[CELL-294, CELL-296] cell chrome/cell login become cell auth chrome, [[volumes]] mount accepts a single path, and thin images stop losing packages when another stack rebuilds against the shared nix-store volume

- feat(cmd/chrome, cmd/auth): move `cell chrome` under `cell auth chrome` and drop `cell login` — host-side credential bootstrap lives under one umbrella; the old top-level commands are gone
- feat(cfg, runner): `[[volumes]] mount = "/foo"` expands to `/foo:/foo` — a colonless mount now means "same path on host and inside container", removing the boilerplate of repeating identical paths
- fix(runner/thin_build): bake the container-local profile symlink to the just-switched home-manager `/nix/store` realpath and pin it as a per-stack GC root — a thin image no longer silently loses chromium/patchright the moment another cell builds a leaner stack against the shared nix-store volume
- fix(runner/thin_build): drop `/nix/var/nix/profiles/per-user/root/profile/bin` from the baked image PATH — PATH lookup no longer resolves tools through the mutable shared-volume slot before the immutable one
- test(cfg): cover `VolumeMount.Resolved()` shorthand expansion — no impact
- test(runner): assert `-v /foo` becomes `-v /foo:/foo`, and that the thin builder resolves realpath, registers a per-stack GC root, and keeps the shared-volume slot off the baked PATH — no impact
- test(cmd/chrome): retarget help/behavior tests to `cell auth chrome`, add regressions that `cell chrome` and `cell login` are no longer registered at the root — no impact

Author: DimmKirr

internal/cfg/cfg.go

@@ -132,6 +132,22 @@ type VolumeMount struct {
 	Mount string `toml:"mount"`
 }
 
+// Resolved returns the mount string in `host:container[:mode]` form,
+// expanding the single-path shorthand where a colonless value means
+// "mount this path at the same path inside the container".
+//
+// Examples:
+//
+//	"/foo/bar"          → "/foo/bar:/foo/bar"
+//	"/foo:/bar"         → "/foo:/bar"      (unchanged)
+//	"/foo:/bar:ro"      → "/foo:/bar:ro"   (unchanged)
+func (v VolumeMount) Resolved() string {
+	if !strings.Contains(v.Mount, ":") && v.Mount != "" {
+		return v.Mount + ":" + v.Mount
+	}
+	return v.Mount
+}
+
 // PackagesSection holds [packages] config for npm and python tools.
 type PackagesSection struct {
 	Npm    map[string]string `toml:"npm"`

internal/cfg/cfg_test.go

@@ -92,6 +92,23 @@ func TestMerge_EnvAccumulates(t *testing.T) {
 	}
 }
 
+func TestVolumeMount_Resolved(t *testing.T) {
+	cases := []struct {
+		in, want string
+	}{
+		{"/host/path:/container/path", "/host/path:/container/path"},
+		{"/host:/container:ro", "/host:/container:ro"},
+		{"/Users/dmitry/dev/evercars/evercars-backend", "/Users/dmitry/dev/evercars/evercars-backend:/Users/dmitry/dev/evercars/evercars-backend"},
+		{"", ""},
+	}
+	for _, tc := range cases {
+		got := cfg.VolumeMount{Mount: tc.in}.Resolved()
+		if got != tc.want {
+			t.Errorf("Resolved(%q) = %q, want %q", tc.in, got, tc.want)
+		}
+	}
+}
+
 func TestMerge_VolumesAccumulate(t *testing.T) {
 	global := cfg.CellConfig{Volumes: []cfg.VolumeMount{{Mount: "a:b"}}}
 	project := cfg.CellConfig{Volumes: []cfg.VolumeMount{{Mount: "c:d:ro"}}}

internal/runner/runner.go

@@ -432,7 +432,7 @@ func BuildArgv(spec RunSpec, fs FS, lookPath func(string) (string, error)) []str
 
 	// cfg [[volumes]] entries
 	for _, vol := range spec.CellCfg.Volumes {
-		argv = append(argv, "-v", vol.Mount)
+		argv = append(argv, "-v", vol.Resolved())
 	}
 
 	// [ports].publish_ip — host interface prefix for `docker run -p`.

