@automattic/vip 4.1.5 → 4.1.8

package/internal/gql/transport.go

@@ -1,65 +0,0 @@
-package gql
-
-import (
-	json "encoding/json/v2"
-	"io"
-	"net/http"
-	"net/url"
-	"strings"
-
-	"github.com/Automattic/vip/internal/debuglog"
-)
-
-type transport struct {
-	cfg Config
-}
-
-func newTransport(cfg Config) Doer { return &transport{cfg: cfg} }
-
-// Do rewrites the request URL to include ?x_query=<operationName> (unless
-// TestMode is set, matching the Node behavior in api.ts:127–134). Attaches
-// the bearer token if present.
-func (t *transport) Do(req *http.Request) (*http.Response, error) {
-	if !t.cfg.TestMode {
-		if op, err := operationNameFromBody(req); err == nil && op != "" {
-			q := req.URL.Query()
-			q.Set("x_query", op)
-			req.URL.RawQuery = q.Encode()
-		}
-	}
-	if t.cfg.Token != "" {
-		req.Header.Set("Authorization", "Bearer "+t.cfg.Token)
-	}
-	if req.Header.Get("Content-Type") == "" {
-		req.Header.Set("Content-Type", "application/json")
-	}
-	// Mirror Node's HTTP diagnostic without exposing URL credentials or
-	// arbitrary query parameters (which can contain signed download tokens).
-	safeURL := *req.URL
-	safeURL.User = nil
-	safeURL.RawQuery = ""
-	safeURL.Fragment = ""
-	debuglog.Printf(req.Context(), "@automattic/vip:http", "running fetch %s", safeURL.String())
-	return t.cfg.HTTPClient.Do(req)
-}
-
-// operationNameFromBody peeks the JSON body for "operationName" without
-// consuming the reader.
-func operationNameFromBody(req *http.Request) (string, error) {
-	if req.Body == nil {
-		return "", nil
-	}
-	buf, err := io.ReadAll(req.Body)
-	if err != nil {
-		return "", err
-	}
-	req.Body = io.NopCloser(strings.NewReader(string(buf)))
-	req.ContentLength = int64(len(buf))
-	var doc struct {
-		OperationName string `json:"operationName"`
-	}
-	if err := json.Unmarshal(buf, &doc); err != nil {
-		return "", err
-	}
-	return url.QueryEscape(doc.OperationName), nil
-}

package/internal/gql/transport_helper.go

@@ -1,24 +0,0 @@
-package gql
-
-import "net/http"
-
-// HTTPClientWithMiddleware returns an *http.Client whose RoundTripper composes
-// the supplied middleware chain via the *Client's Do method. Use this to feed
-// the same chain (error -> rechallenge -> retry) to a genqlient graphql.Client
-// without duplicating the wiring.
-//
-// The returned *http.Client and the underlying *Client share the same
-// transport.HTTPClient (http.DefaultClient by default), so any rechallenge
-// retry stays on the same connection pool.
-func HTTPClientWithMiddleware(apiHost, token string, mw []Middleware) *http.Client {
-	client := NewClient(Config{APIHost: apiHost, Token: token, Middleware: mw})
-	return &http.Client{Transport: &doerTransport{c: client}}
-}
-
-// doerTransport adapts a *Client (which exposes Do) to net/http.RoundTripper
-// so genqlient's graphql.Client can run through our middleware stack.
-type doerTransport struct{ c *Client }
-
-func (d *doerTransport) RoundTrip(req *http.Request) (*http.Response, error) {
-	return d.c.Do(req)
-}

package/internal/httpproxy/callers_test.go

@@ -1,211 +0,0 @@
-package httpproxy
-
-import (
-	"io/fs"
-	"os"
-	"path/filepath"
-	"strings"
-	"testing"
-)
-
-// tokenBearingSources are the production files whose requests carry a VIP
-// credential — a keychain bearer token, a WPVIP_DEPLOY_TOKEN, or a presigned URL
-// whose query string is itself the credential. Every one of them must build its
-// client from this package.
-//
-// http.DefaultClient and http.DefaultTransport are the failure mode: they apply
-// http.ProxyFromEnvironment, which is the exact inversion of Node's policy —
-// HTTPS_PROXY is honoured without the VIP_USE_SYSTEM_PROXY opt-in, and
-// VIP_PROXY/SOCKS_PROXY are ignored. The behavioural proofs live in
-// httpproxy_test.go, internal/gql/proxy_test.go and internal/upload/proxy_test.go;
-// this list is the cheap guard that stops a seventh call site being added
-// without one.
