duplicatecode 0.3.0__py3-none-win_amd64.whl → 0.3.1__py3-none-win_amd64.whl

{duplicatecode-0.3.0.dist-info → duplicatecode-0.3.1.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: duplicatecode
-Version: 0.3.0
+Version: 0.3.1
 Classifier: Programming Language :: Rust
 Classifier: Environment :: Console
 Summary: Static (LLM-free) detection of duplicate/similar code in Python, TypeScript/JavaScript, SQL and C#
@@ -10,7 +10,7 @@ Description-Content-Type: text/markdown; charset=UTF-8; variant=GFM
 
 # duplicatecode
 
-Static (LLM-free) detection of duplicate / similar code in Python, TypeScript/JavaScript (TSX/JSX), SQL and C#,
+Static by default (LLM-free, no network unless `--embed*` is used) detection of duplicate / similar code in Python, TypeScript/JavaScript (TSX/JSX), SQL and C#,
 aimed at catching an LLM re-implementing something that already exists. Input can be a git diff
 checked against existing source.
 
@@ -66,7 +66,14 @@ duplicatecode find "retry with exponential backoff" src/   # does something like
 
 ## Embeddings (bring your own key)
 
-Two optional signals, both off by default (the detector stays LLM-free unless you ask):
+Two optional signals, both off by default (the detector stays static and offline unless you ask).
+
+> **Privacy warning.** `--embed openai`, `--embed cohere`, and `--embed-code` / `--embeddings` pointed at any
+> hosted endpoint (OpenAI, Cohere, Azure, ...) **upload the source text of your units** to that provider
+> (`--embeddings` sends identifier names only). `find` embeds **every unit under the given paths**, so
+> `find ... --embed openai` uploads all of it. The local presets (`minilm`, `qwen3`, `potion`) are meant for a
+> server on loopback (default `127.0.0.1:8099`; `DUPLICATECODE_EMBED_ENDPOINT` overrides it): pointing that
+> variable at a remote host sends text there too. Do not use hosted embeddings on code you may not share.
 
 - `--embeddings` embeds identifier *names* (cheap) as an extra name-similarity signal.
 - `--embed <preset>` is the short form (`minilm`, `qwen3`, `potion`, `openai`, `cohere`; `qwen3` is about 5x slower than `minilm` on CPU, so use it with a GPU or prefer `minilm`) and implies
@@ -215,9 +222,9 @@ Self-scans of three internal repositories (Python + TypeScript), 189 pairs judge
   before trusting them. A structure-heavy `--profile reimpl` exists for renamed re-implementations
   (use with `--min-name 0`) but has no real-repo precision data yet.
 
-### Fresh held-out check (copies profile, threshold 0.6)
+### Fresh held-out check (copies profile, threshold 0.6 = the `copies` default for `scan`)
 
-A third, untouched sample of 57 pairs (nothing was tuned on it): 30% true duplicates, 47% incl. partial
+A third, untouched sample of 57 pairs (nothing was tuned on it; the `reimpl` profile has different defaults, 0.35 for `scan`, and is not covered by this sample): 30% true duplicates, 47% incl. partial
 (OneSales 0/24, MDMApp 11/24, CCMT2 6/9 true). The 50%/76% above was optimistic because it was measured on the
 pairs used to choose the weights. Test code is about half of the noise but also holds real copies
 (25% true either way), so it is kept by default; `--skip-tests` drops it.
@@ -235,7 +242,7 @@ by Haiku and Sonnet without seeing the repo. Fraction where the original is foun
 | 0.5 | 45% | 14% | 30% | 1% |
 | 0.6 | 24% | 5% | 14% | 0% |
 
-So `diff` (checking new code) defaults to threshold 0.4 while `scan` (existing copies) defaults to 0.6. About half of
+So with the `copies` profile `diff` (checking new code) defaults to threshold 0.4 while `scan` (existing copies) defaults to 0.6; the `reimpl` profile has its own lower defaults (see above). About half of
 independent re-implementations are caught; the rest are genuinely different code. The structure-heavy `reimpl`
 profile is not better on this test.
 
