Route cloud open/preview byte hydration through the Phase 14 byte cache so opening and previewing use the same bounded, owner-scoped, quota-counted cache lifecycle as analysis.
Scope fence: do not change the shared browser analysis queue; this plan only updates existing content routes and their tests.
@.planning/phases/13-virtual-local-cloud-operations/13-CONTEXT.md
@.planning/phases/14-selective-analysis-and-byte-cache/14-PATTERNS.md
@backend/api/cloud/operations.py
@backend/services/cloud_byte_cache.py
@frontend/src/views/CloudFolderView.vue
Task 1: Update backend open/preview/download routes to use cache leases
backend/api/cloud/operations.py, backend/services/cloud_byte_cache.py, backend/tests/test_cloud_cache.py, backend/tests/test_cloud_security.py
- backend/api/cloud/operations.py
- backend/services/cloud_byte_cache.py
- backend/storage/cloud_backend_factory.py
Modify authorized cloud content routes so provider bytes are hydrated into the cache on demand, pinned during active streaming/preview, last-accessed timestamp is updated, and eviction runs after release when needed. Preserve binary-only preview enforcement and no raw provider URL exposure. Existing download fallback remains authorized through DocuVault, not a provider URL.
- Preview/open/download never serve bytes without owner-scoped connection/item resolution.
- Cache hits avoid provider byte fetch.
- Active preview/download cache entries are not evicted mid-response.
- Responses still omit object keys, credentials, and raw provider URLs.
cd backend && pytest -q tests/test_cloud_cache.py tests/test_cloud_security.py -k "preview or download or cache"
Task 2: Preserve frontend open/preview behavior against cached backend
frontend/src/views/__tests__/CloudFolderOpenPreview.test.js
- frontend/src/views/CloudFolderView.vue
- frontend/src/api/cloud.js
- frontend/src/views/__tests__/CloudFolderOpenPreview.test.js
Update frontend tests only if route response metadata changes. Preserve the invariant that `CloudFolderView` calls `api.openCloudFile`/`previewCloudFile` and never opens provider URLs directly. Add assertions that cache-related response fields, if any, do not leak object keys.
- Existing open/preview tests remain green.
- No browser-to-provider URL path is introduced.
- Cache semantics remain backend-owned and do not require frontend object-key knowledge.
cd frontend && npm run test -- CloudFolderOpenPreview.test.js
1. `cd backend && pytest -q tests/test_cloud_cache.py tests/test_cloud_security.py -k "cache or preview or download"`
2. `cd frontend && npm run test -- CloudFolderOpenPreview.test.js`
3. `rg "window.open|provider_url|object_key" frontend/src/views/CloudFolderView.vue frontend/src/api/cloud.js backend/api/cloud/operations.py`
Create .planning/phases/14-selective-analysis-and-byte-cache/14-06-SUMMARY.md when complete.
