duplicatecode 0.2.0__tar.gz → 0.3.0__tar.gz

{duplicatecode-0.2.0 → duplicatecode-0.3.0}/Cargo.lock

@@ -91,9 +91,9 @@ dependencies = [
 
 [[package]]
 name = "cc"
-version = "1.5.1"
+version = "1.2.67"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f360145194ee8e21db5ee7f3fcd4fe52210864c75c985dae33218202c8bbe040"
+checksum = "e17dd265a7d0f31ef544e1b20e03add05d3b45b491b633b10d67145d2acc1a38"
 dependencies = [
  "find-msvc-tools",
  "shlex",
@@ -198,7 +198,7 @@ dependencies = [
 
 [[package]]
 name = "duplicatecode"
-version = "0.2.0"
+version = "0.3.0"
 dependencies = [
  "anyhow",
  "clap",
@@ -212,7 +212,7 @@ dependencies = [
 
 [[package]]
 name = "duplicatecode-engine"
-version = "0.2.0"
+version = "0.3.0"
 dependencies = [
  "ignore",
  "serde",
@@ -220,6 +220,7 @@ dependencies = [
  "tree-sitter",
  "tree-sitter-c-sharp",
  "tree-sitter-python",
+ "tree-sitter-sequel",
  "tree-sitter-typescript",
  "ureq",
  "walkdir",
@@ -790,6 +791,16 @@ dependencies = [
  "tree-sitter-language",
 ]
 
+[[package]]
+name = "tree-sitter-sequel"
+version = "0.3.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9d198ad3c319c02e43c21efa1ec796b837afcb96ffaef1a40c1978fbdcec7d17"
+dependencies = [
+ "cc",
+ "tree-sitter-language",
+]
+
 [[package]]
 name = "tree-sitter-typescript"
 version = "0.23.2"

{duplicatecode-0.2.0 → duplicatecode-0.3.0}/Cargo.toml

@@ -3,6 +3,6 @@ resolver = "2"
 members = ["crates/duplicatecode-engine", "crates/duplicatecode-cli"]
 
 [workspace.package]
-version = "0.2.0"
+version = "0.3.0"
 edition = "2021"
 license = "MIT"

{duplicatecode-0.2.0 → duplicatecode-0.3.0}/PKG-INFO

@@ -1,16 +1,16 @@
 Metadata-Version: 2.4
 Name: duplicatecode
-Version: 0.2.0
+Version: 0.3.0
 Classifier: Programming Language :: Rust
 Classifier: Environment :: Console
-Summary: Static (LLM-free) detection of duplicate/similar code in Python, TypeScript and C#
+Summary: Static (LLM-free) detection of duplicate/similar code in Python, TypeScript/JavaScript, SQL and C#
 License: MIT
 Requires-Python: >=3.9
 Description-Content-Type: text/markdown; charset=UTF-8; variant=GFM
 
 # duplicatecode
 
-Static (LLM-free) detection of duplicate / similar code in Python, TypeScript (TSX) and C#,
+Static (LLM-free) detection of duplicate / similar code in Python, TypeScript/JavaScript (TSX/JSX), SQL and C#,
 aimed at catching an LLM re-implementing something that already exists. Input can be a git diff
 checked against existing source.
 
