[FEATURE]:permissions: external_directory approval prompt lacks explicit scope choice (folder only vs including subfolders) #56807

Feature hasn't been suggested before.

• I have verified this feature I'm about to request hasn't been suggested before.

Describe the enhancement you want to request

Summary

When external_directory permissions are configured to ask, each access to a
different external (sub)directory triggers a new approval prompt. The prompt
offers no explicit scope choice and does not explain what "Allow always" will
save, so it is unclear whether one approval covers the granted folder and all
its subfolders. Request: make the prompt state the scope of each choice and/or
offer "this folder only" vs "this folder including all subfolders".

Environment

• opencode version: v2.0.32
• OS: Windows 11 (10.0.26200), win32 x64
• Terminal: Unavailable (terminal env vars not set from CLI probe)
• Shell: Windows PowerShell
• Install/channel: latest release
• Active plugins: -opencode.config.compatibility; local plugin
  file:///…/agent-os-opencode (Agent OS hook bridge)

Reproduction

1. Global opencode.json (the exact rule the V1→V2 migration guide
   recommends to restore V1-like behavior):

   "permissions": [
     { "action": "external_directory", "resource": "*", "effect": "ask" }
   ]

2. Start the TUI in a project. Ask the agent to read a file in a sibling external folder → approval prompt appears.
3. Approve with "Allow once".
4. Ask the agent to read a file in a different subdirectory under the same external folder (or in its parent) → a new prompt appears per new boundary directory.
   Reproducible consistently (reported by the user who configured the rule).

Expected Behavior

The approval prompt states the scope explicitly, e.g. "this folder only" / "this folder and all subfolders", scoped to the current project.
Alternatively, "Allow always" should visibly save a pattern covering the confirmed directory tree. Per the matching rules (* includes /), a saved dir/* pattern is already recursive over the subtree — but at approval time none of this is communicated.

Actual Behavior

After "Allow once", every new external subfolder triggers a fresh prompt. The user reads this as "grant covers only this exact folder, without its subfolders", which breaks the common mental model "giving access to a folder includes its subtree".
It is not visible from the prompt what pattern "Allow always" will save. During the reporter's test the project-scoped saved-permission storage remained empty (as documented for "Allow once"), so the exact proposed pattern could not be observed.

Additional Context

The permissions guide states: "Allow always: Approve it and save the tool's proposed patterns for the project", and external_directory resources are "normally ending in /*". The gap is purely at the approval UX level.
Since the migration guide explicitly recommends adding this rule, migrated users will meet this prompt routinely.
This is an enhancement request about menu wording/UX, not a malfunction of rule evaluation.