zero-bridge: a loopback HTTP/SSE bridge and web UI for zero acp

[FabioLeitao]

zero-bridge is a small Go program (standard library only) that starts one long-lived zero acp child and exposes it as loopback HTTP/SSE plus a plain web UI. It consumes only the public ACP surface. Zero is not modified or vendored. It is a personal, experimental project.

What runs today: chat with streaming output, session list/load/resume, permission cards, tool output, and a headless browser test suite.

Security posture, because the concerns on #622 were about exactly that: the bridge binds loopback only and refuses anything else; Host and Origin are checked; a JSON content type is required; the page sets a CSP and inserts text only. Permissions are denied by default, only allow_once is offered, and a timeout denies. Behind a reverse proxy there is an optional Bearer token or cookie session with a login rate limit (a Caddy guide is in the repo). This is a local controller, not a hosted service.

Where it touches Zero, all in public issues already: persisting token usage for ACP sessions (#1118, PR #1137), spec-draft mode over ACP (#664), frame and goroutine limits (#923, PR #944), and MCP startup warnings that arrive as agent_message_chunk (related: #825).

MIT licensed. Not affiliated with or endorsed by Gitlawb or Twigpine. Tested on Linux only so far.

Feedback on ACP gaps is welcome. I am not asking for anything to be merged here.

Repo: https://github.com/FabioLeitao/zero-bridge