Add a Known gaps section to docs/agent-guardrails.md and tighten the
bash_protected_port row. Each gap was probed at the hook boundary:
- the plugin inspects only task, call_omo_agent, edit, write and bash, so
webfetch of localhost:8080 passes (seen live 2026-10-04)
- bash_protected_port matches literal host:port text, so [::1], the
machine address and URLs held in variables are missed
- bash -c / sh -c wrappers evade bash_banned and bash_main_checkout
(the port rule still sees inside them)
- a relative cd chain after an absolute one can be mis-anchored
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KkCGRantZsSwmcFpet6FTa
a0362d3f5c