Sidebar ↔ CLI parity (1:1)

Every verb in the Cloud sidebar has a CLI verb that goes through the same socket method and the same app code path (SurfaceCatalog, the machine's CmuxTuiSurfaceProvider). An agent can do anything a person can do from the sidebar, and a sidebar action never does something the CLI cannot. Ids come from cmux vm tree --json / cmux surface ls --json (<machine>/<kind>/<key>, ws_…, term_…).

Rules that keep it 1:1:

• One machine, many workspaces; four groups. A machine is the big box; its cmux-tui workspaces are rows under it, never machines of their own. Under a connected machine, in this order: Workspaces (always its own row — with one workspace, with none, a "No workspaces yet" line under it — so its ＋, cmux vm workspace new, is one click away; a workspace row shows its own name, never a folded "Workspaces / name" breadcrumb, and lists exactly its layout: the terminals with a tab in it, its browsers, its screen), Ports, VNC Displays (one row per screen), and last, its own section, Terminals (every terminal resource the machine owns, one row per identity, badge = daemon tabs, detached ones greyed; always present so its ＋ is New Terminal, "No terminals yet" under it when empty). cmux vm tree prints the same sequence — workspaces, ports, one row per VNC display, then the final terminals/ section (with its detached subgroup); the Terminals section is the sidebar's flat index of what those lines already name. A daemon browser with neither a workspace tab nor a port has no group of its own.
• A mirrored local workspace edits its machine workspace. A local workspace bound to a machine workspace (vm workspace open, workspace.cloud_vm_bind) is that workspace's view: moving a pane into it re-parents the tab (tab.move; a pool terminal gets a tab with terminal project), closing a terminal pane in it closes the tab (tab.close: the terminal detaches, only terminal close kills), and closing the local workspace (⌘⇧W, window close) leaves the machine workspace untouched. Viewer panes in unbound workspaces never touch the layout (CloudPlacementCoordinator).
• A workspace folder is its layout. A terminal whose tab in the workspace closed (or whose workspace closed with vm workspace close) has left the workspace: no row lingers under it. It keeps running on the machine, so the Terminals group still lists it, greyed as "detached", where a click re-attaches it and Kill Terminal… ends it. Exited records with stale unresolved tab ids remain ordinary exited rows, not detached ones.
• A sidebar verb is implemented as a closure in CloudTreeNodeActions that calls the catalog/provider; the matching socket handler in SurfaceSocketCommands calls the same catalog/provider method. Adding a sidebar verb without a socket method is a parity bug.
• --focus false means the same on vm new, vm base open, and vm open: open the surface where it belongs, never select its workspace or move keyboard focus out of the workspace the person is in (a pane is still focused when its workspace is the one already on screen). The New Machine / Set Up Base sheets always create this way; the success notification's click goes to the new workspace.
• Placement flags mean the same everywhere: --pane <p> + side = split that pane on that side; --tab / --tabs = tabs in that pane; nothing = the focused pane of the current (or --workspace) local workspace; --new = never reuse a pane that already shows the surface.
• Ports are a first-class group in the tree when a machine exposes listening ports; the CLI and sidebar use the same port-open path. A canonical browser/port:<n> resource stays in the owning machine's Ports group even when the daemon also reports it inside a cloud workspace, where the workspace pointer uses the same resource id.
• Agent-only primitives (cmux vm terminal send|read|wait → vm.terminal_write|read|wait, plus exec, push, pull, route, run, agent, layout export|apply, env) have no sidebar verb by design: a person does those things by typing into a pane or by arranging panes. They still go through the machine's CmuxTuiSurfaceProvider, so what an agent types headlessly shows up in every pane projecting that terminal.

Existing machine-to-machine links are agent-only: the source machine's in-VM cmux vm shim uses the remote-daemon verbs without a control-plane credential. This build cannot create new peer grants; the old vm link enrollment broker is not part of the trusted private-network listener flow. Inside a machine the shim also speaks the Mac's own spellings for its local session (cmux send-key, cmux terminal send|read|wait, cmux new-workspace, cmux layout …, cmux env …, cmux tree), so an agent in the cloud drives its machine — and, through a link, a peer machine — with the verbs it already knows from the Mac.