Remove image build --from-image; doctor treats catalog images as OK

The `image build` flow spun up a transient Firecracker VM, SSHed in,
and ran a large bash provisioning script to derive a new managed
image from an existing one. It overlapped heavily with the golden-
image Dockerfile flow (same mise/docker/tmux/opencode install logic
duplicated in Go as `imagemgr.BuildProvisionScript`) and had far more
machinery: async op state, RPC begin/status/cancel, webui form +
operation page, preflight checks, API types, tests. For custom
images, writing a Dockerfile is simpler and more reproducible.

Removed end-to-end:
- CLI `image build` subcommand + `absolutizeImageBuildPaths`.
- Daemon: BuildImage method, imagebuild.go (transient-VM orchestration),
  image_build_ops.go (async begin/status/cancel), imagemgr/build.go
  (the 247-line provisioning script generator and all its append*
  helpers), validateImageBuildPrereqs + addImageBuildPrereqs.
- RPC dispatches for image.build / .begin / .status / .cancel.
- opstate registry `imageBuildOps`, daemon seam `imageBuild`,
  background pruner call.
- API types: ImageBuildParams, ImageBuildOperation, ImageBuildBeginResult,
  ImageBuildStatusParams, ImageBuildStatusResult; model type
  ImageBuildRequest.
- Web UI: Backend interface methods, handlers, form, routes, template
  branches (images.html build form, operation.html build branch,
  dashboard.html Build button).
- Tests that directly exercised BuildImage.

Doctor polish (task C):
- Drop the "image build" preflight section entirely (its raison d'être
  is gone).
- Default-image check now accepts "not local but in imagecat" as OK:
  vm create auto-pulls on first use. Only flag when the image is
  neither locally registered nor in the catalog.

Net: 24 files touched, 1,373 lines deleted, 25 added.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

internal/webui/server.go

@@ -43,8 +43,6 @@ type Backend interface {
 	PortsVM(context.Context, string) (api.VMPortsResult, error)
 	ListImages(context.Context) ([]model.Image, error)
 	FindImage(context.Context, string) (model.Image, error)
-	BeginImageBuild(context.Context, api.ImageBuildParams) (api.ImageBuildOperation, error)
-	ImageBuildStatus(context.Context, string) (api.ImageBuildOperation, error)
 	RegisterImage(context.Context, api.ImageRegisterParams) (model.Image, error)
 	PromoteImage(context.Context, string) (model.Image, error)
 	DeleteImage(context.Context, string) (model.Image, error)
@@ -84,16 +82,6 @@ type vmSetForm struct {
 	NATEnabled   bool
 }
 
-type imageBuildForm struct {
-	Name       string
-	FromImage  string
-	Size       string
-	KernelPath string
-	InitrdPath string
-	ModulesDir string
-	Docker     bool
-}
-
 type imageRegisterForm struct {
 	Name         string
 	RootfsPath   string
@@ -126,11 +114,9 @@ type pageData struct {
 	Images              []model.Image
 	Image               model.Image
 	ImageUsers          int
-	ImageBuildForm      imageBuildForm
 	ImageRegisterForm   imageRegisterForm
 	LogText             string
 	VMCreateOperation   *api.VMCreateOperation
-	ImageBuildOperation *api.ImageBuildOperation
 	OperationStatusURL  string
 	OperationSuccessURL string
 	OperationLogPath    string
@@ -197,17 +183,13 @@ func (s *Server) registerRoutes(mux *http.ServeMux) {
 	mux.HandleFunc("POST /vms/{id}/delete", s.wrap(s.handleVMDelete))
 	mux.HandleFunc("POST /vms/{id}/set", s.wrap(s.handleVMSet))
 	mux.HandleFunc("GET /images", s.wrap(s.handleImageList))
-	mux.HandleFunc("GET /images/build", s.wrap(s.handleImageBuildForm))
-	mux.HandleFunc("POST /images/build", s.wrap(s.handleImageBuild))
 	mux.HandleFunc("GET /images/register", s.wrap(s.handleImageRegisterForm))
 	mux.HandleFunc("POST /images/register", s.wrap(s.handleImageRegister))
 	mux.HandleFunc("GET /images/{id}", s.wrap(s.handleImageShow))
 	mux.HandleFunc("POST /images/{id}/promote", s.wrap(s.handleImagePromote))
 	mux.HandleFunc("POST /images/{id}/delete", s.wrap(s.handleImageDelete))
 	mux.HandleFunc("GET /operations/vm-create/{id}", s.wrap(s.handleVMCreateOperationPage))
-	mux.HandleFunc("GET /operations/image-build/{id}", s.wrap(s.handleImageBuildOperationPage))
 	mux.HandleFunc("GET /api/operations/vm-create/{id}", s.wrap(s.handleVMCreateOperationAPI))
-	mux.HandleFunc("GET /api/operations/image-build/{id}", s.wrap(s.handleImageBuildOperationAPI))
 	mux.HandleFunc("GET /api/fs", s.wrap(s.handleFSAPI))
 }
 
