Masking fields 🧵

[haughty plume]

@hazy shore @wintry anvil so... can one of you (or both) help with this? 😇

[uncut umbra]

I can help too if more bandwidth needed

[hazy shore]

i can help, but at the cost punting the 3rd party mcp PoC down the road even further

i've said im gonna do this thing in every standup for over a month lmao, but there is always something more high prio

[haughty plume]

Thanks guys - sorry for the distractions

@uncut umbra it might be fastest for you since it involves module loading internals, I can give you a quick overview and you can decide how delegatable it is?

[uncut umbra]

Sure yeah, we want to just not expose certain hardcoded APIs as tools? I know Secret.plaintext was one, but guessing there's others?

[hazy shore]

no worries, honestly, they've felt high impact and also highly educational

[haughty plume]

There's 2 parts to it. One for core types, one for module types

• 1. Module types: in the MCP implementation, at any given time there is one selected object. Each function of that object gets exposed as a tool, 1-1. whether they are field getters or actual functions.

As an optimization we want to change that: continue to show actual functions, but hide field getters

The issue is that we do this by introspecting at the dagql layer, which I believe doesn't make that distinction. So the trick is to cleanly get the missing info.

https://github.com/shykes/dagger/blob/environment-api/core/mcp.go#L171

(this is the branch where we're all developing at the moment)

this part of the code probably works the same in main, but why take the risk 🙂

(actually you're probably safe doing it in main, whatever works)

[uncut umbra]

Yep makes sense, I'll start there off that branch

[haughty plume]

Oh also @uncut umbra quick internals question...

Given a core.Query is it easy to get the corresponding dagql.Object ie. dagql.Server.Root() ?

I feel like I've already asked that question in the past 😅

[uncut umbra]

dagql.Server.Root() is a dagql.Instance[*core.Query], so if you have the Instance already then you are done.

If you have a plain *core.Query and need to wrap it in a dagql.Instance, then it's possible to do, let me check the exact syntax

[uncut umbra]

I guess in order to create the dagql.Object you'd need to plumb around a dagql.Server, but at that point you can get the dagql.Object by just calling dagql.Server.Root() anyways.

So while I'm lacking context, it seems like whatever you're doing you should just be either plumbing around dagql.Instance[*core.Query] and/or plumbing around the dagql.Server rather than ending up in a situation where you have a plain *core.Query anyways

[wintry anvil]

Seems Erik is taking it -- happy to help on this or other things if needed

[haughty plume]

@wintry anvil there is a 2nd part of masking which you could take 🙂

[uncut umbra]

Is there a good example to test this with here? I have an implementation

[haughty plume]

2. Core types: in the MCP implementation, we expose 100% of all functions of all core types. But, maybe we don't need them all... So, we could make a list of functions to hide, and hardcode that list in the MCP implementation.

For example Container has all this:

as-service
as-tarball
build
default-args
directory
entrypoint
env-variable
env-variables
exit-code
experimental-with-all-gp-us
experimental-with-gpu
export
exposed-ports
file
from
image-ref
import
label
labels
mounts
platform
publish
rootfs
stderr
stdout
sync
terminal
up
user
with-annotation
with-default-args
with-default-terminal-cmd
with-directory
with-entrypoint
with-env-variable
with-exec
with-exposed-port
with-file
with-files
with-label
with-mounted-cache
with-mounted-directory
with-mounted-file
with-mounted-secret
with-mounted-temp
with-new-file
with-registry-auth
with-rootfs
with-secret-variable
with-service-binding
with-unix-socket
with-user
with-workdir
without-annotation
without-default-args
without-directory
without-entrypoint
without-env-variable
without-exposed-port
without-file
without-files
without-label
without-mount
without-registry-auth
without-secret-variable
without-unix-socket
without-user
without-workdir
workdir

[uncut umbra]

I sent out a PR for the masking of user object fields: https://github.com/dagger/dagger/pull/10024

It did indeed seem detached enough from the other changes that I could just merge it separately. But lemme know if it's easier to just push as a commit to the environment-api branch @haughty plume

[haughty plume]

Thank you!

[uncut umbra]

Happy to help more if possible, just lemme know

[haughty plume]

I think we're going to need a release soon.. Once we have this batch of improvements out, we'll want to get it in people's hands for testing

[thorn island]

That’s awesome @uncut umbra !