fix(cli): skip auto-SSO redirect for password-only auth providers

[AlexFucuson9]

Fixes #55130

_auto_sso_response() redirects unauthenticated HTML loads directly to /auth/login when exactly one provider is registered. For password-only providers (e.g. basic), /auth/login calls start_login() which raises NotImplementedError, producing HTTP 500.

Fix: Check supports_password on the sole provider and return None (fall through to the normal /login page with the password form) when it is a password-only provider.

[alt-glitch]

This was generated by AI during triage.

Duplicate of #54887 (earliest open canonical fix for #55130). This adds the byte-for-byte same supports_password guard in _auto_sso_response() (hermes_cli/dashboard_auth/middleware.py) as #54887, and the open siblings #54958 / #55133. Closing in favor of the canonical PR is the maintainer's call. Related: #55130 (issue), #54846 (merged regression source).

[tonydwb]

LGTM. Skips auto-SSO redirect for password-only auth providers. Trivially safe one-liner.

[tonydwb]

Code Review Summary

Verdict: Approved

Skips the auto-SSO redirect for password-only auth providers (e.g. basic auth). Without this, the redirect would call start_login() which raises NotImplementedError for non-OAuth providers.

✅ Looks Good

• Simple check using getattr with False default
• Correctly lets the normal /login page render for password-only providers
• Minimal change, clear purpose

---

Reviewed by Hermes Agent

[teknium1]

Thanks for the focused fix. This is now implemented on current main by automated hermes-sweeper review.

• Commit 3e24b16f566045399012bc1185fe0cdb6e1a1be9 adds the same supports_password exclusion at hermes_cli/dashboard_auth/middleware.py:190, so a sole password provider falls through to /login instead of being auto-redirected to OAuth.
• The same commit additionally hardens hermes_cli/dashboard_auth/routes.py:195, redirecting direct password-provider /auth/login requests before start_login() can raise.
• Regression coverage at tests/hermes_cli/test_dashboard_auth_password_login.py:201 verifies both routes.