Home › Rules › Windsurf rules

Windsurf rules examples: copy-paste rules for Windsurf (now Devin Desktop)

Based on the Devin Desktop and Devin CLI docs, checked Oct 20, 2026. Sources below.

Formats
Windsurf
Devin Desktop

Short answer: Windsurf was renamed Devin Desktop on June 2, 2026, and its agent is now Devin Local (the old Cascade agent was removed in the September 8, 2026 update). Your rules still work. The simplest setup is one AGENTS.md file in your project's root folder, which is always on. For rules that should only apply sometimes, add one file per rule in .devin/rules/ with a trigger line at the top. Old .windsurf/rules/ folders and the single .windsurfrules file are still read. Below are 7 examples you can copy.

Where Windsurf rules go now

File	Where	When it applies
`AGENTS.md` (recommended)	Project root, or any subfolder	Root: always on. Subfolder: only when the agent works on files in that folder
One rule per file	`.devin/rules/*.md`	Depends on its `trigger` (table below)
Old Windsurf rules folder	`.windsurf/rules/*.md`	Still read, same `trigger` format. Files in both folders are loaded; `.devin/rules/` is the preferred place for new rules
Old single file	`.windsurfrules` in the root	Still read, always on
Personal, not shared	`AGENTS.local.md` next to `AGENTS.md`	Always on. Add it to `.gitignore`
Every project on your computer	`~/.config/devin/AGENTS.md` (Windows: `%APPDATA%\devin\AGENTS.md`), or `~/.devin/global_rules.md`	Always on

Devin Local reads rules through the Devin CLI rules system (Devin's docs say so), so the Devin CLI docs apply to it too. That's where the AGENTS.local.md and global paths above come from. The same agent also reads CLAUDE.md and Cursor's .cursor/rules/*.mdc files, so if you already wrote rules for another tool, you may not need to copy them over.

The 4 trigger types

Every file in .devin/rules/ (or .windsurf/rules/) starts with a short header between two --- lines that says when the rule turns on:

`trigger:`	What happens	Good for
`always_on`	The whole rule is sent with every message	A few short rules that always matter
`model_decision`	Only the `description` is sent; the agent reads the full rule when your task matches it	Longer guides, like database or payments rules
`glob`	Turns on when the agent reads or edits files matching `globs`, like `src/*/.ts`	Rules for tests, components or one folder
`manual`	Off until you type `@rule-name` in the chat	Checklists you run now and then

The Devin CLI docs also list an agent trigger value. The four above are the ones the Devin Desktop docs explain.

7 Windsurf rules examples

1. A starter AGENTS.md for a beginner web app (always on)

AGENTS.md (project root)

# Project
A habit tracker web app for beginners. Next.js (App Router), TypeScript, Tailwind CSS, Supabase for the database and login.

# How to work with me
- I'm new to coding. Explain what you're about to change in plain English before you change it.
- Work in small steps. After each step, tell me exactly how to test it in the browser.
- Ask before changing the database, login, or anything to do with payments.
- Explain errors in plain English before fixing them.

# Code rules
- Reuse components in src/components before making new ones.
- Tailwind classes only. No inline styles.
- Never put secret keys in front-end code. Only NEXT_PUBLIC_ variables may be used in the browser.

# Commands
- Run locally: npm run dev
- Check before you say you're done: npm run lint and npm run build

No header needed: a root AGENTS.md is always on. Swap the first two lines for your own project and stack. Cursor, Codex and GitHub Copilot's agent read AGENTS.md too, so this one file covers several tools.

2. Ask before touching the database (model_decision)

.devin/rules/database.md

---
trigger: model_decision
description: Rules for any change to the database, migrations, row-level security or login. Use before editing anything in supabase/ or touching tables.
---

Before any database change:
1. Explain the change in plain English and what could break.
2. Show me the migration before running it. Wait for my OK.
3. Never turn off row-level security.
4. Never drop a table or column without asking twice.
5. Afterwards, tell me how to check my existing data is still there.

Only the description sits in the agent's context until a task needs it, so a long rule like this costs little the rest of the time. Write the description in the words you'd actually use.

3. Test files (glob)

.devin/rules/tests.md

---
trigger: glob
globs: "**/*.test.ts, **/*.test.tsx"
---

- Use describe and it blocks, one behavior per test.
- Mock calls to outside APIs and Supabase. Tests must not need the internet.
- Name tests in plain English: it("shows an error when the email is empty").
- After changing a test, run npm test and show me the result.

Separate several patterns with commas, and wrap them in quotes so a pattern starting with * doesn't break the header.

4. UI and components (glob, grouped with XML tags)

.devin/rules/ui.md

---
trigger: glob
globs: "src/components/**, src/app/**"
---

<ui_rules>
- Mobile first: every layout must work at 375px wide.
- Reuse Button, Card and Input from src/components/ui before creating new ones.
- Use the brand colors from tailwind.config only.
- Every button and link needs a visible focus style.
- Images need alt text.
</ui_rules>

Windsurf's docs suggest bullet points and, for related rules, XML-style tags like <ui_rules> to group them.

5. Pre-launch checklist (manual)

.devin/rules/launch-checklist.md

---
trigger: manual
description: Pre-launch checklist. Only when I type @launch-checklist.
---

Go through this list one item at a time and tell me pass or fail for each:
1. No secret keys in front-end code or committed .env files.
2. Row-level security is on for every table that holds user data.
3. Every page has a title and meta description.
4. Forms show a clear error when something goes wrong.
5. The site works on a phone-sized screen.
6. npm run build finishes with no errors.
Don't fix anything until I say which items to fix.

Type @launch-checklist when you're ready to ship. For the full list of things to check, see the vibe coding security checklist.

6. Your global rules (every project)

~/.config/devin/AGENTS.md

# My rules for every project
- I'm a beginner. Use plain English and explain new terms the first time.
- Make the smallest change that works. Don't refactor code I didn't ask about.
- Never delete files or run commands that remove data without asking me first.
- When you finish, list what you changed and how I can check it.

Use this for how you like to work, not for anything about one project.

7. Personal rules you don't commit (AGENTS.local.md)

AGENTS.local.md (add to .gitignore)

# My personal rules (not shared)
- Show me the plan before writing code, every time.
- Run the tests before you tell me a task is done.

Still have a .windsurfrules file?

It keeps working: Devin Local reads .windsurfrules as an always-on rule. If you want one file that every AI coding tool reads, rename it to AGENTS.md. If part of it only matters sometimes (database rules, test rules), move that part into its own file in .devin/rules/ with a model_decision or glob trigger, so it stops filling every message.

Tips from the docs

Keep rules short and specific. "Use pnpm" beats "use the right package manager". Long or vague rules get followed less.
Skip generic rules like "write good code". The agent already does its best at that; your rules should say what's special about your project.
Use lists, not paragraphs. Bullet points and numbered steps are easier for the agent to follow.
Mind the size limit. The Devin Desktop docs cap each workspace rule file at 12,000 characters.
Turn repeated steps into skills. The Devin CLI docs recommend skills over long rules, because skills load only when they're needed. See 7 SKILL.md examples.

Best value

Get all 5 kits for $25 with 30% off: code WELCOME30 at checkout (through Nov 30, 2026)

Rules tell the agent how to code. The kits tell it what to build and in what order, with copy-paste prompts and stop-and-test checkpoints: a small game, a Discord bot, an email-triage agent, an MVP, or a cleanup of messy code.

Get all 5 kits for $25 → See what's in each kit

$25 instead of $39 for the five kits bought separately; WELCOME30 takes 30% off that at checkout ($17.50). Instant download from Gumroad. 7-day refund, no questions asked.

Cursor rules examples (10 copy-paste .mdc rules)
CLAUDE.md examples and best practices
AGENTS.md vs CLAUDE.md
Every rules file format
Free rules file generator (writes an AGENTS.md for your project type)

Sources

Checked Oct 20, 2026. These tools change often; if something here no longer matches, tell us at [email protected].