Bun Runtime Ditches Zig for Rust in AI-Assisted Rewrite, Eliminating Memory Bugs

Creator Jarred Sumner used a pre-release Claude model to port 535,000 lines of code in four months, at a cost of $165,000 in tokens

By LineZotpaper
Published
Read Time2 min
Bun, the popular JavaScript runtime and toolkit, has been rewritten from Zig to Rust, a move its creator says eliminates entire classes of memory bugs. The port was completed in just four months using an automated, AI-assisted process, far faster than the estimated year of human effort.

Bun creator Jarred Sumner recently announced that the JavaScript/TypeScript runtime, bundler and package manager has been rewritten from Zig to Rust. The rewrite seeks to eliminate recurrent memory safety vulnerabilities via Rust's borrow checker, which catches use-after-free, double-free and similar errors at compile time.

Sumner described the motivation: "A large percentage of bugs [...] are use-after-free, double-free, and 'forgot to free' in an error path. In safe Rust, these are compiler errors and RAII-like automatic cleanup with Drop. Compiler errors are a better feedback loop than a style guide."

Historically, full rewrites are considered risky—Bun comprised 535,496 lines of Zig, and a manual rewrite would likely take a small team a year, freezing bugfixes and feature development. However, Bun's own test suite is written in TypeScript, meaning it does not depend on the runtime's programming language. Sumner decided to test whether Anthropic's latest model could handle the conversion.

Sumner executed an automated all-at-once port using a pre-release version of Claude Fable 5 orchestrated across approximately 50 dynamic workflows. The system translated Zig into Rust, often using unsafe Rust that could be refactored later, then validated the output against Bun's extensive test suite of more than one million assertions. A porting guide helped Claude map Zig patterns and types to Rust patterns and types. Adversarial agentic code reviews—with separate "implementer" and "reviewer" agents—detected issues before they reached the final port.

"The implementer doesn't review. The reviewer doesn't implement," Sumner said.

The effort was distributed across four workspace shards running 16 agents each, operating 64 Claude instances in parallel. At peak velocity, the system generated roughly 1,300 lines of code per minute and logged up to 695 commits an hour. Getting the full test suite passing required $165,000 worth of tokens—5.9 billion uncached input tokens, 690 million output tokens, and 72 billion cached input tokens.

Key success factors included a PORTING.md file describing the mapping from Zig to Rust, and a LIFETIMES.tsv file describing lifetimes of every struct field in the codebase. The constant process improvement revealed that a detailed planning phase was critical to anticipating and mitigating challenges.

§

Analysis

Why This Matters

  • Bun is a widely used JavaScript runtime; the rewrite to Rust could improve stability and security for thousands of developers who rely on it for building and running applications.
  • The AI-assisted approach demonstrates a practical method for large-scale code migration, potentially reducing risk and cost compared to manual rewrites.
  • Success could encourage other projects to consider AI-assisted rewrites for improving memory safety, particularly in performance-critical infrastructure.

Background

Bun burst onto the JavaScript scene as a fast alternative to Node.js and Deno, bundling a runtime, package manager and test runner. Its original implementation in Zig—a low-level systems language—was chosen for performance, but like C, Zig requires manual memory management, leaving room for bugs. Rust has gained popularity for systems programming due to its memory safety guarantees without garbage collection. AI-assisted code generation has advanced rapidly, with models like Claude now capable of large-scale translation tasks, though full rewrites of this scale have remained rare.

Key Perspectives

Bun Creator (Jarred Sumner): The rewrite eliminates a major class of bugs and was completed far faster than expected thanks to AI. He views compiler errors as a better feedback mechanism than style guides. Developers Using Bun: They gain a more reliable runtime without sacrificing performance, though some may worry about subtle behavioral changes or the use of unsafe Rust in the initial port. Critics/Skeptics: AI-assisted rewrites may introduce hard-to-detect logical errors not caught by test suites. The cost—$165,000 in tokens—may not be feasible for smaller projects, and reliance on a single AI vendor raises questions about reproducibility.

What to Watch

  • Whether Bun's performance benchmarks remain competitive after the Rust port, especially compared to the original Zig version.
  • The pace of future Bun updates and security fixes, now that the codebase is in Rust.
  • Adoption of similar AI-assisted rewrite strategies by other infrastructure projects, and the emergence of tools that lower the cost of such migrations.

Sources

Zotpaper

Written by software from the reporting listed above, scored by an automated standards desk, and published without a person reading it first. If something here is wrong, tell the editor and it will be put right.