From 8dfcf8b1d06ee9e40da04798c808ec32eb146f14 Mon Sep 17 00:00:00 2001
From: Jami Cogswell <jcogs33@Jamis-MacBook-Pro.local>
Date: Fri, 27 Jun 2025 19:12:17 +0000
Subject: [PATCH 01/38] Add 'View Autofixes' button to variant analysis view

---
 .../ql-vscode/src/common/interface-types.ts     |  6 ++++++
 .../variant-analysis-manager.ts                 |  4 ++++
 .../variant-analysis-view-manager.ts            |  4 ++++
 .../variant-analysis/variant-analysis-view.ts   |  6 ++++++
 .../view/variant-analysis/VariantAnalysis.tsx   | 12 ++++++++++++
 .../variant-analysis/VariantAnalysisActions.tsx | 17 +++++++++++++++++
 .../variant-analysis/VariantAnalysisHeader.tsx  |  4 ++++
 .../__tests__/VariantAnalysisActions.spec.tsx   |  3 +++
 8 files changed, 56 insertions(+)

diff --git a/extensions/ql-vscode/src/common/interface-types.ts b/extensions/ql-vscode/src/common/interface-types.ts
index 2a0fb24c811..3d23df070ef 100644
--- a/extensions/ql-vscode/src/common/interface-types.ts
+++ b/extensions/ql-vscode/src/common/interface-types.ts
@@ -527,6 +527,11 @@ interface OpenQueryTextMessage {
   t: "openQueryText";
 }
 
+interface ViewAutofixesMessage {
+  t: "viewAutofixes";
+  filterSort?: RepositoriesFilterSortStateWithIds;
+}
+
 interface CopyRepositoryListMessage {
   t: "copyRepositoryList";
   filterSort?: RepositoriesFilterSortStateWithIds;
@@ -561,6 +566,7 @@ export type FromVariantAnalysisMessage =
   | RequestRepositoryResultsMessage
   | OpenQueryFileMessage
   | OpenQueryTextMessage
+  | ViewAutofixesMessage
   | CopyRepositoryListMessage
   | ExportResultsMessage
   | OpenLogsMessage
diff --git a/extensions/ql-vscode/src/variant-analysis/variant-analysis-manager.ts b/extensions/ql-vscode/src/variant-analysis/variant-analysis-manager.ts
index 4e56c3cea7f..de7d1980629 100644
--- a/extensions/ql-vscode/src/variant-analysis/variant-analysis-manager.ts
+++ b/extensions/ql-vscode/src/variant-analysis/variant-analysis-manager.ts
@@ -967,6 +967,10 @@ export class VariantAnalysisManager
     );
   }
 
+  public async viewAutofixes() {
+    // TODO
+  }
+
   public async copyRepoListToClipboard(
     variantAnalysisId: number,
     filterSort: RepositoriesFilterSortStateWithIds = defaultFilterSortState,
diff --git a/extensions/ql-vscode/src/variant-analysis/variant-analysis-view-manager.ts b/extensions/ql-vscode/src/variant-analysis/variant-analysis-view-manager.ts
index cc531c558e7..db591ac3d95 100644
--- a/extensions/ql-vscode/src/variant-analysis/variant-analysis-view-manager.ts
+++ b/extensions/ql-vscode/src/variant-analysis/variant-analysis-view-manager.ts
@@ -34,4 +34,8 @@ export interface VariantAnalysisViewManager<
     variantAnalysisId: number,
     filterSort?: RepositoriesFilterSortStateWithIds,
   ): Promise<void>;
+  viewAutofixes(
+    variantAnalysisId: number,
+    filterSort?: RepositoriesFilterSortStateWithIds,
+  ): Promise<void>;
 }
diff --git a/extensions/ql-vscode/src/variant-analysis/variant-analysis-view.ts b/extensions/ql-vscode/src/variant-analysis/variant-analysis-view.ts
index f8a87e47b87..0656a0e3a0e 100644
--- a/extensions/ql-vscode/src/variant-analysis/variant-analysis-view.ts
+++ b/extensions/ql-vscode/src/variant-analysis/variant-analysis-view.ts
@@ -135,6 +135,12 @@ export class VariantAnalysisView
       case "openQueryText":
         await this.manager.openQueryText(this.variantAnalysisId);
         break;
+      case "viewAutofixes":
+        await this.manager.viewAutofixes(
+          this.variantAnalysisId,
+          msg.filterSort,
+        );
+        break;
       case "copyRepositoryList":
         await this.manager.copyRepoListToClipboard(
           this.variantAnalysisId,
diff --git a/extensions/ql-vscode/src/view/variant-analysis/VariantAnalysis.tsx b/extensions/ql-vscode/src/view/variant-analysis/VariantAnalysis.tsx
index 5b68d114d6f..524dbd57fed 100644
--- a/extensions/ql-vscode/src/view/variant-analysis/VariantAnalysis.tsx
+++ b/extensions/ql-vscode/src/view/variant-analysis/VariantAnalysis.tsx
@@ -105,6 +105,17 @@ export function VariantAnalysis({
     }
   }, []);
 
+  const viewAutofixes = useCallback(() => {
+    vscode.postMessage({
+      t: "viewAutofixes",
+      filterSort: {
+        ...filterSortState,
+        repositoryIds: selectedRepositoryIds,
+      },
+    });
+    sendTelemetry("variant-analysis-view-autofixes");
+  }, [filterSortState, selectedRepositoryIds]);
+
   const copyRepositoryList = useCallback(() => {
     vscode.postMessage({
       t: "copyRepositoryList",
@@ -148,6 +159,7 @@ export function VariantAnalysis({
         onOpenQueryFileClick={openQueryFile}
         onViewQueryTextClick={openQueryText}
         onStopQueryClick={stopQuery}
+        onViewAutofixesClick={viewAutofixes}
         onCopyRepositoryListClick={copyRepositoryList}
         onExportResultsClick={exportResults}
         onViewLogsClick={onViewLogsClick}
diff --git a/extensions/ql-vscode/src/view/variant-analysis/VariantAnalysisActions.tsx b/extensions/ql-vscode/src/view/variant-analysis/VariantAnalysisActions.tsx
index 8a573761ef0..d0e467b14eb 100644
--- a/extensions/ql-vscode/src/view/variant-analysis/VariantAnalysisActions.tsx
+++ b/extensions/ql-vscode/src/view/variant-analysis/VariantAnalysisActions.tsx
@@ -9,8 +9,10 @@ export type VariantAnalysisActionsProps = {
   stopQueryDisabled?: boolean;
 
   showResultActions?: boolean;
+  onViewAutofixesClick: () => void;
   onCopyRepositoryListClick: () => void;
   onExportResultsClick: () => void;
+  viewAutofixesDisabled?: boolean;
   copyRepositoryListDisabled?: boolean;
   exportResultsDisabled?: boolean;
 
@@ -55,8 +57,10 @@ export const VariantAnalysisActions = ({
   onStopQueryClick,
   stopQueryDisabled,
   showResultActions,
+  onViewAutofixesClick,
   onCopyRepositoryListClick,
   onExportResultsClick,
+  viewAutofixesDisabled,
   copyRepositoryListDisabled,
   exportResultsDisabled,
   hasSelectedRepositories,
@@ -66,6 +70,19 @@ export const VariantAnalysisActions = ({
     <Container>
       {showResultActions && (
         <>
+          <Button
+            secondary
+            onClick={onViewAutofixesClick}
+            disabled={viewAutofixesDisabled}
+          >
+            {chooseText({
+              hasSelectedRepositories,
+              hasFilteredRepositories,
+              normalText: "View Autofixes",
+              selectedText: "View Autofixes for selected results",
+              filteredText: "View Autofixes for filtered results",
+            })}
+          </Button>
           <Button
             secondary
             onClick={onCopyRepositoryListClick}
diff --git a/extensions/ql-vscode/src/view/variant-analysis/VariantAnalysisHeader.tsx b/extensions/ql-vscode/src/view/variant-analysis/VariantAnalysisHeader.tsx
index bdd9b5e11be..04dfad612c8 100644
--- a/extensions/ql-vscode/src/view/variant-analysis/VariantAnalysisHeader.tsx
+++ b/extensions/ql-vscode/src/view/variant-analysis/VariantAnalysisHeader.tsx
@@ -34,6 +34,7 @@ type VariantAnalysisHeaderProps = {
 
   onStopQueryClick: () => void;
 
+  onViewAutofixesClick: () => void;
   onCopyRepositoryListClick: () => void;
   onExportResultsClick: () => void;
 
@@ -82,6 +83,7 @@ export const VariantAnalysisHeader = ({
   onOpenQueryFileClick,
   onViewQueryTextClick,
   onStopQueryClick,
+  onViewAutofixesClick,
   onCopyRepositoryListClick,
   onExportResultsClick,
   onViewLogsClick,
@@ -150,11 +152,13 @@ export const VariantAnalysisHeader = ({
           variantAnalysisStatus={variantAnalysis.status}
           showResultActions={(resultCount ?? 0) > 0}
           onStopQueryClick={onStopQueryClick}
+          onViewAutofixesClick={onViewAutofixesClick}
           onCopyRepositoryListClick={onCopyRepositoryListClick}
           onExportResultsClick={onExportResultsClick}
           stopQueryDisabled={!variantAnalysis.actionsWorkflowRunId}
           exportResultsDisabled={!hasDownloadedRepos}
           copyRepositoryListDisabled={!hasReposWithResults}
+          viewAutofixesDisabled={!hasReposWithResults}
           hasFilteredRepositories={
             variantAnalysis.scannedRepos?.length !==
             filteredRepositories?.length
diff --git a/extensions/ql-vscode/src/view/variant-analysis/__tests__/VariantAnalysisActions.spec.tsx b/extensions/ql-vscode/src/view/variant-analysis/__tests__/VariantAnalysisActions.spec.tsx
index ff0a99099a3..3f33e344ea2 100644
--- a/extensions/ql-vscode/src/view/variant-analysis/__tests__/VariantAnalysisActions.spec.tsx
+++ b/extensions/ql-vscode/src/view/variant-analysis/__tests__/VariantAnalysisActions.spec.tsx
@@ -6,11 +6,13 @@ import { VariantAnalysisActions } from "../VariantAnalysisActions";
 
 describe(VariantAnalysisActions.name, () => {
   const onStopQueryClick = jest.fn();
+  const onViewAutofixesClick = jest.fn();
   const onCopyRepositoryListClick = jest.fn();
   const onExportResultsClick = jest.fn();
 
   afterEach(() => {
     onStopQueryClick.mockReset();
+    onViewAutofixesClick.mockReset();
     onCopyRepositoryListClick.mockReset();
     onExportResultsClick.mockReset();
   });
@@ -22,6 +24,7 @@ describe(VariantAnalysisActions.name, () => {
     reactRender(
       <VariantAnalysisActions
         onStopQueryClick={onStopQueryClick}
+        onViewAutofixesClick={onViewAutofixesClick}
         onCopyRepositoryListClick={onCopyRepositoryListClick}
         onExportResultsClick={onExportResultsClick}
         {...props}

From 11034377c9c1e5c39ce2d0d0e25aaf5255731d56 Mon Sep 17 00:00:00 2001
From: Jami Cogswell <jcogs33@Jamis-MacBook-Pro.local>
Date: Fri, 27 Jun 2025 19:45:53 +0000
Subject: [PATCH 02/38] Add 'View Autofixes' query history command for variant
 analysis items

---
 extensions/ql-vscode/package.json                   | 13 +++++++++++++
 extensions/ql-vscode/src/common/commands.ts         |  1 +
 .../src/query-history/query-history-manager.ts      | 13 +++++++++++++
 .../variant-analysis/variant-analysis-manager.ts    |  6 +++++-
 4 files changed, 32 insertions(+), 1 deletion(-)

diff --git a/extensions/ql-vscode/package.json b/extensions/ql-vscode/package.json
index 4f4e0079250..32c6d419d08 100644
--- a/extensions/ql-vscode/package.json
+++ b/extensions/ql-vscode/package.json
@@ -958,6 +958,10 @@
         "command": "codeQLQueryHistory.copyRepoList",
         "title": "Copy Repository List"
       },
+      {
+        "command": "codeQLQueryHistory.viewAutofixes",
+        "title": "View Autofixes"
+      },
       {
         "command": "codeQLQueryResults.down",
         "title": "CodeQL: Navigate Down in Local Result Viewer"
@@ -1296,6 +1300,11 @@
           "group": "1_queryHistory@1",
           "when": "viewItem == remoteResultsItem"
         },
+        {
+          "command": "codeQLQueryHistory.viewAutofixes",
+          "group": "1_queryHistory@2",
+          "when": "viewItem == remoteResultsItem"
+        },
         {
           "command": "codeQLQueries.runLocalQueryFromQueriesPanel",
           "group": "inline",
@@ -1706,6 +1715,10 @@
           "command": "codeQLQueryHistory.copyRepoList",
           "when": "false"
         },
+        {
+          "command": "codeQLQueryHistory.viewAutofixes",
+          "when": "false"
+        },
         {
           "command": "codeQLQueryHistory.showQueryText",
           "when": "false"
diff --git a/extensions/ql-vscode/src/common/commands.ts b/extensions/ql-vscode/src/common/commands.ts
index fcaf2eb72d8..cfcfabb3f85 100644
--- a/extensions/ql-vscode/src/common/commands.ts
+++ b/extensions/ql-vscode/src/common/commands.ts
@@ -197,6 +197,7 @@ export type QueryHistoryCommands = {
   "codeQLQueryHistory.itemClicked": TreeViewContextMultiSelectionCommandFunction<QueryHistoryInfo>;
   "codeQLQueryHistory.openOnGithub": TreeViewContextMultiSelectionCommandFunction<QueryHistoryInfo>;
   "codeQLQueryHistory.copyRepoList": TreeViewContextMultiSelectionCommandFunction<QueryHistoryInfo>;
+  "codeQLQueryHistory.viewAutofixes": TreeViewContextMultiSelectionCommandFunction<QueryHistoryInfo>;
 
   // Commands in the command palette
   "codeQL.exportSelectedVariantAnalysisResults": () => Promise<void>;
diff --git a/extensions/ql-vscode/src/query-history/query-history-manager.ts b/extensions/ql-vscode/src/query-history/query-history-manager.ts
index bf6823abac1..dd21a9d17f8 100644
--- a/extensions/ql-vscode/src/query-history/query-history-manager.ts
+++ b/extensions/ql-vscode/src/query-history/query-history-manager.ts
@@ -338,6 +338,11 @@ export class QueryHistoryManager extends DisposableObject {
         this.handleOpenOnGithub.bind(this),
         "query",
       ),
+      "codeQLQueryHistory.viewAutofixes": createSingleSelectionCommand(
+        this.app.logger,
+        this.handleViewAutofixes.bind(this),
+        "query",
+      ),
       "codeQLQueryHistory.copyRepoList": createSingleSelectionCommand(
         this.app.logger,
         this.handleCopyRepoList.bind(this),
@@ -1052,6 +1057,14 @@ export class QueryHistoryManager extends DisposableObject {
     );
   }
 
+  async handleViewAutofixes(item: QueryHistoryInfo) {
+    if (item.t !== "variant-analysis") {
+      return;
+    }
+
+    await this.variantAnalysisManager.viewAutofixes(item.variantAnalysis.id);
+  }
+
   async handleCopyRepoList(item: QueryHistoryInfo) {
     if (item.t !== "variant-analysis") {
       return;
diff --git a/extensions/ql-vscode/src/variant-analysis/variant-analysis-manager.ts b/extensions/ql-vscode/src/variant-analysis/variant-analysis-manager.ts
index de7d1980629..c043d44eeef 100644
--- a/extensions/ql-vscode/src/variant-analysis/variant-analysis-manager.ts
+++ b/extensions/ql-vscode/src/variant-analysis/variant-analysis-manager.ts
@@ -967,7 +967,11 @@ export class VariantAnalysisManager
     );
   }
 
-  public async viewAutofixes() {
+  public async viewAutofixes(variantAnalysisId: number) {
+    const variantAnalysis = this.variantAnalyses.get(variantAnalysisId);
+    if (!variantAnalysis) {
+      throw new Error(`No variant analysis with id: ${variantAnalysisId}`);
+    }
     // TODO
   }
 

From 5f5a20fc1e5eac3c6c3e4e23598bba6ecc2ad207 Mon Sep 17 00:00:00 2001
From: Jami Cogswell <jcogs33@Jamis-MacBook-Pro.local>
Date: Fri, 27 Jun 2025 19:59:24 +0000
Subject: [PATCH 03/38] Add 'view-autofixes.ts' file for main implementation

---
 .../variant-analysis-manager.ts               | 21 ++++++++++++-----
 .../src/variant-analysis/view-autofixes.ts    | 23 +++++++++++++++++++
 2 files changed, 38 insertions(+), 6 deletions(-)
 create mode 100644 extensions/ql-vscode/src/variant-analysis/view-autofixes.ts

diff --git a/extensions/ql-vscode/src/variant-analysis/variant-analysis-manager.ts b/extensions/ql-vscode/src/variant-analysis/variant-analysis-manager.ts
index c043d44eeef..04407f8f679 100644
--- a/extensions/ql-vscode/src/variant-analysis/variant-analysis-manager.ts
+++ b/extensions/ql-vscode/src/variant-analysis/variant-analysis-manager.ts
@@ -73,6 +73,7 @@ import type {
   VariantAnalysisCommands,
 } from "../common/commands";
 import { exportVariantAnalysisResults } from "./export-results";
+import { viewAutofixesForVariantAnalysisResults } from "./view-autofixes";
 import {
   readRepoStates,
   REPO_STATES_FILENAME,
@@ -967,12 +968,20 @@ export class VariantAnalysisManager
     );
   }
 
