diff --git a/.openclaw-sync/source.json b/.openclaw-sync/source.json
index 6e548ee87..29703fbf9 100644
--- a/.openclaw-sync/source.json
+++ b/.openclaw-sync/source.json
@@ -1,5 +1,5 @@
 {
   "repository": "openclaw/openclaw",
-  "sha": "b66459e3c2d29fe942e435979ccec5a95e4fb98e",
-  "syncedAt": "2026-05-02T05:35:56.367Z"
+  "sha": "1771160d2cd10db45a4809ccac6193df395951f9",
+  "syncedAt": "2026-05-02T05:40:55.855Z"
 }
diff --git a/docs/.generated/plugin-sdk-api-baseline.sha256 b/docs/.generated/plugin-sdk-api-baseline.sha256
index bbdc6b3a7..dc8766b35 100644
--- a/docs/.generated/plugin-sdk-api-baseline.sha256
+++ b/docs/.generated/plugin-sdk-api-baseline.sha256
@@ -1,2 +1,2 @@
-1fbd0ea7f65901d96653458ba414f9ac69dc0142ff3772e48d63de8b9fa5567f  plugin-sdk-api-baseline.json
-2d29f4e632b05bd365f414096c87a2a3d9718f13fdbf9538824cb32db2902436  plugin-sdk-api-baseline.jsonl
+7c25208c10ba075f76719883b7b2aefe4cf5e42328bad3acff1c5055350d344f  plugin-sdk-api-baseline.json
+6cac90f85065bcbd447911a0c7c54e7d6992278fd1b95a3e78ae4be3f185848a  plugin-sdk-api-baseline.jsonl
diff --git a/docs/tools/searxng-search.md b/docs/tools/searxng-search.md
index cbd7720dd..205205532 100644
--- a/docs/tools/searxng-search.md
+++ b/docs/tools/searxng-search.md
@@ -85,6 +85,9 @@ Transport rules:
 - `https://` works for public or private SearXNG hosts
 - `http://` is only accepted for trusted private-network or loopback hosts
 - public SearXNG hosts must use `https://`
+- private/internal hosts use the self-hosted network guard; public `https://`
+  hosts stay on the strict web-search guard and cannot redirect to private
+  addresses
 
 ## Environment variable
 
@@ -112,6 +115,9 @@ key wins first).
 - **No API key** -- works with any SearXNG instance out of the box
 - **Base URL validation** -- `baseUrl` must be a valid `http://` or `https://`
   URL; public hosts must use `https://`
+- **Network guard** -- private/internal SearXNG endpoints opt in to
+  private-network access; public `https://` SearXNG endpoints keep strict SSRF
+  protection
 - **Auto-detection order** -- SearXNG is checked last (order 200) in
   auto-detection. API-backed providers with configured keys run first, then
   DuckDuckGo (order 100), then Ollama Web Search (order 110)