@@ -522,42 +504,6 @@ func (s *Server) handleImageList(w http.ResponseWriter, r *http.Request) error {
 	})
 }
 
-func (s *Server) handleImageBuildForm(w http.ResponseWriter, r *http.Request) error {
-	return s.renderImageBuildPage(w, r, imageBuildForm{}, "")
-}
-
-func (s *Server) renderImageBuildPage(w http.ResponseWriter, r *http.Request, form imageBuildForm, formErr string) error {
-	return s.renderPage(w, r, http.StatusOK, "Build Image", "image_build_content", func(data *pageData) error {
-		data.Section = "images"
-		data.ImageBuildForm = form
-		data.ErrorMessage = formErr
-		return nil
-	})
-}
-
-func (s *Server) handleImageBuild(w http.ResponseWriter, r *http.Request) error {
-	if err := s.verifyPOST(w, r); err != nil {
-		return err
-	}
-	allowed, err := s.requireMutationAllowed(r.Context())
-	if err != nil {
-		return err
-	}
-	form, params, err := s.parseImageBuildForm(r)
-	if err != nil {
-		return s.renderImageBuildPage(w, r, form, err.Error())
-	}
-	if !allowed {
-		return s.renderImageBuildPage(w, r, form, "mutating actions are unavailable until `sudo -v` succeeds")
-	}
-	op, err := s.backend.BeginImageBuild(r.Context(), params)
-	if err != nil {
-		return s.renderImageBuildPage(w, r, form, err.Error())
-	}
-	http.Redirect(w, r, "/operations/image-build/"+url.PathEscape(op.ID), http.StatusSeeOther)
-	return nil
-}
-
 func (s *Server) handleImageRegisterForm(w http.ResponseWriter, r *http.Request) error {
 	return s.renderImageRegisterPage(w, r, imageRegisterForm{}, "")
 }
@@ -683,24 +629,6 @@ func (s *Server) handleVMCreateOperationPage(w http.ResponseWriter, r *http.Requ
 	})
 }
 
-func (s *Server) handleImageBuildOperationPage(w http.ResponseWriter, r *http.Request) error {
-	op, err := s.backend.ImageBuildStatus(r.Context(), r.PathValue("id"))
-	if err != nil {
-		return err
-	}
-	return s.renderPage(w, r, http.StatusOK, "Building Image", "operation_content", func(data *pageData) error {
-		data.Section = "images"
-		data.OperationKind = "image"
-		data.ImageBuildOperation = &op
-		data.OperationStatusURL = "/api/operations/image-build/" + url.PathEscape(op.ID)
-		if op.ImageID != "" {
-			data.OperationSuccessURL = "/images/" + url.PathEscape(op.ImageID)
-		}
-		data.OperationLogPath = op.BuildLogPath
-		return nil
-	})
-}
-
 func (s *Server) handleVMCreateOperationAPI(w http.ResponseWriter, r *http.Request) error {
 	op, err := s.backend.VMCreateStatus(r.Context(), r.PathValue("id"))
 	if err != nil {
@@ -709,14 +637,6 @@ func (s *Server) handleVMCreateOperationAPI(w http.ResponseWriter, r *http.Reque
 	return writeJSON(w, api.VMCreateStatusResult{Operation: op})
 }
 