-  public async viewAutofixes(variantAnalysisId: number) {
-    const variantAnalysis = this.variantAnalyses.get(variantAnalysisId);
-    if (!variantAnalysis) {
-      throw new Error(`No variant analysis with id: ${variantAnalysisId}`);
-    }
-    // TODO
+  public async viewAutofixes(
+    variantAnalysisId: number,
+    filterSort: RepositoriesFilterSortStateWithIds = defaultFilterSortState,
+  ) {
+    await viewAutofixesForVariantAnalysisResults(
+      variantAnalysisId,
+      filterSort,
+      this.variantAnalyses,
+      this.app.credentials,
+      this.app.logger,
+      this.storagePath,
+      this.app,
+      this.cliServer,
+    );
   }
 
   public async copyRepoListToClipboard(
diff --git a/extensions/ql-vscode/src/variant-analysis/view-autofixes.ts b/extensions/ql-vscode/src/variant-analysis/view-autofixes.ts
new file mode 100644
index 00000000000..07262e00986
--- /dev/null
+++ b/extensions/ql-vscode/src/variant-analysis/view-autofixes.ts
@@ -0,0 +1,23 @@
+import type { RepositoriesFilterSortStateWithIds } from "./shared/variant-analysis-filter-sort";
+import { defaultFilterSortState } from "./shared/variant-analysis-filter-sort";
+import type { VariantAnalysis } from "./shared/variant-analysis";
+import type { Credentials } from "../common/authentication";
+import type { NotificationLogger } from "../common/logging";
+import type { App } from "../common/app";
+import type { CodeQLCliServer } from "../codeql-cli/cli";
+
+/**
+ * Generates autofixes for the results of a variant analysis.
+ */
+export async function viewAutofixesForVariantAnalysisResults(
+  variantAnalysisId: number,
+  filterSort: RepositoriesFilterSortStateWithIds = defaultFilterSortState,
+  variantAnalyses: Map<number, VariantAnalysis>,
+  credentials: Credentials,
+  logger: NotificationLogger,
+  storagePath: string,
+  app: App,
+  cliServer: CodeQLCliServer,
+): Promise<void> {
+  // TODO
+}

From fb39455bf745ba5f09aae9ac8bf0b1fac0940f5a Mon Sep 17 00:00:00 2001
From: Jami Cogswell <jcogs33@Jamis-MacBook-Pro.local>
Date: Fri, 27 Jun 2025 20:06:32 +0000
Subject: [PATCH 04/38] Check for local autofix

---
 .../src/variant-analysis/view-autofixes.ts    | 34 ++++++++++++++++++-
 1 file changed, 33 insertions(+), 1 deletion(-)

diff --git a/extensions/ql-vscode/src/variant-analysis/view-autofixes.ts b/extensions/ql-vscode/src/variant-analysis/view-autofixes.ts
index 07262e00986..f0b055cce96 100644
--- a/extensions/ql-vscode/src/variant-analysis/view-autofixes.ts
+++ b/extensions/ql-vscode/src/variant-analysis/view-autofixes.ts
@@ -5,6 +5,9 @@ import type { Credentials } from "../common/authentication";
 import type { NotificationLogger } from "../common/logging";
 import type { App } from "../common/app";
 import type { CodeQLCliServer } from "../codeql-cli/cli";
+import { pathExists } from "fs-extra";
+import { withProgress, progressUpdate } from "../common/vscode/progress";
+import type { ProgressCallback } from "../common/vscode/progress";
 
 /**
  * Generates autofixes for the results of a variant analysis.
@@ -19,5 +22,34 @@ export async function viewAutofixesForVariantAnalysisResults(
   app: App,
   cliServer: CodeQLCliServer,
 ): Promise<void> {
-  // TODO
+  await withProgress(
+    async (progress: ProgressCallback) => {
+      // Get the path to the local autofix installation.
+      progress(progressUpdate(1, 4, `Checking for local autofix installation`));
+      const localAutofixPath = findLocalAutofix();
+
+      // TODO
+    },
+    {
+      title: "Generating Autofixes",
+      cancellable: false, // not cancellable for now
+    },
+  );
+}
+
+/**
+ * Finds the local autofix installation path from the AUTOFIX_PATH environment variable.
+ * Throws an error if the path is not set or does not exist.
+ * @returns An object containing the local autofix path.
+ * @throws Error if the AUTOFIX_PATH environment variable is not set or the path does not exist.
+ */
+function findLocalAutofix(): string {
+  const localAutofixPath = process.env.AUTOFIX_PATH;
+  if (!localAutofixPath) {
+    throw new Error("Path to local autofix installation not found.");
+  }
+  if (!pathExists(localAutofixPath)) {
+    throw new Error(`Local autofix path ${localAutofixPath} does not exist.`);
+  }
+  return localAutofixPath;
 }

From 27bdc31ab4e3962cf2ce09dcda2cd5af7e870c52 Mon Sep 17 00:00:00 2001
From: Jami Cogswell <jcogs33@Jamis-MacBook-Pro.local>
Date: Fri, 27 Jun 2025 20:18:55 +0000
Subject: [PATCH 05/38] Override query help

---
 .../src/variant-analysis/view-autofixes.ts    | 77 +++++++++++++++++++
 1 file changed, 77 insertions(+)

diff --git a/extensions/ql-vscode/src/variant-analysis/view-autofixes.ts b/extensions/ql-vscode/src/variant-analysis/view-autofixes.ts
index f0b055cce96..30bba3b3e03 100644
--- a/extensions/ql-vscode/src/variant-analysis/view-autofixes.ts
+++ b/extensions/ql-vscode/src/variant-analysis/view-autofixes.ts
@@ -8,6 +8,8 @@ import type { CodeQLCliServer } from "../codeql-cli/cli";
 import { pathExists } from "fs-extra";
 import { withProgress, progressUpdate } from "../common/vscode/progress";
 import type { ProgressCallback } from "../common/vscode/progress";
+import { join, dirname, parse } from "path";
+import { tryGetQueryMetadata } from "../codeql-cli/query-metadata";
 
 /**
  * Generates autofixes for the results of a variant analysis.
@@ -28,6 +30,16 @@ export async function viewAutofixesForVariantAnalysisResults(
       progress(progressUpdate(1, 4, `Checking for local autofix installation`));
       const localAutofixPath = findLocalAutofix();
 
+      // Get the variant analysis with the given id.
+      const variantAnalysis = variantAnalyses.get(variantAnalysisId);
+      if (!variantAnalysis) {
+        throw new Error(`No variant analysis with id: ${variantAnalysisId}`);
+      }
+
+      // Generate the query help and output it to the override directory.
+      progress(progressUpdate(2, 4, `Generating query help override`));
+      await overrideQueryHelp(variantAnalysis, cliServer, localAutofixPath);
+
       // TODO
     },
     {
@@ -53,3 +65,68 @@ function findLocalAutofix(): string {
   }
   return localAutofixPath;
 }
+
+/**
+ * Overrides the query help from a given variant analysis
+ * at a location within the `localAutofixPath` directory .
+ */
+async function overrideQueryHelp(
+  variantAnalysis: VariantAnalysis,
+  cliServer: CodeQLCliServer,
+  localAutofixPath: string,
+): Promise<void> {
+  // Get path to the query used by the variant analysis.
+  const queryFilePath = variantAnalysis.query.filePath;
+  if (!(await pathExists(queryFilePath))) {
+    throw new Error(`Query file used by variant analysis not found.`);
+  }
+  const queryFilePathNoExt = join(
+    dirname(queryFilePath),
+    parse(queryFilePath).name,
+  );
+
+  // Get the path to the query help, which may be either a `.qhelp` or a `.md` file.
+  // Note: we assume that the name of the query file is the same as the name of the query help file.
+  const queryHelpFilePathQhelp = `${queryFilePathNoExt}.qhelp`;
+  const queryHelpFilePathMarkdown = `${queryFilePathNoExt}.md`;
+
+  // Set `queryHelpFilePath` to the existing extension type.
+  let queryHelpFilePath: string;
+  if (await pathExists(queryHelpFilePathQhelp)) {
+    queryHelpFilePath = queryHelpFilePathQhelp;
+  } else if (await pathExists(queryHelpFilePathMarkdown)) {
+    queryHelpFilePath = queryHelpFilePathMarkdown;
+  } else {
+    throw new Error(
+      `Could not find query help file at either ${queryHelpFilePathQhelp} or ${queryHelpFilePathMarkdown}. Check that the query help file exists and is named correctly.`,
+    );
+  }
+
+  // Get the query metadata.
+  const metadata = await tryGetQueryMetadata(cliServer, queryFilePath);
+  if (!metadata) {
+    throw new Error(`Could not get query metadata for ${queryFilePath}.`);
+  }
+  // Get the query ID (used for the overridden query help's filename).
+  const queryId = metadata.id;
+  if (!queryId) {
+    throw new Error(`Query metadata for ${queryFilePath} is missing an ID.`);
+  }
+  // Replace `/` with `-` for use with the overridden query help's filename.
+  // Use `replaceAll` since some query IDs have multiple slashes.
+  const queryIdWithDash = queryId.replaceAll("/", "-");
+
+  // Get the path to the output directory for overriding the query help.
+  // Note: the path to this directory may change in the future.
+  const queryHelpOverrideDirectory = join(
+    localAutofixPath,
+    "prompt-templates",
+    "qhelps",
+    `${queryIdWithDash}.md`,
+  );
+
+  await cliServer.generateQueryHelp(
+    queryHelpFilePath,
+    queryHelpOverrideDirectory,
+  );
+}

From 9a8bd792b4611950fdacb60f4fea94462109e862 Mon Sep 17 00:00:00 2001
From: Jami Cogswell <jcogs33@Jamis-MacBook-Pro.local>
Date: Fri, 27 Jun 2025 22:05:56 +0000
Subject: [PATCH 06/38] Get full names (owner/repo) of the selected
 repositories

---
 .../src/variant-analysis/view-autofixes.ts    | 53 ++++++++++++++++++-
 1 file changed, 52 insertions(+), 1 deletion(-)

diff --git a/extensions/ql-vscode/src/variant-analysis/view-autofixes.ts b/extensions/ql-vscode/src/variant-analysis/view-autofixes.ts
index 30bba3b3e03..66054011514 100644
--- a/extensions/ql-vscode/src/variant-analysis/view-autofixes.ts
+++ b/extensions/ql-vscode/src/variant-analysis/view-autofixes.ts
@@ -1,5 +1,8 @@
 import type { RepositoriesFilterSortStateWithIds } from "./shared/variant-analysis-filter-sort";
-import { defaultFilterSortState } from "./shared/variant-analysis-filter-sort";
+import {
+  defaultFilterSortState,
+  filterAndSortRepositoriesWithResults,
+} from "./shared/variant-analysis-filter-sort";
 import type { VariantAnalysis } from "./shared/variant-analysis";
 import type { Credentials } from "../common/authentication";
 import type { NotificationLogger } from "../common/logging";
@@ -10,6 +13,13 @@ import { withProgress, progressUpdate } from "../common/vscode/progress";
 import type { ProgressCallback } from "../common/vscode/progress";
 import { join, dirname, parse } from "path";
 import { tryGetQueryMetadata } from "../codeql-cli/query-metadata";
+import { window as Window } from "vscode";
+
+// Limit to three repos when generating autofixes so not sending
+// too many requests to autofix. Since we only need to validate
+// a handle of autofixes for each query, this should be sufficient.
+// Consider increasing this in the future if needed.
+const MAX_NUM_REPOS: number = 3;
 
 /**
  * Generates autofixes for the results of a variant analysis.
@@ -40,6 +50,12 @@ export async function viewAutofixesForVariantAnalysisResults(
       progress(progressUpdate(2, 4, `Generating query help override`));
       await overrideQueryHelp(variantAnalysis, cliServer, localAutofixPath);
 
+      // Get the full names (nwos) of the selected repositories.
+      const selectedRepoNames = getSelectedRepositoryNames(
+        variantAnalysis,
+        filterSort,
+      );
+
       // TODO
     },
     {
@@ -130,3 +146,38 @@ async function overrideQueryHelp(
     queryHelpOverrideDirectory,
   );
 }
+
+/**
+ * Gets the full names (owner/repo) of the selected
+ * repositories from the given variant analysis while
+ * limiting the number of repositories to `MAX_NUM_REPOS`.
+ */
+function getSelectedRepositoryNames(
+  variantAnalysis: VariantAnalysis,
+  filterSort: RepositoriesFilterSortStateWithIds,
+): string[] {
+  // Get the repositories that were selected by the user.
+  const filteredRepositories = filterAndSortRepositoriesWithResults(
+    variantAnalysis.scannedRepos,
+    filterSort,
+  );
+
+  // Get the full names (owner/repo = nwo) of the selected repos.
+  let fullNames = filteredRepositories
+    ?.filter((a) => a.resultCount && a.resultCount > 0)
+    .map((a) => a.repository.fullName);
+  if (!fullNames || fullNames.length === 0) {
+    throw new Error("No repositories with results found.");
+  }
+
+  // Limit to MAX_NUM_REPOS by slicing the array,
+  // and inform the user about the limit.
+  if (fullNames.length > MAX_NUM_REPOS) {
+    fullNames = fullNames.slice(0, MAX_NUM_REPOS);
+    void Window.showInformationMessage(
+      `Only the first ${MAX_NUM_REPOS} repos (${fullNames.join(", ")}) will be included in the Autofix results.`,
+    );
+  }
+
+  return fullNames;
+}

From 66d952683b352c5bebf4d5ab9291af588c765927 Mon Sep 17 00:00:00 2001
From: Jami Cogswell <jcogs33@Jamis-MacBook-Pro.local>
Date: Fri, 27 Jun 2025 22:10:54 +0000
Subject: [PATCH 07/38] Get storage paths for autofix output

---
 .../src/variant-analysis/view-autofixes.ts    | 58 ++++++++++++++++++-
 1 file changed, 57 insertions(+), 1 deletion(-)

diff --git a/extensions/ql-vscode/src/variant-analysis/view-autofixes.ts b/extensions/ql-vscode/src/variant-analysis/view-autofixes.ts
index 66054011514..67ecc4444a7 100644
--- a/extensions/ql-vscode/src/variant-analysis/view-autofixes.ts
+++ b/extensions/ql-vscode/src/variant-analysis/view-autofixes.ts
@@ -8,7 +8,7 @@ import type { Credentials } from "../common/authentication";
 import type { NotificationLogger } from "../common/logging";
 import type { App } from "../common/app";
 import type { CodeQLCliServer } from "../codeql-cli/cli";
-import { pathExists } from "fs-extra";
+import { pathExists, ensureDir } from "fs-extra";
 import { withProgress, progressUpdate } from "../common/vscode/progress";
 import type { ProgressCallback } from "../common/vscode/progress";
 import { join, dirname, parse } from "path";
@@ -56,6 +56,13 @@ export async function viewAutofixesForVariantAnalysisResults(
         filterSort,
       );
 
+      // Get storage paths for the autofix results.
+      const {
+        variantAnalysisIdStoragePath,
+        sourceRootsStoragePath,
+        autofixOutputStoragePath,
+      } = await getStoragePaths(variantAnalysisId, storagePath);
+
       // TODO
     },
     {
@@ -181,3 +188,52 @@ function getSelectedRepositoryNames(
 
   return fullNames;
 }
+
+/**
+ * Gets the storage paths needed for the autofix results.
+ */
+async function getStoragePaths(
+  variantAnalysisId: number,
+  storagePath: string,
+): Promise<{
+  variantAnalysisIdStoragePath: string;
+  sourceRootsStoragePath: string;
+  autofixOutputStoragePath: string;
+}> {
+  // Confirm storage path for the variant analysis ID exists.
+  const variantAnalysisIdStoragePath = join(
+    storagePath,
+    variantAnalysisId.toString(),
+  );
+  if (!(await pathExists(variantAnalysisIdStoragePath))) {
+    throw new Error(
+      `Variant analysis storage path does not exist: ${variantAnalysisIdStoragePath}`,
+    );
+  }
+
+  // Storage path for all autofix info.
+  const autofixStoragePath = join(variantAnalysisIdStoragePath, "autofix");
+
+  // Storage path for the source roots used with autofix.
+  const sourceRootsStoragePath = join(autofixStoragePath, "source-roots");
+  await ensureDir(sourceRootsStoragePath);
+
+  // Storage path for the autofix output.
+  let autofixOutputStoragePath = join(autofixStoragePath, "output");
+  // If the path already exists, assume that it's a previous run
+  // and append "-n" to the end of the path where n is the next available number.
+  if (await pathExists(autofixOutputStoragePath)) {
+    let i = 1;
+    while (await pathExists(autofixOutputStoragePath + i.toString())) {
+      i++;
+    }
+    autofixOutputStoragePath = autofixOutputStoragePath += i.toString();
+  }
+  await ensureDir(autofixOutputStoragePath);
+
+  return {
+    variantAnalysisIdStoragePath,
+    sourceRootsStoragePath,
+    autofixOutputStoragePath,
+  };
+}

From 9c4d7a7f35d8e314fab01292ec6a0dd194c47435 Mon Sep 17 00:00:00 2001
From: Jami Cogswell <jcogs33@Jamis-MacBook-Pro.local>
Date: Fri, 27 Jun 2025 22:16:15 +0000
Subject: [PATCH 08/38] Add function to process the selected repositories

---
 .../src/variant-analysis/view-autofixes.ts    | 39 +++++++++++++++++++
 1 file changed, 39 insertions(+)

diff --git a/extensions/ql-vscode/src/variant-analysis/view-autofixes.ts b/extensions/ql-vscode/src/variant-analysis/view-autofixes.ts
index 67ecc4444a7..805ed8e0500 100644
--- a/extensions/ql-vscode/src/variant-analysis/view-autofixes.ts
+++ b/extensions/ql-vscode/src/variant-analysis/view-autofixes.ts
@@ -14,6 +14,7 @@ import type { ProgressCallback } from "../common/vscode/progress";
 import { join, dirname, parse } from "path";
 import { tryGetQueryMetadata } from "../codeql-cli/query-metadata";
 import { window as Window } from "vscode";
+import { pluralize } from "../common/word";
 
 // Limit to three repos when generating autofixes so not sending
 // too many requests to autofix. Since we only need to validate
@@ -63,6 +64,27 @@ export async function viewAutofixesForVariantAnalysisResults(
         autofixOutputStoragePath,
       } = await getStoragePaths(variantAnalysisId, storagePath);
 
+      // Process the selected repositories:
+      //  Get sarif
+      //  Download source root
+      //  Run autofix and output results
+      progress(
+        progressUpdate(
+          3,
+          4,
+          `Processing ${pluralize(selectedRepoNames.length, "repository", "repositories")}`,
+        ),
+      );
+      const outputTextFiles = await processSelectedRepositories(
+        selectedRepoNames,
+        variantAnalysisIdStoragePath,
+        sourceRootsStoragePath,
+        autofixOutputStoragePath,
+        localAutofixPath,
+        credentials,
+        logger,
+      );
+
       // TODO
     },
     {
@@ -237,3 +259,20 @@ async function getStoragePaths(
     autofixOutputStoragePath,
   };
 }
+
+/**
+ * Processes the selected repositories for autofix generation.
+ */
+async function processSelectedRepositories(
+  selectedRepoNames: string[],
+  variantAnalysisIdStoragePath: string,
+  sourceRootsStoragePath: string,
+  autofixOutputStoragePath: string,
+  localAutofixPath: string,
+  credentials: Credentials,
+  logger: NotificationLogger,
+): Promise<string[]> {
+  const outputTextFiles: string[] = [];
+  // TODO
+  return outputTextFiles;
+}

