@homeflare/alchemy 0.47.1 → 0.48.1

package/src/talos/talos-cluster-health.ts

@@ -22,13 +22,19 @@
  *   rollout would never learn the real problem was vault. Both `read` and `reconcile` now only
  *   catch `TalosError` (`talosctl health` itself ran and exited non-zero — the one case this
  *   family may honestly call "not healthy"); anything else propagates untouched.
+ * ★ `connection` IS A PASS-THROUGH so this resource is `ClusterLike`. Later rows take
+ *   `cluster: health`. The health check itself still uses `target` and `talosctl`; the field is
+ *   copied onto attributes and is not a credential. It is required: an optional field would not
+ *   satisfy `{ connection: Connection }`.
  */
 import { Resource } from 'alchemy';
 import { isResolved } from 'alchemy/Diff';
 import type { Input } from 'alchemy/Input';
 import * as Provider from 'alchemy/Provider';
 import * as Effect from 'effect/Effect';
+import type { TalosOpenBaoConnection } from './cluster-adapter.ts';
 import { mintTalosconfig } from './credentials.ts';
+import { literalConnectionRefusal, withLiteralConnection } from './literal-connection.ts';
 import type { TalosRequirements, WithTarget } from './resource.ts';
 import { TalosError, talosctl } from './talosctl.ts';
 
@@ -49,12 +55,19 @@ export interface ClusterHealthProps extends WithTarget {
    * on kube-proxy and CoreDNS, both of which wait on a CNI that does not exist yet at bootstrap.
    */
   after?: readonly unknown[];
+  /**
+   * Kubernetes connection copied onto attributes so a later row can take `cluster: this`.
+   * Not read by the health check. Persist only a secret-free connection (`talos-openbao`).
+   */
+  connection: TalosOpenBaoConnection;
 }
 
 export interface ClusterHealthAttributes {
   healthy: boolean;
   controlPlaneNodes: string;
   workerNodes: string;
+  /** Same object as the prop. Makes these attributes `ClusterLike`. */
+  connection: TalosOpenBaoConnection;
 }
 
 export interface TalosClusterHealth extends Resource<
@@ -65,11 +78,34 @@ export interface TalosClusterHealth extends Resource<
   TalosRequirements
 > {}
 
-export const TalosClusterHealth = Resource<TalosClusterHealth>('Talos.ClusterHealth');
+// ⛔ Declaration-time literal guard: a fresh resource skips `diff` (see `withLiteralConnection`).
+export const TalosClusterHealth = withLiteralConnection(
+  Resource<TalosClusterHealth>('Talos.ClusterHealth'),
+);
 
 const nodeCsv = (nodes: readonly string[] | undefined) =>
   nodes === undefined || nodes.length === 0 ? '' : nodes.join(',');
 
+const attributes = (props: ClusterHealthProps, healthy: boolean): ClusterHealthAttributes => ({
+  connection: props.connection,
+  controlPlaneNodes: nodeCsv(props.controlPlaneNodes),
+  healthy,
+  workerNodes: nodeCsv(props.workerNodes),
+});
+
+/**
+ * ⚠️ A ROW SAVED BEFORE `connection` EXISTED HAS NONE — `right` is `undefined` at runtime despite
+ *   the type, and reading `right.auth` threw on a healthy cluster. Missing means "update".
+ */
+const sameConnection = (
+  left: TalosOpenBaoConnection,
+  right: TalosOpenBaoConnection | undefined,
+): boolean =>
+  right?.auth?.kind === left.auth.kind &&
+  right.auth.uid === left.auth.uid &&
+  // ⚠️ A row that still carries the legacy `auth.cluster` alias must update, so it leaves state.
+  !Object.hasOwn(right.auth, 'cluster');
+
 const healthArgs = (props: ClusterHealthProps, waitTimeout: string) => {
   const args = ['health', '--wait-timeout', waitTimeout];
   const cp = nodeCsv(props.controlPlaneNodes);
@@ -113,11 +149,7 @@ const check = (props: ClusterHealthProps, waitTimeout: string) =>
         nodes: [contact],
         talosconfigPath: credential.talosconfigPath,
       });
-      return {
-        controlPlaneNodes: nodeCsv(props.controlPlaneNodes),
-        healthy: true,
-        workerNodes: nodeCsv(props.workerNodes),
-      };
+      return attributes(props, true);
     }),
   );
 
