the temp G-code folder via a scoped root).
     add_global_allowed_root(data_dir());
 
     // The user's app config and cloud credentials live directly inside data_dir(), so the

src/slic3r/plugin/PluginAuditManager.hpp

@@ -2,6 +2,7 @@
 #define slic3r_PluginAuditManager_hpp_
 
 #include <Python.h>
+#include <memory>
 #include <mutex>
 #include <string>
 #include <vector>
@@ -53,8 +54,8 @@ public:
     void add_scoped_allowed_root(const boost::filesystem::path& root);
 
     // --- denied-filenames registry ---
-    // Filenames a plugin may never touch, in any directory, regardless of audit mode or
-    // enclosing allowed root.  A candidate is denied when its filename starts with a
+    // Filenames a plugin may never touch, in any directory, regardless of the enclosing allowed
+    // root.  A candidate is denied when its filename starts with a
     // registered name, so .bak/.tmp companions are covered by the same entry.
     //
     // The comparison is case-insensitive on every platform, unlike the _WIN32-only iequals
@@ -73,30 +74,23 @@ public:
     // 8.3 short name is out of scope (see the design doc). This blocks direct access only.
     bool is_denied_filename(const boost::filesystem::path& candidate) const;
 
-    // --- enforcement mode ---
-    enum class AuditMode {
-        // Import/loading phase: allow reads anywhere, only block writes
-        // outside allowed roots.  Python needs to read stdlib modules
-        // during import and those are not inside plugin directories.
-        Loading,
-
-        // Execution phase: block both reads and writes outside allowed
-        // roots, plus subprocess/socket/ctypes.
-        Enforcing,
-    };
-
-    void set_audit_mode(AuditMode mode);
-    AuditMode audit_mode() const;
-
     // --- policy checks ---
     // Shared core for every audited filesystem event.  The deny list is consulted above the
-    // Loading-mode read exemption and above the allowed roots, so a denied filename is
-    // blocked even though every scope currently runs in Loading and the files in question
-    // sit inside data_dir(), which is itself a global allowed root.
+    // allowed roots, so a denied filename is blocked even when the file sits inside data_dir(),
+    // which is itself a global allowed root.
     AuditDecision check_path_access(const boost::filesystem::path& candidate, bool is_write);
     AuditDecision check_open(const std::string& path, const std::string& mode);
 
+    // Ask the user to grant the requested filesystem-read paths. The request may originate on a
+    // plugin load worker, so the implementation marshals the modal dialog to the wx main thread.
+    // Returns true only when every missing path was granted and persisted; denial aborts the plugin
+    // load without adding a permission.
+    bool request_filesystem_read_permissions(const std::string& plugin_key,
+                                             const std::vector<std::string>& paths);
+
     void report_violation(const AuditViolation& violation);
+    bool audit_denial_pending() const;
+    void clear_audit_denial();
     void clear_last_violation();
     bool last_violation(AuditViolation& violation) const;
 
@@ -109,12 +103,12 @@ private:
 
     static int audit_hook(const char* event, PyObject* args, void* user_data);
 
-    static thread_local std::string  m_current_plugin_key;
-    static thread_local std::string  m_current_capability_name;
-    static thread_local AuditMode    m_audit_mode;
+    static thread_local std::string                   m_current_plugin_key;
+    static thread_local std::string                   m_current_capability_name;
     static thread_local std::vector<boost::filesystem::path> m_scoped_allowed_roots;
-    static thread_local bool         m_has_last_violation;
-    static thread_local AuditViolation m_last_violation;
+    static thread_local bool                           m_audit_denial_pending;
+    static thread_local bool                           m_has_last_violation;
+    static thread_local AuditViolation                 m_last_violation;
 
     // mutable: is_denied_filename() is a const query that must lock.
     mutable std::mutex m_mutex;
@@ -130,8 +124,7 @@ class ScopedPluginAuditContext
 public:
     explicit ScopedPluginAuditContext(
         const std::string&                   plugin_key,
-        const std::string&                   capability_name = {},
-        PluginAuditManager::AuditMode        mode = PluginAuditManager::AuditMode::Loading);
+        const std::string&                   capability_name = {});
 
     ~ScopedPluginAuditContext();
 
@@ -141,7 +134,6 @@ public:
 private:
     std::string                   m_previous_id;
     std::string                   m_previous_capability;
-    PluginAuditManager::AuditMode m_previous_mode;
     std::vector<boost::filesystem::path> m_previous_scoped_roots;
 };
 

src/slic3r/plugin/PluginFsUtils.cpp

@@ -785,6 +785,23 @@ bool read_install_state(const boost::filesystem::path& plugin_dir, PluginInstall
             parsed.plugin_name = state["plugin_name"].get<std::string>();
         if (state.contains("cloud_uuid") && state["cloud_uuid"].is_string())
             parsed.cloud_uuid = state["cloud_uuid"].get<std::string>();
+
+        if (state.contains("permissions") && state["permissions"].is_object()) {
+            const auto& permissions = state["permissions"];
+            if (permissions.contains("networking") && permissions["networking"].is_array())
+                for (const auto& host : permissions["networking"])
+                    if (host.is_string())
+                        parsed.permissions.networking.push_back(host.get<std::string>());
+            if (permissions.contains("fs_read") && permissions["fs_read"].is_array())
+                for (const auto& path : permissions["fs_read"])
+                    if (path.is_string())
+                        parsed.permissions.fs_read.push_back(path.get<std::string>());
+            if (permissions.contains("fs_write") && permissions["fs_write"].is_array())
+                for (const auto& path : permissions["fs_write"])
+                    if (path.is_string())
+                        parsed.permissions.fs_write.push_back(path.get<std::string>());
+        }
+
         if (state.contains("enabled") && state["enabled"].is_boolean())
             parsed.enabled = state["enabled"].get<bool>();
 
@@ -820,6 +837,12 @@ bool write_install_state(const boost::filesystem::path& plugin_dir, const Plugin
     if (!state.cloud_uuid.empty())
         json["cloud_uuid"] = state.cloud_uuid;
 