From 2afd2ee4b027a3cbe247b706c559c959e62e906d Mon Sep 17 00:00:00 2001
From: Jami Cogswell <jcogs33@Jamis-MacBook-Pro.local>
Date: Fri, 27 Jun 2025 22:26:46 +0000
Subject: [PATCH 09/38] Get SARIF for variant analysis repo

---
 .../src/variant-analysis/view-autofixes.ts    | 38 ++++++++++++++++++-
 1 file changed, 37 insertions(+), 1 deletion(-)

diff --git a/extensions/ql-vscode/src/variant-analysis/view-autofixes.ts b/extensions/ql-vscode/src/variant-analysis/view-autofixes.ts
index 805ed8e0500..66897f1ed30 100644
--- a/extensions/ql-vscode/src/variant-analysis/view-autofixes.ts
+++ b/extensions/ql-vscode/src/variant-analysis/view-autofixes.ts
@@ -15,6 +15,7 @@ import { join, dirname, parse } from "path";
 import { tryGetQueryMetadata } from "../codeql-cli/query-metadata";
 import { window as Window } from "vscode";
 import { pluralize } from "../common/word";
+import { glob } from "glob";
 
 // Limit to three repos when generating autofixes so not sending
 // too many requests to autofix. Since we only need to validate
@@ -273,6 +274,41 @@ async function processSelectedRepositories(
   logger: NotificationLogger,
 ): Promise<string[]> {
   const outputTextFiles: string[] = [];
-  // TODO
+  await Promise.all(
+    selectedRepoNames.map(async (nwo) =>
+      withProgress(
+        async (progressForRepo: ProgressCallback) => {
+          // Get the sarif file.
+          progressForRepo(progressUpdate(1, 3, `Getting sarif`));
+          const repoStoragePath = join(variantAnalysisIdStoragePath, nwo);
+          const sarifFile = await getSarifFile(repoStoragePath, nwo);
+        },
+        {
+          title: `Processing ${nwo}`,
+          cancellable: false,
+        },
+      ),
+    ),
+  );
+
   return outputTextFiles;
 }
+
+/**
+ * Gets the path to a SARIF file in a given `repoStoragePath`.
+ */
+async function getSarifFile(
+  repoStoragePath: string,
+  nwo: string,
+): Promise<string> {
+  // Get results directory path.
+  const repoResultsStoragePath = join(repoStoragePath, "results");
+  // Find sarif file.
+  const sarifFiles = await glob(`${repoResultsStoragePath}/**/*.sarif`);
+  if (sarifFiles.length !== 1) {
+    throw new Error(
+      `Expected to find exactly one \`*.sarif\` file for ${nwo}, but found ${sarifFiles.length}.`,
+    );
+  }
+  return sarifFiles[0];
+}

From 2bcf42e42eefdd77ca0d43374eacea8406ee60d3 Mon Sep 17 00:00:00 2001
From: Jami Cogswell <jcogs33@Jamis-MacBook-Pro.local>
Date: Fri, 27 Jun 2025 22:31:14 +0000
Subject: [PATCH 10/38] Read 'repo_task.json' file

---
 .../src/variant-analysis/view-autofixes.ts      | 17 ++++++++++++++++-
 1 file changed, 16 insertions(+), 1 deletion(-)

diff --git a/extensions/ql-vscode/src/variant-analysis/view-autofixes.ts b/extensions/ql-vscode/src/variant-analysis/view-autofixes.ts
index 66897f1ed30..7491d084545 100644
--- a/extensions/ql-vscode/src/variant-analysis/view-autofixes.ts
+++ b/extensions/ql-vscode/src/variant-analysis/view-autofixes.ts
@@ -3,7 +3,10 @@ import {
   defaultFilterSortState,
   filterAndSortRepositoriesWithResults,
 } from "./shared/variant-analysis-filter-sort";
-import type { VariantAnalysis } from "./shared/variant-analysis";
+import type {
+  VariantAnalysis,
+  VariantAnalysisRepositoryTask,
+} from "./shared/variant-analysis";
 import type { Credentials } from "../common/authentication";
 import type { NotificationLogger } from "../common/logging";
 import type { App } from "../common/app";
@@ -16,6 +19,7 @@ import { tryGetQueryMetadata } from "../codeql-cli/query-metadata";
 import { window as Window } from "vscode";
 import { pluralize } from "../common/word";
 import { glob } from "glob";
+import { readRepoTask } from "./repo-tasks-store";
 
 // Limit to three repos when generating autofixes so not sending
 // too many requests to autofix. Since we only need to validate
@@ -282,6 +286,17 @@ async function processSelectedRepositories(
           progressForRepo(progressUpdate(1, 3, `Getting sarif`));
           const repoStoragePath = join(variantAnalysisIdStoragePath, nwo);
           const sarifFile = await getSarifFile(repoStoragePath, nwo);
+
+          // Read the contents of the variant analysis' `repo_task.json` file,
+          // and confirm that the `databaseCommitSha` and `resultCount` exist.
+          const repoTask: VariantAnalysisRepositoryTask =
+            await readRepoTask(repoStoragePath);
+          if (!repoTask.databaseCommitSha) {
+            throw new Error(`Missing database commit SHA for ${nwo}`);
+          }
+          if (!repoTask.resultCount) {
+            throw new Error(`Missing variant analysis result count for ${nwo}`);
+          }
         },
         {
           title: `Processing ${nwo}`,

From b0b8b627186ca73a49d20bfc4fdd5a195dcc357c Mon Sep 17 00:00:00 2001
From: Jami Cogswell <jcogs33@Jamis-MacBook-Pro.local>
Date: Sat, 28 Jun 2025 19:42:12 +0000
Subject: [PATCH 11/38] Download source root

---
 .../src/variant-analysis/view-autofixes.ts    | 131 +++++++++++++++++-
 1 file changed, 130 insertions(+), 1 deletion(-)

diff --git a/extensions/ql-vscode/src/variant-analysis/view-autofixes.ts b/extensions/ql-vscode/src/variant-analysis/view-autofixes.ts
index 7491d084545..1b2b0e76fcd 100644
--- a/extensions/ql-vscode/src/variant-analysis/view-autofixes.ts
+++ b/extensions/ql-vscode/src/variant-analysis/view-autofixes.ts
@@ -11,7 +11,7 @@ import type { Credentials } from "../common/authentication";
 import type { NotificationLogger } from "../common/logging";
 import type { App } from "../common/app";
 import type { CodeQLCliServer } from "../codeql-cli/cli";
-import { pathExists, ensureDir } from "fs-extra";
+import { pathExists, ensureDir, readdir, move, remove } from "fs-extra";
 import { withProgress, progressUpdate } from "../common/vscode/progress";
 import type { ProgressCallback } from "../common/vscode/progress";
 import { join, dirname, parse } from "path";
@@ -20,6 +20,9 @@ import { window as Window } from "vscode";
 import { pluralize } from "../common/word";
 import { glob } from "glob";
 import { readRepoTask } from "./repo-tasks-store";
+import { unlink, mkdtemp } from "fs/promises";
+import { tmpdir } from "os";
+import { spawn } from "child_process";
 
 // Limit to three repos when generating autofixes so not sending
 // too many requests to autofix. Since we only need to validate
@@ -297,6 +300,18 @@ async function processSelectedRepositories(
           if (!repoTask.resultCount) {
             throw new Error(`Missing variant analysis result count for ${nwo}`);
           }
+
+          // Download the source root.
+          // Using `0` as the progress step to force a dynamic vs static progress bar.
+          // Consider using `reportStreamProgress` as a future enhancement.
+          progressForRepo(progressUpdate(0, 3, `Downloading source root`));
+          const srcRootPath = await downloadPublicCommitSource(
+            nwo,
+            repoTask.databaseCommitSha,
+            sourceRootsStoragePath,
+            credentials,
+            logger,
+          );
         },
         {
           title: `Processing ${nwo}`,
@@ -327,3 +342,117 @@ async function getSarifFile(
   }
   return sarifFiles[0];
 }
+
+/**
+ * Downloads the source code of a public commit from a GitHub repository.
+ */
+async function downloadPublicCommitSource(
+  nwo: string,
+  sha: string,
+  outputPath: string,
+  credentials: Credentials,
+  logger: NotificationLogger,
+): Promise<string> {
+  const [owner, repo] = nwo.split("/");
+  if (!owner || !repo) {
+    throw new Error(`Invalid repository name: ${nwo}`);
+  }
+
+  // Create output directory if it doesn't exist
+  await ensureDir(outputPath);
+
+  // Define the final checkout directory
+  const checkoutDir = join(
+    outputPath,
+    `${owner}-${repo}-${sha.substring(0, 7)}`,
+  );
+
+  // Check if directory already exists to avoid re-downloading
+  if (await pathExists(checkoutDir)) {
+    void logger.log(
+      `Source for ${nwo} at ${sha} already exists at ${checkoutDir}.`,
+    );
+    return checkoutDir;
+  }
+
+  void logger.log(`Fetching source of repository ${nwo} at ${sha}...`);
+
+  try {
+    // Create a temporary directory for downloading
+    const downloadDir = await mkdtemp(join(tmpdir(), "download-source-"));
+    const tarballPath = join(downloadDir, "source.tar.gz");
+
+    const octokit = await credentials.getOctokit();
+
+    // Get the tarball URL
+    const { url } = await octokit.rest.repos.downloadTarballArchive({
+      owner,
+      repo,
+      ref: sha,
+    });
+
+    // Download the tarball using spawn
+    await new Promise<void>((resolve, reject) => {
+      const curlArgs = [
+        "-H",
+        "Accept: application/octet-stream",
+        "--user-agent",
+        "GitHub-CodeQL-Extension",
+        "-L", // Follow redirects
+        "-o",
+        tarballPath,
+        url,
+      ];
+
+      const process = spawn("curl", curlArgs, { cwd: downloadDir });
+
+      process.on("error", reject);
+      process.on("exit", (code) =>
+        code === 0
+          ? resolve()
+          : reject(new Error(`curl exited with code ${code}`)),
+      );
+    });
+
+    void logger.log(`Download complete, extracting source...`);
+
+    // Extract the tarball
+    await new Promise<void>((resolve, reject) => {
+      const process = spawn("tar", ["-xzf", tarballPath], { cwd: downloadDir });
+
+      process.on("error", reject);
+      process.on("exit", (code) =>
+        code === 0
+          ? resolve()
+          : reject(new Error(`tar extraction failed with code ${code}`)),
+      );
+    });
+
+    // Remove the tarball to save space
+    await unlink(tarballPath);
+
+    // Find the extracted directory (GitHub tarballs extract to a single directory)
+    const extractedFiles = await readdir(downloadDir);
+    const sourceDir = extractedFiles.filter((f) => f !== "source.tar.gz")[0];
+
+    if (!sourceDir) {
+      throw new Error("Failed to find extracted source directory");
+    }
+
+    const extractedSourcePath = join(downloadDir, sourceDir);
+
+    // Ensure the destination directory's parent exists
+    await ensureDir(dirname(checkoutDir));
+
+    // Move the extracted source to the final location
+    await move(extractedSourcePath, checkoutDir);
+
+    // Clean up the temporary directory
+    await remove(downloadDir);
+
+    return checkoutDir;
+  } catch (error) {
+    const errorMessage = error instanceof Error ? error.message : String(error);
+    throw new Error(`Failed to download ${nwo} at ${sha}: ${errorMessage}`);
+  }
+}

From 05c398fa6afba0681693ee831a919fd1feb5cf3e Mon Sep 17 00:00:00 2001
From: Jami Cogswell <jcogs33@Jamis-MacBook-Pro.local>
Date: Sat, 28 Jun 2025 19:50:35 +0000
Subject: [PATCH 12/38] Add function for running autofix on a given repo

---
 .../src/variant-analysis/view-autofixes.ts    | 29 +++++++++++++++++++
 1 file changed, 29 insertions(+)

diff --git a/extensions/ql-vscode/src/variant-analysis/view-autofixes.ts b/extensions/ql-vscode/src/variant-analysis/view-autofixes.ts
index 1b2b0e76fcd..db8edd64084 100644
--- a/extensions/ql-vscode/src/variant-analysis/view-autofixes.ts
+++ b/extensions/ql-vscode/src/variant-analysis/view-autofixes.ts
@@ -312,6 +312,19 @@ async function processSelectedRepositories(
             credentials,
             logger,
           );
+
+          // Run autofix.
+          progressForRepo(progressUpdate(2, 3, `Running autofix`));
+          await runAutofixForRepository(
+            nwo,
+            sarifFile,
+            srcRootPath,
+            localAutofixPath,
+            autofixOutputStoragePath,
+            repoTask.resultCount,
+            logger,
+            outputTextFiles,
+          );
         },
         {
           title: `Processing ${nwo}`,
@@ -456,3 +469,19 @@ async function downloadPublicCommitSource(
     throw new Error(`Failed to download ${nwo} at ${sha}: ${errorMessage}`);
   }
 }
+
+/**
+ * Runs autofix for a given repository (nwo).
+ */
+async function runAutofixForRepository(
+  nwo: string,
+  sarifFile: string,
+  srcRootPath: string,
+  localAutofixPath: string,
+  autofixOutputStoragePath: string,
+  resultCount: number,
+  logger: NotificationLogger,
+  outputTextFiles: string[],
+): Promise<void> {
+  // TODO
+}

From 4d5437f587cc7e2edce712510178d70931094691 Mon Sep 17 00:00:00 2001
From: Jami Cogswell <jcogs33@Jamis-MacBook-Pro.local>
Date: Sat, 28 Jun 2025 19:55:49 +0000
Subject: [PATCH 13/38] Get storage paths for repository-specific autofix
 output

---
 .../src/variant-analysis/view-autofixes.ts    | 32 ++++++++++++++++++-
 1 file changed, 31 insertions(+), 1 deletion(-)

diff --git a/extensions/ql-vscode/src/variant-analysis/view-autofixes.ts b/extensions/ql-vscode/src/variant-analysis/view-autofixes.ts
index db8edd64084..8f713c4f4c7 100644
--- a/extensions/ql-vscode/src/variant-analysis/view-autofixes.ts
+++ b/extensions/ql-vscode/src/variant-analysis/view-autofixes.ts
@@ -483,5 +483,35 @@ async function runAutofixForRepository(
   logger: NotificationLogger,
   outputTextFiles: string[],
 ): Promise<void> {
-  // TODO
+  // Get storage paths for the autofix results for this repository.
+  const {
+    repoAutofixOutputStoragePath,
+    outputTextFilePath,
+    transcriptFilePath,
+    fixDescriptionFilePath,
+  } = await getRepoStoragePaths(autofixOutputStoragePath, nwo);
+}
+
+/**
+ * Gets the storage paths for the autofix results for a given repository.
+ */
+async function getRepoStoragePaths(
+  autofixOutputStoragePath: string,
+  nwo: string,
+) {
+  // Create output directories for repo's autofix results.
+  const repoAutofixOutputStoragePath = join(
+    autofixOutputStoragePath,
+    nwo.replaceAll("/", "-"),
+  );
+  await ensureDir(repoAutofixOutputStoragePath);
+  return {
+    repoAutofixOutputStoragePath,
+    outputTextFilePath: join(repoAutofixOutputStoragePath, "output.txt"),
+    transcriptFilePath: join(repoAutofixOutputStoragePath, "transcript.md"),
+    fixDescriptionFilePath: join(
+      repoAutofixOutputStoragePath,
+      "fix-description.md",
+    ),
+  };
 }

From 5dfaf3f13cde046844f89014c1c80c8d76247bf2 Mon Sep 17 00:00:00 2001
From: Jami Cogswell <jcogs33@Jamis-MacBook-Pro.local>
Date: Sat, 28 Jun 2025 20:10:06 +0000
Subject: [PATCH 14/38] Set up to run autofix on repo results

---
 .../src/variant-analysis/view-autofixes.ts    | 27 +++++++++++++++++++
 1 file changed, 27 insertions(+)

diff --git a/extensions/ql-vscode/src/variant-analysis/view-autofixes.ts b/extensions/ql-vscode/src/variant-analysis/view-autofixes.ts
index 8f713c4f4c7..b1274c85da7 100644
--- a/extensions/ql-vscode/src/variant-analysis/view-autofixes.ts
+++ b/extensions/ql-vscode/src/variant-analysis/view-autofixes.ts
@@ -29,6 +29,8 @@ import { spawn } from "child_process";
 // a handle of autofixes for each query, this should be sufficient.
 // Consider increasing this in the future if needed.
 const MAX_NUM_REPOS: number = 3;
+// Similarly, limit to three fixes per repo.
+const MAX_NUM_FIXES: number = 3;
 
 /**
  * Generates autofixes for the results of a variant analysis.
@@ -490,6 +492,31 @@ async function runAutofixForRepository(
     transcriptFilePath,
     fixDescriptionFilePath,
   } = await getRepoStoragePaths(autofixOutputStoragePath, nwo);
+
+  // Get autofix binary.
+  // Switch to Go binary in the future and have user pass full path
+  // in an environment variable instead of hardcoding part here.
+  const cocofixBin = join(process.cwd(), localAutofixPath, "bin", "cocofix.js");
+
+  // Limit number of fixes generated.
+  const limitFixesBoolean: boolean = resultCount > MAX_NUM_FIXES;
+  if (limitFixesBoolean) {
+    void Window.showInformationMessage(
+      `Only generating autofixes for the first ${MAX_NUM_FIXES} alerts for ${nwo}.`,
+    );
+
+    // Run autofix in a loop for the first MAX_NUM_FIXES alerts.
+    // Not an ideal solution, but avoids modifying the input SARIF file.
+    for (let i = 0; i < MAX_NUM_FIXES; i++) {
+      // TODO: run autofix for the i-th alert.
+    }
+  } else {
+    // TODO: run autofix once for all alerts.
+  }
+
+  // Save output text files from each repo to later merge
+  // into a single markdown file containing all results.
+  outputTextFiles.push(outputTextFilePath);
 }
 
