[andrebrait]

Summary

The image viewer (lightbox) opened every image at 100%, even on phones, so a large screenshot showed as a small corner. The minimum zoom of 25% was still far too large for big images.

• Opens fitted to the screen on every device. The fit is measured from the viewport's content box, so the padding stays visible. Images smaller than the screen stay at their real size instead of being enlarged.
• The zoom percentage is relative to real pixels. A 6000×4000 image opens at 20% on a 1400×900 desktop and at 6% on a 390×844 phone.
• Zoom out goes down to 10%, or to the fitted size for very large images, in ×1.25 steps instead of ±25%.
• Fit to screen and 1:1 buttons replace Reset zoom, with aria-pressed showing which one is active.
• Zooming keeps the centre of the view in place. Going to 1:1 shows the middle of the image, not its top-left corner.
• A zoomed-in image scrolls to every edge. The image is sized by layout instead of transform: scale, which did not grow the scroll area, so the parts beyond the starting size could not be reached.
• An image that fails to load, or has no intrinsic size, is shown as the browser renders it instead of staying hidden.
• The viewer's buttons get 44px targets under the Touch Targets setting, and the toolbar wraps on narrow screens instead of clipping them.
• Works at every Interface Scale. The viewer covers exactly the window, and fit, 1:1 and every percentage are in real screen pixels: the root zoom no longer stretches the image.

Verification

• tsc --noEmit, lint, npm test: 1,219 pass / 0 fail. New tests cover fitZoom (width- and height-limited, no upscaling, zero sizes) and stepZoom (×1.25 steps, the min(fit, 10%) floor, the 800% cap).
• Headless Chromium on an isolated dev server with a 6000×4000 image:
  • Desktop 1400×900: opens at 20%. 1:1 shows 6000×4000, the scroll area is 6048×4048 (every edge reachable), and the view is centred at 50%/50%. Zoom out stops at 10%; Fit returns to 20%.
  • Phone 390×844: opens at 6%, and zoom out is disabled at the fit.
  • A broken image stays visible, with the zoom controls disabled.
  • With data-touch-targets="accessible", all viewer buttons measure 44×44.
• Compact and Large Interface Scale at 1400×900: the viewer covers exactly 1400×900, fit is about 20% at both, and 1:1 measures 6000 screen px. On a 360×760 phone at Large scale with Accessible targets, all five buttons are reachable at 44px.
• One condensed adversarial review round, then Codex and CodeRabbit on the review companion ([companion] fix(image-viewer): open fitted to the screen, with Fit and 1:1 zoom andrebrait/ompweb#85). Every finding is fixed in follow-up commits. CodeRabbit had no comments, and Codex's last review of the final head found nothing.

[kahme247]

Review — approve (SHIP, all three)

Verified by independent review with attack probes and joint-tree merges.

Tool-result images (#223). [hash] validated by ^[a-f0-9]{64}$ (traversal/uppercase/suffix all 404 by test); MIME from magic bytes only (SVG/HTML rejected); nosniff; 16MB memo cap + 30-day sweep. Only new dep is sharp, lock in sync. Non-blocking follow-ups noted: disk-quota cap, sharp as optionalDependency for exotic platforms.

Lightbox (#226). Zoom math sound (fit returns 1 on zero-size; steps clamp to [min(fit,10%), 800%]); native <dialog> focus handling; locales consistent; inline reset SVG replaced with lucide Maximize.

Markdown links (#224). href="" trap closed (rejected schemes arrive as undefined → <span>); anchors stay, externals get target=_blank rel=noopener noreferrer, unopenable locals become plain text; no server-side fetch of attacker URLs (no SSRF). Joint trees compose cleanly.