Merge branch 'main' of ssh://git.helu.ca:22022/r/mnemosyne

The backend already allows admin delete of a workspace-scoped Library via
the shared delete_library_cascade (commit 142e967), and the confirm-delete
page carries the Daedalus caution. But the detail template was never updated
to match: the Delete button stayed hardcoded `disabled` for any library with
a workspace_id, and the banner said "Do not delete it manually." So the
working route was unreachable from the UI — admins still could not clear an
orphaned Library blocking workspace re-registration.

Make Delete an unconditional enabled link to library:library-delete (the
confirm page already warns), and rewrite the workspace banner to describe the
escape hatch (deleting here removes embedded content; Daedalus recreates and
re-embeds on the next sync) instead of forbidding it.

Template-only change; no view/model/migration changes.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.gitea/workflows/cve-scan-docker-build.yml

@@ -3,8 +3,6 @@ name: CVE Scan & Docker Build
 on:
   push:
     branches: [main]
-  pull_request:
-    branches: [main]
 
 env:
   REGISTRY: git.helu.ca

mnemosyne/library/api/workspaces.py

@@ -17,12 +17,14 @@ across users.
 import logging
 
 from neomodel import db
+from neomodel.exceptions import UniqueProperty
 from rest_framework import status
 from rest_framework.decorators import api_view, permission_classes
 from rest_framework.permissions import IsAuthenticated
 from rest_framework.response import Response
 
 from library.content_types import get_library_type_config
+from library.services.library_delete import delete_library_cascade
 
 from .serializers import WorkspaceCreateSerializer, WorkspaceStatusSerializer
 
@@ -84,7 +86,10 @@ def workspace_create(request):
                 data["workspace_id"], request.user.username,
             )
             return Response(
-                {"detail": "Workspace id is already in use."},
+                {
+                    "detail": "Workspace id is already in use.",
+                    "code": "owner_conflict",
+                },
                 status=status.HTTP_409_CONFLICT,
             )
         if existing.library_type != data["library_type"]:
@@ -94,7 +99,8 @@ def workspace_create(request):
                         "library_type is immutable for an existing workspace "
                         f"(have '{existing.library_type}', "
                         f"got '{data['library_type']}')."
-                    )
+                    ),
+                    "code": "library_type_immutable",
                 },
                 status=status.HTTP_409_CONFLICT,
             )
@@ -119,7 +125,29 @@ def workspace_create(request):
         reranker_instruction=defaults["reranker_instruction"],
         llm_context_prompt=defaults["llm_context_prompt"],
     )
-    lib.save()
+    try:
+        lib.save()
+    except UniqueProperty:
+        # Library.name is globally unique. A name collision here almost always
+        # means an orphaned Library survived a failed Daedalus workspace delete
+        # (the old node kept the name), and the recreate under a new
+        # workspace_id now clashes. Surface a clean 409 instead of a 500 so
+        # Daedalus can record + report it; the operator clears the orphan
+        # (admin delete) or renames the workspace.
+        logger.warning(
+            "workspace_create name_conflict workspace_id=%s name=%s",
+            data["workspace_id"], data["name"],
+        )
+        return Response(
+            {
+                "detail": (
+                    f"A library named '{data['name']}' already exists in "
+                    "Mnemosyne."
+                ),
+                "code": "name_conflict",
+            },
+            status=status.HTTP_409_CONFLICT,
+        )
     logger.info(
         "Workspace created workspace_id=%s library_uid=%s library_type=%s",
         data["workspace_id"], lib.uid, lib.library_type,
@@ -165,74 +193,15 @@ def workspace_detail_or_delete(request, workspace_id):
     if lib is None:
         return Response(status=status.HTTP_204_NO_CONTENT)
 