@@ -252,7 +259,7 @@ read/grep, two with this CLI. All distinct groups (82) were then judged blind by
 | OneSales, with CLI | 21 | 10 | 48% / 86% | 67% | 9 |
 
 Only 18 of 82 groups were found by both, so the approaches are complementary. The agents' reports are capped at 30
-groups, so the raw tool is a better measure of recall: `scan --threshold 0.6` (defaults) finds 38 of the 40 judged
+groups, so the raw tool is a better measure of recall: `scan --threshold 0.6` (the `copies` defaults) finds 38 of the 40 judged
 true duplicates (25/25 MDMApp, 13/15 OneSales) and 23 of the 25 that the LLM-only agents found independently.
 What it still misses: a differently-written picker function (same purpose, different code) and a formatFileSize
 variant with different constants. Fixed after this test: tiny same-name exact copies (`min_tokens` 20 -> 8, near-exact

duplicatecode-0.3.1.dist-info/RECORD

@@ -0,0 +1,5 @@
+duplicatecode-0.3.1.data/scripts/duplicatecode.exe,sha256=33sUDGbK4bx4ia2FRp7sr2VNCqXbDEv8d2PB-586Ydw,17516032
+duplicatecode-0.3.1.dist-info/METADATA,sha256=O5SLA8he4Y3B-lFxwEAIERR0oQAO9uvq_FcKHJVVSMM,20682
+duplicatecode-0.3.1.dist-info/WHEEL,sha256=8Aej0W0a6Cz6apA3IzJrTnxLRVLAt-w0Oh8SA3Con_c,94
+duplicatecode-0.3.1.dist-info/sboms/duplicatecode.cyclonedx.json,sha256=XyVdeAxDdFGNhcXz_Jq2o4fltkDfZerwCTzRKtU6dSo,126750
+duplicatecode-0.3.1.dist-info/RECORD,,

{duplicatecode-0.3.0.dist-info → duplicatecode-0.3.1.dist-info}/sboms/duplicatecode.cyclonedx.json

