feat(ui): inflight toast + clamav scan visibility

Adds an indeterminate-progress toast that surfaces while the report
upload is in flight. When the report carries user attachments the toast
calls out that they're being scanned ("Scanning N attachments & sending
report…") so users know the wizard hasn't frozen during a scan that can
take several seconds. Toast is shown for all file types — image risk is
small, but consistent UX beats a confusing inconsistency.

Operator visibility into ClamAV:
- Structured logs in clamav.ts: scan start (size), scan verdict
  (clean / infected:reason / error) with duration in ms
- Repro-Scan-Enabled response header on intake 201 + scanEnabled in the
  JSON body so the SDK / DevTools can confirm whether scanning was on

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: Ripwords

apps/dashboard/server/api/intake/reports.ts

@@ -438,8 +438,10 @@ export default defineEventHandler(async (event) => {
   }
 
   event.node.res.statusCode = 201
+  event.node.res.setHeader("Repro-Scan-Enabled", env.INTAKE_USER_FILE_SCAN_ENABLED ? "1" : "0")
   return {
     id: report.id,
+    scanEnabled: env.INTAKE_USER_FILE_SCAN_ENABLED,
     ...(replayPart ? { replayStored, replayDisabled } : {}),
   }
 })

apps/dashboard/server/lib/clamav.ts

@@ -63,11 +63,21 @@ export async function scanBytes(bytes: Uint8Array): Promise<ScanResult> {
     )
   }
   const stream = Readable.from(Buffer.from(bytes))
+  const start = Date.now()
+  console.info(`[clamav] scan start size=${bytes.byteLength}`)
   try {
     const { isInfected, viruses } = await client.scanStream(stream)
-    if (isInfected) return { clean: false, reason: viruses?.[0] ?? "infected" }
+    const duration = Date.now() - start
+    if (isInfected) {
+      const reason = viruses?.[0] ?? "infected"
+      console.warn(`[clamav] scan verdict=infected:${reason} duration=${duration}ms`)
+      return { clean: false, reason }
+    }
+    console.info(`[clamav] scan verdict=clean duration=${duration}ms`)
     return { clean: true }
   } catch (err) {
+    const duration = Date.now() - start
+    console.error(`[clamav] scan error duration=${duration}ms`, err)
     // Reset the cached client so the next call re-inits — handles transient
     // socket drops cleanly when clamd restarts.
     _client = null

packages/ui/src/reporter.tsx

@@ -5,6 +5,7 @@ import { DEFAULT_ATTACHMENT_LIMITS, validateAttachments, type Attachment } from
 import { StepAnnotate } from "./wizard/step-annotate"
 import { StepDetails } from "./wizard/step-details"
 import { StepReview, type SummaryLine } from "./wizard/step-review"
+import { SubmitToast } from "./wizard/submit-toast"
 import { PrimaryButton, SecondaryButton, WizardHeader } from "./wizard/controls"
 
 export interface ReporterSubmitResult {
@@ -274,6 +275,7 @@ export function Reporter({ onClose, onCapture, onSubmit, openedAt }: ReporterPro
     { class: "ft-wizard" },
     h(WizardHeader, headerProps),
     body,
+    h(SubmitToast, { visible: submitting, attachmentCount: attachments.length }),
     h(
       "footer",
       { class: "ft-wizard-footer" },

packages/ui/src/styles-inline.ts

@@ -403,6 +403,74 @@ export default String.raw`:host,
   font-variant-numeric: tabular-nums;
 }
 
