feat(permissions): expose network permission state (#103)

frontend/src/domain/index.ts

@@ -748,6 +748,48 @@ export interface EffectivePermissions {
   fallback: PermissionPosture;
 }
 
+/** Wanted/effective network policy for system permissions. */
+export type NetworkPolicy = "allow" | "deny" | "ask";
+
+/** Optional system permission bundle, distinct from file/bash permissions. */
+export interface SystemPermissionSet {
+  network?: NetworkPolicy;
+}
+
+/** One sparse agent system-permission override. */
+export interface AgentSystemPermissionOverride {
+  agentId: string;
+  permissions: SystemPermissionSet;
+}
+
+/** Full project system-permission document. */
+export interface ProjectSystemPermissions {
+  version: number;
+  projectDefault?: SystemPermissionSet;
+  agents?: AgentSystemPermissionOverride[];
+}
+
+/** Runtime lock details for resolved system permissions. */
+export interface RuntimeLock {
+  state: "none" | "locked";
+  source?: string;
+  reason?: string;
+}
+
+/** Whether the UI can edit the wanted system policy. */
+export interface SystemPermissionControl {
+  mode: "editable" | "readOnly";
+  reason?: string;
+}
+
+/** Resolved wanted/effective system permissions for one agent. */
+export interface ResolvedAgentSystemPermissions {
+  wanted: NetworkPolicy | null;
+  effective: NetworkPolicy;
+  runtimeLock: RuntimeLock;
+  control: SystemPermissionControl;
+}
+
 // ---------------------------------------------------------------------------
 // MCP tool permissions (ticket #82) — distinct from the file/command
 // permissions above: an allowlist of exact MCP tool names, applied by the MCP