Add config.toml policy_file directive

[merphx]

Warning

DRAFT PR—DO NOT MERGE

Blocked by: #60 (Leash fails to start on Docker Desktop)

Also, I want to complete a little more manual testing on Docker Desktop before removing draft status.

Summary

Add support for configuring Cedar policy file paths in config.toml, allowing users to manage security policies at global and project scopes without relying on CLI flags or environment variables.

Example use case: allowing different network calls to different URLs depending on project-specific tech stack, 3rd-party services, etc.

Changes

• Add policy_file configuration directive

  • Global scope: [leash] policy_file = "~/leash/policies/default.cedar"
  • Project scope: [projects."/path"] policy_file = "./policies/project.cedar"
  • Supports ~ expansion, environment variables, and relative paths (for project entries)

• Implement precedence hierarchy

  • CLI --policy flag takes highest priority
  • LEASH_POLICY_FILE environment variable
  • Project-specific config
  • Global config
  • Auto-generated permissive policy (when none specified)

• Update contributor list

  • Add Phoenix Zerin to CONTRIBUTORS.md 🌟

Screenshots/Videos

N/A

Reviewer Notes

Note

Not being super familiar with the codebase I let the coding agent copy+adapt the code used for target_image configuration and did not prompt it to do any refactoring/deduplication.

[merphx]

CI Test Failure - Thoughts?

I noticed the CI is failing on TestLaunchTargetContainerSkipsDuplicateMount, and I had the coding agent look into it. Here's what it observed:

1. Different code areas:

   • This PR modifies policy file loading in runner.go and adds tests in runner_config_test.go
   • The failing test is in mount_state_test.go, testing container mount deduplication

2. Passes locally:

   • All 133 tests in internal/runner pass when I run them locally
   • The failure only appears in CI

3. Possible race condition:

   • The test modifies the global commandOutput variable (line 193-195) to mock architecture detection
   • Other tests in the same file use t.Parallel(), which could cause timing issues
   • The agent noticed commit 5066912 fixed similar issues by removing t.Parallel() from environment-sensitive tests

It looks like this might be a pre-existing flaky test, and so I'd be keen for it not to block this PR, but I could be overlooking something. Whatcha think?