From 3de930ea0b7e8604c96564b3438b667c4dab96a3 Mon Sep 17 00:00:00 2001
From: Daniel Han <daniel@unsloth.ai>
Date: Tue, 17 Mar 2026 07:56:53 +0000
Subject: [PATCH] studio: change login error to "Incorrect password", add
 reset-password CLI

- Login error now says "Incorrect password" instead of the generic
  "Incorrect username or password" since Studio only has one account.
- Add `unsloth studio reset-password` command that deletes the auth
  database so a fresh admin account with a new random password is
  created on the next server start.
---
 cli/commands/studio.py        | 25 +++++++++++++++++++++++++
 studio/backend/routes/auth.py |  4 ++--
 2 files changed, 27 insertions(+), 2 deletions(-)

diff --git a/cli/commands/studio.py b/cli/commands/studio.py
index 89b2227fa6..da5198ad75 100644
--- a/cli/commands/studio.py
+++ b/cli/commands/studio.py
@@ -178,3 +178,28 @@ def setup():
 
     if result.returncode != 0:
         raise typer.Exit(result.returncode)
+
+
+# ── unsloth studio reset-password ────────────────────────────────────
+
+
+@studio_app.command("reset-password")
+def reset_password():
+    """Reset the Studio admin password.
+
+    Deletes the auth database so that a fresh admin account with a new
+    random password is created on the next server start.  The Studio
+    server must be restarted after running this command.
+    """
+    auth_dir = STUDIO_HOME / "auth"
+    db_file = auth_dir / "auth.db"
+    pw_file = auth_dir / ".bootstrap_password"
+
+    if not db_file.exists():
+        typer.echo("No auth database found -- nothing to reset.")
+        raise typer.Exit(0)
+
+    db_file.unlink(missing_ok = True)
+    pw_file.unlink(missing_ok = True)
+
+    typer.echo("Auth database deleted. Restart Unsloth Studio to get a new password.")
diff --git a/studio/backend/routes/auth.py b/studio/backend/routes/auth.py
index 4b586d1432..8765c702ca 100644
--- a/studio/backend/routes/auth.py
+++ b/studio/backend/routes/auth.py
@@ -54,14 +54,14 @@ async def login(payload: AuthLoginRequest) -> Token:
     if record is None:
         raise HTTPException(
             status_code = status.HTTP_401_UNAUTHORIZED,
-            detail = "Incorrect username or password",
+            detail = "Incorrect password",
         )
 
     salt, pwd_hash, _jwt_secret, must_change_password = record
     if not hashing.verify_password(payload.password, salt, pwd_hash):
         raise HTTPException(
             status_code = status.HTTP_401_UNAUTHORIZED,
-            detail = "Incorrect username or password",
+            detail = "Incorrect password",
         )
 
     access_token = create_access_token(subject = payload.username)