@@ -132,13 +164,7 @@ const isTalosError = (cause: unknown): cause is TalosError => cause instanceof T
 /** ★ EXPORTED for talos-cluster-health.test.ts — see talos-bootstrap.ts's own note on the pattern. */
 export const readClusterHealth = (props: ClusterHealthProps) =>
   check(props, '5s').pipe(
-    Effect.catchIf(isTalosError, () =>
-      Effect.succeed({
-        controlPlaneNodes: nodeCsv(props.controlPlaneNodes),
-        healthy: false,
-        workerNodes: nodeCsv(props.workerNodes),
-      }),
-    ),
+    Effect.catchIf(isTalosError, () => Effect.succeed(attributes(props, false))),
   );
 
 export const diffClusterHealth = (
@@ -146,9 +172,15 @@ export const diffClusterHealth = (
   output: ClusterHealthAttributes | undefined,
 ) =>
   Effect.gen(function* () {
+    // ⛔ `cluster: health` hands this connection to workloads: refuse an Output here, while it is
+    //   still an Input (`literal-connection.ts`).
+    const refused = literalConnectionRefusal((news as { connection?: unknown }).connection);
+    if (refused !== undefined) return yield* Effect.fail(refused);
     if (output === undefined || !isResolved(news)) return undefined;
     const live = yield* readClusterHealth(news);
-    if (live.healthy) return { action: 'noop' } as const;
+    if (live.healthy && sameConnection(live.connection, output.connection)) {
+      return { action: 'noop' } as const;
+    }
     return { action: 'update' } as const;
   });
 

