Semantic indexing fails with HTTP 401 in WSL Remote and Remote SSH but succeeds locally

# Semantic Indexing Fails with HTTP 401 in WSL Remote and Remote SSH Sessions While Succeeding Locally

- **GitHub Copilot Chat Extension Version:** 0.59.0
- **GitHub Authentication Extension Version:** 0.0.2
- **VS Code Version:** 1.131.0
- **Feature:** Semantic Indexing
- **Selected Model:** N/A (failure occurs before any model invocation)

## Summary

Semantic indexing consistently succeeds when a repository is opened locally in VS Code.

The same repository consistently fails semantic indexing when opened through a remote extension host (WSL Remote or Remote SSH).

The failure occurs after repository ingestion and ingest finalization complete successfully. The final remote indexing request fails with HTTP 401 ("Requires authentication").

This behavior has been reproduced across:

- Personal repositories
- Organization-owned repositories
- Multiple repositories
- Multiple machines
- Multiple CPU architectures

## Environments Tested

### Environment A

- Windows 11 Pro 26H1 (Build 28000.2269)
- VS Code 1.131.0
- WSL2
- Linux kernel: `6.6.87.2-microsoft-standard-WSL2`
- ARM64 / AArch64
- Snapdragon X Elite (X2E88100)
- 32 GB RAM

### Environment B

- Windows x86-64
- VS Code Remote SSH
- Remote Linux host
- AMD64 / x86-64

The behavior is identical in both environments.

Because the issue reproduces on both ARM64 and x86-64 platforms, architecture does not appear to be a contributing factor.

## Reproduction Matrix

| Environment | Repository Type | Result |
|------------|----------------|---------|
| Local VS Code | Personal repository | ✅ Semantic indexing succeeds |
| Local VS Code | Organization repository | ✅ Semantic indexing succeeds |
| WSL Remote | Personal repository | ❌ HTTP 401 |
| WSL Remote | Organization repository | ❌ HTTP 401 |
| Remote SSH | Repository | ❌ HTTP 401 |

## Steps to Reproduce

1. Open a repository locally in VS Code.
2. Trigger Semantic Index creation.
3. Observe that indexing succeeds.
4. Open the exact same repository through WSL Remote or Remote SSH.
5. Trigger Semantic Index creation.
6. Observe that indexing fails.
7. Review the GitHub Copilot Chat output.

## Expected Behavior

Semantic indexing should succeed regardless of whether the repository is opened locally or through a remote extension host.

## Actual Behavior

Repository ingestion succeeds.

Ingest finalization succeeds.

The final indexing request fails from the remote extension host with:

```text
GithubCodeSearchService.triggerIndexing(manual)
Response: 401 Requires authentication
```

## Key Diagnostic Finding

This does **not** appear to be a general GitHub or Copilot authentication failure.

The following functionality continues to work correctly:

- GitHub sign-in
- Copilot token acquisition
- Copilot Chat
- Repository discovery
- File ingestion
- Ingest finalization

Only the final remote indexing request fails.

## Representative Logs

### Successful Authentication

```text
Logged in as
Got Copilot token for

Copilot Chat: 0.59.0, VS Code: 1.131.0

copilot token sku: copilot_for_business_seat_quota
```

### Successful Ingestion

```text
ExternalIngestClient::performIngestion(): Uploaded 2 ingestable files in 956ms
ExternalIngestClient::performIngestion(): Successfully finalized ingest.
```

### Failed Indexing Request

```text
GithubCodeSearchService.triggerIndexing(manual). Failed to request indexing for '/'. Response: 401. {"message":"Requires authentication","status":"401"}

RepoTracker::TriggerRemoteIndexing(manual). Failed to request indexing for '/'.
```

Additional repro:

```text
ExternalIngestIndex::doIngest(): Checkpoint matches current checkpoint, skipping ingest.

GithubCodeSearchService.triggerIndexing(manual). Failed to request indexing for '/'. Response: 401. {"message":"Requires authentication","status":"401"}
```

## Additional Observations

### Local vs Remote Status Difference

For the same repository:

**Local VS Code:**

```text
Out of Date
```

**WSL Remote / Remote SSH:**

```text
Not Indexed
```

before the indexing attempt fails with HTTP 401.

### Extension Host Placement

When reviewing Running Extensions:

```text
GitHub Authentication -> Local

GitHub Copilot Chat -> Remote

Other GitHub-related extensions -> Remote
```

The failure only occurs when semantic indexing is initiated from a remote extension host.

This may indicate an issue with authentication propagation between the local GitHub Authentication provider and remote GitHub Code Search functionality.

## Additional Log Messages Observed

These may be unrelated, but were observed during testing/debugging and are included for completeness.

### During Login

```text
Failed to create database. Falling back to in-memory db:
Error: unable to open database file
```

### GitHub Actions Extension

```text
Error getting GitHub context
TypeError: Invalid URL
```

## Troubleshooting Performed

### Authentication

- Signed out of GitHub in VS Code.
- Signed back into GitHub.
- Signed out of GitHub-related extensions.
- Reauthenticated all GitHub-related extensions.

### WSL / Remote Environment

- Deleted `~/.vscode-server`.
- Allowed VS Code to fully rebuild the remote server.
- Reinstalled all extensions.

### GitHub Authentication

- Enabled vscode user setting: **GitHub Authentication: Prefer Device Code Flow**.
- Reauthenticated using device-code login.
- Confirmed successful Copilot token acquisition.

### Repository Testing

Created new test repositories specifically for validation:

- New personal repository
- New organization-owned repository

Results:

- Both repositories indexed successfully when opened locally.
- Both repositories failed with the identical HTTP 401 error when opened through WSL Remote.

### Cross-Platform Verification

The issue was originally observed on:

- Windows x86-64
- VS Code Remote SSH
- Remote AMD64 Linux host

The issue was later reproduced and most recently tested/debugged on:

- Windows ARM64
- WSL2
- ARM64 Linux environment

This strongly suggests the issue is associated with remote extension hosts rather than CPU architecture.

## Conclusion

Semantic indexing appears to fail only when executed through a remote extension host (WSL Remote or Remote SSH).

Evidence suggests that:

- GitHub authentication works.
- Copilot authentication works.
- Copilot Chat works.
- Semantic ingestion works.
- Semantic ingest finalization works.

The only failing operation is:

```text
GithubCodeSearchService.triggerIndexing(manual)
```

which consistently returns:

```text
401 Requires authentication
```

when initiated from a remote extension host.