← research

Bun rewritten in Rust by 64 Claude agents in 11 days (read 2026-07-15)

Aug 10, 2026

Source: bun.com/blog/bun-in-rust. Why it matters here: it is the largest public validation of the exact patterns this system runs on — dynamic workflows, adversarial review with context separation, worktree isolation, deterministic gates — at 1M+ lines and $165k of tokens. Distilled for what transfers.

What happened

Bun (JS runtime, originally Zig) was mechanically ported to Rust — 1,009,272 lines added, 6,502 commits (peak 695/hr) — in 11 days (May 3–14, 2026) using Claude in dynamic workflows: 4 git worktrees × 16 agents = 64 parallel instances, ~1,300 lines/min at peak. Cost ≈ $165k API-equivalent (5.9B uncached input, 690M output, 72B cached reads). Stated alternative: ~3 engineer-years with zero feature work. Motivation: Zig's manual memory management vs JS GC = perpetual use-after-free/double-free crashes ("tired of going to sleep worrying about crashes"); Rust's borrow checker + Drop turns that bug class into compile errors.

Results (verified numbers from the post)

  • Memory: Bun.build() ×1000 runs — 3,506 MB → 586 MB (Drop-based cleanup)
  • Binary ~20% smaller; throughput +2–5% (Bun.serve +4.8%, next build +4.5%, tsc +4.7%) via cross-language LTO
  • Claude Code itself shipped it (v2.1.181): 10% faster startup, "barely anyone noticed" — the correctness flex
  • Post-rewrite hardening: 24/7 coverage-guided fuzzing of every parser (100B executions, ~15 auto-PRs), LeakSanitizer on all native allocations, 11 security-review rounds
  • 19 port regressions found+fixed — the interesting ones are language-semantics bugs: Zig assert always executes vs Rust debug_assert! erased in release (broke HMR); release-build bounds checks exposing latent off-by-ones; unwrap_or eager-evaluation panic vs unwrap_or_else
  • Unsafe ratio: ~4% (13k unsafe across 780k lines, 78% single-line FFI)

The workflow (what they actually did)

  1. Serialize domain knowledge BEFORE fan-out: Claude wrote PORTING.md (Zig→Rust pattern map) + LIFETIMES.tsv (per-field lifetime annotations) first — workers consumed artifacts, not tribal knowledge.
  2. Trial run before scale: 3 files through the full pipeline (1 implementer, 2 adversarial reviewers, 1 fixer) before any 64-agent fan-out.
  3. Adversarial review with context separation: implementer sees Zig source + guide + own reasoning; each reviewer sees ONLY the diff, instructed to assume the code is wrong. Two reviewers per line. This caught real pre-merge bugs: Box::leak before async uv_close (UAF→double-free), trunc vs floor for negative mtimes, the unwrap_or_else panic.
  4. Compiler as distributed task queue: after the mechanical port, ~16,000 compile errors grouped by crate and sharded across 64 agents — the compiler's error stream became the work-distribution mechanism; each crate independently fixable.
  5. Mechanical port, idiomatic later: line-by-line translation preserving architecture; the language-agnostic TypeScript test suite was the unchanged oracle throughout; idiomatic refactor deferred past v1.4.
  6. Isolation as infrastructure: worktree per worker, cgroup limits, staged phases — agents structurally can't collide.
  7. Pre-work enabling the fan-out: the monolithic Zig unit was split into ~100 crates FIRST (dependency refactoring) so work could shard cleanly.

What transfers into our doctrine (delta only — most of this we already run)

  • Already ours, now externally validated at 1M-line scale: fresh-context adversarial verifiers ("the maker was confident — that is not evidence"), worktree/write-set isolation, deterministic gates, run-contract prep. Bun adds the working ratios: 2 reviewers/line, 1 fixer per finding, 16 agents/worktree.
  • NEW → adopted as LOOP_ENGINEERING P17: (a) deterministic error streams are work queues — group compiler/lint/test failures by module and shard the groups to workers instead of hand-decomposing; (b) serialize domain knowledge into worker-readable artifacts before any fan-out (the PORTING.md/LIFETIMES.tsv move — a stronger form of Definition-of-Ready); (c) pilot N=3 through the full pipeline before scaling to N=64.
  • Port/migration law: mechanical first, tests as the invariant oracle, idiomatic later; expect the regressions at language-semantics seams (assert semantics, bounds checks, eager vs lazy evaluation) — review those seams specifically.
  • Budget calibration: $165k/11 days bought ~3 engineer-years. At our scale the same shape prices a "full-repo migration" workflow in the $10²–10³ range — the pattern is affordable far below Bun's size.

Verified against source (2026-07-20)

Checked every proper noun and checkable number against the primary source (bun.com/blog/bun-in-rust, fetched live): lines added, commit count, peak commits/hr, date range, 4×16=64 agent topology, $165k cost, memory (3,506→586 MB at 1,000 Bun.build() runs — confirmed exact), binary size ~20% smaller, per-benchmark throughput (Bun.serve +4.8%, next build +4.5%, tsc +4.7% — all exact), Claude Code v2.1.181 10% faster startup, 100B fuzzing executions, ~15 auto-PRs, 19 regressions, ~4% unsafe ratio (13k unsafe / 780k lines) — all verified clean.

  • wrong → right: "5.9B cached input" → "5.9B uncached input." [Evidence: bun.com/blog/bun-in-rust verbatim: "this took 5.9 billion uncached input tokens, 690 million output tokens, and 72 billion cached input token reads — around $165,000 at API pricing."] The dossier had the cached/uncached labels swapped, which inverts the cost story (cached tokens are the cheap ones).