package/src/talos/talos-cluster-identity.test.ts

@@ -0,0 +1,96 @@
+/**
+ * `Talos.ClusterIdentity` — publishes the physical cluster's uid for the operator to pin. Fake `bao` and fake apiserver only; nothing is written.
+ */
+import { expect, test } from 'bun:test';
+import * as Effect from 'effect/Effect';
+import * as ChildProcessSpawner from 'effect/process/ChildProcessSpawner';
+import { fakeApiServer } from './fake-apiserver.ts';
+import { fakeSpawner } from './fake-process.ts';
+import {
+  diffClusterIdentity,
+  readClusterIdentity,
+  reconcileClusterIdentity,
+} from './talos-cluster-identity.ts';
+
+const b64 = (text: string) => Buffer.from(text).toString('base64');
+const pem = (label: string) => `-----${'BEGIN'} ${label}-----\n${b64(label)}\n`;
+const kubeconfig = `apiVersion: v1
+kind: Config
+clusters:
+  - name: c1
+    cluster: { server: 'https://c1.cluster.invalid:6443', certificate-authority-data: ${b64(pem('CERTIFICATE'))} }
+contexts:
+  - name: admin@c1
+    context: { cluster: c1, user: admin@c1 }
+users:
+  - name: admin@c1
+    user: { client-certificate-data: ${b64(pem('CERTIFICATE'))}, client-key-data: ${b64(pem('PRIVATE KEY'))} }
+`;
+const props = { context: 'admin@c1', target: { cluster: 'c1', mount: 'talos-c1' } };
+const run = <A, E>(effect: Effect.Effect<A, E, ChildProcessSpawner.ChildProcessSpawner>) =>
+  Effect.runPromise(
+    Effect.provideService(
+      effect,
+      ChildProcessSpawner.ChildProcessSpawner,
+      fakeSpawner(() => ({ stdout: JSON.stringify({ data: { data: { kubeconfig } } }) })),
+    ),
+  );
+
+test('reads the kube-system uid and publishes { uid }', async () => {
+  const api = fakeApiServer({ 'c1.cluster.invalid': 'uid-c1' });
+  try {
+    const out = await run(readClusterIdentity(props));
+    expect(out).toEqual({ uid: 'uid-c1' });
+    expect(api.seen).toEqual(['GET c1.cluster.invalid/api/v1/namespaces/kube-system']);
+  } finally {
+    api.restore();
+  }
+});
+
+const prior = { uid: 'uid-c1' } as const;
+
+test('an unchanged uid is a noop', async () => {
+  const api = fakeApiServer({ 'c1.cluster.invalid': 'uid-c1' });
+  try {
+    expect((await run(diffClusterIdentity(props, prior)))?.action).toBe('noop');
+  } finally {
+    api.restore();
+  }
+});
+
+// ⛔ A changed uid must never be an `update`: downstream workloads would be force-applied onto the
+//   new cluster (see the header of talos-cluster-identity.ts).
+test('a changed uid is refused in diff AND reconcile, never an update', async () => {
+  const moved = fakeApiServer({ 'c1.cluster.invalid': 'uid-c2' });
+  try {
+    const inDiff = await run(diffClusterIdentity(props, prior)).catch((e: unknown) => String(e));
+    expect(inDiff).toContain('TalosClusterMoved');
+    expect(inDiff).toContain('uid-c2');
+    const inReconcile = await run(reconcileClusterIdentity(props, prior)).catch((e: unknown) =>
+      String(e),
+    );
+    expect(inReconcile).toContain('TalosClusterMoved');
+  } finally {
+    moved.restore();
+  }
+});
+
+test('reconcile with no saved output publishes the live uid', async () => {
+  const api = fakeApiServer({ 'c1.cluster.invalid': 'uid-c2' });
+  try {
+    const out = await run(reconcileClusterIdentity(props, undefined));
+    expect(out.uid).toBe('uid-c2');
+  } finally {
+    api.restore();
+  }
+});
+
+test('an apiserver answering without a uid fails closed', async () => {
+  const api = fakeApiServer({});
+  try {
+    const failure = await run(readClusterIdentity(props)).catch((e: unknown) => String(e));
+    expect(failure).toContain('TalosClusterIdentityUnreadable');
+  } finally {
+    api.restore();
+  }
+});

