CodeDelegator: Mitigating Context Pollution via Role Separation in Code-as-Action Agents

1 Introduction

The integration of external tools into Large Language Models (LLMs) marks a fundamental advance, enabling complex problem-solving through real-world interaction [Qu et al., 2025; Liu et al., 2025b]. ReAct [Yao et al., 2023] exemplifies this capability through an iterative Thought-ActionObservation loop. However, ReAct-based frameworks typically represent actions as JSON or structured text, which constrains their expressiveness to predefined schemas and leads to linearly increasing context length, thereby reducing execution efficiency (Fig. 1(a)). The "code-as-action" paradigm (e.g., CodeAct [Wang et al., 2024b]) addresses this by adopting executable Python as a unified action representation, naturally supporting control flow, variable management, and multi-tool composition within a single step.

However, when handling real-world, long-horizon tasks that interact with complex environments and humans, codeas-action agents encounter a fundamental tension. Consider a task "analyze competitor iPhone 15 pricing data and generate a market report": the agent must strategically decompose this into sub-tasks (data collection, data cleaning, analysis report generation) and reason about dependencies. For each subtask, it must generate syntactically correct code with proper API calls and error handling. These objectives compete for attention within a fixed context window, where later tokens progressively overshadow earlier content [Liu et al., 2024]. Moreover, planning requires abstract reasoning, while implementation demands fine-grained attention to detail. When interleaved, planning steps and debugging traces accumulate in shared context. We refer to this as context pollution: the progressive dilution of task-relevant information that degrades both planning and implementation capabilities (Fig. 1(b)).

To address this tension, we propose CODEDELEGATOR, which decouples strategic planning from code implementation through role separation (Fig. 2). A Delegator maintains strategic focus: decomposing complex tasks, analyzing dependencies, monitoring progress, and dynamically dispatching work, without ever writing implementation code. Ephemeral Coders execute assigned sub-tasks through an interactive loop: generating code, observing execution results, diagnosing errors, and iteratively refining until completion. Each Coder is spawned by the Delegator with a fresh context containing only task-relevant information, preventing accumulation of irrelevant history from other sub-tasks. A key challenge is enabling effective coordination without reintroducing context pollution. We address this through Ephemeral-Persistent State Separation (EPSS), a duallayer workspace providing code-aware isolation beyond mere conversation separation. The Delegator governs a persistent Orchestration Layer containing global state, task plans, and committed results. Each Coder operates in an ephemeral execution sandbox where debugging traces and local variables remain confined and are discarded upon completion. Structured schemas govern all inter-agent communication, replacing lossy natural language summaries with typed specifications. Our contributions are as follows:

• We identify and empirically characterize the context pollution problem in code-as-action agents (§ 3).
• We propose CODEDELEGATOR (§ 4), a targeted isola-

tion mechanism for code-as-action agents comprising: (a) ephemeral workers that prevent cross-subtask pollution, (b) asymmetric schema-constrained communication that filters execution noise, and (c) EPSS for codeaware dual-layer state separation; distinct from generic planner-executor orchestration in general multi-agent frameworks.

• Experiments (§ 5) on τ 2 -bench and MCPMark demonstrate that CODEDELEGATOR achieves substantial improvement over baselines.

2 RelatedWork

The remarkable reasoning capabilities of Large Language Models have spurred research into autonomous agents that use tools to solve complex tasks [Wei et al., 2022; Huang et al., 2022; Yao et al., 2023; Qu et al., 2025]. The planexecute-observe loop introduced by ReAct [Yao et al., 2023] has become foundational for many agent systems [Yang et al., 2023; Wu et al., 2024; Zhang et al., 2024; Hu et al., 2025].

