…lity (#645)

- Fixes moderate severity Prototype Pollution in parseBody (GHSA advisory)
- Non-breaking patch update via npm audit fix

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

* feat: add Sub-Agent creation dialog with browse and create flow

- Add SubAgentCreationDialog for browsing existing .claude/commands
- Add SubAgentFormDialog for creating new Sub-Agent nodes
- Add command-browser-service and command-operations
- Move "Create New" buttons next to filter input in both SubAgent and Skill dialogs
- Change SubAgent dialog title to "Browse Sub-Agent"
- Set default model to "Inherit" for new Sub-Agent creation
- Add i18n translations for all Sub-Agent dialog strings (en/ja/ko/zh-CN/zh-TW)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* feat: defer sub-agent file creation until user accepts in DiffPreviewDialog

- Split autoCreateSubAgentFiles into planSubAgentFiles + executeSubAgentFileCreation
- Add PlannedSubAgentFile type and pass plannedFiles through MCP payload
- Show "Files to be created" section in DiffPreviewDialog with file paths
- Add schema fields (commandFilePath, commandScope, agentType, aiGenerationGuidance)
- Add commandScope validation and export-service reference model support

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

- Updated undici to resolve 6 security advisories (CRLF injection, request smuggling, WebSocket overflow, memory consumption)

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Release: v3.28.0

## [3.28.0](v3.27.1...v3.28.0) (2026-03-16)

### Features

* add Sub-Agent creation dialog with deferred file creation ([#646](#646)) ([f6d8b9f](f6d8b9f))