Artifacts: published files (video, images) return 403 in Safari on iPad – frame has no credentials

Summary

Files published alongside an Artifact (via the Artifact tool's files option) cannot be loaded by Safari on iPadOS, and apparently not by other browsers that block third-party cookies. The page itself renders, but every request for a published file (<video src>, <img src>, CSS background-image, and fetch() with relative URLs) fails. Chrome on macOS works.

Environment

• Artifacts published from Claude Code (desktop app, macOS), contract 0.2.75, capabilities db + user
• Viewer: Safari on iPad (iPadOS, device from 2020/2021), signed in to claude.ai, artifact shared with that account
• Works: Chrome on macOS, signed in to the same organization

Steps to reproduce

1. Publish an HTML page with files containing an mp4 (H.264 High L3.1, yuv420p, AAC LC, 1280x720) and a jpg, referenced with relative paths (v/video.mp4, p/poster.jpg), e.g. <video controls playsinline preload="metadata"> with video.src = "v/video.mp4"; video.poster = "p/poster.jpg".
2. Share the artifact with a user and open it in Safari on an iPad (signed in).
3. The page's own HTML, inline CSS/JS and Google Fonts load. The player stays black (no poster), with Safari's "cannot play" icon.
4. Same for a second artifact that references 380 published webp images via <img src> and background-image: the images stay empty for a reviewer, page chrome renders.

What I found

• Published files are served from https://<artifact-uuid>.frame.claudeusercontent.com/_f/<version>/<path>.
• Requesting such a file without the frame's credentials returns 403 with a small HTML body ("Couldn't load this artifact.", posting __frame_denied to the parent). So the files rely on the frame origin's credentials.
• Replacing <video src> by fetch("v/video.mp4", {credentials: "same-origin"}) + URL.createObjectURL(blob) did not help on the iPad: the fetch fails immediately as well (the "loading" state never showed), so the frame document has no credentials for its own origin in Safari.
• Consistent with Safari blocking third-party cookies for the cross-site *.frame.claudeusercontent.com iframe embedded in claude.ai. Chrome still sends them.

Expected

Published files should load in all viewers the artifact page itself loads in, in particular Safari/iPadOS, which is what teachers and students mostly use in schools. Hosting the media elsewhere is not an option because the frame CSP blocks external media/images.

Impact

Two review pages for teachers (videos, worksheet scans) are unusable for anyone on Safari or iPad. We can only tell reviewers to use Chrome on a desktop.