+    json["permissions"] = {
+        {"networking", state.permissions.networking},
+        {"fs_read", state.permissions.fs_read},
+        {"fs_write", state.permissions.fs_write},
+    };
+
     nlohmann::json capabilities = nlohmann::json::array();
     for (const auto& [name, enabled] : state.capabilities)
         capabilities.push_back(nlohmann::json{{name, enabled}});
@@ -837,6 +860,9 @@ bool write_install_state(const boost::filesystem::path& plugin_dir, const Plugin
                          const std::vector<std::pair<std::string, bool>>& capabilities)
 {
     PluginInstallState state;
+    // Loading a plugin updates its lifecycle/capability state, but must retain permissions granted
+    // during register_capabilities() or by a previous runtime audit prompt.
+    read_install_state(plugin_dir, state);
     state.installed_from    = entry.is_cloud_plugin() ? "cloud" : "local";
     // Prefer the descriptor's recorded installed_version (the version fetched from the cloud
     // at install time, preserved across sidecar re-writes) so a stale manifest/PEP723 header
@@ -853,10 +879,16 @@ bool write_install_state(const boost::filesystem::path& plugin_dir, const Plugin
 bool write_install_state(const boost::filesystem::path& plugin_dir, const PluginDescriptor& entry)
 {
     // Install-time writer: the package is not loaded, so its capabilities are not known yet and the
-    // sidecar is (re)initialized to "auto-load, nothing disabled". PluginManager writes the real
-    // per-capability flags once the package is loaded, via the (dir, entry, enabled, capabilities)
-    // overload.
-    return write_install_state(plugin_dir, entry, true, {});
+    // sidecar is (re)initialized to "auto-load, nothing disabled". This intentionally resets
+    // permissions on a fresh install/reinstall. PluginManager writes the real per-capability flags
+    // while preserving permissions once the package is loaded, via the overload above.
+    PluginInstallState state;
+    state.installed_from    = entry.is_cloud_plugin() ? "cloud" : "local";
+    state.installed_version = !entry.installed_version.empty() ? entry.installed_version : entry.version;
+    state.plugin_name       = entry.name;
+    state.cloud_uuid        = entry.cloud_uuid();
+    state.enabled           = true;
+    return write_install_state(plugin_dir, state);
 }
 
 bool read_python_plugin_metadata(const boost::filesystem::path& py_path, PluginDescriptor& descriptor, std::string& error)

src/slic3r/plugin/PluginFsUtils.hpp

@@ -81,11 +81,21 @@ inline nlohmann::json py_to_json(const pybind11::handle& o)
     return py::str(o).cast<std::string>(); // fallback: str()
 }
 
+struct PluginPermissions
+{
+    std::vector<std::string> networking;
+    std::vector<std::string> fs_read;
+    std::vector<std::string> fs_write;
+};
+
 struct PluginInstallState {
     std::string installed_from;      // "local" | "cloud"
     std::string installed_version;
     std::string plugin_name;
     std::string cloud_uuid;          // empty for local
+
+    PluginPermissions permissions;
+
     bool enabled = true;
     std::vector<std::pair<std::string, bool>> capabilities; // name -> enabled, ordered
 };

src/slic3r/plugin/PluginLoader.cpp

@@ -280,7 +280,7 @@ bool load(const PluginDescriptor&                          descriptor,
     // (while the active plugin key is set), then instantiates each registered capability and caches
     // its get_name(). Returns one entry per capability.
     std::string bridge_error;
-    auto        capabilities_found = bridge.finalize_plugin_capture(descriptor.entry_path, bridge_error);
+    auto        capabilities_found = bridge.finalize_plugin_capture(descriptor.entry_path, descriptor.plugin_key, bridge_error);
     if (!bridge_error.empty()) {
         capabilities_found.clear();
         error = "Plugin registration failed: " + bridge_error;

src/slic3r/plugin/PluginManager.cpp

@@ -21,6 +21,7 @@
 #include <chrono>
 #include <mutex>
 #include <slic3r/plugin/PluginConfig.hpp>
+#include <slic3r/plugin/PluginDescriptor.hpp>
 #include <slic3r/plugin/PluginLoader.hpp>
 #include <slic3r/plugin/PythonPluginInterface.hpp>
 #include <slic3r/plugin/pluginTypes/script/ScriptPluginCapability.hpp>
@@ -554,6 +555,20 @@ std::shared_ptr<PluginCapabilityInterface> PluginManager::get_plugin_capability(
     return nullptr;
 }
 
+bool PluginManager::get_install_state(const std::string& plugin_key, PluginInstallState& install_state)
+{
+    PluginDescriptor descriptor;
+    if (!try_get_plugin_descriptor(plugin_key, descriptor)) {
+        return false;
+    }
+
+    if (!read_install_state(boost::filesystem::path(descriptor.plugin_root), install_state)) {
+        return false;
+    }
+
+    return true;
+}
+
 // ── Lifecycle ───────────────────────────────────────────────────────────────────────────────
 
 bool PluginManager::is_plugin_loaded(const std::string& plugin_key) const
@@ -842,6 +857,8 @@ void PluginManager::load_plugin_impl(const std::string& plugin_key, bool skip_de
     if (!plugin_loader::load(descriptor, skip_deps, capabilities_to_enable, registry_precheck, plugin, error)) {
         if (error == LOAD_CANCELLED)
             return; // cancelled: nothing materialized survives, and no error is recorded
+        if (error.rfind("Plugin registration failed:", 0) == 0)
+            mark_plugin_install_state_disabled(plugin_key);
         fail(std::move(error));
         return;
     }
@@ -1067,6 +1084,31 @@ void PluginManager::write_loaded_plugin_install_state(const std::string& plugin_
     write_install_state(boost::filesystem::path(descriptor.plugin_root), descriptor, /*enabled=*/true, capabilities);
 }
 
+void PluginManager::mark_plugin_install_state_disabled(const std::string& plugin_key)
+{
+    std::lock_guard<std::mutex> state_lock(m_install_state_mutex);
+
+    PluginDescriptor descriptor;
+    if (!try_get_plugin_descriptor(plugin_key, descriptor) || descriptor.plugin_root.empty())
+        return;
+
+    const boost::filesystem::path root(descriptor.plugin_root);
+    PluginInstallState state;
+    if (!read_install_state(root, state)) {
+        state.installed_from    = descriptor.is_cloud_plugin() ? "cloud" : "local";
+        state.installed_version = !descriptor.installed_version.empty() ? descriptor.installed_version : descriptor.version;
+        state.plugin_name       = descriptor.name;
+        state.cloud_uuid        = descriptor.cloud_uuid();
+    }
+    state.enabled = false;
+    if (!write_install_state(root, state))
+        return;
+
+    std::lock_guard<std::mutex> lock(m_mutex);
+    if (Plugin* plugin = find_plugin_locked(plugin_key))
+        plugin->descriptor.enabled = false;
+}
+
 // ── Callbacks ───────────────────────────────────────────────────────────────────────────────
 
 void PluginManager::subscribe_on_load_callback(PluginLifecycleCompleteFn fn)

src/slic3r/plugin/PluginManager.hpp

@@ -150,6 +150,8 @@ public:
                                                                      PluginCapabilityType type = PluginCapabilityType::Unknown,
                                                                      bool only_enabled         = true) const;
 
+    bool get_install_state(const std::string& plugin_key, PluginInstallState& install_state);
+
     void load_plugin(const std::string& plugin_key, bool skip_deps = false, std::vector<std::string> capabilities_to_enable = {});
     bool unload_plugin(const std::string& plugin_key);
     void unload_all_plugins();
@@ -246,6 +248,7 @@ private:
 