@@ -42,6 +42,134 @@ duplicatecode scan . --pairs --json                  # machine-readable pairs in
 duplicatecode bench --dataset dataset [--file-level] [--mutations] [--negatives <other repo>]
 ```
 
+## More ways to look
+
+```sh
+duplicatecode fragments packages/            # copied blocks inside different functions (4+ identical statements)
+duplicatecode scan . --pairs --explain       # say what differs: literals, calls, lines (what to parameterize)
+duplicatecode find "retry with exponential backoff" src/   # does something like this already exist? (needs embeddings)
+```
+
+- `fragments` indexes windows of consecutive normalized statements, so a block pasted into another
+  function is found even when the surrounding functions differ. On an injection benchmark (renamed
+  blocks of real functions pasted into others) it finds 93-97% of blocks of 6+ statements; see
+  `eval/REPORT.md`. Tune with `--min-stmts` / `--min-tokens`; constructors and dunders are ignored.
+- `--explain` adds, per pair, the literals and calls only one side has and the source lines with no
+  counterpart ("16 of 18/17 statements shared").
+- `find` embeds the query and every unit and ranks by similarity. With MiniLM, 50 task descriptions
+  against 168 implementation units rank the right one first 94% of the time; with 1,379 unrelated real
+  units mixed in, 82% first and 96% in the top 3 (every query within the top 10).
+- Default thresholds depend on the profile: `copies` keeps its tuned 0.6 (`scan`), 0.4 (`diff`), 0.45
+  (`review`); `reimpl` scores live lower, so it defaults to 0.35 / 0.28 / 0.30, which correspond to roughly
+  0.1% / 1% false-positive rates on unrelated code in the benchmarks. With `--embed` the `reimpl`
+  defaults rise by 0.07 because blended scores of unrelated code rise too.
+
+## Embeddings (bring your own key)
+
+Two optional signals, both off by default (the detector stays LLM-free unless you ask):
+
+- `--embeddings` embeds identifier *names* (cheap) as an extra name-similarity signal.
+- `--embed <preset>` is the short form (`minilm`, `qwen3`, `potion`, `openai`, `cohere`; `qwen3` is about 5x slower than `minilm` on CPU, so use it with a GPU or prefer `minilm`) and implies
+  `--embed-code`. Model ids go into the cache key, so vectors of different models never mix.
+- `--embed-code` embeds the *whole text of every unit* (function, class, file, SQL statement) and blends
+  the cosine into the score (`--embed-weight`, default 0.35, others scaled by 1 - weight). It finds
+  re-implementations that share no tokens. On function-level LLM re-implementations it lifted Python from
+  0.70 to 0.89 on a held-out half; see `eval/REPORT.md` for the numbers and caveats. Vectors are cached per
+  unit text in `~/.cache/duplicatecode/embeddings.bin`, so a rescan only embeds what changed.
+
+Credentials come from the environment:
+
+```sh
+# OpenAI
+export OPENAI_API_KEY=sk-...                      # optional: OPENAI_EMBEDDING_MODEL (default text-embedding-3-small)
+# Cohere (native /v2/embed)
+export COHERE_API_KEY=...                         # optional: COHERE_EMBEDDING_MODEL (default embed-v4.0)
+# OpenAI-compatible server (vLLM, Ollama, LiteLLM, ...)
+export OPENAI_BASE_URL=http://localhost:11434/v1 OPENAI_API_KEY=anything OPENAI_EMBEDDING_MODEL=nomic-embed-text
+# Azure AI Foundry (key, or `az login` if no key is set)
+export AZURE_AI_FOUNDRY_ENDPOINT=https://<res>.services.ai.azure.com
+export AZURE_AI_FOUNDRY_API_KEY=... AZURE_AI_FOUNDRY_EMBEDDING_DEPLOYMENT=text-embedding-3-small
+# Azure OpenAI: AZURE_OPENAI_ENDPOINT / AZURE_OPENAI_API_KEY / AZURE_OPENAI_EMBEDDING_DEPLOYMENT
+# Fully local, no key: start the server once (CPU; it loads whichever model a request names)
+#   uv run --no-project --python 3.12 eval/embed_server.py
+#   duplicatecode scan . --embed minilm          # or: qwen3, potion  (default endpoint 127.0.0.1:8099)
+# Hosted presets: --embed openai (OPENAI_API_KEY), --embed cohere (COHERE_API_KEY)
+
+duplicatecode embed-test fetchUser getUser     # check credentials
+duplicatecode scan . --embed-code              # whole-unit embeddings
+duplicatecode scan . --embeddings              # names only
+```
+
+## API
+
+### Command line
+
+| command | what it does |
+| --- | --- |
