chore(sync): mirror docs from openclaw/openclaw@c1f423f845

.openclaw-sync/source.json

@@ -1,5 +1,5 @@
 {
   "repository": "openclaw/openclaw",
-  "sha": "884d7929d127b5387634c2a5efecd1f4dcd94f32",
-  "syncedAt": "2026-04-23T18:29:39.639Z"
+  "sha": "c1f423f845ca33c42228610af16c3b7d3563dbee",
+  "syncedAt": "2026-04-23T18:33:06.629Z"
 }

docs/cli/config.md

@@ -203,6 +203,7 @@ File provider (`--provider-source file`):
 - `--provider-path <path>` (required)
 - `--provider-mode <singleValue|json>`
 - `--provider-max-bytes <bytes>`
+- `--provider-allow-insecure-path`
 
 Exec provider (`--provider-source exec`):
 

docs/gateway/configuration-reference.md

@@ -3473,6 +3473,7 @@ Validation:
 Notes:
 
 - `file` provider supports `mode: "json"` and `mode: "singleValue"` (`id` must be `"value"` in singleValue mode).
+- File and exec provider paths fail closed when Windows ACL verification is unavailable. Set `allowInsecurePath: true` only for trusted paths that cannot be verified.
 - `exec` provider requires an absolute `command` path and uses protocol payloads on stdin/stdout.
 - By default, symlink command paths are rejected. Set `allowSymlinkCommand: true` to allow symlink paths while validating the resolved target path.
 - If `trustedDirs` is configured, the trusted-dir check applies to the resolved target path.