Rules: the invariants
Committed to the repository, shared with everyone, loaded by their trigger. Store rules belong here because they must hold for every future change, not only for today's task.
The goal: the same web app, two native apps
WebViewGold gives you a native Xcode project and an Android Studio project whose main screen loads your production URL in a WKWebView or Android WebView, plus native extras such as push notifications, an offline screen and the share sheet. Your Windsurf project stays the only codebase, and every deploy shows up in both apps.
The agent's job is to make the web app pass review as an app: mobile layout, legal pages, account deletion, no dead ends, and at least one native capability so the app is more than a website (Guideline 4.2). The tool-specific basics for this stack are on the Windsurf to App Store page.
A workspace rule that keeps every agent run store-safe
Save as .windsurf/rules/native-app.md if you still work with Cascade (older Windsurf or the JetBrains plugin), or as .devin/rules/native-app.md in Devin Desktop. Both use the same trigger front matter, and always_on loads the rule in every session. Windsurf capped rule files at 12,000 characters, so keep it lean.
markdown
---
trigger: always_on
---
# Native app context
- This project is published as iOS and Android apps with WebViewGold, which loads
https://app.example.com in a native WebView. Every deploy is live in both apps.
- There is no separate mobile codebase. Do not propose React Native, Flutter or Capacitor.
- Detect the app with isNativeApp() in src/lib/platform.ts (user agent contains
"MyAppNative", set in WebViewGold). No other user agent checks.
- Native features are URL schemes (registerpush://, shareapp://message?=TEXT&url=URL,
bioauth://, qrcode://). Look up the exact syntax in
https://www.webviewgold.com/llms-full.txt, call them only inside the app,
and keep a web fallback.
# Never
- Use a preview or *.windsurf.build URL as the app URL.
- Open OAuth in popups or new windows (the Social Login Helper handles Google).
- Sell digital goods through Stripe links inside the iOS app.
- Ship placeholder text, "coming soon" buttons or dead links.
# Always
- /privacy, /terms and an in-app Delete account (server-side) exist and work.
- Sign in with Apple appears wherever Google or another social login appears.
- Layout works at 320 px; fixed bars pad env(safe-area-inset-top/bottom);
tap targets are at least 44 px.
- Loading, empty and error states for every fetch.
Great work! Never coded anything but managed to work with this. Easy and fast! Also with great help from the creators!
Turn the readiness pass into a workflow or a skill
Cascade workflows are Markdown files in .windsurf/workflows/ that you start with a slash command named after the file; Cascade never runs one on its own. In Devin Desktop the same steps become a skill: a folder .devin/skills/store-readiness/ with this SKILL.md. Type /store-readiness, or the agent picks it up when your request matches the description. For a Cascade workflow, save the numbered steps as .windsurf/workflows/store-readiness.md with only a description in the front matter.
markdown
---
name: store-readiness
description: Audit and fix this web app for App Store and Google Play review before a WebViewGold build
---
1. Read the native-app rule. List the routes and the auth, payment and analytics code.
2. Mobile: open every main route in the Preview at 390 px and 320 px. Fix horizontal
overflow, tap targets under 44 px, inputs under 16 px font size and fixed bars
without safe-area padding.
3. Legal: make /privacy and /terms real (based on what the code collects) and link
them from the footer and the settings screen.
4. Accounts: if sign-up exists, add Delete account in settings (server-side deletion,
sign out, confirmation) and a public /delete-account page.
5. Sign-in: add Sign in with Apple next to any other social login.
6. States: loading, empty and error-with-retry for every fetch; a friendly 404.
7. App mode: hide store badges, install prompts and builder badges when isNativeApp().
8. Payments: list where digital goods are sold. Report only, change nothing.
9. Run lint, tests and build. Summarize the changes and what I must test on a phone.Rules, workflows, memories, AGENTS.md: what goes where
Workflows and skills: the procedures
Repeatable multi-step jobs such as this readiness pass, a release checklist or a rejection triage. Run them when you need them.
Memories: personal notes
Cascade creates memories on its own. They belong to the workspace they were made in and stay on your machine, so teammates and other tools never see them. Never rely on a memory for a store rule; ask the agent to write it into a rule.
AGENTS.md: the cross-tool file
Devin Desktop reads AGENTS.md at the root and in subfolders as always-on rules, and so do Cursor, Codex and GitHub Copilot. If you mix tools, put the native-app section there once (comparison of instruction files).
From Windsurf project to store submission
The same order works with Cascade and with Devin Local.
Add the rule and the skill
Commit both files. Start a new conversation and ask the agent to summarize the rules it follows; the native-app rule should be in the answer.
Run the readiness pass
Type /store-readiness (or the workflow name in Cascade). Review each change in the diff, check the routes in the Preview, then on your phone's browser.
