Half the analysis panel was a form that could not be submitted

Seven of the fourteen analysers on offer take an argument. The page renders
an input for each name in their `REQUIRES` and sends the values with the
request; `_run_over_store` called `instance.run(ctx, address=..., rows=...)`
and nothing else. So filling in the field the tool asked for and pressing
the button returned "linked_holders needs `addresses`" --- about the
addresses just typed into it. common_funder, cross_chain, linked_holders,
mixer, peel_chain, route and taint were all unreachable from the UI.

Only the names an analyser declares are forwarded. Passing the whole query
would have fixed the visible bug and opened a different one: a URL could
then set any keyword argument on any analyser, including ones it never
advertised. There is a test for each half.

Found by filling the form in a browser. No test caught it because every test
calls the analysers directly, which is the shape of gap that only using the
thing finds.

Two more from the same session, both "the button appears to do nothing":

The parameter form and the result render below the fold in a panel taller
than the window, so pressing an analyser changed nothing a reader could see
and put the only signal in the opposite corner of the screen. Both scroll
into view now, and the first field takes focus.

And the ask dialog ignored Escape and let Tab walk out into the page behind
it --- so the only way out was finding `close` with a mouse, and anyone
navigating by keyboard ended up operating a graph they had been told was
covered by a modal. Escape closes, Tab cycles inside, focus returns to
whatever opened it, and it is a `role="dialog"` with `aria-modal`.

The zoom controls were named "minus" and "plus" to a screen reader.

The landing page's "Eight views" is now `VIEWS.length`.

(The asset checkboxes and analyser buttons read as unnamed in one
accessibility tool's tree. They are not --- the checkboxes sit inside
labels, and the buttons take their name from their own text. Checked the
markup rather than the tool this time; the same tool led me to report
nineteen phantom findings once before.)

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FXWQ25VgFeMuuMhGWjvdof

Author: Toby1009

src/chainscope/server/local.py

@@ -830,7 +830,17 @@ def analyze(self, query: dict[str, list[str]]) -> dict[str, Any]:
         chain = self._chain(_first(query, "chain") or "1") or ChainId.evm(1)
 
         rows = self._transfers(address, chain)
-        found = _run_over_store(name, rows, address, chain, _first(query, "subject") or address)
+        # Everything else on the query is a candidate analyzer argument. Which
+        # of them are actually passed is decided by the analyzer's own
+        # `REQUIRES`, in `_run_over_store`.
+        extra = {
+            key: values[0]
+            for key, values in query.items()
+            if key not in {"name", "address", "chain", "subject"} and values
+        }
+        found = _run_over_store(
+            name, rows, address, chain, _first(query, "subject") or address, extra
+        )
         return {
             "analyzer": name,
             "address": address,
@@ -1349,7 +1359,12 @@ def _asset_provider(chain: ChainId) -> Any:
 
 
 def _run_over_store(
-    name: str, rows: list[Any], address: str, chain: ChainId, subject: str
+    name: str,
+    rows: list[Any],
+    address: str,
+    chain: ChainId,
+    subject: str,
+    extra: dict[str, str] | None = None,
 ) -> Any:
     """Dispatch to an analyzer that works over transfers already in the store.
 
@@ -1400,6 +1415,7 @@ def _run_over_store(
     # returning an empty result that reads as "nothing found".
     from ..cli.commands.analyze import _discover as discover
 