-    library_uid = lib.uid
+    # Delete the Library and everything reachable + unique to it, plus
-    library_name = lib.name
+    # orphan-Concept GC. Shared with the admin/HTML delete path.
-
+    result = delete_library_cascade(lib)
-    # Step 1-4: delete chunks, items, collections, then the library itself.
-    # We collect Item s3_keys first so the caller can clean up S3
-    # asynchronously (a future enhancement — for now, the keys are logged).
-    s3_rows, _ = db.cypher_query(
-        "MATCH (l:Library {workspace_id: $wsid})-[:CONTAINS]->(:Collection)"
-        "-[:CONTAINS]->(i:Item) RETURN i.uid, i.s3_key",
-        {"wsid": workspace_id},
-    )
-    item_s3_keys = [(r[0], r[1]) for r in s3_rows if r[1]]
-
-    db.cypher_query(
-        """
-        MATCH (l:Library {workspace_id: $wsid})-[:CONTAINS]->(:Collection)
-        -[:CONTAINS]->(i:Item)-[:HAS_CHUNK]->(c:Chunk)
-        DETACH DELETE c
-        """,
-        {"wsid": workspace_id},
-    )
-    db.cypher_query(
-        """
-        MATCH (l:Library {workspace_id: $wsid})-[:CONTAINS]->(:Collection)
-        -[:CONTAINS]->(i:Item)-[:HAS_IMAGE]->(img:Image)
-        OPTIONAL MATCH (img)-[:HAS_EMBEDDING]->(emb:ImageEmbedding)
-        DETACH DELETE img, emb
-        """,
-        {"wsid": workspace_id},
-    )
-    db.cypher_query(
-        """
-        MATCH (l:Library {workspace_id: $wsid})-[:CONTAINS]->(:Collection)
-        -[:CONTAINS]->(i:Item)
-        DETACH DELETE i
-        """,
-        {"wsid": workspace_id},
-    )
-    db.cypher_query(
-        """
-        MATCH (l:Library {workspace_id: $wsid})-[:CONTAINS]->(col:Collection)
-        DETACH DELETE col
-        """,
-        {"wsid": workspace_id},
-    )
-    db.cypher_query(
-        "MATCH (l:Library {workspace_id: $wsid}) DETACH DELETE l",
-        {"wsid": workspace_id},
-    )
-
-    # Step 5: orphan Concept garbage collection.
-    orphan_result, _ = db.cypher_query(
-        """
-        MATCH (con:Concept)
-        WHERE NOT (con)<-[:REFERENCES]-() AND NOT (con)<-[:MENTIONS]-()
-              AND NOT (con)<-[:DEPICTS]-()
-        WITH con
-        DETACH DELETE con
-        RETURN count(con) AS deleted
-        """
-    )
-    orphans_deleted = orphan_result[0][0] if orphan_result else 0
 
     logger.info(
         "Workspace deleted workspace_id=%s library_uid=%s name=%s "
         "items=%d orphans_deleted=%d",
-        workspace_id, library_uid, library_name,
+        workspace_id, result["library_uid"], result["name"],
-        len(item_s3_keys), orphans_deleted,
+        result["item_count"], result["orphans_deleted"],
     )
 
     return Response(status=status.HTTP_204_NO_CONTENT)

