feat(hybrid-gateway): integrate muse-cli with Cloudflare netns isolation, symmetric sidechat routing, and 646-pip sync unblock

bin/muse-cli-node

@@ -0,0 +1,49 @@
+#!/usr/bin/env bash
+# muse-cli-node <node> <muse-cli-args...>
+# Runs muse-cli inside the node's isolated network namespace with its own
+# dedicated Cloudflare WARP egress identity and isolated cookies/config.
+# Auto-refreshes cookies via Chromium CDP if authentication fails.
+set -euo pipefail
+
+NETVM_BIN="$(cd "$(dirname "$0")" && pwd)"
+NODE="${1:?usage: muse-cli-node <node> [args...]}"
+shift
+
+CONF_DIR="$HOME/.config/muse-cli/$NODE"
+mkdir -p "$CONF_DIR"
+
+run_cli() {
+    export MUSE_CONFIG_DIR="$CONF_DIR"
+    "$NETVM_BIN/netvm-exec.sh" "$NODE" -- python3 -c "
+import os, sys
+os.environ['MUSE_CONFIG_DIR'] = '$CONF_DIR'
+import muse_cli.cli as cli
+cli.CONFIG_DIR = '$CONF_DIR'
+cli.CONFIG_FILE = os.path.join('$CONF_DIR', 'config.json')
+cli.COOKIES_FILE = os.path.join('$CONF_DIR', 'cookies.txt')
+try:
+    cli.main()
+except SystemExit as e:
+    sys.exit(e.code)
+" "$@"
+}
+
+# First attempt
+set +e
+OUTPUT=$(run_cli "$@" 2>&1)
+RC=$?
+set -e
+
+# Detect authentication failure and trigger single auto-refresh retry
+if [ $RC -ne 0 ] && echo "$OUTPUT" | grep -qiE "AuthError|hatch_sess|401|unauthorized"; then
+    echo "Notice: Auth failure detected for $NODE; refreshing cookies from Chromium CDP..." >&2
+    if "$NETVM_BIN/netvm-exec.sh" "$NODE" -- python3 "$NETVM_BIN/refresh-node-cookies.py" "$NODE"; then
+        echo "Notice: Cookies refreshed for $NODE. Retrying operation..." >&2
+        run_cli "$@"
+        exit $?
+    fi
+fi
+
+# If succeeded or failed on something else, emit output and exit with RC
+echo "$OUTPUT"
+exit $RC