Avoid credentialed Gradio fetches from custom domain

app.py

@@ -77,6 +77,29 @@ redirect_script = """
     if (window.location.pathname === '/') { window.location.replace('/home'); }
 </script>
 """
+hf_space_fetch_credentials_script = """
+<script>
+(function() {
+    const hfSpaceApiPrefix = "https://openhands-openhands-index.hf.space/gradio_api/";
+    const originalFetch = window.fetch.bind(window);
+
+    window.fetch = function(input, init) {
+        const url = typeof input === "string" ? input : input?.url;
+
+        if (url && url.startsWith(hfSpaceApiPrefix)) {
+            if (input instanceof Request) {
+                input = new Request(input, { ...(init || {}), credentials: "omit" });
+                init = undefined;
+            } else {
+                init = { ...(init || {}), credentials: "omit" };
+            }
+        }
+
+        return originalFetch(input, init);
+    };
+})();
+</script>
+"""
 
 # JavaScript to fix navigation links to use relative paths (avoids domain mismatch when behind proxy)
 fix_nav_links_script = """
@@ -353,7 +376,15 @@ logger.info("Creating Gradio application")
 demo = gr.Blocks(
     theme=theme,
     css=final_css,
-    head=posthog_script + scroll_script + redirect_script + fix_nav_links_script + tooltip_script + dark_mode_script,
+    head=(
+        hf_space_fetch_credentials_script
+        + posthog_script
+        + scroll_script
+        + redirect_script
+        + fix_nav_links_script
+        + tooltip_script
+        + dark_mode_script
+    ),
     title="OpenHands Index",
 )