     // Writes the sidecar for a loaded plugin (enabled=true plus the current per-capability flags).
     void write_loaded_plugin_install_state(const std::string& plugin_key);
+    void mark_plugin_install_state_disabled(const std::string& plugin_key);
 
     bool finalize_cloud_plugin_removal(const PluginDescriptor& plugin, bool keep_local, std::string& error);
     bool delete_installed_plugin_package(const PluginDescriptor& plugin, std::string& error);

src/slic3r/plugin/PyPluginTrampoline.hpp

@@ -26,25 +26,30 @@
     try { \
         override_call; \
     } catch (pybind11::error_already_set & err) { \
+        const bool _orca_audit_denial = ::Slic3r::PluginAuditManager::instance().audit_denial_pending(); \
+        if (_orca_audit_denial) \
+            ::Slic3r::PluginAuditManager::instance().clear_current_plugin(); \
         ::Slic3r::log_python_exception_keep(err); \
+        if (_orca_audit_denial) \
+            ::Slic3r::PluginAuditManager::instance().clear_audit_denial(); \
         throw; \
     }
 
 // Opens the plugin's filesystem audit scope for the duration of a C++ -> Python call, and publishes
 // the calling capability's cached name so host APIs invoked from Python can tell which capability
 // they are serving. No-op without an audit plugin key. Declares a local `_orca_audit_scope`.
-#define ORCA_PY_AUDIT_SCOPE(mode) \
+#define ORCA_PY_AUDIT_SCOPE() \
     std::optional<::Slic3r::ScopedPluginAuditContext> _orca_audit_scope; \
     if (const std::string& _orca_audit_key = this->audit_plugin_key(); !_orca_audit_key.empty()) \
-    _orca_audit_scope.emplace(_orca_audit_key, this->name(), mode)
+    _orca_audit_scope.emplace(_orca_audit_key, this->name())
 
-#define ORCA_PY_OVERRIDE_AUDITED(mode, audit_setup, override_macro, ret, base, name, ...) \
+#define ORCA_PY_OVERRIDE_AUDITED(audit_setup, override_macro, ret, base, name, ...) \
     do { \
         ::Slic3r::PluginCapabilityInterface::RefCounter _orca_ref_counter(*this); \
         ::Slic3r::PythonGILState _orca_python_gil; \
         if (!_orca_python_gil) \
             throw std::runtime_error("Python interpreter is shutting down"); \
-        ORCA_PY_AUDIT_SCOPE(mode); \
+        ORCA_PY_AUDIT_SCOPE(); \
         if (_orca_audit_scope) \
             audit_setup(); \
         ORCA_PY_LOGGED_OVERRIDE_BODY(override_macro(ret, base, name, ##__VA_ARGS__)); \
@@ -58,7 +63,7 @@ public:
 
     std::string get_name() const override
     {
-        ORCA_PY_OVERRIDE_AUDITED(::Slic3r::PluginAuditManager::AuditMode::Loading, [] {}, PYBIND11_OVERRIDE_PURE, std::string, Base, get_name);
+        ORCA_PY_OVERRIDE_AUDITED([] {}, PYBIND11_OVERRIDE_PURE, std::string, Base, get_name);
     }
 
     // Config UI hooks. Available on every capability type, so they live here rather than in
@@ -66,7 +71,6 @@ public:
     bool has_config_ui() const override
     {
         ORCA_PY_OVERRIDE_AUDITED(
-            ::Slic3r::PluginAuditManager::AuditMode::Loading,
             [] {},
             PYBIND11_OVERRIDE,
             bool,
@@ -77,7 +81,6 @@ public:
     std::string get_config_ui() const override
     {
         ORCA_PY_OVERRIDE_AUDITED(
-            ::Slic3r::PluginAuditManager::AuditMode::Loading,
             [] {},
             PYBIND11_OVERRIDE,
             std::string,
@@ -94,7 +97,7 @@ public:
     // mistake), both fall back to the base's empty object rather than writing `"cap_config": null`.
     nlohmann::json get_default_config() const override
     {
-        ORCA_PY_AUDIT_SCOPE(::Slic3r::PluginAuditManager::AuditMode::Loading);
+        ORCA_PY_AUDIT_SCOPE();
         try {
             pybind11::gil_scoped_acquire gil;
             pybind11::function override = pybind11::get_override(static_cast<const Base*>(this), "get_default_config");
@@ -117,17 +120,17 @@ public:
 
     void on_load() override
     {
-        ORCA_PY_OVERRIDE_AUDITED(::Slic3r::PluginAuditManager::AuditMode::Loading, [] {}, PYBIND11_OVERRIDE, void, Base, on_load);
+        ORCA_PY_OVERRIDE_AUDITED([] {}, PYBIND11_OVERRIDE, void, Base, on_load);
     }
 
     void on_unload() override
     {
-        ORCA_PY_OVERRIDE_AUDITED(::Slic3r::PluginAuditManager::AuditMode::Loading, [] {}, PYBIND11_OVERRIDE, void, Base, on_unload);
+        ORCA_PY_OVERRIDE_AUDITED([] {}, PYBIND11_OVERRIDE, void, Base, on_unload);
     }
 
     void on_cancelled() override
     {
-        ORCA_PY_OVERRIDE_AUDITED(::Slic3r::PluginAuditManager::AuditMode::Loading, [] {}, PYBIND11_OVERRIDE, void, Base, on_cancelled);
+        ORCA_PY_OVERRIDE_AUDITED([] {}, PYBIND11_OVERRIDE, void, Base, on_cancelled);
     }
 };
 
@@ -139,7 +142,7 @@ public:
     PluginCapabilityType get_type() const override
     {
         ORCA_PY_OVERRIDE_AUDITED(
-            ::Slic3r::PluginAuditManager::AuditMode::Loading, [] {}, PYBIND11_OVERRIDE, PluginCapabilityType, PluginCapabilityInterface,
+            [] {}, PYBIND11_OVERRIDE, PluginCapabilityType, PluginCapabilityInterface,
             get_type);
     }
 };

src/slic3r/plugin/PythonInterpreter.cpp

@@ -87,6 +87,12 @@ void log_python_exception_keep(pybind11::error_already_set& err)
     if (!gil)
         return;
 
+    // Traceback output is host-owned work.  In particular, the stderr tee opens the Python log
+    // file on every write.  Keep that open outside the plugin audit context, otherwise an ordinary
+    // exception raised by a plugin can recursively trigger the filesystem permission dialog while
+    // its original exception is being reported.
+    ScopedPluginAuditContext audit_suppression("");
+
     // Non-destructive: print the traceback to sys.stderr (tee'd to the session log)
     // WITHOUT consuming err, so the caller can rethrow it intact. For example, downstream C++
     // catchers can still read err.what() for the user-facing dialog. We must NOT use

src/slic3r/plugin/PythonPluginBridge.cpp

@@ -1,5 +1,6 @@
 #include "PythonPluginBridge.hpp"
 