@@ -2,9 +2,9 @@
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
   "version": 1,
-  "serialNumber": "urn:uuid:ab06876c-110e-4771-94eb-2edeb8b63aea",
+  "serialNumber": "urn:uuid:f5087dff-39cc-49e3-b7f1-add6f1b591d6",
   "metadata": {
-    "timestamp": "2026-10-07T07:39:59.027661900Z",
+    "timestamp": "2026-10-07T09:33:02.890409000Z",
     "tools": [
       {
         "vendor": "CycloneDX",
@@ -14,9 +14,9 @@
     ],
     "component": {
       "type": "application",
-      "bom-ref": "path+file:///D:/a/duplicatecode/duplicatecode/crates/duplicatecode-cli#duplicatecode@0.3.0",
+      "bom-ref": "path+file:///D:/a/duplicatecode/duplicatecode/crates/duplicatecode-cli#duplicatecode@0.3.1",
       "name": "duplicatecode",
-      "version": "0.3.0",
+      "version": "0.3.1",
       "description": "CLI to detect duplicate/similar code in Python and TypeScript",
       "scope": "required",
       "licenses": [
@@ -24,14 +24,14 @@
           "expression": "MIT"
         }
       ],
-      "purl": "pkg:cargo/duplicatecode@0.3.0?download_url=file://.",
+      "purl": "pkg:cargo/duplicatecode@0.3.1?download_url=file://.",
       "components": [
         {
           "type": "application",
-          "bom-ref": "path+file:///D:/a/duplicatecode/duplicatecode/crates/duplicatecode-cli#duplicatecode@0.3.0 bin-target-0",
+          "bom-ref": "path+file:///D:/a/duplicatecode/duplicatecode/crates/duplicatecode-cli#duplicatecode@0.3.1 bin-target-0",
           "name": "duplicatecode",
-          "version": "0.3.0",
-          "purl": "pkg:cargo/duplicatecode@0.3.0?download_url=file://.#src/main.rs"
+          "version": "0.3.1",
+          "purl": "pkg:cargo/duplicatecode@0.3.1?download_url=file://.#src/main.rs"
         }
       ]
     },
@@ -45,9 +45,9 @@
   "components": [
     {
       "type": "library",
-      "bom-ref": "path+file:///D:/a/duplicatecode/duplicatecode/crates/duplicatecode-engine#0.3.0",
+      "bom-ref": "path+file:///D:/a/duplicatecode/duplicatecode/crates/duplicatecode-engine#0.3.1",
       "name": "duplicatecode-engine",
-      "version": "0.3.0",
+      "version": "0.3.1",
       "description": "Static duplicate/similar code detection engine for Python, TypeScript/JavaScript, SQL and C#",
       "scope": "required",
       "licenses": [
@@ -55,7 +55,7 @@
           "expression": "MIT"
         }
       ],
-      "purl": "pkg:cargo/duplicatecode-engine@0.3.0?download_url=file://..\\duplicatecode-engine"
+      "purl": "pkg:cargo/duplicatecode-engine@0.3.1?download_url=file://..\\duplicatecode-engine"
     },
     {
       "type": "library",
@@ -3324,11 +3324,11 @@
   ],
   "dependencies": [
     {
-      "ref": "path+file:///D:/a/duplicatecode/duplicatecode/crates/duplicatecode-cli#duplicatecode@0.3.0",
+      "ref": "path+file:///D:/a/duplicatecode/duplicatecode/crates/duplicatecode-cli#duplicatecode@0.3.1",
       "dependsOn": [
         "registry+https://github.com/rust-lang/crates.io-index#anyhow@1.0.104",
         "registry+https://github.com/rust-lang/crates.io-index#clap@4.6.7",
-        "path+file:///D:/a/duplicatecode/duplicatecode/crates/duplicatecode-engine#0.3.0",
+        "path+file:///D:/a/duplicatecode/duplicatecode/crates/duplicatecode-engine#0.3.1",
         "registry+https://github.com/rust-lang/crates.io-index#rayon@1.12.0",
         "registry+https://github.com/rust-lang/crates.io-index#serde@1.0.229",
         "registry+https://github.com/rust-lang/crates.io-index#serde_json@1.0.151",
@@ -3337,7 +3337,7 @@
       ]
     },
     {
-      "ref": "path+file:///D:/a/duplicatecode/duplicatecode/crates/duplicatecode-engine#0.3.0",
+      "ref": "path+file:///D:/a/duplicatecode/duplicatecode/crates/duplicatecode-engine#0.3.1",
       "dependsOn": [
         "registry+https://github.com/rust-lang/crates.io-index#ignore@0.4.33",
         "registry+https://github.com/rust-lang/crates.io-index#serde@1.0.229",

duplicatecode-0.3.0.dist-info/RECORD

@@ -1,5 +0,0 @@
-duplicatecode-0.3.0.data/scripts/duplicatecode.exe,sha256=21yAmm_HzANC-d5pxUqpwsyxrAxL8PuGrK59ya4sodQ,17500672
-duplicatecode-0.3.0.dist-info/METADATA,sha256=NatafxHYcIf4MIhEVtm-ioWP22fwXvQsBAzpc-SGRvI,19741
-duplicatecode-0.3.0.dist-info/WHEEL,sha256=8Aej0W0a6Cz6apA3IzJrTnxLRVLAt-w0Oh8SA3Con_c,94
-duplicatecode-0.3.0.dist-info/sboms/duplicatecode.cyclonedx.json,sha256=uPjugBPtNH7_f99oGPEDmrjDbAcAcj-bKIOlBsWrRgw,126750
-duplicatecode-0.3.0.dist-info/RECORD,,