-//
-// TestNoProductionCodeBuildsAnUnproxiedHTTPClient is the complement: this list
-// is opt-IN (these named files must reach for the package), that scan is
-// opt-OUT (no file anywhere may build a client the package did not vend).
-var tokenBearingSources = []string{
-	"../gql/client.go",
-	"../upload/presign.go",
-	"../auth/logout.go",
-	"../rechallenge/client.go",
-	"../wpstream/engineio.go",
-	"../sqlexport/download.go",
-	"../telemetry/tracks.go",
-	"../telemetry/pendo.go",
-}
-
-func TestTokenBearingClientsDoNotUseTheDefaultTransport(t *testing.T) {
-	for _, rel := range tokenBearingSources {
-		src, err := os.ReadFile(filepath.Clean(rel))
-		if err != nil {
-			t.Errorf("read %s: %v (did the file move? update tokenBearingSources)", rel, err)
-			continue
-		}
-		// A bare &http.Client{} is just as wrong — it inherits
-		// http.DefaultTransport's proxy policy — and is not greppable, so
-		// require the file to reach for this package explicitly.
-		if !strings.Contains(string(src), "httpproxy.") {
-			t.Errorf("%s never calls into internal/httpproxy; an http.Client built without "+
-				"an explicit Transport inherits http.DefaultTransport's proxy policy", rel)
-		}
-		for _, banned := range []string{"http.DefaultClient", "http.DefaultTransport"} {
-			for _, line := range strings.Split(string(src), "\n") {
-				trimmed := strings.TrimSpace(line)
-				if strings.HasPrefix(trimmed, "//") {
-					continue // prose may name it
-				}
-				if strings.Contains(trimmed, banned) {
-					t.Errorf("%s uses %s; use httpproxy.Client()/Transport() so VIP_PROXY is "+
-						"honoured and HTTPS_PROXY is not honoured without VIP_USE_SYSTEM_PROXY\n\t%s",
-						rel, banned, trimmed)
-				}
-			}
-		}
-	}
-}
-
-// unproxiedConstructors are the ways production code can end up on
-// http.DefaultTransport's proxy policy — the inverse of Node's.
-//
-// http.Get/Head/Post/PostForm are http.DefaultClient in disguise. A
-// `&http.Client{...}` literal with no Transport field is the same thing with a
-// timeout bolted on, which is what made the four call sites this scan was
-// written for look deliberate.
-var unproxiedConstructors = []string{
-	"http.DefaultClient",
-	"http.DefaultTransport",
-	"http.Get(",
-	"http.Head(",
-	"http.Post(",
-	"http.PostForm(",
-}
-
-// scanExemptDirs are the trees the scan does not walk.
-//
-//   - internal/httpproxy is the package that vends the sanctioned constructors;
-//     it necessarily names http.DefaultTransport in order to clone it.
-//   - internal/parity is the differential-test harness, gated behind
-//     `//go:build parity`. It deliberately talks to a local Parker with its own
-//     client, and its whole point is ambient independence — the Makefile scrubs
-//     every proxy variable before running it.
-var scanExemptDirs = []string{
-	filepath.Join("internal", "httpproxy"),
-	filepath.Join("internal", "parity"),
-}
-
-// TestNoProductionCodeBuildsAnUnproxiedHTTPClient walks every non-test Go file
-// under internal/ and cmd/ and fails on any HTTP client that did not come from
-// this package.
-//
-// tokenBearingSources could only ever catch a regression in a file someone had
-// already thought about. This scan catches the file nobody thought about: at
-// the commit it was written it found four live call sites on
-// http.DefaultTransport, one of them (the WordPress version manifest) a request
-// Node explicitly routes through createProxyAgent.
-func TestNoProductionCodeBuildsAnUnproxiedHTTPClient(t *testing.T) {
-	root, err := filepath.Abs(filepath.Join("..", ".."))
