Module connect 

HTTP CONNECT tunnel handler (Mode 1 — Host Filtering).

Handles CONNECT host:port HTTP/1.1 requests by:

1. Validating the session token
2. Checking the host against the filter (cloud metadata deny list, then allowlist)
3. Establishing a TCP connection to the upstream
4. Returning 200 Connection Established
5. Relaying bytes bidirectionally (transparent TLS tunnel)

The proxy never terminates TLS — it just passes encrypted bytes through. Streaming (SSE, MCP Streamable HTTP, A2A) works transparently.

Functions

handle_connect

Handle an HTTP CONNECT request.