Make every analysis reachable, and reachable from the landing page

Found by operating the site rather than reading it. The accessibility
tree's own summary of the landing page was that there is no way to reach
the tool from it --- the primary button read "read the docs", which is not
what somebody arriving with an address wants to do. The nav now opens a
case from every page and the landing leads with it.

The case view offered three analyses of thirteen, because the list was a
literal in the component. Clustering, peel chains, taint, mixer and the
rest were installed, documented and reachable from the CLI, and invisible
here. `/analyses` now serves the entry-point registry, so the page cannot
drift from what is installed, and reports plugins that failed to import
rather than silently omitting them. The dispatcher runs any registered
analyzer instead of matching four names.

The landing lists all thirteen with what each cannot tell you, and each
links into the case view with that analyzer preselected.

Three problems the walkthrough surfaced, all of which would have shipped:

Thirteen buttons under `flex: 1` divided one row between them and
truncated every label to three characters. Content width and wrapping.

`temporal` returned `AttributeError: 'NoneType' object has no attribute
'enumerate'` --- this handler passes no router by design, and the analyzer
reached for one. It now says it needs to fetch and names the CLI command
that can.

`taint` and `mixer` demanded parameters the page gave no way to supply.
Analyzers declare `REQUIRES` and the page renders an input per entry. The
test checks declarations against `run()`'s signature, which immediately
caught that I had declared `funder` for `common_funder` when it takes
`addresses` --- the error message I had matched belonged to a different
class in the same file.

Hiding inapplicable analyses over-corrected at first and hid all thirteen,
visible only by looking again: the browser had cached the bundle from
before the server grew the field. Which is itself the bug --- HTML carries
this run's token and must never be cached, so it is now `no-store`, with
the content-hashed assets cached hard.

Also adds `code_at`/`is_eoa_at` for historical `eth_getCode`, and lets an
endpoint declare archive state via `CHAINSCOPE_RPC_<NAME>_ARCHIVE`.
Without it every historical `eth_call` was refused, so "was this an EOA at
block b" and "what were this token's decimals then" could only be answered
about the present --- a different question with a plausible-looking answer.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FXWQ25VgFeMuuMhGWjvdof

Author: Toby1009

src/chainscope/analysis/funding.py

@@ -36,7 +36,7 @@
 from dataclasses import dataclass, field
 from datetime import datetime, timezone
 from functools import partial
-from typing import Any
+from typing import Any, ClassVar
 
 from ..chains import fold_if_hex
 from ..core.attribution import Attribution, Category, Confidence, Method
@@ -269,6 +269,12 @@ def _history(
 class CommonFunderAnalyzer(Analyzer):
     """Group addresses by who first funded them."""
 
+    #: Parameters this needs beyond an address. Read by the web UI to
+    #: render an input for each, so a reader is not asked to press a button
+    #: whose only possible outcome is an error naming what they should have
+    #: typed. Kept beside the check that enforces it.
+    REQUIRES: ClassVar[tuple[str, ...]] = ("addresses",)
+
     name = "common-funder"
     version = "1.0"
     description = "Group account-model addresses by who first funded them"

src/chainscope/analysis/mixer.py

@@ -78,7 +78,7 @@
 from dataclasses import dataclass, field
 from datetime import datetime, timezone
 from functools import partial
-from typing import Any
+from typing import Any, ClassVar
 
 from ..chains import fold_if_hex
 from ..core.attribution import Attribution, Category, Confidence, Method
@@ -403,6 +403,12 @@ def _transaction(provider: Any, *, chain: ChainId, tx_hash: str) -> Any:
 class MixerAnalyzer(Analyzer):
     """Correlate deposits and withdrawals for one mixer pool."""
 
+    #: Parameters this needs beyond an address. Read by the web UI to
+    #: render an input for each, so a reader is not asked to press a button
+    #: whose only possible outcome is an error naming what they should have
+    #: typed. Kept beside the check that enforces it.
+    REQUIRES: ClassVar[tuple[str, ...]] = ("deposits",)
+
     name = "mixer"
     version = "1.0"
     description = "Pair mixer deposits with withdrawals by timing, with the anonymity set"

src/chainscope/analysis/peel.py

@@ -39,7 +39,7 @@
 from dataclasses import dataclass, field
 from datetime import datetime, timezone
 from decimal import Decimal
-from typing import Any
+from typing import Any, ClassVar
 
 from ..core.attribution import Confidence
 from ..core.hypothesis import Hypothesis, ScoreFactor
@@ -204,6 +204,12 @@ class PeelStep:
 class PeelChainAnalyzer(Analyzer):
     """Follow the change output of a transaction chain, hop by hop."""
 