-	if err != nil {
-		t.Fatalf("resolve repo root: %v", err)
-	}
-	for _, tree := range []string{"internal", "cmd"} {
-		walkGoSources(t, filepath.Join(root, tree), root, func(rel string, src []byte) {
-			for _, line := range codeLines(string(src)) {
-				for _, banned := range unproxiedConstructors {
-					if strings.Contains(line.text, banned) {
-						t.Errorf("%s:%d builds an HTTP client on http.DefaultTransport's proxy "+
-							"policy via %s. Use httpproxy.Client()/ClientWithTimeout() so VIP_PROXY is "+
-							"honoured and HTTPS_PROXY is not honoured without VIP_USE_SYSTEM_PROXY; use "+
-							"httpproxy.DirectClientWithTimeout() when the target is the user's own "+
-							"machine and must never be proxied.\n\t%s",
-							rel, line.num, banned, line.text)
-					}
-				}
-				if lit, ok := clientLiteral(line.text); ok && !strings.Contains(lit, "Transport:") {
-					t.Errorf("%s:%d constructs http.Client with no Transport, so it inherits "+
-						"http.DefaultTransport's proxy policy. Use httpproxy.ClientWithTimeout() "+
-						"(or DirectClientWithTimeout() for the user's own machine).\n\t%s",
-						rel, line.num, line.text)
-				}
-			}
-		})
-	}
-}
-
-type sourceLine struct {
-	num  int
-	text string
-}
-
-// codeLines drops whole-line comments so prose may name the banned symbols —
-// several files explain at length why they are NOT using http.DefaultClient.
-func codeLines(src string) []sourceLine {
-	var out []sourceLine
-	for i, raw := range strings.Split(src, "\n") {
-		trimmed := strings.TrimSpace(raw)
-		if trimmed == "" || strings.HasPrefix(trimmed, "//") {
-			continue
-		}
-		out = append(out, sourceLine{num: i + 1, text: trimmed})
-	}
-	return out
-}
-
-// clientLiteral returns the body of an `http.Client{...}` composite literal
-// starting on this line, up to the matching brace. A multi-line literal is
-// truncated at end of line, which errs in the safe direction: one whose
-// Transport field sits on a later line reports a false positive rather than
-// letting a real unproxied client through.
-func clientLiteral(line string) (string, bool) {
-	idx := strings.Index(line, "http.Client{")
-	if idx < 0 {
-		return "", false
-	}
-	rest := line[idx+len("http.Client"):]
-	depth := 0
-	for i, r := range rest {
-		switch r {
-		case '{':
-			depth++
-		case '}':
-			depth--
-			if depth == 0 {
-				return rest[:i+1], true
-			}
-		}
-	}
-	return rest, true
-}
-
-func walkGoSources(t *testing.T, dir, root string, fn func(rel string, src []byte)) {
-	t.Helper()
-	err := filepath.WalkDir(dir, func(path string, d fs.DirEntry, err error) error {
-		if err != nil {
-			return err
-		}
-		rel, relErr := filepath.Rel(root, path)
-		if relErr != nil {
-			return relErr
-		}
-		if d.IsDir() {
-			for _, skip := range scanExemptDirs {
-				if rel == skip {
-					return filepath.SkipDir
-				}
-			}
-			return nil
-		}
-		if !strings.HasSuffix(path, ".go") || strings.HasSuffix(path, "_test.go") {
-			return nil
-		}
-		src, readErr := os.ReadFile(filepath.Clean(path))
-		if readErr != nil {
-			return readErr
-		}
-		fn(rel, src)
-		return nil
-	})
-	if err != nil {
-		t.Fatalf("walk %s: %v", dir, err)
-	}
-}

package/internal/httpproxy/debug_test.go

@@ -1,32 +0,0 @@
-package httpproxy
-
-import (
-	"bytes"
-	"context"
-	"net/http"
-	"strings"
-	"testing"
-
-	"github.com/Automattic/vip/internal/debuglog"
-)
-
-func TestProxyDiagnosticOmitsCredentials(t *testing.T) {
-	clearProxyEnv(t)
-	t.Setenv("VIP_PROXY", "socks5://user:proxy-secret@localhost:1080")
-	var out bytes.Buffer
-	ctx := debuglog.WithLogger(context.Background(), "vip:proxy-dispatcher", &out)
-	req, _ := http.NewRequestWithContext(ctx, "GET", "https://example.test/graphql?token=request-secret", nil)
-	u, err := ProxyURL(req)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if u == nil || u.User == nil {
-		t.Fatal("proxy authentication lost")
-	}
-	if !strings.Contains(out.String(), "socks5://localhost:1080") {
-		t.Fatalf("missing proxy diagnostic: %q", out.String())
-	}
-	if strings.Contains(out.String(), "secret") || strings.Contains(out.String(), "user") {
-		t.Fatalf("credentials exposed: %q", out.String())
-	}
-}

package/internal/httpproxy/httpproxy.go

@@ -1,315 +0,0 @@
-// Package httpproxy is the Go port of src/lib/http/proxy-agent.ts, plus the
-// parts of the `proxy-from-env` npm package that file depends on.