+| `scan <paths>` | similar units inside one or more folders; `--pairs`, `--explain`, `--json`, `--fail-on-found` |
+| `diff` | check code added in a git diff (stdin or `--diff`) against the repo (`--repo`) |
+| `review` | ranked candidates for a diff, for a human or an agent to judge |
+| `fragments <paths>` | copied blocks of identical statements inside different functions |
+| `find "<description>" <paths>` | existing units closest to a plain-language description (needs embeddings) |
+| `units <path>` / `show file:10-40` | list extracted units / print a unit's source |
+| `embed-test <names...>` | check the embedding provider and calibrate `--embed-floor` |
+| `eval-groups`, `bench`, `make-mutation-groups` | evaluation (see `eval/README.md`) |
+
+Shared options: `--profile copies|reimpl`, `--threshold`, `--min-tokens`, `--min-lines`, `--exclude`, `--skip-tests`,
+`--cross-file`, `--json`. Embedding options (all off by default): `--embed <preset>`, `--embed-code`,
+`--embed-weight`, `--embed-max-chars`, `--embeddings`, `--embed-cache`, `--embed-dims`.
+
+```sh
+duplicatecode scan . --profile reimpl --min-name 0 --embed minilm --pairs --explain
+duplicatecode fragments src/ --min-stmts 4 --min-tokens 30 --cross-file --json
+duplicatecode find "retry with exponential backoff" src/ --top 5 --json
+duplicatecode diff --repo . < change.diff --embed openai
+```
+
+JSON output:
+
+- `find --json`: `[{score, file, name, kind, start_line, end_line}]`
+- `fragments --json`: `[{a, b, statements, tokens}]` with `a`/`b` = `{file, unit, start_line, end_line, coverage}`
+- `scan --pairs --json`: `[{query, candidate, scores}]`; with `--explain`: `[{match, explanation}]`
+- `scan --json` (groups): `[{score, units: [{file, name, kind, start_line, end_line}]}]`
+
+`scan --fail-on-found` exits with status 1 when anything is reported, for CI.
+
+### Rust library
+
+The engine crate `duplicatecode-engine` is what the CLI uses:
+
+```rust
+use duplicatecode_engine::embed::{embed_unit_code, EmbedConfig, EmbeddingCache};
+use duplicatecode_engine::explain::explain;
+use duplicatecode_engine::fragments::{find_fragments, FragmentOptions};
+use duplicatecode_engine::index::Weights;
+use duplicatecode_engine::{find_matches, load_units_with, Corpus, MatchOptions};
+
+let mut units = load_units_with(Path::new("src/"), &[]);
+
+// optional: embed every unit; units without a vector simply skip the embedding term
+let cfg = EmbedConfig::from_env(None).ok_or("no embedding provider configured")?;
+let mut cache = EmbeddingCache::load(&EmbeddingCache::default_path());
+embed_unit_code(&mut units, &cfg, &mut cache, 3000)?;
+
+// pairs: queries against a corpus
+let weights = Weights::default().with_embed(0.35); // 0.0 = static only
+let corpus = Corpus::new(units.clone());
+let pairs = find_matches(&units, &corpus, MatchOptions { weights, threshold: 0.42, ..Default::default() });
+
+// copied blocks, and what differs inside a pair
+let blocks = find_fragments(&units, FragmentOptions::default());
+println!("{}", explain(&units[0], &units[1]).summary());
+```
+
+### Not built yet
+
+Planned, not available today: a `.duplicatecode.toml` with an `[embed]` section; `--embed-optional` (warn and
+fall back to the static score when the provider is unreachable; today an unreachable provider is an error);
+`--allow-upload` (required for the hosted presets, which send source text out); a `duplicatecode[embed]` Python
+extra that starts the local server on demand; an `Embedder` trait so providers can plug in without HTTP.
+
 ## How it works
 
 Units (functions, methods, classes, arrow-function components) are extracted with tree-sitter and

{duplicatecode-0.2.0 → duplicatecode-0.3.0}/README.md

@@ -1,6 +1,6 @@
 # duplicatecode
 
-Static (LLM-free) detection of duplicate / similar code in Python, TypeScript (TSX) and C#,
+Static (LLM-free) detection of duplicate / similar code in Python, TypeScript/JavaScript (TSX/JSX), SQL and C#,
 aimed at catching an LLM re-implementing something that already exists. Input can be a git diff
 checked against existing source.
 
@@ -32,6 +32,134 @@ duplicatecode scan . --pairs --json                  # machine-readable pairs in
 duplicatecode bench --dataset dataset [--file-level] [--mutations] [--negatives <other repo>]
 ```
 
