From 21a072f0e15156ee8afc2459a5465fb6cdff33ab Mon Sep 17 00:00:00 2001
From: "openclaw-docs-sync[bot]"
 <openclaw-docs-sync[bot]@users.noreply.github.com>
Date: Thu, 23 Apr 2026 18:34:45 +0000
Subject: [PATCH] chore(sync): mirror docs from
 openclaw/openclaw@c1f423f845ca33c42228610af16c3b7d3563dbee

---
 .openclaw-sync/source.json              | 4 ++--
 docs/cli/config.md                      | 1 +
 docs/gateway/configuration-reference.md | 1 +
 3 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/.openclaw-sync/source.json b/.openclaw-sync/source.json
index c07783c67..4c5f1bfbf 100644
--- a/.openclaw-sync/source.json
+++ b/.openclaw-sync/source.json
@@ -1,5 +1,5 @@
 {
   "repository": "openclaw/openclaw",
-  "sha": "884d7929d127b5387634c2a5efecd1f4dcd94f32",
-  "syncedAt": "2026-04-23T18:29:39.639Z"
+  "sha": "c1f423f845ca33c42228610af16c3b7d3563dbee",
+  "syncedAt": "2026-04-23T18:33:06.629Z"
 }
diff --git a/docs/cli/config.md b/docs/cli/config.md
index 15e5923a8..fd7356b40 100644
--- a/docs/cli/config.md
+++ b/docs/cli/config.md
@@ -203,6 +203,7 @@ File provider (`--provider-source file`):
 - `--provider-path <path>` (required)
 - `--provider-mode <singleValue|json>`
 - `--provider-max-bytes <bytes>`
+- `--provider-allow-insecure-path`
 
 Exec provider (`--provider-source exec`):
 
diff --git a/docs/gateway/configuration-reference.md b/docs/gateway/configuration-reference.md
index 0890d6e50..f006e0d24 100644
--- a/docs/gateway/configuration-reference.md
+++ b/docs/gateway/configuration-reference.md
@@ -3473,6 +3473,7 @@ Validation:
 Notes:
 
 - `file` provider supports `mode: "json"` and `mode: "singleValue"` (`id` must be `"value"` in singleValue mode).
+- File and exec provider paths fail closed when Windows ACL verification is unavailable. Set `allowInsecurePath: true` only for trusted paths that cannot be verified.
 - `exec` provider requires an absolute `command` path and uses protocol payloads on stdin/stdout.
 - By default, symlink command paths are rejected. Set `allowSymlinkCommand: true` to allow symlink paths while validating the resolved target path.
 - If `trustedDirs` is configured, the trusted-dir check applies to the resolved target path.