fix(kugetsu): update forked session permissions after detection

Previously we only fixed base session permissions before forking.
But permissions are NOT inherited from parent to child.

Now we update the newly created session's permissions immediately
after detection, ensuring the forked session can access external
directories like ~/.kugetsu/worktrees/.

skills/kugetsu/scripts/kugetsu

@@ -146,8 +146,9 @@ issue_ref_to_worktree_name() {
 
 issue_ref_to_worktree_path() {
     local issue_ref="$1"
+    local parent_dir="${2:-$WORKTREES_DIR}"
     local worktree_name=$(issue_ref_to_worktree_name "$issue_ref")
-    echo "$WORKTREES_DIR/$worktree_name"
+    echo "$parent_dir/.kugetsu-worktrees/$worktree_name"
 }
 
 issue_ref_to_branch_name() {
@@ -195,13 +196,15 @@ get_repo_url() {
 
 worktree_exists() {
     local issue_ref="$1"
-    local worktree_path=$(issue_ref_to_worktree_path "$issue_ref")
+    local parent_dir="${2:-$PWD}"
+    local worktree_path=$(issue_ref_to_worktree_path "$issue_ref" "$parent_dir")
     [ -d "$worktree_path" ]
 }
 
 create_worktree() {
     local issue_ref="$1"
-    local worktree_path=$(issue_ref_to_worktree_path "$issue_ref")
+    local parent_dir="${2:-$PWD}"
+    local worktree_path=$(issue_ref_to_worktree_path "$issue_ref" "$parent_dir")
     local branch_name=$(issue_ref_to_branch_name "$issue_ref")
     local repo_url=$(get_repo_url "$issue_ref")
     
@@ -211,9 +214,10 @@ create_worktree() {
         exit 1
     fi
     
-    ensure_worktree_dir
+    local worktree_parent_dir=$(dirname "$worktree_path")
+    mkdir -p "$worktree_parent_dir"
     
-    if worktree_exists "$issue_ref"; then
+    if worktree_exists "$issue_ref" "$parent_dir"; then
         echo "Removing existing worktree at '$worktree_path'..."
         git worktree remove "$worktree_path" 2>/dev/null || rm -rf "$worktree_path"
     fi
@@ -234,9 +238,10 @@ create_worktree() {
 
 remove_worktree_for_issue() {
     local issue_ref="$1"
-    local worktree_path=$(issue_ref_to_worktree_path "$issue_ref")
+    local parent_dir="${2:-$PWD}"
+    local worktree_path=$(issue_ref_to_worktree_path "$issue_ref" "$parent_dir")
     
-    if worktree_exists "$issue_ref"; then
+    if worktree_exists "$issue_ref" "$parent_dir"; then
         echo "Removing worktree at '$worktree_path'..."
         git worktree remove "$worktree_path" 2>/dev/null || rm -rf "$worktree_path"
     fi
@@ -1215,8 +1220,9 @@ cmd_start() {
         exit 1
     fi
 
-    local worktree_path=$(issue_ref_to_worktree_path "$issue_ref")
-    create_worktree "$issue_ref"
+    local parent_dir="$PWD"
+    local worktree_path=$(issue_ref_to_worktree_path "$issue_ref" "$parent_dir")
+    create_worktree "$issue_ref" "$parent_dir"
 
     local session_file="$(issue_ref_to_filename "$issue_ref").json"
 
@@ -1233,28 +1239,35 @@ cmd_start() {
     if [ "$active_count" -ge "$MAX_CONCURRENT_AGENTS" ]; then
         echo "Error: Max concurrent agents ($MAX_CONCURRENT_AGENTS) reached" >&2
         echo "Active sessions: $active_count" >&2
-        remove_worktree_for_issue "$issue_ref"
+        remove_worktree_for_issue "$issue_ref" "$parent_dir"
         exit 1
     fi
     
+    local fork_log="$SESSIONS_DIR/$session_file.fork.log"
+    local opencode_db="${OPENCODE_DB:-$HOME/.local/share/opencode/opencode.db}"
+    
+    fix_session_permissions
+    
     if [ "$DEBUG_MODE" = true ]; then
-        opencode run "$message" --fork --session "$base_session_id" --dir "$worktree_path" 2>&1 | tee "$SESSIONS_DIR/$session_file.debug.log" &
+        (cd "$worktree_path" && opencode run "$message" --fork --session "$base_session_id" 2>&1) | tee "$fork_log" &
     else
-        opencode run "$message" --fork --session "$base_session_id" --dir "$worktree_path" 2>&1 &
+        (cd "$worktree_path" && opencode run "$message" --fork --session "$base_session_id" 2>&1) >> "$fork_log" &
     fi
 