 /**

From 03585af99e509c0897debc7ac20ca3c5d33f312b Mon Sep 17 00:00:00 2001
From: Jami Cogswell <jcogs33@Jamis-MacBook-Pro.local>
Date: Sat, 28 Jun 2025 20:13:08 +0000
Subject: [PATCH 15/38] Add function for setting variable autofix args

---
 .../src/variant-analysis/view-autofixes.ts    | 26 +++++++++++++++++++
 1 file changed, 26 insertions(+)

diff --git a/extensions/ql-vscode/src/variant-analysis/view-autofixes.ts b/extensions/ql-vscode/src/variant-analysis/view-autofixes.ts
index b1274c85da7..6492baf6c48 100644
--- a/extensions/ql-vscode/src/variant-analysis/view-autofixes.ts
+++ b/extensions/ql-vscode/src/variant-analysis/view-autofixes.ts
@@ -542,3 +542,29 @@ async function getRepoStoragePaths(
     ),
   };
 }
+
+/**
+ * Creates autofix arguments that vary depending on the run.
+ */
+function createVarAutofixArgs(
+  outputTextFilePath: string,
+  fixDescriptionFilePath: string,
+  transcriptFilePath: string,
+  alertNumber?: number, // Optional parameter for specific alert
+): string[] {
+  const args = [
+    "--output",
+    outputTextFilePath,
+    "--fix-description",
+    fixDescriptionFilePath,
+    "--transcript",
+    transcriptFilePath,
+  ];
+
+  // Add alert number argument if provided
+  if (alertNumber !== undefined) {
+    args.push("--only-alert-number", alertNumber.toString());
+  }
+
+  return args;
+}

From 19400a9707542218c68a1696d44ff20c86f5dc6b Mon Sep 17 00:00:00 2001
From: Jami Cogswell <jcogs33@Jamis-MacBook-Pro.local>
Date: Sat, 28 Jun 2025 20:15:03 +0000
Subject: [PATCH 16/38] Add function for executing autofix

---
 .../src/variant-analysis/view-autofixes.ts    | 31 +++++++++++++++++++
 1 file changed, 31 insertions(+)

diff --git a/extensions/ql-vscode/src/variant-analysis/view-autofixes.ts b/extensions/ql-vscode/src/variant-analysis/view-autofixes.ts
index 6492baf6c48..c8531109c2a 100644
--- a/extensions/ql-vscode/src/variant-analysis/view-autofixes.ts
+++ b/extensions/ql-vscode/src/variant-analysis/view-autofixes.ts
@@ -23,6 +23,7 @@ import { readRepoTask } from "./repo-tasks-store";
 import { unlink, mkdtemp } from "fs/promises";
 import { tmpdir } from "os";
 import { spawn } from "child_process";
+import type { execFileSync } from "child_process";
 
 // Limit to three repos when generating autofixes so not sending
 // too many requests to autofix. Since we only need to validate
@@ -568,3 +569,33 @@ function createVarAutofixArgs(
 
   return args;
 }
+
+/**
+ * Executes the autofix command.
+ */
+function execAutofix(
+  logger: NotificationLogger,
+  bin: string,
+  args: string[],
+  options: Parameters<typeof execFileSync>[2],
+  showCommand?: boolean,
+): Promise<void> {
+  return new Promise((resolve, reject) => {
+    try {
+      const cwd = options?.cwd || process.cwd();
+      if (showCommand) {
+        void logger.log(`Spawning '${bin} ${args.join(" ")}' in ${cwd}`);
+      }
+      if (args.some((a) => a === undefined || a === "")) {
+        throw new Error(
+          `Invalid empty or undefined arguments: ${args.join(" ")}`,
+        );
+      }
+      const p = spawn(bin, args, { stdio: [0, 1, 2], ...options });
+      p.on("error", reject);
+      p.on("exit", (code) => (code === 0 ? resolve() : reject(code)));
+    } catch (e) {
+      reject(e);
+    }
+  });
+}

From 3c7d9ca6ac755fec7b1b3f9de3949128cdf9202c Mon Sep 17 00:00:00 2001
From: Jami Cogswell <jcogs33@Jamis-MacBook-Pro.local>
Date: Sat, 28 Jun 2025 20:19:55 +0000
Subject: [PATCH 17/38] Add function for running autofix on a given SARIF

---
 .../src/variant-analysis/view-autofixes.ts    | 53 +++++++++++++++++++
 1 file changed, 53 insertions(+)

diff --git a/extensions/ql-vscode/src/variant-analysis/view-autofixes.ts b/extensions/ql-vscode/src/variant-analysis/view-autofixes.ts
index c8531109c2a..517f3e73578 100644
--- a/extensions/ql-vscode/src/variant-analysis/view-autofixes.ts
+++ b/extensions/ql-vscode/src/variant-analysis/view-autofixes.ts
@@ -544,6 +544,59 @@ async function getRepoStoragePaths(
   };
 }
 
+/**
+ * Runs autofix on the results in the given SARIF file.
+ */
+async function runAutofixOnResults(
+  logger: NotificationLogger,
+  cocofixBin: string,
+  sarifFile: string,
+  srcRootPath: string,
+  outputTextFilePath: string,
+  fixDescriptionFilePath: string,
+  transcriptFilePath: string,
+  workDir: string,
+  alertNumber?: number, // Optional parameter for specific alert
+): Promise<void> {
+  // Set up args for autofix command.
+  const fixedAutofixArgs = [
+    "--sarif",
+    sarifFile,
+    "--source-root",
+    srcRootPath,
+    "--model",
+    "capi-dev-4o", // may fail with older versions of cocofix
+    "--dev",
+    "--no-cache",
+    "--format",
+    "text",
+    "--diff-style",
+    "diff", // could do "text" instead if want line of "=" between fixes
+  ];
+  const varAutofixArgs = createVarAutofixArgs(
+    outputTextFilePath,
+    fixDescriptionFilePath,
+    transcriptFilePath,
+    alertNumber,
+  );
+
+  const autofixArgs = [...fixedAutofixArgs, ...varAutofixArgs];
+
+  await execAutofix(
+    logger,
+    cocofixBin,
+    autofixArgs,
+    {
+      cwd: workDir,
+      env: {
+        CAPI_DEV_KEY: process.env.CAPI_DEV_KEY,
+        PATH: process.env.PATH,
+      },
+    },
+    true,
+  );
+}
+
 /**
  * Creates autofix arguments that vary depending on the run.
  */

From 74e8277b3b5885ec6813290369ef876ed5be0b92 Mon Sep 17 00:00:00 2001
From: Jami Cogswell <jcogs33@Jamis-MacBook-Pro.local>
Date: Sat, 28 Jun 2025 20:23:07 +0000
Subject: [PATCH 18/38] Run autofix for case when the repo result count does
 not exceed the fix limit

---
 .../ql-vscode/src/variant-analysis/view-autofixes.ts | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/extensions/ql-vscode/src/variant-analysis/view-autofixes.ts b/extensions/ql-vscode/src/variant-analysis/view-autofixes.ts
index 517f3e73578..199ba298e0b 100644
--- a/extensions/ql-vscode/src/variant-analysis/view-autofixes.ts
+++ b/extensions/ql-vscode/src/variant-analysis/view-autofixes.ts
@@ -512,7 +512,17 @@ async function runAutofixForRepository(
       // TODO: run autofix for the i-th alert.
     }
   } else {
-    // TODO: run autofix once for all alerts.
+    // Run autofix once for all alerts.
+    await runAutofixOnResults(
+      logger,
+      cocofixBin,
+      sarifFile,
+      srcRootPath,
+      outputTextFilePath,
+      fixDescriptionFilePath,
+      transcriptFilePath,
+      repoAutofixOutputStoragePath,
+    );
   }
 
   // Save output text files from each repo to later merge

From e7076f9eb11cfcbc7a9287177c58105cc7a4d6eb Mon Sep 17 00:00:00 2001
From: Jami Cogswell <jcogs33@Jamis-MacBook-Pro.local>
Date: Sat, 28 Jun 2025 20:27:45 +0000
Subject: [PATCH 19/38] Add function that appends a suffix to a given file path

This function will increment file numbers when running autofix in a loop
---
 .../ql-vscode/src/variant-analysis/view-autofixes.ts  | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/extensions/ql-vscode/src/variant-analysis/view-autofixes.ts b/extensions/ql-vscode/src/variant-analysis/view-autofixes.ts
index 199ba298e0b..4d912e7f705 100644
--- a/extensions/ql-vscode/src/variant-analysis/view-autofixes.ts
+++ b/extensions/ql-vscode/src/variant-analysis/view-autofixes.ts
@@ -662,3 +662,14 @@ function execAutofix(
     }
   });
 }
+
+/**
+ * Creates a new file path by appending the given suffix.
+ * @param filePath The original file path.
+ * @param suffix The suffix to append to the file name (before the extension).
+ * @returns The new file path with the suffix appended.
+ */
+function appendSuffixToFilePath(filePath: string, suffix: string): string {
+  const { dir, name, ext } = parse(filePath);
+  return join(dir, `${name}-${suffix}${ext}`);
+}

From e04eb622faec3853d8fac3f9c0d3eb753ffd8ed0 Mon Sep 17 00:00:00 2001
From: Jami Cogswell <jcogs33@Jamis-MacBook-Pro.local>
Date: Sun, 29 Jun 2025 00:13:24 +0000
Subject: [PATCH 20/38] Run autofix for case when the repo result count exceeds
 the fix limit

---
 .../src/variant-analysis/view-autofixes.ts    | 81 ++++++++++++++++++-
 1 file changed, 79 insertions(+), 2 deletions(-)

diff --git a/extensions/ql-vscode/src/variant-analysis/view-autofixes.ts b/extensions/ql-vscode/src/variant-analysis/view-autofixes.ts
index 4d912e7f705..96451784f60 100644
--- a/extensions/ql-vscode/src/variant-analysis/view-autofixes.ts
+++ b/extensions/ql-vscode/src/variant-analysis/view-autofixes.ts
@@ -20,7 +20,7 @@ import { window as Window } from "vscode";
 import { pluralize } from "../common/word";
 import { glob } from "glob";
 import { readRepoTask } from "./repo-tasks-store";
-import { unlink, mkdtemp } from "fs/promises";
+import { unlink, mkdtemp, readFile, writeFile } from "fs/promises";
 import { tmpdir } from "os";
 import { spawn } from "child_process";
 import type { execFileSync } from "child_process";
@@ -508,9 +508,45 @@ async function runAutofixForRepository(
 
     // Run autofix in a loop for the first MAX_NUM_FIXES alerts.
     // Not an ideal solution, but avoids modifying the input SARIF file.
+    const tempOutputTextFiles: string[] = [];
+    const fixDescriptionFiles: string[] = [];
+    const transcriptFiles: string[] = [];
     for (let i = 0; i < MAX_NUM_FIXES; i++) {
-      // TODO: run autofix for the i-th alert.
+      const tempOutputTextFilePath = appendSuffixToFilePath(
+        outputTextFilePath,
+        i.toString(),
+      );
+      const tempFixDescriptionFilePath = appendSuffixToFilePath(
+        fixDescriptionFilePath,
+        i.toString(),
+      );
+      const tempTranscriptFilePath = appendSuffixToFilePath(
+        transcriptFilePath,
+        i.toString(),
+      );
+
+      tempOutputTextFiles.push(tempOutputTextFilePath);
+      fixDescriptionFiles.push(tempFixDescriptionFilePath);
+      transcriptFiles.push(tempTranscriptFilePath);
+
+      await runAutofixOnResults(
+        logger,
+        cocofixBin,
+        sarifFile,
+        srcRootPath,
+        tempOutputTextFilePath,
+        tempFixDescriptionFilePath,
+        tempTranscriptFilePath,
+        repoAutofixOutputStoragePath,
+        i,
+      );
     }
+
+    // Merge the output files together.
+    // Caveat that autofix will call each alert "alert 0", which will look a bit odd in the merged output file.
+    await mergeFiles(tempOutputTextFiles, outputTextFilePath);
+    await mergeFiles(fixDescriptionFiles, fixDescriptionFilePath);
+    await mergeFiles(transcriptFiles, transcriptFilePath);
   } else {
     // Run autofix once for all alerts.
     await runAutofixOnResults(
@@ -673,3 +709,44 @@ function appendSuffixToFilePath(filePath: string, suffix: string): string {
   const { dir, name, ext } = parse(filePath);
   return join(dir, `${name}-${suffix}${ext}`);
 }
+
+/**
+ * Merges the given `inputFiles` into a single `outputFile`.
+ * @param inputFiles - The list of input files to merge.
+ * @param outputFile - The output file path.
+ * @param deleteOriginalFiles - Whether to delete the original input files after merging.
+ */
+async function mergeFiles(
+  inputFiles: string[],
+  outputFile: string,
+  deleteOriginalFiles: boolean = true,
+): Promise<void> {
+  try {
+    // Check if any input files do not exist and return if so.
+    const pathChecks = await Promise.all(
+      inputFiles.map(async (path) => ({
+        exists: await pathExists(path),
+      })),
+    );
+    const anyPathMissing = pathChecks.some((check) => !check.exists);
+    if (inputFiles.length === 0 || anyPathMissing) {
+      return;
+    }
+
+    // Merge the files
+    const contents = await Promise.all(
+      inputFiles.map((file) => readFile(file, "utf8")),
+    );
+
+    // Write merged content
+    await writeFile(outputFile, contents.join("\n"));
+
+    // Delete original files
+    if (deleteOriginalFiles) {
+      await Promise.all(inputFiles.map((file) => unlink(file)));
+    }
+  } catch (error) {
+    console.error("Error merging files:", error);
+    throw error;
+  }
+}

From 2c12d71dc2f7e50f0a2437837e890b94930842ab Mon Sep 17 00:00:00 2001
From: Jami Cogswell <jcogs33@Jamis-MacBook-Pro.local>
Date: Sun, 29 Jun 2025 00:37:19 +0000
Subject: [PATCH 21/38] Add markdown formatting to autofix output

---
 .../src/variant-analysis/view-autofixes.ts    | 39 +++++++++++++++++++
 1 file changed, 39 insertions(+)

diff --git a/extensions/ql-vscode/src/variant-analysis/view-autofixes.ts b/extensions/ql-vscode/src/variant-analysis/view-autofixes.ts
index 96451784f60..0ad31d9f565 100644
--- a/extensions/ql-vscode/src/variant-analysis/view-autofixes.ts
+++ b/extensions/ql-vscode/src/variant-analysis/view-autofixes.ts
@@ -561,6 +561,9 @@ async function runAutofixForRepository(
     );
   }
 
+  // Format the output text file with markdown.
+  await formatWithMarkdown(outputTextFilePath, `${nwo}`);
+
   // Save output text files from each repo to later merge
   // into a single markdown file containing all results.
   outputTextFiles.push(outputTextFilePath);
@@ -750,3 +753,39 @@ async function mergeFiles(
     throw error;
   }
 }
+
+/**
+ * Formats the given input file with the specified header.
+ * @param inputFile The path to the input file to format.
+ * @param header The header to include in the formatted output.
+ */
+async function formatWithMarkdown(
+  inputFile: string,
+  header: string,
+): Promise<void> {
+  try {
+    // Check if the input file exists
+    const exists = await pathExists(inputFile);
+    if (!exists) {
+      return;
+    }
+
+    // Read the input file content
+    const content = await readFile(inputFile, "utf8");
+
+    const frontFormatting: string =
+      "<details><summary>Fix suggestion details</summary>\n\n```diff\n";
+
+    const backFormatting: string =
+      "```\n\n</details>\n\n ### Notes\n - notes placeholder\n\n";
+
+    // Format the content with Markdown
+    const formattedContent = `## ${header}\n\n${frontFormatting}${content}${backFormatting}`;
+
+    // Write the formatted content back to the file
+    await writeFile(inputFile, formattedContent);
+  } catch (error) {
+    console.error("Error formatting file:", error);
+    throw error;
+  }
+}

From 6b47932e8208da44e7e3b9754ba21fc8e5509657 Mon Sep 17 00:00:00 2001
From: Jami Cogswell <jcogs33@Jamis-MacBook-Pro.local>
Date: Sun, 29 Jun 2025 00:43:17 +0000
Subject: [PATCH 22/38] Combine and output final autofix results

---
 .../ql-vscode/src/variant-analysis/view-autofixes.ts | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/extensions/ql-vscode/src/variant-analysis/view-autofixes.ts b/extensions/ql-vscode/src/variant-analysis/view-autofixes.ts
index 0ad31d9f565..56affe6add8 100644
--- a/extensions/ql-vscode/src/variant-analysis/view-autofixes.ts
+++ b/extensions/ql-vscode/src/variant-analysis/view-autofixes.ts
@@ -24,6 +24,7 @@ import { unlink, mkdtemp, readFile, writeFile } from "fs/promises";
 import { tmpdir } from "os";
 import { spawn } from "child_process";
 import type { execFileSync } from "child_process";
+import { tryOpenExternalFile } from "../common/vscode/external-files";
 
 // Limit to three repos when generating autofixes so not sending
 // too many requests to autofix. Since we only need to validate
@@ -96,7 +97,16 @@ export async function viewAutofixesForVariantAnalysisResults(
         logger,
       );
 
-      // TODO
+      // Output results from all repos to a combined markdown file.
+      progress(progressUpdate(4, 4, `Finalizing autofix results`));
+      const combinedOutputMarkdownFile = join(
+        autofixOutputStoragePath,
+        "autofix-output.md",
+      );
+      await mergeFiles(outputTextFiles, combinedOutputMarkdownFile, false);
+
+      // Open the combined markdown file.
+      await tryOpenExternalFile(app.commands, combinedOutputMarkdownFile);
     },
     {
       title: "Generating Autofixes",

From 3ff5d64f2cf303f23902a6341cc94a992ae8391d Mon Sep 17 00:00:00 2001
From: Jami Cogswell <jcogs33@Jamis-MacBook-Pro.local>
Date: Sun, 29 Jun 2025 02:07:01 +0000
Subject: [PATCH 23/38] Add canary