-func (s *Server) handleImageBuildOperationAPI(w http.ResponseWriter, r *http.Request) error {
-	op, err := s.backend.ImageBuildStatus(r.Context(), r.PathValue("id"))
-	if err != nil {
-		return err
-	}
-	return writeJSON(w, api.ImageBuildStatusResult{Operation: op})
-}
-
 func (s *Server) handleFSAPI(w http.ResponseWriter, r *http.Request) error {
 	path := strings.TrimSpace(r.URL.Query().Get("path"))
 	if path == "" {
@@ -977,31 +897,6 @@ func (s *Server) parseVMSetForm(r *http.Request, vm model.VMRecord) (api.VMSetPa
 	return params, nil
 }
 
-func (s *Server) parseImageBuildForm(r *http.Request) (imageBuildForm, api.ImageBuildParams, error) {
-	if err := s.verifyPOST(nilResponseWriter{}, r); err != nil {
-		return imageBuildForm{}, api.ImageBuildParams{}, err
-	}
-	form := imageBuildForm{
-		Name:       strings.TrimSpace(r.FormValue("name")),
-		FromImage:  strings.TrimSpace(r.FormValue("from_image")),
-		Size:       strings.TrimSpace(r.FormValue("size")),
-		KernelPath: strings.TrimSpace(r.FormValue("kernel_path")),
-		InitrdPath: strings.TrimSpace(r.FormValue("initrd_path")),
-		ModulesDir: strings.TrimSpace(r.FormValue("modules_dir")),
-		Docker:     r.FormValue("docker") == "on",
-	}
-	params := api.ImageBuildParams{
-		Name:       form.Name,
-		FromImage:  form.FromImage,
-		Size:       form.Size,
-		KernelPath: form.KernelPath,
-		InitrdPath: form.InitrdPath,
-		ModulesDir: form.ModulesDir,
-		Docker:     form.Docker,
-	}
-	return form, params, nil
-}
-
 func (s *Server) parseImageRegisterForm(r *http.Request) (imageRegisterForm, api.ImageRegisterParams, error) {
 	if err := s.verifyPOST(nilResponseWriter{}, r); err != nil {
 		return imageRegisterForm{}, api.ImageRegisterParams{}, err

internal/webui/server_test.go

@@ -26,7 +26,6 @@ type fakeBackend struct {
 	image    model.Image
 	ports    api.VMPortsResult
 	createOp api.VMCreateOperation
-	buildOp  api.ImageBuildOperation
 }
 
 func (f fakeBackend) Config() model.DaemonConfig { return f.config }
@@ -55,12 +54,6 @@ func (f fakeBackend) SetVM(context.Context, api.VMSetParams) (model.VMRecord, er
 func (f fakeBackend) PortsVM(context.Context, string) (api.VMPortsResult, error) { return f.ports, nil }
 func (f fakeBackend) ListImages(context.Context) ([]model.Image, error)          { return f.images, nil }
 func (f fakeBackend) FindImage(context.Context, string) (model.Image, error)     { return f.image, nil }
-func (f fakeBackend) BeginImageBuild(context.Context, api.ImageBuildParams) (api.ImageBuildOperation, error) {
-	return f.buildOp, nil
-}
-func (f fakeBackend) ImageBuildStatus(context.Context, string) (api.ImageBuildOperation, error) {
-	return f.buildOp, nil
-}
 func (f fakeBackend) RegisterImage(context.Context, api.ImageRegisterParams) (model.Image, error) {
 	return f.image, nil
 }

internal/webui/templates/dashboard.html

@@ -35,7 +35,6 @@
       <h3>Images</h3>
       <div class="stack-inline">
         <a class="button secondary" href="/images/register">Register</a>
-        <a class="button" href="/images/build">Build</a>
       </div>
     </div>
     <table>

internal/webui/templates/images.html

@@ -3,7 +3,6 @@
   <p class="muted">Manage registered rootfs/kernel stacks and promote unmanaged experiments into daemon-owned artifacts.</p>
   <div class="stack-inline">
     <a class="button secondary" href="/images/register">Register Image</a>
-    <a class="button" href="/images/build">Build Image</a>
   </div>
 </div>
 <table>
@@ -32,48 +31,6 @@
 </table>
 {{end}}
 
