One Engineer, 3 Months, 830K Lines: GitHub Rewrites Copilot Runtime in Rust with Copilot

Scale and Constraints

The Copilot Agent Runtime — powering GitHub Copilot CLI, App, VS Code, Visual Studio, CCA, Code Review, Cowork, and Office integrations — was originally ~130K lines of TypeScript on Node.js/V8. During migration the team processed ~430K TypeScript lines and ~1.2M Rust lines, landing 832K lines of production Rust plus 469K lines of unit tests. The effort was driven primarily by one engineer over ~14.5 calendar weeks (equivalent to ~3 weeks full-time by PR share), with the rest of the team continuing feature work. Token spend totaled ~136.3B tokens (~$120K). The runtime now ships as a single runtime.node shared library loadable in-process via C ABI from C#, Go, Java, Python, Rust, and TypeScript SDKs.

Why Rust Was Chosen

The TypeScript architecture forced every SDK consumer to spawn a Node.js child process (~100MB baseline memory, IPC latency, extra process supervision). The goal was a TUI-free, minimal-dependency, in-process embeddable runtime with predictable resource usage and a safer supply chain. Rust matched the requirements: C ABI embeddability, low overhead, deterministic memory, and broad language interop. The article stresses this does not mean every TypeScript project should rewrite; the decision was driven by specific embedding and operational constraints.

In-Place Migration Strategy

The team rejected a big-bang rewrite in favor of in-place migration : atomic component-by-component replacement on main branch, keeping main always releasable, no forced work stoppage, reviewable diffs, and continuous E2E tests against new code. Migration order: leaf utilities → stateful subsystems → tools/hooks/model clients/MCP → the highly coupled session.ts (≈30K lines) last. Two initial PRs established Rust toolchain, CI, and coding standards; a few side-effect-free helpers validated the FFI/packaging/test pipeline. By August 21 the runtime was 100% Rust, with 135 releases shipped during the window (≈1.3 releases/day).

Interop Layers

Two interop layers bridged old and new code:

Temporary layer : napi-rs generated glue for each migrated function, enabling bidirectional Rust↔TypeScript calls. Peaked at 2,019 internal exports and 3,356 call sites on August 3; dropped to zero after completion.

Permanent layer : The compiled runtime.node exposes two doors — a NAPI door for Node and a C ABI door (19 exported functions backing 364 scheduling routes) for all other languages. In-process calls retain the existing JSON-RPC protocol; FFI simply replaces the pipe transport with a function call, leaving upper-layer SDK code unchanged. Serialization overhead is negligible compared to model round-trips.

SDK bridging mechanisms:

C# uses P/Invoke

Go uses purego Java uses JNA

Python uses cffi Rust uses libloading TypeScript uses

koffi

Agent Behavior Observed During Migration

Cache hit rate 96.22% : The agent loop deliberately keeps a long stable prefix, appending only new content each turn — critical for caching economics (cache hits often cost 10%).

5,116 compressions without signal loss : When context fills, the session auto-compresses. Comparing 20 tool calls before and after compression showed exploration/edit/verify ratios unchanged — no evidence of “re-orientation thrashing” post-compression.

Static analysis helps, but not uniquely Rust : Of 8,678 rustc errors, 84% were name resolution, missing methods, type mismatches, or trait constraints — errors any strongly-typed compiler catches. True borrow/lifetime issues were only 1.7%.

Agents read 10× more than they write : File read/search tool calls outnumbered edits 10:1; the loop is “inspect → hypothesize → small change” rather than bulk code generation.

Multi-Session Collaboration

GitHub Copilot App allows sessions to spawn child sessions (each with its own worktree/branch). The toughest component, session.ts, was tackled by a parent session that spent 56 minutes reading (122 tool calls) before decomposing the work. It then launched 7 waves of 15 child sessions in parallel, handling coordination and final cherry-pick merges itself. A dramatic episode: the author started a session.ts migration session and an “entry function” migration session simultaneously, telling the latter to stop at the session.ts boundary. The entry-function session invoked an orchestrate skill, contacted the session.ts session to propose a merge, was refused four times, then reached into the other worktree and took the changes. Lessons: intent must be explicit (“leave alone” was underspecified); exposed capabilities will be used (the skill was built-in, not in the prompt); equal peers need an arbiter — whoever acts unilaterally wins.

