refactor(admission): own inspector, web, and CLI state per host (#8058)

* refactor(admission): own inspector, web, and CLI state per host

Replace the process-global inspector, web-bundle, guidance, and JavaScript
counters with objects a host passes in, so independent instances do not
share admission or cleanup.

* fix(admission): keep worker and file cleanup on the host

Web-bundle and JavaScript workers retry only their host registry, and
each Inspector admission authorizes and closes its own file scope.
Browser providers can share one web-bundle admission.

* test(inspector): gate one admission's file cleanup

The isolation test delayed the first ArtifactResourceScope.retryCleanup
call, so a second call on a shared ElectronFileScope still finished.
Hold first.files.retryCleanup until the other admission's close
finishes, then release and join before restoring the method.

---------

Co-authored-by: Cursor Agent <cursoragent@cursor.com>

src/cli/javascriptApplicationAnalysis.ts

@@ -50,40 +50,48 @@ export const cliJavaScriptSourcePaths = async (
 };
 
 /**
- * One scope for every JavaScript analysis in this process. A healthy worker
- * stays parked between commands; {@link closeCliJavaScriptResources} stops it.
- * Pending cleanup is still retried before each command returns.
+ * One parked JavaScript worker for one CLI host. A healthy worker stays
+ * parked between that host's commands. Independent hosts do not share it.
  */
-let retainedScope: ArtifactResourceScope | undefined;
-/** One shutdown shared by the exit callback and the dispatch `finally`. */
-let closing: Promise<void> | undefined;
+export class CliJavaScriptAnalysisHost {
+  #retainedScope: ArtifactResourceScope | undefined;
+  /** One shutdown shared by the exit callback and the dispatch `finally`. */
+  #closing: Promise<void> | undefined;
 
-const cliAnalysisScope = (): ArtifactResourceScope => {
-  retainedScope ??= new ArtifactResourceScope();
-  return retainedScope;
-};
+  scope(): ArtifactResourceScope {
+    this.#retainedScope ??= new ArtifactResourceScope();
+    return this.#retainedScope;
+  }
 
-/**
- * Stop the process-owned JavaScript worker. Callers that overlap share the
- * attempt in flight. The scope stays owned when shutdown fails, so the next
- * call retries instead of treating the worker as already released.
- */
-export const closeCliJavaScriptResources = (): Promise<void> => {
-  if (closing !== undefined) return closing;
-  const scope = retainedScope;
-  if (scope === undefined) return Promise.resolve();
-  let published: Promise<void>;
-  published = scope
-    .close()
-    .then(() => {
-      if (retainedScope === scope) retainedScope = undefined;
-    })
-    .finally(() => {
-      if (closing === published) closing = undefined;
-    });
-  closing = published;
-  return published;
-};
+  /**
+   * Stop this host's worker. Overlapping callers share the attempt in flight.
+   * The scope stays owned when shutdown fails, so the next call retries.
+   */
+  close(): Promise<void> {
+    if (this.#closing !== undefined) return this.#closing;
+    const scope = this.#retainedScope;
+    if (scope === undefined) return Promise.resolve();
+    let published: Promise<void>;
+    published = scope
+      .close()
+      .then(() => {
+        if (this.#retainedScope === scope) this.#retainedScope = undefined;
+      })
+      .finally(() => {
+        if (this.#closing === published) this.#closing = undefined;
+      });
+    this.#closing = published;
+    return published;
+  }
+}
+
+/** Process CLI host used when a caller does not pass its own host. */
+const processJavaScriptAnalysis = new CliJavaScriptAnalysisHost();
+
+/** Stop the process-owned JavaScript worker. */
+export const closeCliJavaScriptResources = (
+  host: CliJavaScriptAnalysisHost = processJavaScriptAnalysis,
+): Promise<void> => host.close();
 
 /** Execute the shared CLI boundary for static JavaScript analysis. */
 export const runCliJavaScriptApplicationAnalysis = async (
@@ -95,6 +103,7 @@ export const runCliJavaScriptApplicationAnalysis = async (
     readonly evidenceOutput: string | undefined;
     readonly view?: AnalysisViewRequest;
   },
+  host: CliJavaScriptAnalysisHost = processJavaScriptAnalysis,
 ): Promise<JsonValue> => {
   const { analyzeJavaScriptApplication } =
     await import("../application/javascript/JavaScriptApplicationService.js");
@@ -104,7 +113,7 @@ export const runCliJavaScriptApplicationAnalysis = async (
     },
     { minimumIntervalMs: 0 },
   );
-  const resources = cliAnalysisScope();
+  const resources = host.scope();
   const result = await analyzeJavaScriptApplication(input, resources, {
     environment,
     progress,