+#include <algorithm>
 #include <boost/log/trivial.hpp>
 #include <exception>
 #include <memory>
@@ -39,6 +40,7 @@ thread_local std::string g_active_plugin_key;
 std::mutex g_registry_mutex;
 std::unordered_map<std::string, std::vector<py::object>> g_pending_capabilities;
 std::unordered_map<std::string, py::object> g_pending_package;
+std::unordered_map<std::string, std::vector<std::string>> g_pending_fs_read_permissions;
 struct PluginInstanceHandle
 {
     // The C++ plugin interface points into a Python object. Keep both alive through one
@@ -76,6 +78,8 @@ void discard_pending_capture_without_python(const std::string& plugin_key)
         (void) package->second.release();
         g_pending_package.erase(package);
     }
+
+    g_pending_fs_read_permissions.erase(plugin_key);
 }
 
 } // namespace
@@ -100,34 +104,38 @@ void PythonPluginBridge::begin_plugin_capture(const std::string& plugin_key)
         // for this same entry path.
         g_pending_capabilities.erase(plugin_key);
         g_pending_package.erase(plugin_key);
+        g_pending_fs_read_permissions.erase(plugin_key);
     }
     // From now until finalize/cancel, @orca.plugin and register_capability() calls made by
     // Python code on this thread are attributed to this plugin.
     g_active_plugin_key = plugin_key;
 }
 
-std::vector<CapturedCapability> PythonPluginBridge::finalize_plugin_capture(const std::string& plugin_key, std::string& error)
+std::vector<CapturedCapability> PythonPluginBridge::finalize_plugin_capture(const std::string& capture_key,
+                                                                              const std::string& plugin_key,
+                                                                              std::string&       error)
 {
     PythonGILState gil;
     if (!gil) {
         error = "Python interpreter is shutting down";
         return {};
     }
-    BOOST_LOG_TRIVIAL(info) << "Finalizing Python plugin capture for key " << plugin_key;
+    BOOST_LOG_TRIVIAL(info) << "Finalizing Python plugin capture for key " << capture_key;
 
     // Phase 1: run the package class's register_capabilities() while the active key is
     // still set. That method is expected to call orca.register_capability() once per
     // capability class, and register_capability() needs g_active_plugin_key to know which
     // pending bucket to append to.
     {
-        auto clear_active_key = [&plugin_key]() {
-            if (g_active_plugin_key == plugin_key)
+        auto clear_active_key = [&capture_key]() {
+            if (g_active_plugin_key == capture_key)
                 g_active_plugin_key.clear();
         };
-        auto discard_pending_for_key = [&plugin_key]() {
+        auto discard_pending_for_key = [&capture_key]() {
             std::lock_guard<std::mutex> lock(g_registry_mutex);
-            g_pending_capabilities.erase(plugin_key);
-            g_pending_package.erase(plugin_key);
+            g_pending_capabilities.erase(capture_key);
+            g_pending_package.erase(capture_key);
+            g_pending_fs_read_permissions.erase(capture_key);
         };
 
         try {
@@ -137,7 +145,7 @@ std::vector<CapturedCapability> PythonPluginBridge::finalize_plugin_capture(cons
             py::object package_cls;
             {
                 std::lock_guard<std::mutex> lock(g_registry_mutex);
-                auto it = g_pending_package.find(plugin_key);
+                auto it = g_pending_package.find(capture_key);
                 if (it != g_pending_package.end()) {
                     package_cls = it->second;
                     g_pending_package.erase(it);
@@ -156,6 +164,33 @@ std::vector<CapturedCapability> PythonPluginBridge::finalize_plugin_capture(cons
             // are kept.
             py::object package = package_cls();
             package.attr("register_capabilities")();
+
+            // Permission declarations are collected while register_capabilities() runs so the
+            // plugin can describe its needs without touching wx from the Python load worker. Ask
+            // only after registration returns, before capability instances are materialized.
+            std::vector<std::string> fs_read_permissions;
+            {
+                std::lock_guard<std::mutex> lock(g_registry_mutex);
+                auto it = g_pending_fs_read_permissions.find(capture_key);
+                if (it != g_pending_fs_read_permissions.end()) {
+                    fs_read_permissions = std::move(it->second);
+                    g_pending_fs_read_permissions.erase(it);
+                }
+            }
+            if (!fs_read_permissions.empty()) {
+                bool granted = false;
+                {
+                    py::gil_scoped_release release;
+                    granted = PluginAuditManager::instance().request_filesystem_read_permissions(plugin_key, fs_read_permissions);
+                }
+                if (!granted) {
+                    error = "Plugin filesystem read permission request denied";
+                    BOOST_LOG_TRIVIAL(warning) << error << " for key " << plugin_key;
+                    discard_pending_for_key();
+                    clear_active_key();
+                    return {};
+                }
+            }
         } catch (py::error_already_set& err) {
             log_python_exception_keep(err);
             error = err.what();
@@ -179,7 +214,7 @@ std::vector<CapturedCapability> PythonPluginBridge::finalize_plugin_capture(cons
     std::vector<py::object> classes;
     {
         std::lock_guard<std::mutex> lock(g_registry_mutex);
-        auto it = g_pending_capabilities.find(plugin_key);
+        auto it = g_pending_capabilities.find(capture_key);
         if (it != g_pending_capabilities.end()) {
             classes = std::move(it->second);
             g_pending_capabilities.erase(it);
@@ -188,10 +223,10 @@ std::vector<CapturedCapability> PythonPluginBridge::finalize_plugin_capture(cons
 
     // Registration is complete. Later register_capability() calls should fail instead of
     // accidentally attaching themselves to this plugin.
-    if (g_active_plugin_key == plugin_key)
+    if (g_active_plugin_key == capture_key)
         g_active_plugin_key.clear();
 
