v0.8.4: WebUI sessions, diff, settings, slash commands and extensions

Sessions: rename, delete and search; /api/retry regenerates the last
answer, editing a prompt resends from there; /api/export downloads the
transcript as Markdown (cst_session_export_md). Session messages carry
note/tool_result markers, so a reload rebuilds the tool steps with
their arguments, output and exit status; subagent progress is shown.

Diff and settings: /api/diff shows the real diff; /api/settings covers
protocol, max_steps, tool switches and confirm; /api/permissions edits
the rules; sandbox status is reported. Session rename no longer reads
past a short title.

Commands: slash commands with completion in the composer (/model,
/provider, /new, /retry, /undo, /compact, /export, /diff, /init,
/skill and more), a Ctrl+P palette, Shift+Tab cycles the approval
mode, F1 or ? shows the keys. "Thinking expanded" is saved in the
settings (show_thinking), "expand all tool output" in the browser.

Extensions: GET /api/extensions lists MCP servers, plugins, skills,
agent roles and subagent runs; POST /api/extensions/reload and
/api/extensions/trust; a workspace switch reloads them. /api/init and
/api/skill run on the server (cst_init_prompt shared with the TUI).

Errors, statuses and [cst] notes are shown in Chinese with a readable
reason instead of rc=; a failed turn's error survives the reload.

Tests: scripts/e2e_webui_sessions.py, e2e_webui_workspace.py and
e2e_webui_ext.py, run from e2e_webui.sh.

web/index.html

@@ -69,6 +69,7 @@
         <svg class="i"><use href="#i-refresh"/></svg>
       </button>
     </div>
+    <input id="sess-search" class="sess-search" type="search" placeholder="搜索会话" autocomplete="off">
     <div id="sessions-list" class="sessions"></div>
 
     <div class="side-foot">
@@ -133,6 +134,11 @@
 
     <footer id="composer">
       <div id="pending" class="pending" hidden></div>
+      <div id="edit-bar" class="edit-bar" hidden>
+        <span>编辑上一条消息：发送后替换它并重新回答（文件改动保留，需要时先撤销）</span>
+        <span class="grow"></span>
+        <button id="btn-edit-cancel" class="link">取消</button>
+      </div>
 
       <!-- permission gate: inline, the turn really is waiting on it -->
       <div id="gate" class="gate" hidden>
@@ -146,8 +152,9 @@
         <div class="gate-row" id="gate-buttons"></div>
       </div>
 
+      <div id="slash" class="slash" role="listbox" hidden></div>
       <div class="box">
-        <textarea id="input" rows="1" placeholder="给 CST-Agent 派个任务…"></textarea>
+        <textarea id="input" rows="1" placeholder="给 CST-Agent 派个任务…（/ 打开命令，F1 看快捷键）"></textarea>
         <div class="box-row">
           <button id="btn-plus" class="icon att" title="添加图片或计划模式">
             <svg class="i"><use href="#i-plus"/></svg>
@@ -191,7 +198,8 @@
     </section>
 
     <section class="card" id="card-files">
-      <h4>文件改动 <span class="badge" id="files-count">0</span></h4>
+      <h4>文件改动 <span class="badge" id="files-count">0</span>
+        <span class="grow"></span><button id="btn-diff" class="link" title="git status + git diff">查看 diff</button></h4>
       <div id="files-body" class="muted">本轮还没有改动文件。</div>
     </section>