Enable SSH and Git operations in Cloudflare sandbox

Install openssh-client in the sandbox image and add consola for logging.
Read SSH_PRIVATE_KEY/SSH_PUBLIC_KEY env vars to write SSH keys, set
known_hosts and git config, then clone the repository in the /run
handler.
Expose SSH env types in worker typings and update ProcessEnv mapping.

.sandbox/cloudflare/Dockerfile

···
 FROM docker.io/cloudflare/sandbox:0.7.0
 
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    openssh-client
+
 # Required during local development to access exposed ports
 EXPOSE 8080

.sandbox/cloudflare/bun.lock

···
   "workspaces": {
     "": {
       "name": "@cloudflare/sandbox-minimal-example",
+      "dependencies": {
+        "consola": "^3.4.2",
+      },
       "devDependencies": {
         "@cloudflare/sandbox": "*",
         "@types/node": "^24.10.11",
···
     "@types/node": ["@types/node@24.10.11", "", { "dependencies": { "undici-types": "~7.16.0" } }, "sha512-/Af7O8r1frCVgOz0I62jWUtMohJ0/ZQU/ZoketltOJPZpnb17yoNc9BSoVuV9qlaIXJiPNOpsfq4ByFajSArNQ=="],
 
     "blake3-wasm": ["blake3-wasm@2.1.5", "", {}, "sha512-F1+K8EbfOZE49dtoPtmxUQrpXaBIl3ICvasLh+nJta0xkz+9kF/7uet9fLnwKqhDrmj6g+6K3Tw9yQPUg2ka5g=="],
+
+    "consola": ["consola@3.4.2", "", {}, "sha512-5IKcdX0nnYavi6G7TtOhwkYzyjfJlatbjMjuLSfE2kYT5pMDOilZ4OvMhi637CcDICTmz3wARPoyhqyX1Y+XvA=="],
 
     "cookie": ["cookie@1.1.1", "", {}, "sha512-ei8Aos7ja0weRpFzJnEA9UHJ/7XQmqglbRwnf2ATjcB9Wq874VKH9kfjjirM6UhU2/E5fFYadylyhFldcqSidQ=="],
 

.sandbox/cloudflare/package.json

···
 		"wrangler": "^4.63.0"
 	},
 	"author": "",
-	"license": "MIT"
+	"license": "MIT",
+	"dependencies": {
+		"consola": "^3.4.2"
+	}
 }

.sandbox/cloudflare/src/index.ts

···
 import { getSandbox } from "@cloudflare/sandbox";
+import consola from "consola";
 
 export { Sandbox } from "@cloudflare/sandbox";
 
···
 
     // Execute a shell command
     if (url.pathname === "/run") {
-      const result = await sandbox.exec('echo "2 + 3 = $((2 + 3))"');
+      const HOME = "/root";
+      await sandbox.exec("mkdir -p $HOME/.ssh");
+      await sandbox.writeFile(`${HOME}/.ssh/id_rsa`, env.SSH_PRIVATE_KEY);
+      await sandbox.writeFile(`${HOME}/.ssh/id_rsa.pub`, env.SSH_PUBLIC_KEY);
+      await sandbox.exec("chmod 600 $HOME/.ssh/id_rsa");
+      await sandbox.exec(
+        "ssh-keyscan -t rsa tangled.org >> $HOME/.ssh/known_hosts",
+      );
+      await sandbox.exec("git config --global user.name 'Cloudflare Sandbox'");
+      await sandbox.exec(
+        "git config --global user.email '[e-mail]'",
+      );
+      consola.info("SSH keys uploaded to sandbox.");
+
+      consola.info("Sandbox environment configured for Git operations.");
+      consola.info("Cloning repository...");
+      const clone = await sandbox.exec(
+        "git clone [e-mail]:rocksky.app/rocksky rocksky -b main",
+      );
+      consola.log(clone.stdout);
+      const ls = await sandbox.exec("ls -la rocksky");
       return Response.json({
-        output: result.stdout,
-        error: result.stderr,
-        exitCode: result.exitCode,
-        success: result.success,
+        output: ls.stdout,
+        error: ls.stderr,
+        exitCode: ls.exitCode,
+        success: ls.success,
       });
     }
 
···
         content: file.content,
       });
     }
+
+    sandbox.destroy();
 
     return new Response("Try /run or /file");
   },

.sandbox/cloudflare/worker-configuration.d.ts

···
 /* eslint-disable */
-// Generated by Wrangler by running `wrangler types` (hash: 6ac4664e0b184e123d5c5ac50212c5b8)
+// Generated by Wrangler by running `wrangler types` (hash: fc7de8dc66857a5a298a86791b7745d0)
 // Runtime types generated with workerd@1.20260205.0 2025-05-06 nodejs_compat
 declare namespace Cloudflare {
 	interface GlobalProps {
···
 		durableNamespaces: "Sandbox";
 	}
 	interface Env {
+		SSH_PRIVATE_KEY: string;
+		SSH_PUBLIC_KEY: string;
 		Sandbox: DurableObjectNamespace<import("./src/index").Sandbox>;
 	}
 }
 interface Env extends Cloudflare.Env {}
+type StringifyValues<EnvType extends Record<string, unknown>> = {
+	[Binding in keyof EnvType]: EnvType[Binding] extends string ? EnvType[Binding] : string;
+};
+declare namespace NodeJS {
+	interface ProcessEnv extends StringifyValues<Pick<Cloudflare.Env, "SSH_PRIVATE_KEY" | "SSH_PUBLIC_KEY">> {}
+}
 
 // Begin runtime types
 /*! *****************************************************************************