-    BOOST_LOG_TRIVIAL(info) << "Collected " << classes.size() << " registered capability class(es) for key " << plugin_key;
+    BOOST_LOG_TRIVIAL(info) << "Collected " << classes.size() << " registered capability class(es) for key " << capture_key;
 
     std::vector<CapturedCapability> capabilities;
     capabilities.reserve(classes.size());
@@ -203,7 +238,7 @@ std::vector<CapturedCapability> PythonPluginBridge::finalize_plugin_capture(cons
             py::object instance = cls();
             if (!py::isinstance<PluginCapabilityInterface>(instance)) {
                 error = "Registered capability must inherit from a PluginCapability base";
-                BOOST_LOG_TRIVIAL(error) << "Python plugin capture failed type check for key " << plugin_key
+                BOOST_LOG_TRIVIAL(error) << "Python plugin capture failed type check for key " << capture_key
                                          << " error=" << error;
                 return {};
             }
@@ -211,7 +246,7 @@ std::vector<CapturedCapability> PythonPluginBridge::finalize_plugin_capture(cons
             auto capability_iface = instance.cast<std::shared_ptr<PluginCapabilityInterface>>();
             if (!capability_iface) {
                 error = "Failed to cast Python capability to PluginCapabilityInterface";
-                BOOST_LOG_TRIVIAL(error) << "Python plugin capture failed cast for key " << plugin_key
+                BOOST_LOG_TRIVIAL(error) << "Python plugin capture failed cast for key " << capture_key
                                          << " error=" << error;
                 return {};
             }
@@ -225,7 +260,7 @@ std::vector<CapturedCapability> PythonPluginBridge::finalize_plugin_capture(cons
             // here is a hard error that rejects the whole plugin capture.
             if (name.find(';') != std::string::npos) {
                 error = "Capability name must not contain ';': " + name;
-                BOOST_LOG_TRIVIAL(error) << "Python plugin capture rejected capability for key " << plugin_key
+                BOOST_LOG_TRIVIAL(error) << "Python plugin capture rejected capability for key " << capture_key
                                          << " error=" << error;
                 return {};
             }
@@ -245,12 +280,12 @@ std::vector<CapturedCapability> PythonPluginBridge::finalize_plugin_capture(cons
             // log the traceback here. GIL is held for the duration of finalize_plugin_capture.
             log_python_exception_keep(err);
             error = err.what();
-            BOOST_LOG_TRIVIAL(error) << "Python plugin capture raised Python exception for key " << plugin_key
+            BOOST_LOG_TRIVIAL(error) << "Python plugin capture raised Python exception for key " << capture_key
                                      << " error=" << error;
             return {};
         } catch (const std::exception& ex) {
             error = ex.what();
-            BOOST_LOG_TRIVIAL(error) << "Python plugin capture raised exception for key " << plugin_key
+            BOOST_LOG_TRIVIAL(error) << "Python plugin capture raised exception for key " << capture_key
                                      << " error=" << error;
             return {};
         }
@@ -278,6 +313,7 @@ void PythonPluginBridge::cancel_plugin_capture(const std::string& plugin_key)
         // may already have registered under this key.
         g_pending_capabilities.erase(plugin_key);
         g_pending_package.erase(plugin_key);
+        g_pending_fs_read_permissions.erase(plugin_key);
     }
 
     if (g_active_plugin_key == plugin_key)
@@ -304,6 +340,7 @@ void PythonPluginBridge::clear_pending_captures()
             (void) pkg.release();
         }
         g_pending_package.clear();
+        g_pending_fs_read_permissions.clear();
         g_active_plugin_key.clear();
         return;
     }
@@ -312,6 +349,7 @@ void PythonPluginBridge::clear_pending_captures()
     BOOST_LOG_TRIVIAL(info) << "Clearing " << g_pending_capabilities.size() << " pending Python plugin capture(s)";
     g_pending_capabilities.clear();
     g_pending_package.clear();
+    g_pending_fs_read_permissions.clear();
     g_active_plugin_key.clear();
 }
 
@@ -448,6 +486,27 @@ void bind_python_api(pybind11::module_& m)
         },
         R"pbdoc(Register a PluginCapability subclass while OrcaSlicer loads your module.)pbdoc");
 
+    m.def(
+        "request_permissions",
+        [](const std::vector<std::string>& fs_read) {
+            if (g_active_plugin_key.empty())
+                throw py::value_error("request_permissions() called outside plugin discovery context");
+
+            std::lock_guard<std::mutex> lock(g_registry_mutex);
+            auto& requested = g_pending_fs_read_permissions[g_active_plugin_key];
+            for (const std::string& path : fs_read) {
+                if (path.empty())
+                    throw py::value_error("request_permissions(fs_read=...) does not accept empty paths");
+                if (std::find(requested.begin(), requested.end(), path) == requested.end())
+                    requested.push_back(path);
+            }
+        },
+        py::arg("fs_read") = std::vector<std::string>{},
+        R"pbdoc(Request filesystem read permissions while OrcaSlicer loads your module.
+
+The host presents the request to the user after register_capabilities() returns. Denying the
+request aborts the plugin load.)pbdoc");
+
     m.def("plugin", [](py::object cls) {
         if (g_active_plugin_key.empty())
             throw py::value_error("@orca.plugin used outside plugin discovery context");

src/slic3r/plugin/PythonPluginBridge.hpp

@@ -31,7 +31,7 @@ public:
     // Returns one CapturedCapability per capability, or an empty vector on failure
     // (error message populated).
     std::vector<CapturedCapability> finalize_plugin_capture(
-        const std::string& plugin_key, std::string& error);
+        const std::string& capture_key, const std::string& plugin_key, std::string& error);
 
     // Clear any pending registrations for the key. Safe to call when import fails.
     void cancel_plugin_capture(const std::string& plugin_key);

src/slic3r/plugin/pluginTypes/printerAgent/PrinterAgentPluginCapabilityTrampoline.hpp

@@ -16,206 +16,206 @@ public:
     AgentInfo get_agent_info() override
     {
         ORCA_PY_OVERRIDE_AUDITED(
-            ::Slic3r::PluginAuditManager::AuditMode::Loading, [] {}, PYBIND11_OVERRIDE_PURE, AgentInfo, PrinterAgentPluginCapability,
+            [] {}, PYBIND11_OVERRIDE_PURE, AgentInfo, PrinterAgentPluginCapability,
             get_agent_info);
     }
 
     int connect_printer(std::string dev_id, std::string dev_ip, std::string username, std::string password, bool use_ssl) override
     {
         ORCA_PY_OVERRIDE_AUDITED(
-            ::Slic3r::PluginAuditManager::AuditMode::Loading, [] {}, PYBIND11_OVERRIDE_PURE, int, PrinterAgentPluginCapability, connect_printer, dev_id,
+            [] {}, PYBIND11_OVERRIDE_PURE, int, PrinterAgentPluginCapability, connect_printer, dev_id,
             dev_ip, username, password, use_ssl);
     }
 
     int disconnect_printer() override
     {
         ORCA_PY_OVERRIDE_AUDITED(
-            ::Slic3r::PluginAuditManager::AuditMode::Loading, [] {}, PYBIND11_OVERRIDE_PURE, int, PrinterAgentPluginCapability, disconnect_printer);
+            [] {}, PYBIND11_OVERRIDE_PURE, int, PrinterAgentPluginCapability, disconnect_printer);
     }
 
     int send_message(std::string dev_id, std::string json_str, int qos, int flag) override
     {
         ORCA_PY_OVERRIDE_AUDITED(
-            ::Slic3r::PluginAuditManager::AuditMode::Loading, [] {}, PYBIND11_OVERRIDE_PURE, int, PrinterAgentPluginCapability, send_message, dev_id,
+            [] {}, PYBIND11_OVERRIDE_PURE, int, PrinterAgentPluginCapability, send_message, dev_id,
             json_str, qos, flag);
     }
 
