chore: remove obfuscated code smuggled into jest.config.js

[OkeyAmy]

What changed

The exported Jest config in jest.config.js had roughly 26 KB of obfuscated code appended to the same line as the closing };. This removes it, leaving the file as configuration again. Nothing else in the tree changed.

Why it went

The blob plays no part in Jest configuration. It sits after the exported object, so it runs every time the config file loads — that is, on every npm test. What it contains:

• eval(...) over a string assembled at run time
• spawn(<cmd>, ['-e', <same string>], { detached: true, windowsHide: true }), invoked so a detached child process keeps running outside the test run
• a lookup-table decode feeding new URL(...) and outbound fetches; no literal address survives in the file, the strings are recovered from a hex table while it executes

It arrived in e4c92ad ("test: add quiet hours and alert dedup tests (#304)"), a commit whose message never suggests it touches Jest configuration.

Indicators

Item	Value
Injecting commit	e4c92ad
Location	jest.config.js line 40, one 26,296-character line appended after };
Signatures	eval(DiRknXtYt+, spawn(, windowsHide, !![], new URL( decode loop
Blast radius	In the original tree, grep -rl windowsHide matched only this file; a repo-wide scan for appended high-entropy lines (over 1,500 characters containing 0x.., !![], eval() found nothing else

Verification

• node -e "require('./jest.config.js')" loads the cleaned config and stops there.
• The suite runs under the cleaned config. Previously, simply loading the config was enough to set the payload off.

Related

Two further files in main are committed as Base64 rather than source (src/common/guard/quota.guard.spec.ts, scripts/validate-openapi.ts). They are repaired in a follow-up PR, so this one stays focused on the executable payload.

[drips-wave]

Hey @OkeyAmy! 👋 It looks like this PR isn't linked to any issue.

If this PR is for one of the issues assigned to you as part of a Wave, please link it to ensure your contribution is tracked properly. You can do this by adding a keyword to the PR description (e.g., Closes #123), or by clicking a button below:

Issue	Title
#214	Trellis API: Add high-cardinality telemetry protection with redaction and sampling rules	Link to this issue
#220	Trellis API: Add maintainer action approval flow with signed intent receipts	Link to this issue
#218	Trellis API: Build multi-actor concurrency harness for race-prone mutations	Link to this issue

ℹ️ Learn more about linking PRs to issues

[github-actions]

Code Review & Auto-Merge — @dorismaduegbunam 🚀

Thank you @OkeyAmy for your contribution!

• PR Title: chore: remove obfuscated code smuggled into jest.config.js

• Author: @OkeyAmy

• Branch: chore/jest-config-payload-removal -> main

• Status: Approved & Merged into main.

Verified code changes and repository requirements. Merging pull request.