From 892bc94afe9dd24133f52cd1d35c024aeb7679ff Mon Sep 17 00:00:00 2001
From: Leo Kettmeir <crowlkats@toaxl.com>
Date: Wed, 17 Dec 2025 23:29:57 +0100
Subject: [PATCH] fix(flags): implement a better sandbox subcommand (#31657)

---
 cli/args/flags.rs   | 19 ++++++++++++-------
 cli/main.rs         |  4 ++--
 cli/tools/deploy.rs | 10 +++++++---
 3 files changed, 21 insertions(+), 12 deletions(-)

diff --git a/cli/args/flags.rs b/cli/args/flags.rs
index 00e71f1f7d..6822c14ed7 100644
--- a/cli/args/flags.rs
+++ b/cli/args/flags.rs
@@ -224,6 +224,11 @@ pub struct CoverageFlags {
   pub r#type: CoverageType,
 }
 
+#[derive(Clone, Debug, Eq, PartialEq, Default)]
+pub struct DeployFlags {
+  pub sandbox: bool,
+}
+
 #[derive(Clone, Debug, Eq, PartialEq, Default)]
 pub enum DocSourceFileFlag {
   #[default]
@@ -598,7 +603,7 @@ pub enum DenoSubcommand {
   Compile(CompileFlags),
   Completions(CompletionsFlags),
   Coverage(CoverageFlags),
-  Deploy(Option<&'static str>),
+  Deploy(DeployFlags),
   Doc(DocFlags),
   Eval(EvalFlags),
   Fmt(FmtFlags),
@@ -1671,14 +1676,14 @@ pub fn flags_from_vec_with_initial_cwd(
     deploy_parse(
       &mut flags,
       &mut matches.remove_subcommand().unwrap().1,
-      None,
+      false,
     )?;
     return Ok(flags);
   } else if matches.subcommand_matches("sandbox").is_some() {
     deploy_parse(
       &mut flags,
       &mut matches.remove_subcommand().unwrap().1,
-      Some("sandbox"),
+      true,
     )?;
     return Ok(flags);
   }
@@ -1734,12 +1739,12 @@ pub fn flags_from_vec_with_initial_cwd(
     if subcommand.get_name() == "deploy" {
       flags.argv = vec![String::from("--help")];
       flags.permissions.allow_all = true;
-      flags.subcommand = DenoSubcommand::Deploy(None);
+      flags.subcommand = DenoSubcommand::Deploy(DeployFlags::default());
       return Ok(flags);
     } else if subcommand.get_name() == "sandbox" {
       flags.argv = vec![String::from("--help")];
       flags.permissions.allow_all = true;
-      flags.subcommand = DenoSubcommand::Deploy(Some("sandbox"));
+      flags.subcommand = DenoSubcommand::Deploy(DeployFlags { sandbox: true });
       return Ok(flags);
     }
 
@@ -5911,7 +5916,7 @@ fn coverage_parse(
 fn deploy_parse(
   flags: &mut Flags,
   matches: &mut ArgMatches,
-  subcommand: Option<&'static str>,
+  sandbox: bool,
 ) -> clap::error::Result<()> {
   let mut args: Vec<String> = matches
     .remove_many("args")
@@ -5923,7 +5928,7 @@ fn deploy_parse(
   }
 
   flags.argv = args;
-  flags.subcommand = DenoSubcommand::Deploy(subcommand);
+  flags.subcommand = DenoSubcommand::Deploy(DeployFlags { sandbox });
   Ok(())
 }
 
diff --git a/cli/main.rs b/cli/main.rs
index a808b15a9f..49be997158 100644
--- a/cli/main.rs
+++ b/cli/main.rs
@@ -147,8 +147,8 @@ async fn run_subcommand(
       );
       tools::bundle::bundle(flags, bundle_flags).await
     }),
-    DenoSubcommand::Deploy(subcommand) => spawn_subcommand(async move {
-      tools::deploy::deploy(Arc::unwrap_or_clone(flags), subcommand).await
+    DenoSubcommand::Deploy(deploy_flags) => spawn_subcommand(async move {
+      tools::deploy::deploy(Arc::unwrap_or_clone(flags), deploy_flags).await
     }),
     DenoSubcommand::Doc(doc_flags) => {
       spawn_subcommand(async { tools::doc::doc(flags, doc_flags).await })
diff --git a/cli/tools/deploy.rs b/cli/tools/deploy.rs
index b41dd67af4..13cc7bebb8 100644
--- a/cli/tools/deploy.rs
+++ b/cli/tools/deploy.rs
@@ -9,6 +9,7 @@ use deno_path_util::ResolveUrlOrPathError;
 use deno_runtime::WorkerExecutionMode;
 use deno_runtime::deno_permissions::PermissionsContainer;
 
+use crate::args::DeployFlags;
 use crate::args::Flags;
 use crate::args::jsr_api_url;
 use crate::factory::CliFactory;
@@ -17,12 +18,15 @@ use crate::registry;
 
 pub async fn deploy(
   mut flags: Flags,
-  subcommand: Option<&'static str>,
+  deploy_flags: DeployFlags,
 ) -> Result<i32, AnyError> {
   flags.node_modules_dir = Some(NodeModulesDirMode::None);
   flags.no_lock = true;
-  if let Some(subcommand) = subcommand {
-    flags.argv = vec![subcommand.to_string()];
+  if deploy_flags.sandbox {
+    // SAFETY: only this subcommand is running, nothing else, so it's safe to set an env var.
+    unsafe {
+      std::env::set_var("DENO_DEPLOY_CLI_SANDBOX", "1");
+    }
   }
 
   let mut factory = CliFactory::from_flags(Arc::new(flags));