swarm: unrestricted_internet flag on the agent permissions record, unset reads as on, create writes false

swarmctl/src/main.rs

@@ -346,7 +346,8 @@ struct AgentsMdApplyArgs {
 enum PermissionsVerb {
     /// Show the permissions the swarm grants an agent, or that it sets none.
     Get(InferenceAgentArgs),
-    /// Replace the permissions the swarm grants an agent.
+    /// Replace the permissions the swarm grants an agent; the internet flag
+    /// stays unless given.
     Set(PermissionsSetArgs),
     /// Clear the agent's permissions, so the default applies again.
     Clear(InferenceAgentArgs),
@@ -366,6 +367,10 @@ struct PermissionsSetArgs {
         required = true
     )]
     permissions: Vec<String>,
+    /// Whether the agent's traffic may leave the host unfiltered. Left out,
+    /// the stored value stays.
+    #[arg(long, value_name = "BOOL")]
+    unrestricted_internet: Option<bool>,
     #[command(flatten)]
     socket: ControllerSocketArg,
 }
@@ -765,9 +770,12 @@ fn inference(remote: &RemoteArgs, command: InferenceVerb) -> Result<()> {
 fn permissions(remote: &RemoteArgs, command: PermissionsVerb) -> Result<()> {
     match command {
         PermissionsVerb::Get(a) => permissions::get(&a.socket.resolve(remote)?, &a.agent),
-        PermissionsVerb::Set(a) => {
-            permissions::set(&a.socket.resolve(remote)?, &a.agent, &a.permissions)
-        }
+        PermissionsVerb::Set(a) => permissions::set(
+            &a.socket.resolve(remote)?,
+            &a.agent,
+            &a.permissions,
+            a.unrestricted_internet,
+        ),
         PermissionsVerb::Clear(a) => permissions::clear(&a.socket.resolve(remote)?, &a.agent),
     }
 }