[FEATURE] acp: 'Always allow (all projects)' option that writes to global permission config

[bcdady]

Problem

In ACP mode (e.g. Zed), clicking "Always allow" on a permission prompt stores the approval in the per-project database. If you want the same rule to apply across all projects, you have to manually edit ~/.config/opencode/opencode.json and add the pattern to the permission block.

For common tools like grep, python3, or git, this means repeated prompts in every new project until you remember to update the config by hand.

Proposed solution

Add a fourth option to the ACP permission prompt alongside the existing three:

• Allow once
• Always allow (current project)
• Always allow (all projects) ← new
• Reject

Selecting "Always allow (all projects)" would write the pattern directly into the global config file under the appropriate permission key, making it effective immediately for all projects.

Related

• [BUG] “Always allow” TUI approvals override restrictions for all agents #9554 — "Always allow" scope leaks across agents/sessions in TUI
• PR fix(acp): include shell command and file path in permission prompts #28921 — adds always-allow scope label to the ACP prompt, making this gap more visible