http_replay: make request_id optional (allow a direct target without a prior captured request)

[Serhatcck]

Summary

In both http_replay and http_replay_raw, request_id is currently the single required parameter — it has no .optional() in the zod schema, so every replay must originate from a request the crawl/proxy already captured.

• src/tool/http-replay.ts:333 — request_id: z.string() (required)
• src/tool/http-replay.ts:572-574 — same for http_replay_raw

Motivation

Requiring a captured request_id means the tool cannot send a request the session has not already captured — e.g. a hand-constructed probe, a follow-up endpoint discovered by reasoning, or a target the crawler missed. Today the only escape hatch (webfetch / bash) is being denied for vuln testers, so there is no way to hit an un-captured target through the governed engine.

Proposal

Make request_id optional and accept a direct target as an alternative, e.g.:

• http_replay: { target: { method, url, headers?, body? }, mutations? } when no request_id is given.
• http_replay_raw: allow { target_url, raw } without request_id.

Constraints to preserve

• Scope guard still applies: the resolved host must pass inScope(sessionID, host) (http-replay.ts:109) exactly as it does today — a direct target must NOT bypass the captured-host allowlist. (Open question: should a direct target be allowed only for already-captured hosts, or should there be a separate scope source?)
• Keep request_id as the primary path; target is the fallback.

Notes

Flagged during a review of the http_replay engine (PR #83/#86). Filed for discussion — there is a deliberate design reason the engine is "replay a captured request" (scope safety), so the trade-off between flexibility and the captured-only guarantee should be decided explicitly.