chore(sync): mirror docs from openclaw/openclaw@f79553bef6

.openclaw-sync/source.json

@@ -1,5 +1,5 @@
 {
   "repository": "openclaw/openclaw",
-  "sha": "dc9f1b8525b18fc2ec2db6c2d6d90be68e4495f8",
-  "syncedAt": "2026-04-29T11:20:06.052Z"
+  "sha": "f79553bef61f7b28a848d0c7dd6b04db99503083",
+  "syncedAt": "2026-04-29T11:24:58.782Z"
 }

docs/auth-credential-semantics.md

@@ -80,6 +80,14 @@ the target agent signs in separately and creates its own local profile.
   candidate for it, `models status --probe` reports `status: no_model` with
   `reasonCode: no_model`.
 
+## External CLI credential discovery
+
+- Runtime-only credentials owned by external CLIs are discovered only when the
+  provider, runtime, or auth profile is in scope for the current operation, or
+  when a stored local profile for that external source already exists.
+- Read-only/status paths pass `allowKeychainPrompt: false`; they use file-backed
+  external CLI credentials only and do not read or reuse macOS Keychain results.
+
 ## OAuth SecretRef Policy Guard
 
 - SecretRef input is for static credentials only.