fix(kugetsu): update forked session permissions after detection

Previously we only fixed base session permissions before forking.
But permissions are NOT inherited from parent to child.

Now we update the newly created session's permissions immediately
after detection, ensuring the forked session can access external
directories like ~/.kugetsu/worktrees/.

skills/kugetsu/scripts/kugetsu

@@ -1246,6 +1246,8 @@ cmd_start() {
     local fork_log="$SESSIONS_DIR/$session_file.fork.log"
     local opencode_db="${OPENCODE_DB:-$HOME/.local/share/opencode/opencode.db}"
     
+    fix_session_permissions
+    
     if [ "$DEBUG_MODE" = true ]; then
         (cd "$worktree_path" && opencode run "$message" --fork --session "$base_session_id" 2>&1) | tee "$fork_log" &
     else
@@ -1317,6 +1319,31 @@ for row in cursor.fetchall():
         exit 1
     fi
 
+    echo "Updating permissions for new session: $new_session_id"
+    python3 -c "
+import sqlite3
+conn = sqlite3.connect('$opencode_db')
+cursor = conn.cursor()
+PERMISSION_JSON = '[{\"permission\":\"question\",\"pattern\":\"*\",\"action\":\"deny\"},{\"permission\":\"plan_enter\",\"pattern\":\"*\",\"action\":\"deny\"},{\"permission\":\"plan_exit\",\"pattern\":\"*\",\"action\":\"deny\"},{\"permission\":\"external_directory\",\"pattern\":\"*\",\"action\":\"allow\"}]'
+cursor.execute('UPDATE session SET permission = ? WHERE id = ?', (PERMISSION_JSON, '$new_session_id'))
+conn.commit()
+print('[OK] Session permissions updated')
+"
+
+    if [ "$DEBUG_MODE" = true ]; then
+        echo "[DEBUG] Forked session permissions check:"
+        python3 -c "
+import sqlite3
+conn = sqlite3.connect('$opencode_db')
+cursor = conn.cursor()
+cursor.execute(\"SELECT id, directory, permission FROM session WHERE id = '$new_session_id'\")
+for row in cursor.fetchall():
+    print('  ID:', row[0])
+    print('  Directory:', row[1])
+    print('  Permission:', row[2])
+" 2>/dev/null || echo "  (failed to query DB)"
+    fi
+
     printf '{"type": "forked", "issue_ref": "%s", "opencode_session_id": "%s", "worktree_path": "%s", "created_at": "%s", "state": "idle"}\n' \
         "$issue_ref" "$new_session_id" "$worktree_path" "$(date -Iseconds)" > "$SESSIONS_DIR/$session_file"