+## More ways to look
+
+```sh
+duplicatecode fragments packages/            # copied blocks inside different functions (4+ identical statements)
+duplicatecode scan . --pairs --explain       # say what differs: literals, calls, lines (what to parameterize)
+duplicatecode find "retry with exponential backoff" src/   # does something like this already exist? (needs embeddings)
+```
+
+- `fragments` indexes windows of consecutive normalized statements, so a block pasted into another
+  function is found even when the surrounding functions differ. On an injection benchmark (renamed
+  blocks of real functions pasted into others) it finds 93-97% of blocks of 6+ statements; see
+  `eval/REPORT.md`. Tune with `--min-stmts` / `--min-tokens`; constructors and dunders are ignored.
+- `--explain` adds, per pair, the literals and calls only one side has and the source lines with no
+  counterpart ("16 of 18/17 statements shared").
+- `find` embeds the query and every unit and ranks by similarity. With MiniLM, 50 task descriptions
+  against 168 implementation units rank the right one first 94% of the time; with 1,379 unrelated real
+  units mixed in, 82% first and 96% in the top 3 (every query within the top 10).
+- Default thresholds depend on the profile: `copies` keeps its tuned 0.6 (`scan`), 0.4 (`diff`), 0.45
+  (`review`); `reimpl` scores live lower, so it defaults to 0.35 / 0.28 / 0.30, which correspond to roughly
+  0.1% / 1% false-positive rates on unrelated code in the benchmarks. With `--embed` the `reimpl`
+  defaults rise by 0.07 because blended scores of unrelated code rise too.
+
+## Embeddings (bring your own key)
+
+Two optional signals, both off by default (the detector stays LLM-free unless you ask):
+
+- `--embeddings` embeds identifier *names* (cheap) as an extra name-similarity signal.
+- `--embed <preset>` is the short form (`minilm`, `qwen3`, `potion`, `openai`, `cohere`; `qwen3` is about 5x slower than `minilm` on CPU, so use it with a GPU or prefer `minilm`) and implies
+  `--embed-code`. Model ids go into the cache key, so vectors of different models never mix.
+- `--embed-code` embeds the *whole text of every unit* (function, class, file, SQL statement) and blends
+  the cosine into the score (`--embed-weight`, default 0.35, others scaled by 1 - weight). It finds
+  re-implementations that share no tokens. On function-level LLM re-implementations it lifted Python from
+  0.70 to 0.89 on a held-out half; see `eval/REPORT.md` for the numbers and caveats. Vectors are cached per
+  unit text in `~/.cache/duplicatecode/embeddings.bin`, so a rescan only embeds what changed.
+
+Credentials come from the environment:
+
+```sh
+# OpenAI
+export OPENAI_API_KEY=sk-...                      # optional: OPENAI_EMBEDDING_MODEL (default text-embedding-3-small)
+# Cohere (native /v2/embed)
+export COHERE_API_KEY=...                         # optional: COHERE_EMBEDDING_MODEL (default embed-v4.0)
+# OpenAI-compatible server (vLLM, Ollama, LiteLLM, ...)
+export OPENAI_BASE_URL=http://localhost:11434/v1 OPENAI_API_KEY=anything OPENAI_EMBEDDING_MODEL=nomic-embed-text
+# Azure AI Foundry (key, or `az login` if no key is set)
+export AZURE_AI_FOUNDRY_ENDPOINT=https://<res>.services.ai.azure.com
+export AZURE_AI_FOUNDRY_API_KEY=... AZURE_AI_FOUNDRY_EMBEDDING_DEPLOYMENT=text-embedding-3-small
+# Azure OpenAI: AZURE_OPENAI_ENDPOINT / AZURE_OPENAI_API_KEY / AZURE_OPENAI_EMBEDDING_DEPLOYMENT
+# Fully local, no key: start the server once (CPU; it loads whichever model a request names)
+#   uv run --no-project --python 3.12 eval/embed_server.py
+#   duplicatecode scan . --embed minilm          # or: qwen3, potion  (default endpoint 127.0.0.1:8099)
+# Hosted presets: --embed openai (OPENAI_API_KEY), --embed cohere (COHERE_API_KEY)
+
