@stratusagent/channel-slack 0.3.0 → 0.6.0

package/dist/index.js

@@ -85,12 +85,32 @@ class ReplyRenderer {
             return;
         }
         if (event.type === 'tool.called') {
+            // Also a turn boundary. On the kernel path `provider.response` has
+            // already marked one, and marking it twice costs nothing; on a
+            // provider that hosts its own loop there is no provider.response at
+            // all, so this is the only thing between the text before a tool and
+            // the text after it — without it they fuse in the live message.
+            this.turnBreakPending = true;
             this.toolLine = `⚙ ${event.call.toolName}…`;
             this.scheduleEdit();
             return;
         }
+        if (event.type === 'tool.denied') {
+            // Denial settles a call that never reached tool.called, so nothing
+            // else clears the status line or marks the boundary for it — the
+            // message would keep claiming a refused tool is running, and the
+            // model's follow-up would fuse with the text before the attempt.
+            this.toolLine = undefined;
+            this.turnBreakPending = true;
+            this.scheduleEdit();
+            return;
+        }
         if (event.type === 'tool.completed') {
             this.toolLine = undefined;
+            // Also a boundary, and not only for symmetry: a call rejected before
+            // execution settles as tool.completed without ever having emitted
+            // tool.called, so this is the only mark that attempt leaves.
+            this.turnBreakPending = true;
             // Clear the visible status promptly: the next provider turn may be
             // non-streaming or slow to its first delta, and the message must not
             // claim a finished tool is still running that whole time.
@@ -251,6 +271,102 @@ const lastAssistantReply = (session) => {
     }
     return '(no reply)';
 };
+const APPROVAL_ACTIONS = {
+    stratus_approve_once: 'once',
+    stratus_approve_always: 'always',
+    stratus_deny: 'deny',
+};
+/**
+ * How an approval request reads once it is settled. `always` deliberately
+ * says "this session" out loud: the button is the shortest path to widening
+ * what an agent does unattended, and an approver should see the scope they
+ * granted in the record of granting it.
+ */
+const OUTCOME_TEXT = {
+    'decided:once': 'Allowed once',
+    'decided:always': 'Allowed for the rest of this session',
+    'decided:deny': 'Denied',
+    'timeout:deny': 'Expired without an answer — denied',
+    // Covers both endings that reach here: the turn was aborted, and the
+    // daemon shut down with the request still outstanding.
+    'cancelled:deny': 'Cancelled before anyone answered — denied',
+    'undeliverable:deny': 'Could not be put to an approver — denied',
+};
+/** Comfortably inside Slack's 3000-character section limit. */
+const APPROVAL_INPUT_LIMIT = 1400;
+/** One line in a notification; the blocks carry the readable version. */
+const APPROVAL_SUMMARY_LIMIT = 160;
+/**
+ * Slack's three markup characters. Tool input is written by a model, so it
+ * reaches this message as untrusted text: unescaped, `<@U123>` becomes a
+ * real mention and `<!channel>` a real broadcast, letting an agent ping a
+ * workspace through the very prompt asking whether to trust it. Escaping is
+ * applied even inside a code block, where clients disagree about whether
+ * that markup still resolves.
+ */
+const escapeSlackText = (text) => text.replaceAll('&', '&amp;').replaceAll('<', '&lt;').replaceAll('>', '&gt;');
+/**
+ * What the approver is actually being asked to allow.
+ *
+ * Without this the prompt names only the tool, and for anything whose
+ * danger lives in its arguments — the shell tool this engine exists for —
+ * `ls` and a destructive command produce an identical message. Approving
+ * something you cannot see is not approval.
+ *
+ * Truncation is announced rather than silent for the same reason: a
+ * decision made on a partial view should at least know it is partial.