+/* === Submit toast === */
+.ft-toast {
+  position: absolute;
+  top: 100px;
+  right: 24px;
+  background: var(--ft-color-bg);
+  border: 1px solid var(--ft-color-border);
+  border-radius: var(--ft-radius-md);
+  box-shadow: 0 12px 28px -12px rgba(0, 0, 0, 0.18);
+  padding: 12px 14px;
+  display: flex;
+  flex-direction: column;
+  gap: 10px;
+  min-width: 260px;
+  max-width: 320px;
+  z-index: 2;
+  animation: ft-toast-in 200ms ease-out;
+}
+@keyframes ft-toast-in {
+  from {
+    transform: translateY(-8px);
+    opacity: 0;
+  }
+  to {
+    transform: translateY(0);
+    opacity: 1;
+  }
+}
+.ft-toast-row {
+  display: flex;
+  align-items: center;
+  gap: 10px;
+  font-size: 13px;
+  font-weight: 500;
+  color: var(--ft-color-text);
+  line-height: 1.3;
+}
+.ft-toast-icon {
+  font-size: 16px;
+  flex-shrink: 0;
+}
+.ft-toast-progress {
+  height: 4px;
+  background: var(--ft-color-surface);
+  border-radius: 2px;
+  overflow: hidden;
+  position: relative;
+}
+.ft-toast-progress::before {
+  content: "";
+  position: absolute;
+  top: 0;
+  left: 0;
+  bottom: 0;
+  width: 35%;
+  background: var(--ft-color-primary);
+  border-radius: 2px;
+  animation: ft-toast-stripe 1.2s ease-in-out infinite;
+}
+@keyframes ft-toast-stripe {
+  0% {
+    transform: translateX(-100%);
+  }
+  100% {
+    transform: translateX(286%);
+  }
+}
+
 /* === Inline messages === */
 .ft-msg {
   font-size: 12px;

packages/ui/src/styles.css

@@ -400,6 +400,74 @@
   font-variant-numeric: tabular-nums;
 }
 
+/* === Submit toast === */
+.ft-toast {
+  position: absolute;
+  top: 100px;
+  right: 24px;
+  background: var(--ft-color-bg);
+  border: 1px solid var(--ft-color-border);
+  border-radius: var(--ft-radius-md);
+  box-shadow: 0 12px 28px -12px rgba(0, 0, 0, 0.18);
+  padding: 12px 14px;
+  display: flex;
+  flex-direction: column;
+  gap: 10px;
+  min-width: 260px;
+  max-width: 320px;
+  z-index: 2;
+  animation: ft-toast-in 200ms ease-out;
+}
+@keyframes ft-toast-in {
+  from {
+    transform: translateY(-8px);
+    opacity: 0;
+  }
+  to {
+    transform: translateY(0);
+    opacity: 1;
+  }
+}
+.ft-toast-row {
+  display: flex;
+  align-items: center;
+  gap: 10px;
+  font-size: 13px;
+  font-weight: 500;
+  color: var(--ft-color-text);
+  line-height: 1.3;
+}
+.ft-toast-icon {
+  font-size: 16px;
+  flex-shrink: 0;
+}
+.ft-toast-progress {
+  height: 4px;
+  background: var(--ft-color-surface);
+  border-radius: 2px;
+  overflow: hidden;
+  position: relative;
+}
+.ft-toast-progress::before {
+  content: "";
+  position: absolute;
+  top: 0;
+  left: 0;
+  bottom: 0;
+  width: 35%;
+  background: var(--ft-color-primary);
+  border-radius: 2px;
+  animation: ft-toast-stripe 1.2s ease-in-out infinite;
+}
+@keyframes ft-toast-stripe {
+  0% {
+    transform: translateX(-100%);
+  }
+  100% {
+    transform: translateX(286%);
+  }
+}
+
 /* === Inline messages === */
 .ft-msg {
   font-size: 12px;

packages/ui/src/wizard/submit-toast.tsx

@@ -0,0 +1,34 @@
+import { h } from "preact"
+
+interface Props {
+  visible: boolean
+  attachmentCount: number
+}
+
+/**
+ * Inflight toast shown while the report is being uploaded. When the report
+ * carries user attachments we hint that those are being scanned, since
+ * server-side processing can run several seconds when a virus scan is
+ * enabled — reassuring the user that the wizard hasn't frozen.
+ *
+ * The progress bar is intentionally indeterminate: we have no granular
+ * progress signal from a single multipart POST, only "still in flight".
+ */
+export function SubmitToast({ visible, attachmentCount }: Props) {
+  if (!visible) return null
+  const message =
+    attachmentCount > 0
+      ? `Scanning ${attachmentCount} attachment${attachmentCount === 1 ? "" : "s"} & sending report…`
+      : "Sending report…"
+  return h(
+    "div",
+    { class: "ft-toast", role: "status", "aria-live": "polite" },
+    h(
+      "div",
+      { class: "ft-toast-row" },
+      h("span", { class: "ft-toast-icon", "aria-hidden": "true" }, "🛡️"),
+      h("span", null, message),
+    ),
+    h("div", { class: "ft-toast-progress", "aria-hidden": "true" }),
+  )
+}