Require username input on HF Spaces - prevent unauthorized memory access

app.py

@@ -356,13 +356,38 @@ with st.sidebar:
     st.markdown("#### User Identity")
     
     # Get Hugging Face user ID if available (in HF Spaces)
-    hf_user_id = os.getenv("SPACE_USER") or os.getenv("HF_USERNAME")
+    hf_user_id = os.getenv("SPACE_USER") or os.getenv("HF_USERNAME") or os.getenv("HF_USER")
     
-    if hf_user_id:
-        # Lock to HF user ID - no override allowed for security
-        st.info(f"👤 Signed in as: **{hf_user_id}**")
+    # Check if we're on Hugging Face Spaces (not local)
+    is_hf_space = os.getenv("SPACE_ID") is not None or os.getenv("HF_ENDPOINT") is not None
+    
+    if is_hf_space:
+        # On HF Spaces - require username input for security
+        if "hf_username" not in st.session_state:
+            st.warning("⚠️ Please enter your Hugging Face username to access your personalized memories.")
+            username_input = st.text_input(
+                "Enter your Hugging Face username",
+                key="hf_username_input",
+                placeholder="your-hf-username"
+            )
+            if st.button("Set Username", use_container_width=True):
+                if username_input.strip():
+                    st.session_state.hf_username = username_input.strip()
+                    st.rerun()
+                else:
+                    st.error("Please enter a valid username")
+            st.stop()
+        else:
+            # Username is set - lock it
+            persona_name = st.session_state.hf_username
+            st.info(f"👤 Using account: **{persona_name}**")
+            if st.button("Change Username", use_container_width=True):
+                del st.session_state.hf_username
+                st.rerun()
+    elif hf_user_id:
+        # HF user ID detected automatically
         persona_name = hf_user_id
-        # Hide persona selection when HF user ID is available
+        st.info(f"👤 Signed in as: **{hf_user_id}**")
         st.caption("Your memories are personalized to your account.")
     else:
         # Local/testing mode - allow persona selection