-//
-// It exists because the two runtimes disagree about the DEFAULT. Node reaches
-// the API through node-fetch with an explicit agent (src/lib/api/http.ts:42),
-// and node-fetch reads no proxy environment of its own — so an ambient
-// HTTPS_PROXY is ignored unless the user sets VIP_USE_SYSTEM_PROXY. Go's
-// http.DefaultTransport reads HTTP_PROXY/HTTPS_PROXY unconditionally, so
-// vip-next was routing bearer tokens through proxies the Node CLI deliberately
-// bypassed, while ignoring the VIP_PROXY/SOCKS_PROXY variables Node does honour.
-//
-// Every vip-next HTTP client that talks to the VIP API must use Client() or
-// Transport() rather than http.DefaultClient.
-package httpproxy
-
-import (
-	"fmt"
-	"net/http"
-	"net/url"
-	"os"
-	"strconv"
-	"strings"
-	"time"
-
-	"github.com/Automattic/vip/internal/debuglog"
-)
-
-// ProxyURL is the port of createProxyAgent (proxy-agent.ts:20-46). It is shaped
-// as an http.Transport.Proxy func: nil means "connect directly".
-//
-// Precedence, verbatim from the source's own comment:
-//
-//  1. VIP_PROXY set: a SOCKS proxy, unconditionally — before the opt-in gate
-//     and before NO_PROXY. This is the pre-system-proxy behaviour and stays
-//     backward compatible.
-//  2. Nothing applicable set: no proxy.
-//  3. VIP_USE_SYSTEM_PROXY and SOCKS_PROXY: SOCKS.
-//  4. VIP_USE_SYSTEM_PROXY and HTTPS_PROXY: HTTP CONNECT. Note that Node checks
-//     HTTPS_PROXY for EVERY target, not only https:// ones, and never consults
-//     HTTP_PROXY at all.
-//  5. NO_PROXY alongside the opt-in: see coveredInNoProxy.
-//
-// Errors are returned rather than swallowed. A proxy the user configured but
-// that we cannot honour must fail the request; silently connecting direct is
-// how the SOCKS half of this bug went unnoticed.
-func ProxyURL(req *http.Request) (selected *url.URL, err error) {
-	if req == nil || req.URL == nil {
-		return nil, nil
-	}
-	defer func() {
-		if selected != nil && err == nil {
-			debuglog.Printf(req.Context(), "vip:proxy-dispatcher", "Enabling fetch dispatcher proxy support using config: %s://%s", selected.Scheme, selected.Host)
-		}
-	}()
-	target := req.URL
-
-	// 1. VIP Socks Proxy takes precedence and is fully backward compatible.
-	if vipProxy := firstEnv("VIP_PROXY", "vip_proxy"); vipProxy != "" {
-		return socksProxyURL(vipProxy)
-	}
-
-	// 2-5. System proxy usage, gated on the explicit opt-in.
-	if os.Getenv("VIP_USE_SYSTEM_PROXY") == "" {
-		return nil, nil
-	}
-	noProxy := firstEnv("NO_PROXY", "no_proxy")
-	if coveredInNoProxy(target, noProxy) {
-		return nil, nil
-	}
-	if socksProxy := firstEnv("SOCKS_PROXY", "socks_proxy"); socksProxy != "" {
-		return socksProxyURL(socksProxy)
-	}
-	if httpsProxy := firstEnv("HTTPS_PROXY", "https_proxy"); httpsProxy != "" {
-		return httpsProxyURL(httpsProxy)
-	}
-	return nil, nil
-}
-
-// Transport returns an http.Transport with vip-next's proxy policy and
-// otherwise the stdlib defaults (connection pooling, timeouts, HTTP/2).
-func Transport() *http.Transport {
-	base, ok := http.DefaultTransport.(*http.Transport)
-	if !ok {
-		return &http.Transport{Proxy: ProxyURL}
-	}
-	t := base.Clone()
-	t.Proxy = ProxyURL
-	return t
-}
-
-// Client returns an http.Client with vip-next's proxy policy and no timeout,
-// matching http.DefaultClient in every other respect.
-func Client() *http.Client { return &http.Client{Transport: Transport()} }
-
-// ClientWithTimeout is Client with a per-request deadline.