     int send_message_to_printer(std::string dev_id, std::string json_str, int qos, int flag) override
     {
         ORCA_PY_OVERRIDE_AUDITED(
-            ::Slic3r::PluginAuditManager::AuditMode::Loading, [] {}, PYBIND11_OVERRIDE_PURE, int, PrinterAgentPluginCapability, send_message_to_printer,
+            [] {}, PYBIND11_OVERRIDE_PURE, int, PrinterAgentPluginCapability, send_message_to_printer,
             dev_id, json_str, qos, flag);
     }
 
     bool start_discovery(bool start, bool sending) override
     {
         ORCA_PY_OVERRIDE_AUDITED(
-            ::Slic3r::PluginAuditManager::AuditMode::Loading, [] {}, PYBIND11_OVERRIDE_PURE, bool, PrinterAgentPluginCapability, start_discovery, start,
+            [] {}, PYBIND11_OVERRIDE_PURE, bool, PrinterAgentPluginCapability, start_discovery, start,
             sending);
     }
 
     int bind_detect(std::string dev_ip, std::string sec_link, detectResult& detect) override
     {
         ORCA_PY_OVERRIDE_AUDITED(
-            ::Slic3r::PluginAuditManager::AuditMode::Loading, [] {}, PYBIND11_OVERRIDE_PURE, int, PrinterAgentPluginCapability, bind_detect, dev_ip,
+            [] {}, PYBIND11_OVERRIDE_PURE, int, PrinterAgentPluginCapability, bind_detect, dev_ip,
             sec_link, detect);
     }
 
     std::string get_user_selected_machine() override
     {
         ORCA_PY_OVERRIDE_AUDITED(
-            ::Slic3r::PluginAuditManager::AuditMode::Loading, [] {}, PYBIND11_OVERRIDE_PURE, std::string, PrinterAgentPluginCapability,
+            [] {}, PYBIND11_OVERRIDE_PURE, std::string, PrinterAgentPluginCapability,
             get_user_selected_machine);
     }
 
     int set_user_selected_machine(std::string dev_id) override
     {
         ORCA_PY_OVERRIDE_AUDITED(
-            ::Slic3r::PluginAuditManager::AuditMode::Loading, [] {}, PYBIND11_OVERRIDE_PURE, int, PrinterAgentPluginCapability,
+            [] {}, PYBIND11_OVERRIDE_PURE, int, PrinterAgentPluginCapability,
             set_user_selected_machine, dev_id);
     }
 
     int start_send_gcode_to_sdcard(PrintParams params, OnUpdateStatusFn update_fn, WasCancelledFn cancel_fn, OnWaitFn wait_fn) override
     {
         ORCA_PY_OVERRIDE_AUDITED(
-            ::Slic3r::PluginAuditManager::AuditMode::Loading, [] {}, PYBIND11_OVERRIDE_PURE, int, PrinterAgentPluginCapability,
+            [] {}, PYBIND11_OVERRIDE_PURE, int, PrinterAgentPluginCapability,
             start_send_gcode_to_sdcard, params, update_fn, cancel_fn, wait_fn);
     }
 
     int start_local_print(PrintParams params, OnUpdateStatusFn update_fn, WasCancelledFn cancel_fn) override
     {
         ORCA_PY_OVERRIDE_AUDITED(
-            ::Slic3r::PluginAuditManager::AuditMode::Loading, [] {}, PYBIND11_OVERRIDE_PURE, int, PrinterAgentPluginCapability, start_local_print,
+            [] {}, PYBIND11_OVERRIDE_PURE, int, PrinterAgentPluginCapability, start_local_print,
             params, update_fn, cancel_fn);
     }
 
     FilamentSyncMode get_filament_sync_mode() const override
     {
         ORCA_PY_OVERRIDE_AUDITED(
-            ::Slic3r::PluginAuditManager::AuditMode::Loading, [] {}, PYBIND11_OVERRIDE_PURE, FilamentSyncMode, PrinterAgentPluginCapability,
+            [] {}, PYBIND11_OVERRIDE_PURE, FilamentSyncMode, PrinterAgentPluginCapability,
             get_filament_sync_mode);
     }
 
     bool fetch_filament_info(std::string dev_id) override
     {
         ORCA_PY_OVERRIDE_AUDITED(
-            ::Slic3r::PluginAuditManager::AuditMode::Loading, [] {}, PYBIND11_OVERRIDE_PURE, bool, PrinterAgentPluginCapability, fetch_filament_info, dev_id);
+            [] {}, PYBIND11_OVERRIDE_PURE, bool, PrinterAgentPluginCapability, fetch_filament_info, dev_id);
     }
 
     int check_cert() override
     {
         ORCA_PY_OVERRIDE_AUDITED(
-            ::Slic3r::PluginAuditManager::AuditMode::Loading, [] {}, PYBIND11_OVERRIDE_PURE, int, PrinterAgentPluginCapability, check_cert);
+            [] {}, PYBIND11_OVERRIDE_PURE, int, PrinterAgentPluginCapability, check_cert);
     }
 
     void install_device_cert(std::string dev_id, bool lan_only) override
     {
         ORCA_PY_OVERRIDE_AUDITED(
-            ::Slic3r::PluginAuditManager::AuditMode::Loading, [] {}, PYBIND11_OVERRIDE_PURE, void, PrinterAgentPluginCapability, install_device_cert, dev_id,
+            [] {}, PYBIND11_OVERRIDE_PURE, void, PrinterAgentPluginCapability, install_device_cert, dev_id,
             lan_only);
     }
 
     int ping_bind(std::string ping_code) override
     {
         ORCA_PY_OVERRIDE_AUDITED(
-            ::Slic3r::PluginAuditManager::AuditMode::Loading, [] {}, PYBIND11_OVERRIDE_PURE, int, PrinterAgentPluginCapability, ping_bind, ping_code);
+            [] {}, PYBIND11_OVERRIDE_PURE, int, PrinterAgentPluginCapability, ping_bind, ping_code);
     }
 
     int bind(std::string dev_ip, std::string dev_id, std::string dev_model, std::string sec_link, std::string timezone, bool improved, OnUpdateStatusFn update_fn) override
     {
         ORCA_PY_OVERRIDE_AUDITED(
-            ::Slic3r::PluginAuditManager::AuditMode::Loading, [] {}, PYBIND11_OVERRIDE_PURE, int, PrinterAgentPluginCapability, bind, dev_ip, dev_id,
+            [] {}, PYBIND11_OVERRIDE_PURE, int, PrinterAgentPluginCapability, bind, dev_ip, dev_id,
             dev_model, sec_link, timezone, improved, update_fn);
     }
 
