Lossless Context Management

Although this is a migration CLI rather than an MCP server, the command uses the mutable @latest tag, allowing npx to download and execute a package version that has not necessarily been reviewed. A compromised release could execute code with the operator's permissions and access sensitive conversation data; the documented dry-run behavior does not sandbox package execution.

The apply command independently resolves @latest, so it can execute an unreviewed or compromised release and could even resolve a different version from the preceding dry run. User confirmation and the documented SQLite backup reduce accidental migration risk, but do not prevent malicious package execution, conversation exfiltration, or unauthorized modification.