--- a/webapprt/CommandLineHandler.js
+++ b/webapprt/CommandLineHandler.js
@@ -4,24 +4,16 @@
 
 const Cc = Components.classes;
 const Ci = Components.interfaces;
 const Cu = Components.utils;
 
 Cu.import("resource://gre/modules/XPCOMUtils.jsm");
 Cu.import("resource://gre/modules/Services.jsm");
 
-// Initialize DOMApplicationRegistry so it can receive and respond to messages.
-// We catch an exception here on the off chance the registry throws one, as we
-// don't need it for most apps, and exceptions it throws shouldn't prevent apps
-// from loading.
-try {
-  Cu.import("resource://gre/modules/Webapps.jsm");
-} catch(ex) {}
-
 function CommandLineHandler() {}
 
 CommandLineHandler.prototype = {
   classID: Components.ID("{6d69c782-40a3-469b-8bfd-3ee366105a4a}"),
 
   QueryInterface: XPCOMUtils.generateQI([Ci.nsICommandLineHandler]),
 
   handle: function handle(cmdLine) {
@@ -33,8 +25,41 @@ CommandLineHandler.prototype = {
                            []);
   },
 
   helpInfo : "",
 };
 
 let components = [CommandLineHandler];
 let NSGetFactory = XPCOMUtils.generateNSGetFactory(components);
+
+/* There's some work we need to do on startup, before we load the webapp,
+ * and this seems as good a place as any to do it, although it's possible
+ * that in the future we will find a lazier place to do it.
+ *
+ * NOTE: it's very important that the stuff we do here doesn't prevent
+ * the command-line handler from being registered/accessible, since otherwise
+ * the app won't start, which is catastrophic failure.  That's why it's all
+ * wrapped in a try/catch block. */
+
+try {
+  // Initialize DOMApplicationRegistry so it can receive/respond to messages.
+  Cu.import("resource://gre/modules/Webapps.jsm");
+
+  // On firstrun, set permissions to their default values.
+  if (!Services.prefs.getBoolPref("webapprt.firstrun")) {
+    Cu.import("resource://webapprt/modules/WebappRT.jsm");
+    let uri = Services.io.newURI(WebappRT.config.app.origin, null, null);
+
+    // Set AppCache-related permissions.
+    Services.perms.add(uri, "pin-app", Ci.nsIPermissionManager.ALLOW_ACTION);
+    Services.perms.add(uri, "offline-app",
+                       Ci.nsIPermissionManager.ALLOW_ACTION);
+
+    // Now that we've set the appropriate permissions, twiddle the firstrun flag
+    // so we don't try to do so again.
+    Services.prefs.setBoolPref("webapprt.firstrun", true);
+  }
+} catch(ex) {
+#ifdef MOZ_DEBUG
+  dump(ex + "\n");
+#endif
+}

--- a/webapprt/Makefile.in
+++ b/webapprt/Makefile.in
@@ -34,16 +34,20 @@ EXTRA_PP_COMPONENTS = \
   $(NULL)
 
 EXTRA_JS_MODULES = \
   WebappRT.jsm \
   $(NULL)
 
 include $(topsrcdir)/config/rules.mk
 
+ifdef MOZ_DEBUG
+DEFINES += -DMOZ_DEBUG=1
+endif
+
 libs::
 	$(PYTHON) $(MOZILLA_DIR)/config/buildlist.py $(FINAL_TARGET)/chrome.manifest "resource webapprt ./"
 
 libs:: prefs.js
 	$(NSINSTALL) -D $(FINAL_TARGET)/defaults/preferences
 	$(INSTALL) $^ $(FINAL_TARGET)/defaults/preferences
 
 GRE_MILESTONE := $(shell tail -n 1 $(topsrcdir)/config/milestone.txt 2>/dev/null || tail -1 $(topsrcdir)/config/milestone.txt)

--- a/webapprt/prefs.js
+++ b/webapprt/prefs.js
@@ -6,8 +6,11 @@ pref("browser.chromeURL", "chrome://weba
 pref("browser.download.folderList", 1);
 
 // Disable all add-on locations other than the profile (which can't be disabled this way)
 pref("extensions.enabledScopes", 1);
 // Auto-disable any add-ons that are "dropped in" to the profile
 pref("extensions.autoDisableScopes", 1);
 // Disable add-on installation via the web-exposed APIs
 pref("xpinstall.enabled", false);
+
+// Whether or not we've ever run.  We use this to set permissions on firstrun.
+pref("webapprt.firstrun", false);