chore: upgrade dependencies and clear npm audit

- @modelcontextprotocol/sdk 1.26 -> 1.30 (hono/node-server 2.1.0).

- @typescript-eslint/* and typescript-eslint 8.55 -> 8.66.

- npm audit now reports 0 vulnerabilities (was 21: 2 critical, 15 high).

- Add ConfigOverrides type so partial output overrides are typed instead of cast.

- Remove unnecessary type assertions flagged by the upgraded linter; build, lint and 205 tests pass.

package.json

@@ -42,7 +42,7 @@
   },
   "dependencies": {
     "@anthropic-ai/sdk": "^0.74.0",
-    "@modelcontextprotocol/sdk": "^1.26.0",
+    "@modelcontextprotocol/sdk": "^1.30.0",
     "chalk": "^5.4.1",
     "cli-table3": "^0.6.5",
     "commander": "^14.0.3",
@@ -59,14 +59,14 @@
   },
   "devDependencies": {
     "@types/node": "^22.0.0",
-    "@typescript-eslint/eslint-plugin": "^8.0.0",
-    "@typescript-eslint/parser": "^8.0.0",
+    "@typescript-eslint/eslint-plugin": "^8.66.0",
+    "@typescript-eslint/parser": "^8.66.0",
     "@vitest/coverage-v8": "^3.2.4",
     "eslint": "^9.0.0",
     "eslint-config-prettier": "^10.0.0",
     "prettier": "^3.5.0",
     "typescript": "^5.7.0",
-    "typescript-eslint": "^8.55.0",
+    "typescript-eslint": "^8.66.0",
     "vitest": "^3.0.0"
   },
   "files": [

src/cli/commands/config.ts

@@ -111,9 +111,7 @@ ${t('cli_examples')}
 async function showConfig(projectPath: string): Promise<void> {
   const config = await loadConfig(projectPath);
   console.log(chalk.bold.cyan(`\n${t('config_current')}\n`));
-  console.log(
-    chalk.gray(JSON.stringify(redactApiKey(config as unknown as Record<string, unknown>), null, 2))
-  );
+  console.log(chalk.gray(JSON.stringify(redactApiKey(config), null, 2)));
 }
 
 async function initConfig(projectPath: string): Promise<void> {

src/config/index.ts

@@ -25,6 +25,11 @@ const CONFIG_SEARCH_PLACES = [
   `${MODULE_NAME}.config.mjs`,
 ];
 
+/** CLI overrides allow partial nested output settings. */
+export type ConfigOverrides = Partial<Omit<Config, 'output'>> & {
+  output?: Partial<Config['output']>;
+};
+
 /**
  * Load configuration file
  * Search order: project path upward -> global ~/.fuckucoderc.json
@@ -277,7 +282,7 @@ export function loadAIConfig(configAI?: Config['ai'], cliModel?: string): AIConf
 export function createRuntimeConfig(
   projectPath: string,
   config: Config,
-  cliOptions: Partial<Config> = {}
+  cliOptions: ConfigOverrides = {}
 ): RuntimeConfig {
   const merged = mergeConfig(config, cliOptions);
   const aiConfig = merged.ai.enabled ? loadAIConfig(merged.ai, merged.ai.model) : undefined;
@@ -292,7 +297,7 @@ export function createRuntimeConfig(
 /**
  * Merge configurations
  */
-function mergeConfig(base: Config, override: Partial<Config>): Config {
+function mergeConfig(base: Config, override: ConfigOverrides): Config {
   return {
     ...base,
     ...override,

src/mcp/server.ts

@@ -11,7 +11,12 @@ import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js'
 import { z } from 'zod';
 import { resolve } from 'node:path';
 import { createAnalyzer } from '../analyzer/index.js';
-import { loadConfig, createRuntimeConfig, loadAIConfig } from '../config/index.js';
+import {
+  loadConfig,
+  createRuntimeConfig,
+  loadAIConfig,
+  type ConfigOverrides,
+} from '../config/index.js';
 import { createAIManager } from '../ai/index.js';
 import { MarkdownOutput } from '../cli/output/markdown.js';
 import { JsonOutput } from '../cli/output/json.js';
@@ -38,9 +43,9 @@ async function buildRuntimeConfig(
 
   const config = await loadConfig(projectPath);
   // mergeConfig spreads nested objects, so partial output fields are safe at runtime
-  const overrides: Partial<import('../config/schema.js').Config> = { verbose: options.verbose };
+  const overrides: ConfigOverrides = { verbose: options.verbose };
   if (options.top !== undefined) {
-    overrides.output = { top: options.top } as import('../config/schema.js').Config['output'];
+    overrides.output = { top: options.top };
   }
   return createRuntimeConfig(projectPath, config, overrides);
 }
@@ -134,7 +139,7 @@ server.registerTool(
   },
   async ({ path: projectPath, model, provider, baseUrl, apiKey, top, locale, verbose }) => {
     const resolvedPath = resolve(projectPath);
-    setLocale(locale as Locale);
+    setLocale(locale);
 
     const config = await loadConfig(resolvedPath);
     const runtimeConfig = createRuntimeConfig(resolvedPath, config, {