+ */
+const renderInvocation = (input) => {
+    if (Object.keys(input).length === 0) {
+        return { summary: '', truncated: false };
+    }
+    const rendered = JSON.stringify(input, null, 2);
+    const truncated = rendered.length > APPROVAL_INPUT_LIMIT;
+    const oneLine = JSON.stringify(input);
+    return {
+        detail: truncated ? rendered.slice(0, APPROVAL_INPUT_LIMIT) : rendered,
+        summary: oneLine.length > APPROVAL_SUMMARY_LIMIT
+            ? `${oneLine.slice(0, APPROVAL_SUMMARY_LIMIT)}…`
+            : oneLine,
+        truncated,
+    };
+};
+const approvalBlocks = (agentName, toolName, risk, requestId, input) => {
+    const invocation = renderInvocation(input);
+    return [
+        {
+            type: 'section',
+            text: {
+                type: 'mrkdwn',
+                text: `*${escapeSlackText(agentName)}* wants to run \`${escapeSlackText(toolName)}\` (${risk}).`,
+            },
+        },
+        ...(invocation.detail
+            ? [{
+                    type: 'section',
+                    text: { type: 'mrkdwn', text: `\`\`\`\n${escapeSlackText(invocation.detail)}\n\`\`\`` },
+                }]
+            : []),
+        ...(invocation.truncated
+            ? [{
+                    type: 'context',
+                    elements: [{ type: 'mrkdwn', text: ':warning: Arguments shown are truncated — the full call is longer than this.' }],
+                }]
+            : []),
+        {
+            type: 'actions',
+            // The request id rides on every button rather than in the message
+            // reference: Slack gives the value back verbatim, so the gateway is
+            // asked about the request that was actually rendered, never one
+            // re-derived from a channel and timestamp.
+            elements: [
+                { type: 'button', action_id: 'stratus_approve_once', text: { type: 'plain_text', text: 'Allow once' }, value: requestId },
+                { type: 'button', action_id: 'stratus_approve_always', text: { type: 'plain_text', text: 'Always allow' }, value: requestId, style: 'primary' },
+                { type: 'button', action_id: 'stratus_deny', text: { type: 'plain_text', text: 'Deny' }, value: requestId, style: 'danger' },
+            ],
+        },
+    ];
+};
 /**
  * The Slack channel adapter. One Slack app per agent — Slack has no way to
  * give a single bot several identities with real avatars, presence, and
@@ -269,6 +385,9 @@ export const createSlackChannelAdapter = (options) => {
     const createSocket = options.createSocketClient ?? defaultSocketClient;
     const createWeb = options.createWebClient ?? defaultWebClient;
     const connections = [];
+    // Every agent this adapter was asked to carry, connected or not — the
+    // difference between "mine and broken" and "not mine".
+    const configuredAgents = new Set(options.agents.map((agent) => agent.agentId));
     // Renderers queue per session: two messages in one thread share a
     // session id, and the gateway serializes their turns — so events route
     // to the FIRST registered renderer (the running turn), never a later
@@ -284,8 +403,38 @@ export const createSlackChannelAdapter = (options) => {
     // Socket Mode redelivers on missed acks; a slow turn must not run twice.
     const seenEvents = new Set();
     const seenOrder = [];
+    // Rendered approval requests, keyed by the gateway's request id — the
+    // same id the buttons carry back.
+    const approvalPosts = new Map();
+    // Requests whose message is mid-post. A request can settle — expire, or
+    // its turn be cancelled — while the postMessage that announces it is
+    // still in flight, and the retraction would then find nothing to retract
+    // and leave live-looking buttons behind forever. Resolutions arriving in
+    // that window are held here and applied once the post lands. Bounded by
+    // construction: an id is only ever in this set while one HTTP call is
+    // outstanding.
+    const rendering = new Set();
+    const resolvedWhileRendering = new Map();
     let unsubscribe;
     let gatewayRef;
+    // Everything the adapter owes Slack goes through here, so stop() drains
+    // it: an approval question or its retraction must reach the workspace
+    // before the sockets close, or a message keeps offering buttons that
+    // nothing is listening for.
+    const track = (work) => {
+        // Also the rejection boundary, because this is where the work stops
+        // being anyone's to await: the caller hands it over and returns to the
+        // event loop, so a rejection past this point is attached to nothing
+        // and takes the daemon down under Node's default. One call site below
+        // remembers to catch before handing over, which is exactly the kind of
+        // rule that holds until the next call site forgets it -- so it lives
+        // here instead, where there is one of it.
+        const settled = work.catch((error) => {
+            warn(`slack: background work failed: ${error instanceof Error ? error.message : String(error)}`);
+        });
+        inflight.add(settled);
+        void settled.finally(() => inflight.delete(settled));
+    };
     const alreadySeen = (key) => {
         if (seenEvents.has(key)) {
             return true;
@@ -329,6 +478,317 @@ export const createSlackChannelAdapter = (options) => {
         }
         return result.trim();
     };
+    const connectionFor = (agentId) => connections.find((candidate) => candidate.config.agentId === agentId);
+    /**
+     * Renders one parked call as buttons and remembers where it went.