package/src/talos/talos-cluster-identity.ts

@@ -0,0 +1,130 @@
+/**
+ * `Talos.ClusterIdentity` — a read-only resource that reports WHICH physical cluster a name means.
+ *
+ * ★ It reads the vault kubeconfig and GETs the kube-system Namespace once (`cluster-identity.ts`),
+ *   and publishes `{ uid }`. That is the BOOTSTRAP-THEN-PIN step (cluster-adapter.ts header): the
+ *   first deploy creates the cluster and this row with no workloads, the operator copies the
+ *   printed uid into the adapter config, and workloads take `talosOpenBaoConnection(<literal>)`.
+ *   ⛔ It publishes NO `connection`: an Output uid in a workload's auth is unresolved at plan time
+ *   and hides a cluster change from the plan (`talosOpenBaoConnection` explains the DELETE on B).
+ * ⛔ DRIFT REPAIR CANNOT LAUNDER A MOVE: `read` receives the persisted output and compares it, so
+ *   `Drift.repair` fails with `TalosClusterMoved` instead of reconciling B against B.
+ * ⛔ IT MUTATES NOTHING: no vault write, no cluster write, `delete` is a no-op. Its only effect is
+ *   the value it reports. `after` must reach past Cilium/CNI only if the apiserver needs it; the
+ *   kube-system namespace exists as soon as the apiserver answers.
+ * ⛔ A CHANGED UID IS REFUSED, NEVER AN UPDATE (`TalosClusterMoved`, in diff AND reconcile). This
+ *   resource declares no `stables`, so downstream the engine sees an unresolved Output, every
+ *   workload `diff` returns undefined and the engine plans an UPDATE, not a replace (Plan.ts
+ *   resourceExpr, `isResolved(news)` in Manifest.ts and HelmChart.ts). Reconcile would then
+ *   connect with the NEW uid and force-apply onto the new cluster while the old cluster's objects
+ *   are orphaned (an earlier comment here claimed a replace and a refusal at cleanup: it cannot
+ *   happen). A real move is a NEW identity resource per physical cluster.
+ */
+import { Resource } from 'alchemy';
+import { isResolved } from 'alchemy/Diff';
+import type { Input } from 'alchemy/Input';
+import * as Provider from 'alchemy/Provider';
+import * as Effect from 'effect/Effect';
+import { TalosClusterMoved } from './cluster-adapter-errors.ts';
+import { readClusterUid } from './cluster-identity.ts';
+import { openTransport, talosVaultLocation, withConnectDeadline } from './cluster-transport.ts';
+import type { KubeconfigProps } from './kubeconfig.ts';
+import type { TalosRequirements } from './resource.ts';
+
+type KubeconfigSource = Pick<KubeconfigProps, 'context' | 'kubeconfigKey' | 'target'>;
+
+export interface ClusterIdentityProps extends KubeconfigSource {
+  /** Ordering edge: after `Talos.Kubeconfig` (the vault key must exist) and the apiserver is up. */
+  after?: readonly unknown[];
+}
+
+export interface ClusterIdentityAttributes {
+  /**
+   * The cluster's kube-system `metadata.uid`. Public. ⛔ NOT A `connection`: these attributes are
+   * deliberately not `ClusterLike`. Pin this value as a literal in `TalosOpenBaoAdapter` and build
+   * workloads' connection from that literal (bootstrap-then-pin, cluster-adapter.ts header).
+   */
+  uid: string;
+}
+
+export interface TalosClusterIdentity extends Resource<
+  'Talos.ClusterIdentity',
+  ClusterIdentityProps,
+  ClusterIdentityAttributes,
+  never,
+  TalosRequirements
+> {}
+
+export const TalosClusterIdentity = Resource<TalosClusterIdentity>('Talos.ClusterIdentity');
+
+/**
+ * ★ EXPORTED for talos-cluster-identity.test.ts — see talos-bootstrap.ts's note on the pattern.
+ * ⛔ A PERSISTED OUTPUT IS COMPARED HERE TOO, not only in reconcile: `Drift.repair` hands `read`
+ *   the persisted attributes, then reconciles `news: old.props, output: <what read returned>`.
+ *   A read that ignored the output returned the NEW uid, so the reconcile guard compared B with B
+ *   and saved it. Failing in read stops that path with `TalosClusterMoved`.
+ */
+export const readClusterIdentity = (
+  props: ClusterIdentityProps,
+  output?: ClusterIdentityAttributes,
+) =>
+  Effect.gen(function* () {
+    const cluster = props.target.cluster;
+    // ⛔ Same single deadline as connect: a hung `bao` must not hang the plan.
+    const uid = yield* withConnectDeadline(
+      cluster,
+      Effect.gen(function* () {
+        const transport = yield* openTransport(talosVaultLocation(props));
+        return yield* readClusterUid(cluster, transport);
+      }),
+    );
+    if (output !== undefined && uid !== output.uid) {
+      return yield* Effect.fail(new TalosClusterMoved({ cluster, live: uid, saved: output.uid }));
+    }
+    return { uid };
+  });
+
+/** ⛔ Fails closed when a saved uid exists and the live one differs. See the header. */
+export const reconcileClusterIdentity = (
+  props: ClusterIdentityProps,
+  output: ClusterIdentityAttributes | undefined,
+) => readClusterIdentity(props, output);
+
+export const diffClusterIdentity = (
+  news: Input<ClusterIdentityProps>,
+  output: ClusterIdentityAttributes | undefined,
+) =>
+  Effect.gen(function* () {
+    if (output === undefined || !isResolved(news)) return undefined;
+    yield* reconcileClusterIdentity(news, output);
+    return { action: 'noop' } as const;
+  });
+
+const handlers = {
+  delete: () => Effect.void,
+  diff: ({
+    news,
+    output,
+  }: {
+    news: Input<ClusterIdentityProps>;
+    output: ClusterIdentityAttributes | undefined;
+  }) => diffClusterIdentity(news, output),
+  list: () => Effect.succeed([]),
+  read: ({
+    olds,
+    output,
+  }: {
+    olds: ClusterIdentityProps;
+    output: ClusterIdentityAttributes | undefined;
+  }) => readClusterIdentity(olds, output),
+  reconcile: ({
+    news,
+    output,
+  }: {
+    news: ClusterIdentityProps;
+    output: ClusterIdentityAttributes | undefined;
+  }) => reconcileClusterIdentity(news, output),
+};
+
+export const TalosClusterIdentityProvider = () =>
+  Provider.effect(TalosClusterIdentity, Effect.succeed(TalosClusterIdentity.Provider.of(handlers)));