---
 extensions/ql-vscode/package.json             |  2 +-
 .../ql-vscode/src/common/interface-types.ts   |  6 ++-
 .../ql-vscode/src/compare/compare-view.ts     |  2 +
 .../src/local-queries/results-view.ts         |  2 +
 .../stories/results/AlertTable.stories.tsx    |  1 +
 .../variant-analysis/variant-analysis-view.ts | 39 ++++++++++++++++++-
 .../__tests__/AlertTablePathRow.spec.tsx      |  5 ++-
 .../__tests__/AlertTableResultRow.spec.tsx    |  5 ++-
 .../view/variant-analysis/VariantAnalysis.tsx | 12 +++++-
 .../VariantAnalysisActions.tsx                | 32 ++++++++-------
 .../VariantAnalysisHeader.tsx                 |  5 +++
 .../__tests__/VariantAnalysisActions.spec.tsx |  4 ++
 12 files changed, 96 insertions(+), 19 deletions(-)

diff --git a/extensions/ql-vscode/package.json b/extensions/ql-vscode/package.json
index 32c6d419d08..a3497c557f5 100644
--- a/extensions/ql-vscode/package.json
+++ b/extensions/ql-vscode/package.json
@@ -1303,7 +1303,7 @@
         {
           "command": "codeQLQueryHistory.viewAutofixes",
           "group": "1_queryHistory@2",
-          "when": "viewItem == remoteResultsItem"
+          "when": "viewItem == remoteResultsItem && config.codeQL.canary"
         },
         {
           "command": "codeQLQueries.runLocalQueryFromQueriesPanel",
diff --git a/extensions/ql-vscode/src/common/interface-types.ts b/extensions/ql-vscode/src/common/interface-types.ts
index 3d23df070ef..08bf9e7baf2 100644
--- a/extensions/ql-vscode/src/common/interface-types.ts
+++ b/extensions/ql-vscode/src/common/interface-types.ts
@@ -151,10 +151,13 @@ interface SetStateMsg {
 export interface UserSettings {
   /** Whether to display links to the dataflow models that generated particular nodes in a flow path. */
   shouldShowProvenance: boolean;
+  /** Whether to display the "View Autofixes" button. */
+  shouldShowViewAutofixesBtn: boolean;
 }
 
 export const DEFAULT_USER_SETTINGS: UserSettings = {
   shouldShowProvenance: false,
+  shouldShowViewAutofixesBtn: false,
 };
 
 /** Message indicating that the user's configuration settings have changed. */
@@ -559,7 +562,8 @@ export type ToVariantAnalysisMessage =
   | SetVariantAnalysisMessage
   | SetFilterSortStateMessage
   | SetRepoResultsMessage
-  | SetRepoStatesMessage;
+  | SetRepoStatesMessage
+  | SetUserSettingsMsg;
 
 export type FromVariantAnalysisMessage =
   | CommonFromViewMessages
diff --git a/extensions/ql-vscode/src/compare/compare-view.ts b/extensions/ql-vscode/src/compare/compare-view.ts
index 93538f52e6b..5a739bf6803 100644
--- a/extensions/ql-vscode/src/compare/compare-view.ts
+++ b/extensions/ql-vscode/src/compare/compare-view.ts
@@ -119,6 +119,8 @@ export class CompareView extends AbstractWebview<
       t: "setUserSettings",
       userSettings: {
         shouldShowProvenance: isCanary(),
+        // "View Autofixes" button is not supported in compare view
+        shouldShowViewAutofixesBtn: false,
       },
     });
 
diff --git a/extensions/ql-vscode/src/local-queries/results-view.ts b/extensions/ql-vscode/src/local-queries/results-view.ts
index 00eae1138aa..f68c3116452 100644
--- a/extensions/ql-vscode/src/local-queries/results-view.ts
+++ b/extensions/ql-vscode/src/local-queries/results-view.ts
@@ -550,6 +550,8 @@ export class ResultsView extends AbstractWebview<
       userSettings: {
         // Only show provenance info in canary mode for now.
         shouldShowProvenance: isCanary(),
+        // "View Autofixes" button is not supported in results view
+        shouldShowViewAutofixesBtn: false,
       },
     });
 
diff --git a/extensions/ql-vscode/src/stories/results/AlertTable.stories.tsx b/extensions/ql-vscode/src/stories/results/AlertTable.stories.tsx
index d2cc19f3916..4f36ea36c8b 100644
--- a/extensions/ql-vscode/src/stories/results/AlertTable.stories.tsx
+++ b/extensions/ql-vscode/src/stories/results/AlertTable.stories.tsx
@@ -433,5 +433,6 @@ WithCodeFlows.args = {
   ),
   userSettings: {
     shouldShowProvenance: true,
+    shouldShowViewAutofixesBtn: false, // Not supported in AlertTable
   },
 };
diff --git a/extensions/ql-vscode/src/variant-analysis/variant-analysis-view.ts b/extensions/ql-vscode/src/variant-analysis/variant-analysis-view.ts
index 0656a0e3a0e..8c975130045 100644
--- a/extensions/ql-vscode/src/variant-analysis/variant-analysis-view.ts
+++ b/extensions/ql-vscode/src/variant-analysis/variant-analysis-view.ts
@@ -1,4 +1,5 @@
-import { ViewColumn } from "vscode";
+import type { ConfigurationChangeEvent } from "vscode";
+import { ViewColumn, workspace } from "vscode";
 import type { WebviewPanelConfig } from "../common/vscode/abstract-webview";
 import { AbstractWebview } from "../common/vscode/abstract-webview";
 import {
@@ -27,6 +28,7 @@ import type { App } from "../common/app";
 import {
   getVariantAnalysisDefaultResultsFilter,
   getVariantAnalysisDefaultResultsSort,
+  isCanary,
 } from "../config";
 
 export class VariantAnalysisView
@@ -46,6 +48,39 @@ export class VariantAnalysisView
     manager.registerView(this);
 
     this.dataFlowPathsView = new DataFlowPathsView(app);
+
+    // Set up configuration change listener
+    this.push(
+      workspace.onDidChangeConfiguration(
+        this.onConfigurationChanged.bind(this),
+      ),
+    );
+  }
+
+  /**
+   * Handler for configuration changes
+   */
+  private onConfigurationChanged(e: ConfigurationChangeEvent): void {
+    // Check if the canary setting has changed
+    if (e.affectsConfiguration("codeQL.canary")) {
+      void this.updateUserSettings();
+    }
+  }
+
+  private async updateUserSettings(): Promise<void> {
+    if (!this.isShowingPanel) {
+      return;
+    }
+
+    await this.postMessage({
+      t: "setUserSettings",
+      userSettings: {
+        // Provenance is not supported in variant analysis view
+        shouldShowProvenance: false,
+        // Only show "View Autofixes" button in canary mode.
+        shouldShowViewAutofixesBtn: isCanary(),
+      },
+    });
   }
 
   public async openView() {
@@ -53,6 +88,8 @@ export class VariantAnalysisView
     panel.reveal(undefined, true);
 
     await this.waitForPanelLoaded();
+
+    await this.updateUserSettings();
   }
 
   public async updateView(variantAnalysis: VariantAnalysis): Promise<void> {
diff --git a/extensions/ql-vscode/src/view/results/__tests__/AlertTablePathRow.spec.tsx b/extensions/ql-vscode/src/view/results/__tests__/AlertTablePathRow.spec.tsx
index ada710bee85..6d64880bf8a 100644
--- a/extensions/ql-vscode/src/view/results/__tests__/AlertTablePathRow.spec.tsx
+++ b/extensions/ql-vscode/src/view/results/__tests__/AlertTablePathRow.spec.tsx
@@ -22,7 +22,10 @@ describe(AlertTablePathRow.name, () => {
         currentPathExpanded={true}
         databaseUri={"dbUri"}
         sourceLocationPrefix="src"
-        userSettings={{ shouldShowProvenance: false }}
+        userSettings={{
+          shouldShowProvenance: false,
+          shouldShowViewAutofixesBtn: false,
+        }}
         updateSelectionCallback={jest.fn()}
         toggleExpanded={jest.fn()}
         {...props}
diff --git a/extensions/ql-vscode/src/view/results/__tests__/AlertTableResultRow.spec.tsx b/extensions/ql-vscode/src/view/results/__tests__/AlertTableResultRow.spec.tsx
index 0aa7279ae72..216a0899897 100644
--- a/extensions/ql-vscode/src/view/results/__tests__/AlertTableResultRow.spec.tsx
+++ b/extensions/ql-vscode/src/view/results/__tests__/AlertTableResultRow.spec.tsx
@@ -17,7 +17,10 @@ describe(AlertTableResultRow.name, () => {
         selectedItemRef={mockRef}
         databaseUri={"dbUri"}
         sourceLocationPrefix="src"
-        userSettings={{ shouldShowProvenance: false }}
+        userSettings={{
+          shouldShowProvenance: false,
+          shouldShowViewAutofixesBtn: false,
+        }}
         updateSelectionCallback={jest.fn()}
         toggleExpanded={jest.fn()}
         {...props}
diff --git a/extensions/ql-vscode/src/view/variant-analysis/VariantAnalysis.tsx b/extensions/ql-vscode/src/view/variant-analysis/VariantAnalysis.tsx
index 524dbd57fed..b5f05cc2296 100644
--- a/extensions/ql-vscode/src/view/variant-analysis/VariantAnalysis.tsx
+++ b/extensions/ql-vscode/src/view/variant-analysis/VariantAnalysis.tsx
@@ -9,11 +9,15 @@ import { VariantAnalysisStatus } from "../../variant-analysis/shared/variant-ana
 import { VariantAnalysisHeader } from "./VariantAnalysisHeader";
 import { VariantAnalysisOutcomePanels } from "./VariantAnalysisOutcomePanels";
 import { VariantAnalysisLoading } from "./VariantAnalysisLoading";
-import type { ToVariantAnalysisMessage } from "../../common/interface-types";
+import type {
+  ToVariantAnalysisMessage,
+  UserSettings,
+} from "../../common/interface-types";
 import { vscode } from "../vscode-api";
 import { defaultFilterSortState } from "../../variant-analysis/shared/variant-analysis-filter-sort";
 import { sendTelemetry, useTelemetryOnChange } from "../common/telemetry";
 import { useMessageFromExtension } from "../common/useMessageFromExtension";
+import { DEFAULT_USER_SETTINGS } from "../../common/interface-types";
 
 export type VariantAnalysisProps = {
   variantAnalysis?: VariantAnalysisDomainModel;
@@ -77,6 +81,9 @@ export function VariantAnalysis({
   useTelemetryOnChange(filterSortState, "variant-analysis-filter-sort-state", {
     debounceTimeoutMillis: 1000,
   });
+  const [userSettings, setUserSettings] = useState<UserSettings>(
+    DEFAULT_USER_SETTINGS,
+  );
 
   useMessageFromExtension<ToVariantAnalysisMessage>((msg) => {
     if (msg.t === "setVariantAnalysis") {
@@ -102,6 +109,8 @@ export function VariantAnalysis({
           ...msg.repoStates,
         ];
       });
+    } else if (msg.t === "setUserSettings") {
+      setUserSettings(msg.userSettings);
     }
   }, []);
 
@@ -163,6 +172,7 @@ export function VariantAnalysis({
         onCopyRepositoryListClick={copyRepositoryList}
         onExportResultsClick={exportResults}
         onViewLogsClick={onViewLogsClick}
+        userSettings={userSettings}
       />
       <VariantAnalysisOutcomePanels
         variantAnalysis={variantAnalysis}
diff --git a/extensions/ql-vscode/src/view/variant-analysis/VariantAnalysisActions.tsx b/extensions/ql-vscode/src/view/variant-analysis/VariantAnalysisActions.tsx
index d0e467b14eb..3a6690e828c 100644
--- a/extensions/ql-vscode/src/view/variant-analysis/VariantAnalysisActions.tsx
+++ b/extensions/ql-vscode/src/view/variant-analysis/VariantAnalysisActions.tsx
@@ -1,6 +1,7 @@
 import { styled } from "styled-components";
 import { VariantAnalysisStatus } from "../../variant-analysis/shared/variant-analysis";
 import { VscodeButton } from "@vscode-elements/react-elements";
+import type { UserSettings } from "../../common/interface-types";
 
 export type VariantAnalysisActionsProps = {
   variantAnalysisStatus: VariantAnalysisStatus;
@@ -18,6 +19,8 @@ export type VariantAnalysisActionsProps = {
 
   hasSelectedRepositories?: boolean;
   hasFilteredRepositories?: boolean;
+
+  userSettings: UserSettings;
 };
 
 const Container = styled.div`
@@ -65,24 +68,27 @@ export const VariantAnalysisActions = ({
   exportResultsDisabled,
   hasSelectedRepositories,
   hasFilteredRepositories,
+  userSettings,
 }: VariantAnalysisActionsProps) => {
   return (
     <Container>
       {showResultActions && (
         <>
-          <Button
-            secondary
-            onClick={onViewAutofixesClick}
-            disabled={viewAutofixesDisabled}
-          >
-            {chooseText({
-              hasSelectedRepositories,
-              hasFilteredRepositories,
-              normalText: "View Autofixes",
-              selectedText: "View Autofixes for selected results",
-              filteredText: "View Autofixes for filtered results",
-            })}
-          </Button>
+          {userSettings.shouldShowViewAutofixesBtn && (
+            <Button
+              secondary
+              onClick={onViewAutofixesClick}
+              disabled={viewAutofixesDisabled}
+            >
+              {chooseText({
+                hasSelectedRepositories,
+                hasFilteredRepositories,
+                normalText: "View Autofixes",
+                selectedText: "View Autofixes for selected results",
+                filteredText: "View Autofixes for filtered results",
+              })}
+            </Button>
+          )}
           <Button
             secondary
             onClick={onCopyRepositoryListClick}
diff --git a/extensions/ql-vscode/src/view/variant-analysis/VariantAnalysisHeader.tsx b/extensions/ql-vscode/src/view/variant-analysis/VariantAnalysisHeader.tsx
index 04dfad612c8..30c3ed83e5f 100644
--- a/extensions/ql-vscode/src/view/variant-analysis/VariantAnalysisHeader.tsx
+++ b/extensions/ql-vscode/src/view/variant-analysis/VariantAnalysisHeader.tsx
@@ -22,6 +22,7 @@ import {
   filterAndSortRepositoriesWithResults,
 } from "../../variant-analysis/shared/variant-analysis-filter-sort";
 import { ViewTitle } from "../common";
+import type { UserSettings } from "../../common/interface-types";
 
 type VariantAnalysisHeaderProps = {
   variantAnalysis: VariantAnalysis;
@@ -39,6 +40,8 @@ type VariantAnalysisHeaderProps = {
   onExportResultsClick: () => void;
 
   onViewLogsClick?: () => void;
+
+  userSettings: UserSettings;
 };
 
 const Container = styled.div`
@@ -87,6 +90,7 @@ export const VariantAnalysisHeader = ({
   onCopyRepositoryListClick,
   onExportResultsClick,
   onViewLogsClick,
+  userSettings,
 }: VariantAnalysisHeaderProps) => {
   const totalScannedRepositoryCount = useMemo(() => {
     return variantAnalysis.scannedRepos?.length ?? 0;
@@ -166,6 +170,7 @@ export const VariantAnalysisHeader = ({
           hasSelectedRepositories={
             selectedRepositoryIds && selectedRepositoryIds.length > 0
           }
+          userSettings={userSettings}
         />
       </Row>
       <VariantAnalysisStats
diff --git a/extensions/ql-vscode/src/view/variant-analysis/__tests__/VariantAnalysisActions.spec.tsx b/extensions/ql-vscode/src/view/variant-analysis/__tests__/VariantAnalysisActions.spec.tsx
index 3f33e344ea2..abfb75881c0 100644
--- a/extensions/ql-vscode/src/view/variant-analysis/__tests__/VariantAnalysisActions.spec.tsx
+++ b/extensions/ql-vscode/src/view/variant-analysis/__tests__/VariantAnalysisActions.spec.tsx
@@ -27,6 +27,10 @@ describe(VariantAnalysisActions.name, () => {
         onViewAutofixesClick={onViewAutofixesClick}
         onCopyRepositoryListClick={onCopyRepositoryListClick}
         onExportResultsClick={onExportResultsClick}
+        userSettings={{
+          shouldShowProvenance: false,
+          shouldShowViewAutofixesBtn: false,
+        }}
         {...props}
       />,
     );

From 4e089e73545b00a402c0b9fdb2f06992b8ff9266 Mon Sep 17 00:00:00 2001
From: Jami Cogswell <jcogs33@Jamis-MacBook-Pro.local>
Date: Wed, 2 Jul 2025 16:30:27 +0000
Subject: [PATCH 24/38] Remove config listener for canary setting

---
 .../variant-analysis/variant-analysis-view.ts | 20 +------------------
 1 file changed, 1 insertion(+), 19 deletions(-)

diff --git a/extensions/ql-vscode/src/variant-analysis/variant-analysis-view.ts b/extensions/ql-vscode/src/variant-analysis/variant-analysis-view.ts
index 8c975130045..989efb08a7e 100644
--- a/extensions/ql-vscode/src/variant-analysis/variant-analysis-view.ts
+++ b/extensions/ql-vscode/src/variant-analysis/variant-analysis-view.ts
@@ -1,5 +1,4 @@
-import type { ConfigurationChangeEvent } from "vscode";
-import { ViewColumn, workspace } from "vscode";
+import { ViewColumn } from "vscode";
 import type { WebviewPanelConfig } from "../common/vscode/abstract-webview";
 import { AbstractWebview } from "../common/vscode/abstract-webview";
 import {
@@ -48,23 +47,6 @@ export class VariantAnalysisView
     manager.registerView(this);
 
     this.dataFlowPathsView = new DataFlowPathsView(app);
-
-    // Set up configuration change listener
-    this.push(
-      workspace.onDidChangeConfiguration(
-        this.onConfigurationChanged.bind(this),
-      ),
-    );
-  }
-
-  /**
-   * Handler for configuration changes
-   */
-  private onConfigurationChanged(e: ConfigurationChangeEvent): void {
-    // Check if the canary setting has changed
-    if (e.affectsConfiguration("codeQL.canary")) {
-      void this.updateUserSettings();
-    }
   }
 
   private async updateUserSettings(): Promise<void> {

From 04a858affa7fc4b6fe49362b8b7bfa4895fa3794 Mon Sep 17 00:00:00 2001
From: Jami Cogswell <jcogs33@Jamis-MacBook-Pro.local>
Date: Wed, 2 Jul 2025 20:27:33 +0000
Subject: [PATCH 25/38] canary: use separate message for the user settings for
 the variant analysis view

