V0.38.5 git board rewrite (#238)

Co-authored-by: gobha <jasafpro@gmail.com>
Co-committed-by: gobha <jasafpro@gmail.com>

server/handlers/ext_api.go

@@ -100,7 +100,12 @@ func (h *ExtAPIHandler) Handle(c *gin.Context) {
 		return
 	}
 
-	// ── 3. Check api.http permission ───────────
+	// ── 3. Check permissions ──────────────────
+	// The package needs at least one granted permission to be active.
+	// api.http is NOT required here — a consumer package may delegate
+	// HTTP to a library via lib.require(). The sandbox wires the http
+	// module only when api.http is granted; without it the script simply
+	// cannot call http.get() directly, which is correct for consumers.
 	if h.stores.ExtPermissions == nil {
 		c.JSON(http.StatusForbidden, gin.H{"error": "permission system unavailable"})
 		return
@@ -110,8 +115,8 @@ func (h *ExtAPIHandler) Handle(c *gin.Context) {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": "permission check failed"})
 		return
 	}
-	if !hasPermission(granted, models.ExtPermAPIHTTP) {
-		c.JSON(http.StatusForbidden, gin.H{"error": "extension does not have api.http permission"})
+	if len(granted) == 0 {
+		c.JSON(http.StatusForbidden, gin.H{"error": "extension has no granted permissions"})
 		return
 	}