DialectOS: Cursor rule for Windsurf

.windsurfrules

windsurfrules is a cursor rule for Windsurf from KyaniteLabs/DialectOS. It costs 507 tokens per session, scanned A, a copy of cursorrules, Apache-2.0.

A set of repository rules for AI coding agents, covering code organisation, formatting, security, testing, Git, and pull requests. Git is the version-control system used to track code changes.

In plain words
What is it for?
Use it to guide issue-based changes, linting and formatting, secret and input handling, unhappy-path tests, commit messages, pull requests, and protected branches.
Why use it?
It gives agents consistent project expectations and helps prevent unsafe code, weak tests, unreviewed changes, and poor branch hygiene.

Cursor rule for Windsurf

Written for Windsurf: a Windsurf rule.

This is KyaniteLabs/DialectOS's own configuration. It tells Windsurf how to work on DialectOS itself, so it is not a mod to install elsewhere. Copy it as a starting point and replace the rules that are about this project. Everything DialectOS configures →

Reuse

Borrowing it

Nothing to install: this file belongs to KyaniteLabs/DialectOS. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.

Copy the file
curl -O https://raw.githubusercontent.com/KyaniteLabs/DialectOS/main/.windsurfrules
Clone the repo
git clone --depth 1 https://github.com/KyaniteLabs/DialectOS

Made for: Windsurf.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for windsurfrules

README.md
[![agentmods](https://agentmods.dev/badge/rules/kyanitelabs/dialectos/windsurfrules.svg)](https://agentmods.dev/rules/kyanitelabs/dialectos/windsurfrules)
Your own site
<a href="https://agentmods.dev/rules/kyanitelabs/dialectos/windsurfrules"><img src="https://agentmods.dev/badge/rules/kyanitelabs/dialectos/windsurfrules.svg" alt="Measured on agentmods" height="20"></a>
Per session 507 This file is loaded in full into every session.
When invoked 507 The same file — it is already loaded in full.
Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.
Origin 100% copy Near-identical to another mod in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00507 $0.00507
Opus 5 $0.00253 $0.00253
Sonnet 5 $0.00101 $0.00101
Haiku 4.5 $0.00051 $0.00051

Measured today against content hash 30e9ecb2fdee, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-07, from the pricing page.

Security

Grade A, and why

windsurfrules scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured today.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

Origin

This is a copy

100% identical to cursorrules — 0 lines differ, which has more behind it and is treated as the original. This page carries a canonical link to it rather than competing with it.

.windsurfrules · 60 lines

How it starts

The opening of the file, as written. The whole thing — 60 lines — stays where its author put it; the contents beside it link to each section on GitHub.

KyaniteLabs — AI Agent Instructions

Organization

  • Org: KyaniteLabs, owner: simongonzalezdc
  • All repos use issue-driven development — contributions enter as GitHub issues, not direct PRs
  • Pipeline runs every 30 min: triage → fix → review → merge
  • All main/master branches are protected (no direct push, CI required)

Code Quality

  • Formatter: ruff (Python), prettier (JS/TS)
  • Linter: ruff (Python), eslint (JS/TS)
  • Config: pyproject.toml (Python), pnpm (Node)
  • Pin exact dependency versions
  • No orphaned code — every function called, every file imported
  • No commented-out code blocks

Security

  • No shell=True with user input
  • No hardcoded secrets/tokens/API keys
  • Validate file paths (no path traversal)
  • Use HTTPS for external calls
  • Parameterized queries for databases

Testing

  • Test behavior, not implementation
  • Test the unhappy path (API down, file missing, bad input)
  • Integration tests over mocks for external systems
  • One assertion per concept

Git

  • Commits tell why, not what
  • PRs under 400 lines
  • Rebase, don't merge on feature branches
  • Never skip CI

Git Workspace Hygiene

  • Delete feature branches after merge — no stale branches
  • Remove worktrees when done — no orphaned worktrees
  • Prune stale remote references (git remote prune origin)
  • Clean working directory when task is done (git status clean)
  • Delete abandoned branches — don't leave dead work behind
  • Main branch is the only permanent artifact — everything else is temporary

Epoch Data Tracking

  • Use Epoch for time estimation before starting tasks (MCP, REST API, or CLI)
  • Record actual time after completing tasks (record_actual)
  • Every project feeds data to Epoch — it's how the system learns
  • Epoch only works if everyone contributes estimate-vs-actual data

Local LLM

  • Use local inference at localhost:1234 before cloud APIs
  • Check loaded models first, don't touch models you didn't load
  • Unload when done
  • CPU thread pool: 10, flash attention: on, KV cache: Q8

Read the full file on GitHub · 60 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. today First seen · 60 lines · 507 tokens per session scan A 30e9ecb2fdee

Subscribe to this mod's changes

windsurfrules is a cursor rule published in the GitHub repository KyaniteLabs/DialectOS (4 stars, last pushed yesterday), licensed Apache-2.0. It adds 507 tokens to every session, about $0.0025 per session on Opus 5. A static security scan graded it A with 0 findings. It is 100% identical to cursorrules, differing in 0 lines, and is treated as a copy.