Fix: use a plain Record for the built-in tool table

Review feedback: prefer Record<string, BaseTool> over a Map. The lookup
goes through Object.hasOwn so a YAML string naming an inherited member
such as 'constructor' still falls through to findToolOrThrow instead of
resolving to Object.prototype.constructor. Object.hasOwn is already the
guard used elsewhere in this package (test_runner.ts).

Author: Amaad Martin

dev/src/integration/agent_registry.ts

@@ -28,9 +28,10 @@ import {IntegrationRegistry} from './integration_registry.js';
 /**
  * Built-in tools that a YAML config can name directly, mirroring adk-python's
  * `LlmAgent._resolve_tools`, which resolves a bare built-in name to the real
- * tool object.
+ * tool object. Looked up with `Object.hasOwn` so that a YAML string naming an
+ * inherited member such as `constructor` does not resolve to one.
  */
-const BUILTIN_TOOLS = new Map<string, BaseTool>([['exit_loop', EXIT_LOOP]]);
+const BUILTIN_TOOLS: Record<string, BaseTool> = {exit_loop: EXIT_LOOP};
 
 /**
  * Server-side built-ins that are dropped instead of resolved: they are executed
@@ -149,9 +150,8 @@ export class AgentRegistry {
 
       const tools = config.tools
         ?.map((toolConfig) => {
-          const builtinTool = BUILTIN_TOOLS.get(toolConfig.name);
-          if (builtinTool) {
-            return builtinTool;
+          if (Object.hasOwn(BUILTIN_TOOLS, toolConfig.name)) {
+            return BUILTIN_TOOLS[toolConfig.name];
           }
 
           if (SKIPPED_BUILTIN_TOOLS.includes(toolConfig.name)) {

dev/test/integration/agent_registry_test.ts

@@ -293,4 +293,20 @@ describe('AgentRegistry', () => {
 
     expect(retrieved.tools.length).toBe(0);
   });
+
+  it('should not resolve an inherited Object member as a built-in tool', () => {
+    const config = {
+      name: 'bad_agent',
+      model: 'model',
+      description: 'desc',
+      instruction: 'inst',
+      agentClass: 'LlmAgent',
+      tools: [{name: 'constructor'}],
+    } as unknown as YamlAgentConfig;
+
+    agentRegistry.registerAgentConfig('bad_agent', config);
+    expect(() => agentRegistry.getAgent('bad_agent')).toThrow(
+      'Tool constructor not found in registry',
+    );
+  });
 });