fix(sleep): contain staging paths, harden run launcher, type config writes

Addresses three review findings on the dashboard.

* Staging path containment. `os.path.basename` is not containment:
  `basename("..")` is `".."`, so `/api/night/..` resolved to the staging
  parent and `/api/adopt` would have handed that directory to
  adopt_staging, copying whatever it found over the live SKILL.md and
  CLAUDE.md. Both endpoints now share `_night_dir`, which percent-decodes
  first, rejects anything that is not a plain single path component, and
  then confirms the *resolved* path is still under the staging root — so a
  symlink or junction planted inside staging cannot redirect the read
  either. Non-string `ts` values are rejected rather than stringified.

* Run launcher resilience. A failing `subprocess.Popen` raised straight
  out of the request-handler thread, dropping the connection and leaving
  the UI waiting; it now returns {ok: false, error} and the launcher stays
  usable. The parent also closes its own copy of the log descriptor after
  spawning instead of relying on refcounting to release it, which on
  Windows kept the file locked.

* Config value typing. The editor declared fields as "number" but rendered
  every one as `type="text"` (a no-op ternary) and decided what to coerce
  by matching a regex against the *label text* — so renaming a label would
  silently start writing strings into config.json, and `load_config` does
  not type-coerce. Fields now declare a kind (text/select/bool/int/float),
  rendering and parsing both key off that kind, and the server validates
  independently in `_coerce_config_value` against the type of each built-in
  default, since the client is not the only possible caller. A value that
  cannot be coerced is a 400 and nothing is written, so a bad field cannot
  half-apply a form. Free text is no longer coerced: "true" in the house
  rules stays the string "true".

Adds 12 tests: traversal and link-escape attempts on both endpoints
(asserting nothing was adopted, with a junction fallback so the link case
runs on unprivileged Windows too), spawn-failure handling and log-handle
release, and config typing including the partial-write and free-text cases.

Author: Alphaxalchemy

skillopt_sleep/dashboard.html

@@ -517,47 +517,67 @@ <h2 class='sec' style='margin-top:13px'>Evidence — night ${esc(SEL||"—")}</h
   ["azure_endpoint","azure / compat endpoint","text"],
   ["gate_mode","gate mode","select",["on","off"]],
   ["gate_metric","gate metric","select",["mixed","hard","soft"]],
-  ["gate_mixed_weight","mixed weight (soft share)","number"],
-  ["edit_budget","edit budget / night","number"],
-  ["holdout_fraction","holdout fraction (val)","number"],
-  ["max_tasks_per_night","max tasks / night","number"],
-  ["lookback_hours","lookback hours (first run)","number"],
-  ["dream_rollouts","dream rollouts (K)","number"],
-  ["dream_factor","dream factor","number"],
-  ["recall_k","recall K","number"],
-  ["llm_mine","LLM mining","select",["true","false"]],
-  ["evolve_skill","evolve SKILL.md","select",["true","false"]],
-  ["evolve_memory","evolve CLAUDE.md","select",["true","false"]],
-  ["evidence_log","evidence log","select",["true","false"]],
-  ["auto_adopt","auto-adopt (careful)","select",["false","true"]],
+  ["gate_mixed_weight","mixed weight (soft share)","float"],
+  ["edit_budget","edit budget / night","int"],
+  ["holdout_fraction","holdout fraction (val)","float"],
+  ["max_tasks_per_night","max tasks / night","int"],
+  ["lookback_hours","lookback hours (first run)","int"],
+  ["dream_rollouts","dream rollouts (K)","int"],
+  ["dream_factor","dream factor","int"],
+  ["recall_k","recall K","int"],
+  ["llm_mine","LLM mining","bool"],
+  ["evolve_skill","evolve SKILL.md","bool"],
+  ["evolve_memory","evolve CLAUDE.md","bool"],
+  ["evidence_log","evidence log","bool"],
+  ["auto_adopt","auto-adopt (careful)","bool",["false","true"]],
   ["preferences","house rules for the optimizer","text"],
 ];
+/* Every field declares its own kind, and both rendering and parsing key off
+   that kind — never off the label text. Renaming a label is a copy change,
+   not a silent type change that writes a string into config.json. */
 function renderConfig(){
   const g = $("#cfgGrid"); g.innerHTML = "";
   for(const [key,label,kind,opts] of CFG_FIELDS){
     const v = OV.config[key];
     const d = document.createElement("div"); d.className = "cfgitem";
-    if(kind==="select"){
-      d.innerHTML = `<label>${esc(label)}</label><select data-k='${key}'>` +
-        opts.map(o=>`<option value='${esc(o)}' ${String(v)===o?"selected":""}>${esc(o||"(inherit)")}</option>`).join("") + "</select>";
+    const choices = kind==="bool" ? (opts || ["true","false"]) : opts;
+    if(kind==="select" || kind==="bool"){
+      d.innerHTML = `<label>${esc(label)}</label><select data-k='${key}' data-kind='${kind}'>` +
+        choices.map(o=>`<option value='${esc(o)}' ${String(v)===o?"selected":""}>${esc(o||"(inherit)")}</option>`).join("") + "</select>";
+    } else if(kind==="int" || kind==="float"){
+      d.innerHTML = `<label>${esc(label)}</label><input data-k='${key}' data-kind='${kind}'` +
+        ` type='number' step='${kind==="int"?"1":"any"}' value='${esc(v??"")}'>`;
     } else {
-      d.innerHTML = `<label>${esc(label)}</label><input data-k='${key}' type='${kind==="number"?"text":"text"}' value='${esc(v??"")}'>`;
+      d.innerHTML = `<label>${esc(label)}</label><input data-k='${key}' data-kind='text' type='text' value='${esc(v??"")}'>`;
     }
     g.appendChild(d);
   }
 }
+function parseCfgValue(kind, raw){
+  const v = String(raw ?? "");
+  if(v === "") return "";                       // empty resets to the default
+  if(kind === "bool") return v === "true";
+  if(kind === "int" || kind === "float"){
+    const n = Number(v);
+    if(!Number.isFinite(n)) return null;        // signals a validation failure
+    return kind === "int" ? Math.trunc(n) : n;
+  }
+  return v;                                     // text/select stay strings
+}
 async function saveConfig(){
   const updates = {};
+  const bad = [];
   document.querySelectorAll("#cfgGrid [data-k]").forEach(el=>{
-    let v = el.value;
-    if(v==="true") v = true; else if(v==="false") v = false;
-    else if(v!=="" && !isNaN(Number(v)) && el.closest(".cfgitem").querySelector("label").textContent.match(/weight|budget|fraction|hours|tasks|rollouts|factor|K$|chars/i)) v = Number(v);
-    updates[el.dataset.k] = v;
+    const parsed = parseCfgValue(el.dataset.kind, el.value);
+    if(parsed === null){ bad.push(el.dataset.k); return; }
+    updates[el.dataset.k] = parsed;
   });
+  if(bad.length){ alert("Not a valid number: " + bad.join(", ")); return; }
   const r = await post("/api/config", {updates});
   if(r.ok){ OV.config = r.config; const m = $("#cfgMsg");
     m.classList.add("show"); setTimeout(()=>m.classList.remove("show"), 1600);
     renderConfig(); renderMap(); renderStages(); }
+  else if(r.error){ alert("Config not saved: " + r.error); }
 }
 
