Claude Design share URLs return "not found" to unauthenticated clients (blocks Claude Code integration)

Summary

Share URLs in the format https://api.anthropic.com/v1/design/h/{project-hash}?open_file={filename} cannot be fetched programmatically by external tools (including Claude Code's WebFetch and standard HTTP clients). This breaks cross-tool handoff between Claude Code and Claude Design.

Reproduction

1. Create a Claude Design project containing an HTML file
2. Copy the share URL from the address bar or share action
3. Attempt to fetch from an unauthenticated client:

curl -sL "https://api.anthropic.com/v1/design/h/{project-hash}?open_file={filename}.html"

Expected

Response returns the HTML file contents, or a redirect to a CDN-hosted static version.

Actual

• GET returns \"not found"\ (body, 10 bytes, HTTP 200)
• HEAD returns \HTTP 405 Method Not Allowed\
• Headers indicate the request reached the API but was rejected:

content-security-policy: default-src 'none'; frame-ancestors 'none'
cache-control: no-store

Environment

• Client: curl 8.x on macOS
• Also reproduced via Claude Code WebFetch tool (\maxContentLength size exceeded\ on the browser-rendered page; fetch of the raw API endpoint returns "not found")
• Browser access to the same URL works correctly (authenticated session)

Impact

External tools cannot access files in Claude Design projects. This prevents:

• Claude Code reading a Design HTML for editing or review
• Other MCP servers integrating with Design artefacts
• Any automated workflow that combines Design output with downstream processing

Suggested fix

Either:

• Add a view-only token parameter to share URLs that permits unauthenticated GET on file contents, OR
• Expose a stable, CDN-hosted download URL per file (separate from the app preview URL), OR
• Ship a Design MCP server with read tools for share links

Workaround

User manually downloads the file from the Design UI and transfers to local disk. Works but breaks automation.