[Bug]: Handoff budget counts stored history as 1 token per byte, and ACP registry agents fall back to a 128k window#23144

opened6d agobyKKainoa Newton

Summary

Follow-up to #22637, which was closed with a request to file the remaining part separately. Some providers don't report token usage (Factory Droid via the ACP registry, and Cursor). For those, the handoff budget relies on T3's own estimate. That estimate runs about 3–4× too high, so switching providers fails with "Insufficient context allowance" while the model still has plenty of room.

Area

apps/server

Still true on main @ b5a226e49c

  1. nativeContextEstimate (apps/server/src/orchestration-v2/ProviderTurnStartService.ts) counts each byte of historicalMessage(item).text as one token, and that includes command_execution output. Normal text averages about 3–4 bytes per token. In #19875, 274 KB of a 354 KB estimate was command output.
  2. ACP registry agents have no getModelContextWindow, so handoffBudget() (packages/provider-core/src/server/handoffBudget.ts) uses 128_000 unless the agent sends a usage_update with a size. Factory doesn't send one. With a 32k reserve, a switch is blocked once stored history passes about 96 KB.

Steps to reproduce

  1. Run a few Factory Droid (ACP registry) turns that produce large command output.
  2. Switch the thread to another provider and send a message.
  3. Switch back and send again. The second switch fails with "Insufficient context allowance".

Expected behavior

The estimate stays reasonably close to real usage, so the switch goes through when the model has room.

Possible directions

These are ideas, not a spec:

  • Convert bytes to tokens at a conservative ratio.
  • Cap or down-weight tool output.
  • Use a window size the ACP agent exposes, or a per-instance setting.
  • Warn instead of hard-blocking when usage is only an estimate.

Version or commit

Nightly 0.0.46-nightly.20261014.3132. Code references are to main @ b5a226e49c.

Environment

macOS arm64, Factory Droid 0.228.0 via the ACP registry, Cursor

Verification blocked on this Linux triage VM: Factory Droid and Cursor executables and configuration are absent. The reported Factory ACP provider-switch sequence was not run. Leaving open for verification with an authenticated Factory ACP provider.