-    # Wait briefly for session to be created
+    local fork_pid=$!
+    
+    local max_attempts=10
+    local attempt=1
+    local new_session_id=""
+    local fork_log_output=""
+    
+    while [ $attempt -le $max_attempts ]; do
         sleep 1
         
-    # Find the new session by comparing before/after lists
-    # Skip any session that existed before the fork and skip base/pm-agent
-    local new_session_id=""
         while IFS= read -r sess; do
-        # Skip base and pm-agent
             [ "$sess" = "$base_session_id" ] && continue
             [ "$sess" = "$pm_agent_session_id" ] && continue
             
-        # Check if this session existed before
             local existed_before=false
             for before_sess in "${before_sessions[@]}"; do
                 if [ "$sess" = "$before_sess" ]; then
@@ -1269,12 +1282,68 @@ cmd_start() {
             fi
         done < <(opencode session list 2>/dev/null | grep -oP '^ses_\w+')
         
+        if [ -n "$new_session_id" ]; then
+            break
+        fi
+        
+        if ! kill -0 $fork_pid 2>/dev/null; then
+            fork_log_output=$(tail -20 "$fork_log" 2>/dev/null || echo "(log empty or unavailable)")
+            break
+        fi
+        
+        attempt=$((attempt + 1))
+    done
+
     if [ -z "$new_session_id" ]; then
-        echo "Error: Could not find newly created session" >&2
+        if [ -f "$opencode_db" ]; then
+            local db_sessions=$(python3 -c "
+import sqlite3
+conn = sqlite3.connect('$opencode_db')
+cursor = conn.cursor()
+cursor.execute(\"SELECT id FROM session WHERE parent_id IS NOT NULL ORDER BY time_created DESC LIMIT 5\")
+for row in cursor.fetchall():
+    print(row[0])
+" 2>/dev/null || echo "")
+            if [ -n "$db_sessions" ]; then
+                echo "Recent forked sessions in DB:" >&2
+                echo "$db_sessions" >&2
+            fi
+        fi
+        
+        echo "Error: Could not find newly created session after ${max_attempts}s" >&2
+        if [ -n "$fork_log_output" ]; then
+            echo "Fork log output:" >&2
+            echo "$fork_log_output" >&2
+        fi
         remove_worktree_for_issue "$issue_ref"
         exit 1
     fi
 
+    echo "Updating permissions for new session: $new_session_id"
+    python3 -c "
+import sqlite3
+conn = sqlite3.connect('$opencode_db')
+cursor = conn.cursor()
+PERMISSION_JSON = '[{\"permission\":\"question\",\"pattern\":\"*\",\"action\":\"deny\"},{\"permission\":\"plan_enter\",\"pattern\":\"*\",\"action\":\"deny\"},{\"permission\":\"plan_exit\",\"pattern\":\"*\",\"action\":\"deny\"},{\"permission\":\"external_directory\",\"pattern\":\"*\",\"action\":\"allow\"}]'
+cursor.execute('UPDATE session SET permission = ? WHERE id = ?', (PERMISSION_JSON, '$new_session_id'))
+conn.commit()
+print('[OK] Session permissions updated')
+"
+
+    if [ "$DEBUG_MODE" = true ]; then
+        echo "[DEBUG] Forked session permissions check:"
+        python3 -c "
+import sqlite3
+conn = sqlite3.connect('$opencode_db')
+cursor = conn.cursor()
+cursor.execute(\"SELECT id, directory, permission FROM session WHERE id = '$new_session_id'\")
+for row in cursor.fetchall():
+    print('  ID:', row[0])
+    print('  Directory:', row[1])
+    print('  Permission:', row[2])
+" 2>/dev/null || echo "  (failed to query DB)"
+    fi
+
     printf '{"type": "forked", "issue_ref": "%s", "opencode_session_id": "%s", "worktree_path": "%s", "created_at": "%s", "state": "idle"}\n' \
         "$issue_ref" "$new_session_id" "$worktree_path" "$(date -Iseconds)" > "$SESSIONS_DIR/$session_file"
 
@@ -1331,9 +1400,9 @@ cmd_continue() {
     if [ -n "$worktree_path" ] && [ -d "$worktree_path" ]; then
         echo "Using worktree: $worktree_path"
         if [ "$DEBUG_MODE" = true ]; then
-            opencode run "$message" --continue --session "$opencode_session_id" --dir "$worktree_path" 2>&1 | tee "$session_path.debug.log" &
+            (cd "$worktree_path" && opencode run "$message" --continue --session "$opencode_session_id" 2>&1) | tee "$session_path.debug.log" &
         else
-            opencode run "$message" --continue --session "$opencode_session_id" --dir "$worktree_path" 2>&1 &
+            (cd "$worktree_path" && opencode run "$message" --continue --session "$opencode_session_id" 2>&1) &
         fi
     else
         if [ "$DEBUG_MODE" = true ]; then