     int unbind(std::string dev_id) override
     {
         ORCA_PY_OVERRIDE_AUDITED(
-            ::Slic3r::PluginAuditManager::AuditMode::Loading, [] {}, PYBIND11_OVERRIDE_PURE, int, PrinterAgentPluginCapability, unbind, dev_id);
+            [] {}, PYBIND11_OVERRIDE_PURE, int, PrinterAgentPluginCapability, unbind, dev_id);
     }
 
     int start_print(PrintParams params, OnUpdateStatusFn update_fn, WasCancelledFn cancel_fn, OnWaitFn wait_fn) override
     {
         ORCA_PY_OVERRIDE_AUDITED(
-            ::Slic3r::PluginAuditManager::AuditMode::Loading, [] {}, PYBIND11_OVERRIDE_PURE, int, PrinterAgentPluginCapability, start_print, params,
+            [] {}, PYBIND11_OVERRIDE_PURE, int, PrinterAgentPluginCapability, start_print, params,
             update_fn, cancel_fn, wait_fn);
     }
 
     int start_local_print_with_record(PrintParams params, OnUpdateStatusFn update_fn, WasCancelledFn cancel_fn, OnWaitFn wait_fn) override
     {
         ORCA_PY_OVERRIDE_AUDITED(
-            ::Slic3r::PluginAuditManager::AuditMode::Loading, [] {}, PYBIND11_OVERRIDE_PURE, int, PrinterAgentPluginCapability,
+            [] {}, PYBIND11_OVERRIDE_PURE, int, PrinterAgentPluginCapability,
             start_local_print_with_record, params, update_fn, cancel_fn, wait_fn);
     }
 
     int start_sdcard_print(PrintParams params, OnUpdateStatusFn update_fn, WasCancelledFn cancel_fn) override
     {
         ORCA_PY_OVERRIDE_AUDITED(
-            ::Slic3r::PluginAuditManager::AuditMode::Loading, [] {}, PYBIND11_OVERRIDE_PURE, int, PrinterAgentPluginCapability, start_sdcard_print, params,
+            [] {}, PYBIND11_OVERRIDE_PURE, int, PrinterAgentPluginCapability, start_sdcard_print, params,
             update_fn, cancel_fn);
     }
 
     int get_hms_snapshot(std::string dev_id, std::string file_name, std::function<void(std::string, int)> callback) override
     {
         ORCA_PY_OVERRIDE_AUDITED(
-            ::Slic3r::PluginAuditManager::AuditMode::Loading, [] {}, PYBIND11_OVERRIDE_PURE, int, PrinterAgentPluginCapability, get_hms_snapshot, dev_id,
+            [] {}, PYBIND11_OVERRIDE_PURE, int, PrinterAgentPluginCapability, get_hms_snapshot, dev_id,
             file_name, callback);
     }
 
     int set_server_callback(OnServerErrFn fn) override
     {
         ORCA_PY_OVERRIDE_AUDITED(
-            ::Slic3r::PluginAuditManager::AuditMode::Loading, [] {}, PYBIND11_OVERRIDE_PURE, int, PrinterAgentPluginCapability, set_server_callback, fn);
+            [] {}, PYBIND11_OVERRIDE_PURE, int, PrinterAgentPluginCapability, set_server_callback, fn);
     }
 
     int set_on_ssdp_msg_fn(OnMsgArrivedFn fn) override
     {
         ORCA_PY_OVERRIDE_AUDITED(
-            ::Slic3r::PluginAuditManager::AuditMode::Loading, [] {}, PYBIND11_OVERRIDE_PURE, int, PrinterAgentPluginCapability, set_on_ssdp_msg_fn, fn);
+            [] {}, PYBIND11_OVERRIDE_PURE, int, PrinterAgentPluginCapability, set_on_ssdp_msg_fn, fn);
     }
 
     int set_on_printer_connected_fn(OnPrinterConnectedFn fn) override
     {
         ORCA_PY_OVERRIDE_AUDITED(
-            ::Slic3r::PluginAuditManager::AuditMode::Loading, [] {}, PYBIND11_OVERRIDE_PURE, int, PrinterAgentPluginCapability, set_on_printer_connected_fn,
+            [] {}, PYBIND11_OVERRIDE_PURE, int, PrinterAgentPluginCapability, set_on_printer_connected_fn,
             fn);
     }
 
     int set_on_subscribe_failure_fn(GetSubscribeFailureFn fn) override
     {
         ORCA_PY_OVERRIDE_AUDITED(
-            ::Slic3r::PluginAuditManager::AuditMode::Loading, [] {}, PYBIND11_OVERRIDE_PURE, int, PrinterAgentPluginCapability, set_on_subscribe_failure_fn,
+            [] {}, PYBIND11_OVERRIDE_PURE, int, PrinterAgentPluginCapability, set_on_subscribe_failure_fn,
             fn);
     }
 
     int set_on_message_fn(OnMessageFn fn) override
     {
         ORCA_PY_OVERRIDE_AUDITED(
-            ::Slic3r::PluginAuditManager::AuditMode::Loading, [] {}, PYBIND11_OVERRIDE_PURE, int, PrinterAgentPluginCapability, set_on_message_fn, fn);
+            [] {}, PYBIND11_OVERRIDE_PURE, int, PrinterAgentPluginCapability, set_on_message_fn, fn);
     }
 
     int set_on_user_message_fn(OnMessageFn fn) override
     {
         ORCA_PY_OVERRIDE_AUDITED(
-            ::Slic3r::PluginAuditManager::AuditMode::Loading, [] {}, PYBIND11_OVERRIDE_PURE, int, PrinterAgentPluginCapability, set_on_user_message_fn, fn);
+            [] {}, PYBIND11_OVERRIDE_PURE, int, PrinterAgentPluginCapability, set_on_user_message_fn, fn);
     }
 
     int set_on_local_connect_fn(OnLocalConnectedFn fn) override
     {
         ORCA_PY_OVERRIDE_AUDITED(
-            ::Slic3r::PluginAuditManager::AuditMode::Loading, [] {}, PYBIND11_OVERRIDE_PURE, int, PrinterAgentPluginCapability, set_on_local_connect_fn, fn);
+            [] {}, PYBIND11_OVERRIDE_PURE, int, PrinterAgentPluginCapability, set_on_local_connect_fn, fn);
     }
 
     int set_on_local_message_fn(OnMessageFn fn) override
     {
         ORCA_PY_OVERRIDE_AUDITED(
-            ::Slic3r::PluginAuditManager::AuditMode::Loading, [] {}, PYBIND11_OVERRIDE_PURE, int, PrinterAgentPluginCapability, set_on_local_message_fn, fn);
+            [] {}, PYBIND11_OVERRIDE_PURE, int, PrinterAgentPluginCapability, set_on_local_message_fn, fn);
     }
 
     int set_queue_on_main_fn(QueueOnMainFn fn) override
     {
         ORCA_PY_OVERRIDE_AUDITED(
-            ::Slic3r::PluginAuditManager::AuditMode::Loading, [] {}, PYBIND11_OVERRIDE_PURE, int, PrinterAgentPluginCapability, set_queue_on_main_fn, fn);
+            [] {}, PYBIND11_OVERRIDE_PURE, int, PrinterAgentPluginCapability, set_queue_on_main_fn, fn);
     }
 
