feat: allow importing stitch.toml in bot setup wizard

- Add `toml` field to `CreateRequest` to accept a full config file as an alternative to custom corridor fields
- Validate imported TOML through `validate_imported_toml()` to reject files containing secret keys, `[signer]` sections, or other security risks before writing
- Add `import_toml` module with comprehensive secret-key detection (exact matches and substring patterns) and file-size limits (64 KiB)
- Reject requests that provide both `custom` corridor fields and `toml` simultaneously
- Update web UI to toggle between "Enter the fields" and "Import stitch.toml" modes in the custom corridor step
- Add file upload and textarea input for pasting or uploading `stitch.toml` in the UI
- Extract `chain_id` from imported TOML to populate the chain picker automatically
- Bump version to 0.1.229

Author: bnolens

.textile-monorepo-source

@@ -1 +1 @@
-9973cf47c734763cf7adecea909e900b04ee45df
+f2b8d64a3590275fcfd4c7e96fac2b6147c6741a

.textile-stitch-release-version

@@ -1 +1 @@
-0.1.228
+0.1.229

Cargo.lock

@@ -1,6 +1,6 @@
 [package]
 name = "stitch-bot"
-version = "0.1.228"
+version = "0.1.229"
 edition = "2021"
 description = "Stitch — Textile filler-network operator bot; quotes Swap via RFQ firm quotes and optionally fills resting limit orders."
 license = "AGPL-3.0-or-later"

Cargo.toml

@@ -262,6 +262,11 @@ pub struct CreateRequest {
     /// When present it takes precedence over `corridor_id`.
     #[serde(default)]
     pub custom: Option<CustomCorridor>,
+    /// A full `stitch.toml` to write as-is (admin-generated or hand-edited).
+    /// Mutually exclusive with `custom`. Validated through the same parser the
+    /// bot uses; `[signer]` and other secret keys are refused.
+    #[serde(default)]
+    pub toml: Option<String>,
     pub signer: SignerRequest,
     /// Start the bot immediately. Off by default: the recommended path is to
     /// approve Permit2 (costs a little gas) and dry-run first.
@@ -290,6 +295,30 @@ impl CreateRequest {
     /// pending preset, or invalid custom details) is refused before anything is
     /// written.
     fn resolve_corridor(&self) -> Result<ResolvedCorridor, ApiError> {
+        if self.custom.is_some() && self.toml.as_ref().is_some_and(|s| !s.trim().is_empty()) {
+            return Err(ApiError::bad_request(
+                "send either custom corridor fields or a stitch.toml, not both",
+            ));
+        }
+
+        if let Some(raw) = self
+            .toml
+            .as_deref()
+            .map(str::trim)
+            .filter(|s| !s.is_empty())
+        {
+            let toml = setup::validate_imported_toml(raw)
+                .map_err(|e| ApiError::bad_request(format!("{e:#}")))?;
+            let cfg = crate::config::Config::from_toml(&toml)
+                .map_err(|e| ApiError::bad_request(format!("{e:#}")))?;
+            return Ok(ResolvedCorridor {
+                toml,
+                container_label: None,
+                display_name: "a custom corridor".to_string(),
+                network_label: format!("chain {}", cfg.chain_id),
+            });
+        }
+
         if let Some(custom) = &self.custom {
             let toml = custom
                 .render()
@@ -1155,6 +1184,84 @@ mod tests {
         );
     }
 
