Claude Code refuses ant commands holding certain agent IDs

What

ant is a command-line tool for Anthropic's managed agents. Claude Code now checks Bash commands that run ant and refuses some of them before they run. This supports the /claude-api managed-agents-secure skill.

• Prefixed IDs: commands containing agent_, env_ or vlt_ IDs followed by staging_, vrtx_ or bdrk_ are refused with "Claude Code did not run this command: it holds an ID starting agent_, env_ or vlt_ then staging_, vrtx_ or bdrk_".
• Local IDs: local-server IDs such as agent_local_ are accepted only in a strict form. A second refusal path blocks arguments holding a locally derived ID (id_with_local_part), or one written as a plain literal (local_id).
• Split IDs: IDs broken across a line continuation (a backslash that carries a command onto the next line) are now caught too.
• Messages: each case returns its own refusal message. Before, only the id_with_second_part and managed_agents_secure_command_changed causes existed.

Why

If you use the managed-agents-secure skill, some ant beta: commands that used to run may now be stopped, with a message saying which kind of ID caused it. Nothing has been read about the gate tengu_claude_api_ant_command_refused.