ompchamber 3.1.0 → 3.1.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ompchamber",
-  "version": "3.1.0",
+  "version": "3.1.1",
   "description": "Developer web console and diagnostic chamber for AI Oh-My-Pi — Elysia + Preact on Bun.",
   "license": "UNLICENSED",
   "author": "Wijanarko Putra Rajeb <wijanarko.rajeb@gmail.com>",

package/src/cli/lib/args.js

@@ -188,7 +188,7 @@ USAGE:
 COMMANDS:
   serve          Start the OMPChamber web server (default when no command is given)
   update         Update OMPChamber to the latest GitHub release
-  stop           Stop running OMPChamber instances (every one, or --port <port>)
+  stop           Stop the instances the CLI started (--port/--all to stop any)
   restart        Stop and start again (every CLI-started instance, or --port <port>)
   status         Show running instances (every one, or --port <port>)
   logs           Print or follow server logs (every instance, or --port <port>)
@@ -201,7 +201,7 @@ OPTIONS:
   --prod                  Run the production build instead of the dev server
   --foreground            Run the server in the foreground (no daemon)
   --no-daemon             Alias for --foreground
-  --all                   Explicit form of the default for stop/restart (every instance)
+  --all                   Every instance, including ones started outside the CLI
   -c, --check             Report whether a newer release exists without installing it
   --force                 Reinstall even when already up to date
   --no-restart            Do not restart a running instance after updating
@@ -226,7 +226,8 @@ EXAMPLES:
   ompchamber serve --prod          # Serve the production build
   ompchamber update --check        # Is a newer release available?
   ompchamber update                # Update, then restart a running instance
-  ompchamber stop                  # Stop the running instance
+  ompchamber stop                  # Stop the instances the CLI started
+  ompchamber stop --port 3000      # Stop the instance on port 3000, whoever started it
   ompchamber restart               # Restart the server
   ompchamber status                # Show whether the server is running
   ompchamber logs -f -n 200        # Follow the last 200 log lines

package/src/cli/lib/commands/restart.js

@@ -1,19 +1,20 @@
 // `ompchamber restart` — stop live instances, then serve again.
 //
 // Scoping matches `status` and `stop`: without `--port` every live instance is
-// restarted on its own recorded port/host/mode, and `--port <port>` restricts
-// the restart to that one. With nothing running, the command is simply `serve`.
+// considered, and `--port <port>` restricts the restart to that one. With
+// nothing running, the command is simply `serve`.
 //
 // Instances the CLI did not start are left alone, exactly as `ompchamber update`
 // leaves them: `bun run dev` and `bun run start` own their own process, so
-// replacing it would break a loop OMPChamber does not manage. `ompchamber stop`
-// is still the deliberate way to end one.
+// replacing it would break a loop OMPChamber does not manage. `ompchamber stop
+// --port <port>` (or `--all`) is the deliberate way to end one.
 
 import { findLiveInstance, listLiveInstances, stopInstance } from '@/cli/lib/runtime.js';
 import { STOP_TIMEOUT_MS } from '@/cli/lib/process-lifecycle.js';
 import { log, isJson, isQuiet } from '@/cli/lib/output.js';
 import { run as runServe } from '@/cli/lib/commands/serve.js';
-import { isAutoRestartable, skipRestartNote } from '@/server/lib/lifecycle/restart';
+import { skipRestartNote } from '@/server/lib/lifecycle/restart';
+import { isCliManaged } from '@/server/lib/lifecycle/launch-mode';
 
 function explicitPort(options) {
   const raw = options?.port;
@@ -34,7 +35,7 @@ export async function run(options, ctx) {
   if (targets.length === 0) return runServe(options, ctx);
 
   for (const live of targets) {
-    if (!isAutoRestartable(live.launchMode)) {
+    if (!isCliManaged(live.launchMode)) {
       if (!json && !quiet) log(`Skipping OMPChamber on port ${live.port}: ${skipRestartNote(live.launchMode)}.`);
       continue;
     }

package/src/cli/lib/commands/stop.js

@@ -1,22 +1,19 @@
-// `ompchamber stop` — stop one or every live OMPChamber instance.
+// `ompchamber stop` — stop OMPChamber instances.
+//
+// Scope follows OWNERSHIP, the same rule `restart` and `update` apply. By
+// default only the instances the CLI started are stopped, because a server
+// running from source is supervised by a launcher the CLI does not own and
+// that launcher exits with the child it spawned: `bun run dev` is a process
+// whose whole job is to mirror the script under it, so signalling the server
+// takes the user's dev loop down with it. `--port <port>` and `--all` are the
+// explicit forms that do end one — naming an instance is a deliberate call,
+// not a default.
 