package/src/talos/talosctl-binary.ts

@@ -0,0 +1,150 @@
+/**
+ * Which `talosctl` runs, and whether that file may be trusted with the vault-minted talosconfig.
+ * Extracted from talosctl.ts (250-line cap).
+ *
+ * ⛔ A VETTING REFUSAL IS NOT A TalosError. `TalosError` means a `talosctl` run completed and
+ *   exited non-zero — the one outcome `Talos.ClusterHealth` may call "not healthy", and the one
+ *   `talosctlOrAlready` pattern-matches. A refused binary never ran, so it is its own class and
+ *   propagates through both untouched (hunt round 6: it read as `healthy: false`).
+ */
+import { accessSync, constants, lstatSync, realpathSync } from 'node:fs';
+import { basename, delimiter, dirname, isAbsolute, join } from 'node:path';
+import * as Effect from 'effect/Effect';
+import { isTrustedBoundary } from './trust-boundary.ts';
+
+/** `talosctl` on `PATH`. A lane pins another build with {@link TALOSCTL_BINARY_ENV} or `binary`. */
+export const DEFAULT_TALOSCTL_BINARY = 'talosctl';
+
+/**
+ * Executable override, read at call time. The Mac PATH measured 2026-10-05 has v1.13.8; the
+ * cluster is v1.14.2. Set this to the v1.14.2 binary. A per-call `binary` option wins.
+ */
+export const TALOSCTL_BINARY_ENV = 'HF_TALOSCTL';
+
+/** `bao` on `PATH` — the OpenBao CLI that fetches the cluster credentials at connect time. */
+export const DEFAULT_BAO_BINARY = 'bao';
+
+/** `bao` executable override, read at call time and vetted exactly like {@link TALOSCTL_BINARY_ENV}. */
+export const BAO_BINARY_ENV = 'HF_BAO';
+
+export class TalosBinaryRefused extends Error {
+  readonly command: string;
+  readonly binary: string;
+
+  constructor(command: string, detail: string, binary = DEFAULT_TALOSCTL_BINARY) {
+    super(`${binary} ${command} refused: ${detail}`);
+    this.name = 'TalosBinaryRefused';
+    this.command = command;
+    this.binary = binary;
+  }
+}
+
+/**
+ * ⛔ THE DEFAULT IS VETTED TOO (hunt round 5): a bare `talosctl` is resolved against `PATH` here
+ *   (not `Bun.which` — the published dist runs on Node, where that global is missing), symlinks are
+ *   followed, and the REAL file is vetted, version-checked and executed by absolute path.
+ */
+export const resolveDefault = (binary: string) =>
+  Effect.try({
+    try: () => {
+      for (const entry of (process.env['PATH'] ?? '').split(delimiter)) {
+        if (!isAbsolute(entry)) continue;
+        try {
+          const candidate = join(entry, binary);
+          accessSync(candidate, constants.X_OK);
+          return realpathSync(candidate);
+        } catch {
+          // not in this PATH entry — try the next
+        }
+      }
+      throw new Error('not found');
+    },
+    catch: () => new TalosBinaryRefused('binary check', `${binary} was not found on PATH`, binary),
+  });
+
+/**
+ * ⛔ EVERY DIRECTORY ON THE CANONICAL PATH must belong to the current user or root and must not be
+ *   group/world-writable (unless sticky: a sticky directory's entries cannot be renamed by others).
+ *   Round 5 checked only the immediate parent's mode, so an attacker-owned 0755 parent, or a
+ *   writable ancestor, could swap the file after the check. Returns the refusal reason, or
+ *   undefined when the whole chain is trusted.
+ */
+const untrustedAncestor = (file: string, uid: number | undefined): string | undefined => {
+  let dir = realpathSync(dirname(file));
+  for (;;) {
+    const stat = lstatSync(dir);
+    // The boundary directory itself is still vetted; only what lies ABOVE it is not (test seam,
+    // trust-boundary.seam.ts, which the published tarball does not carry).
+    const isBoundary = isTrustedBoundary(dir);
+    if (uid !== undefined && stat.uid !== uid && stat.uid !== 0) {
