fix(kugetsu): update forked session permissions after detection

Previously we only fixed base session permissions before forking.
But permissions are NOT inherited from parent to child.

Now we update the newly created session's permissions immediately
after detection, ensuring the forked session can access external
directories like ~/.kugetsu/worktrees/.

skills/kugetsu/scripts/kugetsu

@@ -1244,6 +1244,9 @@ cmd_start() {
     fi
     
     local fork_log="$SESSIONS_DIR/$session_file.fork.log"
+    local opencode_db="${OPENCODE_DB:-$HOME/.local/share/opencode/opencode.db}"
+    
+    fix_session_permissions
     
     if [ "$DEBUG_MODE" = true ]; then
         (cd "$worktree_path" && opencode run "$message" --fork --session "$base_session_id" 2>&1) | tee "$fork_log" &
@@ -1256,18 +1259,11 @@ cmd_start() {
     local max_attempts=10
     local attempt=1
     local new_session_id=""
+    local fork_log_output=""
     
     while [ $attempt -le $max_attempts ]; do
         sleep 1
         
-        if ! kill -0 $fork_pid 2>/dev/null; then
-            if [ -s "$fork_log" ]; then
-                echo "Fork command exited. Log output:" >&2
-                tail -20 "$fork_log" >&2
-            fi
-            break
-        fi
-        
         while IFS= read -r sess; do
             [ "$sess" = "$base_session_id" ] && continue
             [ "$sess" = "$pm_agent_session_id" ] && continue
@@ -1290,19 +1286,64 @@ cmd_start() {
             break
         fi
         
+        if ! kill -0 $fork_pid 2>/dev/null; then
+            fork_log_output=$(tail -20 "$fork_log" 2>/dev/null || echo "(log empty or unavailable)")
+            break
+        fi
+        
         attempt=$((attempt + 1))
     done
 
     if [ -z "$new_session_id" ]; then
+        if [ -f "$opencode_db" ]; then
+            local db_sessions=$(python3 -c "
+import sqlite3
+conn = sqlite3.connect('$opencode_db')
+cursor = conn.cursor()
+cursor.execute(\"SELECT id FROM session WHERE parent_id IS NOT NULL ORDER BY time_created DESC LIMIT 5\")
+for row in cursor.fetchall():
+    print(row[0])
+" 2>/dev/null || echo "")
+            if [ -n "$db_sessions" ]; then
+                echo "Recent forked sessions in DB:" >&2
+                echo "$db_sessions" >&2
+            fi
+        fi
+        
         echo "Error: Could not find newly created session after ${max_attempts}s" >&2
-        if [ -f "$fork_log" ] && [ -s "$fork_log" ]; then
-            echo "Fork log:" >&2
-            tail -30 "$fork_log" >&2
+        if [ -n "$fork_log_output" ]; then
+            echo "Fork log output:" >&2
+            echo "$fork_log_output" >&2
         fi
         remove_worktree_for_issue "$issue_ref"
         exit 1
     fi
 
+    echo "Updating permissions for new session: $new_session_id"
+    python3 -c "
+import sqlite3
+conn = sqlite3.connect('$opencode_db')
+cursor = conn.cursor()
+PERMISSION_JSON = '[{\"permission\":\"question\",\"pattern\":\"*\",\"action\":\"deny\"},{\"permission\":\"plan_enter\",\"pattern\":\"*\",\"action\":\"deny\"},{\"permission\":\"plan_exit\",\"pattern\":\"*\",\"action\":\"deny\"},{\"permission\":\"external_directory\",\"pattern\":\"*\",\"action\":\"allow\"}]'
+cursor.execute('UPDATE session SET permission = ? WHERE id = ?', (PERMISSION_JSON, '$new_session_id'))
+conn.commit()
+print('[OK] Session permissions updated')
+"
+
+    if [ "$DEBUG_MODE" = true ]; then
+        echo "[DEBUG] Forked session permissions check:"
+        python3 -c "
+import sqlite3
+conn = sqlite3.connect('$opencode_db')
+cursor = conn.cursor()
+cursor.execute(\"SELECT id, directory, permission FROM session WHERE id = '$new_session_id'\")
+for row in cursor.fetchall():
+    print('  ID:', row[0])
+    print('  Directory:', row[1])
+    print('  Permission:', row[2])
+" 2>/dev/null || echo "  (failed to query DB)"
+    fi
+
     printf '{"type": "forked", "issue_ref": "%s", "opencode_session_id": "%s", "worktree_path": "%s", "created_at": "%s", "state": "idle"}\n' \
         "$issue_ref" "$new_session_id" "$worktree_path" "$(date -Iseconds)" > "$SESSIONS_DIR/$session_file"