Deploy for production on Netlify
Cascade's App Deploys publish to a
name.windsurf.buildaddress, are meant for previews, and write awindsurf_deployment.yamlwith the project details. For the app, claim the site into your own Netlify account or connect the Git repository to Netlify, then add your domain (why the domain matters). In Devin Desktop, deploy with Netlify directly, because App Deploys are not available to Devin Local.Configure WebViewGold
Config.swift:
host,webviewurl,useragent_iphone,useragent_ipad. Config.java:HOST,HOME_URL,USER_AGENT. Set the Social Login Helper triggers if you use Google login, and pick a push provider (OneSignal, Firebase or Pushwoosh) if you want notifications. The Android setup docs list every key.Build
With a Mac, archive in Xcode; build a signed App Bundle in Android Studio. If you would rather hand this part off, the Full Service team configures and builds both apps for you within 72 hours.
Submit and keep iterating
Have the agent draft the privacy policy, store description and review notes from the code; you submit. Web changes go live with each deploy, and only native shell changes need a new build.
Prompt: production deploy plus store pass
Use it if you prefer one guided run over the skill, or just for the deploy part. It stops after the Netlify setup so you can check the build first.
Paste into Cascade or Devin Local
We are publishing this web app as native iOS and Android apps with WebViewGold, which loads our production URL in a native WebView. Follow the native-app rule. Work in this order and stop for my confirmation after step 2. 1. Production build: make sure "npm run build" works from a clean checkout and document every environment variable in .env.example (names only, no values). 2. Netlify: add a netlify.toml with the build command and publish directory for this framework. If this is a single-page app, add a catch-all redirect to /index.html with status 200 so /privacy, /terms and /delete-account load directly. List the environment variables I must add in the Netlify dashboard. Do not use App Deploys for production. 3. Native helper: add src/lib/platform.ts with isNativeApp(), which checks the user agent for "MyAppNative". 4. Run the store-readiness skill (or workflow) and fix what it finds. 5. Write docs/store/review-notes.md: what the app does, a placeholder for the demo account, and the native features a reviewer can try. 6. Summarize all changes and give me a phone test plan: sign up, sign in with Google and with Apple, delete the account, airplane mode, open /privacy directly.
Checklist before you submit
- The URL in Config.swift and Config.java is your own domain on Netlify, not a windsurf.build or deploy preview URL.
- Direct loads of /privacy and /delete-account return the page, not a 404.
- The agent can quote the native-app rule back to you in a fresh conversation.
- Workflows you rely on exist as skills if you moved to Devin Desktop.
- Airplane mode shows the WebViewGold offline screen.
- Your production domain gets through the free App Store readiness check without red flags.
Pitfalls
- Shipping the windsurf.build preview: it is meant for previews, the subdomain cannot be changed after deployment, and the URL is compiled into the app.
- Single-page apps on Netlify without a catch-all redirect: the privacy URL you enter in App Store Connect returns a 404 for the reviewer.
- Trusting memories for rules: they do not travel to teammates, other workspaces or other tools.
- Old
.windsurfrulesand new.devin/rulescontradicting each other. Both load, so consolidate. - Two global rules files: if
.devin/global_rules.mdand.windsurf/global_rules.mdboth exist, only the first one loads. - Testing only in the editor Preview. The native WebView differs in OAuth, file uploads and safe areas; test the built app on a phone.
Frequently asked questions
Is Windsurf discontinued?
No. Windsurf was renamed Devin Desktop in June 2026. It is the same editor with the same settings and extensions, and the Windsurf plugin for JetBrains IDEs is still offered.
Can I still use Cascade?
In Devin Desktop, new conversations start with Devin Local, and Cascade conversations can no longer be started there. Cascade remains in the Windsurf plugin for JetBrains. The rule in this guide works with both agents; use a workflow with Cascade and a skill with Devin Local.
Do my .windsurfrules still work?
Yes. Devin Desktop imports .windsurfrules, .windsurf/rules/*.md and .windsurf/global_rules.md by default. New rules belong in .devin/rules/, which takes precedence when both exist.
Can I use the windsurf.build URL in my app?
It would load, but do not do it. App Deploys are meant for previews, the subdomain cannot be changed later, and the URL is compiled into your app. Use your own domain on Netlify or another host.
Do I need a Mac?
For a manual iOS build in Xcode, yes. The WebViewGold Cloud Builder builds and uploads both apps from the browser, and the Full Service team can do the configuration and build for you.
Three ways to get your app into the stores
Same result, different amount of work on your side. All three come with the approval guarantee and 24/7 human support.
Do it yourself
$109 per platform, one-time
The WebViewGold license: a finished Xcode or Android Studio project. Paste your URL, set name and icon, switch on features, build and submit. Free updates forever.
See plans on the main pageCloud Builder
$349 per license, one-time add-on
No Mac, no Xcode, no Android Studio: configure in the browser, we build both apps in the cloud and hand them to App Store Connect and the Play Console.
How the Cloud Builder works Try the free demoFull Service
$698 per platform $798
Send us your URL and icon. Our team configures, builds and delivers your app within 72 hours, white-label, with source projects. Both platforms for $1,158.
Full Service details Powered by
Winter Sale prices valid until December 31, 2026.