[BUG] Published artifacts show blank screen - postMessage origin mismatch (app://localhost)

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

All user-published artifacts on claude.ai show a blank screen. This affects ALL published artifacts (including a minimal 15-line React test component), while gallery/inspiration artifacts work fine.

Note: This is a claude.ai web issue, not Claude Code CLI. Filing here as there's no dedicated claude.ai bug tracker.

URLs tested:

• https://claude.ai/public/artifacts/8b241cc8-6938-4ace-97f0-05fa098b296c (minimal 15-line test)
• - https://claude.ai/public/artifacts/dffe5b77-2de4-4465-a0ed-de515c932a71
• - - https://claude.ai/public/artifacts/cef52e44-d350-4f75-95bc-19a3f30350b3

The iframe loads (945x586px) but remains completely empty. The postMessage handshake between claude.ai and claudeusercontent.com fails due to origin mismatch.

What Should Happen?

Published artifacts should load and render correctly in the iframe, as they did until March 31, 2026. The postMessage handshake between claude.ai and www.claudeusercontent.com should use the correct origin.

Error Messages/Logs

Uncaught SyntaxError: Failed to execute 'postMessage' on 'Window': Invalid target origin 'app://localhost' in a call to 'postMessage'.
    at 7905-1f7e271de70b4d3c.js:1:6920 (requestHandshake)

Also: Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://www.claudeusercontent.com') does not match the recipient window's origin ('https://claude.ai').

Frontend version: 77a7afd8b7
Reproduced in Chrome latest + Chrome IncognitUncaught SyntaxError: Failed to execute 'postMessage' on 'Window': Invalid target origin 'app://localhost' in a call to 'postMessage'.
    at 7905-1f7e271de70b4d3c.js:1:6920
    at Array.forEach (<anonymous>)
    at l.requestHandshake (7905-1f7e271de70b4d3c.js:1:6890)
    at new l (7905-1f7e271de70b4d3c.js:1:9710)
    at 7324-2de3d1f6bfa48673.js:1:11221

Also repeated:
Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://www.claudeusercontent.com') does not match the recipient window's origin ('https://claude.ai').

Frontend version: 77a7afd8b7
Browser: Chrome latest, also reproduced in Chrome Incognito (no extensions)
Started: around April 1, 2026
Gallery artifacts (/artifacts/inspiration/*) work fine - only /public/artifacts/* affectedo (no extensions).
Started around April 1, 2026.
Gallery artifacts (/artifacts/inspiration/*) work fine - only /public/artifacts/* affected.

Steps to Reproduce

a1. Publish any artifact from claude.ai (even a minimal 15-line React component)

1. Open the published URL (e.g. https://claude.ai/public/artifacts/8b241cc8-6938-4ace-97f0-05fa098b296c)
2. 3. Observe: blank/dark screen, no content rendered
3. 4. Open DevTools console: see postMessage errors with 'app://localhost' origin
4. 5. Compare with gallery artifact (e.g. https://claude.ai/artifacts/inspiration/ac6871a2-35d6-4328-ba77-9e9be5c9993b) which loads correctly

Claude Model

None

Is this a regression?

Yes, this worked in a previous version

Last Working Version

Worked on March 31, 2026. Broke around April 1, 2026.

Claude Code Version

N/A - this is a claude.ai web issue, not Claude Code. Frontend version: 77a7afd8b7

Platform

Other

Operating System

Windows

Terminal/Shell

Other

Additional Information

This bug affects the published artifacts viewer on claude.ai, not Claude Code CLI. Filing here because there is no dedicated bug tracker for claude.ai web issues.

Key finding: Gallery/inspiration artifacts (served from claude.ai/artifacts/inspiration/*) render correctly. Only user-published artifacts (served via claudeusercontent.com iframe) show blank screen.

The root cause appears to be in 7905-1f7e271de70b4d3c.js where requestHandshake() calls postMessage with target origin 'app://localhost' instead of 'https://www.claudeusercontent.com'.

This was confirmed by testing a minimal 15-line React component that also fails identically.