Add dial-control option to vMCP session factory

[tgrunnagle]

Summary

The vMCP MultiSessionFactory opens a persistent connection to every backend
during session initialize (the MCP handshake plus capability listing), but
those session-init dials used http.DefaultTransport with no
net.Dialer.Control hook, and NewSessionFactory exposed no way to inject
one. This is asymmetric with the per-call backend client in pkg/vmcp/client,
which already offers WithDialControl. As a result, an embedder that installs
a dial guard on the backend client (for example, an SSRF / DNS-rebinding guard
that refuses dials resolving into private IP ranges) covered the aggregation
and tool-call paths but could not cover the session-init dials — so
initialize would still dial and handshake against an operator- or
attacker-influenceable backend endpoint.

• Add session.WithDialControl (MultiSessionFactoryOption) and its
  counterpart backend.WithDialControl (HTTPConnectorOption), threaded
  through createMCPClient so the hook fires on session-init dials for both
  the streamable-http and sse transports, on both the MakeSessionWithID
  and RestoreSession paths. The signature matches net.Dialer.Control and
  vmcpclient.WithDialControl exactly and carries the same security caveats
  (per-TCP-dial not per-request, proxy transparency, both IP families, OWASP
  range list).
• Centralize backend transport construction by extracting
  networking.CloneDefaultTransportWithDialControl as the single shared
  construction point used by both the per-call client and the session
  connector, removing the duplicated clone-or-reconstruct + dialer logic that
  previously lived in pkg/vmcp/client.
• Group createMCPClient's option parameters into an mcpClientParams
  struct so the two adjacent, frequently-nil func members (sink,
  dialControl) cannot be silently transposed at a call site.
• Preserve existing behavior: a nil control (the default) leaves the dial
  path byte-for-byte identical to http.DefaultTransport — the session
  connector returns http.DefaultTransport unchanged when no hook is set.

Closes #6545

Type of change

• New feature

Test plan

• Unit tests (task test)

Ran the affected packages (pkg/networking, pkg/vmcp/client,
pkg/vmcp/session, and pkg/vmcp/session/internal/backend) with the Taskfile
flags. Coverage added:

• A deny-all dial control yields zero backend requests during session
  initialize for both the streamable-http and sse transports, and the
  control's hook is asserted to have actually fired (so an unrelated earlier
  failure cannot pass the test for the wrong reason).
• The dial control also guards the RestoreSession path (its distinct
  filtering / identity-binding restore logic).
• A two-backend session where the control blocks one backend's address proves
  the control is applied per-backend: the allowed backend connects and the
  blocked one is excluded.
• A nil control returns http.DefaultTransport unchanged.
• The shared networking.CloneDefaultTransportWithDialControl helper is covered
  directly, including the reconstruction branch taken when http.DefaultTransport
  has been replaced by a non-*http.Transport.
• The pre-existing client transport tests still pass.

Changes

File	Change
pkg/networking/http_client.go	Add CloneDefaultTransportWithDialControl, the single shared backend-transport construction point (clone-or-reconstruct + optional dial-control dialer).
pkg/networking/backend_transport_test.go	Tests for the shared helper, including the DefaultTransport-replaced reconstruction branch.
pkg/vmcp/client/client.go	Replace inlined backendDialer / transport construction with the shared helper.
pkg/vmcp/session/factory.go	Add WithDialControl factory option; thread it into the HTTP connector.
pkg/vmcp/session/factory_dialcontrol_test.go	Test the factory option across MakeSessionWithID, RestoreSession, and the mixed per-backend allow/block scenario.
pkg/vmcp/session/internal/backend/mcp_session.go	Add WithDialControl connector option and backendBaseTransport; group createMCPClient's option params into mcpClientParams; thread the hook through for streamable-http and sse.
pkg/vmcp/session/internal/backend/mcp_session_dialcontrol_test.go	Deny-all dial-control tests for both transports, asserting the hook fired.
pkg/vmcp/session/internal/backend/mcp_session_test.go	Update for the new createMCPClient signature.

Does this introduce a user-facing change?

No end-user behavior changes by default. This adds an opt-in embedder API: a
new session.WithDialControl option that lets a deployment enforce a
per-connection dial policy on the connections opened at vMCP session
initialization, closing a gap relative to the existing backend-client guard.

Special notes for reviewers

• The no-hook path is intentionally byte-for-byte identical to before:
  backendBaseTransport(nil) returns http.DefaultTransport directly rather
  than a clone, so nothing changes for deployments that do not opt in.
• Timeout constants for the backend dialer now live in one place
  (pkg/networking), so the client and session-connector dial paths can no
  longer drift.
• The reconstruction-branch test mutates the process-global
  http.DefaultTransport and is therefore non-parallel (restored via
  t.Cleanup); it carries a justified //nolint:paralleltest.
• Follow-up (item 4 in the issue, deliberately out of scope here): wiring the
  option into pkg/vmcp/cli/serve.go so a production deployment can opt into a
  guard. This PR adds the plumbing; the CLI wiring can land separately.

