[Bug] No published server image includes the modal sandbox provider extra

[evangineer]

Description

The modal managed-sandbox provider (sandbox.provider: modal server config, omnigent/onboarding/sandboxes/modal.py) ships in the base package, but no published server image can run it: deploy/docker/Dockerfile's server-builder stage builds with OMNIGENT_EXTRAS= (empty by default), and the .github/workflows/oss-publish-images.yml matrix only publishes extras-variants for openshell and kubernetes. There is no omnigent-server-modal variant, so ModalSandboxLauncher's lazy import modal has nothing to import in any officially published server image.

This is the same class of gap reported for openshell in #1151 and fixed by publishing ghcr.io/omnigent-ai/omnigent-server-openshell in #1190, then repeated for kubernetes (omnigent-server-kubernetes) in #2124. No equivalent exists for modal.

Likely why this hasn't surfaced before: deploying the server itself onto Modal via deploy/modal/modal_app.py sidesteps it — that file's comments note Modal injects its own client runtime into any image it builds. The gap only bites deployments that run the server elsewhere (bare Docker / any other platform) and want Modal purely as a managed-sandbox provider, per deploy/modal/README.md's "Server-managed sandboxes" section.

Expected behavior

Either:

• Publish a ghcr.io/omnigent-ai/omnigent-server-modal image variant (base server + modal extra), mirroring the CI pattern fix(infra): publish omnigent-server-openshell image and wire overlay to it #1190 / feat(images): publish a kubernetes server image variant (omnigent-server-kubernetes) #2124 established, with deploy/modal/README.md's server-managed-sandboxes section pointed at it; or
• Explicitly document that a self-built image (--build-arg OMNIGENT_EXTRAS=modal) is required whenever the server doesn't run on Modal itself.

Steps to reproduce

1. Deploy the server anywhere other than Modal (e.g. plain docker compose with ghcr.io/omnigent-ai/omnigent-server:latest).
2. Set sandbox: {provider: modal, server_url: ..., modal: {secrets: [...]}} in the server config (<data_dir>/config.yaml).
3. Create a session with "host_type": "managed".
4. Expect the launch to fail on the lazy import modal inside ModalSandboxLauncher, since the running image was never built with OMNIGENT_EXTRAS=modal.

Version

main, confirmed by reading deploy/docker/Dockerfile and .github/workflows/oss-publish-images.yml as of 2026-07-24 — have not yet reproduced the runtime failure end-to-end.

[omnigent-ci]

🤖 Automated triage

• Bot assessment: Medium impact
• Priority: P2-medium
• Why: Published server images cannot provision Modal-managed sandboxes for deployments outside Modal, but users can mitigate by building the image with OMNIGENT_EXTRAS=modal.

This automated assessment uses the issue content and repository signals. Maintainers can override the priority label.