feat: add snyk.remediationAgent.fixFolder command [IDE-2052]

application/codeaction/remediation_test.go

@@ -189,6 +189,48 @@ func TestResolveCodeAction_RemediationAgent_InvokesProvider(t *testing.T) {
 	assert.Len(t, resolved.Edit.Changes, 1, "resolved edit must carry the provider's changes")
 }
 
+func TestGetCodeActions_RemediationAgent_NonCodeProduct_NoAction(t *testing.T) {
+	fake := &fakeRemediationProvider{edit: &types.WorkspaceEdit{}}
+
+	// OSS issue with a FindingId and HasAIFix — should not get a remediation action.
+	ossIssue := &snyk.Issue{
+		FindingId: "finding-oss",
+		Product:   product.ProductOpenSource,
+		AdditionalData: snyk.OssIssueData{
+			IsUpgradable: true,
+		},
+	}
+
+	service, params := setupWithIssueAndProvider(t, ossIssue, fake)
+	actions := service.GetCodeActions(params)
+
+	for _, a := range actions {
+		assert.NotEqual(t, types.RemediationAgentQuickFix, a.Kind,
+			"non-Code product must not produce RemediationAgentQuickFix actions")
+	}
+}
+
+func TestGetCodeActions_RemediationAgent_NotAIFixable_NoAction(t *testing.T) {
+	fake := &fakeRemediationProvider{edit: &types.WorkspaceEdit{}}
+
+	// Code issue with HasAIFix=false — provider present but issue is not AI-fixable.
+	issue := &snyk.Issue{
+		FindingId: "finding-not-fixable",
+		Product:   product.ProductCode,
+		AdditionalData: snyk.CodeIssueData{
+			HasAIFix: false,
+		},
+	}
+
+	service, params := setupWithIssueAndProvider(t, issue, fake)
+	actions := service.GetCodeActions(params)
+
+	for _, a := range actions {
+		assert.NotEqual(t, types.RemediationAgentQuickFix, a.Kind,
+			"non-AI-fixable Code issue must not produce RemediationAgentQuickFix actions")
+	}
+}
+
 func TestGetCodeActions_RemediationAgent_DoesNotMutateIssueCodeActions(t *testing.T) {
 	fake := &fakeRemediationProvider{edit: &types.WorkspaceEdit{}}
 	issue := buildFixableIssue("finding-mutate")

application/di/init.go

@@ -233,17 +233,21 @@ func initApplication(conf configuration.Configuration, engine workflow.Engine, l
 	fileWatcher = watcher.NewFileWatcher()
 
 	var remediationProvider remediation.RemediationProvider
+	var folderRemediator remediation.FolderRemediator
 	remediationNotifier = nil
 	if conf.GetBool(remediationAgentEnabledKey) {
 		p := remediation.NewRemyProvider(engine, nil)
 		remediationProvider = p
 		if n, ok := p.(remediation.FileChangeNotifier); ok {
 			remediationNotifier = n
 		}
+		if fr, ok := p.(remediation.FolderRemediator); ok {
+			folderRemediator = fr
+		}
 	}
 
 	codeActionService = codeaction.NewService(engine, w, fileWatcher, notifier, featureFlagService, configResolver, remediationProvider)
-	command.SetService(command.NewService(engine, logger, authenticationService, featureFlagService, notifier, learnService, w, snykCodeScanner, snykCli, ldxSyncService, configResolver, scanStateAggregator.StateSnapshot))
+	command.SetService(command.NewService(engine, logger, authenticationService, featureFlagService, notifier, learnService, w, snykCodeScanner, snykCli, ldxSyncService, configResolver, scanStateAggregator.StateSnapshot, folderRemediator))
 }
 
 // remediationAgentEnabledKey is the configuration key that gates the remy-backed