     // request_bind_ticket returns its ticket through a std::string* out-param, which pybind11
@@ -223,7 +223,7 @@ public:
     // returns a (result, ticket) tuple, which we unpack into the int result and the out-param.
     int request_bind_ticket(std::string* ticket) override
     {
-        ORCA_PY_AUDIT_SCOPE(::Slic3r::PluginAuditManager::AuditMode::Loading);
+        ORCA_PY_AUDIT_SCOPE();
         ::Slic3r::PluginCapabilityInterface::RefCounter _orca_ref_counter(*this);
         ::Slic3r::PythonGILState gil;
         if (!gil)

src/slic3r/plugin/pluginTypes/script/ScriptPluginCapabilityTrampoline.hpp

@@ -13,7 +13,6 @@ public:
     ExecutionResult execute() override
     {
         ORCA_PY_OVERRIDE_AUDITED(
-            ::Slic3r::PluginAuditManager::AuditMode::Loading,
             [] {},
             PYBIND11_OVERRIDE_PURE,
             ExecutionResult,

src/slic3r/plugin/pluginTypes/slicingPipeline/SlicingPipelinePluginCapabilityTrampoline.hpp

@@ -10,7 +10,6 @@ public:
     using PyPluginCommonTrampoline<SlicingPipelinePluginCapability>::PyPluginCommonTrampoline;
     ExecutionResult execute(SlicingPipelineContext& ctx) override {
         ORCA_PY_OVERRIDE_AUDITED(
-            ::Slic3r::PluginAuditManager::AuditMode::Loading,
             [&]{
                 // At Step.psGCodePostProcess the plugin edits the exported G-code file, which lives
                 // outside data_dir() (a temp/output folder), so writing to it would otherwise be

tests/slic3rutils/test_plugin_audit.cpp

@@ -81,7 +81,7 @@ TEST_CASE("Plugin audit denies app config and token filenames anywhere", "[audit
     }
 }
 
-TEST_CASE("Plugin audit deny beats allowed roots and the Loading read exemption", "[audit]")
+TEST_CASE("Plugin audit deny beats allowed roots", "[audit]")
 {
     ScopedDataDir data_dir_guard("plugin-audit-deny");
     seed_denied_names();
@@ -91,8 +91,8 @@ TEST_CASE("Plugin audit deny beats allowed roots and the Loading read exemption"
     // config and the token would otherwise be reachable simply by living inside it.
     mgr.add_global_allowed_root(data_dir());
 
-    // Enter a plugin context. The deny must hold in Loading mode, which every scope runs in.
-    ScopedPluginAuditContext ctx("test_plugin", "", PluginAuditManager::AuditMode::Loading);
+    // Enter a plugin context. The deny must hold even inside a globally allowed root.
+    ScopedPluginAuditContext ctx("test_plugin", "");
 
     const fs::path conf  = fs::path(data_dir()) / (SLIC3R_APP_KEY ".conf");
     const fs::path token = fs::path(data_dir()) / secret_constants::USER_SECRET_FILENAME;
@@ -103,6 +103,13 @@ TEST_CASE("Plugin audit deny beats allowed roots and the Loading read exemption"
         CHECK(decision.allowed);
     }
 
+    SECTION("a file outside the allowed root is blocked for reads as well as writes")
+    {
+        AuditDecision decision = mgr.check_open((fs::path(data_dir()).parent_path() / "outside.txt").string(), "r");
+        CHECK_FALSE(decision.allowed);
+        CHECK(decision.reason == "outside allowed root");
+    }
+
     SECTION("writing the app config is blocked despite data_dir() being allowed")
     {
         AuditDecision decision = mgr.check_open(conf.string(), "w");
@@ -110,16 +117,14 @@ TEST_CASE("Plugin audit deny beats allowed roots and the Loading read exemption"
         CHECK(decision.reason == "denied filename");
     }
 
-    SECTION("reading the app config is blocked even though Loading exempts reads")
+    SECTION("reading the app config is blocked despite the allowed root")
     {
-        // Without the deny, a read in Loading mode short-circuits to allow. The deny sits above
-        // that exemption, so this must still be blocked.
         AuditDecision decision = mgr.check_open(conf.string(), "r");
         CHECK_FALSE(decision.allowed);
         CHECK(decision.reason == "denied filename");
     }
 
-    SECTION("reading the cloud refresh token is blocked in Loading mode")
+    SECTION("reading the cloud refresh token is blocked")
     {
         AuditDecision decision = mgr.check_open(token.string(), "r");
         CHECK_FALSE(decision.allowed);
@@ -150,7 +155,7 @@ TEST_CASE("Plugin audit deny beats a plugin's own scoped root", "[audit]")
     const fs::path plugin_dir = fs::path(data_dir()) / "plugins" / "test_plugin";
     fs::create_directories(plugin_dir);
 
-    ScopedPluginAuditContext ctx("test_plugin", "", PluginAuditManager::AuditMode::Loading);
+    ScopedPluginAuditContext ctx("test_plugin", "");
     mgr.add_scoped_allowed_root(plugin_dir);
 
     SECTION("the plugin's own non-denied file opens for read and write")

tests/slic3rutils/test_plugin_install.cpp

@@ -112,6 +112,18 @@ TEST_CASE("install-state sidecar is the source of truth for a cloud plugin's ins
     REQUIRE(read_install_state(plugin_dir, state));
     CHECK(state.installed_version == "1.2.0");
 
+    state.permissions.networking = {"api.example.com", "192.168.45.6"};
+    state.permissions.fs_read     = {"/path/to/read"};
+    state.permissions.fs_write    = {"/path/to/write"};
+    REQUIRE(write_install_state(plugin_dir, state));
+
+    // Permission data is persisted in the same sidecar as the installation metadata.
+    PluginInstallState persisted;
+    REQUIRE(read_install_state(plugin_dir, persisted));
+    CHECK(persisted.permissions.networking == state.permissions.networking);
+    CHECK(persisted.permissions.fs_read == state.permissions.fs_read);
+    CHECK(persisted.permissions.fs_write == state.permissions.fs_write);
+
     // Reading the sidecar back onto a freshly-scanned descriptor (whose header version is still
     // 1.0.0) must surface the cloud-installed 1.2.0. This is what lets update_cloud_metadata compare
     // the cloud's latest version against the installed version instead of the stale header, so an