Summary
getSystemFragment in src/proxy.ts:115-149 is a complete HTTP fetcher with cache + TTL + timeout, but nothing in the binary calls it. Only the definition shows up across the repo.
Evidence
$ grep -n getSystemFragment src/proxy.ts
115:async function getSystemFragment(baseUrl: string, token: string): Promise<string> {
No callers anywhere. The supporting state (_systemFragmentCache, _systemFragmentFetchedAt, FRAGMENT_TTL_MS) is likewise untouched after its initial assignment.
Why it matters
- Confuses auditors reading the proxy — the README promotes the binary as thin, but this function suggests a whole fragment-fetch code path that doesn't run.
- Drags along a TTL constant + two module-level
lets that exist for one call site that never happens.
Fix options
- Delete — if the server-side
/prepare endpoint already returns system_fragment (it does, see PrepareResult.system_fragment at src/proxy.ts:408), the client doesn't need its own fetcher. Remove the function and the cache globals.
- Wire up — if there was a planned fallback (fetch fragment when
/prepare is skipped / passthrough), call it from handleRequest explicitly and document when.
My read: option 1 is correct. The prepare exchange is the only content-aware call the proxy makes, per the README.
Summary
getSystemFragmentinsrc/proxy.ts:115-149is a complete HTTP fetcher with cache + TTL + timeout, but nothing in the binary calls it. Only the definition shows up across the repo.Evidence
No callers anywhere. The supporting state (
_systemFragmentCache,_systemFragmentFetchedAt,FRAGMENT_TTL_MS) is likewise untouched after its initial assignment.Why it matters
lets that exist for one call site that never happens.Fix options
/prepareendpoint already returnssystem_fragment(it does, seePrepareResult.system_fragmentatsrc/proxy.ts:408), the client doesn't need its own fetcher. Remove the function and the cache globals./prepareis skipped / passthrough), call it fromhandleRequestexplicitly and document when.My read: option 1 is correct. The prepare exchange is the only content-aware call the proxy makes, per the README.