+    fn imported_toml() -> String {
+        r#"
+chain_id        = 42220
+rpc_url         = "https://forno.celo.org"
+indexer_url     = "https://api.textilecredit.com"
+permit2         = "0x000000000022D473030F116dDEE9F6B43aC78BA3"
+reactor         = "0xa9AA0a64769cBed4d3B1Ceb4Df01CdE915C235b3"
+tick_interval_secs = 5
+
+[feed]
+url            = "https://api.textilecredit.com/price?chainId=42220&pair=cngn-usdt"
+staleness_secs = 900
+
+[[pools]]
+collateral = "0x1111111111111111111111111111111111111111"
+collateral_decimals = 6
+debt = "0x2222222222222222222222222222222222222222"
+debt_decimals = 6
+buy_offset_bps = 5
+sell_offset_bps = 5
+ttl_secs = 60
+"#
+        .to_string()
+    }
+
+    #[tokio::test]
+    async fn an_imported_toml_writes_the_file_verbatim() {
+        let h = harness("create-import-toml");
+        let toml_body = imported_toml();
+        let (status, body) = h
+            .post_json(
+                "/api/bots",
+                json!({ "name": "bot-a", "toml": toml_body, "signer": local(TEST_KEY) }),
+            )
+            .await;
+        assert_eq!(status, StatusCode::CREATED, "{body}");
+        let written = std::fs::read_to_string(h.root.join("bot-a/stitch.toml")).unwrap();
+        assert!(
+            written.contains("0x1111111111111111111111111111111111111111"),
+            "{written}"
+        );
+        assert!(crate::config::Config::from_toml(&written).is_ok());
+    }
+
+    #[tokio::test]
+    async fn an_imported_toml_with_a_signer_is_refused() {
+        let h = harness("create-import-signer");
+        let toml_body =
+            imported_toml() + "\n[signer]\nbackend = \"local\"\nprivate_key = \"0xabc\"\n";
+        let (status, body) = h
+            .post_json(
+                "/api/bots",
+                json!({ "name": "bot-a", "toml": toml_body, "signer": local(TEST_KEY) }),
+            )
+            .await;
+        assert_eq!(status, StatusCode::BAD_REQUEST, "{body}");
+        assert!(body.contains("signer"), "{body}");
+        assert!(!h.root.join("bot-a").exists());
+    }
+
+    #[tokio::test]
+    async fn custom_fields_and_toml_together_are_refused() {
+        let h = harness("create-import-both");
+        let (status, body) = h
+            .post_json(
+                "/api/bots",
+                json!({
+                    "name": "bot-a",
+                    "custom": custom_body(),
+                    "toml": imported_toml(),
+                    "signer": local(TEST_KEY)
+                }),
+            )
+            .await;
+        assert_eq!(status, StatusCode::BAD_REQUEST, "{body}");
+        assert!(body.contains("not both"), "{body}");
+    }
+
     #[tokio::test]
     async fn a_custom_corridor_with_a_garbage_token_is_refused() {
         let h = harness("create-custom-bad-token");

