[BUG] Claude Design preview: all project-relative subresources rejected with 401 "preview token required" (only top-level HTML gets a token)

Environment

• Product: Claude Design (claude.ai/design), design-system project
• Date observed: 2026-07-11
• Platform: macOS (Darwin 24.6.0), Chrome

Bug description

In a Claude Design project preview, only the top-level HTML file is served successfully. Every project-relative subresource referenced by that file — stylesheets (e.g. tokens.css), font files (fonts/*.ttf), SVG/PNG assets — is rejected by the preview server with HTTP 401 "preview token required".

It appears the preview token is only attached to the request for the root HTML document, and is not propagated to (or accepted for) subresource requests originating from that document. As a result, previews render unstyled and without fonts/images.

Steps to reproduce

1. Create a design-system project on claude.ai/design with a component HTML page that references project-relative subresources, e.g. <link rel="stylesheet" href="tokens.css"> and @font-face sources under fonts/.
2. Open the preview of the HTML page.
3. Observe in the network panel: the HTML document returns 200, while every project-relative subresource request returns 401 with a "preview token required" error.

Expected behavior

Subresources belonging to the same project should be served to the preview with the same authorization as the root document.

Actual behavior

All project-relative subresources return 401 "preview token required"; only the top-level HTML gets a token.

Impact

Design-system previews are unusable (no styles, no fonts, no images) even though all files upload correctly and are visible via list_files / DesignSync. The affected project has ~250 files (~25 component specimen pages, several UI-kit pages, a full font family) — all present in the project, none servable as subresources.