2.1 Code-as-Action LLMAgents

CodeAct [Wang et al., 2024b] demonstrates that executable Python code naturally supports control flow, variable management, and multi-tool composition, outperforming ReAct on complex tasks. This paradigm has been adopted by OpenHands [Wang et al., 2025], SWE-agent [Yang et al., 2024], and Voyager [Wang et al., 2024a]. Recent work explores hierarchical code generation to enhance planning ability in codeas-action agents. Liu et al. generates abstract code skeletons for progressive refinement. Yu et al. introduces recursive decomposition of placeholder functions. These approaches address what to implement versus how. However, planning and implementation still share a single context, so debugging traces from implementing step i accumulate when planning step i+1. CODEDELEGATOR addresses an orthogonal isolation concern: the Delegator and Coders operate in separate contexts, ensuring that no implementation detail, regardless of abstraction level, ever reaches the planning process.

2.2 Multi-Agent Collaboration

Multi-agent collaboration leverages specialized roles for complex tasks, as exemplified by AutoGen [Wu et al., 2024], MetaGPT [Hong et al., 2023], and CAMEL [Li et al., 2023]. However, Cemri et al. identified recurring coordination failures including specification drift, inter-agent misalignment, and verification gaps. CODEDELEGATOR differs from these frameworks by targeting context pollution specifically: agents are ephemeral rather than persistent, communication is structurally asymmetric via typed schemas, and isolation operates at the runtime level (namespace, interpreter, artifacts), not merely at the conversation-history level.

3 Understanding Context Pollution in Code-as-Action Agents

We define context pollution in code-as-action agents as the progressive dilution of task-relevant information in shared context: debugging traces from sub-task si persist during sj, competing for attention when they are irrelevant. To validate that pollution, not task difficulty alone, limits code-as-action agents, we conduct a pilot study on CodeAct.

Setup. We evaluate CodeAct on 50 tasks from the airline domain of τ 2 -Bench [Barres et al., 2025], with both the agent and the simulated user powered by DeepSeekV3.2 [DeepSeek-AI et al., 2025]. We record task success, final context length, and cumulative code execution errors, and stratify tasks by intrinsic complexity to disentangle pollution from task difficulty.

Task Complexity. We compute the average success rate of four official τ 2 -bench (airline) baselines-Claude-3.7Sonnet [Anthropic, 2025], GPT-4.1 [OpenAI, 2025a], GPT4.1-mini [OpenAI, 2025a], and o4-mini [OpenAI, 2025c]. Each model is evaluated over 4 independent runs, yielding 16 trials per task. We categorize tasks into Low (SR ≥ 75%, 17 tasks), Medium (25%<SR<75%, 20 tasks), and High (SR ≤ 25%, 13 tasks).

Results. Table 1 shows that CodeAct incurs more context length across all difficulty levels compared to ReAct. However, this overhead yields inconsistent returns: CodeAct underperforms ReAct on Low (-5.8%) and Medium (-2.5%) difficulty tasks, while outperforming on High difficulty tasks (+7.7%). Fig. 3 provides further insight: within the CodeAct runs, context length negatively correlates with success on both Low and High difficulty tasks.

Analysis. This pattern reveals where code-as-action provides value and where it incurs cost: the additional context is pure overhead on simpler tasks, but pays off on complex ones requiring multi-step logic. Yet even on High tasks, the absolute success rate remains low (26.9%) and context length is substantial (21.1K tokens). The negative correlation between context length and success within High-difficulty tasks suggests that cross-sub-task trace accumulation still degrades performance, even when code flexibility helps. This motivates CODEDELEGATOR: retain the expressiveness benefits of code-as-action for complex sub-tasks while isolating each sub-task's execution to prevent traces from polluting subsequent planning.

4 Methodology

CODEDELEGATOR separates strategic planning from code implementation via role specialization: a persistent Delegator orchestrates task decomposition, while ephemeral Coders execute atomic sub-tasks in isolated contexts, coordinated through Ephemeral-Persistent State Separation (EPSS). Fig. 4 gives an overview. Our design follows four principles derived from the pilot study (§3). (P1) Orchestrate without accumulation: the Delegator tracks what is accomplished via workspace state, never how, keeping its context bounded to O(n) task-structure summaries. (P2) Fresh context per sub-task: each Coder starts empty, receives only its specification plus designated inputs, and is discarded with all traces upon returning a structured result. (P3) Context-runtime decoupling: the reasoning context, sandboxed runtime, and persistent artifact store are separated, with inter-module communication using typed object references rather than printed strings to preserve type fidelity and avoid namespace collisions. (P4) Schema-driven communication: specifications (σi) and results (ρi) use typed schemas-downward: directive, inputs, return schema; upward: status, artifacts, summary, diagnostics-enforcing asymmetry between complete spec and filtered result. The rest of this section instantiates these principles through the agent architecture (§4.1), the EPSS workspace (§4.2), and the execution protocol (§4.3).