+     *
+     * A request this adapter cannot route is DENIED here rather than left to
+     * expire: with no approver configured, or no conversation to ask in,
+     * waiting out the timeout tells the agent nothing it will not be told
+     * immediately, and holds the turn (and the thread it is answering) open
+     * for the whole window to get there.
+     */
+    const renderApprovalRequest = async (event) => {
+        const gateway = gatewayRef;
+        if (!gateway) {
+            return;
+        }
+        const connection = connectionFor(event.agentId);
+        if (!connection) {
+            // Two different situations, and only one of them is this adapter's
+            // to answer.
+            //
+            // An agent it was configured for but could not connect (a failed
+            // auth, a dead app token) is its own: it was supposed to carry that
+            // agent's approvals and cannot, so it says so rather than letting
+            // every gated call wait out the timeout.
+            //
+            // An agent it was never configured for is NOT. Approval requests are
+            // a broadcast, and another channel may be the one that serves that
+            // agent — denying here would let Slack refuse a question somebody
+            // else was going to ask. `stratus serve` reports agents that no
+            // channel can ask for, at startup, where the whole roster is visible.
+            if (configuredAgents.has(event.agentId)) {
+                warn(`slack: ${event.agentId} has no live connection; denying ${event.call.toolName}`);
+                gateway.resolveApproval({ requestId: event.requestId, answer: 'deny', reason: 'undeliverable' });
+            }
+            return;
+        }
+        const approvers = new Set((connection.config.approvers ?? []).filter((id) => id.length > 0));
+        const metadata = event.metadata ?? {};
+        const sameChannel = metadata.channel === 'slack' && typeof metadata.slackChannel === 'string'
+            ? metadata.slackChannel
+            : undefined;
+        const channel = sameChannel ?? connection.config.approvalChannel;
+        const thread = sameChannel && typeof metadata.slackThread === 'string' ? metadata.slackThread : undefined;
+        // Undeliverable, not decided: nobody was asked, so filing this next to
+        // the denials somebody actually made would make the audit record lie
+        // about which is which.
+        const decline = (reason) => {
+            warn(`slack: ${reason}; denying ${event.call.toolName} for ${event.agentId}`);
+            gateway.resolveApproval({ requestId: event.requestId, answer: 'deny', reason: 'undeliverable' });
+        };
+        if (approvers.size === 0) {
+            decline(`no approvers configured for ${event.agentId}`);
+            return;
+        }
+        if (!channel) {
+            decline(`no conversation to ask in for ${event.agentId}`);
+            return;
+        }
+        const agentName = gateway.agents().find((agent) => agent.id === event.agentId)?.name ?? event.agentId;
+        // The notification preview is all some approvers see before deciding
+        // whether to open the thread, so it carries the arguments too — just
+        // the short form.
+        const invocationSummary = renderInvocation(event.call.input).summary;
+        // The post is the only awaited step, and the only window in which the
+        // request can settle behind this function's back — so it is the only
+        // step `rendering` covers, and nothing decides anything until it is
+        // over and the two possible outcomes can be told apart.
+        rendering.add(event.requestId);
+        let post;
+        let failure;
+        try {
+            const posted = await connection.web.chat.postMessage({
+                channel,
+                // Fallback text for notifications and clients that do not render
+                // blocks — an approval nobody can read is an approval nobody gives.
+                text: escapeSlackText(`${agentName} wants to run ${event.call.toolName} (${event.risk})`
+                    + `${invocationSummary ? `: ${invocationSummary}` : ''}.`),
+                ...(thread ? { thread_ts: thread } : {}),
+                blocks: approvalBlocks(agentName, event.call.toolName, event.risk, event.requestId, event.call.input),
+            });
+            post = posted.ts
+                ? {
+                    connection,
+                    channel: posted.channel ?? channel,
+                    ts: posted.ts,
+                    ...(thread ? { thread } : {}),
+                    agentName,
+                    toolName: event.call.toolName,
+                    risk: event.risk,
+                    approvers,
+                }
+                : undefined;
+            failure = post ? undefined : `Slack accepted the approval request for ${event.agentId} without a timestamp`;
+        }
+        catch (error) {
+            failure = `could not post an approval request to ${channel} (${error instanceof Error ? error.message : String(error)})`;
+        }
+        rendering.delete(event.requestId);
+        if (post) {
+            approvalPosts.set(event.requestId, post);
+        }
+        const settledMeanwhile = resolvedWhileRendering.get(event.requestId);
+        if (settledMeanwhile) {
+            resolvedWhileRendering.delete(event.requestId);
+            // Already decided — never decline it a second time; just take the
+            // buttons off the message that just appeared.
