GitHub ports Copilot runtime to 800,000 lines of production Rust

The Copilot agent runtime arrived on GitHub's stack as a TypeScript codebase built on top of the Copilot CLI, because the CLI was written and shipped quickly and the layers were intertwined rather than cleanly separated. That design carried a cost for other products: GitHub says the runtime backs a growing set of Microsoft, GitHub, and ecosystem solutions, including the latest releases of VS Code, Visual Studio, CCA, Copilot Code Review, Copilot Cowork, Copilot Studio, and Excel, Outlook, PowerPoint, and Word. Over time most of those products replaced their own agent loop with the GitHub Copilot SDK, which is the entry point to the runtime.

GitHub's stated goals for the rewrite were a runtime that is its own library without the CLI's terminal interface, one written in a language with minimal overhead that can be embedded in-process, and one that works cleanly with all six SDK languages. The port had to proceed while the codebase kept moving. GitHub says it was done in place, component by component, with each pull request replacing the existing TypeScript implementation with a thin shim into Rust and deleting the old code in one atomic change, so the main branch stayed shippable. The company also shied away from maintaining TypeScript and Rust versions of the same component concurrently, noting that session orchestration owns mutable state, drives callbacks in both directions, and threads through nearly every other subsystem, which made running both versions in parallel impractical.

The stated payoff is that the shipped runtime is a platform library with two front doors: one for Node processes and one for any language that can call through a foreign function interface. GitHub says those in-process entry points are currently opt-in while it gains confidence in sharing a process, and therefore a failure boundary, with the consuming application. Whether teams adopt the in-process path is likely to hinge on how that confidence builds, since the SDK API above the transport — sessions, events, tools, permissions, and callbacks — stays the same either way.