+duplicatecode embed-test fetchUser getUser     # check credentials
+duplicatecode scan . --embed-code              # whole-unit embeddings
+duplicatecode scan . --embeddings              # names only
+```
+
+## API
+
+### Command line
+
+| command | what it does |
+| --- | --- |
+| `scan <paths>` | similar units inside one or more folders; `--pairs`, `--explain`, `--json`, `--fail-on-found` |
+| `diff` | check code added in a git diff (stdin or `--diff`) against the repo (`--repo`) |
+| `review` | ranked candidates for a diff, for a human or an agent to judge |
+| `fragments <paths>` | copied blocks of identical statements inside different functions |
+| `find "<description>" <paths>` | existing units closest to a plain-language description (needs embeddings) |
+| `units <path>` / `show file:10-40` | list extracted units / print a unit's source |
+| `embed-test <names...>` | check the embedding provider and calibrate `--embed-floor` |
+| `eval-groups`, `bench`, `make-mutation-groups` | evaluation (see `eval/README.md`) |
+
+Shared options: `--profile copies|reimpl`, `--threshold`, `--min-tokens`, `--min-lines`, `--exclude`, `--skip-tests`,
+`--cross-file`, `--json`. Embedding options (all off by default): `--embed <preset>`, `--embed-code`,
+`--embed-weight`, `--embed-max-chars`, `--embeddings`, `--embed-cache`, `--embed-dims`.
+
+```sh
+duplicatecode scan . --profile reimpl --min-name 0 --embed minilm --pairs --explain
+duplicatecode fragments src/ --min-stmts 4 --min-tokens 30 --cross-file --json
+duplicatecode find "retry with exponential backoff" src/ --top 5 --json
+duplicatecode diff --repo . < change.diff --embed openai
+```
+
+JSON output:
+
+- `find --json`: `[{score, file, name, kind, start_line, end_line}]`
+- `fragments --json`: `[{a, b, statements, tokens}]` with `a`/`b` = `{file, unit, start_line, end_line, coverage}`
+- `scan --pairs --json`: `[{query, candidate, scores}]`; with `--explain`: `[{match, explanation}]`
+- `scan --json` (groups): `[{score, units: [{file, name, kind, start_line, end_line}]}]`
+
+`scan --fail-on-found` exits with status 1 when anything is reported, for CI.
+
+### Rust library
+
+The engine crate `duplicatecode-engine` is what the CLI uses:
+
+```rust
+use duplicatecode_engine::embed::{embed_unit_code, EmbedConfig, EmbeddingCache};
+use duplicatecode_engine::explain::explain;
+use duplicatecode_engine::fragments::{find_fragments, FragmentOptions};
+use duplicatecode_engine::index::Weights;
+use duplicatecode_engine::{find_matches, load_units_with, Corpus, MatchOptions};
+
+let mut units = load_units_with(Path::new("src/"), &[]);
+
+// optional: embed every unit; units without a vector simply skip the embedding term
+let cfg = EmbedConfig::from_env(None).ok_or("no embedding provider configured")?;
+let mut cache = EmbeddingCache::load(&EmbeddingCache::default_path());
+embed_unit_code(&mut units, &cfg, &mut cache, 3000)?;
+
+// pairs: queries against a corpus
+let weights = Weights::default().with_embed(0.35); // 0.0 = static only
+let corpus = Corpus::new(units.clone());
+let pairs = find_matches(&units, &corpus, MatchOptions { weights, threshold: 0.42, ..Default::default() });
+
+// copied blocks, and what differs inside a pair
+let blocks = find_fragments(&units, FragmentOptions::default());
+println!("{}", explain(&units[0], &units[1]).summary());
+```
+
+### Not built yet
+
+Planned, not available today: a `.duplicatecode.toml` with an `[embed]` section; `--embed-optional` (warn and
+fall back to the static score when the provider is unreachable; today an unreachable provider is an error);
+`--allow-upload` (required for the hosted presets, which send source text out); a `duplicatecode[embed]` Python
+extra that starts the local server on demand; an `Embedder` trait so providers can plug in without HTTP.
+
 ## How it works
 
