acli auth login opened Chromium. buildFHSEnv binds only an allowlist of /etc entries into its bubblewrap sandbox, and /etc/xdg is not on it, so the mimeapps.list from xdg.mime is invisible there and xdg-open takes the first http handler in mimeinfo.cache. The same holds for Steam and AppImages. xdg.portal.xdgOpenUsePortal hands the URL to the OpenURI portal, which resolves it on the host (NixOS/nixpkgs#160923). acli and kubectl on the ThinkPad. Flake inputs updated.