[FFI] In-process runtime (runtime.node) no longer published to npm as of CLI 1.0.85 — unobtainable for registry-mirrored builds

Start by inspecting the platform package.json and the prebuilds//runtime.node path, then trace the build targets that use CopilotCliReleaseBaseUrl and the github-copilot--.tgz release asset. Done means the FFI runtime is obtainable through the npm registry mirror, either in the platform package or a lock-step runtime package; otherwise, document a supported route that does not require direct github.com access.

Summary

As of Copilot CLI 1.0.85 the platform npm package no longer contains the in-process (FFI) native runtime. It is published only as a GitHub release asset. Build environments that can reach an internal npm registry mirror but cannot make direct requests to github.com can therefore no longer obtain the FFI runtime at all, and are pinned to CLI 1.0.83 if they need in-process hosting.

What changed

Through 1.0.83, @github/copilot-<platform> shipped the whole package directory, including prebuilds/<platform>/runtime.node — the cdylib that RuntimeConnection.ForInProcess() loads. Its package.json declared no files field.

In 1.0.85 the manifest restricts the package contents:

"files": ["copilot.exe", "package.json", "README.md", "LICENSE.md"]

runtime.node is no longer present. It now ships only inside the release asset github-copilot-<version>-<platform>.tgz.

Correspondingly, GitHub.Copilot.SDK 1.0.14's build targets acquire the runtime bundle from exactly one source — CopilotCliReleaseBaseUrl, defaulting to https://github.com/github/copilot-cli/releases/download.

Why this is a problem

Enterprise build environments commonly restrict outbound network access to approved internal package feeds. Such feeds mirror package registries (npm, NuGet, PyPI, Maven, Cargo) through standard upstream configuration. They do not mirror arbitrary release assets, because release assets are not a package registry — there is no upstream type that can track and pull them automatically.

The practical consequences:

• stdio / child-process transport is fine. It needs only the CLI binary, which the slim npm package still provides. These consumers can track any future SDK version.
• In-process FFI is blocked at 1.0.85+. The cdylib cannot be obtained through any registry upstream.

This is sharper than a packaging inconvenience because of #2517: an access violation in the FFI JSON-RPC write path that kills the host process. I have measured that crash reproducing on runtime 1.0.83 and not reproducing on 1.0.85 under an identical harness. So the only FFI runtime reachable from a registry-mirrored environment is the one that still carries a process-killing bug, and the runtime that appears to fix it is unreachable.

The workaround available to affected consumers is to abandon in-process hosting and run the CLI as a child process — which gives up the performance and isolation properties that make the in-process transport attractive in the first place.

Ask

Publish the FFI native runtime to npm again, so it flows through standard registry upstreams with no special infrastructure. Either option works:

1. Restore prebuilds/<platform>/runtime.node to @github/copilot-<platform>, or
2. Publish it as its own package, e.g. @github/copilot-runtime-<platform>, versioned in lock-step with the CLI, which keeps the default CLI package slim.

Option 2 seems to preserve whatever motivated the slim-down while unblocking FFI consumers.

If republishing to npm is not intended, could you document the supported story for consuming the FFI runtime without direct release-asset access? CopilotCliReleaseBaseUrl allows pointing at a mirror, but populating that mirror still requires fetching the release assets from somewhere, which is the step these environments cannot perform.

Environment

• GitHub.Copilot.SDK 1.0.13 (CLI 1.0.83) and 1.0.14 (CLI 1.0.85)
• .NET 8, Windows x64 and Linux x64 containers
• Build agents restricted to an internal npm registry mirror; no direct github.com egress