fix: use ${GITEA_TOKEN:-} to handle unset token and initialize env during init

With set -u, expanding $GITEA_TOKEN fails if not set.
Changed to ${GITEA_TOKEN:-} to provide empty default.

Also initializes $ENV_DIR/default.env during kugetsu init
so users are aware of the env file structure.

skills/kugetsu/scripts/kugetsu-session.sh

@@ -58,6 +58,25 @@ EOF
         echo "Created config file: $KUGETSU_DIR/config"
     fi
 
+    mkdir -p "$ENV_DIR"
+    if [ ! -f "$ENV_DIR/default.env" ]; then
+        cat > "$ENV_DIR/default.env" << 'EOF'
+# Environment variables for agents
+# Copy this file to <agent-type>.env (e.g., pm-agent.env, dev.env)
+# and set your tokens and configuration
+
+# Required: Gitea token for API access
+# GITEA_TOKEN=your_gitea_token_here
+
+# Optional: GitHub token (if using GitHub)
+# GITHUB_TOKEN=your_github_token_here
+
+# Optional: GitLab token (if using GitLab)
+# GITLAB_TOKEN=your_gitlab_token_here
+EOF
+        echo "Created env template: $ENV_DIR/default.env"
+    fi
+
     local existing_base=$(get_base_session_id)
     local existing_pm=$(get_pm_agent_session_id)
     
@@ -195,7 +214,7 @@ cmd_delegate() {
     mkdir -p "$LOGS_DIR"
     local log_file="$LOGS_DIR/delegate-$(date +%s).log"
     load_agent_env "pm-agent"
-    nohup sh -c "GITEA_TOKEN='$GITEA_TOKEN' opencode run '$message' --continue --session '$pm_session'" >> "$log_file" 2>&1 &
+    nohup sh -c "GITEA_TOKEN='${GITEA_TOKEN:-}' opencode run '$message' --continue --session '$pm_session'" >> "$log_file" 2>&1 &
     echo "Delegated to PM agent (logged to $(basename "$log_file"))"
 }
 
@@ -314,7 +333,7 @@ cmd_start() {
     load_agent_env "dev"
     
     cd "$worktree_path"
-    nohup sh -c "GITEA_TOKEN='$GITEA_TOKEN' opencode run '$dev_message' --continue --session '$new_session_id'" >> "$LOGS_DIR/dev-$new_session_id.log" 2>&1 &
+    nohup sh -c "GITEA_TOKEN='${GITEA_TOKEN:-}' opencode run '$dev_message' --continue --session '$new_session_id'" >> "$LOGS_DIR/dev-$new_session_id.log" 2>&1 &
     
     echo "Session started for '$issue_ref': $new_session_id"
     echo "Worktree: $worktree_path"
@@ -369,9 +388,9 @@ cmd_continue() {
     
     if [ -n "$worktree_path" ] && [ -d "$worktree_path" ]; then
         cd "$worktree_path"
-        nohup sh -c "GITEA_TOKEN='$GITEA_TOKEN' opencode run '$message' --continue --session '$opencode_session_id'" >> "$LOGS_DIR/dev-$opencode_session_id.log" 2>&1 &
+        nohup sh -c "GITEA_TOKEN='${GITEA_TOKEN:-}' opencode run '$message' --continue --session '$opencode_session_id'" >> "$LOGS_DIR/dev-$opencode_session_id.log" 2>&1 &
     else
-        nohup sh -c "GITEA_TOKEN='$GITEA_TOKEN' opencode run '$message' --continue --session '$opencode_session_id'" >> "$LOGS_DIR/dev-$opencode_session_id.log" 2>&1 &
+        nohup sh -c "GITEA_TOKEN='${GITEA_TOKEN:-}' opencode run '$message' --continue --session '$opencode_session_id'" >> "$LOGS_DIR/dev-$opencode_session_id.log" 2>&1 &
     fi
 }
 
@@ -523,7 +542,7 @@ cmd_destroy() {
     local target="${1:-}"
     local force=false
     
-    if [ "$2" = "-y" ]; then
+    if [ "${2:-}" = "-y" ]; then
         force=true
     fi