airom repo <url|path> scans a git repository. The target is interpreted by what it is:
Local worktree
Remote URL
An existing local path always wins: if ./foo exists on disk, it is scanned as a worktree even if a remote of the same name exists. Anything that is neither an existing path nor a recognized remote URL is a usage error.
airom scan <target> reaches repo automatically when the target is not an existing local path but does look like a git URL. Use the repo: prefix to force it.

​
Recognized remote URLs

https://, http://, ssh://, git://, and scp-like git@host:path.

​
Remote clones need git on PATH

Remote URLs are cloned by invoking the git binary. There is no in-process clone fallback: if no git is on PATH, AIROM fails with a clear error rather than silently doing something else.
The clone is deliberately minimal:
What AIROM runs
Clones never prompt for credentials — AIROM sets GIT_TERMINAL_PROMPT=0, so a private repo fails fast instead of hanging on an interactive password prompt. Clone a private repo yourself and scan the local worktree.
The temp checkout is removed when the scan finishes.

​
Git provenance

The repo source captures provenance for the worktree it scans, best-effort: When a git binary is present it is authoritative. When it is not, HEAD and the origin URL are still recovered by reading .git/HEAD, its target ref (loose or packed), and .git/config directly. Every step is best-effort: pointing repo at a directory that is not a git worktree yields empty provenance and the scan proceeds normally. The resolved commit becomes the scan’s content identity (git:<commit>), falling back to the target string when no commit can be resolved.
The AIBOM’s source block currently records the source kind and target only. Populating the git provenance block in the emitted document is not wired up yet — do not expect commit or dirty to appear in the output today.

​
Everything from fs applies

A repo scan is a directory scan of the worktree. Ignore handling (.gitignore + .airomignore stacks, non-overridable default skips, --ignore globs), --max-file-size, --io-budget, --parallel, and --select all behave exactly as documented in /scanning/filesystem.
Repo scan with the usual knobs
Note that .git/ itself is a non-overridable default skip, so repository internals are never walked as scan content.

​
Working without a network

The global --offline flag is accepted and parsed, but it is not yet enforced: it does not currently block a remote clone. Do not rely on it as a network guarantee.
To scan a repository with no network access, clone it yourself and point repo at the local worktree — a local path is never fetched over the network.
No network: local worktree only