4.1 Agent Architecture

CODEDELEGATOR employs two agent types with asymmetric responsibilities, lifespans, and context access patterns.

Delegator Agent. The Delegator is a long-lived agent that maintains strategic oversight throughout the task lifecycle. It performs three core functions:

• Task Decomposition. Given a complex task T , the Delegator decomposes it into a sequence of sub-tasks S = {s1, . . . , sn}. It is instructed to identify logical sub-units that can be implemented independently, spec-

ify their execution order, and ensure each sub-task has a clear completion criterion. The decomposition satisfies atomicity and verifiability: each sub-task is small enough to complete within a single Coder session and has a clear expected outcome that the Delegator can assess upon completion. If a sub-task later proves too complex, the REPLAN mechanism allows dynamic redecomposition.

• Sub-task Delegation. For each sub-task si, the Delegator constructs a structured specification σi = (Di, Ii,Ri), where Di is a directive describing the goal and constraints in natural language; Ii denotes input bindings as references to Orchestration Layer objects, annotated with type, shape, and sample values; and Ri is a return schema specifying expected output names, types, and validation conditions. The Delegator then dispatches σi to a freshly initialized Coder.
• Adaptive Progress Control. After each Coder terminates, the Delegator assesses the structured result ρi (§4.1) to determine whether the sub-task has been satisfactorily completed, based on the reported status, output summary Mi, and error diagnostics Ei. It then selects one of three actions: (i) PROCEED-commit the successful Coder's outputs to the Orchestration Layer and advance to the next sub-task; (ii) RETRY-spawn a new Coder with a refined specification when the failure is judged recoverable (typically specification ambiguity or missing context rather than fundamental decomposition flaws); (iii) REPLAN-revise the overall task decomposition when failure is attributed to structural issues or the retry limit is reached.

Coder Agent. Each Coder is a short-lived specialist implementing exactly one atomic sub-task. Its defining characteristic is context isolation: it inherits no history from the Delegator's planning process or sibling Coders' implementations.

• Interactive Execution. A freshCoder receives the specification σi, runtime access to designated input variables, and an isolated execution environment. It operates in an interactive loop analogous to computational notebooks: generate code, execute, observe outputs or errors, and refine based on feedback-using runtime errors as actionable signals for iterative refinement. The loop terminates when the Coder produces all outputs specified in Ri, encounters an unrecoverable error, or exhausts its iteration budget K.
• Structured Result. Upon completion, each Coder returns a structured result ρi = (Si,Ai,Mi, Ei): Si ∈ {SUCCESS, FAIL} is the completion status; Ai contains output artifacts as references to Python objects satisfying Ri (populated only on SUCCESS); Mi is a concise summary of the outcome; and Ei provides brief error diagnostics with root-cause explanation (only on FAIL). Critically, full execution histories, intermediate code cells, debugging traces and failed attempts are not returned-they are discarded with the Coder instance, enforcing asymmetric information flow that prevents context pollution. The structured diagnostics Ei summarize root causes and failed operations, preserving what the Delegator needs to decide between RETRY and REPLAN while filtering implementation noise.

4.2 Ephemeral-Persistent State Separation

A naive approach-simple context separation-gives each agent an independent conversation history. However, codeas-action agents require deeper isolation: they exchange actual Python objects that lose fidelity when described as text, operate in interpreter namespaces where variable collisions cause subtle bugs, and generate verbose traces that must be filtered rather than merely truncated. We propose Ephemeral-Persistent State Separation (EPSS), a codeaware dual-layer architecture isolating conversation context, execution namespace, and runtime artifacts.

