diff --git a/.claude/settings.json b/.claude/settings.json
index c0dfef0..705b93f 100644
--- a/.claude/settings.json
+++ b/.claude/settings.json
@@ -1,8 +1,12 @@
 {
-  "//": "forgekit dogfoods its own plugin during local dev. These hooks mirror hooks/hooks.json but resolve through ${CLAUDE_PROJECT_DIR} (this repo) instead of ${CLAUDE_PLUGIN_ROOT}, so the guards run without a marketplace install. Every guard is advisory/fail-open; the completion gate honors FORGE_STOPGATE=0.",
+  "//": "forgekit dogfoods its own plugin during local dev. These hooks mirror hooks/hooks.json but resolve through ${CLAUDE_PROJECT_DIR} (this repo) instead of ${CLAUDE_PLUGIN_ROOT}, so the guards run without a marketplace install. Exec form via global/guards/run.mjs: node finds bash (Git Bash on Windows, where bash is usually NOT on PATH) and passes stdin/stdout/exit code through untouched. Every guard is advisory/fail-open; the completion gate honors FORGE_STOPGATE=0.",
   "statusLine": {
     "type": "command",
-    "command": "bash \"${CLAUDE_PROJECT_DIR}\"/global/statusline.sh"
+    "command": "node",
+    "args": [
+      "${CLAUDE_PROJECT_DIR}/global/guards/run.mjs",
+      "${CLAUDE_PROJECT_DIR}/global/statusline.sh"
+    ]
   },
   "hooks": {
     "SessionStart": [
@@ -11,15 +15,28 @@
         "hooks": [
           {
             "type": "command",
-            "command": "bash \"${CLAUDE_PROJECT_DIR}\"/global/guards/recall-load.sh"
+            "command": "node",
+            "args": [
+              "${CLAUDE_PROJECT_DIR}/global/guards/run.mjs",
+              "${CLAUDE_PROJECT_DIR}/global/guards/recall-load.sh"
+            ]
           },
           {
             "type": "command",
-            "command": "bash \"${CLAUDE_PROJECT_DIR}\"/global/guards/cortex.sh session-start"
+            "command": "node",
+            "args": [
+              "${CLAUDE_PROJECT_DIR}/global/guards/run.mjs",
+              "${CLAUDE_PROJECT_DIR}/global/guards/cortex.sh",
+              "session-start"
+            ]
           },
           {
             "type": "command",
-            "command": "bash \"${CLAUDE_PROJECT_DIR}\"/.claude/hooks/session-start.sh"
+            "command": "node",
+            "args": [
+              "${CLAUDE_PROJECT_DIR}/global/guards/run.mjs",
+              "${CLAUDE_PROJECT_DIR}/.claude/hooks/session-start.sh"
+            ]
           }
         ]
       }
@@ -29,11 +46,21 @@
         "hooks": [
           {
             "type": "command",
-            "command": "bash \"${CLAUDE_PROJECT_DIR}\"/global/guards/cortex.sh prompt"
+            "command": "node",
+            "args": [
+              "${CLAUDE_PROJECT_DIR}/global/guards/run.mjs",
+              "${CLAUDE_PROJECT_DIR}/global/guards/cortex.sh",
+              "prompt"
+            ]
           },
           {
             "type": "command",
-            "command": "bash \"${CLAUDE_PROJECT_DIR}\"/global/guards/cortex.sh preflight"
+            "command": "node",
+            "args": [
+              "${CLAUDE_PROJECT_DIR}/global/guards/run.mjs",
+              "${CLAUDE_PROJECT_DIR}/global/guards/cortex.sh",
+              "preflight"
+            ]
           }
         ]
       }
@@ -44,15 +71,27 @@
         "hooks": [
           {
             "type": "command",
-            "command": "bash \"${CLAUDE_PROJECT_DIR}\"/global/guards/protect-paths.sh"
+            "command": "node",
+            "args": [
+              "${CLAUDE_PROJECT_DIR}/global/guards/run.mjs",
+              "${CLAUDE_PROJECT_DIR}/global/guards/protect-paths.sh"
+            ]
           },
           {
             "type": "command",
-            "command": "bash \"${CLAUDE_PROJECT_DIR}\"/global/guards/cost-budget.sh"
+            "command": "node",
+            "args": [
+              "${CLAUDE_PROJECT_DIR}/global/guards/run.mjs",
+              "${CLAUDE_PROJECT_DIR}/global/guards/cost-budget.sh"
+            ]
           },
           {
             "type": "command",
-            "command": "bash \"${CLAUDE_PROJECT_DIR}\"/global/guards/doom-loop.sh"
+            "command": "node",
+            "args": [
+              "${CLAUDE_PROJECT_DIR}/global/guards/run.mjs",
+              "${CLAUDE_PROJECT_DIR}/global/guards/doom-loop.sh"
+            ]
           }
         ]
       },
@@ -61,7 +100,12 @@
         "hooks": [
           {
             "type": "command",
-            "command": "bash \"${CLAUDE_PROJECT_DIR}\"/global/guards/cortex.sh pre-edit"
+            "command": "node",
+            "args": [
+              "${CLAUDE_PROJECT_DIR}/global/guards/run.mjs",
+              "${CLAUDE_PROJECT_DIR}/global/guards/cortex.sh",
+              "pre-edit"
+            ]
           }
         ]
       }
@@ -72,11 +116,20 @@
         "hooks": [
           {
             "type": "command",
-            "command": "bash \"${CLAUDE_PROJECT_DIR}\"/global/guards/format-on-edit.sh"
+            "command": "node",
+            "args": [
+              "${CLAUDE_PROJECT_DIR}/global/guards/run.mjs",
+              "${CLAUDE_PROJECT_DIR}/global/guards/format-on-edit.sh"
+            ]
           },
           {
             "type": "command",
-            "command": "bash \"${CLAUDE_PROJECT_DIR}\"/global/guards/cortex.sh capture"
+            "command": "node",
+            "args": [
+              "${CLAUDE_PROJECT_DIR}/global/guards/run.mjs",
+              "${CLAUDE_PROJECT_DIR}/global/guards/cortex.sh",
+              "capture"
+            ]
           }
         ]
       },
@@ -85,11 +138,20 @@
         "hooks": [
           {
             "type": "command",
-            "command": "bash \"${CLAUDE_PROJECT_DIR}\"/global/guards/secret-redact.sh"
+            "command": "node",
+            "args": [
+              "${CLAUDE_PROJECT_DIR}/global/guards/run.mjs",
+              "${CLAUDE_PROJECT_DIR}/global/guards/secret-redact.sh"
+            ]
           },
           {
             "type": "command",
-            "command": "bash \"${CLAUDE_PROJECT_DIR}\"/global/guards/cortex.sh capture"
+            "command": "node",
+            "args": [
+              "${CLAUDE_PROJECT_DIR}/global/guards/run.mjs",
+              "${CLAUDE_PROJECT_DIR}/global/guards/cortex.sh",
+              "capture"
+            ]
           }
         ]
       }
@@ -99,15 +161,28 @@
         "hooks": [
           {
             "type": "command",
-            "command": "bash \"${CLAUDE_PROJECT_DIR}\"/global/guards/completion-gate.sh"
+            "command": "node",
+            "args": [
+              "${CLAUDE_PROJECT_DIR}/global/guards/run.mjs",
+              "${CLAUDE_PROJECT_DIR}/global/guards/completion-gate.sh"
+            ]
           },
           {
             "type": "command",
-            "command": "bash \"${CLAUDE_PROJECT_DIR}\"/global/guards/lean-guard.sh"
+            "command": "node",
+            "args": [
+              "${CLAUDE_PROJECT_DIR}/global/guards/run.mjs",
+              "${CLAUDE_PROJECT_DIR}/global/guards/lean-guard.sh"
+            ]
           },
           {
             "type": "command",
-            "command": "bash \"${CLAUDE_PROJECT_DIR}\"/global/guards/cortex.sh stop"
+            "command": "node",
+            "args": [
+              "${CLAUDE_PROJECT_DIR}/global/guards/run.mjs",
+              "${CLAUDE_PROJECT_DIR}/global/guards/cortex.sh",
+              "stop"
+            ]
           }
         ]
       }
diff --git a/.codex-plugin/plugin.json b/.codex-plugin/plugin.json
index 4bef723..a3027b5 100644
--- a/.codex-plugin/plugin.json
+++ b/.codex-plugin/plugin.json
@@ -15,7 +15,7 @@
   "interface": {
     "displayName": "Forge",
     "shortDescription": "Cognitive substrate and one config for every AI coding tool.",
-    "longDescription": "Forge adds a pre-action cognitive substrate for coding agents: assumption gating, transparent model routing, impact prediction, scope decomposition, memory/learning context, and verification checklists. It also emits shared rules and MCP config for Codex, Claude Code, Cursor, Gemini, Aider, Copilot, Windsurf/Devin, Zed, Continue, and Roo.",
+    "longDescription": "Forge adds a pre-action cognitive substrate for coding agents: assumption gating, transparent model routing, impact prediction, scope decomposition, memory/learning context, and verification checklists. It also emits shared rules and MCP config for Codex, Claude Code, Cursor, Gemini, Aider, Copilot, Windsurf/Devin, Zed, Continue, OpenClaw, and Roo.",
     "developerName": "CodeWithJuber",
     "category": "Productivity",
     "capabilities": ["MCP", "Skills", "Code Review", "Verification"],
diff --git a/ARCHITECTURE.md b/ARCHITECTURE.md
index 171eb68..f583f0a 100644
--- a/ARCHITECTURE.md
+++ b/ARCHITECTURE.md
@@ -29,7 +29,7 @@ for the full list.
   Brand stored as **one token** (the `brand` key in `brand.json`); rebrand = 1 edit.
 - **Distributable id = `forgekit`** (npm package + marketplace id) — fixed even if
   the brand token changes, so a rename never breaks install.
-- **Scope = full multi-tool day 1** — nine tools plus MCP, from one canonical source.
+- **Scope = full multi-tool day 1** — ten tools plus MCP, from one canonical source.
 - **Install = all three channels** (plugin + hardened installer + npm CLI), all
   three pointing at the _same_ tree ("one tree, three front doors").
 - **Own `lean` + `atlas`** — as _thin layers over proven primitives_, not
@@ -443,7 +443,7 @@ guards through `${CLAUDE_PROJECT_DIR}`.
 
 ## Verified cross-tool emit matrix
 
-_(All rows confirmed against vendor docs.)_ Forge emits config for **nine tools**, plus
+_(All rows confirmed against vendor docs.)_ Forge emits config for **ten tools**, plus
 an **MCP server** for Roo Code and VS Code.
 
 | Tool               | Native target                                                            | How Forge emits                                                                                        |
@@ -457,10 +457,39 @@ an **MCP server** for Roo Code and VS Code.
 | **Windsurf/Devin** | `AGENTS.md` auto-discovered; caps 6k/12k chars                           | Root `AGENTS.md` under caps; detect `.windsurf` vs `.devin` at init                                    |
 | **Zed**            | first match of a precedence list incl. `AGENTS.md`                       | Emit `AGENTS.md` + doctor flags any earlier-precedence legacy file shadowing it                        |
 | **Continue**       | `.continue/rules/*.md` + `.continue/mcpServers/*.yaml`                   | Emit a rules file plus the Forge MCP server config                                                     |
+| **OpenClaw**       | execution-folder `AGENTS.md` as project context; MCP registry is global | Rely on root `AGENTS.md`; write an OpenClaw-shaped `.openclaw/mcp.json` the operator applies with one `openclaw mcp add` |
 
 Roo Code and VS Code receive the Forge MCP server via `forge init`
 (`.roo/mcp.json`, `.vscode/mcp.json`) rather than a rules file.
 
+### OpenClaw: what is automatic and what is not
+
+OpenClaw appends the execution folder's `AGENTS.md` after its configured agent-workspace
+files as project context, so the canonical rules reach it with **no** extra instruction
+file — the same deal as Codex, Cursor and Copilot. Only `AGENTS.md` travels this way:
+OpenClaw deliberately does not load `SOUL.md`, `IDENTITY.md`, `USER.md`, `MEMORY.md` or
+`BOOTSTRAP.md` from the execution folder, so anything Forge wants OpenClaw to read has to
+be inside the canonical body.
+
+For the **config compiler path**, MCP is deliberately not automatic. OpenClaw's server
+registry is `mcp.servers` in the user's global `~/.openclaw/openclaw.json`; Forge never
+writes to another tool's global config. Instead `forge sync` emits a repo-local,
+OpenClaw-shaped fragment at `.openclaw/mcp.json` and reports the exact command that
+registers it:
+
+```bash
+openclaw mcp add forge-cortex --command forge --arg cortex-mcp
+openclaw mcp doctor forge-cortex --probe   # prove it starts and lists tools
+```
+
+There is also a separate **bundle installation path**. The published package already ships
+`.codex-plugin/plugin.json`, `global/tools`, and `.mcp.json`; OpenClaw auto-detects that
+layout as a Codex bundle. Installing a trusted local directory or packed archive through
+`openclaw plugins install` loads Forge's skills and bundle-scoped `forge-cortex` MCP server,
+so the manual global registration above is unnecessary for that installation. This does not
+turn Forge's Claude `hooks/hooks.json` automation into OpenClaw guards: only OpenClaw-style
+hook packs execute. Forge therefore provides no ambient pre-action guard on OpenClaw.
+
 ## Repo layout — one tree, three front doors
 
 ```
@@ -552,20 +581,22 @@ from the tree it describes.
 ```mermaid
 %%{init: {'theme':'base','themeVariables':{'primaryColor':'#201a15','primaryTextColor':'#f2ede7','primaryBorderColor':'#372c22','lineColor':'#f26430','secondaryColor':'#272019','tertiaryColor':'#171310','edgeLabelBackground':'#201a15','clusterBkg':'#171310','clusterBorder':'#4a3b2e','fontFamily':'ui-sans-serif, system-ui, sans-serif','fontSize':'14px'},'flowchart':{'curve':'basis','padding':10,'nodeSpacing':36,'rankSpacing':44}}}%%
 flowchart LR
-  test["test<br/>100 files"]
-  src["src<br/>94 files"]
+  test["test<br/>106 files"]
+  src["src<br/>97 files"]
   landing["landing<br/>61 files"]
   research["research<br/>35 files"]
+  global["global<br/>3 files"]
   bench["bench<br/>2 files"]
-  global["global<br/>2 files"]
   scripts["scripts<br/>2 files"]
   docs["docs<br/>1 file"]
   examples["examples<br/>1 file"]
-  test -- 195 --> src
+  test -- 206 --> src
   bench -- 7 --> src
   examples -- 4 --> src
   test -- 2 --> scripts
   scripts --> src
+  src --> global
   test --> bench
+  test --> global
 ```
 <!-- forge:render:repo-map:end -->
diff --git a/CHANGELOG.md b/CHANGELOG.md
index c4dd9ea..5b6f09e 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -6,6 +6,57 @@ to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ## [Unreleased]
 
+### Added
+
+- **OpenClaw is a first-class emit target — the compiler's tenth tool.** Instructions need
+  no new file: OpenClaw appends the execution folder's `AGENTS.md` after its configured
+  agent-workspace files as project context, so the canonical source reaches it the same way
+  it reaches Codex, Cursor and Copilot. MCP is registered explicitly rather than silently:
+  OpenClaw keeps its server registry in the user's global `~/.openclaw/openclaw.json`, which
+  Forge will not write to, so `forge sync` emits an OpenClaw-shaped fragment to
+  `.openclaw/mcp.json` and reports the exact enabling command
+  (`openclaw mcp add forge-cortex --command forge --arg cortex-mcp`). `.openclaw/mcp.json`
+  is an ordinary managed MCP target: idempotent, per-target ownership (a same-name server
+  you wrote yourself is preserved until `--adopt`), and reversible via
+  `forge integrations remove`. `openclaw` is now selectable and auto-detected by
+  `forge tools`. The packaged `.codex-plugin/plugin.json`, `global/tools`, and `.mcp.json`
+  also form an OpenClaw-compatible Codex bundle: installing a trusted checkout or packed
+  archive loads Forge's skills and bundle-scoped MCP server without the config-only path's
+  manual global registration. Forge installs **nothing** into OpenClaw's hook system — there
+  are no ambient guards there, only `AGENTS.md`/skill text and the MCP tools.
+
+### Changed
+
+- **MCP targets address their server bucket by dotted key path.** `emit/mcp.js` resolved a
+  single top-level key (`mcpServers`, `servers`, `context_servers`); OpenClaw nests its
+  registry under `mcp.servers`. The resolver now walks a path, creating missing objects only
+  on write, and refuses to restructure a file where any step already holds a non-object —
+  that shape is the user's and is reported, never rewritten.
+
+### Fixed
+
+- **Claude Code hooks no longer fail on Windows with `spawn bash ENOENT`.** Every Forge hook
+  (the plugin's `hooks/hooks.json`, the `settings.template.json` that `forge init` merges, the
+  statusline) was exec form with `command: "bash"`. Exec-form hooks are spawned directly — no
+  shell, a plain `PATH` lookup — and a default Git for Windows install puts `git.exe` on `PATH`
+  (`Git\cmd`) but not `bash.exe` (`Git\bin`, `Git\usr\bin`), so SessionStart and every other
+  guard died before it ran. Hooks now spawn the zero-dependency launcher
+  `global/guards/run.mjs` (`node run.mjs <guard>.sh …`), which resolves bash — `FORGE_BASH`,
+  `CLAUDE_CODE_GIT_BASH_PATH`, the Git install that owns `git` on `PATH`, the standard install
+  dirs, then `PATH` (never WSL's System32 `bash.exe`) — and passes stdin, stdout and the exit
+  code through verbatim, so exit-2 blocks are unchanged. POSIX behaviour is identical (`bash`
+  from `PATH`). `forge init` heals a Forge-owned install left in the old `bash` spelling in
+  place — ownership manifest included, so uninstall still reverses it — while a hand-written
+  hook at a Forge path is left alone; `forge doctor` shows the resolved bash, flags stale hooks
+  (`--fix` re-merges) and requires the launcher as an install asset. Regression tests cover the
+  Windows default-install `PATH` shape, paths with spaces on both OSes, the no-bash failure
+  mode (exit 1 + hint, never a fabricated block) and the packed archive.
+- **`protect-paths` no longer dies (exit 1, fail-open) on machines without `jq`.** Its grep
+  fallback ran under `set -euo pipefail`, so a payload missing `command` (every Write/Edit) or
+  `file_path` (every Bash call) aborted the guard before it could decide — invisible in CI, where
+  `jq` is preinstalled, but the norm on Windows. The fallback now yields an empty field exactly
+  like the `jq` branch, so `.env` writes and destructive `rm` are blocked without `jq`.
+
 ## [0.32.1] - 2026-08-22
 
 ### Fixed
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index de94c9c..25cc35a 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -12,7 +12,7 @@ small and dependency-free is the whole point, so please read this before opening
 - **Node.js ESM only.** All code is ES modules (`"type": "module"`). No CommonJS.
 - **Supported Node versions:** 20 and 22 (the `>=20` engines floor; Node 18 is EOL).
 - **Cross-tool first.** New behavior should work across the tools forgekit targets
-  (Claude Code, Codex, Cursor, Gemini, Aider, …), emitted from one source — not
+  (Claude Code, Codex, Cursor, Gemini, Aider, OpenClaw, …), emitted from one source — not
   Claude-only. Say so in the PR if a piece is unavoidably tool-specific.
 
 ## Getting started
diff --git a/ONBOARDING.md b/ONBOARDING.md
index 590e50c..384d378 100644
--- a/ONBOARDING.md
+++ b/ONBOARDING.md
@@ -5,7 +5,7 @@ context window, wiped every call — so it has no memory of what your team learn
 foresight about what an edit breaks, and no enforced guardrails. forgekit is the
 **cognitive substrate** that supplies exactly those three things, and it delivers them
 as native config to Claude Code, Codex, Cursor, Gemini, Aider, Copilot, Windsurf, Zed,
-and Continue at once. Author the brain once; every tool reads it.
+Continue, and OpenClaw at once. Author the brain once; every tool reads it.
 
 This page is the fast path: install, configure a repo, do a task, and watch the ledger
 start paying off on day two.
@@ -51,9 +51,22 @@ cd ~/your-project
 forge init                 # emits AGENTS.md, CLAUDE.md, .gemini/settings.json, .aider.conf.yml …
 ```
 
-Now Claude Code, Codex, Cursor, Gemini, Aider, Copilot, Windsurf, Zed, and Continue all
-read the **same** rules — each from its own native file (plus MCP server config for Roo
-Code and VS Code).
+Now Claude Code, Codex, Cursor, Gemini, Aider, Copilot, Windsurf, Zed, Continue, and
+OpenClaw all read the **same** rules — each from its own native file (plus MCP server
+config for Roo Code and VS Code).
+
+On OpenClaw the rules arrive automatically (it reads the execution folder's `AGENTS.md`
+as project context), but the MCP server is a deliberate one-command step, because
+OpenClaw's registry lives in your global `~/.openclaw/openclaw.json` and Forge does not
+write there:
+
+```bash
+openclaw mcp add forge-cortex --command forge --arg cortex-mcp
+openclaw mcp doctor forge-cortex --probe
+```
+
+`forge sync` writes the same definition to `.openclaw/mcp.json` so you can review or
+merge it instead of retyping the flags.
 