+    #: Parameters this needs beyond an address. Read by the web UI to
+    #: render an input for each, so a reader is not asked to press a button
+    #: whose only possible outcome is an error naming what they should have
+    #: typed. Kept beside the check that enforces it.
+    REQUIRES: ClassVar[tuple[str, ...]] = ("start",)
+
     name = "peel-chain"
     version = "1.0"
     description = "Follow a UTXO peel chain, identifying payments shed at each hop"

src/chainscope/analysis/route.py

@@ -49,7 +49,7 @@
 from collections import defaultdict
 from dataclasses import dataclass, field
 from datetime import datetime, timezone
-from typing import Any
+from typing import Any, ClassVar
 
 from ..chains import address_key, fold_if_hex
 from ..core.result import Finding, Result, Severity
@@ -543,6 +543,12 @@ def read(provider: Any) -> Any:
 class RouteAnalyzer(Analyzer):
     """How money could have got from one address to another."""
 
+    #: Parameters this needs beyond an address. Read by the web UI to
+    #: render an input for each, so a reader is not asked to press a button
+    #: whose only possible outcome is an error naming what they should have
+    #: typed. Kept beside the check that enforces it.
+    REQUIRES: ClassVar[tuple[str, ...]] = ("source", "target")
+
     name = "route"
     description = "find time-respecting routes between two addresses"
     requires = Capability.ASSET_TRANSFERS

src/chainscope/analysis/taint.py

@@ -70,7 +70,7 @@
 from datetime import datetime, timezone
 from enum import Enum
 from functools import partial
-from typing import Any, Union
+from typing import Any, ClassVar, Union
 
 from ..core.chainid import ChainId
 from ..core.result import Finding, Result, Severity
@@ -503,6 +503,12 @@ def trace_origins(
 class TaintAnalyzer(Analyzer):
     """Trace stolen value forward from a source address."""
 
+    #: Parameters this needs beyond an address. Read by the web UI to
+    #: render an input for each, so a reader is not asked to press a button
+    #: whose only possible outcome is an error naming what they should have
+    #: typed. Kept beside the check that enforces it.
+    REQUIRES: ClassVar[tuple[str, ...]] = ("source",)
+
     name = "taint"
     version = "1.0"
     description = "Trace how much of each address's holdings came from a given source"

src/chainscope/analysis/xchain.py

@@ -33,7 +33,7 @@
 from dataclasses import dataclass
 from datetime import datetime, timedelta, timezone
 from decimal import Decimal
-from typing import Any
+from typing import Any, ClassVar
 
 from ..core.attribution import Confidence
 from ..core.hypothesis import Hypothesis, ScoreFactor, rank
@@ -121,6 +121,12 @@ def calibrate(
 class CrossChainMatcher(Analyzer):
     """Find the far side of a swap on another chain."""
 
+    #: Parameters this needs beyond an address. Read by the web UI to
+    #: render an input for each, so a reader is not asked to press a button
+    #: whose only possible outcome is an error naming what they should have
+    #: typed. Kept beside the check that enforces it.
+    REQUIRES: ClassVar[tuple[str, ...]] = ("amount", "asset", "at")
+
     name = "cross-chain"
     version = "1.0"
     description = "Match a deposit on one chain to its payout on another"

src/chainscope/config.py

@@ -63,6 +63,11 @@ class ConfigError(RuntimeError):
 #: is not a legal environment variable name.
 RPC_PREFIX = "CHAINSCOPE_RPC_"
 
+#: Appended to an RPC variable to say that endpoint serves historical state:
+#: ``CHAINSCOPE_RPC_ETHEREUM_ARCHIVE=1``. Without it, historical `eth_call` and
+#: `eth_getCode` are refused rather than silently answered about the present.
+ARCHIVE_SUFFIX = "_ARCHIVE"
+
 
 def load_dotenv(
     path: str | Path | None = None, *, search_from: Path | None = None
@@ -122,6 +127,9 @@ class Settings:
     rpc: dict[str, str] = field(default_factory=dict)
     """Chain short name (lowercased) to endpoint URL."""
 
