Under the hood
First-party design auth classification now also checks the request URL, not just the token
What
The internal check that classifies a request as using "first_party_design_auth" now also requires a URL-based check to pass, in addition to the existing authentication lookup it already performed.
Why
This tightens how Claude Code decides a request qualifies as first-party design authentication, requiring the request's URL to also match expectations rather than relying on the auth lookup alone.