 Units (functions, methods, classes, arrow-function components) are extracted with tree-sitter and

{duplicatecode-0.2.0 → duplicatecode-0.3.0}/crates/duplicatecode-cli/src/bench.rs

@@ -389,6 +389,9 @@ fn fit(samples: &[&Sample]) -> Weights {
     let mut w = Weights {
         bias: 0.0,
         w: [0.0; N_FEATURES],
+        sql: None,
+        file: None,
+        renormalize: false,
         name_floor: 0.5,
     };
     for _ in 0..2500 {
@@ -415,7 +418,7 @@ fn apply(w: &Weights, x: &[f64; N_FEATURES]) -> f64 {
 }
 
 /// Fraction of positives scoring above the (1 - fpr) quantile of the negatives.
-fn tpr_at_fpr(scores: &[(f64, bool)], fpr: f64) -> f64 {
+pub(crate) fn tpr_at_fpr(scores: &[(f64, bool)], fpr: f64) -> f64 {
     let mut neg: Vec<f64> = scores.iter().filter(|s| !s.1).map(|s| s.0).collect();
     let pos: Vec<f64> = scores.iter().filter(|s| s.1).map(|s| s.0).collect();
     if neg.is_empty() || pos.is_empty() {

duplicatecode-0.3.0/crates/duplicatecode-cli/src/groups.rs

@@ -0,0 +1,267 @@
+//! Labeled-group benchmark: files inside one group are clones, files of different groups are not.
+//!
+//! Layout `<root>/<dataset>/<group>/<file>`. Every file is one whole-file unit; all pairs inside a
+//! dataset are scored. Reports AUC, recall at fixed false-positive rates and top-1 retrieval.
+
+use crate::bench::tpr_at_fpr;
+use anyhow::{bail, Result};
+use duplicatecode_engine::index::{score_with_idf, Idf, Scores, Weights};
+use duplicatecode_engine::{load_file_units, load_units, Unit};
+use rayon::prelude::*;
+use std::path::Path;
+
+type Pick = fn(&Scores) -> f64;
+const SIGNALS: [(&str, Pick); 7] = [
+    ("structure", |s| s.structural),
+    ("loose", |s| s.loose),
+    ("kinds", |s| s.kinds),
+    ("stmt_exact", |s| s.stmt_exact),
+    ("stmt_shape", |s| s.stmt_shape),
+    ("stmt_lcs", |s| s.stmt_lcs),
+    ("combined", |s| s.combined),
+];
+
+/// Area under the ROC curve with tie handling (Mann-Whitney U).
+fn auc(scores: &[(f64, bool)]) -> f64 {
+    let mut v: Vec<(f64, bool)> = scores.to_vec();
+    v.sort_by(|a, b| a.0.total_cmp(&b.0));
+    let (mut rank_sum, mut n_pos, mut i) = (0.0, 0usize, 0usize);
+    while i < v.len() {
+        let mut j = i;
+        while j < v.len() && v[j].0 == v[i].0 {
+            j += 1;
+        }
+        let avg_rank = (i + j + 1) as f64 / 2.0; // 1-based average rank of the tie block
+        let pos = v[i..j].iter().filter(|x| x.1).count();
+        rank_sum += avg_rank * pos as f64;
+        n_pos += pos;
+        i = j;
+    }
+    let n_neg = v.len() - n_pos;
+    if n_pos == 0 || n_neg == 0 {
+        return f64::NAN;
+    }
+    (rank_sum - (n_pos * (n_pos + 1)) as f64 / 2.0) / (n_pos * n_neg) as f64
+}
+
+fn group_of(u: &Unit) -> &str {
+    u.file.split('/').next().unwrap_or("")
+}
+
+/// Score above which only `fpr` of the negative pairs lie.
+fn score_at_fpr(scores: &[(f64, bool)], fpr: f64) -> f64 {
+    let mut neg: Vec<f64> = scores.iter().filter(|s| !s.1).map(|s| s.0).collect();
+    neg.sort_by(|a, b| a.total_cmp(b));
+    neg.get(((1.0 - fpr) * neg.len() as f64) as usize)
+        .or(neg.last())
+        .copied()
+        .unwrap_or(f64::NAN)
+}
+
+struct Report {
+    thr1: f64,
+    thr01: f64,
+    auc: f64,
+    tpr1: f64,
+    tpr5: f64,
+    top1: f64,
+}
+
+fn evaluate(units: &[Unit], pick: Pick, all: &[Vec<Scores>]) -> Report {
+    let n = units.len();
+    let mut pairs = Vec::with_capacity(n * n / 2);
+    let mut hit = 0usize;
+    for i in 0..n {