 import { listLiveInstances, findLiveInstance, stopInstance } from '@/cli/lib/runtime.js';
 import { STOP_TIMEOUT_MS } from '@/cli/lib/process-lifecycle.js';
-import { ok, warn, printJson, isJson } from '@/cli/lib/output.js';
-
-function resolvePort(options) {
-  const raw = options?.port;
-  if (raw !== null && raw !== undefined) {
-    const parsed = Number(raw);
-    if (Number.isFinite(parsed)) return parsed;
-  }
-  const env = Bun.env.OMPCHAMBER_PORT;
-  if (typeof env === 'string' && env.trim().length > 0) {
-    const parsed = Number(env.trim());
-    if (Number.isFinite(parsed)) return parsed;
-  }
-  return 3000;
-}
+import { ok, warn, log, printJson, isJson, isQuiet } from '@/cli/lib/output.js';
+import { unmanagedReason } from '@/server/lib/lifecycle/launch-mode';
+import { partitionStopTargets } from '@/cli/lib/stop-scope.js';
 
 function explicitPort(options) {
   const raw = options?.port;
@@ -25,30 +22,40 @@ function explicitPort(options) {
   return Number.isFinite(parsed) ? parsed : null;
 }
 
+/** How to end an instance the default scope leaves alone. */
+function stopHint(port) {
+  return `stop it with \`ompchamber stop --port ${port}\` or \`ompchamber stop --all\``;
+}
+
 export async function run(options) {
   const json = isJson();
+  const quiet = isQuiet();
   const requested = explicitPort(options);
+  // `--all` is the explicit spelling of "every instance, whoever started it".
+  const explicitScope = requested !== null || Boolean(options?.all);
+
+  const live = requested !== null
+    ? [await findLiveInstance(requested)].filter(Boolean)
+    : await listLiveInstances();
+  const { targets, skipped } = partitionStopTargets(live, explicitScope);
+  const skippedReport = skipped.map((entry) => ({ port: entry.port, pid: entry.pid, launchMode: entry.launchMode }));
 
-  // No `--port` means every live instance: a CLI server, a dev run and a
-  // production server are three processes, and `stop` without a port is the
-  // command that clears all of them. `--all` is the explicit spelling of the
-  // same default, kept because it reads well in scripts.
-  let targets;
-  if (requested !== null) {
-    const live = await findLiveInstance(requested);
-    targets = live ? [live] : [];
-  } else {
-    targets = await listLiveInstances();
+  if (!json && !quiet) {
+    for (const entry of skipped) {
+      log(`Skipping OMPChamber on port ${entry.port} (pid ${entry.pid}): it ${unmanagedReason(entry.launchMode)} — ${stopHint(entry.port)}.`);
+    }
   }
 
   if (targets.length === 0) {
     if (json) {
-      printJson({ stopped: [] });
+      printJson({ stopped: [], skipped: skippedReport });
       return;
     }
-    warn(requested === null
-      ? 'No running OMPChamber instances found.'
-      : `No running OMPChamber instance on port ${requested}.`);
+    if (skipped.length === 0) {
+      warn(requested === null
+        ? 'No running OMPChamber instances found.'
+        : `No running OMPChamber instance on port ${requested}.`);
+    }
     return;
   }
 
@@ -64,5 +71,5 @@ export async function run(options) {
     }
   }
 
-  if (json) printJson({ stopped });
+  if (json) printJson({ stopped, skipped: skippedReport });
 }

package/src/cli/lib/commands/update.js

@@ -10,7 +10,8 @@ import { color, configure, error, log, ok, warn, printJson, isJson, isQuiet } fr
 import { listLiveInstances, findLiveInstance, stopInstance } from '@/cli/lib/runtime.js';
 import { STOP_TIMEOUT_MS } from '@/cli/lib/process-lifecycle.js';
 import { run as runServe } from '@/cli/lib/commands/serve.js';
-import { isAutoRestartable, skipRestartNote } from '@/server/lib/lifecycle/restart';
+import { skipRestartNote } from '@/server/lib/lifecycle/restart';
+import { isCliManaged } from '@/server/lib/lifecycle/launch-mode';
 import { resolveInstallContext, resolveOmpChamberVersion, updateOmpChamber } from '@/server/lib/updates/install';
 
 /**
@@ -30,7 +31,7 @@ async function restartInstances(options, ctx) {
   const restarted = [];
   const skipped = [];
   for (const entry of await liveInstances(options)) {
-    if (!isAutoRestartable(entry.launchMode)) {
+    if (!isCliManaged(entry.launchMode)) {
       skipped.push({ port: entry.port, pid: entry.pid, launchMode: entry.launchMode });
       log(`Skipping OMPChamber on port ${entry.port}: ${skipRestartNote(entry.launchMode)}.`);
       continue;

package/src/cli/lib/stop-scope.js

@@ -0,0 +1,23 @@
+// Ownership scope for `ompchamber stop`.
+//
+// Kept separate from the command so the rule is testable without a live
+// server: the default scope is the instances the CLI started, and only an
+// explicit `--port <port>` / `--all` widens it to the ones it did not. That
+// distinction is the whole reason this module exists — a server running from
+// source sits under a launcher that exits with its child, so stopping it by
+// default takes a `bun run dev` loop down with it.
+
+import { isCliManaged } from '@/server/lib/lifecycle/launch-mode';
+
+/**
+ * Split the live instances into the ones `stop` acts on and the ones it leaves
+ * alone. `explicit` is true when the user named a port or passed `--all`:
+ * naming an instance is a deliberate call, so ownership no longer gates it.
+ */
+export function partitionStopTargets(instances, explicit) {
+  if (explicit) return { targets: instances, skipped: [] };
+  return {
+    targets: instances.filter((entry) => isCliManaged(entry.launchMode)),
+    skipped: instances.filter((entry) => !isCliManaged(entry.launchMode)),
+  };
+}

package/src/cli/lib/stop-scope.test.js

@@ -0,0 +1,41 @@
+/**
+ * @license
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+import { describe, expect, test } from 'bun:test';
+
+import { partitionStopTargets } from '@/cli/lib/stop-scope.js';
+
+const daemon = { port: 3000, pid: 11, launchMode: 'daemon' };
+const foreground = { port: 3001, pid: 12, launchMode: 'foreground' };
+const dev = { port: 3002, pid: 13, launchMode: 'direct' };
+const unknown = { port: 3003, pid: 14, launchMode: 'unknown' };
+
+describe('partitionStopTargets', () => {
+  // The default scope is ownership, not "everything that answers /api/health".
+  // `bun run dev` is a supervisor whose only job is to mirror the script under
+  // it, so stopping that server exits the user's dev loop too — the bug this
+  // rule exists to prevent.
+  test('stops only the instances the CLI started when the scope is implicit', () => {
+    const { targets, skipped } = partitionStopTargets([daemon, dev, foreground, unknown], false);
+    expect(targets).toEqual([daemon, foreground]);
+    expect(skipped).toEqual([dev, unknown]);
+  });
+
+  // Naming an instance — a port or `--all` — is a deliberate call, so the
+  // ownership rule no longer gates it.
+  test('widens to every instance when the scope is explicit', () => {
+    const { targets, skipped } = partitionStopTargets([daemon, dev, unknown], true);
+    expect(targets).toEqual([daemon, dev, unknown]);
+    expect(skipped).toEqual([]);
+  });
+
+  test('an unreadable launch mode is never stopped implicitly', () => {
+    // A record whose launchMode could not be read must not authorise a kill:
+    // the safe reading is "not ours".
+    const { targets, skipped } = partitionStopTargets([{ port: 4000, pid: 99, launchMode: undefined }], false);
+    expect(targets).toEqual([]);
+    expect(skipped.length).toBe(1);
+  });
+});

package/src/server/lib/bundler/css.test.ts

@@ -0,0 +1,87 @@
+/**
+ * @license
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+import { describe, expect, test } from 'bun:test';
+import { mkdtemp, rm } from 'fs/promises';
+import { tmpdir } from 'os';
+import { join } from 'path';
+
+import cssPlugin from '@/server/lib/bundler/css';
+
+/**
+ * Build one stylesheet through the REAL plugin with the options the client
+ * build uses (`target: 'bun'`, `minify: true`), and return the emitted CSS.
+ *
+ * This is the end-to-end gate for the nesting bug: Bun's minifier re-nests a
+ * rule's nested at-rule as `@supports (…) { & { … } }` for a non-browser
+ * target, and Chrome then drops it whenever the parent selector names a
+ * pseudo-element. Asserting on the flattener's own output cannot catch that —
+ * only the bundle the browser is actually served can.
+ */
+async function buildThroughPlugin(css: string): Promise<string> {
+  const dir = await mkdtemp(join(tmpdir(), 'ompchamber-css-'));
+  try {
+    await Bun.write(join(dir, 'probe.css'), css);
+    const result = await Bun.build({
+      entrypoints: [join(dir, 'probe.css')],
+      outdir: join(dir, 'out'),
+      target: 'bun',
+      minify: true,
+      plugins: [cssPlugin],
+    });
+    if (!result.success) throw new Error(result.logs.map((log) => log.message).join('\n'));
+    return await Bun.file(join(dir, 'out', 'probe.css')).text();
+  } finally {
+    await rm(dir, { recursive: true, force: true });
+  }
+}
+
+describe('css plugin — nested at-rules reach the browser flattened', () => {
+  test('a placeholder colour refinement survives as a top-level @supports', async () => {
+    const out = await buildThroughPlugin(`.probe::placeholder {
+  color: var(--color-ink);
+  @supports (color: color-mix(in lab, red, red)) {
+    color: color-mix(in oklab, var(--color-ink) 40%, transparent);
+  }
+}
+`);
+
+    // No `&` anywhere: a nested rule under `::placeholder` is inert in Chrome,
+    // which leaves the rule's full-opacity fallback as the final colour.
+    expect(out).not.toMatch(/(?<!\\)&/);
+    expect(out).toContain('@supports');
+    expect(out).toContain('::placeholder');
+    expect(out).toContain('40%');
+  });
+
+  test('a scrollbar thumb keeps its translucent refinement', async () => {
+    const out = await buildThroughPlugin(`::-webkit-scrollbar-thumb {
+  background: var(--theme-ink);
+  @supports (color: color-mix(in lab, red, red)) {
+    background: color-mix(in srgb, var(--theme-ink) 20%, transparent);
+  }
+}
+`);
+
+    expect(out).not.toMatch(/(?<!\\)&/);
+    expect(out).toContain('20%');
+  });
+
+  test('declarations written after the at-rule keep their order in the bundle', async () => {
+    const out = await buildThroughPlugin(`.probe {
+  background: var(--theme-ink);
+  @supports (color: color-mix(in lab, red, red)) {
+    background: color-mix(in srgb, var(--theme-ink) 20%, transparent);
+  }
+  border-radius: 3px;
+}
+`);
+
+    // The trailing declaration must not be hoisted above the at-rule: that
+    // would let the at-rule's `background` win over a later one.
+    expect(out.indexOf('border-radius')).toBeGreaterThan(out.indexOf('@supports'));
+    expect(out).not.toMatch(/(?<!\\)&/);
+  });
+});

package/src/server/lib/bundler/css.ts

@@ -42,6 +42,15 @@
  *    never does), so there is no "build finished" moment to flush at. Writing
  *    each source's faces as its `onLoad` returns is order-independent and works
  *    identically under both entry points.
+ *
+ * 3. **Nested at-rules are flattened** (`flattenNestedAtRules`, registered
+ *    AFTER Tailwind so it sees the expanded tree). Bun's CSS minifier keeps the
+ *    nesting it is handed and, for `target: 'bun'`, re-nests a rule's nested
+ *    at-rule as `@supports (…) { & { … } }` — and Chrome drops a nested rule
+ *    whose parent selector names a pseudo-element. Tailwind emits its colour
+ *    fallbacks in exactly that shape, so the whole app's placeholder and
+ *    scrollbar colours silently collapsed to their fallback. See that module for
+ *    the measurement; this one only has to run it.
  */
 
 import { basename, dirname, isAbsolute, join, resolve as resolvePath } from 'path';
@@ -51,6 +60,7 @@ import type { BunPlugin } from 'bun';
 
 import { FONT_FACE_DIR } from '@/server/lib/assets/font-css.server';
 import { FONT_ROUTE_PREFIX, packageRoot } from '@/server/lib/assets/fonts.server';
+import { flattenNestedAtRules } from '@/server/lib/bundler/nested-at-rules';
 