internal/runner/runner_test.go

@@ -337,6 +337,18 @@ func TestArgv_ReadonlyVolume(t *testing.T) {
 	}
 }
 
+// Shorthand: a colonless mount path expands to `path:path`, mounting the
+// host path at the same path inside the container.
+func TestArgv_CfgVolumes_SinglePathShorthand(t *testing.T) {
+	argv := buildArgv(t, func(s *runner.RunSpec) {
+		s.CellCfg.Volumes = []cfg.VolumeMount{{Mount: "/Users/dmitry/dev/evercars/evercars-backend"}}
+	})
+	want := "/Users/dmitry/dev/evercars/evercars-backend:/Users/dmitry/dev/evercars/evercars-backend"
+	if !hasConsecutive(argv, "-v", want) {
+		t.Errorf("expected -v %s in argv: %v", want, argv)
+	}
+}
+
 // --- cfg mise ---
 
 func TestArgv_MiseEnvVars(t *testing.T) {

internal/runner/systemprompt.go

@@ -49,7 +49,7 @@ func ContainerContext(c config.Config, cellCfg cfg.CellConfig) string {
 	fmt.Fprintf(&b, "  /etc/devcell/config = %s (user build config)\n", c.ConfigDir)
 
 	for _, vol := range cellCfg.Volumes {
-		parts := strings.SplitN(vol.Mount, ":", 3)
+		parts := strings.SplitN(vol.Resolved(), ":", 3)
 		if len(parts) >= 2 {
 			mode := "read-write"
 			if len(parts) == 3 && parts[2] == "ro" {
@@ -64,7 +64,7 @@ func ContainerContext(c config.Config, cellCfg cfg.CellConfig) string {
 	fmt.Fprintf(&b, "  host: %s → container: %s\n", hostDir, hostDir)
 	fmt.Fprintf(&b, "  host: %s → container: %s\n", c.HostHome, homeDir)
 	for _, vol := range cellCfg.Volumes {
-		parts := strings.SplitN(vol.Mount, ":", 3)
+		parts := strings.SplitN(vol.Resolved(), ":", 3)
 		if len(parts) >= 2 {
 			fmt.Fprintf(&b, "  host: %s → container: %s\n", parts[0], parts[1])
 		}

internal/runner/thin_build.go

@@ -211,14 +211,32 @@ export PATH="/nix/var/nix/profiles/devcell-tools/bin:$PATH"
 echo "Running home-manager switch (nix store on volume)..."
 home-manager switch --flake %s#devcell-%s%s
 
-# Canonical profile path — home-manager ran as root, so the user profile is at
-# per-user/root. The baked ENV PATH, nix-managed MCP server commands, and
-# entrypoint fragments all address it via the /opt/devcell path instead.
-# -T: replace the link itself, never create inside the target dir.
-ln -sfT /nix/var/nix/profiles/per-user/root/profile /opt/devcell/.local/state/nix/profiles/profile
+# Capture the just-switched home-manager-path as an immutable /nix/store
+# realpath. /nix/var/nix/profiles/per-user/root/profile is a mutable slot on
+# the shared devcell-nix-store docker volume — any later home-manager switch
+# from another container rewrites it, and every image whose profile symlink
+# went through that slot would silently lose packages (see CELL-322: a leaner
+# stack build clobbered chromium/patchright out of an ultimate container
+# PATH). Resolve once here and bake the resulting store path.
+HM_PROFILE=$(readlink -f /nix/var/nix/profiles/per-user/root/profile)
+if [ -z "$HM_PROFILE" ] || [ ! -d "$HM_PROFILE" ]; then
+  echo "ERROR: could not resolve home-manager profile realpath" >&2
+  exit 1
+fi
+
+# Canonical profile path — points at the immutable store target, not the
+# shared-volume slot. -T: replace the link itself, never create inside dir.
+ln -sfT "$HM_PROFILE" /opt/devcell/.local/state/nix/profiles/profile
+
+# Pin the resolved store path as a persistent GC root on the shared volume
+# so nix-collect-garbage from another container cannot reap the target our
+# baked-in symlink depends on. Named per-hmTarget + arch so concurrent stacks
+# preserve their own home-manager-path independently.
+mkdir -p /nix/var/nix/gcroots/devcell
+ln -sfT "$HM_PROFILE" /nix/var/nix/gcroots/devcell/%s%s
 