Orchestration Layer (Persistent). As illustrated in Fig. 4, the Delegator maintains a session-wide workspace providing task tracking, typed artifact storage, and event logging. It contains: (i) the task specification T and decomposition S with per-sub-task status tracking; (ii) committed artifacts, i.e., Python objects from successful Coders, indexed by name with type annotations; and (iii) a progress journal recording outcome summaries. Artifacts are stored as actual objects, not textual descriptions. When sub-task 2 produces df clean, subsequent Coders receive the DataFrame itself, preserving type, shape, and content without lossy natural language encoding.

Execution Layer (Ephemeral). Each Coder operates in an isolated Python runtime that provides: (i) namespace isolation-variables do not collide across Coders or persist across retries; (ii) trace confinement-stack traces, print outputs, and intermediate results remain local; and (iii) clean state-a

Sub-task 2: Clean and normalize pricing data

Directive: Remove duplicate rows by product id. Forwardfill missing price values; drop rows where product id is null. Convert all prices to USD using provided exchange rates.

Inputs: df raw (pd.DataFrame, shape 847 × 12); exchange rates (Dict[str, float])

Return: df clean (pd.DataFrame, no nulls in price or product id, prices in USD)

⇓ Coder executes and returns

Result ρ2: Clean and normalize pricing data

Status: SUCCESS

Artifacts: df clean (pd.DataFrame, shape 821 × 12, no nulls in price or product id)

Summary: Deduplicated, forward-filled missing prices, converted to USD.

Error: None

Figure 5: Asymmetric communication example. Top: specification σi sent to Coder. Bottom: structured result ρi returned to Delegator. Debugging traces remain confined to the Execution Layer.

deterministic environment without pollution from prior executions. Upon termination, the runtime is discarded entirely; only the structured result ρi, containing artifact references, returns to the Delegator.

Typed, Asymmetric Communication. Unlike systems relying on natural language handoffs, EPSS uses schema-driven messaging, as shown in Fig. 5. Communication is structurally asymmetric: downward, the Delegator sends a specification σi with typed input bindings (object references plus annotations); upward, the Coder returns a result ρi with artifact references, summary, and diagnostics, but no raw execution traces. This enables Coders to manipulate large objects without printing them into context, while the Delegator maintains a compact O(n) planning state. Table 2 summarizes how the Orchestration and Execution Layers differ in lifecycle, state management, information flow, and access control.

Algorithm 1 CODEDELEGATOR Execution Protocol

Require: Task T , retry budget R, iteration budget K Ensure: Orchestration Layer W or FAILURE 1: S ← DECOMPOSE(T ) 2: W ← ∅ 3: while S has pending sub-tasks do 4: si ← next pending sub-task in S 5: resolved ← FALSE 6: for r ← 1 to R do 7: σi ← GENSPEC(si, W) 8: ρi ← EXECCODER(σi, K) 9: if ρi.S = SUCCESS then 10: W ← W ∪ ρi .A 11: resolved ← TRUE 12: break 13: else if ISRECOVERABLE(ρi.E) then 14: continue ▷ Retry with refined spec 15: else 16: S ← REPLAN(S, si, ρi.E) 17: resolved ← TRUE ▷ Handled via replan 18: break 19: end if 20: end for 21: if ¬resolved then 22: return FAILURE(si, ρi.E) 23: end if 24: end while 25: returnW

4.3 Execution Protocol

Algorithm 1 summarizes the end-to-end execution protocol. The Delegator first decomposes task T into sub-tasks S = {s1, . . . , sn}. For each sub-task whose dependencies are satisfied, it generates a specification σi and spawns a fresh Coder, which tackles the sub-task through iterative coding with tool invocations until either success or the iteration budget K is exhausted. Based on the returned status and error diagnostics Ei, the Delegator evaluates completion and decides the next action: on success with evaluation criteria met, it commits the artifacts to the Orchestration Layer and proceeds to the next sub-task; on failure or unmet criteria, it analyzes the diagnostics-if the issue is resolvable through specification refinement, it retries with a fresh Coder instance; otherwise, it invokes REPLAN to split the problematic sub-task, add missing dependencies, or reformulate requirements. Execution terminates successfully when all sub-tasks complete, or fails when retry or replan budgets are exhausted.