+        let mut best: Option<(f64, bool)> = None;
+        for j in 0..n {
+            if i == j || units[i].file == units[j].file {
+                continue;
+            }
+            let v = pick(&all[i][j]);
+            let same = group_of(&units[i]) == group_of(&units[j]);
+            if j > i {
+                pairs.push((v, same));
+            }
+            if best.is_none_or(|b| v > b.0) {
+                best = Some((v, same));
+            }
+        }
+        hit += best.is_some_and(|b| b.1) as usize;
+    }
+    Report {
+        thr1: score_at_fpr(&pairs, 0.01),
+        thr01: score_at_fpr(&pairs, 0.001),
+        auc: auc(&pairs),
+        tpr1: tpr_at_fpr(&pairs, 0.01),
+        tpr5: tpr_at_fpr(&pairs, 0.05),
+        top1: hit as f64 / n as f64,
+    }
+}
+
+pub fn run(
+    root: &Path,
+    quiet: bool,
+    dump: Option<&Path>,
+    prepare: &dyn Fn(&mut [Unit]) -> Result<()>,
+    weights: Weights,
+) -> Result<()> {
+    let mut dump_out = dump.map(std::fs::File::create).transpose()?;
+    let mut datasets: Vec<_> = std::fs::read_dir(root)?
+        .filter_map(Result::ok)
+        .map(|e| e.path())
+        .filter(|p| p.is_dir() && !p.file_name().unwrap().to_string_lossy().starts_with('_'))
+        .collect();
+    datasets.sort();
+    if datasets.is_empty() {
+        bail!(
+            "no datasets below {} (run eval/fetch_codenet.py)",
+            root.display()
+        );
+    }
+    let mut headline = Vec::new();
+    for dir in datasets {
+        let name = dir.file_name().unwrap().to_string_lossy().to_string();
+        // `fn-*` datasets compare functions/classes (product path); the others whole files
+        let functions = name.starts_with("fn-");
+        let mut units = if functions {
+            load_units(&dir)
+                .into_iter()
+                .filter(|u| !u.boilerplate && u.token_count() >= 8)
+                .collect()
+        } else {
+            load_file_units(&dir)
+        };
+        units.sort_by(|a, b| (&a.file, a.start_line).cmp(&(&b.file, b.start_line)));
+        prepare(&mut units)?;
+        let n = units.len();
+        let idf = Idf::from_units(&units);
+        // full score matrix once; each signal is a projection of it
+        let all: Vec<Vec<Scores>> = (0..n)
+            .into_par_iter()
+            .map(|i| {
+                (0..n)
+                    .map(|j| score_with_idf(&units[i], &units[j], &weights, Some(&idf)))
+                    .collect()
+            })
+            .collect();
+        if let Some(f) = dump_out.as_mut() {
+            use std::io::Write;
+            for i in 0..n {
+                for j in i + 1..n {
+                    if units[i].file == units[j].file {
+                        continue;
+                    }
+                    let feats: Vec<String> = all[i][j]
+                        .features()
+                        .iter()
+                        .map(|x| format!("{x:.5}"))
+                        .collect();
+                    writeln!(
+                        f,
+                        "{name}\t{}:{}\t{}:{}\t{}\t{}\t{}\t{}\t{}",
+                        units[i].file,
+                        units[i].start_line,
+                        units[j].file,
+                        units[j].start_line,
+                        group_of(&units[i]),
+                        group_of(&units[j]),
+                        units[i].tokens.len().min(units[j].tokens.len()),
