derive an agent's backend hosts into the egress allow list at the controller

swarm-controller-api/src/egress.rs

@@ -18,6 +18,11 @@ pub struct AllowedDomain {
     #[serde(default, skip_serializing_if = "Option::is_none")]
     #[cfg_attr(feature = "schema", schema(example = "atlas"))]
     pub agent: Option<String>,
+    /// Set on an entry the controller keeps from the agent's backend
+    /// environment (the host of its `ANTHROPIC_BASE_URL`). The list shows it
+    /// as automatic; adding or removing one is refused.
+    #[serde(default, skip_serializing_if = "std::ops::Not::not")]
+    pub derived: bool,
 }
 
 /// The swarm's allow-list: every entry, swarm-wide and per agent, sorted.
@@ -36,6 +41,7 @@ mod tests {
         let swarm_wide = AllowedDomain {
             domain: "github.com".to_owned(),
             agent: None,
+            derived: false,
         };
         let wire = r#"{"domain":"github.com"}"#;
         assert_eq!(serde_json::to_string(&swarm_wide).unwrap(), wire);