5 Experiments

5.1 Experiment Setup

Environments. We evaluate CODEDELEGATOR under two interaction paradigms. (1) Human-Agent-Environment interaction (HAE) (§5.2): the agent converses with users while invoking tools to interact with the environment. We adopt τ 2 - bench [Barres et al., 2025], which simulates customer service scenarios involving multi-turn dialogues and backend operations (e.g., order lookup, ticket modification), covering retail (115 tasks) and airline (50 tasks) domains. (2) AgentEnvironment-only interaction (AE) (§5.3): the user specifies a task upfront, after which the agent interacts with the environment autonomously without further dialogue. We use MCPMark [Wu et al., 2025], which provides 127 expertcurated tasks requiring extensive CRUD operations with 5 MCP services: Filesystem, GitHub, Notion, Playwright and PostgreSQL. Together, these benchmarks assess agent capabilities across diverse interaction patterns and complexity levels.

Baselines. We compare against two representative actionrepresentation paradigms spanning the expressiveness spectrum. (1) ReAct [Yao et al., 2023]: interleaves reasoning and action with structured text, enabling explicit deliberation but limited to one tool invocation per step. (2) CodeAct [Wang et al., 2024b]: employs executable Python as the action space, supporting control flow and multi-tool composition within single actions. To ensure compatibility with contemporary tool-use frameworks and model completion APIs, we adapt CodeAct's original free-form code format to a JSONbased function call interface where code is passed as a string argument-preserving its expressiveness while enabling standardized evaluation. Both baselines operate as single-agent systems with shared context across the entire task, isolating the effect of our proposed hierarchical delegation and EPSS mechanisms.

Evaluation. For τ 2 -bench, we report passˆk (k ∈ {1, 2, 3, 4}) (%) [Yao et al., 2024] across its two domains: retail and airline. A task is considered passed only if all user requirements are satisfied and all backend state changes are correct. For MCPMark, we report pass@1 as the primary metric, where success requires correct tool invocations, proper output parsing, and ground-truth-matching results verified by programmatic scripts.

Implementation Details. For τ 2 -bench, we employ DeepSeekV3.2 [DeepSeek-AI et al., 2025] in fast-thinking mode and GPT-5 [OpenAI, 2025b] at low reasoning level as backbone models to ensure fair comparison, and following the τ 2 -bench framework requirements which require an LLM-based user simulator for multi-turn dialogue, we use DeepSeekV3.2 as the simulated user. For MCPMark, we adopt DeepSeekV3.2 as the sole backbone model due to cost considerations. The temperature is set to 0 across all experiments to ensure reproducibility. For ReAct and CodeAct baselines, we set the maximum number of interaction steps to 200 and the maximum tolerated errors to 10. For CODEDELEGATOR, the Delegator component is limited to 100 dispatch rounds while each Coder instance is constrained to 20 iterations, where the Delegator and Coders share the same base model but operate within separate contexts.

5.2 Results on HAE Scenario

Table 3 presents results on τ 2 -bench. With DeepSeekV3.2, CODEDELEGATOR achieves the highest passˆ1 accuracy across both domains, reaching 82.0% on Retail and 63.5% on Airline. CodeAct consistently underperforms ReAct despite its greater expressiveness, confirming that context pollution negates the benefits of code-based actions in long-horizon tasks. The advantage of CODEDELEGATOR becomes more pronounced under stricter consistency requirements: on Airline, the passˆ1 → passˆ4 degradation is 17.5% for CODEDELEGATOR versus 27.0% for CodeAct, with CODEDELEGATOR outperforming CodeAct by 14.0% absolute at passˆ4. The Airline domain, involving longer action sequences and more complex API operations, better reveals the benefits of role separation by isolating execution traces from subsequent planning steps. Results with GPT-5 show similar trends, validating that context pollution is a model-agnostic limitation.