 Change a rule later by editing `source/rules.json` (or dropping a per-repo
 `.forge/rules.json`), then:
@@ -172,7 +185,7 @@ Forge would rather ship an honest subset with a clear boundary than a vague clai
 
 - **Add a rule** → a bullet in `source/rules.json`, then `forge sync`.
 - **Add a tool (skill)** → `global/tools/<name>/SKILL.md` with `name` + `description` frontmatter.
-- **Add a guard** → `global/guards/<name>.sh` (source `_guardlib.sh` for fields + the lock), then wire it in `global/settings.template.json` and `hooks/hooks.json`.
+- **Add a guard** → `global/guards/<name>.sh` (source `_guardlib.sh` for fields + the lock), then wire it in `global/settings.template.json` and `hooks/hooks.json` as `node …/guards/run.mjs …/guards/<name>.sh [mode]` — through the portable launcher (bash is not on `PATH` on Windows), never a bare `bash`.
 - **Rebrand** → edit `brand.json` (+ `package.json` bin, `.claude-plugin/plugin.json` name).
 
 Every command with worked examples and the full extension guide live in
diff --git a/README.md b/README.md
index ef18ec1..1bec4a4 100644
--- a/README.md
+++ b/README.md
@@ -22,23 +22,29 @@ delivers them into every tool you use.
 > content-addressed memory (we call it "proof-carrying memory" / PCM — see the honesty note
 > below), heuristic impact foresight, and guardrail hooks (automatic on Claude Code;
 > instructions and MCP tools elsewhere) — authored once and delivered as native config to
-> Claude Code, Codex, Cursor, Gemini, Aider, Copilot, Windsurf, Zed, and Continue (plus MCP
-> config for Roo and VS Code). Guardrails reduce risk; they are not a security sandbox.
+> Claude Code, Codex, Cursor, Gemini, Aider, Copilot, Windsurf, Zed, Continue, and OpenClaw
+> (plus MCP config for Roo and VS Code). Guardrails reduce risk; they are not a security
+> sandbox.
 
 > **Status: beta — read before you rely on it.**
 >
 > - The core (`init`, `sync`, `substrate`, `impact`, `ledger`, guards) is tested and in daily
 >   use; some flags may change before `1.0`.
 > - **Claude Code is the deepest-tested integration** (full plugin, ambient `UserPromptSubmit`
->   guards). The other eight tools receive native config plus MCP tools, but have had less
->   real-world exercise.
+>   guards). The other nine tools receive native config plus MCP tools, but have had less
+>   real-world exercise. On OpenClaw specifically, rules arrive via `AGENTS.md` project
+>   context; the config-only path uses a one-command MCP registration, while installing the
+>   package as a compatible Codex bundle loads its skills and bundle-scoped MCP server.
+>   Neither path provides ambient hooks (see
+>   [OpenClaw in ARCHITECTURE](ARCHITECTURE.md#openclaw-what-is-automatic-and-what-is-not)).
 > - **Impact/blast-radius analysis is heuristic** — a regex-approximate, conservative code
 >   graph, not a sound call graph. Treat its output as advisory.
 > - **"Proof-carrying memory" is a name, not a formal proof.** Claims are content-addressed and
 >   carry evidence references; confidence moves only when independent oracles (tests, CI, a
 >   human) raise it. There is no theorem-prover in the loop.
 > - Some integrations shell out — `forge harden`, `forge scan`, and the git-native ledger
->   assume **Bash, Git, and (for a few paths) `jq`** are available.
+>   assume **Bash, Git, and (for a few paths) `jq`** are available. Claude hooks on Windows do
+>   not require `bash` on `PATH`: their Node launcher finds Git Bash and preserves guard exits.
 
 ## Start in 60 seconds
 
@@ -128,7 +134,7 @@ The day-to-day value first — the substrate gives a frozen model what it can't
   (`forge docs sync` sweeps the diff for stale prose, `forge handoff` writes the bounded
   session snapshot the next session resumes from, `forge decide` records choices so no
   session re-decides them).
-- **One config for 9 tools.** Author your rules once; Forge emits each tool's native config,
+- **One config for 10 tools.** Author your rules once; Forge emits each tool's native config,
   plus MCP for Roo and VS Code. Zero runtime dependencies — one Node CLI, plain files in git,
   no server.
 
diff --git a/biome.json b/biome.json
index 1a74a63..90c726b 100644
--- a/biome.json
+++ b/biome.json
@@ -3,7 +3,7 @@
   "vcs": { "enabled": true, "clientKind": "git", "useIgnoreFile": true },
   "files": {
     "ignoreUnknown": true,
-    "includes": ["src/**", "test/**", "scripts/**", "bench/**"]
+    "includes": ["src/**", "test/**", "scripts/**", "bench/**", "global/guards/run.mjs"]
   },
   "formatter": {
     "enabled": true,
diff --git a/docs/GUIDE.md b/docs/GUIDE.md
index 526b6a6..133ff44 100644
--- a/docs/GUIDE.md
+++ b/docs/GUIDE.md
@@ -704,10 +704,10 @@ tools` fixes that without changing what `sync` emits.
 
 - `forge tools` — show the detected/primary tool (from `.forge/config.json`, else
   auto-detected from which agent folder exists — `CLAUDE.md`, `.cursor/`, `.gemini/`,
-  `.codex/`, `.zed/`, `.vscode/`, `.aider.conf.yml`, `.continue/`, `.windsurf/`, `.roo/`)
-  and which targets are currently gitignored.
+  `.codex/`, `.zed/`, `.vscode/`, `.aider.conf.yml`, `.continue/`, `.windsurf/`, `.roo/`,
+  `.openclaw/`) and which targets are currently gitignored.
 - `forge tools <name>` — record `<name>` (`claude` · `cursor` · `gemini` · `codex` ·
-  `zed` · `vscode` · `aider` · `continue` · `windsurf` · `roo`) as this repo's primary tool in
+  `zed` · `vscode` · `aider` · `continue` · `windsurf` · `roo` · `openclaw`) as this repo's primary tool in
   `.forge/config.json`, then write a **marked, reversible** block into `.gitignore`
   (`# forge:gitignore:begin … # forge:gitignore:end`) that ignores every OTHER tool's
   emitted artifacts. Your own `.gitignore` lines are never touched, and the shared
@@ -1209,6 +1209,17 @@ Forge substrate — pre-action advisory (advisory, never blocks):
 Nothing to wire — the plugin's [`hooks/hooks.json`](../hooks/hooks.json) installs the
 `SessionStart`, `UserPromptSubmit`, `PreToolUse`, `PostToolUse`, and `Stop` guards for you.
 
+**Windows.** Hooks are exec form (`command` + `args`), which Claude Code spawns directly with a
+plain `PATH` lookup and no shell — and a default Git for Windows install puts `git` on `PATH`
+but **not** `bash`. Every hook therefore runs through the portable launcher
+`global/guards/run.mjs` (`node run.mjs <guard>.sh [mode]`): `node` is always present, and the
+launcher finds Git Bash itself — `FORGE_BASH`, then `CLAUDE_CODE_GIT_BASH_PATH`, then the Git
+install that owns the `git` on `PATH`, the standard install dirs, and finally a `bash.exe` on
+`PATH` (never WSL's System32 launcher) — and passes stdin, stdout and the exit code through
+untouched, so a guard's exit 2 still blocks. `forge doctor` shows which bash it resolved and
+flags hooks left in the old `bash …` spelling; `forge doctor --fix` (or `forge init`) heals
+Forge-owned ones in place. On macOS/Linux nothing changes: `bash` from `PATH`, as before.
+
 Three more ambient layers ride the same hooks:
 
 **Session rehydration (SessionStart).** Besides lessons and the anchored goal, every
@@ -1298,6 +1309,54 @@ emitted `.mcp.json`):
 Forge never pretends it can force a hook into a tool that has none — **ambient on Claude
 Code, agent-invoked everywhere else.**
 
+### OpenClaw — emitted config or installable bundle
+
+OpenClaw appends the execution folder's `AGENTS.md` after its configured agent-workspace
+files as project context, so `forge sync` needs no OpenClaw-specific instruction file:
+the canonical rules arrive on their own. Only `AGENTS.md` travels that way — OpenClaw does
+not read `SOUL.md`, `IDENTITY.md`, `USER.md`, `MEMORY.md` or `BOOTSTRAP.md` from the
+execution folder — so keep anything OpenClaw must see inside the canonical body.
+
+When you use only `forge sync`, the MCP server is **not** wired automatically, on purpose.
+OpenClaw keeps its registry in your global `~/.openclaw/openclaw.json` under `mcp.servers`,
+and Forge does not write to another tool's global config. Instead `forge sync` emits the
+OpenClaw-shaped definition to `.openclaw/mcp.json`:
+
+```json
+{ "mcp": { "servers": { "forge-cortex": { "command": "forge", "args": ["cortex-mcp"] } } } }
+```
+
+Register it once, then prove it:
+
+```bash
+openclaw mcp add forge-cortex --command forge --arg cortex-mcp
+openclaw mcp doctor forge-cortex --probe
+```
+
+`.openclaw/mcp.json` is an ordinary managed MCP target: re-running `sync` is idempotent, a
+same-name server you wrote yourself is preserved (claim it with
+`forge integrations add <name> --adopt`), and `forge integrations remove <name>` reverses
+the add there exactly as it does for every other tool. Removing the entry from the file
+does **not** unregister it inside OpenClaw — use `openclaw mcp unset forge-cortex` for that.
+
+Alternatively, install ForgeKit itself as a compatible bundle. The npm package includes its
+Codex bundle manifest, skills, and MCP definition; OpenClaw maps those to native skills and
+an embedded bundle-scoped MCP server:
+
+```bash
+# Local development checkout
+openclaw plugins install --link . --accept-capabilities
+
+# Or install a trusted archive produced by `npm pack`
+openclaw plugins install ./codewithjuber-forgekit-<version>.tgz --accept-capabilities
+```
+
+Confirm `Format: bundle`, `Bundle format: codex`, and the `forge-cortex` MCP server with
+`openclaw plugins inspect forgekit`. This bundle path does not require the manual global
+`openclaw mcp add` step above. It also does not activate Forge's Claude
+`hooks/hooks.json`: OpenClaw executes only OpenClaw-style hook packs, so Forge still has no
+ambient pre-action guard there.
+
 ---
 
 ## Reading substrate output
@@ -1354,8 +1413,9 @@ picked up by the plugin and by `forge catalog`.
 
 Create `global/guards/<name>.sh` (source `_guardlib.sh` for the shared fields + the
 re-entrancy lock), then wire it in `global/settings.template.json` **and**
-[`hooks/hooks.json`](../hooks/hooks.json). Guards must be idempotent and fail-safe —
-worst case they do nothing.
+[`hooks/hooks.json`](../hooks/hooks.json) as `node …/guards/run.mjs …/guards/<name>.sh [mode]`
+— through the portable launcher, never a bare `bash` (not on `PATH` on Windows). Guards must
+be idempotent and fail-safe — worst case they do nothing.
 
