Hosted communities: Cloudflare returns 403 for buzz-acp WebSocket upgrades on Windows

[Eric-Zhang1990]

Describe the bug

On a Block-hosted *.communities.buzz.xyz community, Buzz Desktop can fetch the relay's NIP-11 metadata over HTTPS, but managed agents cannot establish the relay WebSocket connection. Cloudflare returns HTTP 403 Forbidden during the WebSocket upgrade, before NIP-42 authentication starts.

This reproduces with two separate managed Codex agent identities (Fizz and Honey). In both cases all codex-acp workers initialize successfully, then buzz-acp exits when its initial relay connection receives the Cloudflare 403.

Steps to reproduce

1. Install Buzz Desktop on Windows and connect it to a hosted <community>.communities.buzz.xyz relay.
2. Create a managed Codex agent and start it.
3. Observe that codex-acp 1.1.9 initializes and the agent pool becomes ready.
4. Observe that the subsequent relay WebSocket connection fails with HTTP error: 403 Forbidden.
5. As an independent probe, request the NIP-11 document over HTTPS; it succeeds and reports Buzz Relay 0.2.0 with auth_required: true.
6. Send a standards-compliant WebSocket upgrade request to the same origin; Cloudflare returns 403 instead of 101.

Reproduction probe:

curl.exe -sS -D - -o NUL --http1.1 --max-time 5 `
  -H "Connection: Upgrade" `
  -H "Upgrade: websocket" `
  -H "Sec-WebSocket-Version: 13" `
  -H "Sec-WebSocket-Key: SGVsbG9Xb3JsZDEyMzQ1Ng==" `
  https://<community>.communities.buzz.xyz/

This consistently returns:

HTTP/1.1 403 Forbidden
Server: cloudflare

Adding a browser User-Agent, Origin, and Nostr Accept header does not change the result. The behavior was also reproduced through both a proxy route and a direct route.

Expected behavior

The hosted relay should accept the WebSocket upgrade (101 Switching Protocols), then perform the normal NIP-42 authentication and membership checks inside the established WebSocket connection.

Version and platform

• Buzz version: 0.5.5
• OS: Windows 11 Home, version 10.0.26200 (build 26200)
• ACP adapter: @agentclientprotocol/codex-acp 1.1.9
• Hosted relay NIP-11 version: 0.2.0

Logs / additional context

Representative agent log:

INFO buzz_acp: agent initialized agent=9 name="@agentclientprotocol/codex-acp" steering_supported=true
INFO buzz_acp: agent_pool_ready agents=10
WARN buzz_acp::relay: initial relay connect failed with terminal error: WebSocket error: HTTP error: 403 Forbidden
Error: relay connect error: WebSocket error: HTTP error: 403 Forbidden

Representative edge response:

Date: Thu, 06 Aug 2026 06:16:34 GMT
HTTP/1.1 403 Forbidden
Server: cloudflare
CF-RAY: a26be9e0df2c88bd-LAX

The Cloudflare response body says Sorry, you have been blocked. Because the rejection occurs during the HTTP upgrade, neither the managed agent's Nostr identity nor its respond_to mode has been evaluated yet. Please inspect the hosted-zone Cloudflare WAF/Bot Management rules for WebSocket upgrade requests to tenant community hostnames. The exact community hostname is available privately if needed.

[bauerpaul874801]

和 monorepo 一起用有坑吗 🛠️

[blackwellmiranda8]

膜拜大佬，仓库整理得很清晰 🤝