Generated with Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 78.71%. Comparing base (2533388) to head (e90ac15).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #6547      +/-   ##
==========================================
+ Coverage   78.69%   78.71%   +0.02%     
==========================================
  Files         777      777              
  Lines       76797    76834      +37     
==========================================
+ Hits        60432    60483      +51     
+ Misses      16360    16346      -14     
  Partials        5        5              

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[tgrunnagle]

Multi-Agent Consensus Review

Agents consulted: security-reviewer, go-correctness-reviewer, test-coverage-reviewer, general-code-quality-reviewer

Consensus Summary

#	Finding	Consensus	Severity	Action
1	WithDialControl caveat docs drop the OWASP citation + re-classification sentence present in the original	9/10	MEDIUM	Fix
2	Guarded-dial tests prove "error + zero hits" without confirming the specific hook fired	8/10	MEDIUM	Fix
3	RestoreSession's dial-control wiring has no direct test	8/10	MEDIUM	Fix
4	createMCPClient's adjacent nil-typed positional params risk future transposition	7/10	MEDIUM	Fix
5	CloneDefaultTransportWithDialControl's doc names vMCP specifically inside a generic package	7/10	MEDIUM	Fix
6	Reconstructed-transport fallback branch (DefaultTransport replaced) is entirely untested	7/10	MEDIUM	Fix
7	No multi-backend test for mixed allow/block dial control	7/10	MEDIUM	Fix

Overall

This PR closes a real coverage gap: session-init backend dials in pkg/vmcp/session previously had no way to install a net.Dialer.Control hook, so an SSRF/DNS-rebinding guard installed on the per-call client (pkg/vmcp/client) did not cover the session-init handshake. The approach is sound — a single shared transport constructor (networking.CloneDefaultTransportWithDialControl) is now used by both the per-call client and the persistent session connector, the hook is verified to fire for both streamable-http and sse (both branches build off the same base transport before the transport-type switch), and the no-hook path is deliberately pinned to be byte-for-byte identical to before (assert.Same(t, http.DefaultTransport, backendBaseTransport(nil), ...)).

The findings below are all polish and rigor items, not correctness defects. The biggest is that the new caveat documentation drops two sentences (the OWASP SSRF Prevention Cheat Sheet citation and the "no per-request re-classification" clarification) present in the pkg/vmcp/client.WithDialControl original it's meant to mirror — worth fixing since the closed issue's acceptance criteria call for the same caveat documentation. The rest are test-coverage gaps: the new guarded/unguarded tests prove "error + zero backend hits" without confirming the specific hook fired (an unrelated failure earlier in the chain would look identical), RestoreSession's dial-control wiring and a mixed allow/block multi-backend scenario are both untested, and the http.DefaultTransport-replaced fallback branch in the new shared transport helper has no coverage at all.

None of this should block merge. Build and the full affected-package test suite pass, lint is clean on every touched file (two pre-existing gci failures in pkg/authserver predate this branch and are unrelated to this diff), and the change stays well inside the repo's PR-size budget.

Documentation

• pkg/vmcp/session/internal/backend/mcp_session.go:85-97 — WithDialControl's caveat doc drops the OWASP SSRF Prevention Cheat Sheet citation and the "no per-request re-classification" sentence present in pkg/vmcp/client.WithDialControl (see inline comment for a suggested fix).
• pkg/networking/http_client.go:151-153 — CloneDefaultTransportWithDialControl's doc names vMCP specifically inside a generic, dependency-free package (see inline comment for a suggested rewording).

---

Generated with Claude Code

[jhrozek]

Reviewed with parallel code-quality, security, and architecture passes.

Clean, well-scoped refactor: centralizes backend HTTP transport construction (previously duplicated between pkg/vmcp/client and pkg/vmcp/session/internal/backend) into networking.CloneDefaultTransportWithDialControl, and threads an optional dial-control hook through the vMCP session factory. Constants preserved exactly, option-application order is correct, and the new tests actually assert the hook fires rather than just checking for an error.

One thing worth tracking as a follow-up (non-blocking): the new WithDialControl option isn't wired to any real policy in production yet (no caller in serve.go passes it), same as the existing client-side WithDialControl from #5551. Not a regression, just worth an issue so the SSRF-blocking policy actually gets connected at some point.

Approving.

[tgrunnagle]

Thanks for the review! Opened #6564 to track wiring a private-address dial-control policy into the production serve.go call sites for both this session-factory option and the existing client-side WithDialControl (#5551), gated by a config toggle.