qemu+ssh:///session requires the parameter ?socket=/path/to/libvirtd/session/socket but that path could be automatically detected by checking the XDG_RUNTIME_DIR environment variable on the remote host, and defaulting to the appropriate value if it is unset. (See my other Bug #1241311 for an explanation of why I think it is useful to have good support for remote access to a QEMU session)
I'm planing to fix this issue for a long time now by using virsh to do the transport we are now using netcat for. Unfortunately I didn't have enough time to tackle that problem lately.
This is something I have work in progress to address.
This is merged for the next 6.8.0 release at the end of this month. f8ec7c842df9e40c6607eae9b0223766cb226336 rpc: use new virt-ssh-helper binary for remote tunnelling 6e4143c8510282a3070fe737af4b9ddb5b16fd58 rpc: switch order of args in virNetClientNewSSH dfad1b551dcd31a56e97931d23f3d20c58e4cd05 remote: introduce virt-ssh-helper binary 1ba30bc1e5889f3ae8ef1e0e2e94b48aaa03fa5a remote: extract logic for determining daemon to connect to 7ce887989a2e377aae15b4ad3f9ab93af0c56be2 remote: split out function for constructing socket path 3dfd0cbf250f7b2fc65f90402924ea678a310b08 remote: parse the remote transport string earlier 849de2b844ec53955a9900ffec25da626d1d86d9 remote: split out function for parsing URI scheme 9949d9b28faa61fc59a98962bd72d4dd240b1177 remote: split off enums into separate source file 5cd80b04d918c001587ba262cc4e44cd7a16b198 remote: push logic for default netcat binary into common helper 019b13dd2082e169ffe676b922ce475ae1f264e8 rpc: merge logic for generating remote SSH shell script Both client and server will need the new libvirt for this to work.