[FFI] In-process runtime (runtime.node) no longer published to npm as of CLI 1.0.85 — unobtainable for registry-mirrored builds

[mit2nil]

Summary

As of Copilot CLI 1.0.85 the platform npm package no longer contains the in-process (FFI) native runtime. It is published only as a GitHub release asset. Build environments that can reach an internal npm registry mirror but cannot make direct requests to github.com can therefore no longer obtain the FFI runtime at all, and are pinned to CLI 1.0.83 if they need in-process hosting.

What changed

Through 1.0.83, @github/copilot-<platform> shipped the whole package directory, including prebuilds/<platform>/runtime.node — the cdylib that RuntimeConnection.ForInProcess() loads. Its package.json declared no files field.

In 1.0.85 the manifest restricts the package contents:

"files": ["copilot.exe", "package.json", "README.md", "LICENSE.md"]

runtime.node is no longer present. It now ships only inside the release asset github-copilot-<version>-<platform>.tgz.

Correspondingly, GitHub.Copilot.SDK 1.0.14's build targets acquire the runtime bundle from exactly one source — CopilotCliReleaseBaseUrl, defaulting to https://github.com/github/copilot-cli/releases/download.

Why this is a problem

Enterprise build environments commonly restrict outbound network access to approved internal package feeds. Such feeds mirror package registries (npm, NuGet, PyPI, Maven, Cargo) through standard upstream configuration. They do not mirror arbitrary release assets, because release assets are not a package registry — there is no upstream type that can track and pull them automatically.

The practical consequences:

• stdio / child-process transport is fine. It needs only the CLI binary, which the slim npm package still provides. These consumers can track any future SDK version.
• In-process FFI is blocked at 1.0.85+. The cdylib cannot be obtained through any registry upstream.

This is sharper than a packaging inconvenience because of #2517: an access violation in the FFI JSON-RPC write path that kills the host process. I have measured that crash reproducing on runtime 1.0.83 and not reproducing on 1.0.85 under an identical harness. So the only FFI runtime reachable from a registry-mirrored environment is the one that still carries a process-killing bug, and the runtime that appears to fix it is unreachable.

The workaround available to affected consumers is to abandon in-process hosting and run the CLI as a child process — which gives up the performance and isolation properties that make the in-process transport attractive in the first place.

Ask

Publish the FFI native runtime to npm again, so it flows through standard registry upstreams with no special infrastructure. Either option works:

1. Restore prebuilds/<platform>/runtime.node to @github/copilot-<platform>, or
2. Publish it as its own package, e.g. @github/copilot-runtime-<platform>, versioned in lock-step with the CLI, which keeps the default CLI package slim.

Option 2 seems to preserve whatever motivated the slim-down while unblocking FFI consumers.

If republishing to npm is not intended, could you document the supported story for consuming the FFI runtime without direct release-asset access? CopilotCliReleaseBaseUrl allows pointing at a mirror, but populating that mirror still requires fetching the release assets from somewhere, which is the step these environments cannot perform.

Environment

• GitHub.Copilot.SDK 1.0.13 (CLI 1.0.83) and 1.0.14 (CLI 1.0.85)
• .NET 8, Windows x64 and Linux x64 containers
• Build agents restricted to an internal npm registry mirror; no direct github.com egress

[mit2nil]

Adding a measurement that raises the impact of this packaging change, from #2517.

I isolated whether that crash is fixed managed-side or native-side by holding GitHub.Copilot.SDK at 1.0.14 and varying only CopilotCliVersion:

Managed SDK	Native CLI runtime	Result
1.0.13	1.0.83	crash — 0xC0000005
1.0.14	1.0.85	clean
1.0.14	1.0.83	crash — 0xC0000005

The fix is in the native runtime, between 1.0.83 and 1.0.85. The managed SDK version is not the deciding factor.

That connects the two issues directly: the runtime that fixes a process-killing access violation is precisely the one that stopped shipping to npm. Consumers restricted to a registry mirror can obtain 1.0.83 but not 1.0.85, so the only in-process runtime reachable to them is the one that still crashes. Upgrading the managed SDK does not help, because the fix is not there.

The practical position for an affected consumer today is: use in-process hosting on a runtime with a known crash, or abandon in-process hosting and run the CLI as a child process. Neither is a good outcome when a fixed runtime demonstrably exists.

One thing worth checking on your side: 1.0.85 was released 2026-09-16, a day before I opened this issue. If the files restriction in the platform package was not a deliberate decision, reverting it would resolve this issue and unblock #2517 for registry-mirrored consumers in a single change, with no new distribution mechanism required.