+    extra = extra or {}
     registered, _ = discover()
     factory = registered.get(name)
     if factory is None:
@@ -1408,7 +1424,21 @@ def _run_over_store(
     try:
         instance = factory()
         ctx = Context(chain=chain, router=None, limits={"rows": rows})  # type: ignore[arg-type]
-        return instance.run(ctx, address=address, rows=rows)
+        # What the analyzer declared it needs, taken from the request.
+        #
+        # These were collected by the page --- it renders an input per
+        # `REQUIRES` and sends them --- and then dropped here, so every
+        # analyzer with a required argument answered "linked_holders needs
+        # `addresses`" about the addresses you had just typed into the field it
+        # asked for. Seven of the fourteen on offer: common_funder,
+        # cross_chain, linked_holders, mixer, peel_chain, route, taint. Found
+        # by filling the form in a browser and pressing the button.
+        #
+        # Only the declared names are forwarded. Passing the whole query would
+        # let a URL set keyword arguments the analyzer never advertised.
+        wanted = tuple(getattr(instance, "REQUIRES", ()) or ())
+        supplied = {name: extra[name] for name in wanted if name in extra}
+        return instance.run(ctx, address=address, rows=rows, **supplied)
     except AttributeError as exc:
         # `router=None`: this handler runs analyzers over rows already in the
         # store and has no provider to give them. An analyzer that reaches for

tests/unit/test_the_page_can_pass_an_analyzer_its_arguments.py

@@ -0,0 +1,74 @@
+"""An analyzer's declared arguments must survive the trip from the form.
+
+The page renders an input for each name in an analyzer's ``REQUIRES`` and sends
+them with the request. `_run_over_store` then called ``instance.run(ctx,
+address=..., rows=...)`` and nothing else, so the values were dropped between
+the request and the analyzer --- and the analyzer answered "linked_holders
+needs `addresses`" about the addresses somebody had just typed into the field
+it asked for.
+
+Seven of the fourteen analyzers on offer take an argument, so half the panel
+was a form that could not be submitted. Found by filling it in a browser, not
+by a test: every existing test called the analyzers directly.
+
+The second test is the one that matters longer term. Forwarding the *whole*
+query would have fixed the visible bug and opened a different hole --- a URL
+could then set any keyword argument on any analyzer, including ones it never
+advertised. Only declared names travel.
+"""
+
+from __future__ import annotations
+
+from typing import Any, ClassVar
+
+import pytest
+
+from chainscope.core.chainid import ChainId
+from chainscope.core.result import Result
+from chainscope.server import local
+
+CHAIN = ChainId.evm(1)
+SEED = "0x" + "11" * 20
+
+
+class _Spy:
+    """Stands in for a registered analyzer and records what it was handed."""
+
+    name = "spy"
+    REQUIRES: ClassVar[tuple[str, ...]] = ("addresses", "source")
+    seen: ClassVar[dict[str, Any]] = {}
+
+    def run(self, ctx: Any, **kwargs: Any) -> Result:
+        type(self).seen = dict(kwargs)
+        return Result(analyzer="spy")
+
+
+@pytest.fixture
+def spying(monkeypatch: pytest.MonkeyPatch) -> type[_Spy]:
+    _Spy.seen = {}
+    monkeypatch.setattr(
+        "chainscope.cli.commands.analyze._discover",
+        lambda: ({"spy": _Spy}, []),
+    )
+    return _Spy
+
+
+def test_a_declared_argument_reaches_the_analyzer(spying: type[_Spy]) -> None:
+    local._run_over_store(
+        "spy", [], SEED, CHAIN, SEED, {"addresses": f"{SEED},0xabc", "source": "0xdef"}
+    )
+    assert spying.seen["addresses"] == f"{SEED},0xabc"
+    assert spying.seen["source"] == "0xdef"
+
+
+def test_an_undeclared_argument_does_not(spying: type[_Spy]) -> None:
+    """A query parameter is not a way to set arbitrary keyword arguments."""
+    local._run_over_store("spy", [], SEED, CHAIN, SEED, {"addresses": SEED, "provider": "evil"})
+    assert "provider" not in spying.seen
+
+
+def test_nothing_supplied_is_still_a_clean_call(spying: type[_Spy]) -> None:
+    """The analyzer's own default and its own error message, not a TypeError."""
+    local._run_over_store("spy", [], SEED, CHAIN, SEED, {})
+    assert "addresses" not in spying.seen
+    assert spying.seen["address"] == SEED

