feat(token): add refresh token verification to TokenService

feat(bootstrap): create temporary settings and config files to prevent data loss

refactor(edit_log): switch from Vec to VecDeque for efficient memory management

fix(gateway): ensure store directories are created before starting the API server

refactor(bgbash): implement a global singleton for BashControl

feat(auth): enhance session authentication middleware to use SessionRepository

fix(edit_log_repo): update to use VecDeque for in-memory edit log storage

fix(memory_repo): add newline escaping for frontmatter fields

fix(session_lock_repo): improve error handling for lock file operations

fix(bash_tools): prevent path traversal in job_id argument

refactor(delete): enforce empty directory deletion in file system tools

fix(edit): optimize string replacement to only replace the first occurrence

fix(git_cred): improve credential management with piped input to git commands

feat(git_operator): add safety filter to block destructive git operations

fix(shell): register background jobs in Bash control

feat(spawn): add access tier specification for pipeline stages

refactor(hive_mind): run directives concurrently for improved performance

fix(auth): update refresh token verification in the refresh handler

fix(chat): optimize LLM client usage based on model matching

fix(conversations): enhance message deletion to target specific indices

feat(api): add JWT authentication middleware for all API routes

fix(state): implement refresh token verification in JwtTokenService

fix(daemon): improve usage tracking with saturating addition

fix(tui): handle compacted messages in the TUI state management

apps/infrastructure/src/tools/spawn.rs

@@ -151,7 +151,8 @@ impl Tool for SpawnPipeline {
                     "items": {
                         "type": "object",
                         "properties": {
-                            "directive": {"type": "string", "description": "Directive for this pipeline stage"}
+                            "directive": {"type": "string", "description": "Directive for this pipeline stage"},
+                            "access": {"type": "string", "enum": ["read", "write", "full"], "description": "Access tier for this stage"}
                         },
                         "required": ["directive"]
                     },
@@ -200,17 +201,28 @@ impl Tool for SpawnPipeline {
                 .unwrap_or("")
                 .to_string();
 
+            let access_str = stage
+                .get("access")
+                .and_then(|v| v.as_str())
+                .unwrap_or("full");
+
+            let access = match access_str {
+                "read" => AccessTier::Read,
+                "write" => AccessTier::Write,
+                _ => AccessTier::Full,
+            };
+
             let subagent_ctx = SubagentContext::new(
                 directive.clone(),
                 ctx.clone(),
-                "full".to_string(),
+                access_str.to_string(),
                 base_url.clone(),
                 api_key.clone(),
                 model.clone(),
             );
 
             let result = rt.block_on(async {
-                run_agent(subagent_ctx, &directive, AccessTier::Full, ctx.clone()).await
+                run_agent(subagent_ctx, &directive, access, ctx.clone()).await
             })?;
 
             pipeline_result.push_str(&format!("Stage {}: {}\n", i, result));