Issues

[P3][test] Permissions broker tests wait with time.Sleep(20ms) for a pending request and fail when the machine is loaded

FabioLeitao/zero-bridge#98 · opened

on Oct 21, 2026

[P1][acp] Image attachments reach the agent corrupted: handlePrompt replaces the base64 string with the decoded bytes before marshaling JSON

FabioLeitao/zero-bridge#96 · opened

on Oct 21, 2026

[P2][build] Move golangci-lint to a release that accepts Go 1.27 and drop the go1.26 analyzer pin

FabioLeitao/zero-bridge#90 · opened

on Oct 21, 2026

[P2][deploy] Deploy specs set values nothing consumes: OTEL_SAMPLE is never read and the /workspace and /extra mounts are not passed as roots

FabioLeitao/zero-bridge#84 · opened

on Oct 21, 2026

[P3][http] The HTTP server has no idle or read timeout, and the SSE endpoint has no subscriber cap

FabioLeitao/zero-bridge#85 · opened

on Oct 21, 2026

[P2][proxy] With --trust-proxy the rate-limit key is the first X-Forwarded-For value, which the client controls when the proxy appends

FabioLeitao/zero-bridge#83 · opened

on Oct 21, 2026

[P2][redact] Redact misses common secret shapes and its sk- pattern redacts ordinary words

FabioLeitao/zero-bridge#82 · opened

on Oct 21, 2026

[P2][agent-env] The agent child inherits the whole parent environment except one name, and ZERO_BRIDGE_TOKEN stays readable from the child through /proc

FabioLeitao/zero-bridge#81 · opened

on Oct 21, 2026

[P1][audit] The audit trail records authentication only: permission allow/deny, prompts, session creation and the A2A and OpenAI ingress leave no audit line

FabioLeitao/zero-bridge#80 · opened

on Oct 21, 2026

[P1][cli] Unknown flags and stray arguments are silently ignored, so a typo in a security flag starts the bridge without it

FabioLeitao/zero-bridge#79 · opened

on Oct 21, 2026

[P2][test] Fake agent session/list ignores sessions created by session/new

FabioLeitao/zero-bridge#74 · opened

on Oct 20, 2026

[P2][ux] Slash menu from the commands the agent advertises (ACP available_commands_update)

FabioLeitao/zero-bridge#73 · opened

on Oct 20, 2026

[P2][test] TestCallTimeout failed once under -race in make check (acpclient)

FabioLeitao/zero-bridge#67 · opened

on Oct 20, 2026

[P2][test] S29 acceptance leftovers: model list, success chunk, initialize payload, real client

FabioLeitao/zero-bridge#66 · opened

on Oct 20, 2026

[P2][portable] Use XDG defaults for Linux config and logs

FabioLeitao/zero-bridge#61 · opened

on Oct 20, 2026

[P2][test] Run ACP contract tests in CI and record a real agent

FabioLeitao/zero-bridge#59 · opened

on Oct 20, 2026

Finish line: compatible, useful, portable, agnostic

FabioLeitao/zero-bridge#57 · opened

on Oct 20, 2026

3

S19b — opencode acp as the first non-Zero ACP spike

FabioLeitao/zero-bridge#38 · opened

on Oct 18, 2026

S29 — OpenAI-compatible ingress: /v1/chat/completions and /v1/models over ACP

FabioLeitao/zero-bridge#34 · opened

on Oct 15, 2026

Roadmap and sequencing: desktop track first

FabioLeitao/zero-bridge#30 · opened

on Oct 15, 2026

5

S23b — desktop shell: tray, permission notifications, folder picker

FabioLeitao/zero-bridge#25 · opened

on Oct 15, 2026

3

S23a — desktop shell: scaffold, sidecar lifecycle, hardening

FabioLeitao/zero-bridge#24 · opened

on Oct 15, 2026

2

S23 — desktop shell (Electron, separate repo)

FabioLeitao/zero-bridge#23 · opened

on Oct 15, 2026

2

S22 — PWA and permission notifications (optional)

FabioLeitao/zero-bridge#22 · opened

on Oct 15, 2026

S15 — publication checklist (public repo + Show and tell)

FabioLeitao/zero-bridge#10 · opened

on Oct 14, 2026

3

Navigation Menu

Repository navigation

Issues

[P3][test] Permissions broker tests wait with time.Sleep(20ms) for a pending request and fail when the machine is loaded

[P1][acp] Image attachments reach the agent corrupted: handlePrompt replaces the base64 string with the decoded bytes before marshaling JSON

[P2][build] Move golangci-lint to a release that accepts Go 1.27 and drop the go1.26 analyzer pin

[P2][deploy] Deploy specs set values nothing consumes: OTEL_SAMPLE is never read and the /workspace and /extra mounts are not passed as roots

[P3][http] The HTTP server has no idle or read timeout, and the SSE endpoint has no subscriber cap

[P2][proxy] With --trust-proxy the rate-limit key is the first X-Forwarded-For value, which the client controls when the proxy appends

[P2][redact] Redact misses common secret shapes and its sk- pattern redacts ordinary words

[P2][agent-env] The agent child inherits the whole parent environment except one name, and ZERO_BRIDGE_TOKEN stays readable from the child through /proc

[P1][audit] The audit trail records authentication only: permission allow/deny, prompts, session creation and the A2A and OpenAI ingress leave no audit line

[P1][cli] Unknown flags and stray arguments are silently ignored, so a typo in a security flag starts the bridge without it

[P2][test] Fake agent session/list ignores sessions created by session/new

[P2][ux] Slash menu from the commands the agent advertises (ACP available_commands_update)

[P2][test] TestCallTimeout failed once under -race in make check (acpclient)

[P2][test] S29 acceptance leftovers: model list, success chunk, initialize payload, real client

[P2][portable] Use XDG defaults for Linux config and logs

[P2][test] Run ACP contract tests in CI and record a real agent

Finish line: compatible, useful, portable, agnostic

S19b — opencode acp as the first non-Zero ACP spike

S29 — OpenAI-compatible ingress: /v1/chat/completions and /v1/models over ACP

Roadmap and sequencing: desktop track first

S23b — desktop shell: tray, permission notifications, folder picker

S23a — desktop shell: scaffold, sidecar lifecycle, hardening

S23 — desktop shell (Electron, separate repo)

S22 — PWA and permission notifications (optional)

S15 — publication checklist (public repo + Show and tell)