mnemosyne/library/services/library_delete.py

@@ -0,0 +1,108 @@
+"""
+Shared Library deletion cascade.
+
+Deletes a Library node and everything reachable AND unique to it
+(Collections, Items, Chunks, Images + ImageEmbeddings), then garbage-collects
+Concepts that are no longer referenced by any other Library.
+
+Keyed on the Library ``uid`` so it works for *both* global libraries
+(``workspace_id`` is null) and workspace-scoped libraries. This is the single
+source of truth used by:
+
+  * the Daedalus integration API (``DELETE /library/api/workspaces/{id}/``), and
+  * the admin/HTML delete view (``library_delete``).
+
+Concept-safe: orphan-only Concept GC happens at the end. Concepts still
+referenced by another library (workspace or global) are preserved.
+"""
+
+import logging
+
+from neomodel import db
+
+logger = logging.getLogger(__name__)
+
+
+def delete_library_cascade(lib) -> dict:
+    """Delete ``lib`` and all content reachable and unique to it.
+
+    :param lib: A ``library.models.Library`` node instance.
+    :returns: Dict with ``library_uid``, ``name``, ``item_count``,
+        ``item_s3_keys`` (list of ``(uid, s3_key)`` for async S3 cleanup),
+        and ``orphans_deleted`` (Concept GC count).
+    """
+    library_uid = lib.uid
+    library_name = lib.name
+
+    # Collect Item s3_keys first so the caller can clean up S3 asynchronously
+    # (a future enhancement — for now, the keys are returned/logged).
+    s3_rows, _ = db.cypher_query(
+        "MATCH (l:Library {uid: $uid})-[:CONTAINS]->(:Collection)"
+        "-[:CONTAINS]->(i:Item) RETURN i.uid, i.s3_key",
+        {"uid": library_uid},
+    )
+    item_s3_keys = [(r[0], r[1]) for r in s3_rows if r[1]]
+
+    db.cypher_query(
+        """
+        MATCH (l:Library {uid: $uid})-[:CONTAINS]->(:Collection)
+        -[:CONTAINS]->(i:Item)-[:HAS_CHUNK]->(c:Chunk)
+        DETACH DELETE c
+        """,
+        {"uid": library_uid},
+    )
+    db.cypher_query(
+        """
+        MATCH (l:Library {uid: $uid})-[:CONTAINS]->(:Collection)
+        -[:CONTAINS]->(i:Item)-[:HAS_IMAGE]->(img:Image)
+        OPTIONAL MATCH (img)-[:HAS_EMBEDDING]->(emb:ImageEmbedding)
+        DETACH DELETE img, emb
+        """,
+        {"uid": library_uid},
+    )
+    db.cypher_query(
+        """
+        MATCH (l:Library {uid: $uid})-[:CONTAINS]->(:Collection)
+        -[:CONTAINS]->(i:Item)
+        DETACH DELETE i
+        """,
+        {"uid": library_uid},
+    )
+    db.cypher_query(
+        """
+        MATCH (l:Library {uid: $uid})-[:CONTAINS]->(col:Collection)
+        DETACH DELETE col
+        """,
+        {"uid": library_uid},
+    )
+    db.cypher_query(
+        "MATCH (l:Library {uid: $uid}) DETACH DELETE l",
+        {"uid": library_uid},
+    )
+
+    # Orphan Concept garbage collection: drop Concepts no longer referenced
+    # by any Item (REFERENCES/MENTIONS) or Image (DEPICTS).
+    orphan_result, _ = db.cypher_query(
+        """
+        MATCH (con:Concept)
+        WHERE NOT (con)<-[:REFERENCES]-() AND NOT (con)<-[:MENTIONS]-()
+              AND NOT (con)<-[:DEPICTS]-()
+        WITH con
+        DETACH DELETE con
+        RETURN count(con) AS deleted
+        """
+    )
+    orphans_deleted = orphan_result[0][0] if orphan_result else 0
+
+    logger.info(
+        "Library cascade-deleted library_uid=%s name=%s items=%d orphans_deleted=%d",
+        library_uid, library_name, len(item_s3_keys), orphans_deleted,
+    )
+
+    return {
+        "library_uid": library_uid,
+        "name": library_name,
+        "item_count": len(item_s3_keys),
+        "item_s3_keys": item_s3_keys,
+        "orphans_deleted": orphans_deleted,
+    }

