feat: expand repo ref parser (URLs, SSH, query params, destination dir)

[cursor]

Security-focused review of commit bb8464c / PR #453.

Scope

Traced onboarding import flow: FlakeRefSource → client.path.normalize → config_import_github → parse_repo_ref / prepare_import_target / materialize_repo.

Findings

Significant user-facing breakage (not security-critical)

1. Frontend/backend mismatch on 3-segment shorthand refs (High confidence)

• parseFlakeRef / ownerAndRepoFromLocator (flake-ref.ts) accepts refs like owner/group/repo and marks them importable.
• Rust parse_repo_ref (bootstrap/import.rs) requires exactly two path segments for shorthand / github.com/ forms and rejects a/b/c.
• Trigger: user pastes monorepo-style shorthand (e.g. myorg/nix-config/darwin) → UI shows valid → import fails at backend parse.

2. Destination dir plain names resolved against process CWD (Medium confidence)

• FlakeRefSource always runs client.path.normalize before importGithub, turning plain names like darwin into {cwd}/darwin instead of letting backend resolve_import_target map them to ~/darwin.
• Usually fails validate_new_dir_location or only works when CWD happens to be $HOME; confusing errors vs old behavior.

No critical security issues found

• Path traversal: ?dir= validated in both TS and Rust; zip extraction uses safe_join.
• Command injection: clone URLs/refs passed to libgit2, not a shell.
• Data loss: import targets must be absent/empty (.DS_Store only); non-empty dirs rejected.
• Auth bypass: GitHub App tokens remain scoped to parsed owner/repo; no bypass observed.
• Crashes: no panic paths identified in changed code.

Notes

• Local path import removed from advanced ref UI (by design); local flow remains via LocalSource.
• refreshHostsSnapshot({ force: true }) in setup step is a UX fix, not a security issue.