 # Source home-manager session vars (sets NIX_LD for nix-ld)
-HM_VARS="/nix/var/nix/profiles/per-user/root/profile/etc/profile.d/hm-session-vars.sh"
+HM_VARS="$HM_PROFILE/etc/profile.d/hm-session-vars.sh"
 if [ -f "$HM_VARS" ]; then . "$HM_VARS"; fi
 # NIX_LD_LIBRARY_PATH: nix-ld needs this to resolve shared libs for non-nix binaries.
 # At runtime, entrypoint populates ~/.nix-ld-libs (merged symlink dir).
@@ -291,7 +309,7 @@ COPY entrypoint.sh /opt/devcell/.local/bin/entrypoint.sh
 %sENV HOME=/opt/devcell
 ENV USER=devcell
 ENV DEVCELL_PROFILE=devcell-%s
-ENV PATH="/nix/var/nix/profiles/devcell-tools/bin:/nix/var/nix/profiles/per-user/root/profile/bin:/opt/devcell/.local/state/nix/profiles/profile/bin:/opt/devcell/.local/bin:/nix/var/nix/profiles/default/bin:/usr/local/bin:/usr/bin:/bin"
+ENV PATH="/nix/var/nix/profiles/devcell-tools/bin:/opt/devcell/.local/state/nix/profiles/profile/bin:/opt/devcell/.local/bin:/nix/var/nix/profiles/default/bin:/usr/local/bin:/usr/bin:/bin"
 ENV SSL_CERT_FILE=/etc/ssl/certs/ca-certificates.crt
 ENV NIX_SSL_CERT_FILE=/etc/ssl/certs/ca-certificates.crt
 ENV LOCALE_ARCHIVE=/nix/var/nix/profiles/devcell-tools/lib/locale/locale-archive
@@ -318,6 +336,7 @@ echo "Done — thin image: %s"`,
 		stack,           // export DEVCELL_STACK
 		modules,         // export DEVCELL_MODULES
 		flakeArg, hmTarget, archSuffix, // home-manager switch
+		hmTarget, archSuffix, // /nix/var/nix/gcroots/devcell/<hmTarget><arch>
 		cellStageCmd,    // stage cell binary into $CTX (or empty)
 		cellCopyLine,    // COPY cell ... into Dockerfile (or empty)
 		hmTarget,        // ENV DEVCELL_PROFILE=devcell-<hmTarget>

internal/runner/thin_build_test.go

@@ -401,18 +401,90 @@ func TestDockerHostPath_NoEnvNoChange(t *testing.T) {
 	}
 }
 