 /* ── run control ────────────────────────────────────────────────────── */

skillopt_sleep/dashboard.py

@@ -36,6 +36,7 @@
 import threading
 from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
 from typing import Any, Dict, List, Optional, Tuple
+from urllib.parse import unquote
 
 from skillopt_sleep import prompts as prompt_registry
 from skillopt_sleep.config import DEFAULTS, HOME_STATE_DIR, load_config
@@ -93,17 +94,61 @@ def _user_config_file() -> str:
     return os.path.join(HOME_STATE_DIR, "config.json")
 
 
+def _coerce_config_value(key: str, value: Any) -> Any:
+    """Coerce a submitted value to the type of the built-in default.
+
+    ``load_config`` does not type-coerce, so a string where a number belongs
+    reaches the arithmetic downstream (``edit_budget: "4"``). The default's
+    type is the schema — this is the only place that knows it, and it is
+    enforced server-side because the client is not the only possible caller.
+    """
+    default = DEFAULTS.get(key)
+    if isinstance(default, bool):  # before int: bool is a subclass of int
+        if isinstance(value, bool):
+            return value
+        text = str(value).strip().lower()
+        if text in {"true", "1", "yes", "on"}:
+            return True
+        if text in {"false", "0", "no", "off"}:
+            return False
+        raise ValueError(f"{key} must be a boolean")
+    if isinstance(default, int):
+        try:
+            return int(str(value).strip())
+        except (TypeError, ValueError):
+            raise ValueError(f"{key} must be an integer") from None
+    if isinstance(default, float):
+        try:
+            return float(str(value).strip())
+        except (TypeError, ValueError):
+            raise ValueError(f"{key} must be a number") from None
+    if isinstance(default, str):
+        if isinstance(value, (dict, list)):
+            raise ValueError(f"{key} must be a string")
+        return str(value)
+    return value
+
+
 def _write_config(updates: Dict[str, Any]) -> Dict[str, Any]:
+    """Merge validated updates into the user config file.
+
+    Raises ValueError if any submitted value cannot be coerced; nothing is
+    written in that case, so a bad field cannot half-apply a form.
+    """
     path = _user_config_file()
     current = _read_json(path) or {}
+    accepted: Dict[str, Any] = {}
+    removed = []
     for k, v in updates.items():
         if k not in _EDITABLE_KEYS:
             continue
         if v is None or v == "":
-            # empty resets the key to the built-in default
-            current.pop(k, None)
+            removed.append(k)  # empty resets the key to the built-in default
         else:
-            current[k] = v
+            accepted[k] = _coerce_config_value(k, v)
+    for k in removed:
+        current.pop(k, None)
+    current.update(accepted)
     os.makedirs(os.path.dirname(path), exist_ok=True)
     with open(path, "w", encoding="utf-8") as f:
         json.dump(current, f, ensure_ascii=False, indent=2)
@@ -158,15 +203,25 @@ def start(self, project: str, dry_run: bool) -> Dict[str, Any]:
             cfg = load_config(invoked_project=project)
             self.log_path = os.path.join(cfg.state_dir, "dashboard-run.log")
             os.makedirs(os.path.dirname(self.log_path), exist_ok=True)
-            self.mode = "dry-run" if dry_run else "run"
-            cmd = [sys.executable, "-m", "skillopt_sleep", self.mode,
+            mode = "dry-run" if dry_run else "run"
+            cmd = [sys.executable, "-m", "skillopt_sleep", mode,
                    "--project", project, "--progress"]
-            log = open(self.log_path, "w", encoding="utf-8")
             no_window = getattr(subprocess, "CREATE_NO_WINDOW", 0) if os.name == "nt" else 0
-            self.proc = subprocess.Popen(
-                cmd, stdout=log, stderr=subprocess.STDOUT,
-                creationflags=no_window, cwd=project or None,
-            )
+            try:
+                # The child inherits a dup of this descriptor, so the parent
+                # closes its own copy immediately rather than leaving the log
+                # held open (and, on Windows, locked) for the server's life.
+                with open(self.log_path, "w", encoding="utf-8") as log:
+                    self.proc = subprocess.Popen(
+                        cmd, stdout=log, stderr=subprocess.STDOUT,
+                        creationflags=no_window, cwd=project or None,
+                    )
+            except OSError as exc:
+                # A failed spawn must not raise out of the request thread —
+                # that would drop the connection and leave the UI hanging.
+                self.proc = None
+                return {"ok": False, "error": f"could not start {mode}: {exc}"}
+            self.mode = mode
             return {"ok": True, "mode": self.mode}
 