+    rpc_archive: dict[str, bool] = field(default_factory=dict)
+    """Which of those endpoints serve historical state. See `ARCHIVE_SUFFIX`."""
+
     cache_dir: Path | None = None
     audit_log: Path | None = None
     rate_limit: float = 5.0
@@ -152,7 +160,20 @@ def load(
         rpc = {
             name[len(RPC_PREFIX) :].lower(): value.strip()
             for name, value in merged.items()
-            if name.startswith(RPC_PREFIX) and value.strip()
+            if name.startswith(RPC_PREFIX)
+            and value.strip()
+            and not name.endswith(ARCHIVE_SUFFIX)
+        }
+        # Declared, never guessed from the hostname. An endpoint that keeps
+        # historical state can answer "was this an EOA at block b" and "what
+        # were this token's decimals then"; one that cannot will answer those
+        # about *now*, which is a different question with a plausible-looking
+        # answer. So the capability is off unless somebody says otherwise.
+        rpc_archive = {
+            name[len(RPC_PREFIX) : -len(ARCHIVE_SUFFIX)].lower(): value.strip().lower()
+            not in ("", "0", "false", "no")
+            for name, value in merged.items()
+            if name.startswith(RPC_PREFIX) and name.endswith(ARCHIVE_SUFFIX)
         }
         # An endpoint may itself embed a credential in its path. Registering the
         # whole URL means a cassette recorded against it cannot carry the key,
@@ -163,6 +184,7 @@ def load(
         return cls(
             credentials=credentials,
             rpc=rpc,
+            rpc_archive=rpc_archive,
             cache_dir=_path(merged.get("CHAINSCOPE_CACHE_DIR")),
             audit_log=_path(merged.get("CHAINSCOPE_AUDIT_LOG")),
             rate_limit=_number(

src/chainscope/providers/jsonrpc.py

@@ -95,10 +95,17 @@ def from_settings(cls, settings: Any, chain: ChainId, client: Any = None) -> lis
         lookup goes through the alias table rather than CAIP-2 --- a user types
         ``eth``, and ``eip155:1`` is not a thing anybody sets in a shell profile.
 
-        Archive and trace are left off. Whether a node keeps historical state is
-        a property of that node, not of the URL, and declaring a capability the
-        endpoint does not have makes the router pick it and fail rather than
-        pick something else that works.
+        Archive is **declared, never assumed**. Whether a node keeps historical
+        state is a property of that node, not of the URL, and inferring it from
+        a hostname would make the router pick an endpoint that then fails --- so
+        it is off unless `CHAINSCOPE_RPC_<NAME>_ARCHIVE` says otherwise.
+
+        It has to be declarable, though. Without it every historical `eth_call`
+        and `eth_getCode` is refused, and those are what answer "was this an
+        EOA at block b" and "what were this token's decimals then" --- questions
+        whose present-tense answers are quietly different. Asking a live node
+        for state two years old is exactly the confident wrong answer this
+        package refuses elsewhere.
         """
         from ..core.chainid import ALIASES
 
@@ -109,7 +116,13 @@ def from_settings(cls, settings: Any, chain: ChainId, client: Any = None) -> lis
             url = settings.rpc.get(name)
             if url:
                 return [
-                    cls(url, chain, client=client, native_symbol=native_symbol(chain, "ETH"))
+                    cls(
+                        url,
+                        chain,
+                        client=client,
+                        native_symbol=native_symbol(chain, "ETH"),
+                        archive=settings.rpc_archive.get(name, False),
+                    )
                 ]
         return []
 
@@ -284,6 +297,34 @@ def call(self, chain: ChainId, to: str, data: str, block: int | str = "latest")
         vol = Volatility.LIVE if block == "latest" else Volatility.IMMUTABLE
         return self._call("eth_call", [{"to": to, "data": data}, tag], vol) or "0x"
 
+    def code_at(self, chain: ChainId, address: str, block: int | str = "latest") -> str:
+        """``eth_getCode`` at a specific block. Historical needs ``ARCHIVE_STATE``.
+
+        `get_account` asks at ``latest``, which answers a different question.
+        Whether an address is a contract is not a fixed property: a
+        counterfactual deployment turns an EOA into a contract, and a
+        self-destruct turned one back. Asking "now" to decide what something was
+        two years ago produces a confident wrong answer with nothing to notice,
+        which is the failure mode this package exists to refuse.
+
+        Returns the raw byte string. `"0x"` means no code *at that block*, which
+        is what "EOA at block b" means and is a narrower claim than "not a
+        contract" --- an address with no code yet may still receive one.
+        """
+        if block != "latest" and not self.capabilities & Capability.ARCHIVE_STATE:
+            raise ProviderError(
+                f"{self.name} is not configured as an archive node; "
+                f"eth_getCode at block {block} needs archive state. "
+                f"Pass archive=True if this endpoint does serve history."
+            )
+        tag = block if isinstance(block, str) else hex(block)
+        vol = Volatility.LIVE if block == "latest" else Volatility.IMMUTABLE
+        return self._call("eth_getCode", [address, tag], vol) or "0x"
+
+    def is_eoa_at(self, chain: ChainId, address: str, block: int | str = "latest") -> bool:
+        """Whether ``address`` had no code at ``block``."""
+        return self.code_at(chain, address, block) == "0x"
+
     def block_at_time(self, chain: ChainId, when: datetime) -> Block:
         """Last block at or before ``when``, by binary search.