What
A heartbeat response can now carry a refreshed auth payload, letting a long-running remote worker pick up new tokens without a restart.
Details
- On receiving the payload the client re-reads the session ingress token and OAuth token from disk.
- Adoption only happens if the new token decodes as a JWT, its expiry matches the advertised lifetime, and it extends the current expiry.
- Each non-adoption reason is reported once: not_remote, no_advertised_ttl, read_failed, not_a_jwt, unchanged, exp_mismatch, not_newer, adopt_timeout, adopt_threw.
- The heartbeat request timeout is now derived from the heartbeat interval and jitter rather than a fixed 5000 ms.
- Gated on the CLAUDE_CODE_REMOTE environment; non-remote sessions report not_remote and keep existing credentials.
Evidence
CCR auth refresh: delivered token does not extend expiry, keeping current credentials
Strings lifted out of the shipped bundle, so the claim above can be checked against them.
Names in the bundleCLAUDE_CODE_REMOTE