Require explicit --arch or --profile for remote targets

Author: devploit

README.md

@@ -62,8 +62,8 @@ default retries because its stage 3 is probabilistic.
 - **Version-aware dispatch** — fingerprints the target, rejects fixed releases,
   selects the exact build profile and passes offsets, `htdata` and heap
   parameters explicitly. `--php-version` covers servers that hide their version;
-  `--arch` selects aarch64 or amd64 (auto-detected for local containers), and
-  `--profile` forces an exact build.
+  `--arch` selects aarch64 or amd64 (auto-detected for local containers,
+  required for remote targets), and `--profile` forces an exact build.
 - **Memory-limit probe** — one request reveals the target `memory_limit` from
   the fatal message; the chain then runs once instead of sweeping every value.
 - **Worker pinning** — keeps N-1 prefork workers busy with idle keep-alive
@@ -134,7 +134,7 @@ Useful entry points:
 ```sh
 python3 tools/php2shell_auto.py --list          # profiles and RCE status
 python3 tools/php2shell_auto.py -u <target> --dry-run --no-color
-python3 tools/php2shell_auto.py -u <target> --php-version 8.4.26 --allow-remote
+python3 tools/php2shell_auto.py -u <target> --php-version 8.4.26 --arch amd64 --allow-remote
 python3 tools/php2shell_labs.py status
 python3 tools/php2shell_inventory.py
 ```
@@ -177,9 +177,9 @@ offsets:
 
 - local container: the dispatcher reads `uname -m` and selects the matching
   profile automatically;
-- remote target: pass `--arch aarch64|amd64` (or `--profile NAME`). If the
-  version has several builds and no architecture is supplied, the dispatcher
-  refuses instead of guessing.
+- remote target: `--arch aarch64|amd64` (or `--profile NAME`) is **required**,
+  even when the version has a single profile. HTTP does not expose the CPU
+  architecture, so the dispatcher refuses instead of guessing.
 
 ## Configuration requirements
 

docs/reproducibility.md

@@ -133,6 +133,7 @@ profile that only leaks is stored with `rce: false`.
 | HTTPS stage 1 fails | use HTTP for the verified path; HTTPS is not end-to-end verified |
 | `no proof yet` | `/out` mount, writable webroot, served output path |
 | stage 1 fails on a multi-worker target | `--pin-workers N` (remote pinning is opt-in) |
+| `ARCH REQUIRED` on a remote target | pass `--arch aarch64|amd64` or `--profile NAME`; HTTP cannot reveal the CPU |
 | probe inconclusive | `--memory-limit-mb N` or `--no-probe` |
 | stage 3 fails | verify the exact build/profile; 8.4.25 needs retries |
 

tests/test_core.py

@@ -60,6 +60,12 @@ def test_branch_only(self):
     def test_none(self):
         self.assertEqual(auto.select([], "8.4.26", "8.4"), (None, "none"))
 
+    def test_remote_arch_required(self):
+        self.assertTrue(auto.remote_arch_required(True, None, None))
+        self.assertFalse(auto.remote_arch_required(True, "amd64", None))
+        self.assertFalse(auto.remote_arch_required(True, None, "p"))
+        self.assertFalse(auto.remote_arch_required(False, None, None))
+
     def test_select_by_arch(self):
         profiles = [
             {"name": "p-arm", "php_version": "8.5.11", "branch": "8.5", "arch": "aarch64"},

tools/php2shell_auto.py

@@ -180,6 +180,11 @@ def load_profiles(directory: str):
     return profiles
 
 
+def remote_arch_required(remote: bool, arch: str | None, profile: str | None) -> bool:
+    """Remote targets cannot be fingerprinted for CPU architecture."""
+    return bool(remote and not arch and not profile)
+
+
 def select(profiles, version: str, branch: str, arch: str | None = None):
     def fits(profile):
         return arch is None or profile.get("arch") == arch
@@ -544,7 +549,7 @@ def main() -> int:
     ap.add_argument("--pin-max", type=int, default=32,
                     help="max keep-alive connections for remote auto-pinning")
     ap.add_argument("--arch", choices=("aarch64", "amd64"), default=None,
-                    help="select the CPU architecture; auto-detected for local containers")
+                    help="CPU architecture; required for remote targets, auto-detected locally")
     ap.add_argument("--profile", default=None,
                     help="force a profile by name/path substring (needed when a version has several builds)")
     ap.add_argument("--no-color", action="store_true")
@@ -594,6 +599,11 @@ def main() -> int:
         if detected_arch:
             args.arch = detected_arch
             ui.info(f"detected architecture: {detected_arch}")
+    if remote_arch_required(remote, args.arch, args.profile):
+        ui.crit("remote target: CPU architecture cannot be detected")
+        ui.info("pass --arch aarch64|amd64 (and --php-version if needed) or --profile NAME")
+        ui.result(False, "ARCH REQUIRED", "remote target without --arch/--profile")
+        return 3
 
     version, server, powered = fingerprint(args.target)
     if args.php_version: