fix(desktop): xdg-open goes through the portal, so FHS sandboxes get Firefox

acli auth login opened Chromium. buildFHSEnv binds only an allowlist of /etc
entries into its bubblewrap sandbox, and /etc/xdg is not on it, so the
mimeapps.list from xdg.mime is invisible there and xdg-open takes the first
http handler in mimeinfo.cache. The same holds for Steam and AppImages.
xdg.portal.xdgOpenUsePortal hands the URL to the OpenURI portal, which
resolves it on the host (NixOS/nixpkgs#160923).

acli and kubectl on the ThinkPad. Flake inputs updated.

DECISIONS.md

@@ -1,5 +1,28 @@
 # Decisions
 
+## 2026-09-30 – xdg-open goes through the portal, so FHS sandboxes get Firefox
+
+- **Who**: Dominik, ClaudeCode
+- **Why**: `acli auth login` opened Chromium. acli is a `buildFHSEnv` wrapper,
+  which binds only an allowlist of `/etc` entries into its bubblewrap sandbox;
+  `/etc/xdg` is not on it, so the `mimeapps.list` from `xdg.mime` is invisible
+  there and `xdg-mime` falls back to `mimeinfo.cache`, which yields
+  `chromium-browser.desktop`. Reproduced on the host by querying with
+  `XDG_CONFIG_DIRS` pointed away from `/etc/xdg`. Affects every FHS env
+  (Steam, AppImages), not only acli.
+- **Tradeoffs**: Considered binding `/etc/xdg` into acli via `extraBwrapArgs`
+  (fixes one package only), linking a second copy of `mimeapps.list` into
+  `/run/current-system/sw/etc/xdg` (a self-made workaround), stripping
+  Chromium's http claim (fixes the browser only), and `xdg-settings` (manual,
+  per user and machine). All rejected in favour of the option nixpkgs added
+  for exactly this (NixOS/nixpkgs#160923).
+- **How**: `xdg.portal.xdgOpenUsePortal = true` in `modules/desktop.nix`. It
+  sets `NIXOS_XDG_OPEN_USE_PORTAL=1`; nixpkgs' patched `xdg-open` then hands
+  the URL to the OpenURI portal, which resolves it on the host with the host's
+  `mimeapps.list`. Verified: the thinkpad system builds and carries the
+  variable. The runtime check (`acli auth login` opening Firefox) needs a
+  switch and a new login, since it is a session variable.
+
 ## 2026-09-28 – Nothing waits for a routable address at boot
 
 - **Who**: Dominik, ClaudeCode

flake.lock

@@ -40,11 +40,11 @@
     "moonarch": {
       "flake": false,
       "locked": {
-        "lastModified": 1790177314,
+        "lastModified": 1790681837,
-        "narHash": "sha256-2YTKIvK8gtoDf+zE0QyLyoWT8KQW82O0WQ4pWkHgX6g=",
+        "narHash": "sha256-tVi+c1wnXuWSSejndpE3IcLCY2T2z7tlsOrE4KjePRg=",
         "ref": "refs/heads/main",
-        "rev": "2774d0947de08376651c05fb1b68907c7e3ffd61",
+        "rev": "bad576881b3c6ce31ddd9fef515baae727beb25e",
-        "revCount": 188,
+        "revCount": 189,
         "type": "git",
         "url": "https://gitea.moonarch.de/nevaforget/moonarch.git"
       },
@@ -74,11 +74,11 @@
         "nixpkgs": "nixpkgs"
       },
       "locked": {
-        "lastModified": 1789978172,
+        "lastModified": 1790321948,
-        "narHash": "sha256-FIRXajv1pPZ+l6On6ekkmcQ6le0Zi0ncRUoR3nB0vKA=",
+        "narHash": "sha256-mZGHLGi217oLIwzDM4PNRZeCNa6g2WBXURyXbNMFs7Y=",
         "owner": "NixOS",
         "repo": "nixos-hardware",
-        "rev": "9ebcb7766700d7e006d9505247bd7ce0426f4232",
+        "rev": "30d48a0ec6035f8140d0125af274f0de95f1e9b5",
         "type": "github"
       },
       "original": {
@@ -102,11 +102,11 @@
     },
     "nixpkgs_2": {
       "locked": {
-        "lastModified": 1790046670,
+        "lastModified": 1790578696,
-        "narHash": "sha256-MYiI+CzL0tuWgRPjGsKCDHqYs2T3OzMlMQWOYWG0qso=",
+        "narHash": "sha256-ZoxIApko70jCdbH3l20HWXOBaT2HZd87orzd2yJ9dVE=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "6774f7bc253789b113a4f39285dc0fa100abeacc",
+        "rev": "7a0f122f5090cf4c2ade2a13a0e229d4e19ba71f",
         "type": "github"
       },
       "original": {
@@ -133,7 +133,7 @@
         "lastModified": 1777359446,
         "narHash": "sha256-DqFak+NN9bxBSTWD+6luEjSIQo1FAkw5HeJRCQvnBuk=",
         "ref": "refs/heads/main",
-        "rev": "74ce3688e55318dec0af8e25f376e613243ed6c3",
+        "rev": "21c0f0655443650a48dc444a251afae1e0cc8dc8",
         "revCount": 2,
         "type": "git",
         "url": "https://gitea.moonarch.de/nevaforget/Sweet-cursors.git"

hosts/thinkpad/default.nix

@@ -104,6 +104,8 @@
     uv
     python3
     glab
+    acli
+    kubectl
   ];
 
   # The nixos-hardware profile only sets hardware.cpu.amd.updateMicrocode as a

modules/desktop.nix

@@ -118,6 +118,14 @@ in
     # awake. programs.niri leaves this interface unassigned, so stating it here
     # does not collide with the module's definition.
     config.niri."org.freedesktop.impl.portal.Inhibit" = "none";
+
+    # buildFHSEnv sandboxes (acli, Steam, AppImages) bind only an allowlist of
+    # /etc entries, and /etc/xdg is not on it, so an xdg-open inside them never
+    # sees the xdg.mime defaults and takes the first handler in mimeinfo.cache —
+    # Chromium for http. With this set, nixpkgs' xdg-open hands the URL to the
+    # OpenURI portal instead, which resolves it on the host. See
+    # NixOS/nixpkgs#160923.
+    xdgOpenUsePortal = true;
   };
 
   # The file dialog every portal client opens — Firefox's save dialog among