web/src/app/page.tsx

@@ -59,8 +59,10 @@ export default function Home() {
       <section className="band frame" id="views">
         <h2 className="section">What it shows you</h2>
         <p className="lede">
-          Eight views. Each one listed with what it is for, and with what an
-          answer from it does not settle.
+          {/* Counted, not written down. A ninth view would otherwise leave the
+              prose saying eight, and the number is the first thing read. */}
+          {VIEWS.length} views. Each one listed with what it is for, and with
+          what an answer from it does not settle.
         </p>
         <div className="grid">
           {VIEWS.map((view, i) => (

web/src/components/ask-dialog.tsx

@@ -14,11 +14,13 @@
  * server, against a fixed vocabulary, and refuses rather than guesses.
  */
 
-import { useState } from "react";
+import { useEffect, useRef, useState } from "react";
 
 import { Spinner } from "@/components/spinner";
 import { api, type AskReply } from "@/lib/api";
 
+const FOCUSABLE = "a[href], button:not([disabled]), input, select, textarea, [tabindex]";
+
 type Props = {
   chain: string;
   onClose: () => void;
@@ -30,6 +32,48 @@ export function AskDialog({ chain, onClose, onRun }: Props) {
   const [plan, setPlan] = useState<AskReply | null>(null);
   const [error, setError] = useState("");
   const [reading, setReading] = useState(false);
+  const sheet = useRef<HTMLDivElement | null>(null);
+
+  /**
+   * Escape closes, Tab stays inside, and focus goes back where it was.
+   *
+   * None of these held. Escape did nothing, so the only way out was finding
+   * the close button with a mouse; Tab walked straight out of the dialog into
+   * the page behind it, which is still there and still reachable, so somebody
+   * navigating by keyboard or screen reader ends up operating a graph they
+   * were told was covered by a modal. Verified by pressing Escape with the
+   * dialog open and reading back `document.activeElement`, which was `BODY`.
+   */
+  useEffect(() => {
+    const returnTo = document.activeElement as HTMLElement | null;
+    function onKey(event: KeyboardEvent) {
+      if (event.key === "Escape") {
+        event.preventDefault();
+        onClose();
+        return;
+      }
+      if (event.key !== "Tab" || !sheet.current) return;
+      const stops = [...sheet.current.querySelectorAll<HTMLElement>(FOCUSABLE)].filter(
+        (el) => el.offsetParent !== null,
+      );
+      if (!stops.length) return;
+      const first = stops[0];
+      const last = stops[stops.length - 1];
+      const at = document.activeElement;
+      if (event.shiftKey && (at === first || !sheet.current.contains(at))) {
+        event.preventDefault();
+        last.focus();
+      } else if (!event.shiftKey && at === last) {
+        event.preventDefault();
+        first.focus();
+      }
+    }
+    document.addEventListener("keydown", onKey);
+    return () => {
+      document.removeEventListener("keydown", onKey);
+      returnTo?.focus?.();
+    };
+  }, [onClose]);
 
   async function read() {
     if (!question.trim()) return;
@@ -55,8 +99,15 @@ export function AskDialog({ chain, onClose, onRun }: Props) {
 
   return (
     <div className="scrim" onClick={onClose} role="presentation">
-      <div className="sheet" onClick={(event) => event.stopPropagation()}>
-        <h3>Ask in plain language</h3>
+      <div
+        className="sheet"
+        ref={sheet}
+        onClick={(event) => event.stopPropagation()}
+        role="dialog"
+        aria-modal="true"
+        aria-labelledby="ask-title"
+      >
+        <h3 id="ask-title">Ask in plain language</h3>
         <p className="note small">
           Nothing is sent anywhere. The question is read on your own machine,
           against a fixed vocabulary, and you are shown what it would run before

