From b06c64d5fc47edcff577e1787e0a0d62c0250a4f Mon Sep 17 00:00:00 2001
From: araharah-executor <executor@araharah.local>
Date: Sun, 25 Oct 2026 05:15:57 +0800
Subject: [PATCH] =?UTF-8?q?test(07-06):=20RED=20=E2=80=94=20SA6=20doc-poin?=
 =?UTF-8?q?ter=20static-text=20class=20vector=20(URL=20literals=20only;=20?=
 =?UTF-8?q?fetch=20targets=20to=20the=20same=20host=20still=20fail)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 scripts/test/privacy-audit.test.mjs | 22 ++++++++++++++++++++++
 1 file changed, 22 insertions(+)

diff --git a/scripts/test/privacy-audit.test.mjs b/scripts/test/privacy-audit.test.mjs
index 21062b7..8af6526 100644
--- a/scripts/test/privacy-audit.test.mjs
+++ b/scripts/test/privacy-audit.test.mjs
@@ -162,6 +162,28 @@ await test("SA5 runtime-hosts gate FAILS on an unapproved absolute URL and on a
   }
 });
 
+await test("SA6 the doc-pointer static-text class is NARROW — URL literals to the published-repo host pass, fetch targets to it still fail", async () => {
+  const m = await import(sourceGatesUrl);
+  const fx = makeFixtureRoot("fx-src", {
+    // the /help Known-limits doc pointer shape (bot/src/i18n/strings.ts) —
+    // user-facing copy, never fetched at runtime (D-08/D-09)
+    "docs-pointer.ts": "export const limits = 'http://gitmirah:3000/c-fu/arah2/src/branch/main/docs/KNOWN-LIMITATIONS.md';\n",
+    // any OTHER host in a URL literal is still a violation (prefer-fail)
+    "other-host.ts": "export const u = 'https://evil.example.com/track';\n",
+    // the class does NOT extend to fetch targets — a fetch to the same host fails
+    "fetch-pointer.ts": "fetch('http://gitmirah:3000/api/steal');\n",
+  });
+  try {
+    const r = await m.runRuntimeHostGate({ roots: [{ name: "fx-src", dir: fx.dir }] });
+    assert.equal(r.pass, false, "the fetch target to the doc-pointer host must still fail");
+    assert.ok(!/docs-pointer\.ts/.test(r.evidence), "the doc-pointer URL literal must NOT be a violation");
+    assert.match(r.evidence, /fetch-pointer\.ts/, "a fetch target naming the doc-pointer host must fail — the class is URL literals only");
+    assert.match(r.evidence, /other-host\.ts/, "an unapproved URL literal still fails");
+  } finally {
+    fx.cleanup();
+  }
+});
+
 /* ————— BG — the bundle-gates library ————— */
 
 const bundleGatesUrl = path.join(ROOT, "scripts", "lib", "bundle-gates.mjs");