---
 .../ql-vscode/src/common/interface-types.ts   | 24 +++++++++++++++----
 .../ql-vscode/src/compare/compare-view.ts     |  2 --
 .../src/local-queries/results-view.ts         |  2 --
 .../stories/results/AlertTable.stories.tsx    |  1 -
 .../variant-analysis/variant-analysis-view.ts | 23 +++++-------------
 .../__tests__/AlertTablePathRow.spec.tsx      |  1 -
 .../__tests__/AlertTableResultRow.spec.tsx    |  1 -
 .../view/variant-analysis/VariantAnalysis.tsx | 17 ++++++-------
 .../VariantAnalysisActions.tsx                |  7 +++---
 .../VariantAnalysisHeader.tsx                 | 10 ++++----
 .../__tests__/VariantAnalysisActions.spec.tsx |  5 +---
 11 files changed, 45 insertions(+), 48 deletions(-)

diff --git a/extensions/ql-vscode/src/common/interface-types.ts b/extensions/ql-vscode/src/common/interface-types.ts
index 08bf9e7baf2..eca0779966a 100644
--- a/extensions/ql-vscode/src/common/interface-types.ts
+++ b/extensions/ql-vscode/src/common/interface-types.ts
@@ -151,13 +151,10 @@ interface SetStateMsg {
 export interface UserSettings {
   /** Whether to display links to the dataflow models that generated particular nodes in a flow path. */
   shouldShowProvenance: boolean;
-  /** Whether to display the "View Autofixes" button. */
-  shouldShowViewAutofixesBtn: boolean;
 }
 
 export const DEFAULT_USER_SETTINGS: UserSettings = {
   shouldShowProvenance: false,
-  shouldShowViewAutofixesBtn: false,
 };
 
 /** Message indicating that the user's configuration settings have changed. */
@@ -166,6 +163,25 @@ interface SetUserSettingsMsg {
   userSettings: UserSettings;
 }
 
+export interface VariantAnalysisUserSettings {
+  /** Whether to display the "View Autofixes" button. */
+  shouldShowViewAutofixesButton: boolean;
+}
+
+export const DEFAULT_VARIANT_ANALYSIS_USER_SETTINGS: VariantAnalysisUserSettings =
+  {
+    shouldShowViewAutofixesButton: false,
+  };
+
+/**
+ * Message indicating that the user's variant analysis configuration
+ * settings have changed.
+ */
+interface SetVariantAnalysisUserSettingsMsg {
+  t: "setVariantAnalysisUserSettings";
+  variantAnalysisUserSettings: VariantAnalysisUserSettings;
+}
+
 /**
  * Message indicating that the results view should display interpreted
  * results.
@@ -563,7 +579,7 @@ export type ToVariantAnalysisMessage =
   | SetFilterSortStateMessage
   | SetRepoResultsMessage
   | SetRepoStatesMessage
-  | SetUserSettingsMsg;
+  | SetVariantAnalysisUserSettingsMsg;
 
 export type FromVariantAnalysisMessage =
   | CommonFromViewMessages
diff --git a/extensions/ql-vscode/src/compare/compare-view.ts b/extensions/ql-vscode/src/compare/compare-view.ts
index 5a739bf6803..93538f52e6b 100644
--- a/extensions/ql-vscode/src/compare/compare-view.ts
+++ b/extensions/ql-vscode/src/compare/compare-view.ts
@@ -119,8 +119,6 @@ export class CompareView extends AbstractWebview<
       t: "setUserSettings",
       userSettings: {
         shouldShowProvenance: isCanary(),
-        // "View Autofixes" button is not supported in compare view
-        shouldShowViewAutofixesBtn: false,
       },
     });
 
diff --git a/extensions/ql-vscode/src/local-queries/results-view.ts b/extensions/ql-vscode/src/local-queries/results-view.ts
index f68c3116452..00eae1138aa 100644
--- a/extensions/ql-vscode/src/local-queries/results-view.ts
+++ b/extensions/ql-vscode/src/local-queries/results-view.ts
@@ -550,8 +550,6 @@ export class ResultsView extends AbstractWebview<
       userSettings: {
         // Only show provenance info in canary mode for now.
         shouldShowProvenance: isCanary(),
-        // "View Autofixes" button is not supported in results view
-        shouldShowViewAutofixesBtn: false,
       },
     });
 
diff --git a/extensions/ql-vscode/src/stories/results/AlertTable.stories.tsx b/extensions/ql-vscode/src/stories/results/AlertTable.stories.tsx
index 4f36ea36c8b..d2cc19f3916 100644
--- a/extensions/ql-vscode/src/stories/results/AlertTable.stories.tsx
+++ b/extensions/ql-vscode/src/stories/results/AlertTable.stories.tsx
@@ -433,6 +433,5 @@ WithCodeFlows.args = {
   ),
   userSettings: {
     shouldShowProvenance: true,
-    shouldShowViewAutofixesBtn: false, // Not supported in AlertTable
   },
 };
diff --git a/extensions/ql-vscode/src/variant-analysis/variant-analysis-view.ts b/extensions/ql-vscode/src/variant-analysis/variant-analysis-view.ts
index 989efb08a7e..555a3686e68 100644
--- a/extensions/ql-vscode/src/variant-analysis/variant-analysis-view.ts
+++ b/extensions/ql-vscode/src/variant-analysis/variant-analysis-view.ts
@@ -49,29 +49,18 @@ export class VariantAnalysisView
     this.dataFlowPathsView = new DataFlowPathsView(app);
   }
 
-  private async updateUserSettings(): Promise<void> {
-    if (!this.isShowingPanel) {
-      return;
-    }
-
-    await this.postMessage({
-      t: "setUserSettings",
-      userSettings: {
-        // Provenance is not supported in variant analysis view
-        shouldShowProvenance: false,
-        // Only show "View Autofixes" button in canary mode.
-        shouldShowViewAutofixesBtn: isCanary(),
-      },
-    });
-  }
-
   public async openView() {
     const panel = await this.getPanel();
     panel.reveal(undefined, true);
 
     await this.waitForPanelLoaded();
 
-    await this.updateUserSettings();
+    await this.postMessage({
+      t: "setVariantAnalysisUserSettings",
+      variantAnalysisUserSettings: {
+        shouldShowViewAutofixesButton: isCanary(),
+      },
+    });
   }
 
   public async updateView(variantAnalysis: VariantAnalysis): Promise<void> {
diff --git a/extensions/ql-vscode/src/view/results/__tests__/AlertTablePathRow.spec.tsx b/extensions/ql-vscode/src/view/results/__tests__/AlertTablePathRow.spec.tsx
index 6d64880bf8a..001fa322a34 100644
--- a/extensions/ql-vscode/src/view/results/__tests__/AlertTablePathRow.spec.tsx
+++ b/extensions/ql-vscode/src/view/results/__tests__/AlertTablePathRow.spec.tsx
@@ -24,7 +24,6 @@ describe(AlertTablePathRow.name, () => {
         sourceLocationPrefix="src"
         userSettings={{
           shouldShowProvenance: false,
-          shouldShowViewAutofixesBtn: false,
         }}
         updateSelectionCallback={jest.fn()}
         toggleExpanded={jest.fn()}
diff --git a/extensions/ql-vscode/src/view/results/__tests__/AlertTableResultRow.spec.tsx b/extensions/ql-vscode/src/view/results/__tests__/AlertTableResultRow.spec.tsx
index 216a0899897..9082384e9d2 100644
--- a/extensions/ql-vscode/src/view/results/__tests__/AlertTableResultRow.spec.tsx
+++ b/extensions/ql-vscode/src/view/results/__tests__/AlertTableResultRow.spec.tsx
@@ -19,7 +19,6 @@ describe(AlertTableResultRow.name, () => {
         sourceLocationPrefix="src"
         userSettings={{
           shouldShowProvenance: false,
-          shouldShowViewAutofixesBtn: false,
         }}
         updateSelectionCallback={jest.fn()}
         toggleExpanded={jest.fn()}
diff --git a/extensions/ql-vscode/src/view/variant-analysis/VariantAnalysis.tsx b/extensions/ql-vscode/src/view/variant-analysis/VariantAnalysis.tsx
index b5f05cc2296..3ac0599ae6c 100644
--- a/extensions/ql-vscode/src/view/variant-analysis/VariantAnalysis.tsx
+++ b/extensions/ql-vscode/src/view/variant-analysis/VariantAnalysis.tsx
@@ -11,13 +11,13 @@ import { VariantAnalysisOutcomePanels } from "./VariantAnalysisOutcomePanels";
 import { VariantAnalysisLoading } from "./VariantAnalysisLoading";
 import type {
   ToVariantAnalysisMessage,
-  UserSettings,
+  VariantAnalysisUserSettings,
 } from "../../common/interface-types";
 import { vscode } from "../vscode-api";
 import { defaultFilterSortState } from "../../variant-analysis/shared/variant-analysis-filter-sort";
 import { sendTelemetry, useTelemetryOnChange } from "../common/telemetry";
 import { useMessageFromExtension } from "../common/useMessageFromExtension";
-import { DEFAULT_USER_SETTINGS } from "../../common/interface-types";
+import { DEFAULT_VARIANT_ANALYSIS_USER_SETTINGS } from "../../common/interface-types";
 
 export type VariantAnalysisProps = {
   variantAnalysis?: VariantAnalysisDomainModel;
@@ -81,9 +81,10 @@ export function VariantAnalysis({
   useTelemetryOnChange(filterSortState, "variant-analysis-filter-sort-state", {
     debounceTimeoutMillis: 1000,
   });
-  const [userSettings, setUserSettings] = useState<UserSettings>(
-    DEFAULT_USER_SETTINGS,
-  );
+  const [variantAnalysisUserSettings, setVariantAnalysisUserSettings] =
+    useState<VariantAnalysisUserSettings>(
+      DEFAULT_VARIANT_ANALYSIS_USER_SETTINGS,
+    );
 
   useMessageFromExtension<ToVariantAnalysisMessage>((msg) => {
     if (msg.t === "setVariantAnalysis") {
@@ -109,8 +110,8 @@ export function VariantAnalysis({
           ...msg.repoStates,
         ];
       });
-    } else if (msg.t === "setUserSettings") {
-      setUserSettings(msg.userSettings);
+    } else if (msg.t === "setVariantAnalysisUserSettings") {
+      setVariantAnalysisUserSettings(msg.variantAnalysisUserSettings);
     }
   }, []);
 
@@ -172,7 +173,7 @@ export function VariantAnalysis({
         onCopyRepositoryListClick={copyRepositoryList}
         onExportResultsClick={exportResults}
         onViewLogsClick={onViewLogsClick}
-        userSettings={userSettings}
+        variantAnalysisUserSettings={variantAnalysisUserSettings}
       />
       <VariantAnalysisOutcomePanels
         variantAnalysis={variantAnalysis}
diff --git a/extensions/ql-vscode/src/view/variant-analysis/VariantAnalysisActions.tsx b/extensions/ql-vscode/src/view/variant-analysis/VariantAnalysisActions.tsx
index 3a6690e828c..abec9443946 100644
--- a/extensions/ql-vscode/src/view/variant-analysis/VariantAnalysisActions.tsx
+++ b/extensions/ql-vscode/src/view/variant-analysis/VariantAnalysisActions.tsx
@@ -1,7 +1,6 @@
 import { styled } from "styled-components";
 import { VariantAnalysisStatus } from "../../variant-analysis/shared/variant-analysis";
 import { VscodeButton } from "@vscode-elements/react-elements";
-import type { UserSettings } from "../../common/interface-types";
 
 export type VariantAnalysisActionsProps = {
   variantAnalysisStatus: VariantAnalysisStatus;
@@ -20,7 +19,7 @@ export type VariantAnalysisActionsProps = {
   hasSelectedRepositories?: boolean;
   hasFilteredRepositories?: boolean;
 
-  userSettings: UserSettings;
+  showViewAutofixesButton: boolean;
 };
 
 const Container = styled.div`
@@ -68,13 +67,13 @@ export const VariantAnalysisActions = ({
   exportResultsDisabled,
   hasSelectedRepositories,
   hasFilteredRepositories,
-  userSettings,
+  showViewAutofixesButton,
 }: VariantAnalysisActionsProps) => {
   return (
     <Container>
       {showResultActions && (
         <>
-          {userSettings.shouldShowViewAutofixesBtn && (
+          {showViewAutofixesButton && (
             <Button
               secondary
               onClick={onViewAutofixesClick}
diff --git a/extensions/ql-vscode/src/view/variant-analysis/VariantAnalysisHeader.tsx b/extensions/ql-vscode/src/view/variant-analysis/VariantAnalysisHeader.tsx
index 30c3ed83e5f..6f9ad00ad33 100644
--- a/extensions/ql-vscode/src/view/variant-analysis/VariantAnalysisHeader.tsx
+++ b/extensions/ql-vscode/src/view/variant-analysis/VariantAnalysisHeader.tsx
@@ -22,7 +22,7 @@ import {
   filterAndSortRepositoriesWithResults,
 } from "../../variant-analysis/shared/variant-analysis-filter-sort";
 import { ViewTitle } from "../common";
-import type { UserSettings } from "../../common/interface-types";
+import type { VariantAnalysisUserSettings } from "../../common/interface-types";
 
 type VariantAnalysisHeaderProps = {
   variantAnalysis: VariantAnalysis;
@@ -41,7 +41,7 @@ type VariantAnalysisHeaderProps = {
 
   onViewLogsClick?: () => void;
 
-  userSettings: UserSettings;
+  variantAnalysisUserSettings: VariantAnalysisUserSettings;
 };
 
 const Container = styled.div`
@@ -90,7 +90,7 @@ export const VariantAnalysisHeader = ({
   onCopyRepositoryListClick,
   onExportResultsClick,
   onViewLogsClick,
-  userSettings,
+  variantAnalysisUserSettings,
 }: VariantAnalysisHeaderProps) => {
   const totalScannedRepositoryCount = useMemo(() => {
     return variantAnalysis.scannedRepos?.length ?? 0;
@@ -170,7 +170,9 @@ export const VariantAnalysisHeader = ({
           hasSelectedRepositories={
             selectedRepositoryIds && selectedRepositoryIds.length > 0
           }
-          userSettings={userSettings}
+          showViewAutofixesButton={
+            variantAnalysisUserSettings.shouldShowViewAutofixesButton
+          }
         />
       </Row>
       <VariantAnalysisStats
diff --git a/extensions/ql-vscode/src/view/variant-analysis/__tests__/VariantAnalysisActions.spec.tsx b/extensions/ql-vscode/src/view/variant-analysis/__tests__/VariantAnalysisActions.spec.tsx
index abfb75881c0..08d3fe84b54 100644
--- a/extensions/ql-vscode/src/view/variant-analysis/__tests__/VariantAnalysisActions.spec.tsx
+++ b/extensions/ql-vscode/src/view/variant-analysis/__tests__/VariantAnalysisActions.spec.tsx
@@ -27,10 +27,7 @@ describe(VariantAnalysisActions.name, () => {
         onViewAutofixesClick={onViewAutofixesClick}
         onCopyRepositoryListClick={onCopyRepositoryListClick}
         onExportResultsClick={onExportResultsClick}
-        userSettings={{
-          shouldShowProvenance: false,
-          shouldShowViewAutofixesBtn: false,
-        }}
+        showViewAutofixesButton={false}
         {...props}
       />,
     );

From 7d3e403e0b2b158fa4e8732123b58600b360f295 Mon Sep 17 00:00:00 2001
From: Jami Cogswell <jcogs33@Jamis-MacBook-Pro.local>
Date: Wed, 2 Jul 2025 21:24:37 +0000
Subject: [PATCH 26/38] Remove progress updates that don't display

---
 .../ql-vscode/src/variant-analysis/view-autofixes.ts      | 8 +++-----
 1 file changed, 3 insertions(+), 5 deletions(-)

diff --git a/extensions/ql-vscode/src/variant-analysis/view-autofixes.ts b/extensions/ql-vscode/src/variant-analysis/view-autofixes.ts
index 56affe6add8..a90cd5ea511 100644
--- a/extensions/ql-vscode/src/variant-analysis/view-autofixes.ts
+++ b/extensions/ql-vscode/src/variant-analysis/view-autofixes.ts
@@ -50,7 +50,6 @@ export async function viewAutofixesForVariantAnalysisResults(
   await withProgress(
     async (progress: ProgressCallback) => {
       // Get the path to the local autofix installation.
-      progress(progressUpdate(1, 4, `Checking for local autofix installation`));
       const localAutofixPath = findLocalAutofix();
 
       // Get the variant analysis with the given id.
@@ -60,7 +59,6 @@ export async function viewAutofixesForVariantAnalysisResults(
       }
 
       // Generate the query help and output it to the override directory.
-      progress(progressUpdate(2, 4, `Generating query help override`));
       await overrideQueryHelp(variantAnalysis, cliServer, localAutofixPath);
 
       // Get the full names (nwos) of the selected repositories.
@@ -82,8 +80,8 @@ export async function viewAutofixesForVariantAnalysisResults(
       //  Run autofix and output results
       progress(
         progressUpdate(
-          3,
-          4,
+          1,
+          2,
           `Processing ${pluralize(selectedRepoNames.length, "repository", "repositories")}`,
         ),
       );
@@ -98,7 +96,7 @@ export async function viewAutofixesForVariantAnalysisResults(
       );
 
       // Output results from all repos to a combined markdown file.
-      progress(progressUpdate(4, 4, `Finalizing autofix results`));
+      progress(progressUpdate(2, 2, `Finalizing autofix results`));
       const combinedOutputMarkdownFile = join(
         autofixOutputStoragePath,
         "autofix-output.md",

From 161c5de55e8815bef6263272f25ba0a1c0aeb79d Mon Sep 17 00:00:00 2001
From: Jami Cogswell <jcogs33@Jamis-MacBook-Pro.local>
Date: Wed, 2 Jul 2025 22:46:47 +0000
Subject: [PATCH 27/38] Fix missing await

---
 extensions/ql-vscode/src/variant-analysis/view-autofixes.ts | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/extensions/ql-vscode/src/variant-analysis/view-autofixes.ts b/extensions/ql-vscode/src/variant-analysis/view-autofixes.ts
index a90cd5ea511..248d98d757a 100644
--- a/extensions/ql-vscode/src/variant-analysis/view-autofixes.ts
+++ b/extensions/ql-vscode/src/variant-analysis/view-autofixes.ts
@@ -50,7 +50,7 @@ export async function viewAutofixesForVariantAnalysisResults(
   await withProgress(
     async (progress: ProgressCallback) => {
       // Get the path to the local autofix installation.
-      const localAutofixPath = findLocalAutofix();
+      const localAutofixPath = await findLocalAutofix();
 
       // Get the variant analysis with the given id.
       const variantAnalysis = variantAnalyses.get(variantAnalysisId);
@@ -119,12 +119,12 @@ export async function viewAutofixesForVariantAnalysisResults(
  * @returns An object containing the local autofix path.
  * @throws Error if the AUTOFIX_PATH environment variable is not set or the path does not exist.
  */
-function findLocalAutofix(): string {
+async function findLocalAutofix(): Promise<string> {
   const localAutofixPath = process.env.AUTOFIX_PATH;
   if (!localAutofixPath) {
     throw new Error("Path to local autofix installation not found.");
   }
-  if (!pathExists(localAutofixPath)) {
+  if (!(await pathExists(localAutofixPath))) {
     throw new Error(`Local autofix path ${localAutofixPath} does not exist.`);
   }
   return localAutofixPath;

From e23699f54b784d08029a38b659515741133c6987 Mon Sep 17 00:00:00 2001
From: Jami Cogswell <jcogs33@Jamis-MacBook-Pro.local>
Date: Wed, 2 Jul 2025 23:00:25 +0000
Subject: [PATCH 28/38] Use parse.dir instead of dirname

---
 extensions/ql-vscode/src/variant-analysis/view-autofixes.ts | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/extensions/ql-vscode/src/variant-analysis/view-autofixes.ts b/extensions/ql-vscode/src/variant-analysis/view-autofixes.ts
index 248d98d757a..45819e2e7fb 100644
--- a/extensions/ql-vscode/src/variant-analysis/view-autofixes.ts
+++ b/extensions/ql-vscode/src/variant-analysis/view-autofixes.ts
@@ -144,9 +144,10 @@ async function overrideQueryHelp(
   if (!(await pathExists(queryFilePath))) {
     throw new Error(`Query file used by variant analysis not found.`);
   }
+  const parsedQueryFilePath = parse(queryFilePath);
   const queryFilePathNoExt = join(
-    dirname(queryFilePath),
-    parse(queryFilePath).name,
+    parsedQueryFilePath.dir,
+    parsedQueryFilePath.name,
   );
 
   // Get the path to the query help, which may be either a `.qhelp` or a `.md` file.