     def status(self) -> Dict[str, Any]:
@@ -181,6 +236,40 @@ def status(self) -> Dict[str, Any]:
                 "mode": self.mode, "tail": tail}
 
 
+def _night_dir(project: str, ts: str) -> Optional[str]:
+    """Resolve a night id to its staging directory, or None if it is not one.
+
+    ``os.path.basename`` alone is not containment: it leaves ``".."`` intact,
+    so ``/api/night/..`` resolved to the staging parent and ``/api/adopt``
+    would have copied whatever it found there over the live SKILL.md and
+    CLAUDE.md. Reject anything that is not a plain single path component, then
+    confirm the *resolved* path is still under the staging root so a symlink
+    planted in staging cannot redirect the read either.
+    """
+    name = str(ts or "")
+    if not name or name in {".", ".."}:
+        return None
+    if name != os.path.basename(name):  # separators, drive letters, absolutes
+        return None
+    if os.sep in name or (os.altsep and os.altsep in name):
+        return None
+
+    root = staging_root(project)
+    candidate = os.path.join(root, name)
+    try:
+        real_root = os.path.realpath(root)
+        real_candidate = os.path.realpath(candidate)
+        if os.path.commonpath([real_root, real_candidate]) != real_root:
+            return None
+        if real_candidate == real_root:
+            return None
+    except (OSError, ValueError):  # unrelated roots / different drives
+        return None
+    if not os.path.isdir(real_candidate):
+        return None
+    return candidate
+
+
 def _split_host(value: str) -> Tuple[str, str]:
     """Split a Host header into (hostname, port), tolerating IPv6 brackets."""
     host = (value or "").strip()
@@ -342,9 +431,9 @@ def do_GET(self) -> None:  # noqa: N802 (http.server API)
             })
             return
         if path.startswith("/api/night/"):
-            ts = os.path.basename(path[len("/api/night/"):])
-            d = os.path.join(staging_root(self.project), ts)
-            if not os.path.isdir(d):
+            ts = unquote(path[len("/api/night/"):])
+            d = _night_dir(self.project, ts)
+            if d is None:
                 self._json({"error": "unknown night"}, 404)
                 return
             self._json({
@@ -378,7 +467,11 @@ def do_POST(self) -> None:  # noqa: N802
             if not isinstance(updates, dict):
                 self._json({"error": "updates must be an object"}, 400)
                 return
-            saved = _write_config(updates)
+            try:
+                saved = _write_config(updates)
+            except ValueError as exc:
+                self._json({"error": str(exc)}, 400)
+                return
             cfg = load_config(invoked_project=self.project)
             self._json({"ok": True, "saved": saved,
                         "config": {k: cfg.get(k) for k in sorted(_EDITABLE_KEYS)}})
@@ -395,9 +488,8 @@ def do_POST(self) -> None:  # noqa: N802
             self._json(self.run_state.start(self.project, bool(body.get("dry_run"))))
             return
         if path == "/api/adopt":
-            ts = os.path.basename(str(body.get("ts", "")))
-            d = os.path.join(staging_root(self.project), ts)
-            if not os.path.isdir(d):
+            d = _night_dir(self.project, body.get("ts", ""))
+            if d is None:
                 self._json({"error": "unknown night"}, 404)
                 return
             try: