.windsurfrules guide

Stop writing .windsurfrules
from scratch.

What a production-ready Windsurf (now Devin Desktop) rules file covers for frontend, backend, SaaS, DevOps, mobile, AI/ML and security work — with a free example to copy. Brainfile itself is built for Claude Code, not Windsurf.

Free by email: a practical Claude Code tip every Tuesday and Thursday, plus a Sunday recap.

Drop-in ready Free example below 30-day guarantee 8 roles outlined

Writing .windsurfrules from scratch is the slowest part of onboarding Windsurf

Every developer who installs Windsurf faces the same friction: the default AI behavior is generic, and creating a proper .windsurfrules file from scratch takes longer than the first project milestone. Most devs never write one at all.

🔁

Windsurf doesn't know your stack

Without a strong rules file, the agent in Windsurf (now Devin Desktop, whose local agent Devin Local replaced Cascade) keeps making generic assumptions — suggesting patterns that don't fit your architecture, missing your team's naming conventions, and generating scaffolding you immediately rewrite.

⏳

You re-explain your context every session

You type the same context into every agent chat: "I use Next.js, TypeScript, Prisma, deployed on Railway..." A good .windsurfrules file encodes this once and persists it across every session. Most developers never write one.

📉

Rule files are easy to get wrong

Devin Desktop reads rules from .devin/rules/ (preferred), .windsurf/rules/ and the legacy .windsurfrules file, plus AGENTS.md. Put a rule in the wrong place or with the wrong trigger and it never loads when you expect it to.

What a battle-tested .windsurfrules looks like

Start from a structure written for how the agent actually reads rules instead of a blank file. The example below is free to copy. Fill in your stack, database and deploy target, and your Windsurf session understands who you are, what you're building, and how you write code.

⚡

Correct Windsurf syntax, every time

The example uses the documented rule front matter with description, globs, and alwaysApply fields — no guessing, no silent parse failures, no wasted context.

🔧

Role-aware from the first line

Write it for your specific engineering role. A frontend file should encode component architecture and CSS-in-JS conventions. A SaaS file should cover multi-tenancy patterns and billing edge cases. Generic rules don't change the agent's behavior — role-specific ones do.

🔄

Review it when the editor changes

The editor changes often: in June 2026 Windsurf became Devin Desktop and Devin Local replaced Cascade (see the Devin Desktop FAQ). Re-check your rules file when it changes, so it never falls behind the editor it's supposed to be controlling. (Brainfile's weekly freshness feed covers Claude Code, not Windsurf.)

.windsurfrules — Backend Engineer configuration (excerpt)
--- description: Rules for a backend engineer working on Node.js/TypeScript REST APIs globs: - src/**/*.ts - test/**/*.ts alwaysApply: true --- # Role: Backend Engineer # Stack: Node.js 20 + TypeScript + Express + Prisma # Database: PostgreSQL · Deploy: Railway ## API Design - RESTful resource naming: plural nouns, kebab-case paths (/api/v1/user-profiles) - All endpoints return { data, error, meta } envelope — never naked objects - Error objects must include: code (machine-readable), message (human-readable), status - Versioning via URL prefix (/api/v1/). Breaking changes require a new version. ## Database Conventions - Prisma models use PascalCase, fields use camelCase, DB columns use snake_case - Every migration must be reversible — write the down migration first - Never use findFirst without an orderBy clause — non-deterministic results in prod - Soft deletes on all user-owned records: deletedAt timestamp, never hard delete ## Error Handling - All async route handlers wrapped in asyncHandler() — no unhandled promise rejections - Operational errors (4xx) caught and formatted. Programming errors (5xx) crash and restart. - Validation at the boundary with Zod — never trust req.body downstream ## Testing - Integration tests over unit tests for routes — test the full request/response cycle - Use a separate test database seeded per-test — no shared state between test runs

What a .windsurfrules should cover, by role

Eight engineering roles and the conventions, patterns and guardrails each file should encode. Use them as a checklist when you write yours — specific instructions that change how the agent behaves in your codebase.