+                        units[i].tokens.len().max(units[j].tokens.len()),
+                        feats.join("\t")
+                    )?;
+                }
+            }
+        }
+        let groups: std::collections::BTreeSet<&str> = units.iter().map(group_of).collect();
+        if !quiet {
+            println!("== {name}: {n} files, {} groups", groups.len());
+            println!(
+                "{:<12} {:>6} {:>8} {:>8} {:>7}",
+                "signal", "AUC", "TPR@1%", "TPR@5%", "top1"
+            );
+        }
+        for (label, pick) in SIGNALS {
+            let r = evaluate(&units, pick, &all);
+            if !quiet {
+                println!(
+                    "{label:<12} {:>6.3} {:>8.3} {:>8.3} {:>7.3}",
+                    r.auc, r.tpr1, r.tpr5, r.top1
+                );
+            }
+            if label == "combined" {
+                headline.push((name.clone(), (r.auc + r.tpr1) / 2.0));
+                println!(
+                    "dataset_threshold {name} score@FPR1%={:.3} score@FPR0.1%={:.3}",
+                    r.thr1, r.thr01
+                );
+            }
+        }
+    }
+    for (name, s) in &headline {
+        println!("dataset_score {name}={s:.4}");
+    }
+    let mean = headline.iter().map(|h| h.1).sum::<f64>() / headline.len() as f64;
+    println!("score={mean:.4}");
+    Ok(())
+}
+
+/// Build `<out>/<id>/<variant>.tsx` groups from real components: the original plus mechanically
+/// rewritten variants (renames, statement swaps, temp variables, logging, dead code, all combined).
+/// Other components act as negatives. `skip` lets a holdout set use disjoint files.
+pub fn make_mutation_groups(
+    src: &Path,
+    out: &Path,
+    n: usize,
+    seed: u64,
+    skip: usize,
+) -> Result<()> {
+    use duplicatecode_engine::mutate::{apply, Mutation};
+    use duplicatecode_engine::{walk_files, Lang};
+    let mut files: Vec<_> = walk_files(src, &[])
+        .into_iter()
+        .filter(|p| {
+            let s = p.to_string_lossy();
+            s.ends_with(".tsx")
+                && !s.contains(".test.")
+                && !s.contains(".stories.")
+                && !s.contains("/generated/")
+        })
+        .filter(|p| {
+            std::fs::read_to_string(p)
+                .map(|t| (30..=300).contains(&t.lines().count()) && t.contains("</"))
+                .unwrap_or(false)
+        })
+        .collect();
+    files.sort();
+    let mut state = seed.wrapping_mul(0x9E37_79B9_7F4A_7C15) | 1;
+    let mut next = || {
+        state ^= state << 13;
+        state ^= state >> 7;
+        state ^= state << 17;
+        state
+    };
+    for i in (1..files.len()).rev() {
+        files.swap(i, (next() % (i as u64 + 1)) as usize);
+    }
+    for (k, p) in files.iter().skip(skip).take(n).enumerate() {
+        let text = std::fs::read_to_string(p)?;
+        let dir = out.join(format!("c{:03}", skip + k));
+        std::fs::create_dir_all(&dir)?;
+        std::fs::write(dir.join("orig.tsx"), &text)?;
+        for m in Mutation::ALL {
+            if m == Mutation::LoopToComprehension {
+                continue; // Python only
+            }
+            let v = apply(m, Lang::Tsx, &text);
+            if v != text {
+                std::fs::write(dir.join(format!("{}.tsx", m.name().replace(' ', "_"))), v)?;
+            }
+        }
+    }
+    println!(
+        "wrote {} component groups to {}",
+        files.len().saturating_sub(skip).min(n),
+        out.display()
+    );
+    Ok(())
+}