-{{define "image_build_content"}}
-<p class="muted">Build a managed image from an existing registered image, then redirect into the async build progress view.</p>
-{{if .ErrorMessage}}
-<div class="inline-error">{{.ErrorMessage}}</div>
-{{end}}
-<form method="post" action="/images/build" class="form-grid">
-  {{template "csrf_field" .}}
-  <label><span>Name</span><input type="text" name="name" value="{{.ImageBuildForm.Name}}" placeholder="generated when empty"></label>
-  <label><span>From Image</span><input type="text" name="from_image" value="{{.ImageBuildForm.FromImage}}" placeholder="image id or name"></label>
-  <label><span>Size Override</span><input type="text" name="size" value="{{.ImageBuildForm.Size}}" placeholder="optional"></label>
-  <label class="picker-field">
-    <span>Kernel Path</span>
-    <div class="picker-input">
-      <input type="text" name="kernel_path" value="{{.ImageBuildForm.KernelPath}}" data-picker-input>
-      <button type="button" class="button secondary" data-picker-target="kernel_path" data-picker-kind="file">Browse</button>
-    </div>
-  </label>
-  <label class="picker-field">
-    <span>Initrd Path</span>
-    <div class="picker-input">
-      <input type="text" name="initrd_path" value="{{.ImageBuildForm.InitrdPath}}" data-picker-input>
-      <button type="button" class="button secondary" data-picker-target="initrd_path" data-picker-kind="file">Browse</button>
-    </div>
-  </label>
-  <label class="picker-field">
-    <span>Modules Directory</span>
-    <div class="picker-input">
-      <input type="text" name="modules_dir" value="{{.ImageBuildForm.ModulesDir}}" data-picker-input>
-      <button type="button" class="button secondary" data-picker-target="modules_dir" data-picker-kind="dir">Browse</button>
-    </div>
-  </label>
-  <label class="checkbox">
-    <input type="checkbox" name="docker" {{if .ImageBuildForm.Docker}}checked{{end}}>
-    <span>Install Docker</span>
-  </label>
-  <div class="form-actions">
-    <a class="button secondary" href="/images">Cancel</a>
-    <button class="button" type="submit" {{if not .MutationAllowed}}disabled{{end}}>Build Image</button>
-  </div>
-</form>
-{{end}}
-
 {{define "image_register_content"}}
 <p class="muted">Register an existing host-side image stack. Paths stay on the host; nothing is uploaded through the browser.</p>
 {{if .ErrorMessage}}

internal/webui/templates/operation.html

@@ -1,16 +1,11 @@
 {{define "operation_content"}}
 <section class="operation-card" data-operation-url="{{.OperationStatusURL}}" {{if .OperationSuccessURL}}data-operation-success="{{.OperationSuccessURL}}"{{end}}>
-  <h2>{{if eq .OperationKind "vm"}}VM readiness{{else}}Managed image build{{end}}</h2>
+  <h2>VM readiness</h2>
   {{if .VMCreateOperation}}
   <h3 id="operation-stage">{{.VMCreateOperation.Stage}}</h3>
   <p id="operation-detail">{{.VMCreateOperation.Detail}}</p>
   <p class="muted" id="operation-error">{{.VMCreateOperation.Error}}</p>
   {{end}}
-  {{if .ImageBuildOperation}}
-  <h3 id="operation-stage">{{.ImageBuildOperation.Stage}}</h3>
-  <p id="operation-detail">{{.ImageBuildOperation.Detail}}</p>
-  <p class="muted" id="operation-error">{{.ImageBuildOperation.Error}}</p>
-  {{end}}
   {{if .OperationLogPath}}
   <p class="muted">Build log: <code id="operation-log">{{.OperationLogPath}}</code></p>
   {{else}}