From 22d642945fa16a55c34e6f456493ecc067a68b19 Mon Sep 17 00:00:00 2001
From: Jami Cogswell <jcogs33@Jamis-MacBook-Pro.local>
Date: Wed, 2 Jul 2025 23:23:16 +0000
Subject: [PATCH 29/38] Remove createVarAutofixArgs function

---
 .../src/variant-analysis/view-autofixes.ts    | 41 ++++---------------
 1 file changed, 9 insertions(+), 32 deletions(-)

diff --git a/extensions/ql-vscode/src/variant-analysis/view-autofixes.ts b/extensions/ql-vscode/src/variant-analysis/view-autofixes.ts
index 45819e2e7fb..f7b6ef1da00 100644
--- a/extensions/ql-vscode/src/variant-analysis/view-autofixes.ts
+++ b/extensions/ql-vscode/src/variant-analysis/view-autofixes.ts
@@ -617,7 +617,7 @@ async function runAutofixOnResults(
   alertNumber?: number, // Optional parameter for specific alert
 ): Promise<void> {
   // Set up args for autofix command.
-  const fixedAutofixArgs = [
+  const autofixArgs = [
     "--sarif",
     sarifFile,
     "--source-root",
@@ -630,15 +630,18 @@ async function runAutofixOnResults(
     "text",
     "--diff-style",
     "diff", // could do "text" instead if want line of "=" between fixes
-  ];
-  const varAutofixArgs = createVarAutofixArgs(
+    "--output",
     outputTextFilePath,
+    "--fix-description",
     fixDescriptionFilePath,
+    "--transcript",
     transcriptFilePath,
-    alertNumber,
-  );
+  ];
 
-  const autofixArgs = [...fixedAutofixArgs, ...varAutofixArgs];
+  // Add alert number argument if provided
+  if (alertNumber !== undefined) {
+    autofixArgs.push("--only-alert-number", alertNumber.toString());
+  }
 
   await execAutofix(
     logger,
@@ -655,32 +658,6 @@ async function runAutofixOnResults(
   );
 }
 
-/**
- * Creates autofix arguments that vary depending on the run.
- */
-function createVarAutofixArgs(
-  outputTextFilePath: string,
-  fixDescriptionFilePath: string,
-  transcriptFilePath: string,
-  alertNumber?: number, // Optional parameter for specific alert
-): string[] {
-  const args = [
-    "--output",
-    outputTextFilePath,
-    "--fix-description",
-    fixDescriptionFilePath,
-    "--transcript",
-    transcriptFilePath,
-  ];
-
-  // Add alert number argument if provided
-  if (alertNumber !== undefined) {
-    args.push("--only-alert-number", alertNumber.toString());
-  }
-
-  return args;
-}
-
 /**
  * Executes the autofix command.
  */

From 3030f6c4a603f6e92420b8b08b868a51e8e45c29 Mon Sep 17 00:00:00 2001
From: Jami <57204504+jcogs33@users.noreply.github.com>
Date: Wed, 2 Jul 2025 19:35:06 -0400
Subject: [PATCH 30/38] Update 'autofix not found' error message

Co-authored-by: Andrew Eisenberg <aeisenberg@github.com>
---
 extensions/ql-vscode/src/variant-analysis/view-autofixes.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/extensions/ql-vscode/src/variant-analysis/view-autofixes.ts b/extensions/ql-vscode/src/variant-analysis/view-autofixes.ts
index f7b6ef1da00..59b1093e1ad 100644
--- a/extensions/ql-vscode/src/variant-analysis/view-autofixes.ts
+++ b/extensions/ql-vscode/src/variant-analysis/view-autofixes.ts
@@ -122,7 +122,7 @@ export async function viewAutofixesForVariantAnalysisResults(
 async function findLocalAutofix(): Promise<string> {
   const localAutofixPath = process.env.AUTOFIX_PATH;
   if (!localAutofixPath) {
-    throw new Error("Path to local autofix installation not found.");
+    throw new Error("Path to local autofix installation not found. Internal GitHub access required.");
   }
   if (!(await pathExists(localAutofixPath))) {
     throw new Error(`Local autofix path ${localAutofixPath} does not exist.`);

From ab5ef913f851d3054ae8f4e6a7406ab3dd367fad Mon Sep 17 00:00:00 2001
From: Jami Cogswell <jcogs33@Jamis-MacBook-Pro.local>
Date: Thu, 3 Jul 2025 00:13:46 +0000
Subject: [PATCH 31/38] Fix prettier formatting

---
 extensions/ql-vscode/src/variant-analysis/view-autofixes.ts | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/extensions/ql-vscode/src/variant-analysis/view-autofixes.ts b/extensions/ql-vscode/src/variant-analysis/view-autofixes.ts
index 59b1093e1ad..919f5b86893 100644
--- a/extensions/ql-vscode/src/variant-analysis/view-autofixes.ts
+++ b/extensions/ql-vscode/src/variant-analysis/view-autofixes.ts
@@ -122,7 +122,9 @@ export async function viewAutofixesForVariantAnalysisResults(
 async function findLocalAutofix(): Promise<string> {
   const localAutofixPath = process.env.AUTOFIX_PATH;
   if (!localAutofixPath) {
-    throw new Error("Path to local autofix installation not found. Internal GitHub access required.");
+    throw new Error(
+      "Path to local autofix installation not found. Internal GitHub access required.",
+    );
   }
   if (!(await pathExists(localAutofixPath))) {
     throw new Error(`Local autofix path ${localAutofixPath} does not exist.`);

From 1d203a4bd20c7878355fccc7f54307e4f16b32da Mon Sep 17 00:00:00 2001
From: Jami Cogswell <jcogs33@Jamis-MacBook-Pro.local>
Date: Thu, 3 Jul 2025 17:02:28 +0000
Subject: [PATCH 32/38] Use VariantAnalysisManager and
 VariantAnalysisResultsManager for storage locations

---
 .../variant-analysis-manager.ts               |  4 +-
 .../variant-analysis-results-manager.ts       | 17 ++++-
 .../src/variant-analysis/view-autofixes.ts    | 69 ++++++++++++-------
 3 files changed, 61 insertions(+), 29 deletions(-)

diff --git a/extensions/ql-vscode/src/variant-analysis/variant-analysis-manager.ts b/extensions/ql-vscode/src/variant-analysis/variant-analysis-manager.ts
index 04407f8f679..45914a0bdd4 100644
--- a/extensions/ql-vscode/src/variant-analysis/variant-analysis-manager.ts
+++ b/extensions/ql-vscode/src/variant-analysis/variant-analysis-manager.ts
@@ -973,12 +973,12 @@ export class VariantAnalysisManager
     filterSort: RepositoriesFilterSortStateWithIds = defaultFilterSortState,
   ) {
     await viewAutofixesForVariantAnalysisResults(
+      this,
+      this.variantAnalysisResultsManager,
       variantAnalysisId,
       filterSort,
-      this.variantAnalyses,
       this.app.credentials,
       this.app.logger,
-      this.storagePath,
       this.app,
       this.cliServer,
     );
diff --git a/extensions/ql-vscode/src/variant-analysis/variant-analysis-results-manager.ts b/extensions/ql-vscode/src/variant-analysis/variant-analysis-results-manager.ts
index 0f24e950325..01e27410ff0 100644
--- a/extensions/ql-vscode/src/variant-analysis/variant-analysis-results-manager.ts
+++ b/extensions/ql-vscode/src/variant-analysis/variant-analysis-results-manager.ts
@@ -44,6 +44,7 @@ export type LoadResultsOptions = {
 
 export class VariantAnalysisResultsManager extends DisposableObject {
   private static readonly RESULTS_DIRECTORY = "results";
+  private static readonly RESULTS_SARIF_FILENAME = "results.sarif";
 
   private readonly cachedResults: Map<
     CacheKey,
@@ -212,7 +213,10 @@ export class VariantAnalysisResultsManager extends DisposableObject {
       storageDirectory,
       VariantAnalysisResultsManager.RESULTS_DIRECTORY,
     );
-    const sarifPath = join(resultsDirectory, "results.sarif");
+    const sarifPath = join(
+      resultsDirectory,
+      VariantAnalysisResultsManager.RESULTS_SARIF_FILENAME,
+    );
     const bqrsPath = join(resultsDirectory, "results.bqrs");
 
     let interpretedResults: AnalysisAlert[] | undefined;
@@ -294,6 +298,17 @@ export class VariantAnalysisResultsManager extends DisposableObject {
     return join(variantAnalysisStoragePath, fullName);
   }
 
+  public getRepoResultsSarifStoragePath(
+    variantAnalysisStoragePath: string,
+    fullName: string,
+  ): string {
+    return join(
+      this.getRepoStorageDirectory(variantAnalysisStoragePath, fullName),
+      VariantAnalysisResultsManager.RESULTS_DIRECTORY,
+      VariantAnalysisResultsManager.RESULTS_SARIF_FILENAME,
+    );
+  }
+
   private createGitHubFileLinkPrefix(fullName: string, sha: string): string {
     return new URL(
       `/${fullName}/blob/${sha}`,
diff --git a/extensions/ql-vscode/src/variant-analysis/view-autofixes.ts b/extensions/ql-vscode/src/variant-analysis/view-autofixes.ts
index 919f5b86893..aba274e93ff 100644
--- a/extensions/ql-vscode/src/variant-analysis/view-autofixes.ts
+++ b/extensions/ql-vscode/src/variant-analysis/view-autofixes.ts
@@ -18,13 +18,14 @@ import { join, dirname, parse } from "path";
 import { tryGetQueryMetadata } from "../codeql-cli/query-metadata";
 import { window as Window } from "vscode";
 import { pluralize } from "../common/word";
-import { glob } from "glob";
 import { readRepoTask } from "./repo-tasks-store";
 import { unlink, mkdtemp, readFile, writeFile } from "fs/promises";
 import { tmpdir } from "os";
 import { spawn } from "child_process";
 import type { execFileSync } from "child_process";
 import { tryOpenExternalFile } from "../common/vscode/external-files";
+import type { VariantAnalysisManager } from "./variant-analysis-manager";
+import type { VariantAnalysisResultsManager } from "./variant-analysis-results-manager";
 
 // Limit to three repos when generating autofixes so not sending
 // too many requests to autofix. Since we only need to validate
@@ -38,12 +39,12 @@ const MAX_NUM_FIXES: number = 3;
  * Generates autofixes for the results of a variant analysis.
  */
 export async function viewAutofixesForVariantAnalysisResults(
+  variantAnalysisManager: VariantAnalysisManager,
+  variantAnalysisResultsManager: VariantAnalysisResultsManager,
   variantAnalysisId: number,
   filterSort: RepositoriesFilterSortStateWithIds = defaultFilterSortState,
-  variantAnalyses: Map<number, VariantAnalysis>,
   credentials: Credentials,
   logger: NotificationLogger,
-  storagePath: string,
   app: App,
   cliServer: CodeQLCliServer,
 ): Promise<void> {
@@ -53,7 +54,8 @@ export async function viewAutofixesForVariantAnalysisResults(
       const localAutofixPath = await findLocalAutofix();
 
       // Get the variant analysis with the given id.
-      const variantAnalysis = variantAnalyses.get(variantAnalysisId);
+      const variantAnalysis =
+        variantAnalysisManager.tryGetVariantAnalysis(variantAnalysisId);
       if (!variantAnalysis) {
         throw new Error(`No variant analysis with id: ${variantAnalysisId}`);
       }
@@ -72,7 +74,7 @@ export async function viewAutofixesForVariantAnalysisResults(
         variantAnalysisIdStoragePath,
         sourceRootsStoragePath,
         autofixOutputStoragePath,
-      } = await getStoragePaths(variantAnalysisId, storagePath);
+      } = await getStoragePaths(variantAnalysisManager, variantAnalysisId);
 
       // Process the selected repositories:
       //  Get sarif
@@ -86,6 +88,7 @@ export async function viewAutofixesForVariantAnalysisResults(
         ),
       );
       const outputTextFiles = await processSelectedRepositories(
+        variantAnalysisResultsManager,
         selectedRepoNames,
         variantAnalysisIdStoragePath,
         sourceRootsStoragePath,
@@ -237,21 +240,19 @@ function getSelectedRepositoryNames(
  * Gets the storage paths needed for the autofix results.
  */
 async function getStoragePaths(
+  variantAnalysisManager: VariantAnalysisManager,
   variantAnalysisId: number,
-  storagePath: string,
 ): Promise<{
   variantAnalysisIdStoragePath: string;
   sourceRootsStoragePath: string;
   autofixOutputStoragePath: string;
 }> {
   // Confirm storage path for the variant analysis ID exists.
-  const variantAnalysisIdStoragePath = join(
-    storagePath,
-    variantAnalysisId.toString(),
-  );
+  const variantAnalysisIdStoragePath =
+    variantAnalysisManager.getVariantAnalysisStorageLocation(variantAnalysisId);
   if (!(await pathExists(variantAnalysisIdStoragePath))) {
     throw new Error(
-      `Variant analysis storage path does not exist: ${variantAnalysisIdStoragePath}`,
+      `Variant analysis storage location does not exist: ${variantAnalysisIdStoragePath}`,
     );
   }
 
@@ -286,6 +287,7 @@ async function getStoragePaths(
  * Processes the selected repositories for autofix generation.
  */
 async function processSelectedRepositories(
+  variantAnalysisResultsManager: VariantAnalysisResultsManager,
   selectedRepoNames: string[],
   variantAnalysisIdStoragePath: string,
   sourceRootsStoragePath: string,
@@ -301,13 +303,20 @@ async function processSelectedRepositories(
         async (progressForRepo: ProgressCallback) => {
           // Get the sarif file.
           progressForRepo(progressUpdate(1, 3, `Getting sarif`));
-          const repoStoragePath = join(variantAnalysisIdStoragePath, nwo);
-          const sarifFile = await getSarifFile(repoStoragePath, nwo);
+          const sarifFile = await getRepoSarifFile(
+            variantAnalysisResultsManager,
+            variantAnalysisIdStoragePath,
+            nwo,
+          );
 
           // Read the contents of the variant analysis' `repo_task.json` file,
           // and confirm that the `databaseCommitSha` and `resultCount` exist.
-          const repoTask: VariantAnalysisRepositoryTask =
-            await readRepoTask(repoStoragePath);
+          const repoTask: VariantAnalysisRepositoryTask = await readRepoTask(
+            variantAnalysisResultsManager.getRepoStorageDirectory(
+              variantAnalysisIdStoragePath,
+              nwo,
+            ),
+          );
           if (!repoTask.databaseCommitSha) {
             throw new Error(`Missing database commit SHA for ${nwo}`);
           }
@@ -352,22 +361,30 @@ async function processSelectedRepositories(
 }
 
 /**
- * Gets the path to a SARIF file in a given `repoStoragePath`.
+ * Gets the path to a SARIF file for a given `nwo`.
  */
-async function getSarifFile(
-  repoStoragePath: string,
+async function getRepoSarifFile(
+  variantAnalysisResultsManager: VariantAnalysisResultsManager,
+  variantAnalysisIdStoragePath: string,
   nwo: string,
 ): Promise<string> {
-  // Get results directory path.
-  const repoResultsStoragePath = join(repoStoragePath, "results");
-  // Find sarif file.
-  const sarifFiles = await glob(`${repoResultsStoragePath}/**/*.sarif`);
-  if (sarifFiles.length !== 1) {
-    throw new Error(
-      `Expected to find exactly one \`*.sarif\` file for ${nwo}, but found ${sarifFiles.length}.`,
+  if (
+    !(await variantAnalysisResultsManager.isVariantAnalysisRepoDownloaded(
+      variantAnalysisIdStoragePath,
+      nwo,
+    ))
+  ) {
+    throw new Error(`Variant analysis results not downloaded for ${nwo}`);
+  }
+  const sarifFile =
+    variantAnalysisResultsManager.getRepoResultsSarifStoragePath(
+      variantAnalysisIdStoragePath,
+      nwo,
     );
+  if (!(await pathExists(sarifFile))) {
+    throw new Error(`SARIF file not found for ${nwo}`);
   }
-  return sarifFiles[0];
+  return sarifFile;
 }
 