+            if (post) {
+                await retractApprovalRequest(settledMeanwhile);
+            }
+            return;
+        }
+        if (failure) {
+            decline(failure);
+        }
+    };
+    /**
+     * Retracts the buttons once a request is settled, however it settled.
+     * Every ending goes through here — a click, the timeout, a cancelled turn
+     * — so a message can never keep offering a decision that no longer has
+     * anywhere to land.
+     */
+    /**
+     * Rewrites a prompt left behind by a daemon that is gone, using the
+     * click's own coordinates.
+     *
+     * The index of posted requests is in-memory and keyed by request id, so
+     * a new process starts empty and has no way to find the messages its
+     * predecessor posted. An interaction payload carries the channel and
+     * timestamp of the message it came from, which is the one handle on such
+     * a message that survives — so the click that discovers the prompt is
+     * dead is also what retires it. Unclicked orphans stay as they are;
+     * clearing those needs the posts to be durable, which is a larger change
+     * than this and belongs to both billing paths equally.
+     */
+    const offersDecision = (blocks) => (blocks ?? []).some((block) => block.type === 'actions');
+    const retireOrphanedPrompt = async (connection, args) => {
+        const channel = args.body?.channel?.id;
+        const ts = args.body?.message?.ts;
+        if (!channel || !ts) {
+            return;
+        }
+        // The message decides, not a memory of it. Every ending rewrites this
+        // message into a plain section, so buttons still on it mean nothing
+        // has been written there yet — and no buttons means something has, and
+        // overwriting it would replace a real outcome and the person who made
+        // it. Reading the click's own copy answers that with no bookkeeping to
+        // disagree with, and no second API call to ask.
+        if (!offersDecision(args.body?.message?.blocks)) {
+            return;
+        }
+        const text = 'This request is no longer pending — the daemon that asked it is no longer running.';
+        try {
+            await connection.web.chat.update({
+                channel,
+                ts,
+                text,
+                blocks: [{ type: 'section', text: { type: 'mrkdwn', text } }],
+            });
+        }
+        catch (error) {
+            warn(`slack: could not retire an orphaned approval request: ${error instanceof Error ? error.message : String(error)}`);
+        }
+    };
+    const retractApprovalRequest = async (event) => {
+        const post = approvalPosts.get(event.requestId);
+        if (!post) {
+            // Still being posted: hold the outcome so the message it is about to
+            // create does not keep offering a decision that is already made.
+            if (rendering.has(event.requestId)) {
+                resolvedWhileRendering.set(event.requestId, event);
+            }
+            return;
+        }
+        approvalPosts.delete(event.requestId);
+        const outcome = OUTCOME_TEXT[`${event.reason}:${event.answer}`] ?? 'Resolved';
+        const by = event.actor ? ` by <@${event.actor}>` : '';
+        const text = `*${escapeSlackText(post.agentName)}* — \`${escapeSlackText(post.toolName)}\` (${post.risk}): ${outcome}${by}.`;
+        try {
+            await post.connection.web.chat.update({
+                channel: post.channel,
+                ts: post.ts,
+                text,
+                blocks: [{ type: 'section', text: { type: 'mrkdwn', text } }],
+            });
+        }
+        catch (error) {
+            warn(`slack: could not update a resolved approval request: ${error instanceof Error ? error.message : String(error)}`);
+        }
+    };
+    /**
+     * Says so in the thread when a turn fails with nobody rendering it.
+     *
+     * The intake path reports a failure through the renderer it opened, so a
+     * turn this process started is always answered. A turn it did NOT start
+     * has no renderer: one the startup sweep failed because the last daemon
+     * died mid-turn, or one whose recovery could not be finished. Those are
+     * exactly the cases where the person is still looking at the thread,
+     * and silence there reads as an agent that simply never replied.
+     *
+     * The routing has to come from the durable session, because the only
+     * in-memory copy died with the process that had it.
