> [!IMPORTANT]
> This is a client/harness connectivity failure against the public hosted edge, not a security vulnerability.

**Describe the bug**

On a Block-hosted `*.communities.buzz.xyz` community, Buzz Desktop (WKWebView) can join the workspace and send/receive channel history, but a local managed agent cannot stay up.

`cursor-agent acp` initializes successfully. Then `buzz-acp` dials the community relay with `tokio-tungstenite::connect_async`, Cloudflare returns `HTTP 403 Forbidden` on the WebSocket upgrade (before NIP-42), `buzz-acp` treats 403 as a terminal connect error, and the harness exits ~10s after Start.

The Activity panel only shows the generic copy **Failed to connect to relay.** / **Observer not attached**. `managed-agents.json` stores `last_error: harness exited with status exit status: 1`. Sending `hi` in the agent DM shows **Sending…**, then the text is restored into the composer after the send fails or the agent dies.

This is the same Cloudflare 403 class as #5018 (reported on Windows / Codex). This report adds a macOS + Cursor reproduction, the Desktop-vs-agent split, and a direct-vs-proxy probe.

**Steps to reproduce**

1. Install Buzz Desktop 0.5.20 on macOS and join a hosted `.communities.buzz.xyz` community. The Desktop UI loads channels and history.
2. Create a local managed agent on the Cursor harness (`cursor-agent acp`) and click **Start agent**.
3. Open the agent Activity panel. After a few seconds the button returns to **Start agent**.
4. Send `hi` in the agent DM.

**Expected behavior**

- The hosted relay should accept the agent's WebSocket upgrade (`101`), then run NIP-42 / membership checks inside the socket.
- If the upgrade is denied, Activity / `last_error` should surface the HTTP 403 (and that it is terminal), not only `exit status: 1`.
- `Start agent` should not report success when the child dies on the initial relay connect.
- A failed send should keep a durable error, not only restore the draft.

**Actual behavior**

1. Agent log (`~/Library/Application Support/xyz.block.buzz.app/agents/logs/__.log`):

```text
INFO buzz_acp: buzz-acp starting: relay=wss://.communities.buzz.xyz agent_cmd=…/cursor-agent acp
INFO buzz_acp: agent initialized agent=0 … authMethods=[{id: cursor_login}]
INFO buzz_acp: agent_pool_ready agents=10
WARN buzz_acp::relay: initial relay connect failed with terminal error: WebSocket error: HTTP error: 403 Forbidden
Error: relay connect error: WebSocket error: HTTP error: 403 Forbidden
```

2. Record after exit: `last_exit_code=1`, `last_error=harness exited with status exit status: 1`. PID is gone. Activity: **Observer not attached** + **Failed to connect to relay.**
3. Composer: optimistic **Sending…**, then `hi` is written back into the input (`restoreComposerAfterFailure`). Easy to miss the short toast.

`crates/buzz-acp/src/relay.rs` classifies non-408/429/5xx HTTP statuses as terminal, so 403 is not retried. `start_managed_agent` returns after spawn; relay connect happens later in the child, so the UI briefly looks started.

**Direct vs proxied probe (same machine, same hostname)**

macOS has a system HTTP(S) proxy. Desktop uses CFNetwork (system proxy) and can use the community.

A raw upgrade **through the system proxy** succeeds and receives `AUTH`:

```text
HTTP/1.1 101 Switching Protocols
server: cloudflare
CF-RAY: …-HKG
```

The same upgrade **direct / `--noproxy '*'`** is blocked:

```text
HTTP/1.1 403 Forbidden
Server: cloudflare
CF-RAY: …-LAX
Attention Required! | Cloudflare

Sorry, you have been blocked

You are unable to access communities.buzz.xyz
```

`buzz-acp` uses `connect_async(url)` and does not use the macOS system proxy. That matches the Desktop-works / agent-403 split on this machine (CN egress). #3709 is the same Cloudflare geo/WAF class on another Desktop path.

**Version and platform**

- Buzz version: 0.5.20 (`/Applications/Buzz.app`)
- OS: macOS 15.7 (24G222)
- Agent harness: Cursor (`cursor-agent acp`) — ACP initialize succeeds; Cursor login is not the failure
- Hosted relay: `wss://.communities.buzz.xyz` (NIP-11 / AUTH reachable when the upgrade is not blocked)
- Related: #5018 (Windows / Codex, same 403), #3709 (CN direct Cloudflare 403)

**Logs / additional context**

- Local agent stdout/stderr: `~/Library/Application Support/xyz.block.buzz.app/agents/logs/`
- Desktop does not persist a send-failure log; the 403 only appears in the agent log.
- Other local Cursor agents on this install also died (`Fizz` / `Honey` / `Pollen` hit `cursor-agent` without `acp` and timed out initialize — separate from this 403).
- Community hostname can be shared privately if needed.