migrate-app-to-flows
MUST be used when migrating a legacy Dune app to the new Flows app hosting infrastructure. Orchestrates the full migration: audits current state, updates app.json to appsApi infra, delegates auth wiring to setup-flows-auth, creates or updates manifest.json network permissions, and updates deploy scripts to @cognite/cli. Use this whenever a user says 'migrate to Flows', 'migrate to new infra', 'move from dune to flows', 'migrate legacy app', or wants to move their existing app to the new Flows ap
Security Assessment
About migrate-app-to-flows
This skill orchestrates the migration of a legacy Cognite Dune application to the newer Flows app hosting infrastructure (appsApi). It solves a multi-step, error-prone migration by walking through each area in order and skipping anything already in the correct state. It triggers on requests like 'migrate to Flows', 'move from dune to flows', or 'migrate legacy app', and is scoped to a defined set of tools (Read, Glob, Grep, Edit, Write, Bash).
The workflow starts with an audit that reads app.json, package.json, vite.config.ts, and manifest.json and reports a concise before-state summary. It then updates app.json to use the appsApi infra value and fixes the legacy singular 'deployment' object into the required plural 'deployments' array. It delegates all authentication wiring to a companion setup-flows-auth skill, then creates or updates manifest.json to declare a Content Security Policy: it greps the source for outbound calls (fetch, axios, XMLHttpRequest) and populates network permissions with proper origin sources and CSP directives, flagging dynamic URLs for manual review. Finally it rewrites deploy scripts from the old Dune commands to '@cognite/cli' and runs a final grep to surface any lingering Dune references, ending with a completion report and next steps.
It targets Cognite platform developers maintaining Dune-era apps who need to move to Flows hosting. Use cases include one-shot migrations of proof-of-concept apps, standardizing deployment configuration across a team's apps, and ensuring network permissions are correctly declared for the Flows CSP. The Bash usage is limited to read-only grep scans and standard CLI deploy commands, not destructive operations.
FAQ
What does the migration change?
It sets app.json's infra to 'appsApi' (converting a legacy 'deployment' object to a 'deployments' array), runs setup-flows-auth for auth wiring, creates or updates manifest.json network permissions, and updates deploy scripts to use @cognite/cli.
Does it modify things it doesn't need to?
No. It audits current state first and skips any area already in the correct state, and it preserves non-deploy scripts like start, build, and test unchanged.
How are network permissions determined?
It greps the src directory for fetch, axios, and XMLHttpRequest usage, then adds each external origin to the manifest's network array with appropriate CSP directives (connect-src, img-src, font-src). The CDF cluster URL is allowed automatically.
What handles the authentication part?
The skill delegates all auth-related work (package installation, Vite plugin updates, entry file changes, and connectToHostApp wiring) to a separate setup-flows-auth skill.
What should I do after migration?
Run the dev server, verify the app loads and CDF data appears in Fusion, and when satisfied deploy with 'npx @cognite/cli@latest apps deploy --interactive'. Any remaining Dune references flagged by the final grep should be resolved.
Install migrate-app-to-flows
Quick Setup:
- Copy the skill folder to
.claude/skills/ - Claude will automatically detect and use the skill
Repository
cognitedata/builder-skills