 /**

From 561cbc4b37f6a41fbf94b58e1899653bc25654e8 Mon Sep 17 00:00:00 2001
From: Jami Cogswell <jcogs33@Jamis-MacBook-Pro.local>
Date: Thu, 3 Jul 2025 18:42:00 +0000
Subject: [PATCH 33/38] Add config settings for 'codeQL.autofix.path' and
 'codeQL.autofix.model'

---
 extensions/ql-vscode/src/config.ts                 | 14 ++++++++++++++
 .../src/variant-analysis/view-autofixes.ts         | 10 ++++++++--
 2 files changed, 22 insertions(+), 2 deletions(-)

diff --git a/extensions/ql-vscode/src/config.ts b/extensions/ql-vscode/src/config.ts
index 989e4931bcf..58e4d6ff929 100644
--- a/extensions/ql-vscode/src/config.ts
+++ b/extensions/ql-vscode/src/config.ts
@@ -954,3 +954,17 @@ export class GitHubDatabaseConfigListener
     await GITHUB_DATABASE_UPDATE.updateValue(value, target);
   }
 }
+
+const AUTOFIX_SETTING = new Setting("autofix", ROOT_SETTING);
+
+const AUTOFIX_PATH = new Setting("path", AUTOFIX_SETTING);
+
+export function getAutofixPath(): string | undefined {
+  return AUTOFIX_PATH.getValue<string>() || undefined;
+}
+
+const AUTOFIX_MODEL = new Setting("model", AUTOFIX_SETTING);
+
+export function getAutofixModel(): string | undefined {
+  return AUTOFIX_MODEL.getValue<string>() || undefined;
+}
diff --git a/extensions/ql-vscode/src/variant-analysis/view-autofixes.ts b/extensions/ql-vscode/src/variant-analysis/view-autofixes.ts
index aba274e93ff..b2e3e3d9155 100644
--- a/extensions/ql-vscode/src/variant-analysis/view-autofixes.ts
+++ b/extensions/ql-vscode/src/variant-analysis/view-autofixes.ts
@@ -26,6 +26,7 @@ import type { execFileSync } from "child_process";
 import { tryOpenExternalFile } from "../common/vscode/external-files";
 import type { VariantAnalysisManager } from "./variant-analysis-manager";
 import type { VariantAnalysisResultsManager } from "./variant-analysis-results-manager";
+import { getAutofixPath, getAutofixModel } from "../config";
 
 // Limit to three repos when generating autofixes so not sending
 // too many requests to autofix. Since we only need to validate
@@ -123,7 +124,7 @@ export async function viewAutofixesForVariantAnalysisResults(
  * @throws Error if the AUTOFIX_PATH environment variable is not set or the path does not exist.
  */
 async function findLocalAutofix(): Promise<string> {
-  const localAutofixPath = process.env.AUTOFIX_PATH;
+  const localAutofixPath = getAutofixPath();
   if (!localAutofixPath) {
     throw new Error(
       "Path to local autofix installation not found. Internal GitHub access required.",
@@ -635,6 +636,11 @@ async function runAutofixOnResults(
   workDir: string,
   alertNumber?: number, // Optional parameter for specific alert
 ): Promise<void> {
+  // Get autofix model from user settings.
+  const autofixModel = getAutofixModel();
+  if (!autofixModel) {
+    throw new Error("Autofix model not found.");
+  }
   // Set up args for autofix command.
   const autofixArgs = [
     "--sarif",
@@ -642,7 +648,7 @@ async function runAutofixOnResults(
     "--source-root",
     srcRootPath,
     "--model",
-    "capi-dev-4o", // may fail with older versions of cocofix
+    autofixModel,
     "--dev",
     "--no-cache",
     "--format",

From bbc741319520cb57c6ddb64ab9109ddabc5d9eb4 Mon Sep 17 00:00:00 2001
From: Jami Cogswell <jcogs33@Jamis-MacBook-Pro.local>
Date: Thu, 3 Jul 2025 22:53:58 +0000
Subject: [PATCH 34/38] Remove args check in 'execAutofix'

---
 extensions/ql-vscode/src/variant-analysis/view-autofixes.ts | 5 -----
 1 file changed, 5 deletions(-)

diff --git a/extensions/ql-vscode/src/variant-analysis/view-autofixes.ts b/extensions/ql-vscode/src/variant-analysis/view-autofixes.ts
index b2e3e3d9155..cd86249ea92 100644
--- a/extensions/ql-vscode/src/variant-analysis/view-autofixes.ts
+++ b/extensions/ql-vscode/src/variant-analysis/view-autofixes.ts
@@ -699,11 +699,6 @@ function execAutofix(
       if (showCommand) {
         void logger.log(`Spawning '${bin} ${args.join(" ")}' in ${cwd}`);
       }
-      if (args.some((a) => a === undefined || a === "")) {
-        throw new Error(
-          `Invalid empty or undefined arguments: ${args.join(" ")}`,
-        );
-      }
       const p = spawn(bin, args, { stdio: [0, 1, 2], ...options });
       p.on("error", reject);
       p.on("exit", (code) => (code === 0 ? resolve() : reject(code)));

From d887ca505adf9a5177645c33cfc887a717e7452b Mon Sep 17 00:00:00 2001
From: Jami Cogswell <jcogs33@Jamis-MacBook-Pro.local>
Date: Thu, 3 Jul 2025 23:58:15 +0000
Subject: [PATCH 35/38] Use 'getErrorMessage' and remove uses of
 'console.error'

---
 .../ql-vscode/src/variant-analysis/view-autofixes.ts | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/extensions/ql-vscode/src/variant-analysis/view-autofixes.ts b/extensions/ql-vscode/src/variant-analysis/view-autofixes.ts
index cd86249ea92..e9f70b99d73 100644
--- a/extensions/ql-vscode/src/variant-analysis/view-autofixes.ts
+++ b/extensions/ql-vscode/src/variant-analysis/view-autofixes.ts
@@ -27,6 +27,7 @@ import { tryOpenExternalFile } from "../common/vscode/external-files";
 import type { VariantAnalysisManager } from "./variant-analysis-manager";
 import type { VariantAnalysisResultsManager } from "./variant-analysis-results-manager";
 import { getAutofixPath, getAutofixModel } from "../config";
+import { getErrorMessage } from "../common/helpers-pure";
 
 // Limit to three repos when generating autofixes so not sending
 // too many requests to autofix. Since we only need to validate
@@ -497,8 +498,9 @@ async function downloadPublicCommitSource(
 
     return checkoutDir;
   } catch (error) {
-    const errorMessage = error instanceof Error ? error.message : String(error);
-    throw new Error(`Failed to download ${nwo} at ${sha}: ${errorMessage}`);
+    throw new Error(
+      `Failed to download ${nwo} at ${sha}:. Reason: ${getErrorMessage(error)}`,
+    );
   }
 }
 
@@ -755,8 +757,7 @@ async function mergeFiles(
       await Promise.all(inputFiles.map((file) => unlink(file)));
     }
   } catch (error) {
-    console.error("Error merging files:", error);
-    throw error;
+    throw new Error(`Error merging files. Reason: ${getErrorMessage(error)}`);
   }
 }
 
@@ -791,7 +792,6 @@ async function formatWithMarkdown(
     // Write the formatted content back to the file
     await writeFile(inputFile, formattedContent);
   } catch (error) {
-    console.error("Error formatting file:", error);
-    throw error;
+    throw new Error(`Error formatting file. Reason: ${getErrorMessage(error)}`);
   }
 }

From 41a3612f59a1e70d99a57bfd9129d1bf33b6ae65 Mon Sep 17 00:00:00 2001
From: Jami Cogswell <jcogs33@Jamis-MacBook-Pro.local>
Date: Fri, 4 Jul 2025 00:13:30 +0000
Subject: [PATCH 36/38] Switch fs/promises imports to fs-extra

---
 .../src/variant-analysis/view-autofixes.ts          | 13 +++++++++++--
 1 file changed, 11 insertions(+), 2 deletions(-)

diff --git a/extensions/ql-vscode/src/variant-analysis/view-autofixes.ts b/extensions/ql-vscode/src/variant-analysis/view-autofixes.ts
index e9f70b99d73..14ba0e7563c 100644
--- a/extensions/ql-vscode/src/variant-analysis/view-autofixes.ts
+++ b/extensions/ql-vscode/src/variant-analysis/view-autofixes.ts
@@ -11,7 +11,17 @@ import type { Credentials } from "../common/authentication";
 import type { NotificationLogger } from "../common/logging";
 import type { App } from "../common/app";
 import type { CodeQLCliServer } from "../codeql-cli/cli";
-import { pathExists, ensureDir, readdir, move, remove } from "fs-extra";
+import {
+  pathExists,
+  ensureDir,
+  readdir,
+  move,
+  remove,
+  unlink,
+  mkdtemp,
+  readFile,
+  writeFile,
+} from "fs-extra";
 import { withProgress, progressUpdate } from "../common/vscode/progress";
 import type { ProgressCallback } from "../common/vscode/progress";
 import { join, dirname, parse } from "path";
@@ -19,7 +29,6 @@ import { tryGetQueryMetadata } from "../codeql-cli/query-metadata";
 import { window as Window } from "vscode";
 import { pluralize } from "../common/word";
 import { readRepoTask } from "./repo-tasks-store";
-import { unlink, mkdtemp, readFile, writeFile } from "fs/promises";
 import { tmpdir } from "os";
 import { spawn } from "child_process";
 import type { execFileSync } from "child_process";

From b7f84fca9ef88061279dd5ab6001b6006b6ecd0e Mon Sep 17 00:00:00 2001
From: Jami Cogswell <jcogs33@Jamis-MacBook-Pro.local>
Date: Fri, 4 Jul 2025 00:29:08 +0000
Subject: [PATCH 37/38] Replace three backticks in file content

---
 extensions/ql-vscode/src/variant-analysis/view-autofixes.ts | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/extensions/ql-vscode/src/variant-analysis/view-autofixes.ts b/extensions/ql-vscode/src/variant-analysis/view-autofixes.ts
index 14ba0e7563c..89f9d39b5d7 100644
--- a/extensions/ql-vscode/src/variant-analysis/view-autofixes.ts
+++ b/extensions/ql-vscode/src/variant-analysis/view-autofixes.ts
@@ -796,7 +796,8 @@ async function formatWithMarkdown(
       "```\n\n</details>\n\n ### Notes\n - notes placeholder\n\n";
 
     // Format the content with Markdown
-    const formattedContent = `## ${header}\n\n${frontFormatting}${content}${backFormatting}`;
+    // Replace ``` in the content with \``` to avoid breaking the Markdown code block
+    const formattedContent = `## ${header}\n\n${frontFormatting}${content.replaceAll("```", "\\```")}${backFormatting}`;
 
     // Write the formatted content back to the file
     await writeFile(inputFile, formattedContent);

From 492b805e6677df45ba7d6b8d1e75100047e8bdc8 Mon Sep 17 00:00:00 2001
From: Jami Cogswell <jcogs33@Jamis-MacBook-Pro.local>
Date: Fri, 4 Jul 2025 01:04:38 +0000
Subject: [PATCH 38/38] Use 'extLogger' instead of 'NotificationLogger'

---
 .../variant-analysis-manager.ts               |  1 -
 .../src/variant-analysis/view-autofixes.ts    | 30 +++++--------------
 2 files changed, 8 insertions(+), 23 deletions(-)

diff --git a/extensions/ql-vscode/src/variant-analysis/variant-analysis-manager.ts b/extensions/ql-vscode/src/variant-analysis/variant-analysis-manager.ts
index 45914a0bdd4..179105a2b14 100644
--- a/extensions/ql-vscode/src/variant-analysis/variant-analysis-manager.ts
+++ b/extensions/ql-vscode/src/variant-analysis/variant-analysis-manager.ts
@@ -978,7 +978,6 @@ export class VariantAnalysisManager
       variantAnalysisId,
       filterSort,
       this.app.credentials,
-      this.app.logger,
       this.app,
       this.cliServer,
     );
diff --git a/extensions/ql-vscode/src/variant-analysis/view-autofixes.ts b/extensions/ql-vscode/src/variant-analysis/view-autofixes.ts
index 89f9d39b5d7..2254eed6fa3 100644
--- a/extensions/ql-vscode/src/variant-analysis/view-autofixes.ts
+++ b/extensions/ql-vscode/src/variant-analysis/view-autofixes.ts
@@ -8,7 +8,7 @@ import type {
   VariantAnalysisRepositoryTask,
 } from "./shared/variant-analysis";
 import type { Credentials } from "../common/authentication";
-import type { NotificationLogger } from "../common/logging";
+import { extLogger } from "../common/logging/vscode";
 import type { App } from "../common/app";
 import type { CodeQLCliServer } from "../codeql-cli/cli";
 import {
@@ -26,7 +26,6 @@ import { withProgress, progressUpdate } from "../common/vscode/progress";
 import type { ProgressCallback } from "../common/vscode/progress";
 import { join, dirname, parse } from "path";
 import { tryGetQueryMetadata } from "../codeql-cli/query-metadata";
-import { window as Window } from "vscode";
 import { pluralize } from "../common/word";
 import { readRepoTask } from "./repo-tasks-store";
 import { tmpdir } from "os";
@@ -55,7 +54,6 @@ export async function viewAutofixesForVariantAnalysisResults(
   variantAnalysisId: number,
   filterSort: RepositoriesFilterSortStateWithIds = defaultFilterSortState,
   credentials: Credentials,
-  logger: NotificationLogger,
   app: App,
   cliServer: CodeQLCliServer,
 ): Promise<void> {
@@ -106,7 +104,6 @@ export async function viewAutofixesForVariantAnalysisResults(
         autofixOutputStoragePath,
         localAutofixPath,
         credentials,
-        logger,
       );
 
       // Output results from all repos to a combined markdown file.
@@ -235,11 +232,10 @@ function getSelectedRepositoryNames(
     throw new Error("No repositories with results found.");
   }
 
-  // Limit to MAX_NUM_REPOS by slicing the array,
-  // and inform the user about the limit.
+  // Limit to MAX_NUM_REPOS by slicing the array.
   if (fullNames.length > MAX_NUM_REPOS) {
     fullNames = fullNames.slice(0, MAX_NUM_REPOS);
-    void Window.showInformationMessage(
+    void extLogger.log(
       `Only the first ${MAX_NUM_REPOS} repos (${fullNames.join(", ")}) will be included in the Autofix results.`,
     );
   }
@@ -305,7 +301,6 @@ async function processSelectedRepositories(
   autofixOutputStoragePath: string,
   localAutofixPath: string,
   credentials: Credentials,
-  logger: NotificationLogger,
 ): Promise<string[]> {
   const outputTextFiles: string[] = [];
   await Promise.all(
@@ -344,7 +339,6 @@ async function processSelectedRepositories(
             repoTask.databaseCommitSha,
             sourceRootsStoragePath,
             credentials,
-            logger,
           );
 
           // Run autofix.
@@ -356,7 +350,6 @@ async function processSelectedRepositories(
             localAutofixPath,
             autofixOutputStoragePath,
             repoTask.resultCount,
-            logger,
             outputTextFiles,
           );
         },
@@ -406,7 +399,6 @@ async function downloadPublicCommitSource(
   sha: string,
   outputPath: string,
   credentials: Credentials,
-  logger: NotificationLogger,
 ): Promise<string> {
   const [owner, repo] = nwo.split("/");
   if (!owner || !repo) {
@@ -424,13 +416,13 @@ async function downloadPublicCommitSource(
 
   // Check if directory already exists to avoid re-downloading
   if (await pathExists(checkoutDir)) {
-    void logger.log(
+    void extLogger.log(
       `Source for ${nwo} at ${sha} already exists at ${checkoutDir}.`,
     );
     return checkoutDir;
   }
 
-  void logger.log(`Fetching source of repository ${nwo} at ${sha}...`);
+  void extLogger.log(`Fetching source of repository ${nwo} at ${sha}...`);
 
   try {
     // Create a temporary directory for downloading
@@ -469,7 +461,7 @@ async function downloadPublicCommitSource(
       );
     });
 
-    void logger.log(`Download complete, extracting source...`);
+    void extLogger.log(`Download complete, extracting source...`);
 
     // Extract the tarball
     await new Promise<void>((resolve, reject) => {
@@ -523,7 +515,6 @@ async function runAutofixForRepository(
   localAutofixPath: string,
   autofixOutputStoragePath: string,
   resultCount: number,
-  logger: NotificationLogger,
   outputTextFiles: string[],
 ): Promise<void> {
   // Get storage paths for the autofix results for this repository.
@@ -542,7 +533,7 @@ async function runAutofixForRepository(
   // Limit number of fixes generated.
   const limitFixesBoolean: boolean = resultCount > MAX_NUM_FIXES;
   if (limitFixesBoolean) {
-    void Window.showInformationMessage(
+    void extLogger.log(
       `Only generating autofixes for the first ${MAX_NUM_FIXES} alerts for ${nwo}.`,
     );
 
@@ -570,7 +561,6 @@ async function runAutofixForRepository(
       transcriptFiles.push(tempTranscriptFilePath);
 
       await runAutofixOnResults(
-        logger,
         cocofixBin,
         sarifFile,
         srcRootPath,
@@ -590,7 +580,6 @@ async function runAutofixForRepository(
   } else {
     // Run autofix once for all alerts.
     await runAutofixOnResults(
-      logger,
       cocofixBin,
       sarifFile,
       srcRootPath,
@@ -637,7 +626,6 @@ async function getRepoStoragePaths(
  * Runs autofix on the results in the given SARIF file.
  */
 async function runAutofixOnResults(
-  logger: NotificationLogger,
   cocofixBin: string,
   sarifFile: string,
   srcRootPath: string,
@@ -680,7 +668,6 @@ async function runAutofixOnResults(
   }
 
   await execAutofix(
-    logger,
     cocofixBin,
     autofixArgs,
     {
@@ -698,7 +685,6 @@ async function runAutofixOnResults(
  * Executes the autofix command.
  */
 function execAutofix(
-  logger: NotificationLogger,
   bin: string,
   args: string[],
   options: Parameters<typeof execFileSync>[2],
@@ -708,7 +694,7 @@ function execAutofix(
     try {
       const cwd = options?.cwd || process.cwd();
       if (showCommand) {
-        void logger.log(`Spawning '${bin} ${args.join(" ")}' in ${cwd}`);
+        void extLogger.log(`Spawning '${bin} ${args.join(" ")}' in ${cwd}`);
       }
       const p = spawn(bin, args, { stdio: [0, 1, 2], ...options });
       p.on("error", reject);