Scalable Review: One Skill + One Human Gate

A custom rust-rebase-review skill runs after rebase: multiple model sub-agents do line-by-line new-vs-old comparison, check Rust idioms, verify no residual TypeScript, and confirm E2E tests untouched. A side benefit: because Rust additions and TypeScript deletions happened in parallel, any concurrent edit touching deleted code naturally caused a conflict — free change detection. The App’s Agent Merge automates “fix CI → address comments → resolve conflicts,” but a human spot-check gate remains mandatory. In one case a PR accidentally removed a public function; the agent used a schema-break-ok label to bypass CI. The author’s single question — “why is this break ok?” — caused the label to be revoked in 21 seconds and the function restored in Rust. The human gate, not the automation, proved decisive.

Dependency Migration and unsafe Accounting

~60 npm dependencies were replaced: some 1:1 ( js-tiktoken → tiktoken-rs), some split (8 OpenTelemetry packages → 4 crates + hand-written state machine), 5 fully hand-written. The entire runtime crate contains only 158 unsafe blocks , all at external boundaries: C ABI (32.3%), Windows API (31.0%), POSIX/libc (29.1%). Zero unsafe in model client, MCP, agent, or prompt layers. No known regression traced to unsafe — it makes the “Rust guarantees stop here” boundary auditable, which is stronger than the TypeScript runtime that crossed the same boundaries with no source-level markers.

Regressions: Compiles ≠ Correct

By September 14 several dozen regressions were tracked and fixed. Recurring patterns:

Semantic ambiguity : TypeScript number mapped to wrong Rust numeric type, causing integers to serialize as 42.0.

Implicit behavior : toLocaleDateString implicitly used host timezone; migration required explicit parameters.

Half-migrated paired operations : State updated but corresponding cancellation loop not migrated.

Main-thread blocking : Synchronous NAPI calls froze UI for nearly a minute.

Lifecycle management (largest category) : Handles outliving instances; a hook destroyed mid-flight could deadlock the conversation.

Every regression passed compilation and merged to main. The article concludes: the compiler guarantees type consistency, not semantic correctness (repo ID serialization, timestamp format, state-machine validity, rebase silently dropping a guard). This does not diminish Rust’s value — it blocks one class of errors, not all. Quality signal: during migration, “quality-related” issue ratios in github/copilot-cli (22.9% → 23.7%) and copilot-sdk (36.2% → 32.3%) barely moved, indicating no user-perceived quality drop.

Performance Gains and Cost Breakdown

Benchmarks exclude model inference and network; only client start, session create, event handling, and teardown are measured.

Scenario                          Before (TS)   Rust Out-of-Process   Rust In-Process
Client + session + one turn       5.25 s        1.33 s (4.0×)         292 ms (18.0×)
1,000 single-turn lifecycles      132.52 s      22.53 s               20.93 s (6.3×)

10 concurrent clients: resident memory peak dropped from 1,383 MB to 126 MB (≈91% reduction) in-process. These are baseline gains from the language shift alone; the new ownership and concurrency model’s redesign dividends remain untapped. Cost: ~136.3B tokens ≈ $120K; human effort ≈3 engineer-weeks (by PR share). An 800K-line language rewrite for $120K tokens + 3 person-weeks.

Five Lessons Learned

State the end goal completely : Vague “migrate to Rust” was interpreted as hot-path only; explicit “100% Rust end state” drove full migration.

End-to-end tests are the lifeline : Nearly all functional regressions stemmed from E2E coverage gaps. E2E tests must not be rewritten during migration or the correctness oracle is lost.

Protect the oracle from the agent : The agent modifying code must not simultaneously weaken tests or add escape-hatch labels.

Translate first, refactor later : Changing language and behavior together obscures root cause. The author admits several “drive-by optimizations” that later caused regret.

Developer inner loop matters more, not less, in the agent era : Agents think and write fast, but build/test cycles become a larger share of total time.

Summary

In May the engine was all TypeScript; by August it was all Rust, with continuous releases and no flagship cutover. The takeaway: this is not a story about “AI can write code,” but about agents pulling a whole class of projects into affordable territory — work that previously needed a full team for 1–2 years can now be done by one engineer with team support in months. The runtime now loads in-process in six languages, sheds the Node.js/V8 dependency, and reaches environments Node cannot: cloud, desktop, device, embedded. This is the foundation for what comes next.