[albertvillanova]

Refactor agent/model deserialization: Replace importlib with registry pattern.

Problem

The MultiStepAgent.from_dict() method currently uses importlib.import_module() with getattr() to dynamically load model and agent classes.

Issues with current approach:

1. Security vulnerability: User-supplied strings from dicts can potentially inject arbitrary class names
2. No validation: No check that class exists or is appropriate before instantiation
3. Testing complexity: Requires complex mocking
4. Tight coupling: Hardcoded module names
5. Implicit contract: Supported classes not documented in code
6. Poor error messages: No helpful feedback when class name is invalid

Solution: Registry Pattern

Implement explicit registries similar to the existing TOOL_MAPPING pattern in default_tools

Changes

1. Added MODEL_REGISTRY

   • Created explicit registry mapping model class names to their actual classes
   • Includes all 9 concrete model classes: VLLMModel, MLXModel, TransformersModel, LiteLLMModel, LiteLLMRouterModel, InferenceClientModel, OpenAIModel, AzureOpenAIModel, AmazonBedrockModel
   • Prevents arbitrary code execution via importlib

2. Added AGENT_REGISTRY

   • Created explicit registry for agent classes
   • Includes: ToolCallingAgent, CodeAgent
   • Provides secure whitelist for agent deserialization

3. Refactored Deserialization Methods

   • MultiStepAgent.from_dict(): Now uses MODEL_REGISTRY and AGENT_REGISTRY with proper error handling
   • MultiStepAgent.from_folder(): Now uses AGENT_REGISTRY for loading managed agents
   • Added helpful error messages that list all supported classes when an invalid class name is provided

4. Updated Tests

   • Simplified test mocking: removed complex importlib mocking
   • Updated 4 existing tests to use registry-based mocking with patch.dict()
   • Added 2 new test cases for error handling:
     • test_from_dict_invalid_model_class: validates error messages for invalid model classes
     • test_from_dict_invalid_agent_class: validates error messages for invalid agent classes

[aymeric-roucher]

Thank you!