 /** A `url(...)` whose target is a font file. */
 const URL_FUNCTION = /url\(\s*(['"]?)([^'")]+)\1\s*\)/g;
@@ -100,8 +110,13 @@ const plugin: BunPlugin = {
     build.onLoad({ filter: /\.css$/ }, async (args) => {
       const source = await Bun.file(args.path).text();
       // Tailwind first: it parses `@import "tailwindcss"` and `@theme`, and the
-      // urls it emits are the ones the extraction below has to recognise.
-      const expanded = await postcss([tailwind()]).process(source, { from: args.path });
+      // urls it emits are the ones the extraction below has to recognise. The
+      // flattener runs after it, because the nesting it removes is Tailwind's
+      // own output — and before the font extraction, so a hoisted face is still
+      // recognised as a face.
+      const expanded = await postcss([tailwind(), flattenNestedAtRules()]).process(source, {
+        from: args.path,
+      });
       const { rest, faces } = splitFontFaces(expanded.css, dirname(args.path));
       if (faces.length > 0) {
         const target = join(packageRoot(), FONT_FACE_DIR, `${basename(args.path)}`);

package/src/server/lib/bundler/nested-at-rules.test.ts

@@ -0,0 +1,100 @@
+/**
+ * @license
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+import { describe, expect, test } from 'bun:test';
+import postcss from 'postcss';
+
+import { flattenNestedAtRules } from '@/server/lib/bundler/nested-at-rules';
+
+/** Run the flattener and return the CSS it produced. */
+async function flatten(css: string): Promise<string> {
+  const result = await postcss([flattenNestedAtRules()]).process(css, { from: undefined });
+  return result.css;
+}
+
+/** Every `&` left outside an escaped class name — an unflattened nesting marker. */
+const unescapedAmpersands = (css: string): number => (css.match(/(?<!\\)&/g) ?? []).length;
+
+describe('flattenNestedAtRules', () => {
+  test('hoists a nested @supports out of a pseudo-element rule', async () => {
+    // Tailwind's shape: a fallback declaration, then the color-mix refinement.
+    const out = await flatten(
+      `.placeholder-ink\\/40::placeholder {
+        color: var(--color-ink);
+        @supports (color: color-mix(in lab, red, red)) {
+          color: color-mix(in oklab, var(--color-ink) 40%, transparent);
+        }
+      }`,
+    );
+
+    // The at-rule is at the top level and carries the resolved selector itself:
+    // a nested rule whose parent names a pseudo-element is dropped by Chrome.
+    expect(unescapedAmpersands(out)).toBe(0);
+    expect(out).not.toMatch(/::placeholder\s*\{[^}]*@supports/);
+    const root = postcss.parse(out);
+    const atRules = root.nodes.filter((n) => n.type === 'atrule');
+    expect(atRules).toHaveLength(1);
+    expect(atRules[0].name).toBe('supports');
+    expect(atRules[0].toString()).toContain('.placeholder-ink\\/40::placeholder');
+    expect(atRules[0].toString()).toContain('color-mix');
+  });
+
+  test('keeps declaration order, so the cascade is unchanged', async () => {
+    const out = await flatten(
+      `.a { color: red; @supports (display: block) { color: blue; } border-radius: 3px; }`,
+    );
+
+    const root = postcss.parse(out);
+    const order = root.nodes.map((node) =>
+      node.toString().replace(/\s+/g, ' '),
+    );
+    // `border-radius` was written AFTER the at-rule and must still follow it —
+    // moving it before would let the at-rule's `color` be overridden.
+    expect(order).toHaveLength(3);
+    expect(order[0]).toBe('.a { color: red; }');
+    expect(order[1]).toContain('@supports');
+    expect(order[2]).toBe('.a { border-radius: 3px; }');
+  });
+
+  test('hoists inside the layer that contained the rule, not to the root', async () => {
+    const out = await flatten(
+      `@layer base { .b::placeholder { color: red; @supports (display: block) { color: blue; } } }`,
+    );
+    expect(out).not.toMatch(/::placeholder\s*\{[^}]*@supports/);
+    expect(unescapedAmpersands(out)).toBe(0);
+    // The refinement stays inside `@layer base` — hoisting it past the layer
+    // boundary would change which layer wins.
+    const layer = postcss.parse(out).nodes.find((n) => n.type === 'atrule' && n.name === 'layer');
+    expect(layer?.toString()).toContain('@supports');
+  });
+
+  test('resolves an explicit & and leaves other rules alone', async () => {
+    const out = await flatten(
+      `.card { color: red; @supports (display: block) { & { color: blue; } } }
+       .plain { color: green; }`,
+    );
+    expect(out).not.toContain('&');
+    const root = postcss.parse(out);
+    const supports = root.nodes.find((n) => n.type === 'atrule');
+    expect(supports?.toString()).toContain('.card');
+    expect(root.toString()).toContain('.plain');
+  });
+
+  test('flattens a rule nested inside the hoisted at-rule on the next pass', async () => {
+    const out = await flatten(
+      `.outer { @supports (display: block) { .inner { color: blue; } } }`,
+    );
+    expect(unescapedAmpersands(out)).toBe(0);
+    // The inner rule's selector is resolved against its parent, not left bare.
+    expect(postcss.parse(out).toString()).toContain('.outer .inner');
+  });
+
+  test('leaves an already-flat stylesheet byte-identical', async () => {
+    const flat = `.a { color: red; }
+@supports (display: block) { .a { color: blue; } }
+@layer base { .b { color: green; } }`;
+    expect(await flatten(flat)).toBe(flat);
+  });
+});