🎨

Frontend Engineer

  • React / TypeScript component architecture, naming conventions, and file co-location
  • Accessibility rules: ARIA labels, keyboard navigation, focus management patterns
  • Performance guardrails: memo boundaries, lazy loading, bundle split points
Build a free starter file →
⚙️

Backend Engineer

  • Node.js / Python service structure and error handling with proper envelope format
  • Database conventions: migration hygiene, query optimization, indexing rules
  • RESTful API design, versioning strategy, and Zod validation at the boundary
Build a free starter file →
🚀

SaaS Founder

  • Multi-tenant data isolation: row-level security, org-scoped queries, never cross-tenant
  • Stripe subscription management, webhook idempotency, billing edge cases
  • Auth patterns: JWT / session strategy, invite flows, org-level permission checks
Build a free starter file →
🛠️

DevOps Engineer

  • CI/CD pipeline conventions, GitHub Actions patterns, rollback and canary strategy
  • Infrastructure-as-code: Terraform / Pulumi module structure, naming, and state hygiene
  • Security hardening: secrets management, least-privilege IAM, audit trail requirements
Build a free starter file →
📱

Mobile Developer

  • React Native / Swift / Kotlin platform-specific conventions and navigation patterns
  • Performance rules: FlatList vs ScrollView, Hermes engine config, re-render guards
  • Offline-first architecture: local state sync, conflict resolution, optimistic UI patterns
Build a free starter file →
🧠

AI / ML Engineer

  • PyTorch / JAX training loop conventions and reproducibility standards (seeds, determinism)
  • Experiment tracking: MLflow / W&B run naming, artifact versioning, metric logging hygiene
  • Data validation rules: distribution drift detection, leakage guards, evaluation protocols
Build a free starter file →
🔒

Security Engineer

  • OWASP Top 10 guardrails baked in: no raw SQL, no user-controlled redirects, no eval()
  • Secret management rules: no hardcoded credentials, env var naming standards, vault patterns
  • Input validation and output encoding conventions: parameterized queries, CSP headers, CORS policy
Build a free starter file →
🔗

Full-Stack Developer

  • Monorepo structure: shared packages, workspace boundaries, type sharing across layers
  • API contract patterns: tRPC / OpenAPI schema-first with end-to-end type safety
  • Feature flag and environment config strategy that spans frontend and backend consistently
Build a free starter file →

Three steps from zero to a Windsurf that knows your codebase

Pick the role checklist that fits, write the file with your stack, and the agent starts from how you build.

1

Pick your role checklist

Use the role list above that matches how you actually work: frontend, backend, SaaS, DevOps, mobile, AI/ML, security, or full-stack.

→
2

Add your stack in 3 lines

Fill in your framework, your database, and your deploy target, then write the conventions, patterns and guardrails your role cares about.

→
3

Drop into Windsurf → done

Save as .windsurfrules in your project root (or .devin/rules/, the location Devin Desktop now prefers). It is read automatically every session. No extra config, no API keys, no restart required.

Where Brainfile fits

Brainfile is built for Claude Code, not Windsurf. It ships no .windsurfrules files. If you also use Claude Code, here is what it adds there.

Category ✦ Brainfile (Claude Code) Write your own
What it ships CLAUDE.md, .claude/rules/ and brain/ files, plus the Autopilot protocol The rules file you write for Windsurf
Staying current A weekly freshness feed for Claude Code changes Manual — you research and update yourself
Role setup 15 role packs on Pro, including Software Developer and DevOps Your one role
Windsurf support None — Brainfile ships no Windsurf format Native

Why Windsurf rules need their own format

Windsurf, now Devin Desktop, is not just a re-skinned Cursor. Its agent operates differently from Cursor's, and the rules format reflects that. Write Windsurf rules for Windsurf — don't just port a .cursorrules file.

📐

Windsurf-native format

Devin Desktop's directory rules (.devin/rules/, .windsurf/rules/) take front matter with description, globs, and alwaysApply fields before the markdown content. Get the trigger wrong and the rule does not load when you expect it to.

🌊

Agent-aware instructions

Devin Desktop's agent takes multi-step actions — it's not just autocomplete. Rules for an agent need to say how to sequence tasks, when to ask before acting, and how to handle partial completions.

Also using Claude Code?

Your Claude Code should know how you code.
Not the other way around.

Brainfile for Claude Code: the Autopilot protocol, 10 pattern files and a weekly freshness feed. Pro adds 15 role packs. Start free — 30 days, no card.

$99 /month

30-day money-back guarantee · Instant access · Cancel anytime

Need a team setup? Enterprise — contact us →

Not ready to buy? Stay in the loop.

New Windsurf and Devin Desktop rule configurations, agent tips, and AI context updates. Free: a Claude Code tip every Tuesday and Thursday, plus a Sunday recap.

No spam. Unsubscribe anytime.