hive-c0re: export the agent's unrestricted internet flag as a gauge

hive-c0re/src/agent_config/permissions.rs

@@ -47,6 +47,14 @@ pub fn effective(record: Option<&AgentPermissions>) -> Vec<Permission> {
         .unwrap_or_else(|| Permission::DEFAULT.to_vec())
 }
 
+/// Whether the agent's traffic may leave the host unfiltered under `record`:
+/// its flag when set, **on** when the agent has no record or the record never
+/// set it.
+#[must_use]
+pub fn unrestricted_internet(record: Option<&AgentPermissions>) -> bool {
+    record.is_none_or(swarm_queue_client::agent_permissions::unrestricted)
+}
+
 /// Whether `agent` holds `perm` per the file at `path` (normally [`path`]).
 ///
 /// # Errors
@@ -75,6 +83,19 @@ mod tests {
         );
     }
 
+    /// An agent with no record, or a record that never set the flag, reads on.
+    #[test]
+    fn unrestricted_internet_reads_absent_as_on() {
+        assert!(unrestricted_internet(None), "no record");
+        assert!(unrestricted_internet(Some(&record("{}"))), "flag unset");
+        assert!(unrestricted_internet(Some(&record(
+            r#"{"unrestricted_internet":true}"#
+        ))));
+        assert!(!unrestricted_internet(Some(&record(
+            r#"{"unrestricted_internet":false}"#
+        ))));
+    }
+
     /// No name holds more than the default without an entry: `ruth` with no
     /// entry holds `DEFAULT`, and only an entry grants her `manage_root_agent`.
     #[test]