fix(api): allow session PR text lint

[JSONbored]

Motivation

• The new local MCP tool proxies to POST /v1/lint/pr-text, but ordinary session-authenticated users were receiving 403 because the path was not allowlisted in canSessionAccessPath, creating an availability regression.

Description

• Add a LINT_PR_TEXT_PATH constant for "/v1/lint/pr-text" and include it in the canSessionAccessPath allowlist so session identities can reach the route.
• Add an integration test that creates a non-admin session via createSessionForGitHubUser and verifies a POST /v1/lint/pr-text request returns 200 with a deterministic verdict.

Testing

• Ran npm run typecheck, which completed successfully.
• Ran npx vitest run test/integration/api.test.ts --config vitest.config.ts --reporter verbose, and the integration test file passed (1 file, 34 tests passed).

---

Codex Task

[ghost]

Note

Gittensory Gate skipped

PR closed before full evaluation. No late first comment was created.

Signal	Result	Evidence	Action
Gate result	⚠️ Skipped	#738 is no longer open.	No action.

---

💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →.

Checked by Gittensory, a quiet PR intelligence layer for OSS maintainers.

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[ghost]

gittensory · advisory review

Reviewed 2 changed file(s) — two independent AI reviewers.

Suggested action: ✅ Safe to merge — both reviewers found no blocking issues.

Reviewer A · gpt-oss-120b — recommends ✅ merge
The PR adds a new constant for the lint PR text endpoint and extends session access permissions to allow authenticated GitHub sessions to call this linting route, accompanied by a new integration test confirming the behavior.

Suggestions

• Add an assertion in the new test to verify that the session response does not contain any forbidden public comment words, mirroring the existing check.
• Consider exporting LINT_PR_TEXT_PATH if it may be needed elsewhere in the codebase for consistency.
• Document the new permission change in the API access control documentation to keep future maintainers aware.

Worth double-checking

• Ensure that allowing session access does not unintentionally bypass rate limiting or other abuse protections for the lint endpoint.
• Verify that the linting logic itself continues to sanitize output and does not leak forbidden terms when invoked via a session.

Reviewer B · nemotron-3-120b-a12b — recommends ✅ merge
The PR adds session-based access to the existing /v1/lint/pr-text endpoint by updating the session access control function and adds an integration test to verify the session can lint PR text without leaking forbidden terms. The change is minimal, focused, and maintains the public/private boundary.

Suggestions

• Consider using a dynamic or generated user ID in the test for better isolation (though the current hardcoded ID is acceptable).
• Ensure that the session creation function (createSessionForGitHubUser) is tested elsewhere to avoid duplication, but it's acceptable to use it here.