swarm: unrestricted_internet flag on the agent permissions record, unset reads as on, create writes false

docs/process/conventions.md

@@ -311,6 +311,15 @@ the default (`Permission::DEFAULT`): `messaging`, `meta`, `inbox`,
 none. swarm-controller logs every refused `PUT` or `DELETE` on that route at `warn` as
 `agent permissions: request refused`, with the fields `op`, `agent`, `status` and `detail`.
 
+**Internet flag** — the record also carries `unrestricted_internet`, a
+boolean that isn't a `Permission`. An absent value means on, so every agent
+that existed before the field keeps the open access it had. `POST /api/agents`
+always writes the record with an explicit value, `false` unless the request
+names it. A `PUT` that leaves the field out and a `DELETE` (`swarmctl agent
+permissions clear`) keep the stored value; a `DELETE` on an agent that has one
+rewrites the record to just that value. Read it with
+`swarm_queue_client::agent_permissions::unrestricted`. Nothing acts on it yet.
+
 **How a change applies** —
 - The agent's harness reads its own key every 10 seconds and builds every
   turn's `--tools`, `--allowedTools` and MCP config from the last value, so a

docs/tools/swarmctl-cli.md

@@ -221,7 +221,7 @@ The agent applies its tool permissions at its next turn; the hive running it res
 ###### **Subcommands:**
 
 * `get` — Show the permissions the swarm grants an agent, or that it sets none
-* `set` — Replace the permissions the swarm grants an agent
+* `set` — Replace the permissions the swarm grants an agent; the internet flag stays unless given
 * `clear` — Clear the agent's permissions, so the default applies again
 
 
@@ -246,7 +246,7 @@ Show the permissions the swarm grants an agent, or that it sets none
 
 ## `swarmctl agent permissions set`
 
-Replace the permissions the swarm grants an agent
+Replace the permissions the swarm grants an agent; the internet flag stays unless given
 
 **Usage:** `swarmctl agent permissions set [OPTIONS] --permissions <PERMISSIONS> <AGENT>`
 
@@ -257,6 +257,10 @@ Replace the permissions the swarm grants an agent
 ###### **Options:**
 
 * `--permissions <PERMISSIONS>` — The permissions to grant, comma-separated: any of `messaging`, `meta`, `inbox`, `execution`, `web_tools`, `manage_root_agent`. `--permissions ''` grants none
+* `--unrestricted-internet <BOOL>` — Whether the agent's traffic may leave the host unfiltered. Left out, the stored value stays
+
+  Possible values: `true`, `false`
+
 * `--controller-socket <PATH>` — swarm-controller's unix socket.
 
    Supplied by the nix module that installs this binary, from the same `socketPath` option the daemon binds; falls back to `SWARM_CONTROLLER_SOCKET`.