 ### Add a crew member (sub-agent)
 
@@ -1426,6 +1486,8 @@ code reads but this table misses fails CI on the forge repo):
 | `FORGE_LEDGER_ONLY`                                            | Ledger-only is the DEFAULT (the ledger is the sole store). `0` is the escape hatch — restores the legacy `lessons/*.md` + recall/brain file store while external tooling migrates                                                       |
 | `FORGE_EMBED` / `FORGE_EMBED_MODEL` / `FORGE_EMBED_TIMEOUT_MS` | optional embeddings tier (ADR-0005)                                                                                                                                                                                                     |
 | `FORGE_HOME`                                                   | override `~/.forge` (recall store location)                                                                                                                                                                                             |
+| `FORGE_BASH`                                                   | explicit bash for the hook guards (the `global/guards/run.mjs` launcher). Resolution order: this, `CLAUDE_CODE_GIT_BASH_PATH`, then on Windows the Git for Windows install that owns `git` on `PATH`, the standard install dirs, a non-WSL `bash.exe` on `PATH`; POSIX uses `bash` from `PATH` |
+| `CLAUDE_CODE_GIT_BASH_PATH`                                    | Claude Code's own Git Bash location — honored by the hook launcher when `FORGE_BASH` is unset                                                                                                                                           |
 | `FORGE_ROOT`                                                   | repo root override for the MCP server                                                                                                                                                                                                   |
 | `FORGE_AUTHOR`                                                 | identity stamped on ledger provenance (defaults to git identity)                                                                                                                                                                        |
 | `FORGE_COST_CEILING`                                           | daily spend (USD) the cost-budget guard warns at (default 10)                                                                                                                                                                           |
diff --git a/docs/cognitive-substrate/README.md b/docs/cognitive-substrate/README.md
index d1622b5..62e94ae 100644
--- a/docs/cognitive-substrate/README.md
+++ b/docs/cognitive-substrate/README.md
@@ -25,8 +25,8 @@ forge atlas     # build the code graph (needed for blast-radius checks)
 ```
 
 `forge init` configures Claude Code, Codex, Cursor, Gemini, Aider, Copilot, Windsurf, Zed,
-and Continue (plus MCP config for Roo and VS Code). On Claude Code the check then runs on
-every prompt automatically.
+Continue, and OpenClaw (plus MCP config for Roo and VS Code). On Claude Code the check then
+runs on every prompt automatically.
 
 ---
 
@@ -157,6 +157,13 @@ can call directly. Details + the exact rule wording:
 Forge never pretends it can force a hook into a tool that has none — it's ambient on Claude
 Code, and agent-invoked everywhere else.
 
+**OpenClaw** is agent-invoked in exactly this sense. It picks up the rules on its own (the
+execution folder's `AGENTS.md` becomes project context), but its MCP registry is your global
+`~/.openclaw/openclaw.json`, which Forge will not write to. `forge sync` leaves the
+definition in `.openclaw/mcp.json`; you register it once with
+`openclaw mcp add forge-cortex --command forge --arg cortex-mcp`. Forge installs nothing
+into OpenClaw's own hook system.
+
 ---
 
 ## Use it in a script
diff --git a/global/guards/protect-paths.sh b/global/guards/protect-paths.sh
index 630bb6e..edde9d7 100755
--- a/global/guards/protect-paths.sh
+++ b/global/guards/protect-paths.sh
@@ -11,9 +11,9 @@ if command -v jq >/dev/null 2>&1; then
   fpath="$(printf '%s' "$input" | jq -r '.tool_input.file_path // empty')"
   cmd="$(printf '%s' "$input" | jq -r '.tool_input.command // empty')"
 else
-  tool="$(printf '%s' "$input" | grep -o '"tool_name"[[:space:]]*:[[:space:]]*"[^"]*"' | head -1 | sed 's/.*"\([^"]*\)"$/\1/')"
-  fpath="$(printf '%s' "$input" | grep -o '"file_path"[[:space:]]*:[[:space:]]*"[^"]*"' | head -1 | sed 's/.*"\([^"]*\)"$/\1/')"
-  cmd="$(printf '%s' "$input" | grep -o '"command"[[:space:]]*:[[:space:]]*"[^"]*"' | head -1 | sed 's/.*"\([^"]*\)"$/\1/')"
+  tool="$(printf '%s' "$input" | grep -o '"tool_name"[[:space:]]*:[[:space:]]*"[^"]*"' | head -1 | sed 's/.*"\([^"]*\)"$/\1/' || true)"
+  fpath="$(printf '%s' "$input" | grep -o '"file_path"[[:space:]]*:[[:space:]]*"[^"]*"' | head -1 | sed 's/.*"\([^"]*\)"$/\1/' || true)"
+  cmd="$(printf '%s' "$input" | grep -o '"command"[[:space:]]*:[[:space:]]*"[^"]*"' | head -1 | sed 's/.*"\([^"]*\)"$/\1/' || true)"
 fi
 
 deny() {
diff --git a/global/guards/run.mjs b/global/guards/run.mjs
new file mode 100644
index 0000000..b7dd4dd
--- /dev/null
+++ b/global/guards/run.mjs
@@ -0,0 +1,153 @@
+#!/usr/bin/env node
+// Forge hook launcher — runs a bash guard from an exec-form Claude Code hook on every OS.
+//
+// Why this exists: exec-form hooks (`command` + `args`) are spawned directly — no shell, just a
+// plain PATH lookup of `command`. Forge's hooks were `command: "bash"`. On Windows, Git for Windows
+// puts `git.exe` on PATH (`Git\cmd`) but NOT `bash.exe` (`Git\bin`, `Git\usr\bin`), so every hook
+// — SessionStart first — died with `spawn bash ENOENT` before a guard ever ran. `node` IS a real
+// executable on PATH wherever this package is installed, so hooks now spawn
+// `node run.mjs <guard.sh> [args…]` and THIS file finds bash: $FORGE_BASH, Claude Code's own
+// $CLAUDE_CODE_GIT_BASH_PATH, the Git for Windows install that owns the `git` on PATH, the standard
+// install dirs, then PATH itself — skipping the WSL launcher in System32, which is not Git Bash.
+// POSIX is unchanged: `bash` from PATH, exactly as before.
+//
+// It must never weaken a guard: stdin (the hook JSON), stdout (SessionStart context,
+// `updatedToolOutput`) and stderr are inherited untouched, and bash's exit code is returned
+// verbatim — a guard's exit 2 still blocks. With no bash anywhere it prints ONE actionable line and
+// exits 1: the same visible, non-blocking hook error the ENOENT was, minus the mystery. Node
+// built-ins only — a launcher that itself failed to load would be exactly the silent no-op the
+// guards exist to prevent.
+import { spawnSync } from "node:child_process";
+import { existsSync } from "node:fs";
+import { basename, win32 } from "node:path";
+import { fileURLToPath } from "node:url";
+
+export const NO_BASH_HINT =
+  "no bash found to run the hook guards — install Git for Windows (bash ships with it) or point " +
+  "FORGE_BASH (or CLAUDE_CODE_GIT_BASH_PATH) at your bash executable";
+
+/**
+ * Windows dirs that ship a `bash.exe` which is NOT Git Bash (the WSL launcher in System32).
+ * @param {string} dir
+ * @param {NodeJS.ProcessEnv} env
+ */
+function isSystemDir(dir, env) {
+  /** @param {string} p */
+  const norm = (p) => String(p).toLowerCase().replaceAll("/", "\\").replace(/\\+$/, "");
+  const d = norm(dir);
+  return [env.SystemRoot, env.windir, "C:\\Windows"]
+    .filter(Boolean)
+    .some((r) => d === norm(r) || d.startsWith(`${norm(r)}\\`));
+}
+
+/**
+ * Locate the bash that runs the guards. `path` is what to spawn (`null` when nothing usable
+ * exists); `via` says how it was found (doctor prints it). Pure — env, platform and the
+ * filesystem probe are injectable, so the Windows logic is unit-tested on every OS.
+ * @param {{env?: NodeJS.ProcessEnv, platform?: string, exists?: (p: string) => boolean}} [opts]
+ * @returns {{ path: string | null, via: string }}
+ */
+export function resolveBash({
+  env = process.env,
+  platform = process.platform,
+  exists = existsSync,
+} = {}) {
+  // 1. Explicit overrides win on every OS: FORGE_BASH (ours), then CLAUDE_CODE_GIT_BASH_PATH —
+  //    Claude Code's own setting for the same problem (portable Git, MSYS2, a custom prefix).
+  /** @type {[string, string | undefined][]} */
+  const overrides = [
+    ["FORGE_BASH", env.FORGE_BASH],
+    ["CLAUDE_CODE_GIT_BASH_PATH", env.CLAUDE_CODE_GIT_BASH_PATH],
+  ];
+  for (const [via, p] of overrides) if (p && exists(p)) return { path: p, via };
+  // 2. POSIX: bash from PATH, exactly as the hooks always did (spawn reports ENOENT if absent).
+  if (platform !== "win32") return { path: "bash", via: "PATH" };
+  // 3. Windows — Windows path semantics regardless of the host running this logic (tests).
+  const P = win32;
+  const pathDirs = String(env.PATH ?? env.Path ?? "")
+    .split(P.delimiter)
+    .filter(Boolean);
+  const seen = new Set();
+  /** @type {string[]} */
+  const candidates = [];
+  /** @param {string} p */
+  const add = (p) => {
+    const k = p.toLowerCase();
+    if (!seen.has(k)) {
+      seen.add(k);
+      candidates.push(p);
+    }
+  };
+  // 3a. The Git for Windows install that owns the `git` on PATH: a default install exposes
+  //     `Git\cmd\git.exe` only; its siblings `Git\bin\bash.exe` / `Git\usr\bin\bash.exe` are the
+  //     bash the guards need. Also covers `Git\bin` or `Git\mingw64\bin` being the PATH entry.
+  for (const dir of pathDirs) {
+    if (isSystemDir(dir, env) || !exists(P.join(dir, "git.exe"))) continue;
+    const root = P.dirname(dir);
+    for (const r of [root, P.dirname(root)]) {
+      add(P.join(r, "bin", "bash.exe"));
+      add(P.join(r, "usr", "bin", "bash.exe"));
+    }
+  }
+  // 3b. Standard install dirs: system-wide, per-user, scoop.
+  for (const base of [env.ProgramFiles, env.ProgramW6432, env["ProgramFiles(x86)"]]) {
+    if (base) add(P.join(base, "Git", "bin", "bash.exe"));
+  }
+  if (env.LOCALAPPDATA) add(P.join(env.LOCALAPPDATA, "Programs", "Git", "bin", "bash.exe"));
+  if (env.USERPROFILE)
+    add(P.join(env.USERPROFILE, "scoop", "apps", "git", "current", "bin", "bash.exe"));
+  for (const p of candidates) if (exists(p)) return { path: p, via: "git-for-windows" };
+  // 3c. A bash.exe on PATH — but never the WSL launcher in System32.
+  for (const dir of pathDirs) {
+    if (isSystemDir(dir, env)) continue;
+    const p = P.join(dir, "bash.exe");
+    if (exists(p)) return { path: p, via: "PATH" };
+  }
+  return { path: null, via: "none" };
+}
+
+/**
+ * `${CLAUDE_PLUGIN_ROOT}` is substituted as a native `C:\…` string on Windows; Git Bash's
+ * `dirname`/`cd` are happiest with forward slashes. No-op on POSIX.
+ * @param {string} p
+ */
+const toPosix = (p) => String(p).replaceAll("\\", "/");
+
+/**
+ * Spawn `bash <script> …args` with inherited stdio and return the exit code to report.
+ * @param {string[]} argv `[guardScript, ...guardArgs]`
+ * @param {NodeJS.ProcessEnv} [env]
+ * @returns {number}
+ */
+export function runGuard(argv, env = process.env) {
+  const self = basename(fileURLToPath(import.meta.url));
+  const [script, ...rest] = argv;
+  if (!script) {
+    process.stderr.write(`${self}: usage: node ${self} <guard.sh> [args…]\n`);
+    return 1;
+  }
+  const { path } = resolveBash({ env });
+  if (!path) {
+    process.stderr.write(`${self}: ${NO_BASH_HINT}\n`);
+    return 1;
+  }
+  const r = spawnSync(path, [toPosix(script), ...rest], {
+    stdio: "inherit",
+    env,
+    windowsHide: true,
+  });
+  if (r.error) {
+    const code = /** @type {NodeJS.ErrnoException} */ (r.error).code;
+    process.stderr.write(`${self}: ${code === "ENOENT" ? NO_BASH_HINT : r.error.message}\n`);
+    return 1;
+  }
+  // A signal-killed guard has no status: 1 keeps it a visible non-blocking error, never a block.
+  return r.status ?? 1;
+}
+
+// Run only as the hook entrypoint (`node run.mjs …`). Importing it (doctor, tests) must not spawn
+// anything — and the check is by basename, so a `~/.forge` symlink install cannot fool it.
+const invokedAs = process.argv[1] ? basename(process.argv[1]).toLowerCase() : "";
+if (invokedAs === basename(fileURLToPath(import.meta.url)).toLowerCase()) {
+  process.exitCode = runGuard(process.argv.slice(2));
+}
diff --git a/global/settings.template.json b/global/settings.template.json
index 5f73996..2f2c73f 100644
--- a/global/settings.template.json
+++ b/global/settings.template.json
@@ -5,8 +5,11 @@
   "cleanupPeriodDays": 30,
   "statusLine": {
     "type": "command",
-    "command": "bash",
-    "args": ["~/.forge/statusline.sh"]
+    "command": "node",
+    "args": [
+      "~/.forge/guards/run.mjs",
+      "~/.forge/statusline.sh"
+    ]
   },
   "permissions": {
     "defaultMode": "default",
@@ -77,13 +80,21 @@
         "hooks": [
           {
             "type": "command",
-            "command": "bash",
-            "args": ["~/.forge/guards/cortex.sh", "prompt"]
+            "command": "node",
+            "args": [
+              "~/.forge/guards/run.mjs",
+              "~/.forge/guards/cortex.sh",
+              "prompt"
+            ]
           },
           {
             "type": "command",
-            "command": "bash",
-            "args": ["~/.forge/guards/cortex.sh", "preflight"]
+            "command": "node",
+            "args": [
+              "~/.forge/guards/run.mjs",
+              "~/.forge/guards/cortex.sh",
+              "preflight"
+            ]
           }
         ]
       }
@@ -94,13 +105,20 @@
         "hooks": [
           {
             "type": "command",
-            "command": "bash",
-            "args": ["~/.forge/guards/recall-load.sh"]
+            "command": "node",
+            "args": [
+              "~/.forge/guards/run.mjs",
+              "~/.forge/guards/recall-load.sh"
+            ]
           },
           {
             "type": "command",
-            "command": "bash",
-            "args": ["~/.forge/guards/cortex.sh", "session-start"]
+            "command": "node",
+            "args": [
+              "~/.forge/guards/run.mjs",
+              "~/.forge/guards/cortex.sh",
+              "session-start"
+            ]
           }
         ]
       }
@@ -111,18 +129,27 @@
         "hooks": [
           {
             "type": "command",
-            "command": "bash",
-            "args": ["~/.forge/guards/protect-paths.sh"]
+            "command": "node",
+            "args": [
+              "~/.forge/guards/run.mjs",
+              "~/.forge/guards/protect-paths.sh"
+            ]
           },
           {
             "type": "command",
-            "command": "bash",
-            "args": ["~/.forge/guards/cost-budget.sh"]
+            "command": "node",
+            "args": [
+              "~/.forge/guards/run.mjs",
+              "~/.forge/guards/cost-budget.sh"
+            ]
           },
           {
             "type": "command",
-            "command": "bash",
-            "args": ["~/.forge/guards/doom-loop.sh"]
+            "command": "node",
+            "args": [
+              "~/.forge/guards/run.mjs",
+              "~/.forge/guards/doom-loop.sh"
+            ]
           }
         ]
       },
@@ -131,8 +158,12 @@
         "hooks": [
           {
             "type": "command",
-            "command": "bash",
-            "args": ["~/.forge/guards/cortex.sh", "pre-edit"]
+            "command": "node",
+            "args": [
+              "~/.forge/guards/run.mjs",
+              "~/.forge/guards/cortex.sh",
+              "pre-edit"
+            ]
           }
         ]
       }
@@ -143,13 +174,20 @@
         "hooks": [
           {
             "type": "command",
-            "command": "bash",
-            "args": ["~/.forge/guards/format-on-edit.sh"]
+            "command": "node",
+            "args": [
+              "~/.forge/guards/run.mjs",
+              "~/.forge/guards/format-on-edit.sh"
+            ]
           },
           {
             "type": "command",
-            "command": "bash",
-            "args": ["~/.forge/guards/cortex.sh", "capture"]
+            "command": "node",
+            "args": [
+              "~/.forge/guards/run.mjs",
+              "~/.forge/guards/cortex.sh",
+              "capture"
+            ]
           }
         ]
       },
@@ -158,13 +196,20 @@
         "hooks": [
           {
             "type": "command",
-            "command": "bash",
-            "args": ["~/.forge/guards/secret-redact.sh"]
+            "command": "node",
+            "args": [
+              "~/.forge/guards/run.mjs",
+              "~/.forge/guards/secret-redact.sh"
+            ]
           },
           {
             "type": "command",
-            "command": "bash",
-            "args": ["~/.forge/guards/cortex.sh", "capture"]
+            "command": "node",
+            "args": [
+              "~/.forge/guards/run.mjs",
+              "~/.forge/guards/cortex.sh",
+              "capture"
+            ]
           }
         ]
       }
@@ -174,23 +219,36 @@
         "hooks": [
           {
             "type": "command",
-            "command": "bash",
-            "args": ["~/.forge/guards/completion-gate.sh"]
+            "command": "node",
+            "args": [
+              "~/.forge/guards/run.mjs",
+              "~/.forge/guards/completion-gate.sh"
+            ]
           },
           {
             "type": "command",
-            "command": "bash",
-            "args": ["~/.forge/guards/lean-guard.sh"]
+            "command": "node",
+            "args": [
+              "~/.forge/guards/run.mjs",
+              "~/.forge/guards/lean-guard.sh"
+            ]
           },
           {
             "type": "command",
-            "command": "bash",
-            "args": ["~/.forge/guards/session-learner.sh"]
+            "command": "node",
+            "args": [
+              "~/.forge/guards/run.mjs",
+              "~/.forge/guards/session-learner.sh"
+            ]
           },
           {
             "type": "command",
-            "command": "bash",
-            "args": ["~/.forge/guards/cortex.sh", "stop"]
+            "command": "node",
+            "args": [
+              "~/.forge/guards/run.mjs",
+              "~/.forge/guards/cortex.sh",
+              "stop"
+            ]
           }
         ]
       }
diff --git a/hooks/hooks.json b/hooks/hooks.json
index f2b9379..bc0cea3 100644
--- a/hooks/hooks.json
+++ b/hooks/hooks.json
@@ -6,13 +6,17 @@
         "hooks": [
           {
             "type": "command",
-            "command": "bash",
-            "args": ["${CLAUDE_PLUGIN_ROOT}/global/guards/recall-load.sh"]
+            "command": "node",
+            "args": [
+              "${CLAUDE_PLUGIN_ROOT}/global/guards/run.mjs",
+              "${CLAUDE_PLUGIN_ROOT}/global/guards/recall-load.sh"
+            ]
           },
           {
             "type": "command",
-            "command": "bash",
+            "command": "node",
             "args": [
+              "${CLAUDE_PLUGIN_ROOT}/global/guards/run.mjs",
               "${CLAUDE_PLUGIN_ROOT}/global/guards/cortex.sh",
               "session-start"
             ]
@@ -25,13 +29,18 @@
         "hooks": [
           {
             "type": "command",
-            "command": "bash",
-            "args": ["${CLAUDE_PLUGIN_ROOT}/global/guards/cortex.sh", "prompt"]
+            "command": "node",
+            "args": [
+              "${CLAUDE_PLUGIN_ROOT}/global/guards/run.mjs",
+              "${CLAUDE_PLUGIN_ROOT}/global/guards/cortex.sh",
+              "prompt"
+            ]
           },
           {
             "type": "command",
-            "command": "bash",
+            "command": "node",
             "args": [
+              "${CLAUDE_PLUGIN_ROOT}/global/guards/run.mjs",
               "${CLAUDE_PLUGIN_ROOT}/global/guards/cortex.sh",
               "preflight"
             ]
@@ -45,18 +54,27 @@
         "hooks": [
           {
             "type": "command",
-            "command": "bash",
-            "args": ["${CLAUDE_PLUGIN_ROOT}/global/guards/protect-paths.sh"]
+            "command": "node",
+            "args": [
+              "${CLAUDE_PLUGIN_ROOT}/global/guards/run.mjs",
+              "${CLAUDE_PLUGIN_ROOT}/global/guards/protect-paths.sh"
+            ]
           },
           {
             "type": "command",
-            "command": "bash",
-            "args": ["${CLAUDE_PLUGIN_ROOT}/global/guards/cost-budget.sh"]
+            "command": "node",
+            "args": [
+              "${CLAUDE_PLUGIN_ROOT}/global/guards/run.mjs",
+              "${CLAUDE_PLUGIN_ROOT}/global/guards/cost-budget.sh"
+            ]
           },
           {
             "type": "command",
-            "command": "bash",
-            "args": ["${CLAUDE_PLUGIN_ROOT}/global/guards/doom-loop.sh"]
+            "command": "node",
+            "args": [
+              "${CLAUDE_PLUGIN_ROOT}/global/guards/run.mjs",
+              "${CLAUDE_PLUGIN_ROOT}/global/guards/doom-loop.sh"
+            ]
           }
         ]
       },
@@ -65,8 +83,9 @@
         "hooks": [
           {
             "type": "command",
-            "command": "bash",
+            "command": "node",
             "args": [
+              "${CLAUDE_PLUGIN_ROOT}/global/guards/run.mjs",
               "${CLAUDE_PLUGIN_ROOT}/global/guards/cortex.sh",
               "pre-edit"
             ]
@@ -80,13 +99,20 @@
         "hooks": [
           {
             "type": "command",
-            "command": "bash",
-            "args": ["${CLAUDE_PLUGIN_ROOT}/global/guards/format-on-edit.sh"]
+            "command": "node",
+            "args": [
+              "${CLAUDE_PLUGIN_ROOT}/global/guards/run.mjs",
+              "${CLAUDE_PLUGIN_ROOT}/global/guards/format-on-edit.sh"
+            ]
           },
           {
             "type": "command",
-            "command": "bash",
-            "args": ["${CLAUDE_PLUGIN_ROOT}/global/guards/cortex.sh", "capture"]
+            "command": "node",
+            "args": [
+              "${CLAUDE_PLUGIN_ROOT}/global/guards/run.mjs",
+              "${CLAUDE_PLUGIN_ROOT}/global/guards/cortex.sh",
+              "capture"
+            ]
           }
         ]
       },
@@ -95,13 +121,20 @@
         "hooks": [
           {
             "type": "command",
-            "command": "bash",
-            "args": ["${CLAUDE_PLUGIN_ROOT}/global/guards/secret-redact.sh"]
+            "command": "node",
+            "args": [
+              "${CLAUDE_PLUGIN_ROOT}/global/guards/run.mjs",
+              "${CLAUDE_PLUGIN_ROOT}/global/guards/secret-redact.sh"
+            ]
           },
           {
             "type": "command",
-            "command": "bash",
-            "args": ["${CLAUDE_PLUGIN_ROOT}/global/guards/cortex.sh", "capture"]
+            "command": "node",
+            "args": [
+              "${CLAUDE_PLUGIN_ROOT}/global/guards/run.mjs",
+              "${CLAUDE_PLUGIN_ROOT}/global/guards/cortex.sh",
+              "capture"
+            ]
           }
         ]
       }
@@ -111,23 +144,36 @@
         "hooks": [
           {
             "type": "command",
-            "command": "bash",
-            "args": ["${CLAUDE_PLUGIN_ROOT}/global/guards/completion-gate.sh"]
+            "command": "node",
+            "args": [
+              "${CLAUDE_PLUGIN_ROOT}/global/guards/run.mjs",
+              "${CLAUDE_PLUGIN_ROOT}/global/guards/completion-gate.sh"
+            ]
           },
           {
             "type": "command",
-            "command": "bash",
-            "args": ["${CLAUDE_PLUGIN_ROOT}/global/guards/lean-guard.sh"]
+            "command": "node",
+            "args": [
+              "${CLAUDE_PLUGIN_ROOT}/global/guards/run.mjs",
+              "${CLAUDE_PLUGIN_ROOT}/global/guards/lean-guard.sh"
+            ]
           },
           {
             "type": "command",
-            "command": "bash",
-            "args": ["${CLAUDE_PLUGIN_ROOT}/global/guards/session-learner.sh"]
+            "command": "node",
+            "args": [
+              "${CLAUDE_PLUGIN_ROOT}/global/guards/run.mjs",
+              "${CLAUDE_PLUGIN_ROOT}/global/guards/session-learner.sh"
+            ]
           },
           {
             "type": "command",
-            "command": "bash",
-            "args": ["${CLAUDE_PLUGIN_ROOT}/global/guards/cortex.sh", "stop"]
+            "command": "node",
+            "args": [
+              "${CLAUDE_PLUGIN_ROOT}/global/guards/run.mjs",
+              "${CLAUDE_PLUGIN_ROOT}/global/guards/cortex.sh",
+              "stop"
+            ]
           }
         ]
       }
diff --git a/mintlify/cli/config.mdx b/mintlify/cli/config.mdx
index ab45d14..7100ba7 100644
--- a/mintlify/cli/config.mdx
+++ b/mintlify/cli/config.mdx
@@ -96,8 +96,8 @@ forge tools
 ## `forge integrations`
 
 Opt-in third-party MCP servers (for example `context7`), managed non-destructively across
-every tool Forge emits config for — Claude Code, Codex, Cursor, Gemini, Continue, and the
-rest.
+every tool Forge emits config for — Claude Code, Codex, Cursor, Gemini, Continue, OpenClaw,
+and the rest.
 
 Third-party MCP servers are **not** installed by default. Nothing lands on disk until you
 run `forge integrations add <name> --yes`.
diff --git a/mintlify/concepts/config-compiler.mdx b/mintlify/concepts/config-compiler.mdx
index 6a5efec..66c6eaa 100644
--- a/mintlify/concepts/config-compiler.mdx
+++ b/mintlify/concepts/config-compiler.mdx
@@ -77,7 +77,7 @@ compaction.
 
 ## The verified cross-tool emit matrix
 
-Forge emits config for **nine tools**, plus an MCP server for Roo Code and VS Code. Each
+Forge emits config for **ten tools**, plus an MCP server for Roo Code and VS Code. Each
 row is confirmed against vendor docs.
 
 | Tool               | Native target                                                     | How Forge emits                                                        |
@@ -91,10 +91,20 @@ row is confirmed against vendor docs.
 | **Windsurf/Devin** | `AGENTS.md` auto-discovered (caps 6k/12k chars)                | Root `AGENTS.md` under caps; detects `.windsurf` vs `.devin`          |
 | **Zed**            | first match of a precedence list incl. `AGENTS.md`             | Emits `AGENTS.md`; doctor flags any shadowing legacy file             |
 | **Continue**       | `.continue/rules/*.md` + `.continue/mcpServers/*.yaml`         | Emits a rules file plus the Forge MCP server config                   |
+| **OpenClaw**       | execution-folder `AGENTS.md`; MCP registry is global          | Relies on root `AGENTS.md`; writes `.openclaw/mcp.json` to apply once |
 
 Roo Code and VS Code receive the Forge MCP server via `forge init` (`.roo/mcp.json`,
 `.vscode/mcp.json`) rather than a rules file.
 
+<Note>
+  **OpenClaw MCP is a deliberate manual step.** OpenClaw stores servers in your global
+  `~/.openclaw/openclaw.json`, which Forge will not write to. `forge sync` leaves the
+  definition in `.openclaw/mcp.json`; register it with
+  `openclaw mcp add forge-cortex --command forge --arg cortex-mcp`, then verify with
+  `openclaw mcp doctor forge-cortex --probe`. Forge adds no OpenClaw hooks — rules reach
+  it through `AGENTS.md` project context and the MCP tools, nothing more.
+</Note>
+
 <Warning>
   **Char caps are real.** Codex truncates at 32 KiB, Windsurf at 6k/12k. `forge sync`
   enforces a source size budget so a config never silently truncates.
diff --git a/mintlify/guides/zero-config-onboarding.mdx b/mintlify/guides/zero-config-onboarding.mdx
index 635d922..beeaa21 100644
--- a/mintlify/guides/zero-config-onboarding.mdx
+++ b/mintlify/guides/zero-config-onboarding.mdx
@@ -47,8 +47,8 @@ cd ~/your-project
 forge init                 # emits AGENTS.md, CLAUDE.md, .gemini/settings.json, .aider.conf.yml …
 ```
 