-func ClientWithTimeout(d time.Duration) *http.Client {
-	c := Client()
-	c.Timeout = d
-	return c
-}
-
-// DirectClientWithTimeout returns a client that NEVER consults a proxy, for the
-// requests whose target is the user's own machine.
-//
-// The dev-environment health probe is the case that motivated it: it fetches
-// https://<slug>.vipdev.site/, a name /etc/hosts maps to 127.0.0.1. ProxyURL
-// applies VIP_PROXY unconditionally and exempts no loopback — deliberately, to
-// match proxy-from-env — so routing that probe through the policy would break
-// every developer with the VIP SOCKS proxy exported: the proxy would resolve
-// and dial <slug>.vipdev.site on its OWN side, where the containers do not
-// exist. Node does not proxy it either; Lando's health check is internal, and
-// the single dev-environment request Node hands to createProxyAgent is the
-// WordPress version manifest (dev-environment-core.ts:1044).
-//
-// This exists so "goes direct" is a decision a reader can grep for. A bare
-// &http.Client{} would go direct today for a different, accidental reason —
-// http.DefaultTransport ignores VIP_PROXY entirely — and would silently start
-// honouring an ambient HTTPS_PROXY, which is the bug this package removed.
-func DirectClientWithTimeout(d time.Duration) *http.Client {
-	t := directTransport()
-	return &http.Client{Transport: t, Timeout: d}
-}
-
-func directTransport() *http.Transport {
-	base, ok := http.DefaultTransport.(*http.Transport)
-	if !ok {
-		return &http.Transport{}
-	}
-	t := base.Clone()
-	t.Proxy = nil
-	return t
-}
-
-// socksProxyURL is the SocksProxyAgent constructor's Go equivalent.
-//
-// Divergence, deliberate and loud: socks-proxy-agent also speaks socks4 and
-// socks4a, which net/http cannot. Rather than fall back to a direct connection
-// — the exact silent failure this package exists to remove — an unsupported
-// scheme is an error. "socks" is socks5 in socks-proxy-agent, and net/http
-// treats socks5 and socks5h identically.
-func socksProxyURL(raw string) (*url.URL, error) {
-	u, err := url.Parse(raw)
-	if err != nil {
-		return nil, fmt.Errorf("invalid SOCKS proxy %s: %w", redact(raw), err)
-	}
-	switch u.Scheme {
-	case "socks", "":
-		u.Scheme = "socks5"
-	case "socks5", "socks5h":
-	case "socks4", "socks4a":
-		return nil, fmt.Errorf("SOCKS proxy %s: socks4/socks4a is not supported; use socks5", redact(raw))
-	default:
-		return nil, fmt.Errorf("SOCKS proxy %s: unsupported scheme %q", redact(raw), u.Scheme)
-	}
-	if u.Host == "" {
-		return nil, fmt.Errorf("SOCKS proxy %s has no host", redact(raw))
-	}
-	return u, nil
-}
-
-// redact strips the userinfo from a proxy URL before it can reach an error
-// message. Proxy URLs routinely carry credentials, and these errors do not stay
-// on the machine: cmd/vip-next/main.go registers an exit hook that ships the
-// error text to the telemetry endpoint. The host is deliberately preserved —
-// the user needs to know WHICH proxy setting is wrong.
-func redact(raw string) string {
-	if u, err := url.Parse(raw); err == nil && u.User != nil {
-		return u.Redacted()
-	}
-	// Unparseable, or no userinfo. Fall back to a textual cut at "@" so a
-	// malformed value with an embedded password still cannot escape.
-	if at := strings.LastIndex(raw, "@"); at >= 0 {
-		if scheme := strings.Index(raw, "://"); scheme >= 0 && scheme+3 <= at {
-			return raw[:scheme+3] + "xxxxx@" + raw[at+1:]
-		}
-		return "xxxxx@" + raw[at+1:]
-	}
-	return raw
-}
-
-// httpsProxyURL is the HttpsProxyAgent constructor's Go equivalent. A value
-// with no scheme (`proxy.example:3128`) is read as http://, which is what
-// golang.org/x/net/http/httpproxy does; https-proxy-agent's URL parse would
-// simply produce a hostless agent, so there is no useful behaviour to copy.
-func httpsProxyURL(raw string) (*url.URL, error) {
-	u, err := url.Parse(raw)
-	if err != nil || u.Host == "" {
-		if u2, err2 := url.Parse("http://" + raw); err2 == nil && u2.Host != "" {
-			return u2, nil
-		}
-	}
-	if err != nil {
-		return nil, fmt.Errorf("invalid HTTPS proxy %s: %w", redact(raw), err)
-	}
-	if u.Host == "" {
-		return nil, fmt.Errorf("HTTPS proxy %s has no host", redact(raw))
-	}
-	return u, nil
-}
-
-// coveredInNoProxy ports proxy-agent.ts:60-68.