-// CELL-156 follow-up: home-manager runs as root in the thin builder, so the
-// user profile lands at /nix/var/nix/profiles/per-user/root/profile. MCP
-// server configs, the baked ENV PATH, and entrypoint fragments all address it
-// via the canonical /opt/devcell/.local/state/nix/profiles/profile path —
-// the builder must create that symlink or every nix-managed MCP server fails
-// with ENOENT at runtime.
-func TestThinBuildArgv_CanonicalProfileSymlink(t *testing.T) {
+// The canonical container-local profile path
+// (/opt/devcell/.local/state/nix/profiles/profile) MUST resolve to an
+// immutable /nix/store path, NOT to /nix/var/nix/profiles/per-user/root/profile.
+// The per-user/root profile lives on the shared devcell-nix-store docker
+// volume — every thin build's `home-manager switch` overwrites it, so a
+// container labelled `ultimate` will lose packages the moment someone builds
+// a leaner stack against the same volume (see the CELL-322 kirr.dev-540
+// clobber where chromium/patchright disappeared from PATH).
+//
+// The builder captures the just-switched target's realpath and bakes THAT
+// store path into the image. Once baked, no cross-container switch can touch
+// what this image sees.
+func TestThinBuildArgv_ProfileSymlinkResolvesToStorePath(t *testing.T) {
 	argv := ThinBuildArgv(testCoreImage, testContainer, testVolume, testNixhome, testThinTag, testStack, "x86_64")
 	script := argv[len(argv)-1]
-	want := "ln -sfT /nix/var/nix/profiles/per-user/root/profile /opt/devcell/.local/state/nix/profiles/profile"
-	if !strings.Contains(script, want) {
-		t.Errorf("builder script must symlink canonical profile path to per-user/root profile, want %q", want)
+
+	// MUST NOT symlink into the mutable shared-volume slot.
+	bad := "ln -sfT /nix/var/nix/profiles/per-user/root/profile /opt/devcell/.local/state/nix/profiles/profile"
+	if strings.Contains(script, bad) {
+		t.Errorf("builder must NOT redirect container profile into the shared-volume mutable slot; found: %q", bad)
+	}
+
+	// MUST resolve the profile's realpath after home-manager switch.
+	if !strings.Contains(script, "readlink -f /nix/var/nix/profiles/per-user/root/profile") {
+		t.Error("builder must resolve the just-switched profile's realpath (readlink -f) before baking the container-local symlink")
+	}
+
+	// MUST symlink the container-local profile to that resolved store path.
+	// Match the shell expression that assigns realpath into a var and then uses it as the ln target.
+	if !strings.Contains(script, `ln -sfT "$HM_PROFILE" /opt/devcell/.local/state/nix/profiles/profile`) {
+		t.Error("builder must symlink /opt/devcell/.local/state/nix/profiles/profile → $HM_PROFILE (the resolved store path)")
+	}
+}
+
+// A store path only reachable through a symlink baked inside an image is not
+// a GC root — `nix-collect-garbage` on the shared volume can't see through
+// image layers. Without a per-stack GC root, a later cleanup wipes the
+// home-manager-path our container depends on, breaking every already-built
+// image the next time it's started fresh.
+//
+// The builder must register the resolved profile as an indirect GC root
+// under /nix/var/nix/gcroots/ so the store path stays alive on the volume.
+func TestThinBuildArgv_ProfilePinnedAsGCRoot(t *testing.T) {
+	argv := ThinBuildArgvFull(testCoreImage, testContainer, testVolume, testNixhome, testThinTag, "local", "x86_64", testStack, "", "")
+	script := argv[len(argv)-1]
+
+	if !strings.Contains(script, "/nix/var/nix/gcroots/devcell/") {
+		t.Error("builder must register the resolved home-manager profile as a GC root under /nix/var/nix/gcroots/devcell/ so the shared-volume GC does not reap it")
+	}
+
+	// Per-stack GC root name — different stacks must not clobber each other's
+	// roots. Use the hmTarget + archSuffix combo, matching the existing flake
+	// key convention (`devcell-<hmTarget><archSuffix>`).
+	if !strings.Contains(script, "/nix/var/nix/gcroots/devcell/local") {
+		t.Error("GC root name must be per-hmTarget so different stacks preserve their own home-manager-path")
+	}
+}
+
+// The image's runtime ENV PATH must NOT include /nix/var/nix/profiles/per-user/root/profile/bin.
+// That path lives on the shared devcell-nix-store volume and gets rewritten
+// by every `home-manager switch` from any container — leaving it on PATH
+// defeats the whole store-path-symlink fix because PATH lookup would still
+// resolve tools through the mutable slot before the immutable one.
+func TestThinBuildArgv_RuntimePathExcludesSharedProfileSlot(t *testing.T) {
+	argv := ThinBuildArgv(testCoreImage, testContainer, testVolume, testNixhome, testThinTag, testStack, "x86_64")
+	script := argv[len(argv)-1]
+
+	// Look at the `ENV PATH=` line specifically (the baked image env). The
+	// build-time `export PATH=` lines inside the builder are fine — they only
+	// affect the ephemeral builder container.
+	envPathIdx := strings.Index(script, "ENV PATH=")
+	if envPathIdx < 0 {
+		t.Fatal("script must contain a baked ENV PATH= line")
+	}
+	envPathLine := script[envPathIdx:]
+	if nl := strings.Index(envPathLine, "\n"); nl >= 0 {
+		envPathLine = envPathLine[:nl]
+	}
+	if strings.Contains(envPathLine, "/nix/var/nix/profiles/per-user/root/profile/bin") {
+		t.Errorf("baked ENV PATH must NOT include the mutable per-user/root profile bin; got: %s", envPathLine)
+	}
+	// Sanity: the container-local (now immutable) profile bin MUST still be on PATH.
+	if !strings.Contains(envPathLine, "/opt/devcell/.local/state/nix/profiles/profile/bin") {
+		t.Errorf("baked ENV PATH must still include /opt/devcell/.local/state/nix/profiles/profile/bin, got: %s", envPathLine)
 	}
 }