I wrote my own agent where
everything happens over SSH.
The shell is SSH, the read_file and write_file tool calls are over SSH
Then I give it a disposable VM and let it go.
There are lots of other solutions, but it's an interesting problem to work on.