mnemosyne/library/templates/library/library_confirm_delete.html

@@ -12,6 +12,18 @@
     <div class="alert alert-warning mb-6">
         <span>Are you sure you want to delete <strong>{{ library.name }}</strong>? This action cannot be undone.</span>
     </div>
+    {% if library.workspace_id %}
+    <div class="alert alert-error mb-6">
+        <span>
+            <strong>This Library is managed by Daedalus</strong>
+            (workspace <code>{{ library.workspace_id }}</code>).
+            Deleting it here removes its embedded content from Mnemosyne, but the
+            source files still live in Daedalus — it will be <strong>recreated and
+            re-embedded on the next Daedalus sync</strong>. Use this to clear an
+            orphaned Library that is blocking workspace re-registration.
+        </span>
+    </div>
+    {% endif %}
     <form method="post">
         {% csrf_token %}
         <div class="flex gap-2">

mnemosyne/library/templates/library/library_detail.html

@@ -25,14 +25,7 @@
     </div>
     <div class="flex gap-2">
         <a href="{% url 'library:library-edit' uid=library.uid %}" class="btn btn-sm btn-outline">Edit</a>
-        {% if library.workspace_id %}
-        <button type="button" class="btn btn-sm btn-error btn-outline" disabled
-                title="This library is managed by Daedalus. Delete it from the Daedalus workspace, not here.">
-            Delete
-        </button>
-        {% else %}
         <a href="{% url 'library:library-delete' uid=library.uid %}" class="btn btn-sm btn-error btn-outline">Delete</a>
-        {% endif %}
     </div>
 </div>
 
@@ -43,8 +36,11 @@
         <div class="text-sm opacity-80">
             This library was created for Daedalus workspace
             <code class="font-mono">{{ library.workspace_id }}</code>.
-            Items here are owned by the workspace; deleting the workspace in
+            Normally you manage it from Daedalus. Deleting it here removes its
-            Daedalus will remove this library. Do not delete it manually.
+            embedded content from Mnemosyne, but the source files still live in
+            Daedalus — it will be recreated and re-embedded on the next sync.
+            Use Delete to clear an orphaned library that is blocking workspace
+            re-registration.
         </div>
     </div>
 </div>

mnemosyne/library/views.py

@@ -319,20 +319,20 @@ def library_delete(request, uid):
         messages.error(request, f"Library not found: {e}")
         return redirect("library:library-list")
 
-    # Daedalus owns the lifecycle of workspace-scoped libraries — they can
+    # Daedalus owns the lifecycle of workspace-scoped libraries. Deleting one
-    # only be deleted via DELETE /library/api/workspaces/{workspace_id}/.
+    # here is allowed but discouraged: the confirm page warns that Daedalus
-    # Block the human delete path so a stray click can't desync state.
+    # still holds the source content and will recreate + re-embed it on the
-    if lib.workspace_id:
+    # next sync. The risk is low (no data loss — only re-embedding cost), and
-        messages.error(
+    # this is the supported escape hatch for clearing an orphaned Library that
-            request,
+    # blocks workspace re-registration.
-            f'"{lib.name}" is managed by Daedalus workspace '
-            f"{lib.workspace_id}. Delete it from Daedalus, not here.",
-        )
-        return redirect("library:library-detail", uid=uid)
-
     if request.method == "POST":
         name = lib.name
-        lib.delete()
+        # Use the shared cascade so child nodes (Collections/Items/Chunks/
+        # Images) and orphan Concepts are removed too — a bare lib.delete()
+        # would leak them.
+        from .services.library_delete import delete_library_cascade
+
+        delete_library_cascade(lib)
         messages.success(request, f'Library "{name}" deleted.')
         return redirect("library:library-list")
     return render(request, "library/library_confirm_delete.html", {"library": lib})

mnemosyne/mnemosyne/settings.py

@@ -23,8 +23,9 @@ env = environ.Env(
     DEBUG=(bool, True),
 )
 
-# Read .env file if it exists
+# Read .env file if it exists. Lives at the repo root (one level above the
-environ.Env.read_env(BASE_DIR / ".env")
+# Django project package), shared with the docker-compose stack.
+environ.Env.read_env(BASE_DIR.parent / ".env")
 
 # --- Security ---
 SECRET_KEY = env("SECRET_KEY", default="django-insecure-change-me-in-production")