Work-secret refresh is fully wired end to end but throws unless the SDK host supplies the callback.
What
The SDK's query layer now handles a control request that asks the host to refresh the credential a background session uses when driven by remote control, and there is a matching caller that sends it end to end. It is complete rather than a stub, but only works if the SDK host supplies the refresh callback; otherwise the request throws "refreshWorkSecret callback is not provided."
Details
- The query object tracks the host-supplied callback plus a counter of remote-control calls, so repeat refreshes can be told apart.
- Nothing in normal interactive use reaches this path; it exists for hosts embedding Claude Code with background remote-controlled sessions.
Evidence
remote_control_work_secret
Strings lifted out of the shipped bundle, so the claim above can be checked against them.