web/src/components/graph.tsx

@@ -437,11 +437,18 @@ export function Graph({
         <button onClick={fit} title="fit the whole case on screen" aria-label="fit the whole case on screen">
           ⌖
         </button>
-        <button onClick={() => setView((v) => ({ ...v, zoom: Math.max(0.15, v.zoom * 0.85) }))}>
+        {/* "minus" is what a screen reader reads off a bare glyph. */}
+        <button
+          aria-label="zoom out"
+          onClick={() => setView((v) => ({ ...v, zoom: Math.max(0.15, v.zoom * 0.85) }))}
+        >
           −
         </button>
         <span className="mono">{Math.round(view.zoom * 100)}%</span>
-        <button onClick={() => setView((v) => ({ ...v, zoom: Math.min(3, v.zoom * 1.15) }))}>
+        <button
+          aria-label="zoom in"
+          onClick={() => setView((v) => ({ ...v, zoom: Math.min(3, v.zoom * 1.15) }))}
+        >
           +
         </button>
       </div>

web/src/components/selected.tsx

@@ -15,7 +15,7 @@
  * "unlabelled" the second state gets.
  */
 
-import { useCallback, useEffect, useState } from "react";
+import { useCallback, useEffect, useRef, useState } from "react";
 
 import { Spinner } from "@/components/spinner";
 import { api, boot, type ExpandReply, type ResolveReply } from "@/lib/api";
@@ -60,6 +60,9 @@ export function Selected({
   // list lived in a literal here; the server knows what is actually installed.
   const [registered, setRegistered] = useState<Registered[]>([]);
   const [result, setResult] = useState<string>("");
+  const paramsBox = useRef<HTMLDivElement | null>(null);
+  const firstParam = useRef<HTMLInputElement | null>(null);
+  const resultBox = useRef<HTMLPreElement | null>(null);
   const [params, setParams] = useState<Record<string, string>>({});
   const [open, setOpen] = useState<string | null>(null);
   const writable = boot().writable;
@@ -70,6 +73,29 @@ export function Selected({
       .catch(() => setRegistered([]));
   }, [chain]);
 
+  /**
+   * Bring what just appeared into view, and put the cursor in it.
+   *
+   * This panel is taller than the window, so both the parameter form and the
+   * result render below the fold: pressing an analyser that needs an argument
+   * produced a field nobody could see and a status line at the far corner of
+   * the screen, which reads exactly like a button that does nothing. Found by
+   * pressing `common_funder` and watching the page not change.
+   *
+   * `block: "nearest"` rather than `"center"`, so a result already on screen
+   * does not jump.
+   */
+  useEffect(() => {
+    if (!open) return;
+    paramsBox.current?.scrollIntoView({ block: "nearest", behavior: "smooth" });
+    firstParam.current?.focus();
+  }, [open]);
+
+  useEffect(() => {
+    if (!result) return;
+    resultBox.current?.scrollIntoView({ block: "nearest", behavior: "smooth" });
+  }, [result]);
+
   const run = useCallback(
     async (item: Registered) => {
       onWork?.({ on: true, label: item.name });
@@ -291,10 +317,11 @@ export function Selected({
       </div>
 
       {open ? (
-        <div className="params">
-          {(registered.find((r) => r.name === open)?.needs ?? []).map((need) => (
+        <div className="params" ref={paramsBox}>
+          {(registered.find((r) => r.name === open)?.needs ?? []).map((need, i) => (
             <input
               key={need}
+              ref={i === 0 ? firstParam : undefined}
               className="mono"
               placeholder={need}
               value={params[need] ?? ""}
@@ -327,7 +354,11 @@ export function Selected({
           the pattern.
         </p>
       ) : null}
-      {result ? <pre className="result">{result}</pre> : null}
+      {result ? (
+        <pre className="result" ref={resultBox} tabIndex={-1}>
+          {result}
+        </pre>
+      ) : null}
 
       {!writable ? (
         <p className="note small">