+      return `lives under a directory owned by another user (${dir})`;
+    }
+    const sticky = (stat.mode & 0o1000) !== 0;
+    if ((stat.mode & 0o022) !== 0 && !sticky) {
+      return `lives in a group- or world-writable directory (${dir})`;
+    }
+    const up = dirname(dir);
+    if (up === dir || isBoundary) return undefined;
+    dir = up;
+  }
+};
+
+/**
+ * ⛔ THE BINARY GETS THE VAULT-MINTED TALOSCONFIG: absolute, owned, not writable, executable, trusted
+ *   path. ⛔ RETURNS THE CANONICAL PATH (round 7): the override's directory is resolved ONCE
+ *   (realpath), that path and every ancestor of it are vetted, and the caller must launch exactly
+ *   the returned path for the version probe AND the credential-bearing call. Vetting the given path
+ *   and executing it again let a symlinked ancestor be repointed between the two launches. The leaf
+ *   itself is still lstat'd, so a symlink leaf is refused rather than followed.
+ */
+export const checkBinaryPath = (binary: string, source: string) => {
+  const refuse = (why: string) =>
+    Effect.fail(new TalosBinaryRefused('binary check', `${source} ${why}`, binary));
+  if (!isAbsolute(binary)) return refuse('must be an absolute path');
+  return Effect.try({
+    try: () => {
+      const canonical = join(realpathSync(dirname(binary)), basename(binary));
+      const file = lstatSync(canonical);
+      const uid = process.getuid?.();
+      return { canonical, file, uid, ancestor: untrustedAncestor(canonical, uid) };
+    },
+    catch: () => new TalosBinaryRefused('binary check', `${source} is not a readable file`, binary),
+  }).pipe(
+    Effect.flatMap(({ canonical, file, uid, ancestor }) => {
+      // ★ lstat, not stat: a symlink can be re-pointed by whoever owns the link, so none is accepted.
+      if (file.isSymbolicLink()) return refuse('must not be a symlink');
+      if (!file.isFile()) return refuse('is not a regular file');
+      // ⛔ FAIL CLOSED: with no process uid (a platform lacking getuid) ownership cannot be checked.
+      if (uid === undefined) return refuse('cannot be vetted: no process uid to check ownership');
+      if (ancestor !== undefined) return refuse(ancestor);
+      if (uid !== undefined && file.uid !== uid && file.uid !== 0) {
+        return refuse('must be owned by the current user or root');
+      }
+      if ((file.mode & 0o022) !== 0) return refuse('is group- or world-writable');
+      try {
+        accessSync(canonical, constants.X_OK);
+      } catch {
+        return refuse('is not executable');
+      }
+      return Effect.succeed(canonical);
+    }),
+  );
+};
+
+/**
+ * Resolve and vet the `bao` binary: {@link BAO_BINARY_ENV} wins over `bao` on `PATH`, and either is
+ * checked exactly like talosctl (absolute, owned, not writable, executable, not a symlink, every
+ * ancestor trusted). Returns the canonical path to launch.
+ *
+ * ⛔ `bao` FETCHES THE CLUSTER CREDENTIALS (`readKvValue` / `writeKvValue`), so an un-vetted `bao`
+ *   on a group/world-writable PATH folder (umask 002, the round-10 incident) could answer with an
+ *   attacker's kubeconfig. The same walk that vets `talosctl` must gate every `bao` launch.
+ */
+export const resolveBao = (): Effect.Effect<string, TalosBinaryRefused> => {
+  const override = process.env[BAO_BINARY_ENV]?.trim();
+  const requested = override !== undefined && override !== '' ? override : DEFAULT_BAO_BINARY;
+  const source = requested === DEFAULT_BAO_BINARY ? 'bao on PATH' : BAO_BINARY_ENV;
+  const resolved =
+    requested === DEFAULT_BAO_BINARY ? resolveDefault(requested) : Effect.succeed(requested);
+  return Effect.flatMap(resolved, (path) => checkBinaryPath(path, source));
+};

