feat: per-conversation project binding + action-tool consent gate

- Conversations bind to a project on creation; RAG scopes to the
  conversation's project, not the global setting.
- Action tools (web_search/fetch_url/remember) are withheld unless
  allow_action_tools is enabled (off by default). Settings toggle.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

synapse/main.py

@@ -285,12 +285,17 @@ async def chat_stream_endpoint(payload: Dict[str, Any]):
             separator = "\n\n---\nRelevant past exchanges (use as background context only):\n\n"
             system_prompt = (system_prompt + separator + memory_block) if system_prompt else memory_block
 
+        # Resolve the RAG scope: an existing conversation keeps its bound project;
+        # a brand-new one inherits the current workspace (active_project setting).
+        _conv_proj = store.conversation_project(conversation_id)
+        rag_scope = _conv_proj if _conv_proj is not None else app_settings.get("active_project", "")
+
         # Retrieve relevant uploaded documents (RAG) and inject the top chunks.
         doc_hits = await store.search_documents(
             message, get_ollama_manager().embed,
             limit=app_settings.get("rag_top_k", 3),
             min_score=app_settings.get("rag_min_score", 0.6),
-            project_id=app_settings.get("active_project", "") or None,
+            project_id=rag_scope or None,
         )
         doc_titles: list = []
         if doc_hits:
@@ -365,14 +370,20 @@ async def chat_stream_endpoint(payload: Dict[str, Any]):
             metadata["images"] = images
 
         # Tool-using playbook: advertise the active playbook's allowlisted tools.
+        # Action tools (web/fetch/write) are withheld unless the consent gate is on.
         if _main_pb and getattr(_main_pb, "tools", None):
-            schemas = _tools.schemas_for(_main_pb.tools)
+            allow_actions = bool(app_settings.get("allow_action_tools", False))
+            schemas = _tools.schemas_for(_main_pb.tools, allow_actions)
             if schemas:
                 metadata["tools"] = schemas
-                _synapse_trace(f"  TOOLS   : {', '.join(_main_pb.tools)}\n")
+                _granted = [t for t in _main_pb.tools if not _tools.is_action(t) or allow_actions]
+                _withheld = [t for t in _main_pb.tools if _tools.is_action(t) and not allow_actions]
+                _synapse_trace(f"  TOOLS   : {', '.join(_granted)}\n")
+                if _withheld:
+                    _synapse_trace(f"  WITHHELD: {', '.join(_withheld)} (action tools off)\n")
 
         # Persist conversation and user message before streaming
-        store.create_conversation(conversation_id)
+        store.create_conversation(conversation_id, rag_scope or "")
         store.add_message(conversation_id, "user", rendered_message)
 
         async def event_stream() -> AsyncGenerator[str, None]:

synapse/memory/store.py

@@ -140,6 +140,11 @@ class PersistentMemoryStore:
             cur.execute("ALTER TABLE conversations ADD COLUMN title TEXT")
         except Exception:
             pass
+        # Migrate: bind a conversation to a project ("" = unscoped).
+        try:
+            cur.execute("ALTER TABLE conversations ADD COLUMN project_id TEXT NOT NULL DEFAULT ''")
+        except Exception:
+            pass
 
         cur.execute("""
             CREATE TABLE IF NOT EXISTS messages (
@@ -364,20 +369,30 @@ class PersistentMemoryStore:
     # -----------------------------
     # Conversation API
     # -----------------------------
-    def create_conversation(self, conversation_id: str) -> ConversationItem:
+    def create_conversation(self, conversation_id: str, project_id: str = "") -> ConversationItem:
         now = time.time()
         conn = self._connect()
         try:
             cur = conn.cursor()
             cur.execute(
-                "INSERT OR IGNORE INTO conversations (id, created_at, updated_at) VALUES (?, ?, ?)",
-                (conversation_id, now, now)
+                "INSERT OR IGNORE INTO conversations (id, created_at, updated_at, project_id) VALUES (?, ?, ?, ?)",
+                (conversation_id, now, now, project_id or "")
             )
             conn.commit()
         finally:
             conn.close()
         return ConversationItem(id=conversation_id, created_at=now, updated_at=now)
 
+    def conversation_project(self, conversation_id: str) -> Optional[str]:
+        """The conversation's bound project ('' = unscoped), or None if it doesn't
+        exist yet — lets a new chat inherit the current workspace."""
+        conn = self._connect()
+        row = conn.execute(
+            "SELECT project_id FROM conversations WHERE id = ?", (conversation_id,)
+        ).fetchone()
+        conn.close()
+        return None if row is None else (row["project_id"] or "")
+
     def set_conversation_title(self, conversation_id: str, title: str):
         conn = self._connect()
         try:
@@ -983,6 +998,9 @@ class PersistentMemoryStore:
         "rag_min_score": 0.6,
         # Active project/workspace; "" = all documents (unscoped).
         "active_project": "",
+        # Consent gate for tools that act (web_search/fetch_url/remember). Off by
+        # default: a playbook can list them, but they only run when this is on.
+        "allow_action_tools": False,
         "system_prompt": "",
         "timeout": 120,
         # How long Ollama keeps the model resident in VRAM between messages.

synapse/tools.py

@@ -211,9 +211,24 @@ REGISTRY: dict[str, tuple[dict, Callable[..., Awaitable[str]]]] = {
 }
 
 
-def schemas_for(names: list[str]) -> list[dict]:
-    """Tool schemas for a playbook's allowlist; unknown names are dropped."""
-    return [REGISTRY[n][0] for n in (names or []) if n in REGISTRY]
+# Tools that act (write local state or reach the network). These require an
+# explicit consent gate (settings.allow_action_tools) on top of the per-playbook
+# allowlist — a playbook granting one isn't enough on its own.
+ACTION_TOOLS = frozenset({"web_search", "fetch_url", "remember"})
+
+
+def is_action(name: str) -> bool:
+    return name in ACTION_TOOLS
+
+
+def schemas_for(names: list[str], allow_actions: bool = True) -> list[dict]:
+    """Tool schemas for a playbook's allowlist; unknown names are dropped.
+    When allow_actions is False, action tools are withheld so the model can't
+    even call them."""
+    return [
+        REGISTRY[n][0] for n in (names or [])
+        if n in REGISTRY and (allow_actions or not is_action(n))
+    ]
 
 
 async def dispatch(name: str, args: dict | None) -> str: