Centralize encrypted bot profiles

isolation.ts

@@ -14,15 +14,6 @@ export function agentCommand(
   });
 }
 
-export function isRunnableProfileProcess(
-  status: string,
-  uid: number,
-): boolean {
-  const owner = status.match(/^Uid:\s+(\d+)/m)?.[1];
-  const state = status.match(/^State:\s+(\w)/m)?.[1];
-  return owner !== undefined && Number(owner) === uid && state !== "Z";
-}
-
 async function profileProcessIds(uid: number): Promise<number[]> {
   const ids: number[] = [];
   for await (const entry of Deno.readDir("/proc")) {
@@ -30,7 +21,8 @@ async function profileProcessIds(uid: number): Promise<number[]> {
     const status = await Deno.readTextFile(`/proc/${entry.name}/status`).catch(
       () => null,
     );
-    if (status !== null && isRunnableProfileProcess(status, uid)) {
+    const owner = status?.match(/^Uid:\s+(\d+)/m)?.[1];
+    if (owner !== undefined && Number(owner) === uid) {
       ids.push(Number(entry.name));
     }
   }

isolation_test.ts

@@ -1,7 +1,6 @@
 import { assertEquals, assertRejects } from "jsr:@std/assert@1";
 import {
   agentCommand,
-  isRunnableProfileProcess,
   killProfileProcesses,
   readProfileFile,
 } from "./isolation.ts";
@@ -17,11 +16,6 @@ const profile = (uid: number, home: string): RuntimeProfile => ({
   tokenFile: null,
 });
 
-Deno.test("zombie process entries are already quiescent", () => {
-  const status = "State:\tZ (zombie)\nUid:\t20010\t20010\t20010\t20010\n";
-  assertEquals(isRunnableProfileProcess(status, 20_010), false);
-});
-
 Deno.test({
   name: "refuses to read a profile result symlink as root",
   permissions: { read: true, write: true, sys: ["uid"] },
@@ -87,7 +81,7 @@ Deno.test({
 });
 
 Deno.test({
-  name: "cleanup leaves no runnable daemonized process",
+  name: "cleanup kills daemonized processes before returning",
   permissions: "inherit",
   async fn() {
     if (Deno.uid() !== 0) return;
@@ -101,15 +95,9 @@ Deno.test({
 
     await killProfileProcesses(selected.uid);
 
-    const status = await Deno.readTextFile(`/proc/${pid}/status`).catch(
-      (error) => {
-        if (error instanceof Deno.errors.NotFound) return null;
-        throw error;
-      },
-    );
-    assertEquals(
-      status === null || !isRunnableProfileProcess(status, selected.uid),
-      true,
+    await assertRejects(
+      () => Deno.stat(`/proc/${pid}`),
+      Deno.errors.NotFound,
     );
   },
 });