5.3 Results on AE Scenario

Table 4 presents results on MCPMark across five MCP tool domains. CODEDELEGATOR achieves the highest overall success rate at 38.4%, outperforming both ReAct (25.8%) and CodeAct (26.4%) by approximately 12% absolute. Despite its greater expressiveness, CodeAct performs nearly identically to ReAct, consistent with our findings that context pollution offsets the flexibility of code-based actions. The advantage of CODEDELEGATOR is particularly pronounced in domains requiring complex multi-step interactions: GitHub (+10.1% over CodeAct), Notion (+15.4%), and Playwright (+17.3%), where role separation and EPSS provide the greatest benefit for tracking intermediate state across API calls. The exception is PostgreSQL, where ReAct achieves the highest accuracy at 52.4%. We attribute this to transactional semantics: SQL statements wrapped in code loops can cause partial failures that leave inconsistent states, whereas ReAct's single-call-per-step pattern naturally aligns with atomic transaction boundaries.

6 Analysis

Ablation Study. We conduct an ablation study on MCPMark to validate our components (Table 5).

• w/o Role Separation. Reverts to a single persistent agent, removing ephemeral Coders entirely. The substantial 10.5% drop confirms that spawning fresh agents per sub-task, rather than accumulating execution history in a shared context, is critical to performance.
• w/o EPSS. Retains the two-agent architecture but replaces EPSS's structured schemas with natural-language message passing. The 4.7% drop confirms that typed communication protocols independently reduce coordination noise beyond what role separation alone provides.

Analysis on Complexity Scaling. Fig. 6 shows performance by difficulty on τ 2 -bench airline (DeepSeekV3.2). On Low-complexity tasks, both methods perform comparably; however, CODEDELEGATOR's advantage emerges with increasing complexity: it outperforms CodeAct by 11.2% (18.7% relatively) on Medium and 3.9% (14.5% relatively) on High tasks. CodeAct degrades sharply with complexity while CODEDELEGATOR exhibits more graceful degradation, validating that role separation becomes increasingly valuable as task complexity grows.

Quantitative Analysis of Context Pollution Reduction. We analyze τ 2 -bench (retail, DeepSeekV3.2) logs along three dimensions.

• Context Growth Rate. Fig. 7 plots the average prompt tokens per LLM call at each turn. ReAct and CodeAct exhibit monotonically increasing context, reaching 8.4K and 15.0K tokens respectively, while the Delegator's context grows more slowly (peak 10.3K), confirming EPSS shields the planner from trace accumulation.

• Tool Execution Trace Ratio. Fig. 8 shows tool traces constitute 25.5% of CodeAct's context and 21.7% of ReAct's, but only 9.6% of the Delegator's-a 55% relative reduction. Traces are confined to ephemeral Coders (11.1%), validating EPSS's asymmetric filtering.
• Per-Coder Context and Efficiency. Each Coder starts with a median context of 6,616 tokens, well below single-agent baselines. Despite running multiple agents, total prompt tokens per task (79.4K, Table 7) are lower than ReAct (83.6K) and CodeAct (90.2K), yielding the best cost-per-solved-task with the highest success rate (82.0%).

7 Conclusion

We presented CODEDELEGATOR, a multi-agent framework that mitigates context pollution in code-as-action agents via role separation: a persistent Delegator plans while ephemeral Coders execute sub-tasks in isolated contexts. EphemeralPersistent State Separation (EPSS) ensures only validated results propagate upward. Experiments on τ 2 -bench and MCPMark show consistent improvements over CodeAct, especially on hard tasks, and confirm that EPSS reduces tool-trace contamination by over 55% relative to shared-context baselines while lowering total token consumption.

Contribution Statement

Tianxiang Fei, Cheng Chen, and Yue Pan contributed equally to this work.