chore: remove dead code and tighten defaults

- Remove unused escapeHtml (codebase uses textContent throughout)
- Change retryWithStrategy default retryOn from [401,429] to [429]
  (all call sites already override this; 401 should not be retried)
- Remove keys field from LRUCache.getStats() (only size/utilization used)

Author: euxx

src/lib/format-utils.js

@@ -81,20 +81,6 @@ export function getNotificationStatus(notif) {
   return type;
 }
 
-/**
- * Escape HTML to prevent XSS
- * Uses string replacement instead of DOM manipulation for better performance
- */
-export function escapeHtml(text) {
-  if (text === null || text === undefined) return "";
-  return String(text)
-    .replace(/&/g, "&")
-    .replace(/</g, "&lt;")
-    .replace(/>/g, "&gt;")
-    .replace(/"/g, "&quot;")
-    .replace(/'/g, "&#39;");
-}
-
 /**
  * Classify a network/API error into a category for consistent handling
  * @param {Error} error - Error object

src/lib/github-api.js

@@ -70,7 +70,7 @@ async function retryWithStrategy(fetchFn, options = {}) {
     maxRetries = 3,
     baseDelay = API_TIMEOUTS.RETRY_BASE_DELAY,
     backoff = "exponential",
-    retryOn = [401, 429],
+    retryOn = [429],
     checkResponse = true,
   } = options;
 

src/lib/lru-cache.js

@@ -79,7 +79,6 @@ export class LRUCache {
       size: this.cache.size,
       maxSize: this.maxSize,
       utilization: `${((this.cache.size / this.maxSize) * 100).toFixed(1)}%`,
-      keys: Array.from(this.cache.keys()),
     };
   }
 }

tests/format-utils.test.js

@@ -4,7 +4,6 @@ import {
   formatType,
   formatState,
   getNotificationStatus,
-  escapeHtml,
   classifyError,
 } from "../src/lib/format-utils.js";
 
@@ -115,31 +114,6 @@ describe("getNotificationStatus", () => {
   });
 });
 
-describe("escapeHtml", () => {
-  it("should escape HTML special characters", () => {
-    expect(escapeHtml("<script>")).toBe("&lt;script&gt;");
-    expect(escapeHtml("a & b")).toBe("a &amp; b");
-    expect(escapeHtml('"quotes"')).toBe("&quot;quotes&quot;");
-    expect(escapeHtml("'apostrophe'")).toBe("&#39;apostrophe&#39;");
-  });
-
-  it("should handle combined special characters", () => {
-    expect(escapeHtml('<a href="url">link</a>')).toBe(
-      "&lt;a href=&quot;url&quot;&gt;link&lt;/a&gt;",
-    );
-  });
-
-  it("should handle null/undefined", () => {
-    expect(escapeHtml(null)).toBe("");
-    expect(escapeHtml(undefined)).toBe("");
-  });
-
-  it("should convert non-string values to string", () => {
-    expect(escapeHtml(123)).toBe("123");
-    expect(escapeHtml(true)).toBe("true");
-  });
-});
-
 describe("classifyError", () => {
   it('should classify rate limit errors as "rate-limited"', () => {
     expect(classifyError(new Error("Rate limited until 12:00"))).toBe("rate-limited");

tests/lru-cache.test.js

@@ -114,7 +114,6 @@ describe("LRUCache", () => {
       expect(stats.size).toBe(2);
       expect(stats.maxSize).toBe(3);
       expect(stats.utilization).toBe("66.7%");
-      expect(stats.keys).toEqual(["a", "b"]);
     });
 
     it("should show 0% utilization when empty", () => {