package/src/server/lib/bundler/nested-at-rules.ts

@@ -0,0 +1,146 @@
+/**
+ * @license
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+/**
+ * Hoist every nested at-rule out of the style rule that contains it.
+ *
+ * Bun's CSS minifier keeps the nesting it is handed, and for a target that is
+ * not the browser (`target: 'bun'`, which this build needs because its
+ * entrypoint is the SERVER) it re-nests a rule's nested at-rule into
+ * `@supports (…) { & { … } }`. Chrome does not apply a nested rule whose parent
+ * selector names a pseudo-element, so `&` under `::placeholder` or
+ * `::-webkit-scrollbar-thumb` is dropped and the rule's earlier fallback
+ * declaration wins instead — measured on the built bundle: the composer
+ * placeholder painted at full ink rather than 40%, every scrollbar thumb opaque
+ * rather than 20%.
+ *
+ * Tailwind v4 emits its colour fallbacks in exactly that shape (`color:
+ * var(--x); @supports (color: color-mix(…)) { color: color-mix(…) }`), so one
+ * minifier decision reached 16 rules: every placeholder utility in the app and
+ * every scrollbar rule, base and xterm included. The rsbuild pipeline this
+ * replaced compiled for browsers and flattened the nesting itself.
+ *
+ * Flattening here is what makes the bundle immune: the emitted CSS is
+ * `@supports (…) { .sel::placeholder { … } }` at the top level, which no
+ * minifier has anything left to re-nest and every browser applies. Declaration
+ * order is preserved exactly — a rule's declarations stay in the segments they
+ * were written in, and each at-rule is hoisted to the position it occupied — so
+ * the cascade is unchanged.
+ */
+
+import postcss from 'postcss';
+import type { AtRule, ChildNode, Container, Plugin, Rule } from 'postcss';
+
+/** Resolve a nested selector against the rule it was written inside. */
+function resolveSelector(parentSelector: string, nestedSelector: string): string {
+  if (nestedSelector.includes('&')) return nestedSelector.replaceAll('&', parentSelector);
+  return `${parentSelector} ${nestedSelector}`;
+}
+
+/**
+ * Resolve `&` in the rules directly inside `container`, descending through
+ * at-rules only: `&` still refers to the nearest enclosing STYLE rule, and an
+ * intermediate one is hoisted on a later pass.
+ *
+ * Runs BEFORE `wrapBareDeclarations` — the rule that wraps bare declarations
+ * already carries the parent's resolved selector, and resolving it again would
+ * turn `::placeholder` into `::placeholder ::placeholder`.
+ */
+function resolveAmpersands(container: Container, parentSelector: string): void {
+  for (const node of container.nodes ?? []) {
+    if (node.type === 'rule') node.selector = resolveSelector(parentSelector, node.selector);
+    else if (node.type === 'atrule') resolveAmpersands(node, parentSelector);
+  }
+}
+
+/** Wrap an at-rule's bare declarations in `parentSelector`, keeping them in place. */
+function wrapBareDeclarations(atRule: AtRule, parentSelector: string): void {
+  const nodes = [...(atRule.nodes ?? [])];
+  if (!nodes.some((node) => node.type === 'decl')) return;
+  const rebuilt: ChildNode[] = [];
+  let declarations: ChildNode[] = [];
+  const flush = () => {
+    if (declarations.length === 0) return;
+    const rule = postcss.rule({ selector: parentSelector });
+    rule.append(declarations);
+    rebuilt.push(rule);
+    declarations = [];
+  };
+  for (const node of nodes) {
+    if (node.type === 'decl') declarations.push(node);
+    else {
+      flush();
+      rebuilt.push(node);
+    }
+  }
+  flush();
+  atRule.removeAll();
+  atRule.append(rebuilt);
+}
+
+/** Hoist `rule`'s nested at-rules into its own container. Reports whether it moved any. */
+function hoistNestedAtRules(rule: Rule): boolean {
+  const container = rule.parent;
+  // Snapshot: reparenting the declarations empties `rule.nodes` mid-iteration.
+  const nodes = [...(rule.nodes ?? [])];
+  if (!container || !nodes.some((node) => node.type === 'atrule')) return false;
+
+  const replacement: ChildNode[] = [];
+  let declarations: ChildNode[] = [];
+  const flush = () => {
+    if (declarations.length === 0) return;
+    const segment = postcss.rule({ selector: rule.selector, raws: { ...rule.raws } });
+    segment.append(declarations);
+    replacement.push(segment);
+    declarations = [];
+  };
+
+  for (const node of nodes) {
+    if (node.type !== 'atrule') {
+      declarations.push(node);
+      continue;
+    }
+    flush();
+    const hoisted = node.clone();
+    resolveAmpersands(hoisted, rule.selector);
+    wrapBareDeclarations(hoisted, rule.selector);
+    replacement.push(hoisted);
+  }
+  flush();
+
+  container.insertBefore(rule, replacement);
+  rule.remove();
+  return true;
+}
+
+/**
+ * PostCSS plugin: hoist nested at-rules out of the rules containing them.
+ *
+ * `OnceExit` rather than `Once` so Tailwind's own pass has already expanded
+ * `@theme` and every utility before there is a rule to flatten; register it
+ * LAST for the same reason.
+ */
+export function flattenNestedAtRules(): Plugin {
+  return {
+    postcssPlugin: 'ompchamber-flatten-nested-at-rules',
+    OnceExit(root) {
+      // A hoist can expose another nested at-rule in the segment that received
+      // it, so repeat until a full pass moves nothing.
+      let hoisted = true;
+      while (hoisted) {
+        hoisted = false;
+        const rules: Rule[] = [];
+        root.walkRules((rule) => {
+          rules.push(rule);
+        });
+        // Reverse document order: a nested rule is walked after its parent, so
+        // the inner one is flattened first and its parent is then still intact.
+        for (let index = rules.length - 1; index >= 0; index -= 1) {
+          if (hoistNestedAtRules(rules[index])) hoisted = true;
+        }
+      }
+    },
+  };
+}