src/panel/http/wizard.rs

@@ -0,0 +1,237 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// Copyright (c) 2026 Textile, Inc.
+//! Validate an operator-supplied `stitch.toml` before the panel writes it.
+//!
+//! The admin corridor flow generates a file; the panel's custom-corridor step
+//! can import it instead of filling fields. This is the gate: parse, load
+//! through [`Config::from_toml`], and refuse anything that looks like a
+//! secret. The wizard collects the wallet separately — a toml that already
+//! carries a `[signer]` (or a private key field) is how keys leak.
+
+use anyhow::{bail, Context, Result};
+
+use crate::config::Config;
+
+/// Hard cap so a pasted bomb can't sit in memory. A real stitch.toml is a few
+/// kilobytes; 64 KiB is generous for comments and still small.
+pub const MAX_TOML_BYTES: usize = 64 * 1024;
+
+/// Exact key names that mean a secret lives in this file.
+const FORBIDDEN_KEYS: &[&str] = &[
+    "signer",
+    "private_key",
+    "seed_phrase",
+    "mnemonic",
+    "api_private_key",
+    "api_token",
+    "api_key",
+    "secret_key",
+    "password",
+    "passwd",
+    "access_token",
+    "client_secret",
+    "client_key",
+    "auth_token",
+    "credential",
+    "credentials",
+    "token",
+    "secret",
+];
+
+/// Substrings that make a key secret-bearing even when the exact name is new.
+const FORBIDDEN_KEY_PARTS: &[&str] = &[
+    "password",
+    "passwd",
+    "secret",
+    "private_key",
+    "mnemonic",
+    "seed_phrase",
+    "access_token",
+    "client_secret",
+    "credential",
+];
+
+fn looks_like_secret_key(key: &str) -> bool {
+    let k = key.to_ascii_lowercase().replace('-', "_");
+    if FORBIDDEN_KEYS.iter().any(|f| k == *f) {
+        return true;
+    }
+    if FORBIDDEN_KEY_PARTS.iter().any(|part| k.contains(part)) {
+        return true;
+    }
+    k.ends_with("_token") || k.ends_with("_secret") || k.ends_with("_password")
+}
+
+/// Validate a pasted / uploaded `stitch.toml`. On success returns the original
+/// body (comments preserved) after proving the bot can load it.
+pub fn validate_imported_toml(raw: &str) -> Result<String> {
+    if raw.len() > MAX_TOML_BYTES {
+        bail!(
+            "stitch.toml is too large ({} bytes; max is {} KiB)",
+            raw.len(),
+            MAX_TOML_BYTES / 1024
+        );
+    }
+    let trimmed = raw.trim();
+    if trimmed.is_empty() {
+        bail!("paste a stitch.toml, or pick a file");
+    }
+
+    let parsed: toml::Value = toml::from_str(trimmed).context("this is not valid TOML")?;
+    let mut keys = Vec::new();
+    collect_keys(&parsed, &mut keys);
+    if let Some(key) = keys.iter().find(|k| looks_like_secret_key(k)) {
+        bail!(
+            "this file includes a `{key}` field. Remove it — the wizard collects \
+             the wallet separately, and importing a key in a toml file is how keys leak."
+        );
+    }
+
+    let cfg =
+        Config::from_toml(trimmed).context("this stitch.toml is not a config the bot can load")?;
+    if cfg.signer.is_some() {
+        bail!(
+            "this file includes a [signer] section. Remove it — the wizard \
+             collects the wallet separately."
+        );
+    }
+    if cfg.pools.is_empty() {
+        bail!("this stitch.toml has no [[pools]] — a bot needs at least one pair");
+    }
+
+    Ok(trimmed.to_string())
+}
+
+fn collect_keys(value: &toml::Value, out: &mut Vec<String>) {
+    match value {
+        toml::Value::Table(table) => {
+            for (key, child) in table {
+                out.push(key.clone());
+                collect_keys(child, out);
+            }
+        }
+        toml::Value::Array(items) => {
+            for child in items {
+                collect_keys(child, out);
+            }
+        }
+        _ => {}
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn valid() -> String {
+        r#"
+chain_id        = 42220
+rpc_url         = "https://forno.celo.org"
+indexer_url     = "https://api.textilecredit.com"
+permit2         = "0x000000000022D473030F116dDEE9F6B43aC78BA3"
+reactor         = "0xa9AA0a64769cBed4d3B1Ceb4Df01CdE915C235b3"
+tick_interval_secs = 5
+
+[feed]
+url            = "https://api.textilecredit.com/price?chainId=42220&pair=cngn-usdt"
+staleness_secs = 900
+
+[[pools]]
+collateral = "0x1111111111111111111111111111111111111111"
+collateral_decimals = 6
+debt = "0x2222222222222222222222222222222222222222"
+debt_decimals = 6
+buy_offset_bps = 5
+sell_offset_bps = 5
+ttl_secs = 60
+"#
+        .to_string()
+    }
+
+    #[test]
+    fn a_valid_file_is_accepted_and_loads() {
+        let out = validate_imported_toml(&valid()).expect("valid toml");
+        Config::from_toml(&out).expect("bot loads it");
+    }
+
+    #[test]
+    fn a_signer_table_is_refused() {
+        let err = validate_imported_toml(
+            &(valid() + "\n[signer]\nbackend = \"local\"\nprivate_key = \"0xabc\"\n"),
+        )
+        .unwrap_err();
+        assert!(err.to_string().contains("signer"), "{err}");
+    }
+
+    #[test]
+    fn secret_like_keys_are_refused_even_when_not_on_the_short_list() {
+        for extra in [
+            "\npassword = \"hunter2\"\n",
+            "\naccess_token = \"tok\"\n",
+            "\nclient_secret = \"shh\"\n",
+            "\npanel_password = \"x\"\n",
+        ] {
+            let err = validate_imported_toml(&(valid() + extra)).unwrap_err();
+            assert!(
+                err.to_string().contains("field"),
+                "expected a secret-field error for {extra:?}, got {err}"
+            );
+        }
+    }
+
+    #[test]
+    fn api_key_env_is_not_treated_as_a_secret() {
+        validate_imported_toml(&(valid() + "\napi_key_env = \"STITCH_MAKER_API_KEY\"\n"))
+            .expect("env var name is not a secret");
+    }
+
+    #[test]
+    fn a_private_key_field_is_refused_even_outside_signer() {
+        // A comment mentioning the words is fine; a parsed key is not.
+        let with_comment = format!(
+            "# the wallet key is NOT here; no private_key in this file\n{}",
+            valid()
+        );
+        validate_imported_toml(&with_comment).expect("comment is not a key");
+    }
+
+    #[test]
+    fn empty_and_oversized_files_are_refused() {
+        assert!(validate_imported_toml("   ").is_err());
+        let huge = "x".repeat(MAX_TOML_BYTES + 1);
+        assert!(validate_imported_toml(&huge)
+            .unwrap_err()
+            .to_string()
+            .contains("too large"));
+    }
+
+    #[test]
+    fn garbage_toml_is_refused_before_the_bot_parser() {
+        let err = validate_imported_toml("this is not toml [[[").unwrap_err();
+        assert!(err.to_string().contains("not valid TOML"), "{err}");
+    }
+
+    #[test]
+    fn a_config_the_bot_cannot_load_is_refused() {
+        let err = validate_imported_toml(
+            r#"
+chain_id = 42220
+rpc_url = "https://forno.celo.org"
+permit2 = "0x000000000022D473030F116dDEE9F6B43aC78BA3"
+reactor = "0xa9AA0a64769cBed4d3B1Ceb4Df01CdE915C235b3"
+[feed]
+url = "ftp://evil.example/price"
+[[pools]]
+collateral = "0x1111111111111111111111111111111111111111"
+collateral_decimals = 6
+debt = "0x2222222222222222222222222222222222222222"
+debt_decimals = 6
+"#,
+        )
+        .unwrap_err();
+        assert!(
+            err.to_string().contains("not a config the bot can load"),
+            "{err}"
+        );
+    }
+}