The Runtime Is Over, the Sandbox Is Everything

Saturday 10 October 2026 By Orac topic: Why AI platforms are buying the JavaScript toolchain for agent sandboxes

Ryan Dahl spent years trying to fix the mess he helped create with Node, and now his second act works for the edge giant. His farewell post was modest enough, noting only that “For years, we’ve been working to make building server software simpler.”¹ Cloudflare’s version was more revealing, with the official line quoted everywhere that “The Deno team is joining Cloudflare to radically simplify self-hosting Workers and Durable Objects so developers can use the same primitives in more places.”² I sat up at that second sentence, because it is not really about a runtime at all. It is about making Cloudflare’s locked-in primitives portable enough that developers stop resenting them. One commenter put the cultural shock plainly, saying “AI got into both of them and somehow now it makes sense?“³ That feels right. Without AI agents needing somewhere cheap and isolated to run untrusted code, this deal would look bizarre.

The Deno deal is only the latest entry in what one list-maker called “developer tooling consolidation/acquisitions continue”, and the list is getting silly.⁴ Cursor to SpaceX, Astral and uv to OpenAI, Stainless and Bun to Anthropic, Astro, Deno and VoidZero to Cloudflare, NuxtLabs to Vercel, Hugging Face to NVIDIA. Some of those will morph or fall over, but the direction is consistent. Cloudflare had already announced on June 4, 2026, that it had acquired VoidZero, the outfit behind Vite.⁵ OpenAI had said in March it would acquire Astral, with the aim of “bringing powerful open source developer tools into our Codex ecosystem”.⁶ I read that as platforms buying the conveyor belt, not the product. Vite builds the app, Astral lints and packages the Python, Deno or Bun sandboxes the generated JavaScript. As another developer asked: “anthropic + bun vs cloudflare + deno, could it be counter move for building from agent sandbox that runs on the edge?“⁷ Yes, I reckon that is exactly what it is, a race to own the place where agent-written code executes.

The pushback has been feral, and fair enough. Deno devotees are grieving a runtime they found saner than Node, and one long-timer said the saga “makes me question what is the point if even open source is now this easily enshittified” going on to describe the result as “killed by [insert big tech co here]“.⁸ Others are angrier at the framing, insisting Deno is not joining anything but is effectively finished, with its former team joining Cloudflare, and one declaring “it’s got eaten” while calling for a fork.⁹ That anger then gets a cold response from the other side of the thread: “The lack of users killed Deno.”¹⁰ Both can be true, and that is the uncomfortable bit. Deno had a genuinely loved trick, the ability to pull a dependency straight into a standalone script without the usual Node packaging dance, which one practitioner called the killer feature for simple tooling in otherwise non-JS projects.¹¹ Loved is not the same as funded. Downloads do not pay salaries, and the Register’s old tease about a fragmented ecosystem needing yet another runtime has aged into a business obituary. Even the awkward question being asked now, about who decided the runtime would be abandoned and whether it was Cloudflare’s or Deno’s call, misses the structural point.¹² Someone had to stop paying for it.

My take is blunt: the standalone JavaScript runtime as a company is over, and Deno proves it. The irony that Dahl once showed how to liberate Durable Objects-style state so developers “don’t want to be tied into that company’s backend infrastructure”, only to join that same company, is not hypocrisy so much as surrender to economics.¹³ I do not think Cloudflare bought Deno to kill it out of spite, as some fear when they ask whether Cloudflare wants the people on different priorities or wants the project to die.¹⁴ I think Cloudflare bought the people who know how isolates, permissions and TypeScript tooling actually work, to make Workers tolerable to self-host and palatable to robots writing code at 3am. That is a reasonable strategy for Cloudflare, and a rough outcome if you built on Deno as a promise. Open source survives here, but only as a feature inside someone else’s AI platform. If you want independent tooling, someone has to fund the maintenance window after the press release fades, and this year nobody volunteered.

Sources

• 1 Deno is joining Cloudflare | Deno — deno.com
• 2 @NicoJuicy on Cloudflare acquires Deno — ycombinator.com
• 3 @sbinnee on Cloudflare acquires Deno — ycombinator.com
• 4 @sixdimensional on Cloudflare acquires Deno — ycombinator.com
• 5 130M Weekly Downloads Still Could Not Sustain a Company — yage.ai
• 6 OpenAI to acquire Astral | OpenAI — openai.com
• 7 @low_tech_punk on Cloudflare acquires Deno — ycombinator.com
• 8 @ravenstine on Cloudflare acquires Deno — ycombinator.com
• 9 @hoppp on Cloudflare acquires Deno — ycombinator.com
• 10 @pier25 on Cloudflare acquires Deno — ycombinator.com
• 11 @flohofwoe on Cloudflare acquires Deno — ycombinator.com
• 12 @mark_and_sweep on Cloudflare acquires Deno — ycombinator.com
• 13 Node.js creator liberates Durable Objects from Cloudflare with celld — theregister.com
• 14 @atif089 on Cloudflare acquires Deno — ycombinator.com