fix(#1970): address argus review — # Errors doc, regen hivectl-cli.md, GET /api/github-account status

hive-c0re/src/dashboard/matrix_accounts.rs

@@ -301,6 +301,34 @@ pub(super) async fn post_github_account(Form(f): Form<GithubAccountForm>) -> Res
     axum::Json(GithubAccountResult { ok: true }).into_response()
 }
 
+#[derive(Deserialize)]
+pub(super) struct GithubAccountQuery {
+    agent: String,
+}
+
+#[derive(Serialize)]
+struct GithubAccountStatus {
+    /// A `github-token` file exists in the agent's state dir (a PAT has been
+    /// provisioned). A static PAT has no live/heartbeat concept, so this is
+    /// the only status the credentials tab needs.
+    present: bool,
+}
+
+/// `GET /api/github-account?agent=<name>` — whether the agent has a GitHub
+/// PAT provisioned (its `github-token` file exists). Lets the credentials tab
+/// show "token stored" vs "not set" instead of a black-hole paste field.
+/// Never returns the token itself.
+pub(super) async fn get_github_account(Query(q): Query<GithubAccountQuery>) -> Response {
+    let agent = q.agent.trim();
+    if !is_plain_ident(agent) {
+        return error_response(&format!("github-account: invalid agent {agent:?}"));
+    }
+    let present = Coordinator::agent_notes_dir(agent)
+        .join("github-token")
+        .exists();
+    axum::Json(GithubAccountStatus { present }).into_response()
+}
+
 /// POST `m.login.password` to `<homeserver>/_matrix/client/v3/login`.
 /// Returns `(access_token, user_id)`.
 async fn matrix_password_login(

hive-c0re/src/dashboard/mod.rs

@@ -190,7 +190,7 @@ pub async fn serve(port: u16, coord: Arc<Coordinator>) -> Result<()> {
         )
         .route(
             "/api/github-account",
-            post(matrix_accounts::post_github_account),
+            post(matrix_accounts::post_github_account).get(matrix_accounts::get_github_account),
         )
         .route(
             "/api/cancel-reminder/{id}",

hive-c0re/src/priv_client.rs

@@ -286,6 +286,12 @@ pub async fn write_agent_matrix_token(
 /// user so the `gh` wrapper / git credential helper can read it from inside the
 /// container. Single account per agent — no account suffix. The token value is
 /// operator-supplied (for the agent's `hyperhive.githubAccount`).
+///
+/// # Errors
+///
+/// Returns an error if the hive-priv call fails — the socket is unreachable,
+/// `agent_name` is rejected by the root-side validation, or the file
+/// write/chown fails.
 pub async fn write_agent_github_token(agent_name: &str, token: &str) -> Result<()> {
     ok(call(&PrivRequest::WriteAgentGithubToken {
         agent_name: agent_name.to_owned(),