feat/autofix: get explanations from agent fix response, fall back to AI Explain

[BBerabi]

Description

AI Explain is being deprecated. Newer Agent Fix / Autofix responses already include an explanation per suggestion, so we no longer need a separate call to the (deprecated) AI Explain service in that case.

This PR:

• Propagates the explanation field from the sast-autofix-api response through to AutofixUnifiedDiffSuggestion.Explanation.
• Adds AutofixOptions.ExplainEndpoint. When set, GetAutofixDiffs falls back to the deprecated AI Explain service, but only for suggestions whose response did not already include an explanation. Suggestions that already have one are left untouched, and the AI Explain call is skipped entirely if none are missing or no ExplainEndpoint is configured.

This keeps the decision of "do we still need AI Explain" in one place (code-client-go) rather than duplicated across every consumer (snyk-ls, remy-cli-extension, native-pr-experience), so it supports both flows during rollout without a coordinated multi-repo change.

Checklist

• Tests added and all succeed
• Linted
• README.md updated, if user-facing

🚨After having merged, please update the snyk-ls and CLI go.mod to pull in latest client.

Consumers that want the fallback need to pass ExplainEndpoint in AutofixOptions and can drop their own "call AI Explain unconditionally" logic (e.g. AiFixHandler.EnrichWithExplain in snyk-ls).

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues
✅	Secrets	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[CLAassistant]

All committers have signed the CLA.

[snyk-pr-review-bot]

PR Reviewer Guide 🔍

🧪 PR contains tests

🔒 No security concerns identified

⚡ Recommended focus areas for review Ordering Mismatch 🟠 [major] enrichWithExplain maps fallback explanations to suggestions using positional indexing derived from getOrderedResponse. However, getOrderedResponse (line 173) performs a lexicographical sort on map keys. If the API returns 10 or more explanations (e.g., 'explanation1' through 'explanation10'), the sort order will be 'explanation1', 'explanation10', 'explanation2', etc. This will cause explanations to be incorrectly assigned to the wrong fix suggestions for any index greater than 1. explanations := getOrderedResponse(response) for i, idx := range missingIndices { if i >= len(explanations) { logger.Debug().Msgf("Failed to get fallback explanation for suggestion index %v", idx) break } suggestions[idx].Explanation = explanations[i] Inefficient Concatenation 🟡 [minor] The concatDiffs function uses repeated string concatenation (diff += v) inside a loop. In Go, strings are immutable, so this pattern results in O(n^2) time complexity and unnecessary memory allocations as new strings are created in every iteration. For suggestions involving multiple files or large diffs, this should use strings.Builder. func concatDiffs(suggestion AutofixUnifiedDiffSuggestion) string { diff := "" for _, v := range suggestion.UnifiedDiffsPerFile { diff += v } return diff

📚 Repository Context Analyzed This review considered 12 relevant code sections from 11 files (average relevance: 0.93) internal/deepcode/client.go (lines 1-269) internal/analysis/analysis.go (lines 1-236) llm/options.go (lines 1-37) sarif/sarif_types.go (lines 1-224) http/http.go (lines 1-206) scan.go (lines 244-381) README.md (lines 1-100) ... and 4 more file(s)

🤖 Repository instructions applied (from AGENTS.md)