application/di/init_fix_folder_test.go

@@ -0,0 +1,148 @@
+/*
+ * © 2026 Snyk Limited
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package di_test
+
+import (
+	"context"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/snyk/snyk-ls/application/di"
+	"github.com/snyk/snyk-ls/domain/ide/command"
+	"github.com/snyk/snyk-ls/domain/snyk/remediation"
+	"github.com/snyk/snyk-ls/internal/testutil"
+	"github.com/snyk/snyk-ls/internal/types"
+	"github.com/snyk/snyk-ls/internal/uri"
+)
+
+// INT-002: DI passes the gated provider into the command service.
+//
+// When remediation_agent_enabled=true, the real remyProvider (which implements
+// FolderRemediator) must reach the fixFolder command handler. We verify this
+// by constructing the command service directly via command.NewService and
+// wiring a fake FolderRemediator — removing the wiring call makes this RED.
+func TestDI_FixFolderCommand_WiredWhenEnabled(t *testing.T) {
+	engine, tokenService := testutil.UnitTestWithEngine(t)
+	_ = tokenService
+
+	// Build a minimal git repo so FixFolder has a valid path to validate.
+	repo := initGitRepoForDI(t)
+	folderURI := string(uri.PathToUri(types.FilePath(repo)))
+
+	// Set the flag so initApplication builds the real remediationProvider.
+	engine.GetConfiguration().Set("remediation_agent_enabled", true)
+
+	// Call di.Init to exercise the real wiring path.
+	deps := di.Init(engine, tokenService)
+	_ = deps
+
+	// The real command.Service singleton was set by di.Init. Verify it handles
+	// the fixFolder command without panicking on a nil provider.
+	// With the gate ON the provider is wired; with gate OFF it returns an error.
+	svc := command.Service()
+	require.NotNil(t, svc, "command.Service() must be non-nil after di.Init")
+
+	_, err := svc.ExecuteCommandData(context.Background(), types.CommandData{
+		CommandId: types.RemediationAgentFixFolderCommand,
+		Arguments: []any{folderURI},
+	}, nil)
+
+	// The command will attempt to run remy on a real repo but the engine has no
+	// real GAF workflows registered, so the runner (gafRunner) will fail. That
+	// is fine — what we are testing is that the handler is reached (not a nil
+	// provider error) and that the wiring did not break.
+	// If the provider is nil the error is "not enabled"; if wired it is a runner error.
+	if err != nil {
+		assert.NotContains(t, err.Error(), "not enabled",
+			"provider must be wired when gate is ON; 'not enabled' means provider is nil")
+	}
+}
+
+// INT-002b: Wiring test that is RED if the FolderRemediator param is removed
+// from NewService. Constructs a service with a non-nil provider and verifies
+// the fixFolder command reaches the provider.
+func TestDI_NewService_FixFolderProvider_Wired(t *testing.T) {
+	engine, tokenService := testutil.UnitTestWithEngine(t)
+	_ = tokenService
+
+	// Enable workspace/applyEdit so the capability guard in the handler passes.
+	caps := types.ClientCapabilities{}
+	caps.Workspace.ApplyEdit = true
+	engine.GetConfiguration().Set(types.SettingClientCapabilities, caps)
+
+	repo := initGitRepoForDI(t)
+	folderURI := string(uri.PathToUri(types.FilePath(repo)))
+
+	provider := &diTestFolderRemediator{}
+	svc := command.NewService(
+		engine,
+		engine.GetLogger(),
+		nil, nil, nil, nil, nil, nil, nil, nil, nil, nil,
+		provider,
+	)
+
+	_, _ = svc.ExecuteCommandData(context.Background(), types.CommandData{
+		CommandId: types.RemediationAgentFixFolderCommand,
+		Arguments: []any{folderURI},
+	}, nil)
+
+	// Provider must have been called — proves it was wired.
+	assert.True(t, provider.called, "FolderRemediator.FixFolder must be called when provider is wired")
+}
+
+// diTestFolderRemediator is a minimal FolderRemediator for the DI wiring test.
+type diTestFolderRemediator struct {
+	called bool
+}
+
+func (d *diTestFolderRemediator) FixFolder(_ context.Context, _ types.FilePath) (*types.WorkspaceEdit, error) {
+	d.called = true
+	return nil, nil
+}
+
+var _ remediation.FolderRemediator = (*diTestFolderRemediator)(nil)
+
+func initGitRepoForDI(t *testing.T) string {
+	t.Helper()
+	dir := t.TempDir()
+	run := func(args ...string) {
+		t.Helper()
+		cmd := exec.Command("git", args...)
+		cmd.Dir = dir
+		out, err := cmd.CombinedOutput()
+		require.NoError(t, err, "git %v: %s", args, string(out))
+	}
+	run("init")
+	run("config", "user.email", "test@example.com")
+	run("config", "user.name", "Test")
+	// Overlay filesystems (e.g. Docker on Linux) have write-ordering delays that
+	// can cause git to report "not a valid object" when the object database is
+	// read immediately after a write. core.checkStat=minimal tells git not to
+	// recheck filesystem timestamps for objects it has already cached in memory,
+	// which suppresses the false-negative reads on overlayfs.
+	run("config", "core.checkStat", "minimal")
+	f := filepath.Join(dir, "main.go")
+	require.NoError(t, os.WriteFile(f, []byte("package main\n"), 0644))
+	run("add", ".")
+	run("commit", "-m", "init")
+	return dir
+}

application/server/authentication_flows_e2e_test.go

@@ -390,6 +390,7 @@ func startE2ELocalServer(
 		deps.LdxSyncService,
 		deps.ConfigResolver,
 		nil,
+		nil,
 	))
 	recorder := &testsupport.JsonRPCRecorder{}
 	loc := startServer(engine, tokenService, nil, recorder, deps)

application/server/execute_command_test.go

@@ -182,7 +182,7 @@ func Test_loginCommand_StartsAuthentication(t *testing.T) {
 		})
 
 	// reset to use real service with mock injected
-	command.SetService(command.NewService(engine, engine.GetLogger(), authenticationService, deps.FeatureFlagService, deps.Notifier, deps.LearnService, nil, nil, nil, mockLdxSyncService, nil, nil))
+	command.SetService(command.NewService(engine, engine.GetLogger(), authenticationService, deps.FeatureFlagService, deps.Notifier, deps.LearnService, nil, nil, nil, mockLdxSyncService, nil, nil, nil))
 
 	_, err := loc.Client.Call(t.Context(), "initialize", nil)
 	if err != nil {

application/server/server.go

@@ -736,6 +736,7 @@ func initializeHandler(conf configuration.Configuration, engine workflow.Engine,
 						types.UpdateFolderConfig,
 						types.DismissFeedbackBanner,
 						types.FeedbackBannerInteracted,
+						types.RemediationAgentFixFolderCommand,
 					},
 				},
 			},