-//
-// The early return is load-bearing: getProxyForUrl cannot distinguish "NO_PROXY
-// matched" from "no proxy variable applies to this URL", so proxy-agent.ts only
-// asks it once NO_PROXY is actually set. The conflation survives anyway in one
-// configuration, and it is Node's: with NO_PROXY set and SOCKS_PROXY as the only
-// proxy variable, getProxyForUrl returns "" — it has never heard of SOCKS_PROXY
-// — so the SOCKS proxy is suppressed even for a host NO_PROXY does not name.
-func coveredInNoProxy(target *url.URL, noProxy string) bool {
-	if noProxy == "" {
-		return false
-	}
-	return getProxyForURL(target) == ""
-}
-
-// defaultPorts mirrors proxy-from-env's DEFAULT_PORTS.
-var defaultPorts = map[string]int{
-	"ftp": 21, "gopher": 70, "http": 80, "https": 443, "ws": 80, "wss": 443,
-}
-
-// getProxyForURL ports proxy-from-env's getProxyForUrl.
-func getProxyForURL(target *url.URL) string {
-	proto := target.Scheme
-	hostname := strings.ToLower(target.Hostname())
-	if hostname == "" || proto == "" {
-		return ""
-	}
-	port := defaultPorts[proto]
-	if p := target.Port(); p != "" {
-		if parsed, err := strconv.Atoi(p); err == nil {
-			port = parsed
-		}
-	}
-	if !shouldProxy(hostname, port) {
-		return ""
-	}
-	proxy := firstOf(
-		envAnyCase("npm_config_"+proto+"_proxy"),
-		envAnyCase(proto+"_proxy"),
-		envAnyCase("npm_config_proxy"),
-		envAnyCase("all_proxy"),
-	)
-	if proxy != "" && !strings.Contains(proxy, "://") {
-		proxy = proto + "://" + proxy
-	}
-	return proxy
-}
-
-// shouldProxy ports proxy-from-env's shouldProxy: the NO_PROXY ruleset.
-// A "*" alone proxies nothing; a leading "." or "*" is a suffix match;
-// "host:port" only applies to that port; anything else is an exact host match.
-func shouldProxy(hostname string, port int) bool {
-	noProxy := strings.ToLower(firstOf(envAnyCase("npm_config_no_proxy"), envAnyCase("no_proxy")))
-	if noProxy == "" {
-		return true
-	}
-	if noProxy == "*" {
-		return false
-	}
-	for _, entry := range strings.FieldsFunc(noProxy, func(r rune) bool {
-		return r == ',' || r == ' ' || r == '\t' || r == '\n' || r == '\r' || r == '\f' || r == '\v'
-	}) {
-		if entry == "" {
-			continue
-		}
-		entryHost := entry
-		if idx := strings.LastIndex(entry, ":"); idx > 0 {
-			if entryPort, err := strconv.Atoi(entry[idx+1:]); err == nil {
-				if entryPort != port {
-					continue // rule is for a different port
-				}
-				entryHost = entry[:idx]
-			}
-		}
-		if !strings.HasPrefix(entryHost, ".") && !strings.HasPrefix(entryHost, "*") {
-			if hostname == entryHost {
-				return false
-			}
-			continue
-		}
-		suffix := strings.TrimPrefix(entryHost, "*")
-		if strings.HasSuffix(hostname, suffix) {
-			return false
-		}
-	}
-	return true
-}
-
-// firstEnv returns the first non-empty value among the named variables, in the
-// order proxy-agent.ts reads them (UPPER_CASE first, then lower_case).
-func firstEnv(names ...string) string {
-	for _, n := range names {
-		if v := os.Getenv(n); v != "" {
-			return v
-		}
-	}
-	return ""
-}
-
-// envAnyCase ports proxy-from-env's getEnv, which checks lower case first.
-func envAnyCase(key string) string {
-	if v := os.Getenv(strings.ToLower(key)); v != "" {
-		return v
-	}
-	return os.Getenv(strings.ToUpper(key))
-}
-
-func firstOf(values ...string) string {
-	for _, v := range values {
-		if v != "" {
-			return v
-		}
-	}
-	return ""
-}