The SDK can refresh a background session's credential, but only if the host provides a callback.
Work-secret refresh is fully wired end to end but throws unless the SDK host supplies the callback.
What's wrong with this entry?
The SDK's query layer now handles a control request that asks the host to refresh the credential a background session uses when driven by remote control, and there is a matching caller that sends it end to end. It is complete rather than a stub, but only works if the SDK host supplies the refresh callback; otherwise the request throws "refreshWorkSecret callback is not provided."
- The query object tracks the host-supplied callback plus a counter of remote-control calls, so repeat refreshes can be told apart.
- Nothing in normal interactive use reaches this path; it exists for hosts embedding Claude Code with background remote-controlled sessions.
remote_control_work_secret
Strings lifted out of the shipped bundle, so the claim above can be checked against them.