chore: apply @lavamoat/harden defaults

.depcheckrc.json

@@ -10,6 +10,7 @@
     "@vitest/coverage-istanbul",
     "@vitest/eslint-plugin",
     "@yarnpkg/types",
+    "@yarnpkg/shell",
     "eslint-config-*",
     "eslint-import-resolver-typescript",
     "eslint-plugin-*",

.oxfmtrc.json

@@ -1,6 +1,6 @@
 {
   "$schema": "./node_modules/oxfmt/configuration_schema.json",
-  "ignorePatterns": [".yarnrc.yml"],
+  "ignorePatterns": [".yarnrc.yml", "lavamoat"],
   "printWidth": 80,
   "quoteProps": "as-needed",
   "singleQuote": true,

.yarnrc.yml

@@ -7,10 +7,20 @@ compressionLevel: mixed
 
 enableGlobalCache: false
 
+# Enable hardened mode to validate lockfile content against remote registries.
+enableHardenedMode: true
+
+# Disable Yarn's mirror feature to avoid writing to the global cache.
+enableMirror: false
+
 enableScripts: false
 
 enableTelemetry: false
 
+# Despite `enableGlobalCache` and `enableMirror` being `false`, Yarn is still
+# writing to the global folder.
+globalFolder: .yarn/global
+
 logFilters:
   - code: YN0004
     level: discard
@@ -28,6 +38,7 @@ npmPreapprovedPackages:
   - '@metamask-previews/*'
   - '@lavamoat/*'
 
+# Protect the runtime of calls to "yarn run" scripts using a local plugin.
 plugins:
-  - path: .yarn/plugins/@yarnpkg/plugin-allow-scripts.cjs
-    spec: 'https://raw.githubusercontent.com/LavaMoat/LavaMoat/main/packages/yarn-plugin-allow-scripts/bundles/@yarnpkg/plugin-allow-scripts.js'
+  - path: ./lavamoat/plugin-allow-scripts.js
+  - path: ./lavamoat/.runner-plugin.js

eslint.config.mjs

@@ -5,7 +5,7 @@ import vitest from '@metamask/eslint-config-vitest';
 
 const config = createConfig([
   {
-    ignores: ['dist/', 'docs/', '.yarn/'],
+    ignores: ['dist/', 'docs/', '.yarn/', 'lavamoat/'],
   },
 
   {

lavamoat/.env.ban.json

@@ -0,0 +1 @@
+["SESSION", "SSH", "KEY", "TOKEN", "SECRET", "PASSWORD", "AUTH"]