-Now Claude Code, Codex, Cursor, Gemini, Aider, Copilot, Windsurf, Zed, and Continue all
-read the **same** rules — each from its own native file. Change a rule later by editing
+Now Claude Code, Codex, Cursor, Gemini, Aider, Copilot, Windsurf, Zed, Continue, and
+OpenClaw all read the **same** rules — each from its own native file. Change a rule later by editing
 `source/rules.json` (or dropping a per-repo `.forge/rules.json`), then run `forge sync`.
 
 ## 3. Use the cognitive substrate
diff --git a/mintlify/introduction.mdx b/mintlify/introduction.mdx
index 50cf6f2..cc17e1f 100644
--- a/mintlify/introduction.mdx
+++ b/mintlify/introduction.mdx
@@ -82,15 +82,15 @@ state between calls; Forge is the state.
 - **Work that finishes end to end.** A completion gate blocks "done" once per session
   when code moved but no doc or state artifact followed, with the repair checklist as
   the answer.
-- **One config for 9 tools.** Author your rules once; Forge emits each tool's native
+- **One config for 10 tools.** Author your rules once; Forge emits each tool's native
   config, plus MCP for Roo and VS Code. Zero runtime dependencies — one Node CLI, plain
   files in git, no server.
 
 ## Which tools does Forge feed?
 
-Forge emits config for **nine tools**, plus an MCP server for Roo Code and VS Code:
-Claude Code, Codex, Cursor, Gemini, Aider, Copilot, Windsurf/Devin, Zed, and Continue.
-Each reads the same rules from its own native file.
+Forge emits config for **ten tools**, plus an MCP server for Roo Code and VS Code:
+Claude Code, Codex, Cursor, Gemini, Aider, Copilot, Windsurf/Devin, Zed, Continue, and
+OpenClaw. Each reads the same rules from its own native file.
 
 The only MCP server wired by default is Forge's own (`src/cortex_mcp.js`) — the substrate
 checks and memory reads. Third-party MCP servers such as `context7` are **opt-in** and
diff --git a/mintlify/quickstart.mdx b/mintlify/quickstart.mdx
index 3cd3525..c6ecba9 100644
--- a/mintlify/quickstart.mdx
+++ b/mintlify/quickstart.mdx
@@ -38,8 +38,9 @@ including the symlink dev setup.
     ```
     This emits `AGENTS.md`, `CLAUDE.md`, `.gemini/settings.json`, `.aider.conf.yml`, and
     the rest — plus the `.gitattributes` union-merge rule the ledger needs. Claude Code,
-    Codex, Cursor, Gemini, Aider, Copilot, Windsurf, Zed, and Continue now read the
-    **same** rules, each from its own native file.
+    Codex, Cursor, Gemini, Aider, Copilot, Windsurf, Zed, Continue, and OpenClaw now
+    read the **same** rules, each from its own native file. On OpenClaw the MCP server is
+    one extra command: `openclaw mcp add forge-cortex --command forge --arg cortex-mcp`.
   </Step>
   <Step title="Health-check the setup">
     ```bash
diff --git a/scripts/smoke-install.sh b/scripts/smoke-install.sh
index 22a33a4..6646338 100755
--- a/scripts/smoke-install.sh
+++ b/scripts/smoke-install.sh
@@ -7,14 +7,16 @@
 #
 # What it proves:
 #   1. `bash install.sh` (driven with HOME=<tmp>) creates resolvable asset symlinks, merges
-#      the exec-form hooks (command:"bash" + args + the _forge marker) into settings.json,
-#      and leaves the guard scripts present + executable.
+#      the exec-form hooks (command:"node" + args through guards/run.mjs + the _forge marker)
+#      into settings.json, and leaves the guard scripts present + executable.
 #   2. `forge init --settings-only` (FORGE_SETTINGS_PATH into the temp HOME) exits 0 and is
 #      idempotent — a second run leaves the file byte-for-byte unchanged.
 #   3. The uninstall path removes the Forge hooks AND the symlinks, exit 0.
 #   4. A corrupt settings.json makes `forge init --settings-only` exit non-zero (RA-04).
-#   5. Installing under a path WITH A SPACE and then executing an installed guard proves the
-#      ME-23 exec form + RA-12 quoting survive spaces (the concrete RA-12/ME-23 regression).
+#   5. Installing under a path WITH A SPACE and then executing an installed guard — directly AND
+#      through the portable launcher (`node run.mjs guard.sh`, the exact exec-form shape the
+#      hooks use) — proves the ME-23 exec form + RA-12 quoting survive spaces and that the
+#      launcher passes stdin + exit code through (a block stays exit 2).
 set -euo pipefail
 
 REPO="$(cd "$(dirname "$0")/.." && pwd)"
@@ -62,13 +64,17 @@ for g in protect-paths.sh cost-budget.sh doom-loop.sh cortex.sh; do
 done
 ok "guard scripts present + executable"
 
-# Exec form (ME-23): command:"bash", an args array, and the _forge marker must all be present.
-grep -q '"command": "bash"' "$SETTINGS" || fail "settings.json has no exec-form command:\"bash\""
+# Exec form (ME-23) through the portable launcher: command:"node", an args array whose first
+# element is guards/run.mjs, and the _forge marker must all be present. A bare `bash` command is
+# the Windows regression (bash is not on PATH there) and must never come back.
+grep -q '"command": "node"' "$SETTINGS" || fail "settings.json has no exec-form command:\"node\""
+! grep -q '"command": "bash"' "$SETTINGS" || fail "settings.json still spawns a bare bash (Windows regression)"
+grep -q 'guards/run.mjs'    "$SETTINGS" || fail "settings.json hooks don't go through guards/run.mjs"
 grep -q '"args"'            "$SETTINGS" || fail "settings.json hooks have no args array"
 grep -q '"_forge"'          "$SETTINGS" || fail "settings.json missing the _forge marker"
 # A hook must actually point at a guard script (proves args carry the real path).
 grep -q 'guards/protect-paths.sh' "$SETTINGS" || fail "settings.json hooks don't reference the guards"
-ok "settings.json carries exec-form Forge hooks (command/args/_forge)"
+ok "settings.json carries exec-form Forge hooks (node + run.mjs + args + _forge)"
 
 # ---------------------------------------------------------------------------
 phase "2. forge init --settings-only is idempotent"
@@ -130,4 +136,26 @@ set -e
 [ "$gcode" -eq 0 ] || { cat "$WORK/guard.log" >&2; fail "guard under spaced path exited $gcode (expected 0)"; }
 ok "installed guard runs from a spaced path and allows a benign call"
 
+# The same guard through the launcher — the exact argv an installed hook spawns. Benign → 0.
+LAUNCHER="$SPACE_HOME/.forge/guards/run.mjs"
+[ -f "$LAUNCHER" ] || fail "launcher missing under spaced path: $LAUNCHER"
+set +e
+"$NODE" "$LAUNCHER" "$GUARD" <"$BENIGN" >"$WORK/launcher-benign.log" 2>&1
+lcode=$?
+set -e
+[ "$lcode" -eq 0 ] || { cat "$WORK/launcher-benign.log" >&2; fail "launcher+guard under spaced path exited $lcode (expected 0)"; }
+ok "launcher runs the installed guard from a spaced path (benign → exit 0)"
+
+# ...and a protected-path write must still BLOCK (exit 2) end to end — the launcher never weakens
+# a guard: stdin reaches bash and bash's exit code comes back verbatim.
+BLOCKED="$WORK/blocked-hook.json"
+printf '%s' '{"tool_name":"Write","tool_input":{"file_path":"/x/.env"}}' >"$BLOCKED"
+set +e
+"$NODE" "$LAUNCHER" "$GUARD" <"$BLOCKED" >"$WORK/launcher-block.log" 2>&1
+bcode=$?
+set -e
+[ "$bcode" -eq 2 ] || { cat "$WORK/launcher-block.log" >&2; fail "launcher+guard did not block a .env write (exit $bcode, expected 2)"; }
+grep -q 'env file' "$WORK/launcher-block.log" || fail "block reason did not pass through the launcher"
+ok "launcher propagates a guard BLOCK (exit 2 + stderr) unchanged"
+
 printf '\nAll %s smoke assertions passed.\n' "$PASS"
diff --git a/src/docs_check.js b/src/docs_check.js
index ad1ebf2..34597e0 100644
--- a/src/docs_check.js
+++ b/src/docs_check.js
@@ -50,8 +50,8 @@ export function srcFiles(root) {
     .map((f) => join(dir, f));
 }
 
-/** Every env var name the package actually reads: process.env.X in src/*.js plus
- *  $X / ${X...} in the shell guards (they are part of the same env contract). */
+/** Every env var name the package actually reads: process.env.X in src/*.js, $X / ${X...} in
+ *  the shell guards, and (process.)env.X in the Node guards/launcher — one env contract. */
 export function envVarsRead(root = BRAND.root) {
   const vars = new Set();
   for (const file of srcFiles(root)) {
@@ -70,6 +70,15 @@ export function envVarsRead(root = BRAND.root) {
       ))
         vars.add(m[1]);
     }
+    // The Node guards and the hook launcher (`*.mjs`) are the same contract: `process.env.X`, or
+    // an injected `env.X` (run.mjs takes env as a parameter so its Windows logic is testable).
+    for (const f of readdirSync(guards).filter((f) => f.endsWith(".mjs"))) {
+      const text = readFileSync(join(guards, f), "utf8");
+      for (const m of text.matchAll(
+        /\b(?:process\.)?env\.((?:FORGE|ANTHROPIC|LITELLM|OPENROUTER|ENABLE_CORTEX|CLAUDE)_[A-Z0-9_]*)/g,
+      ))
+        vars.add(m[1]);
+    }
   }
   return vars;
 }
diff --git a/src/doctor.js b/src/doctor.js
index 80ed010..1fd9758 100644
--- a/src/doctor.js
+++ b/src/doctor.js
@@ -14,13 +14,14 @@ import {
 } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
+import { NO_BASH_HINT, resolveBash } from "../global/guards/run.mjs";
 import { isStale, load as loadAtlas } from "./atlas.js";
 import { BRAND } from "./brand.js";
 import { summary as cortexSummary } from "./cortex.js";
 import { docsCheck } from "./docs_check.js";
 import { hashContent, mdHeader } from "./emit/_shared.js";
 import { gatewayBase, gatewayModelMap } from "./gateway_model_map.js";
-import { ensureLedgerGitattributes, guardKey, mergeSettings } from "./init.js";
+import { ensureLedgerGitattributes, guardKey, isStaleManagedHook, mergeSettings } from "./init.js";
 import { verify as ledgerVerify, repoLedger } from "./ledger_store.js";
 import { PRICING_VERIFIED } from "./model_tiers.js";
 import { activeProvider, envModelOverride } from "./providers.js";
@@ -68,18 +69,23 @@ function templateGuardKeys() {
   }
 }
 
-// Every guard identity actually wired into a settings file's hook tree (quote-normalized).
-function installedGuardKeys(hooks) {
-  const keys = new Set();
+// Every hook entry actually wired into a settings file's hook tree (either form).
+function installedHooks(hooks) {
+  const out = [];
   if (hooks && typeof hooks === "object") {
     for (const entries of Object.values(hooks)) {
       for (const entry of Array.isArray(entries) ? entries : []) {
         for (const h of entry?.hooks || [])
-          if (typeof h?.command === "string" || Array.isArray(h?.args)) keys.add(guardKey(h));
+          if (typeof h?.command === "string" || Array.isArray(h?.args)) out.push(h);
       }
     }
   }
-  return keys;
+  return out;
+}
+
+// Every guard identity actually wired into a settings file's hook tree (quote-normalized).
+function installedGuardKeys(hooks) {
+  return new Set(installedHooks(hooks).map((h) => guardKey(h)));
 }
 
 // The user's ~/.claude/settings.json must carry Forge's hooks + permissions or none of the
@@ -112,6 +118,20 @@ function checkSettings(out, settingsPath) {
   // ACTIVE only when EVERY required guard identity is wired AND permissions are present —
   // a stale/partial install (marker set, guards missing) reports DEGRADED, not green.
   if (required.length && missing.length === 0 && hasPerms) {
+    // Wired but in an OLDER spelling — the pre-launcher `bash …` exec form fails on Windows when
+    // bash is not on PATH — is DEGRADED, not green. The idempotent merge heals owned entries;
+    // unowned, hand-written entries remain untouched and need a manual update.
+    const stale = installedHooks(data.hooks).filter((h) => isStaleManagedHook(h));
+    if (stale.length) {
+      out.push({
+        ...warn(
+          "settings",
+          `${stale.length} hook(s) predate the portable launcher (guards/run.mjs) — they fail on Windows when bash is not on PATH; \`forge doctor --fix\` / \`forge init\` heals Forge-owned entries, while hand-written entries must be updated manually`,
+        ),
+        fix,
+      });
+      return;
+    }
     out.push(
       ok("settings", `forge-managed — ${required.length} hook guard(s) + permissions wired`),
     );
@@ -138,6 +158,15 @@ function checkTooling(out) {
           "not found — secret-redact CANNOT run; tool output is NOT scanned for secrets",
         ),
   );
+  // bash runs every guard, spawned by guards/run.mjs from an exec-form hook. A default Git for
+  // Windows install has git on PATH but NOT bash — resolve it exactly the way the launcher does.
+  const shell = resolveBash();
+  const bashOk = shell.path && (shell.path === "bash" ? hasBin("bash") : existsSync(shell.path));
+  out.push(
+    bashOk
+      ? ok("bash", `found via ${shell.via} — hook guards run through guards/run.mjs`)
+      : fail("bash", `not found — hook guards CANNOT run; ${NO_BASH_HINT}`),
+  );
   out.push(
     hasBin("jq")
       ? ok("jq", "found — protect-paths parses hook JSON precisely")
@@ -376,6 +405,7 @@ function checkPluginCompatibility(out) {
 // verify it is a symlink (or the expected install dir) whose contents include the required
 // guard files, that they are readable and (for the `.sh` launchers) executable.
 const REQUIRED_INSTALL_ASSETS = [
+  join("guards", "run.mjs"),
   join("guards", "protect-paths.sh"),
   join("guards", "secret-redact.sh"),
   join("guards", "secret-redact.mjs"),
diff --git a/src/emit/mcp.js b/src/emit/mcp.js
index e3b4e07..456e303 100644
--- a/src/emit/mcp.js
+++ b/src/emit/mcp.js
@@ -19,6 +19,16 @@ import { dirname, join } from "node:path";
 import { BRAND } from "../brand.js";
 import { hashContent, isManaged, readIfExists, writeManaged, yamlHeader } from "./_shared.js";
 