package/src/talos/talosctl-probe-kill.test.ts

@@ -0,0 +1,56 @@
+/**
+ * The version probe's deadline against a REAL hanging child: the claim in talosctl.ts that a timed-out
+ * probe kills the child (and its process group) is proved here with `process.kill(pid, 0)`, not with a
+ * spawner that never starts anything. The script lives in a private os.tmpdir() directory removed on
+ * every exit path, and sleeps 60 s so a surviving child is unmistakable.
+ */
+import { chmodSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { afterAll, expect, test } from 'bun:test';
+import * as Effect from 'effect/Effect';
+import * as NodeServices from '@effect/platform-node/NodeServices';
+import { trustBoundaryForTests } from './trust-boundary.seam.ts';
+import { TalosBinaryRefused, talosctl } from './talosctl.ts';
+
+const dir = mkdtempSync(join(tmpdir(), 'hf-probe-kill-'));
+chmodSync(dir, 0o755);
+trustBoundaryForTests(dir);
+afterAll(() => rmSync(dir, { force: true, recursive: true }));
+
+const pidFile = join(dir, 'pids');
+const script = join(dir, 'talosctl');
+// The shell and its `sleep` grandchild both record their pid: the grandchild only dies if the whole
+// process group is killed, not just the direct child.
+writeFileSync(script, `#!/bin/sh\nsleep 60 &\necho "$$ $!" > '${pidFile}'\nwait\n`, {
+  mode: 0o755,
+});
+chmodSync(script, 0o755);
+
+const alive = (pid: number) => {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (cause) {
+    return (cause as NodeJS.ErrnoException).code !== 'ESRCH';
+  }
+};
+
+test('a probe that hangs is refused and its real child and process group are gone', async () => {
+  const outcome = await Effect.runPromise(
+    Effect.flip(
+      talosctl(['version'], {
+        binary: script,
+        talosconfigPath: 'unused.yaml',
+        versionProbeTimeout: '1 seconds',
+      }).pipe(Effect.provide(NodeServices.layer)),
+    ),
+  );
+  expect(outcome).toBeInstanceOf(TalosBinaryRefused);
+  const pids = readFileSync(pidFile, 'utf8').trim().split(' ').map(Number);
+  expect(pids).toHaveLength(2);
+  // SIGKILL follows SIGTERM after `forceKillAfter` (1 s), so allow it to land.
+  const deadline = Date.now() + 5000;
+  while (pids.some(alive) && Date.now() < deadline) await Bun.sleep(100);
+  expect(pids.map(alive)).toEqual([false, false]);
+});