package/src/server/lib/lifecycle/launch-mode.test.ts

@@ -1,6 +1,6 @@
 import { describe, expect, test } from 'bun:test';
 
-import { launchModeArg, resolveLaunchMode } from '@/server/lib/lifecycle/launch-mode';
+import { isCliManaged, launchModeArg, resolveLaunchMode } from '@/server/lib/lifecycle/launch-mode';
 
 const ENTRY = '/repo/src/server/index.ts';
 
@@ -30,3 +30,22 @@ describe('resolveLaunchMode', () => {
     }
   });
 });
+
+// Every command that would END a server decides with this predicate:
+// `restart`/`update` may replace it, and `stop` stops it by default. Guessing
+// wrong here kills a `bun run dev` the user owns — that launcher exits with its
+// child — or leaves a daemon serving the build that was just replaced.
+describe('isCliManaged', () => {
+  test('owns the instances the CLI started', () => {
+    expect(isCliManaged('daemon')).toBe(true);
+    expect(isCliManaged('foreground')).toBe(true);
+  });
+
+  test('leaves every instance OMPChamber did not start alone', () => {
+    // `bun run dev`, `bun run start`, a manual run, a systemd/pm2 unit.
+    expect(isCliManaged('direct')).toBe(false);
+    // A probed or unreadable record never authorises a kill either.
+    expect(isCliManaged('unknown')).toBe(false);
+    expect(isCliManaged(undefined)).toBe(false);
+  });
+});