+/** The relative path of the OpenClaw MCP artifact. OpenClaw's own MCP registry lives in the
+ *  USER's global config (`~/.openclaw/openclaw.json` → `mcp.servers`), which forge must never
+ *  write to, so this is a repo-local, OpenClaw-SHAPED fragment: valid config to merge or the
+ *  source of the one `openclaw mcp add` command that registers the server. OpenClaw does NOT
+ *  auto-discover it — `openclawAddCommand` renders the explicit enable step, and the emitted
+ *  row says so rather than implying the server is already live. */
+export const OPENCLAW_TARGET = ".openclaw/mcp.json";
+
+// `key` is a DOTTED PATH into the document, not a single top-level key: OpenClaw nests its
+// registry under `mcp.servers`, every other tool uses one flat key. `bucketAt` resolves both.
 const JSON_TARGETS = [
   { tool: "Claude Code", file: ".mcp.json", key: "mcpServers" },
   { tool: "Cursor", file: ".cursor/mcp.json", key: "mcpServers" },
@@ -26,6 +36,7 @@ const JSON_TARGETS = [
   { tool: "Roo Code", file: ".roo/mcp.json", key: "mcpServers" },
   { tool: "Zed", file: ".zed/settings.json", key: "context_servers" },
   { tool: "VS Code / Copilot", file: ".vscode/mcp.json", key: "servers" },
+  { tool: "OpenClaw", file: OPENCLAW_TARGET, key: "mcp.servers" },
 ];
 
 const CONTINUE_DIR = join(".continue", "mcpServers");
@@ -78,6 +89,28 @@ function validateServers(servers) {
  *  leading indicators, newlines, etc. */
 const yamlScalar = (s) => JSON.stringify(String(s));
 
+/** Quote one shell word only when it needs it, so the rendered enable command stays
+ *  copy-pasteable and readable for the ordinary `forge` / `cortex-mcp` case. */
+const shellWord = (s) =>
+  /^[A-Za-z0-9_@%+=:,./-]+$/.test(String(s))
+    ? String(s)
+    : `'${String(s).replaceAll("'", `'\\''`)}'`;
+
+/**
+ * The exact, current-docs `openclaw mcp add` invocation that registers one stdio server in
+ * OpenClaw's own (global) registry. Forge renders this instead of writing OpenClaw's config:
+ * `mcp.servers` lives in the user's `~/.openclaw/openclaw.json`, which is not forge's to edit.
+ * @param {string} name
+ * @param {{command:string, args?:string[]}} def
+ * @returns {string}
+ */
+export function openclawAddCommand(name, def) {
+  const args = (def.args || []).map((a) => `--arg ${shellWord(a)}`);
+  return ["openclaw mcp add", shellWord(name), `--command ${shellWord(def.command)}`, ...args].join(
+    " ",
+  );
+}
+
 /** Per-server Continue file name. Servers already namespaced `forge-*` keep their name.
  *  Injectivity across a managed set is enforced by validateServers (`foo`/`forge-foo`). */
 export const continueFileFor = (name) =>
@@ -87,6 +120,27 @@ export const continueFileFor = (name) =>
 // JSON targets — entry-level ownership (RA-21, ME-08).
 // ---------------------------------------------------------------------------
 
+/**
+ * Resolve the server bucket named by a dotted `keyPath` (`"mcpServers"`, `"mcp.servers"`).
+ * With `create`, missing intermediate objects are added. Returns null when ANY step already
+ * holds a non-object (a string, array, null): that is the user's document shape and forge
+ * restructuring it would destroy data — the caller reports and leaves the file alone.
+ * @returns {Record<string, any>|null}
+ */
+function bucketAt(obj, keyPath, { create = false } = {}) {
+  let cur = obj;
+  for (const k of keyPath.split(".")) {
+    if (!cur || typeof cur !== "object" || Array.isArray(cur)) return null;
+    const v = cur[k];
+    if (v === undefined) {
+      if (!create) return null;
+      cur[k] = {};
+    } else if (!v || typeof v !== "object" || Array.isArray(v)) return null;
+    cur = cur[k];
+  }
+  return cur;
+}
+
 function mergeJson(path, key, servers, owns) {
   let obj = {};
   if (existsSync(path)) {
@@ -96,7 +150,10 @@ function mergeJson(path, key, servers, owns) {
       return { action: "skipped", note: "invalid JSON — left as-is" };
     }
   }
-  const bucket = obj[key] || (obj[key] = {});
+  if (!obj || typeof obj !== "object" || Array.isArray(obj))
+    return { action: "skipped", note: "not a JSON object — left as-is" };
+  const bucket = bucketAt(obj, key, { create: true });
+  if (!bucket) return { action: "skipped", note: `\`${key}\` is not an object — left as-is` };
   // Ownership rules: absent → write; present + owned → refresh on drift; present +
   // NOT owned → leave byte-identical and say so (the entry is the user's — a same-name
   // server they configured themselves must never be silently replaced).
@@ -143,7 +200,7 @@ function removeFromJson(path, key, name) {
   } catch {
     return { action: "skipped", note: "invalid JSON — left as-is" };
   }
-  const bucket = obj?.[key];
+  const bucket = bucketAt(obj, key);
   if (!bucket || bucket[name] === undefined) return { action: "unchanged", note: "absent" };
   delete bucket[name];
   writeFileSync(path, `${JSON.stringify(obj, null, 2)}\n`);
@@ -323,6 +380,19 @@ function migrateLegacyContinue(dir) {
 // Entry points.
 // ---------------------------------------------------------------------------
 
+/** The report note for the OpenClaw target: what the file is, and the command that actually
+ *  registers it. Multiple managed servers name the forge server's command plus a count, so
+ *  the row stays one line without ever claiming a server is enabled that isn't. */
+function openclawEnableHint(servers) {
+  const names = Object.keys(servers);
+  if (!names.length) return "not auto-loaded by OpenClaw";
+  const first = names.find((n) => n.startsWith("forge-")) ?? names[0];
+  const rest = names.length - 1;
+  return `not auto-loaded — enable with \`${openclawAddCommand(first, servers[first])}\`${
+    rest ? ` (+${rest} more in the file)` : ""
+  }`;
+}
+
 /**
  * Emit `servers` (the full managed set) into every target. `owns(target, name)` decides,
  * PER TARGET, whether forge may OVERWRITE an already-present same-name entry that drifted
@@ -342,7 +412,10 @@ export function emitMcp({ targetRoot, servers, owns = () => true }) {
       tool: `${t.tool} MCP`,
       target: t.file,
       action: r.action,
-      note: r.note,
+      // OpenClaw is the one target whose file is NOT read by the tool: its registry is the
+      // user's global config. Never let the row read like the server is live — always carry
+      // the explicit enable command (RA-03's honesty rule applied to a manual-apply target).
+      note: t.file === OPENCLAW_TARGET ? `${r.note}; ${openclawEnableHint(servers)}` : r.note,
     };
   });
   const codex = emitCodexToml(join(targetRoot, CODEX_FILE), servers, (name) =>
@@ -392,7 +465,7 @@ export function removeMcp({ targetRoot, name, removeJsonEntry }) {
     let current;
     if (existsSync(path)) {
       try {
-        current = JSON.parse(readFileSync(path, "utf8"))?.[t.key]?.[name];
+        current = bucketAt(JSON.parse(readFileSync(path, "utf8")), t.key)?.[name];
       } catch {
         current = undefined;
       }
@@ -465,7 +538,7 @@ export function foreignTargets(targetRoot, name, def) {
     const path = join(targetRoot, t.file);
     if (!existsSync(path)) continue;
     try {
-      const cur = JSON.parse(readFileSync(path, "utf8"))?.[t.key]?.[name];
+      const cur = bucketAt(JSON.parse(readFileSync(path, "utf8")), t.key)?.[name];
       if (cur !== undefined && JSON.stringify(cur) !== JSON.stringify(def)) out.add(t.file);
     } catch {
       // invalid JSON: mergeJson will skip the file entirely — not a claimable entry
diff --git a/src/emit/openclaw.js b/src/emit/openclaw.js
new file mode 100644
index 0000000..19a0012
--- /dev/null
+++ b/src/emit/openclaw.js
@@ -0,0 +1,32 @@
+// OpenClaw reads the EXECUTION FOLDER's `AGENTS.md` natively: when a session runs from a
+// repo (or a managed worktree), that folder's AGENTS.md is appended after the configured
+// agent-workspace files as project context (OpenClaw docs, concepts/system-prompt.md). So the
+// canonical source reaches OpenClaw with no second instruction file — same deal as Codex,
+// Cursor and Copilot. Only `AGENTS.md` travels: OpenClaw deliberately does NOT load
+// `SOUL.md`, `IDENTITY.md`, `USER.md`, `MEMORY.md` or `BOOTSTRAP.md` from the execution
+// folder, so anything Forge wants OpenClaw to see must be inside the canonical body.
+//
+// Two things this emitter must NOT claim:
+//   - Ambient hooks. OpenClaw has its own hook system; Forge installs nothing into it. The
+//     substrate reaches OpenClaw through AGENTS.md text and the MCP tools, nothing more.
+//   - Live MCP. OpenClaw's server registry is `mcp.servers` in the USER's global
+//     `~/.openclaw/openclaw.json`. Forge never writes there; the MCP emitter writes an
+//     OpenClaw-shaped fragment to `.openclaw/mcp.json` and reports the one command that
+//     registers it (see emit/mcp.js, OPENCLAW_TARGET).
+//
+// Legacy `AGENT.md` (singular) is not part of OpenClaw's project-context path, so unlike Zed
+// there is no precedence list to police — the only real failure mode is a stale AGENTS.md,
+// which the shared marker/hash already covers.
+import { OPENCLAW_TARGET } from "./mcp.js";
+
+export default {
+  tool: "OpenClaw",
+  emit(_ctx) {
+    return {
+      tool: this.tool,
+      target: "AGENTS.md",
+      action: "relies-on-agents",
+      note: `execution-folder AGENTS.md is project context (MCP: ${OPENCLAW_TARGET}, applied manually)`,
+    };
+  },
+};
diff --git a/src/init.js b/src/init.js
index a4fa642..1de2b69 100644
--- a/src/init.js
+++ b/src/init.js
@@ -84,6 +84,21 @@ function isForgeCommand(hook) {
   return c.includes(`${FORGE_GLOBAL}/`) || c.includes("${CLAUDE_PLUGIN_ROOT}/global/");
 }
 
+/** True iff `hook` is the pre-ME-23 legacy shell-string form: one `command` string with NO
+ *  `args` array. Retired since ME-23 — Forge has never written this shape since — so an
+ *  occurrence at a Forge-managed path is unambiguously an old Forge install, safe to heal to
+ *  whatever interpreter the template uses NOW unconditionally. That is NOT true of the exec-form
+ *  `{command:"bash", args:[...]}` shape (post-ME-23, pre-launcher): a hand-written hook can look
+ *  exactly like that, so healing IT stays gated on ownership (HI-05). */
+function isLegacyShellString(hook) {
+  return (
+    Boolean(hook) &&
+    typeof hook === "object" &&
+    typeof hook.command === "string" &&
+    !Array.isArray(hook.args)
+  );
+}
+
 /** Single-quote a path for safe embedding in a shell command: an install prefix containing
  *  spaces (or any shell metacharacter) must not split into words. Embedded single quotes use
  *  the standard `'\''` escape. ME-23 moved hooks to exec form (`command`+`args`, spawned with
@@ -159,11 +174,46 @@ function canonicalCommand(hook) {
   return normalizeCommand(hook);
 }
 
+/** True iff two hook/statusLine entries are the SAME Forge-managed script, whatever spelling
+ *  wrote them: identical canonical command, OR both Forge-owned (a path under the install root or
+ *  the plugin root) with the same guard identity. The second clause is what lets a template change
+ *  of interpreter heal an installed entry — `bash …/cortex.sh prompt` (the pre-launcher exec form
+ *  that dies on Windows when bash is not on PATH) and `node …/run.mjs …/cortex.sh prompt` are one
+ *  guard — while a user's same-basename hook at a DIFFERENT path is never matched (HI-05). */
+function sameManagedEntry(a, b) {
+  if (canonicalCommand(a) === canonicalCommand(b)) return true;
+  return isForgeCommand(a) && isForgeCommand(b) && guardKey(a) === guardKey(b);
+}
+
 function loadTemplate() {
   const path = join(BRAND.root, "global", "settings.template.json");
   return resolveManagedPaths(JSON.parse(readFileSync(path, "utf8")));
 }
 
+/** @type {Map<string, object> | null} guardKey → resolved template hook (lazy, per process) */
+let templateHooksByKeyCache = null;
+function templateHooksByKey() {
+  if (!templateHooksByKeyCache) {
+    templateHooksByKeyCache = new Map();
+    const tpl = loadTemplate();
+    for (const entries of Object.values(tpl.hooks || {}))
+      for (const entry of entries)
+        for (const h of entry.hooks || []) templateHooksByKeyCache.set(guardKey(h), h);
+  }
+  return templateHooksByKeyCache;
+}
+
+/** True iff `hook` is a Forge-managed guard spelled the way an OLDER template wrote it: the same
+ *  guard identity as a current template hook but a different interpreter/launcher — e.g. the
+ *  pre-launcher `{command:"bash", args:["…/guards/cortex.sh","prompt"]}` exec form, which fails on
+ *  Windows when bash is not on PATH. Doctor reports these; a re-merge (`forge init` /
+ *  `forge doctor --fix`) heals the Forge-owned ones in place. Exported for doctor + tests. */
+export function isStaleManagedHook(hook) {
+  if (!hook || !isForgeCommand(hook)) return false;
+  const tpl = templateHooksByKey().get(guardKey(hook));
+  return Boolean(tpl) && canonicalCommand(hook) !== canonicalCommand(tpl);
+}
+
 /** Read an existing settings file, distinguishing a MISSING file (safe to treat as empty
  *  and create) from one that is PRESENT BUT UNPARSEABLE (must never be silently replaced —
  *  P0-01). Returns `{status, data}` with status `missing` | `ok` | `corrupt`. */
@@ -212,7 +262,11 @@ export function guardKey(hook) {
   // Exec form: the script path is an `args[]` element; the elements after it are its arguments.
   if (hook && typeof hook === "object" && Array.isArray(hook.args)) {
     const args = hook.args.map((a) => String(a));
-    const i = args.findIndex((a) => a.includes(".sh"));
+    // The guard is the element that IS a `.sh` script (`…/cortex.sh`) — not one that merely
+    // contains ".sh": the launcher that precedes it (`…/guards/run.mjs`) or an install prefix
+    // like `~/.shared/` must never be mistaken for the guard. Substring match is the fallback.
+    const exact = args.findIndex((a) => /\.sh$/i.test(a));
+    const i = exact >= 0 ? exact : args.findIndex((a) => a.includes(".sh"));
     if (i >= 0) {
       const base = args[i].split(/[/\\]/).pop();
       const rest = args
@@ -237,10 +291,12 @@ export function guardKey(hook) {
  *  same-basename hook at a DIFFERENT path must NOT block Forge's own install (HI-05). Returns the
  *  merged tree plus the guard identities actually added this merge (`added: [{event, key,
  *  command, args?}]`) so the ownership manifest can reverse exactly them later. */
-function mergeHooks(existing = {}, template = {}) {
+function mergeHooks(existing = {}, template = {}, isOwned = (_event, _key) => false) {
   const merged = { ...existing };
   /** @type {{event:string, key:string, command:string, args?:string[]}[]} */
   const added = [];
+  /** @type {{event:string, key:string, command:string, args?:string[]}[]} */
+  const upgraded = [];
   for (const [event, entries] of Object.entries(template)) {
     const existingEntries = merged[event] || [];
     // guardKey → template hook, to heal legacy shell-string spellings of the same guard.
@@ -256,10 +312,24 @@ function mergeHooks(existing = {}, template = {}) {
       for (const h of entry.hooks || []) {
         if (h.command == null && !Array.isArray(h.args)) continue;
         const tpl = templateByKey.get(guardKey(h));
-        if (tpl && canonicalCommand(h) === canonicalCommand(tpl)) {
+        if (!tpl) continue;
+        // A spelling-only difference (quoting, legacy shell string) always heals. A different
+        // interpreter — the pre-launcher `bash …` exec form vs today's `node run.mjs …` — heals
+        // only an entry Forge itself installed (HI-05): a hand-written one is the user's to change.
+        const spelling = canonicalCommand(h) === canonicalCommand(tpl);
+        const legacyString = isLegacyShellString(h) && isForgeCommand(h);
+        if (spelling || legacyString || (sameManagedEntry(h, tpl) && isOwned(event, guardKey(h)))) {
+          const before = JSON.stringify([h.command, h.args]);
           h.command = tpl.command;
           if (Array.isArray(tpl.args)) h.args = [...tpl.args];
           else delete h.args;
+          if (JSON.stringify([h.command, h.args]) !== before)
+            upgraded.push({
+              event,
+              key: guardKey(h),
+              command: h.command,
+              args: Array.isArray(h.args) ? [...h.args] : undefined,
+            });
         }
       }
     }
@@ -285,7 +355,7 @@ function mergeHooks(existing = {}, template = {}) {
     }
     merged[event] = [...existingEntries, ...newEntries];
   }
-  return { merged, added };
+  return { merged, added, upgraded };
 }
 
