From 98e0a8161fb93b64f5d24491efe08d70495d56bc Mon Sep 17 00:00:00 2001
From: Daniel Han <danielhanchen@gmail.com>
Date: Wed, 3 Jun 2026 05:28:46 -0700
Subject: [PATCH] fix(studio): make reset-password hint work without PATH (all
 platforms)

Follow-up to the auth-form fix. The hint relied on the `unsloth` launcher being
on PATH. That holds in a fresh terminal (the installer adds the launcher dir to
PATH), but the command still fails when:
  - a terminal was opened before install (stale PATH),
  - ~/.local/bin is not on PATH (the default on macOS), or
  - a non-interactive / different shell rc was used.

Have the backend emit the ABSOLUTE path to this install's own `unsloth`
launcher (a sibling of sys.executable) so the command works regardless of PATH
or current directory on Windows, macOS, and Linux. POSIX paths are shell-quoted
(handles spaces). On Windows the bare absolute path is used only when it has no
spaces (works in both cmd and PowerShell); otherwise we fall back to the PATH
form to avoid cmd-vs-PowerShell quoting differences. Falls back to
`unsloth studio reset-password` if the launcher can't be located.

Verified the emitted command runs on Windows (Scripts\unsloth.exe) and Linux
(bin/unsloth) -- both resolve `unsloth studio reset-password`. The CLI command
name is unchanged, so CI smoke steps that call `unsloth studio reset-password`
directly are unaffected.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 studio/backend/routes/auth.py | 36 +++++++++++++++++++++++++++++++++--
 1 file changed, 34 insertions(+), 2 deletions(-)

diff --git a/studio/backend/routes/auth.py b/studio/backend/routes/auth.py
index bb4ce87cd7..ef01bcc9a9 100644
--- a/studio/backend/routes/auth.py
+++ b/studio/backend/routes/auth.py
@@ -9,6 +9,8 @@ from fastapi import APIRouter, Depends, HTTPException, Request, Response, status
 
 import ipaddress
 import os
+import shlex
+import sys
 import threading
 import time
 from collections import deque
@@ -38,6 +40,36 @@ from auth.authentication import (
 router = APIRouter()
 
 
+def _reset_password_command() -> str:
+    """Shell command shown in the 'incorrect password' hint.
+
+    Prefer the ABSOLUTE path to this install's ``unsloth`` launcher (a sibling
+    of the running interpreter) so the hint works even when the launcher's
+    directory is not on PATH -- e.g. a terminal opened before install, a stale
+    Windows PATH, or ``~/.local/bin`` not on PATH (the default on macOS) -- and
+    regardless of the current working directory.
+
+    On POSIX the path is shell-quoted so spaces are handled. On Windows we only
+    use the bare absolute path when it has no spaces, because a quoted path needs
+    different syntax in cmd (``"..."``) vs PowerShell (``& "..."``); when it has
+    a space we fall back to the PATH-based form to stay unambiguous across
+    shells. If the launcher can't be located we fall back to the PATH form too.
+    """
+    try:
+        bin_dir = os.path.dirname(os.path.abspath(sys.executable))
+        if os.name == "nt":
+            exe = os.path.join(bin_dir, "unsloth.exe")
+            if os.path.isfile(exe) and " " not in exe:
+                return f"{exe} studio reset-password"
+        else:
+            exe = os.path.join(bin_dir, "unsloth")
+            if os.path.isfile(exe):
+                return f"{shlex.quote(exe)} studio reset-password"
+    except Exception:
+        pass
+    return "unsloth studio reset-password"
+
+
 # Per-(ip, username) bucket + per-IP aggregate. Account bucket stops one user's
 # typos from blocking others; the aggregate stops username-rotation spray.
 # Single-process only -- multi-worker deployments need a shared store.
@@ -228,7 +260,7 @@ async def login(payload: AuthLoginRequest, request: Request) -> Token:
         _record_login_failure(unknown_key)
         raise HTTPException(
             status_code = status.HTTP_401_UNAUTHORIZED,
-            detail = "Incorrect password. Run 'unsloth studio reset-password' in your terminal to reset it.",
+            detail = f"Incorrect password. Run '{_reset_password_command()}' in your terminal to reset it.",
         )
 
     salt, pwd_hash, _jwt_secret, must_change_password = record
@@ -236,7 +268,7 @@ async def login(payload: AuthLoginRequest, request: Request) -> Token:
         _record_login_failure(key)
         raise HTTPException(
             status_code = status.HTTP_401_UNAUTHORIZED,
-            detail = "Incorrect password. Run 'unsloth studio reset-password' in your terminal to reset it.",
+            detail = f"Incorrect password. Run '{_reset_password_command()}' in your terminal to reset it.",
         )
 
     _clear_login_bucket(key)