+     */
+    const reportUnrenderedFailure = async (event) => {
+        const gateway = gatewayRef;
+        if (!gateway?.sessionRouting) {
+            return;
+        }
+        let routing;
+        try {
+            routing = await gateway.sessionRouting(event.sessionId);
+        }
+        catch (error) {
+            // A store that cannot answer is not a reason to lose the daemon, and
+            // the turn is already failed — there is nothing here to salvage
+            // beyond saying why the thread stayed quiet.
+            warn(`slack: could not read the routing for a failed turn: ${error instanceof Error ? error.message : String(error)}`);
+            return;
+        }
+        const metadata = routing?.metadata;
+        // Another surface's session, or one with no conversation to speak
+        // into. Not this adapter's to answer either way.
+        if (!routing || metadata?.channel !== 'slack' || typeof metadata.slackChannel !== 'string') {
+            return;
+        }
+        const connection = connectionFor(routing.agentId);
+        if (!connection) {
+            return;
+        }
+        const thread = typeof metadata.slackThread === 'string' ? metadata.slackThread : undefined;
+        try {
+            await connection.web.chat.postMessage({
+                channel: metadata.slackChannel,
+                text: `Something went wrong: ${event.error}`,
+                ...(thread ? { thread_ts: thread } : {}),
+            });
+        }
+        catch (error) {
+            warn(`slack: could not report a failed turn: ${error instanceof Error ? error.message : String(error)}`);
+        }
+    };
+    const handleInteractive = async (connection, args) => {
+        // Ack first and unconditionally: Slack retries an unacked interaction,
+        // and a redelivered click on a request that is no longer pending would
+        // read as a second, rejected decision.
+        await args.ack();
+        const gateway = gatewayRef;
+        const action = args.body?.actions?.[0];
+        const answer = action?.action_id ? APPROVAL_ACTIONS[action.action_id] : undefined;
+        const requestId = action?.value;
+        if (!gateway || !answer || !requestId) {
+            return;
+        }
+        const post = approvalPosts.get(requestId);
+        const clicker = args.body?.user?.id;
+        // An unknown request predates this daemon or was already settled; the
+        // click is answered where it was made, not silently dropped.
+        if (!post) {
+            await tellClicker(connection, args, 'That approval request is no longer pending.');
+            // And the message itself is corrected, so the next person to read it
+            // is not offered a decision nothing is waiting for — unless it is
+            // one still being posted, which is live with the index simply not
+            // caught up yet. Slack can show a message before postMessage
+            // resolves here, so a fast click lands inside that window, and
+            // stripping its buttons would strand the turn until the approval
+            // times out: the record written when the post lands does not put
+            // them back. Whether anything has already been written on the
+            // message is `retireOrphanedPrompt`'s own question, answered from
+            // the message rather than from a memory of it.
+            if (!rendering.has(requestId)) {
+                await retireOrphanedPrompt(connection, args);
+            }
+            return;
+        }
+        // A different agent's app relaying a click would bypass the approver
+        // set bound to the request, since each app carries its own.
+        if (post.connection !== connection) {
+            return;
+        }
+        if (!clicker || !post.approvers.has(clicker)) {
+            // The request stays pending: someone who may not decide clicking is
+            // not a decision, and consuming the request would let any channel
+            // member deny an agent's work.
+            await tellClicker(connection, args, `You are not an approver for ${post.agentName}, so that decision was not recorded.`);
+            return;
+        }
+        // The retraction rides on tool.approval-resolved, which the gateway
+        // emits from resolveApproval — so a decision and the message showing it
+        // cannot disagree, and the timeout path retracts through the same code.
+        if (!gateway.resolveApproval({ requestId, answer, actor: clicker })) {
+            await tellClicker(connection, args, 'That approval request is no longer pending.');
+        }
+    };
+    const tellClicker = async (connection, args, text) => {
+        const user = args.body?.user?.id;
+        const channel = args.body?.channel?.id;
+        if (!user || !channel) {
+            return;
+        }
+        const thread = args.body?.message?.thread_ts;
+        try {
+            await connection.web.chat.postEphemeral({
+                channel,
+                user,
+                text,
+                ...(thread ? { thread_ts: thread } : {}),
+            });
+        }
+        catch (error) {
+            warn(`slack: could not send an ephemeral notice: ${error instanceof Error ? error.message : String(error)}`);
+        }
+    };
     const handleInbound = async (connection, args) => {
         // Ack immediately: Slack redelivers unacked envelopes, and a turn can
         // outlive the ack window many times over.