 /** Best-effort reconstruction of Forge's footprint from a settings file that predates the
@@ -337,7 +407,7 @@ function legacyOwnedScan(settings, template) {
   if (
     settings.statusLine?.command &&
     template.statusLine?.command &&
-    canonicalCommand(settings.statusLine) === canonicalCommand(template.statusLine)
+    sameManagedEntry(settings.statusLine, template.statusLine)
   )
     owned.statusLine = true;
   if (settings.$schema && settings.$schema === template.$schema) owned.schema = true;
@@ -397,12 +467,21 @@ export function mergeSettings({ settingsPath, noSettings, onNotice } = {}) {
   // Hooks
   if (template.hooks) {
     const beforeHooks = JSON.stringify(existing.hooks || {});
-    const { merged, added } = mergeHooks(existing.hooks, template.hooks);
+    const isOwned = (event, key) => ownedHooks.some((o) => o.event === event && o.key === key);
+    const { merged, added, upgraded } = mergeHooks(existing.hooks, template.hooks, isOwned);
     existing.hooks = merged;
-    // Dedup by event+key: in exec form `command` is always "bash", so a hook's identity is its
-    // guard key (basename+args), not the command string.
-    for (const a of added)
-      if (!ownedHooks.some((o) => o.event === a.event && o.key === a.key)) ownedHooks.push(a);
+    // Dedup by event+key: in exec form `command` is the interpreter/launcher, so a hook's identity
+    // is its guard key (basename+args), not the command string.
+    for (const a of added) if (!isOwned(a.event, a.key)) ownedHooks.push(a);
+    // An entry healed in place (pre-launcher `bash …` → `node run.mjs …`) keeps its ownership
+    // record current, so a later uninstall still matches — and removes — the new spelling.
+    for (const u of upgraded) {
+      const o = ownedHooks.find((x) => x.event === u.event && x.key === u.key);
+      if (!o) continue;
+      o.command = u.command;
+      if (u.args) o.args = [...u.args];
+      else delete o.args;
+    }
     if (JSON.stringify(existing.hooks) !== beforeHooks) report.added.push("hooks");
     else report.unchanged.push("hooks");
   }
@@ -432,6 +511,20 @@ export function mergeSettings({ settingsPath, noSettings, onNotice } = {}) {
     existing.statusLine = template.statusLine;
     report.added.push("statusLine");
     ownedStatusLine = true;
+  } else if (
+    template.statusLine &&
+    ownedStatusLine &&
+    typeof existing.statusLine === "object" &&
+    sameManagedEntry(existing.statusLine, template.statusLine) &&
+    canonicalCommand(existing.statusLine) !== canonicalCommand(template.statusLine)
+  ) {
+    // Forge's OWN statusline in an older spelling (pre-launcher `bash …/statusline.sh`) — heal it
+    // in place like a hook. A user's statusline, even one pointing at Forge's script, is theirs.
+    existing.statusLine = { ...existing.statusLine, command: template.statusLine.command };
+    if (Array.isArray(template.statusLine.args))
+      existing.statusLine.args = [...template.statusLine.args];
+    else delete existing.statusLine.args;
+    report.added.push("statusLine");
   } else if (template.statusLine) {
     report.unchanged.push("statusLine");
   }
@@ -554,7 +647,7 @@ export function removeForgeSettings({ settingsPath } = {}) {
     Boolean(owned.statusLine) &&
     Boolean(settings.statusLine?.command) &&
     Boolean(template.statusLine?.command) &&
-    canonicalCommand(settings.statusLine) === canonicalCommand(template.statusLine);
+    sameManagedEntry(settings.statusLine, template.statusLine);
   const dropSchema =
     Boolean(owned.schema) && Boolean(settings.$schema) && settings.$schema === template.$schema;
 
diff --git a/src/repo_config.js b/src/repo_config.js
index abc6b42..54a42a9 100644
--- a/src/repo_config.js
+++ b/src/repo_config.js
@@ -39,6 +39,7 @@ const DETECT = [
   { tool: "continue", marker: ".continue" },
   { tool: "windsurf", marker: ".windsurf" },
   { tool: "roo", marker: ".roo" },
+  { tool: "openclaw", marker: ".openclaw" },
 ];
 
 /** Tool names accepted by `forge tools <name>`. Kept in lockstep with the emit targets
@@ -54,6 +55,7 @@ export const KNOWN_TOOLS = [
   "continue",
   "windsurf",
   "roo",
+  "openclaw",
 ];
 
 // Map a sync-report row's tool label to a canonical tool key. The shared source
@@ -70,6 +72,7 @@ const TOOL_KEYS = [
   ["continue", /^Continue/],
   ["windsurf", /^Windsurf/],
   ["roo", /^Roo/],
+  ["openclaw", /^OpenClaw/],
 ];
 
 const forgeConfigPath = (root) => join(root, FORGE_CONFIG_REL);
diff --git a/src/sync.js b/src/sync.js
index 27e0085..c6ff8b0 100644
--- a/src/sync.js
+++ b/src/sync.js
@@ -14,12 +14,24 @@ import copilot from "./emit/copilot.js";
 import cursor from "./emit/cursor.js";
 import gemini from "./emit/gemini.js";
 import { emitMcp } from "./emit/mcp.js";
+import openclaw from "./emit/openclaw.js";
 import windsurf from "./emit/windsurf.js";
 import zed from "./emit/zed.js";
 import { managedMcpState } from "./integrations.js";
 import { LEGACY_PROFILES, readForgeConfig } from "./repo_config.js";
 
-const MODULES = [codex, cursor, copilot, windsurf, zed, claude, gemini, aider, continueTool];
+const MODULES = [
+  codex,
+  cursor,
+  copilot,
+  windsurf,
+  zed,
+  claude,
+  gemini,
+  aider,
+  continueTool,
+  openclaw,
+];
 
 // Soft budget: Codex hard-truncates at 32 KiB, Windsurf caps ~12k chars. Warn early.
 const SIZE_BUDGET_BYTES = 12 * 1024;
@@ -150,7 +162,7 @@ export function sync({ targetRoot = process.cwd() } = {}) {
   const hash = shared.hashContent(canonical);
   const bytes = Buffer.byteLength(canonical);
 
-  // The shared AGENTS.md — read directly by Codex, Cursor, Copilot, Windsurf, Zed.
+  // The shared AGENTS.md — read directly by Codex, Cursor, Copilot, Windsurf, Zed, OpenClaw.
   // If the repo already has a hand-written (unmanaged) AGENTS.md, never destroy it
   // silently — back it up first so no rules are lost when adopting Forge.
   const agentsPath = join(targetRoot, "AGENTS.md");
diff --git a/templates/project-layer/AGENTS.md b/templates/project-layer/AGENTS.md
index aa3d99e..a7970c2 100644
--- a/templates/project-layer/AGENTS.md
+++ b/templates/project-layer/AGENTS.md
@@ -1,6 +1,6 @@
 # AGENTS.md — <project>
 
-Cross-tool rules (read by Codex, Cursor, Copilot, Gemini, Aider, Zed, and by
+Cross-tool rules (read by Codex, Cursor, Copilot, Gemini, Aider, Zed, OpenClaw, and by
 Claude Code when CLAUDE.md points here). Keep tool-agnostic and thin.
 
 ## Stack
diff --git a/test/doctor_launcher.test.js b/test/doctor_launcher.test.js
new file mode 100644
index 0000000..69debbd
--- /dev/null
+++ b/test/doctor_launcher.test.js
@@ -0,0 +1,61 @@
+// Doctor × the portable hook launcher: an install whose hooks still spawn `bash` directly (the
+// pre-launcher exec form — `spawn bash ENOENT` on Windows) is DEGRADED and `--fix` heals it, and
+// doctor reports the bash the launcher resolves.
+import assert from "node:assert/strict";
+import { mkdtempSync, readFileSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { test } from "node:test";
+import { BRAND } from "../src/brand.js";
+import { doctor } from "../src/doctor.js";
+import { mergeSettings } from "../src/init.js";
+import { toPosix } from "../src/util.js";
+
+const fixture = () => mkdtempSync(join(tmpdir(), "forge-doctor-launcher-"));
+const allHooks = (s) =>
+  Object.values(s.hooks || {})
+    .flat()
+    .flatMap((e) => e.hooks || []);
+
+test("doctor: Forge hooks left in the pre-launcher `bash` spelling are DEGRADED (warn) — and --fix heals them", () => {
+  const root = fixture();
+  const settingsPath = join(fixture(), "settings.json");
+  const base = toPosix(join(BRAND.root, "global"));
+  mergeSettings({ settingsPath });
+  // Rewind to what v0.32 wrote: `bash <guard> [mode]`, no launcher (manifest included).
+  const s = JSON.parse(readFileSync(settingsPath, "utf8"));
+  const rewind = (h) => {
+    if (h?.command === "node" && h.args?.[0] === `${base}/guards/run.mjs`) {
+      h.command = "bash";
+      h.args = h.args.slice(1);
+    }
+  };
+  for (const h of allHooks(s)) rewind(h);
+  for (const o of s._forgeOwned.added.hooks) rewind(o);
+  writeFileSync(settingsPath, JSON.stringify(s));
+
+  const before = doctor({ targetRoot: root, settingsPath }).results.find(
+    (r) => r.label === "settings",
+  );
+  assert.equal(before.status, "warn", "wired but in a spelling that fails on Windows is not green");
+  assert.match(before.note, /predate the portable launcher/);
+
+  doctor({ targetRoot: root, settingsPath, fix: true });
+  const after = doctor({ targetRoot: root, settingsPath }).results.find(
+    (r) => r.label === "settings",
+  );
+  assert.equal(after.status, "ok", after.note);
+  const healed = allHooks(JSON.parse(readFileSync(settingsPath, "utf8")));
+  assert.ok(healed.length > 0);
+  assert.ok(
+    healed.every((h) => h.command === "node" && h.args[0] === `${base}/guards/run.mjs`),
+    "every hook now runs through the launcher",
+  );
+});
+
+test("doctor: reports the bash the hook launcher resolves (present here → ok, via run.mjs)", () => {
+  const r = doctor({ targetRoot: fixture() }).results.find((x) => x.label === "bash");
+  assert.ok(r, "bash row present");
+  assert.equal(r.status, "ok", r.note);
+  assert.match(r.note, /run\.mjs/);
+});
diff --git a/test/dogfood.test.js b/test/dogfood.test.js
index 6b7df6f..77ed90f 100644
--- a/test/dogfood.test.js
+++ b/test/dogfood.test.js
@@ -11,22 +11,34 @@ const repo = join(dirname(fileURLToPath(import.meta.url)), "..");
 
 test(".claude/settings.json wires only real, executable scripts via ${CLAUDE_PROJECT_DIR}", () => {
   const s = JSON.parse(readFileSync(join(repo, ".claude", "settings.json"), "utf8"));
-  const commands = Object.values(s.hooks)
+  const hooks = Object.values(s.hooks)
     .flat()
-    .flatMap((e) => e.hooks.map((h) => h.command));
-  assert.ok(commands.length >= 10, "the full guard set is wired");
-  for (const cmd of commands) {
-    assert.match(cmd, /\$\{CLAUDE_PROJECT_DIR\}/, `resolves through the project dir: ${cmd}`);
+    .flatMap((e) => e.hooks);
+  assert.ok(hooks.length >= 10, "the full guard set is wired");
+  for (const h of hooks) {
+    // Exec form through the portable launcher: command is "node", the script path (and the
+    // launcher itself) live in args[], resolved through ${CLAUDE_PROJECT_DIR}.
+    assert.equal(
+      h.command,
+      "node",
+      `interpreter is node (bash is not on PATH on Windows): ${JSON.stringify(h)}`,
+    );
+    assert.ok(
+      Array.isArray(h.args) && h.args.length >= 2,
+      `args = [launcher, guard, …]: ${JSON.stringify(h)}`,
+    );
+    for (const a of h.args.slice(0, 2))
+      assert.match(a, /\$\{CLAUDE_PROJECT_DIR\}/, `resolves through the project dir: ${a}`);
     // A wired script is either a global guard or a repo-local hook (e.g. the web
     // session-start install hook) — both must exist AND be executable.
-    const m = cmd.match(/\}"?\/((?:global\/guards|\.claude\/hooks)\/[\w-]+\.sh)/);
-    assert.ok(m, `references a guard or repo hook script: ${cmd}`);
+    const m = h.args[1].match(/\}\/((?:global\/guards|\.claude\/hooks)\/[\w-]+\.sh)/);
+    assert.ok(m, `args[1] references a guard or repo hook script: ${h.args[1]}`);
     accessSync(join(repo, m[1]), constants.X_OK); // exists AND executable, else throws
   }
 });
 
