`omarchy-refresh-config` takes a path relative to `.config` and joins it onto both `~/.config` and `$OMARCHY_PATH/config`:

```bash
user_config_file="${HOME}/.config/$config_file"
default_config_file="$OMARCHY_PATH/config/$config_file"
...
mkdir -p "$(dirname "$user_config_file")"
cp -f "$default_config_file" "$user_config_file"
```

Nothing stops `..` or an absolute path. `omarchy-refresh-config ../README` copies `$OMARCHY_PATH/README` (or whatever sits one directory up from `config/`) to `~/.config/../README`, which is `$HOME/README`. `hypr/../../.ssh/authorized_keys` would land a write on `~/.ssh/authorized_keys` if a matching source existed under `$OMARCHY_PATH`. An absolute path skips `~/.config` entirely.

The command is on PATH as `omarchy refresh config`. Anything that can invoke it — a keybinding, a script, a plugin — can point the copy outside the user's config tree.

The later `[[ ! -e $default_config_file ]]` check is not a sandbox: it only asks whether the resolved source exists. A `..` path that happens to name a real file under `$OMARCHY_PATH` (or, for an absolute path, anywhere on disk) is copied.

## Expected

Refuse a path that is absolute or that contains a `..` component, before joining it. A missing shipped config is already refused with `Not a shipped user config:`; the same message fits here.