@@ -396,7 +856,15 @@ export const createSlackChannelAdapter = (options) => {
                 sessionId,
                 agentId: connection.config.agentId,
                 userMessage,
-                metadata: { channel: 'slack', team, slackChannel: event.channel, slackUser: userId },
+                metadata: {
+                    channel: 'slack',
+                    team,
+                    slackChannel: event.channel,
+                    slackUser: userId,
+                    // Carried so a mid-turn approval question is asked in the thread
+                    // the turn belongs to rather than at the top of a busy channel.
+                    ...(thread ? { slackThread: thread } : {}),
+                },
             });
             return { renderer, turn };
         });
@@ -448,6 +916,39 @@ export const createSlackChannelAdapter = (options) => {
         async start(gateway) {
             gatewayRef = gateway;
             unsubscribe = gateway.bus.subscribe((event) => {
+                // Approval traffic is not part of a reply: it gets its own message
+                // with its own lifetime, and routing it through the running turn's
+                // renderer would fold a question into the answer being streamed.
+                if (event.type === 'tool.approval-requested') {
+                    track(renderApprovalRequest(event));
+                    return;
+                }
+                if (event.type === 'tool.approval-resolved') {
+                    track(retractApprovalRequest(event));
+                    return;
+                }
+                // A failure with no renderer is not a turn this process is
+                // serving — it is one the startup sweep or a failed recovery
+                // closed out. Nothing downstream would say anything about it.
+                //
+                // A non-empty queue is not proof the failure belongs to a turn
+                // this adapter dispatched, only that it has one for this session.
+                // A renderer is queued at intake, before the gateway starts the
+                // turn it belongs to, so a message arriving while a recovery is
+                // still ahead of it on the session chain leaves the recovery's
+                // failure looking rendered when it is not. Suppressing is the
+                // conservative half of that trade: the alternative reports every
+                // ordinary failure twice.
+                //
+                // Telling them apart needs a turn identifier, which `StratusEvent`
+                // does not carry — the same gap 05's WS envelope closes with
+                // `{ sessionId, turnId, event }`. The routing a line below has it
+                // too: recovery events are already delivered to whichever renderer
+                // is at the head of the queue, whether or not it is theirs.
+                if (event.type === 'session.failed' && !renderers.get(event.sessionId)?.length) {
+                    track(reportUnrenderedFailure(event));
+                    return;
+                }
                 if ('sessionId' in event) {
                     renderers.get(event.sessionId)?.[0]?.onEvent(event);
                 }
@@ -478,6 +979,11 @@ export const createSlackChannelAdapter = (options) => {
                     };
                     socket.on('app_mention', onEvent);
                     socket.on('message', onEvent);
+                    socket.on('interactive', (args) => {
+                        track(handleInteractive(connection, args).catch((error) => {
+                            warn(`slack interaction handling failed: ${error instanceof Error ? error.message : String(error)}`);
+                        }));
+                    });
                     await socket.start();
                     connections.push(connection);
                     log(`slack: ${config.agentId} connected (bot ${connection.botUserId} in team ${connection.teamId})`);
@@ -489,15 +995,26 @@ export const createSlackChannelAdapter = (options) => {
             }
         },
         async stop() {
-            // Stop intake first: with the sockets down no new event can slip
-            // into `inflight` after the drain snapshot below, so nothing posts
-            // to Slack after stop() returns.
+            // Stop intake first, so no new INBOUND event can slip into
+            // `inflight` after the drain snapshot below.
+            //
+            // That is narrower than it used to claim. The snapshot is taken
+            // once, and this unsubscribes from the bus only after it, so a turn
+            // still finishing can emit an event whose subscriber tracks work
+            // this drain never waits for — a retraction posted after stop()
+            // returns, or dropped with the process. Draining until `inflight`
+            // stays empty would close it, and would make stop() wait on turns
+            // the gateway drains after this call rather than before; worth doing
+            // deliberately, not as a side effect.
             await Promise.allSettled(connections.map((connection) => connection.socket.disconnect()));
             await Promise.allSettled([...inflight]);
             unsubscribe?.();
             unsubscribe = undefined;
             gatewayRef = undefined;
             connections.length = 0;
+            approvalPosts.clear();
+            rendering.clear();
+            resolvedWhileRendering.clear();
         },
     };
 };