 test(".claude/settings.json Stop array registers the completion gate", () => {
   const s = JSON.parse(readFileSync(join(repo, ".claude", "settings.json"), "utf8"));
-  const stop = s.hooks.Stop.flatMap((e) => e.hooks.map((h) => h.command)).join("\n");
+  const stop = s.hooks.Stop.flatMap((e) => e.hooks.flatMap((h) => h.args ?? [])).join("\n");
   assert.match(stop, /completion-gate\.sh/);
 });
diff --git a/test/hook_launcher.test.js b/test/hook_launcher.test.js
new file mode 100644
index 0000000..be81334
--- /dev/null
+++ b/test/hook_launcher.test.js
@@ -0,0 +1,332 @@
+// Portable hook launcher (global/guards/run.mjs) — the Windows "hooks fail: bash not on PATH" fix.
+//
+// Exec-form hooks are spawned directly (no shell), so `command: "bash"` needs bash on PATH — which
+// a default Git for Windows install does NOT provide (git.exe lives in Git\cmd, bash.exe in Git\bin
+// and Git\usr\bin). Every hook now spawns `node run.mjs <guard.sh> …`. These tests pin:
+//   1. the bash resolution order on every OS, via injected env + filesystem (pure);
+//   2. real end-to-end runs — stdin/stdout/exit-code passthrough, an exit-2 BLOCK preserved, paths
+//      WITH SPACES on Windows and POSIX, the Windows default-install PATH shape, and the
+//      "no bash anywhere" failure mode (exit 1 + an actionable line, never a fabricated block);
+//   3. that the launcher and both hook manifests ship in the npm archive.
+import assert from "node:assert/strict";
+import { spawnSync } from "node:child_process";
+import { cpSync, existsSync, mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { dirname, join } from "node:path";
+import { test } from "node:test";
+import { fileURLToPath } from "node:url";
+import { resolveBash } from "../global/guards/run.mjs";
+
+const root = join(dirname(fileURLToPath(import.meta.url)), "..");
+const guards = join(root, "global", "guards");
+const launcher = join(guards, "run.mjs");
+const win = process.platform === "win32";
+
+/** Run the launcher exactly as a hook does: `node run.mjs <guard> [args…]`, hook JSON on stdin. */
+function launch(args, { input = "", env = process.env, launcherPath = launcher } = {}) {
+  const r = spawnSync(process.execPath, [launcherPath, ...args], { input, encoding: "utf8", env });
+  return { code: r.status, out: r.stdout ?? "", err: r.stderr ?? "", error: r.error };
+}
+
+/** A copy of process.env with the given keys replaced (case-insensitively — Windows env). */
+function envWith(over) {
+  const drop = new Set(Object.keys(over).map((k) => k.toLowerCase()));
+  const env = {};
+  for (const [k, v] of Object.entries(process.env)) if (!drop.has(k.toLowerCase())) env[k] = v;
+  return Object.assign(env, over);
+}
+
+const writeEnv = JSON.stringify({ tool_name: "Write", tool_input: { file_path: "/x/.env" } });
+const writeSrc = JSON.stringify({ tool_name: "Write", tool_input: { file_path: "/x/src/a.js" } });
+
+/** A fake Windows filesystem: `exists()` over a set of paths, compared case-insensitively. */
+const fakeFs = (...present) => {
+  const norm = (p) => String(p).toLowerCase().replaceAll("/", "\\");
+  const set = new Set(present.map(norm));
+  return (p) => set.has(norm(p));
+};
+const winEnv = (over = {}) => ({
+  SystemRoot: "C:\\Windows",
+  ProgramFiles: "C:\\Program Files",
+  "ProgramFiles(x86)": "C:\\Program Files (x86)",
+  LOCALAPPDATA: "C:\\Users\\u\\AppData\\Local",
+  USERPROFILE: "C:\\Users\\u",
+  PATH: "C:\\Windows\\System32;C:\\Program Files\\nodejs",
+  ...over,
+});
+
+// ------------------------------------------------------------------ resolution order (pure)
+
+test("resolveBash (win32): default Git for Windows install — git on PATH, bash NOT — finds Git\\bin\\bash.exe", () => {
+  const exists = fakeFs(
+    "C:\\Program Files\\Git\\cmd\\git.exe",
+    "C:\\Program Files\\Git\\bin\\bash.exe",
+    "C:\\Program Files\\Git\\usr\\bin\\bash.exe",
+  );
+  const env = winEnv({
+    PATH: "C:\\Windows\\System32;C:\\Program Files\\Git\\cmd;C:\\Program Files\\nodejs",
+    ProgramFiles: "D:\\nowhere", // PATH-derived resolution must not depend on the standard dirs
+  });
+  const r = resolveBash({ env, platform: "win32", exists });
+  assert.equal(r.path, "C:\\Program Files\\Git\\bin\\bash.exe");
+  assert.equal(r.via, "git-for-windows");
+});
+
+test("resolveBash (win32): an install exposing only Git\\usr\\bin\\bash.exe, or Git\\mingw64\\bin on PATH, still resolves", () => {
+  const usrOnly = fakeFs("C:\\Git\\cmd\\git.exe", "C:\\Git\\usr\\bin\\bash.exe");
+  assert.equal(
+    resolveBash({
+      env: winEnv({ PATH: "C:\\Git\\cmd", ProgramFiles: "D:\\nowhere" }),
+      platform: "win32",
+      exists: usrOnly,
+    }).path,
+    "C:\\Git\\usr\\bin\\bash.exe",
+  );
+  const mingw = fakeFs("C:\\Git\\mingw64\\bin\\git.exe", "C:\\Git\\bin\\bash.exe");
+  assert.equal(
+    resolveBash({
+      env: winEnv({ PATH: "C:\\Git\\mingw64\\bin", ProgramFiles: "D:\\nowhere" }),
+      platform: "win32",
+      exists: mingw,
+    }).path,
+    "C:\\Git\\bin\\bash.exe",
+  );
+});
+
+test("resolveBash (win32): a portable Git whose bin dir is on PATH is found via PATH", () => {
+  const exists = fakeFs("D:\\tools\\PortableGit\\bin\\bash.exe");
+  const env = winEnv({
+    PATH: "C:\\Windows\\System32;D:\\tools\\PortableGit\\bin",
+    ProgramFiles: "D:\\nowhere",
+  });
+  assert.deepEqual(resolveBash({ env, platform: "win32", exists }), {
+    path: "D:\\tools\\PortableGit\\bin\\bash.exe",
+    via: "PATH",
+  });
+});
+
+test("resolveBash (win32): the WSL launcher in System32 is never mistaken for Git Bash", () => {
+  const onlyWsl = fakeFs("C:\\Windows\\System32\\bash.exe");
+  assert.deepEqual(resolveBash({ env: winEnv(), platform: "win32", exists: onlyWsl }), {
+    path: null,
+    via: "none",
+  });
+  // …even when it comes FIRST on PATH and the real Git Bash sits in the standard install dir.
+  const both = fakeFs("C:\\Windows\\System32\\bash.exe", "C:\\Program Files\\Git\\bin\\bash.exe");
+  assert.equal(
+    resolveBash({ env: winEnv(), platform: "win32", exists: both }).path,
+    "C:\\Program Files\\Git\\bin\\bash.exe",
+  );
+});
+
+test("resolveBash (win32): per-user (LOCALAPPDATA) and scoop installs are found without any PATH help", () => {
+  const user = fakeFs("C:\\Users\\u\\AppData\\Local\\Programs\\Git\\bin\\bash.exe");
+  assert.equal(
+    resolveBash({ env: winEnv(), platform: "win32", exists: user }).path,
+    "C:\\Users\\u\\AppData\\Local\\Programs\\Git\\bin\\bash.exe",
+  );
+  const scoop = fakeFs("C:\\Users\\u\\scoop\\apps\\git\\current\\bin\\bash.exe");
+  assert.equal(
+    resolveBash({ env: winEnv(), platform: "win32", exists: scoop }).path,
+    "C:\\Users\\u\\scoop\\apps\\git\\current\\bin\\bash.exe",
+  );
+});
+
+test("resolveBash: FORGE_BASH, then CLAUDE_CODE_GIT_BASH_PATH, override everything on every OS — only when the file exists", () => {
+  const exists = fakeFs(
+    "E:\\msys64\\usr\\bin\\bash.exe",
+    "F:\\cc\\bash.exe",
+    "C:\\Program Files\\Git\\bin\\bash.exe",
+  );
+  const env = winEnv({
+    FORGE_BASH: "E:\\msys64\\usr\\bin\\bash.exe",
+    CLAUDE_CODE_GIT_BASH_PATH: "F:\\cc\\bash.exe",
+  });
+  assert.deepEqual(resolveBash({ env, platform: "win32", exists }), {
+    path: "E:\\msys64\\usr\\bin\\bash.exe",
+    via: "FORGE_BASH",
+  });
+  assert.deepEqual(
+    resolveBash({ env: { ...env, FORGE_BASH: "E:\\nope\\bash.exe" }, platform: "win32", exists }),
+    { path: "F:\\cc\\bash.exe", via: "CLAUDE_CODE_GIT_BASH_PATH" },
+  );
+  // Dangling overrides are ignored, not fatal: fall through to the standard install.
+  assert.equal(
+    resolveBash({
+      env: { ...env, FORGE_BASH: "E:\\nope", CLAUDE_CODE_GIT_BASH_PATH: "F:\\nope" },
+      platform: "win32",
+      exists,
+    }).path,
+    "C:\\Program Files\\Git\\bin\\bash.exe",
+  );
+  // POSIX honors the override too (a bash that is not on PATH).
+  const posixExists = (p) => p === "/opt/local/bin/bash";
+  assert.deepEqual(
+    resolveBash({
+      env: { FORGE_BASH: "/opt/local/bin/bash" },
+      platform: "linux",
+      exists: posixExists,
+    }),
+    { path: "/opt/local/bin/bash", via: "FORGE_BASH" },
+  );
+});
+
+test("resolveBash (POSIX): unchanged behaviour — `bash` from PATH, no filesystem probing", () => {
+  let probed = 0;
+  const exists = () => {
+    probed++;
+    return false;
+  };
+  for (const platform of ["linux", "darwin", "freebsd"])
+    assert.deepEqual(resolveBash({ env: { PATH: "/usr/bin:/bin" }, platform, exists }), {
+      path: "bash",
+      via: "PATH",
+    });
+  assert.equal(probed, 0);
+});
+
+// ------------------------------------------------------------------ end to end (real bash)
+
+test("launcher: a guard BLOCK propagates unchanged — exit 2 and the reason on stderr", () => {
+  const r = launch([join(guards, "protect-paths.sh")], { input: writeEnv });
+  assert.equal(r.code, 2, r.err);
+  assert.match(r.err, /env file/i);
+});
+
+test("launcher: a benign call is allowed — exit 0", () => {
+  const r = launch([join(guards, "protect-paths.sh")], { input: writeSrc });
+  assert.equal(r.code, 0, r.err);
+});
+
+test("launcher: stdout passes through — SessionStart recall context reaches Claude", () => {
+  const home = mkdtempSync(join(tmpdir(), "forge-launcher-home-"));
+  try {
+    mkdirSync(join(home, "recall"), { recursive: true });
+    writeFileSync(join(home, "recall", "MEMORY.md"), "- SENTINEL-7f3a: launcher stdout works\n");
+    const r = launch([join(guards, "recall-load.sh")], { env: envWith({ FORGE_HOME: home }) });
+    assert.equal(r.code, 0, r.err);
+    assert.match(r.out, /Durable memory/);
+    assert.match(r.out, /SENTINEL-7f3a/);
+  } finally {
+    rmSync(home, { recursive: true, force: true });
+  }
+});
+
+test("launcher: guard args are forwarded (cortex.sh <mode> keeps exiting 0)", () => {
+  const r = launch([join(guards, "cortex.sh"), "prompt"], {
+    input: JSON.stringify({ prompt: "hi" }),
+  });
+  assert.equal(r.code, 0, r.err);
+});
+
+test("launcher + guards under a path WITH SPACES (as ${CLAUDE_PLUGIN_ROOT} may be): block exit 2, benign 0", () => {
+  const base = mkdtempSync(join(tmpdir(), "forge launcher space-"));
+  try {
+    const g = join(base, "gu ards");
+    cpSync(guards, g, { recursive: true });
+    const spacedLauncher = join(g, "run.mjs");
+    const spacedGuard = join(g, "protect-paths.sh");
+    // Native spelling (backslashes on Windows) — exactly what the plugin-root substitution yields.
+    let r = launch([spacedGuard], { input: writeEnv, launcherPath: spacedLauncher });
+    assert.equal(r.code, 2, r.err);
+    assert.match(r.err, /env file/i);
+    r = launch([spacedGuard], { input: writeSrc, launcherPath: spacedLauncher });
+    assert.equal(r.code, 0, r.err);
+    // Forward-slash spelling (POSIX, or a hand-edited settings.json on Windows).
+    r = launch([spacedGuard.replaceAll("\\", "/")], {
+      input: writeEnv,
+      launcherPath: spacedLauncher,
+    });
+    assert.equal(r.code, 2, r.err);
+  } finally {
+    rmSync(base, { recursive: true, force: true });
+  }
+});
+
+test("launcher (Windows): default-install PATH — Git\\cmd present, Git\\bin absent — bare `bash` is ENOENT, the launcher still runs the guard", {
+  skip: !win && "Windows PATH layout",
+}, () => {
+  // Walk up from the resolved bash to the Git install root and use its `cmd` dir — the ONLY Git
+  // dir a default install puts on PATH.
+  let gitRoot = resolveBash().path ? dirname(resolveBash().path) : "";
+  while (gitRoot && !existsSync(join(gitRoot, "cmd", "git.exe")) && dirname(gitRoot) !== gitRoot)
+    gitRoot = dirname(gitRoot);
+  if (!gitRoot || !existsSync(join(gitRoot, "cmd", "git.exe"))) return; // no Git for Windows here
+  const sysRoot = process.env.SystemRoot || "C:\\Windows";
+  const sys32 = join(sysRoot, "System32");
+  const dirs = [join(gitRoot, "cmd"), dirname(process.execPath)];
+  if (!existsSync(join(sys32, "bash.exe"))) dirs.unshift(sys32); // keep System32 unless WSL's bash sits there
+  const env = envWith({
+    PATH: dirs.join(";"),
+    FORGE_BASH: undefined,
+    CLAUDE_CODE_GIT_BASH_PATH: undefined,
+  });
+  // The regression: what every hook did before — spawn `bash` directly (PATH lookup, no shell).
+  const old = spawnSync("bash", [join(guards, "protect-paths.sh")], {
+    input: writeEnv,
+    encoding: "utf8",
+    env,
+  });
+  assert.equal(
+    old.error?.code,
+    "ENOENT",
+    "the bare-bash exec form should fail under a default-install PATH",
+  );
+  // The fix: same PATH, same guard, through the launcher — resolved from the git on PATH.
+  assert.equal(resolveBash({ env }).via, "git-for-windows");
+  const r = launch([join(guards, "protect-paths.sh")], { input: writeEnv, env });
+  assert.equal(r.code, 2, r.err);
+  assert.match(r.err, /env file/i);
+});
+
+test("launcher: with NO bash anywhere it fails visibly (exit 1 + actionable hint) and never fabricates a block", () => {
+  const empty = mkdtempSync(join(tmpdir(), "forge-nobash-"));
+  try {
+    const env = envWith({
+      PATH: empty,
+      ProgramFiles: empty,
+      ProgramW6432: empty,
+      "ProgramFiles(x86)": empty,
+      LOCALAPPDATA: empty,
+      USERPROFILE: empty,
+      FORGE_BASH: undefined,
+      CLAUDE_CODE_GIT_BASH_PATH: undefined,
+    });
+    const r = launch([join(guards, "protect-paths.sh")], { input: writeEnv, env });
+    assert.equal(r.code, 1, `${r.out}\n${r.err}`);
+    assert.match(r.err, /no bash found/);
+    assert.match(r.err, /FORGE_BASH/);
+  } finally {
+    rmSync(empty, { recursive: true, force: true });
+  }
+});
+
+test("launcher: no guard argument is a usage error (exit 1), not a block", () => {
+  const r = launch([]);
+  assert.equal(r.code, 1);
+  assert.match(r.err, /usage/);
+});
+
+// ------------------------------------------------------------------ package / archive
+
+test("package: the launcher, the guards and both hook manifests ship in the npm archive", () => {
+  const r = spawnSync(
+    win ? "npm.cmd" : "npm",
+    ["pack", "--dry-run", "--json", "--ignore-scripts"],
+    {
+      cwd: root,
+      encoding: "utf8",
+      shell: win,
+    },
+  );
+  assert.equal(r.status, 0, r.stderr);
+  const files = JSON.parse(r.stdout.slice(r.stdout.indexOf("[")))[0].files.map((f) => f.path);
+  for (const want of [
+    "global/guards/run.mjs",
+    "global/guards/protect-paths.sh",
+    "global/guards/_guardlib.sh",
+    "global/settings.template.json",
+    "hooks/hooks.json",
+  ])
+    assert.ok(files.includes(want), `${want} missing from the package (${files.length} files)`);
+});
diff --git a/test/hook_manifests.test.js b/test/hook_manifests.test.js
new file mode 100644
index 0000000..6130af2
--- /dev/null
+++ b/test/hook_manifests.test.js
@@ -0,0 +1,73 @@
+// Windows portability of the hook manifests: every hook (and the statusLine) is exec form THROUGH
+// the launcher — `node <root>/guards/run.mjs <root>/…/<guard>.sh [mode]` — never a bare `bash`.
+//
+// Exec-form hooks are spawned with a plain PATH lookup and no shell. A default Git for Windows
+// install puts git on PATH but NOT bash, so `command: "bash"` failed every hook there with
+// `spawn bash ENOENT` (SessionStart first). `node` is guaranteed wherever the package runs; the
+// launcher locates bash. Pinned in all three manifests so the regression cannot return via any.
+import assert from "node:assert/strict";
+import { readFileSync } from "node:fs";
+import { test } from "node:test";
+
+/** [file, launcher path as written, prefix every guard path must start with] */
+const MANIFESTS = [
+  ["global/settings.template.json", "~/.forge/guards/run.mjs", "~/.forge/"],
+  ["hooks/hooks.json", "${CLAUDE_PLUGIN_ROOT}/global/guards/run.mjs", "${CLAUDE_PLUGIN_ROOT}/"],
+  [
+    ".claude/settings.json",
+    "${CLAUDE_PROJECT_DIR}/global/guards/run.mjs",
+    "${CLAUDE_PROJECT_DIR}/",
+  ],
+];
+
+const read = (file) => JSON.parse(readFileSync(new URL(`../${file}`, import.meta.url), "utf8"));
+
+/** Every command entry in a manifest, tagged with its event ("statusLine" for the status line). */
+function entries(manifest) {
+  const out = [];
+  for (const [event, list] of Object.entries(manifest.hooks || {}))
+    for (const e of list) for (const h of e.hooks || []) out.push({ event, ...h });
+  if (manifest.statusLine) out.push({ event: "statusLine", ...manifest.statusLine });
+  return out;
+}
+
+for (const [file, launcher, prefix] of MANIFESTS) {
+  test(`${file}: every hook and the statusLine run through the launcher — no bare bash`, () => {
+    const all = entries(read(file));
+    assert.ok(all.length >= 10, `${file}: expected the full hook set, got ${all.length}`);
+    for (const h of all) {
+      const where = `${file} ${h.event}: ${JSON.stringify(h)}`;
+      assert.equal(h.type, "command", where);
+      assert.equal(
+        h.command,
+        "node",
+        `interpreter must be node (bash is not on PATH on Windows): ${where}`,
+      );
+      assert.ok(
+        Array.isArray(h.args) && h.args.length >= 2,
+        `args = [launcher, guard, …]: ${where}`,
+      );
+      assert.equal(h.args[0], launcher, `args[0] is the launcher: ${where}`);
+      assert.ok(
+        h.args[1].startsWith(prefix) && h.args[1].endsWith(".sh"),
+        `args[1] is the guard: ${where}`,
+      );
+      // Exec form carries literal paths: no shell, so no quoting — a quote char would be a bug.
+      for (const a of h.args) assert.doesNotMatch(a, /['"]/, `unquoted args: ${where}`);
+    }
+  });
+}
+
+test("plugin manifest and settings template wire the SAME guards per event (both were converted)", () => {
+  const identity = (h) =>
+    `${h.event} ${h.args[1].split("/").pop()} ${h.args.slice(2).join(" ")}`.trim();
+  const plugin = entries(read("hooks/hooks.json"))
+    .filter((h) => h.event !== "statusLine")
+    .map(identity)
+    .sort();
+  const template = entries(read("global/settings.template.json"))
+    .filter((h) => h.event !== "statusLine")
+    .map(identity)
+    .sort();
+  assert.deepEqual(plugin, template);
+});
diff --git a/test/init.test.js b/test/init.test.js
index becc920..7327ea1 100644
--- a/test/init.test.js
+++ b/test/init.test.js
@@ -16,6 +16,7 @@ import {
   ensureLedgerGitattributes,
   guardKey,
   init,
+  isStaleManagedHook,
   LEGACY_PROFILES,
   mergeSettings,
   PROFILES,
@@ -353,19 +354,23 @@ test("mergeSettings writes hooks in EXEC form — path in args[], resolved, UNQU
     .flatMap((e) => e.hooks || []);
   assert.ok(hooks.length > 0, "hooks merged");
   for (const h of hooks) {
-    assert.equal(h.command, "bash", "command is the bare interpreter, no path baked in");
-    assert.ok(Array.isArray(h.args) && h.args.length > 0, "path lives in args[]");
-    const path = h.args[0];
+    // The interpreter is `node`, never `bash`: an exec-form hook is a bare PATH lookup, and a
+    // default Git for Windows install has git on PATH but NOT bash. args[0] is the portable
+    // launcher that finds bash; args[1] is the guard it runs.
+    assert.equal(h.command, "node", "command is the launcher's interpreter, no path baked in");
+    assert.ok(Array.isArray(h.args) && h.args.length > 1, "launcher + guard path live in args[]");
+    assert.equal(h.args[0], `${base}/guards/run.mjs`, "args[0] is the resolved launcher");
+    const path = h.args[1];
     // Resolved to the real install base, NOT the unmaterialized ~/.forge, and — the whole point
     // of exec form — carrying NO surrounding quote characters (spaces would just work).
     assert.ok(path.startsWith(`${base}/`), `args path resolved to the install base: ${path}`);
     assert.ok(!path.includes("~/.forge/"), "no unresolved ~/.forge in args path");
     assert.doesNotMatch(path, /['"]/, `exec-form args path is unquoted: ${path}`);
   }
-  // The statusLine migrated to exec form too.
-  assert.equal(merged.statusLine.command, "bash");
-  assert.equal(merged.statusLine.args[0], `${base}/statusline.sh`);
-  assert.doesNotMatch(merged.statusLine.args[0], /['"]/, "statusline args path unquoted");
+  // The statusLine migrated to exec form too — through the same launcher.
+  assert.equal(merged.statusLine.command, "node");
+  assert.deepEqual(merged.statusLine.args, [`${base}/guards/run.mjs`, `${base}/statusline.sh`]);
+  assert.doesNotMatch(merged.statusLine.args[1], /['"]/, "statusline args path unquoted");
 });
 
 test("resolveManagedPaths: a base path WITH A SPACE lands literally in args, no quoting (ME-23)", () => {
@@ -383,8 +388,8 @@ test("resolveManagedPaths: a base path WITH A SPACE lands literally in args, no
   assert.ok(cortexPrompt, "cortex prompt hook present");
   assert.deepEqual(
     cortexPrompt.args,
-    [`${base}/guards/cortex.sh`, "prompt"],
-    "args are the literal resolved path element + trailing arg, verbatim and unquoted",
+    [`${base}/guards/run.mjs`, `${base}/guards/cortex.sh`, "prompt"],
+    "args are the literal resolved launcher + guard path + trailing arg, verbatim and unquoted",
   );
 });
 
