feat(permissions): expose network permission state (#103)

frontend/src/ports/index.ts

@@ -52,13 +52,16 @@ import type {
   Project,
   ProjectPermissions,
   ProjectWorkState,
+  ProjectSystemPermissions,
   ProfileAvailability,
   ResumableAgent,
+  ResolvedAgentSystemPermissions,
   ReplyChunk,
   ServerExposurePreview,
   ServerExposureSettings,
   Skill,
   SkillScope,
+  SystemPermissionSet,
   Sprint,
   Template,
   TerminalSession,
@@ -861,6 +864,24 @@ export interface PermissionGateway {
     projectId: string,
     agentId: string,
   ): Promise<EffectivePermissions | null>;
+  /** Reads the full project system-permission document. */
+  getProjectSystemPermissions(projectId: string): Promise<ProjectSystemPermissions>;
+  /** Replaces or removes project-level default system permissions. */
+  updateProjectSystemPermissions(
+    projectId: string,
+    permissions: SystemPermissionSet | null,
+  ): Promise<ProjectSystemPermissions>;
+  /** Replaces or removes one agent-specific system-permission override. */
+  updateAgentSystemPermissions(
+    projectId: string,
+    agentId: string,
+    permissions: SystemPermissionSet | null,
+  ): Promise<ProjectSystemPermissions>;
+  /** Resolves wanted/effective runtime-constrained system permissions. */
+  resolveAgentSystemPermissions(
+    projectId: string,
+    agentId: string,
+  ): Promise<ResolvedAgentSystemPermissions>;
   /**
    * Reads the project's durable MCP tool permission document plus the
    * backend-canonical catalogue classification (ticket #82). Distinct