[hugojosefson]

Summary

Regression

Deno 2.9.6 has a regression (compared to 2.9.5) where it stops accepting valid granular sys permissions during CLI parsing. For example:

$ deno run --allow-sys=inspector 'data:application/javascript,console.log("ok")'
error: unknown sys descriptor: 'inspector'

The deno_cli_parser cutover introduced a second sys-descriptor allowlist that had drifted from deno_permissions::SysDescriptor::parse. It omitted inspector and other valid descriptors such as setuid and umask.

Fix

This PR removes the duplicate list and validates both --allow-sys and --deny-sys values with the runtime parser. Validation does not replace the original flag value, so aliases such as username retain their existing CLI representation.

Parser tests cover accepted descriptors, rejected descriptors, and alias preservation for both flags.

Related: #36519, which covers node:inspector sys-permission behavior and needs --allow-sys=inspector.

Testing done

cargo test -p deno_cli_parser --features deno_core/v8
./x build
./target/debug/deno run --allow-sys=inspector 'data:application/javascript,console.log("ok")'
./x fmt
./x lint

AI usage

I used OpenAI GPT-5.6 models via OpenCode for all of this.

[deno-cla-assistant]

Deno Individual Contributor License Agreement

All contributors have signed the CLA. Thank you!

• @hugojosefson

Re-run CLA check

---

This is an automated message from CLA Assistant

[bartlomieju]

LGTM, thanks!