@@ -420,9 +425,96 @@ test("an OLD shell-string install dedupes against the exec-form template and is
     1,
     "no duplicate — the legacy hook deduped against the template",
   );
-  // ...and it was upgraded IN PLACE to exec form (command + resolved, unquoted args).
-  assert.equal(promptHooks[0].command, "bash");
-  assert.deepEqual(promptHooks[0].args, [`${base}/guards/cortex.sh`, "prompt"]);
+  // ...and it was upgraded IN PLACE to exec form (launcher + resolved, unquoted args).
+  assert.equal(promptHooks[0].command, "node");
+  assert.deepEqual(promptHooks[0].args, [
+    `${base}/guards/run.mjs`,
+    `${base}/guards/cortex.sh`,
+    "prompt",
+  ]);
+});
+
+test("guardKey: the launcher form yields the SAME identity — run.mjs or a `.sh`-containing prefix is never the guard", () => {
+  const base = toPosix(join(BRAND.root, "global"));
+  const key = "cortex.sh prompt";
+  const launcherForm = (root) => ({
+    command: "node",
+    args: [`${root}/guards/run.mjs`, `${root}/guards/cortex.sh`, "prompt"],
+  });
+  assert.equal(guardKey(launcherForm(base)), key);
+  assert.equal(guardKey(launcherForm("~/.forge")), key);
+  assert.equal(guardKey(launcherForm("${CLAUDE_PLUGIN_ROOT}/global")), key);
+  // An install prefix that merely CONTAINS ".sh" must not be mistaken for the guard.
+  assert.equal(guardKey(launcherForm("/home/u/.shared/forge")), key);
+  assert.equal(
+    guardKey({ command: "node", args: [`${base}/guards/run.mjs`, `${base}/statusline.sh`] }),
+    "statusline.sh",
+  );
+});
+
+test("a pre-launcher `bash` exec-form install that Forge OWNS is healed to the launcher form — manifest included, so uninstall still reverses it", () => {
+  const tmp = mkdtempSync(join(tmpdir(), "forge-heal-bash-"));
+  const settingsPath = join(tmp, "settings.json");
+  const base = toPosix(join(BRAND.root, "global"));
+  const allHooks = (obj) =>
+    Object.values(obj.hooks || {})
+      .flat()
+      .flatMap((e) => e.hooks || []);
+  mergeSettings({ settingsPath });
+  // Rewind every Forge entry to what v0.32 wrote on Windows: `bash <guard> [mode]`, no launcher
+  // — the exact form that dies with ENOENT when bash is not on PATH.
+  const old = JSON.parse(readFileSync(settingsPath, "utf8"));
+  const rewind = (h) => {
+    if (h?.command === "node" && h.args?.[0] === `${base}/guards/run.mjs`) {
+      h.command = "bash";
+      h.args = h.args.slice(1);
+    }
+  };
+  for (const h of allHooks(old)) rewind(h);
+  rewind(old.statusLine);
+  for (const o of old._forgeOwned.added.hooks) rewind(o);
+  assert.ok(
+    allHooks(old).every((h) => h.command === "bash"),
+    "fixture is the old form",
+  );
+  assert.equal(old.statusLine.command, "bash");
+  writeFileSync(settingsPath, JSON.stringify(old));
+
+  const r = mergeSettings({ settingsPath });
+  const healed = JSON.parse(readFileSync(settingsPath, "utf8"));
+  assert.ok(r.added.includes("hooks"), "the merge reported the hooks change");
+  assert.equal(allHooks(healed).length, allHooks(old).length, "healed in place — no duplicates");
+  for (const h of allHooks(healed)) {
+    assert.equal(h.command, "node", `healed: ${JSON.stringify(h)}`);
+    assert.equal(h.args[0], `${base}/guards/run.mjs`);
+  }
+  assert.deepEqual(healed.statusLine.args, [`${base}/guards/run.mjs`, `${base}/statusline.sh`]);
+  // The ownership manifest followed, so uninstall matches — and removes — the NEW spelling.
+  for (const o of healed._forgeOwned.added.hooks) assert.equal(o.command, "node");
+  assert.equal(removeForgeSettings({ settingsPath }).action, "removed");
+  const after = JSON.parse(readFileSync(settingsPath, "utf8"));
+  assert.equal(allHooks(after).length, 0, "every healed hook removed");
+  assert.equal(after.statusLine, undefined, "healed statusLine removed");
+});
+
+test("a hand-written `bash` hook at a Forge path that Forge does NOT own stays byte-identical (HI-05) — and is flagged stale for doctor", () => {
+  const tmp = mkdtempSync(join(tmpdir(), "forge-unowned-bash-"));
+  const settingsPath = join(tmp, "settings.json");
+  const base = toPosix(join(BRAND.root, "global"));
+  const mine = { type: "command", command: "bash", args: [`${base}/guards/cortex.sh`, "prompt"] };
+  writeFileSync(settingsPath, JSON.stringify({ hooks: { UserPromptSubmit: [{ hooks: [mine] }] } }));
+  mergeSettings({ settingsPath });
+  const merged = JSON.parse(readFileSync(settingsPath, "utf8"));
+  const prompt = merged.hooks.UserPromptSubmit.flatMap((e) => e.hooks || []).filter(
+    (h) => guardKey(h) === "cortex.sh prompt",
+  );
+  assert.equal(prompt.length, 1, "deduped against the template, not duplicated");
+  assert.deepEqual(prompt[0], mine, "the user's spelling is theirs to change");
+  assert.ok(isStaleManagedHook(prompt[0]), "…but doctor can tell them it fails on Windows");
+  assert.ok(
+    !isStaleManagedHook({ command: "bash", args: ["/home/user/custom/cortex.sh", "prompt"] }),
+    "a same-basename hook at a NON-Forge path is not Forge's business",
+  );
 });
 
 // ---------------------------------------------------------------------------
diff --git a/test/openclaw.test.js b/test/openclaw.test.js
new file mode 100644
index 0000000..8446671
--- /dev/null
+++ b/test/openclaw.test.js
@@ -0,0 +1,274 @@
+// OpenClaw target — the compiler's tenth tool. What has to hold:
+//   1. instructions travel via the shared AGENTS.md (OpenClaw reads the execution folder's
+//      AGENTS.md as project context) — no second instruction file, no invented hooks;
+//   2. the MCP artifact is a VALID OpenClaw config fragment (`mcp.servers.<name>`), not a
+//      guess at some other tool's schema;
+//   3. it is idempotent, non-destructive, and reversible through the same
+//      integrations add/remove path every other target uses;
+//   4. the published package remains an OpenClaw-compatible Codex bundle (skills + MCP);
+//   5. nothing forge emits for OpenClaw carries a secret, and nothing forge writes ever
+//      lands outside the target repo (the user's ~/.openclaw is off limits).
+import assert from "node:assert/strict";
+import { existsSync, mkdirSync, mkdtempSync, readFileSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { test } from "node:test";
+import { emitMcp, MCP_TARGET_FILES, OPENCLAW_TARGET, openclawAddCommand } from "../src/emit/mcp.js";
+import openclaw from "../src/emit/openclaw.js";
+import { addIntegration, removeIntegration } from "../src/integrations.js";
+import { detectPrimaryTool, KNOWN_TOOLS, rowToolKey } from "../src/repo_config.js";
+import { sync } from "../src/sync.js";
+
+const fixture = () => mkdtempSync(join(tmpdir(), "forge-openclaw-"));
+const readTarget = (root) => JSON.parse(readFileSync(join(root, OPENCLAW_TARGET), "utf8"));
+
+// --------------------------------------------------------------------------
+// Package bundle: OpenClaw auto-detects the existing Codex layout.
+// --------------------------------------------------------------------------
+
+test("the published package carries an OpenClaw-compatible Codex bundle", () => {
+  const root = process.cwd();
+  const manifest = JSON.parse(readFileSync(join(root, ".codex-plugin", "plugin.json"), "utf8"));
+  const packageJson = JSON.parse(readFileSync(join(root, "package.json"), "utf8"));
+  const mcp = JSON.parse(readFileSync(join(root, manifest.mcpServers), "utf8"));
+
+  assert.equal(manifest.name, "forgekit");
+  assert.equal(manifest.skills, "global/tools");
+  assert.equal(manifest.mcpServers, ".mcp.json");
+  assert.ok(existsSync(join(root, manifest.skills, "cognitive-substrate", "SKILL.md")));
+  assert.deepEqual(mcp.mcpServers["forge-cortex"], {
+    command: "forge",
+    args: ["cortex-mcp"],
+  });
+
+  // OpenClaw installs the packed archive, not this checkout. Keep every bundle root in
+  // npm's allowlist so packaging cannot silently drop an otherwise valid bundle.
+  for (const path of [".codex-plugin", ".mcp.json", "global"]) {
+    assert.ok(packageJson.files.includes(path), `${path} must be included in npm packages`);
+  }
+});
+
+// --------------------------------------------------------------------------
+// Instructions: AGENTS.md, and only AGENTS.md.
+// --------------------------------------------------------------------------
+
+test("OpenClaw instructions ride the shared AGENTS.md — no second instruction file", () => {
+  const root = fixture();
+  const res = sync({ targetRoot: root });
+  const row = res.report.find((r) => r.tool === "OpenClaw");
+  assert.ok(row, "sync reports an OpenClaw row");
+  assert.equal(row.target, "AGENTS.md");
+  assert.equal(row.action, "relies-on-agents");
+
+  // The canonical body actually reached AGENTS.md, and AGENTS.md is forge-managed.
+  const agents = readFileSync(join(root, "AGENTS.md"), "utf8");
+  assert.match(agents, /forge:sync:[a-f0-9]{12}/);
+  assert.match(agents, /^# AGENTS\.md/m);
+
+  // No OpenClaw-specific instruction file is invented — OPENCLAW.md would be a file
+  // OpenClaw never reads, and CLAUDE.md is Claude's, not OpenClaw's.
+  assert.ok(!existsSync(join(root, "OPENCLAW.md")));
+});
+
+test("the OpenClaw row never claims ambient hooks or a live MCP connection", () => {
+  const note = openclaw.emit({ targetRoot: fixture() }).note;
+  assert.doesNotMatch(note, /hook/i, "forge installs nothing into OpenClaw's hook system");
+  assert.match(note, /AGENTS\.md/);
+  assert.match(note, /manual/i, "the MCP step is stated as manual");
+});
+
+// --------------------------------------------------------------------------
+// MCP artifact: real OpenClaw shape.
+// --------------------------------------------------------------------------
+
+test("sync writes a valid OpenClaw `mcp.servers` stdio fragment", () => {
+  const root = fixture();
+  sync({ targetRoot: root });
+  const doc = readTarget(root);
+  // Nested under mcp.servers — OpenClaw's documented config shape, not a flat mcpServers key.
+  assert.deepEqual(Object.keys(doc), ["mcp"]);
+  assert.deepEqual(Object.keys(doc.mcp), ["servers"]);
+  const server = doc.mcp.servers["forge-cortex"];
+  assert.ok(server, "the forge server is registered under mcp.servers");
+  // A stdio server needs a command; args must be a string array.
+  assert.equal(typeof server.command, "string");
+  assert.ok(server.command.length > 0);
+  assert.ok(Array.isArray(server.args));
+  for (const a of server.args) assert.equal(typeof a, "string");
+  assert.deepEqual(server.args, ["cortex-mcp"]);
+  // No stray keys: anything forge does not understand must not be invented here.
+  assert.deepEqual(Object.keys(server).sort(), ["args", "command"]);
+});
+
+test("the reported enable command matches the emitted server definition", () => {
+  const root = fixture();
+  const res = sync({ targetRoot: root });
+  const row = res.report.find((r) => r.target === OPENCLAW_TARGET);
+  assert.ok(row);
+  const server = readTarget(root).mcp.servers["forge-cortex"];
+  const expected = openclawAddCommand("forge-cortex", server);
+  assert.equal(expected, "openclaw mcp add forge-cortex --command forge --arg cortex-mcp");
+  assert.ok(row.note.includes(expected), row.note);
+  // The row must not read as "done" — OpenClaw does not auto-load this file.
+  assert.match(row.note, /not auto-loaded/);
+});
+
+test("openclawAddCommand shell-quotes only what needs it", () => {
+  assert.equal(
+    openclawAddCommand("forge-cortex", { command: "node", args: ["./dist/x.js", "a b"] }),
+    "openclaw mcp add forge-cortex --command node --arg ./dist/x.js --arg 'a b'",
+  );
+  assert.equal(
+    openclawAddCommand("srv", { command: "my cmd" }),
+    "openclaw mcp add srv --command 'my cmd'",
+  );
+});
+
+// --------------------------------------------------------------------------
+// Idempotency + preservation.
+// --------------------------------------------------------------------------
+
+test("re-running sync leaves the OpenClaw artifact byte-identical", () => {
+  const root = fixture();
+  sync({ targetRoot: root });
+  const first = readFileSync(join(root, OPENCLAW_TARGET), "utf8");
+  const second = sync({ targetRoot: root });
+  assert.equal(readFileSync(join(root, OPENCLAW_TARGET), "utf8"), first, "bytes unchanged");
+  assert.equal(second.report.find((r) => r.target === OPENCLAW_TARGET).action, "unchanged");
+});
+
+test("a user's own OpenClaw config keys and same-name server survive emission", () => {
+  const root = fixture();
+  mkdirSync(join(root, ".openclaw"), { recursive: true });
+  writeFileSync(
+    join(root, OPENCLAW_TARGET),
+    `${JSON.stringify(
+      {
+        gateway: { publicOrigin: "https://gateway.example.com" },
+        mcp: {
+          apps: { enabled: true },
+          servers: {
+            "forge-cortex": { command: "my-own-forge", args: ["serve"] },
+            mine: { command: "node", args: ["./mine.js"] },
+          },
+        },
+      },
+      null,
+      2,
+    )}\n`,
+  );
+  const res = sync({ targetRoot: root });
+  const doc = readTarget(root);
+  // Unrelated config is untouched...
+  assert.deepEqual(doc.gateway, { publicOrigin: "https://gateway.example.com" });
+  assert.deepEqual(doc.mcp.apps, { enabled: true });
+  assert.deepEqual(doc.mcp.servers.mine, { command: "node", args: ["./mine.js"] });
+  // ...and a DIVERGENT same-name entry forge did not write is preserved, not clobbered.
+  assert.deepEqual(doc.mcp.servers["forge-cortex"], {
+    command: "my-own-forge",
+    args: ["serve"],
+  });
+  const row = res.report.find((r) => r.target === OPENCLAW_TARGET);
+  assert.equal(row.action, "skipped");
+  assert.match(row.note, /user-owned/);
+});
+
+test("a non-object at mcp.servers is left exactly as the user wrote it", () => {
+  const root = fixture();
+  mkdirSync(join(root, ".openclaw"), { recursive: true });
+  const original = `${JSON.stringify({ mcp: { servers: "oops" } }, null, 2)}\n`;
+  writeFileSync(join(root, OPENCLAW_TARGET), original);
+  const res = sync({ targetRoot: root });
+  assert.equal(readFileSync(join(root, OPENCLAW_TARGET), "utf8"), original, "bytes preserved");
+  const row = res.report.find((r) => r.target === OPENCLAW_TARGET);
+  assert.equal(row.action, "skipped");
+  assert.match(row.note, /not an object/);
+});
+
+// --------------------------------------------------------------------------
+// Reversibility, through the same registry path as every other target.
+// --------------------------------------------------------------------------
+
+test("OpenClaw is an ownable MCP target: integrations add then remove round-trips", () => {
+  const root = fixture();
+  assert.ok(MCP_TARGET_FILES.includes(OPENCLAW_TARGET), "target is in the ownership domain");
+
+  const added = addIntegration("context7", { targetRoot: root, adopt: false });
+  assert.equal(added.ok, true, added.reason);
+  assert.ok(readTarget(root).mcp.servers.context7, "context7 landed in the OpenClaw fragment");
+  assert.ok(readTarget(root).mcp.servers["forge-cortex"], "the registry server is there too");
+
+  const removed = removeIntegration("context7", { targetRoot: root });
+  assert.equal(removed.ok, true, removed.reason);
+  const doc = readTarget(root);
+  assert.equal(doc.mcp.servers.context7, undefined, "removal reverses the add");
+  assert.ok(doc.mcp.servers["forge-cortex"], "the registry server is untouched by the removal");
+  const row = removed.rows.find((r) => r.target === OPENCLAW_TARGET);
+  assert.equal(row.action, "written");
+});
+
+test("emitMcp ownership is per-target: adopting elsewhere does not claim OpenClaw's entry", () => {
+  const root = fixture();
+  mkdirSync(join(root, ".openclaw"), { recursive: true });
+  writeFileSync(
+    join(root, OPENCLAW_TARGET),
+    `${JSON.stringify({ mcp: { servers: { srv: { command: "theirs" } } } }, null, 2)}\n`,
+  );
+  writeFileSync(
+    join(root, ".mcp.json"),
+    `${JSON.stringify({ mcpServers: { srv: { command: "theirs" } } }, null, 2)}\n`,
+  );
+  const servers = { srv: { command: "ours", args: [] } };
+  // Adoption is recorded for Claude's file only.
+  emitMcp({ targetRoot: root, servers, owns: (target) => target === ".mcp.json" });
+  assert.equal(
+    JSON.parse(readFileSync(join(root, ".mcp.json"), "utf8")).mcpServers.srv.command,
+    "ours",
+    "the adopted target is refreshed",
+  );
+  assert.equal(
+    readTarget(root).mcp.servers.srv.command,
+    "theirs",
+    "OpenClaw's same-name entry is NOT claimed by another target's adoption",
+  );
+});
+
+// --------------------------------------------------------------------------
+// Registry wiring + safety.
+// --------------------------------------------------------------------------
+
+test("openclaw is selectable and auto-detected as a primary tool", () => {
+  assert.ok(KNOWN_TOOLS.includes("openclaw"));
+  assert.equal(rowToolKey("OpenClaw MCP"), "openclaw");
+  assert.equal(rowToolKey("OpenClaw"), "openclaw");
+  const root = fixture();
+  mkdirSync(join(root, ".openclaw"));
+  assert.equal(detectPrimaryTool(root), "openclaw");
+});
+
+test("nothing forge emits for OpenClaw carries a credential", () => {
+  const root = fixture();
+  // A token in the environment must not be picked up and written into any artifact.
+  const canary = "forge-openclaw-canary-token-value";
+  process.env.FORGE_OPENCLAW_TEST_TOKEN = canary;
+  try {
+    sync({ targetRoot: root });
+  } finally {
+    delete process.env.FORGE_OPENCLAW_TEST_TOKEN;
+  }
+  const text = readFileSync(join(root, OPENCLAW_TARGET), "utf8");
+  assert.ok(!text.includes(canary));
+  // No credential-shaped keys at all: the stdio server needs none, so none are emitted.
+  for (const key of ["env", "headers", "token", "password", "auth", "Authorization"])
+    assert.ok(!text.includes(key), `${key} must not appear in ${OPENCLAW_TARGET}`);
+});
+
+test("emission stays inside the target repo — the user's ~/.openclaw is never a write target", () => {
+  // Every ownable MCP path is repo-relative: no absolute path, no `~`, no parent escape.
+  for (const target of MCP_TARGET_FILES) {
+    assert.ok(!target.startsWith("~"), target);
+    assert.ok(!target.startsWith("/") && !/^[A-Za-z]:/.test(target), target);
+    assert.ok(!target.split(/[\\/]/).includes(".."), target);
+  }
+  assert.equal(OPENCLAW_TARGET, ".openclaw/mcp.json");
+});
diff --git a/tsconfig.json b/tsconfig.json
index c0d6f1d..b373822 100644
--- a/tsconfig.json
+++ b/tsconfig.json
@@ -13,5 +13,5 @@
     "noUnusedLocals": true,
     "types": ["node"]
   },
-  "include": ["src/**/*.js", "scripts/**/*.mjs"]
+  "include": ["src/**/*.js", "scripts/**/*.mjs", "global/guards/run.mjs"]
 }