ocr scan Reviews complete files, suitable for taking over legacy systems, security-specific work, or audits of specified directories; it is a different object from Git diff review and plugin commit candidate snapshots. When the user says "review this commit," do not default to scanning the entire repository.
When to use and pre-execution checks
Clarify the scan scope: repository, directory, or specific files; explain that a full-repository scan may read a large amount of source code, and authorization from a previous commit review cannot be used as a substitute. Confirm the reasoning provider, endpoint, model, and budget; do not assume Delegation Mode supports scan. Check the current CLI's scan --path, output files, and resume capability, and do not automatically upgrade. Exclusions must be visible in the report.
Workflow / Execution and reporting
Step 1 — Determine the target and outbound boundaries
After the user confirms the complete repository or specified path, record the path, exclusions, reasoning provider, model, and budget. If the model/endpoint cannot be confirmed, stop at planning and do not execute the scan.
Step 2 — Execute or resume
Run against the agreed scope ocr scan --path <path>; when providing for host reading, use the machine-readable output/file options supported by the current CLI. After an interruption, check the session first, and only use it for the same scope and version --resume <session-id>。
Step 3 — Verification and coverage
Verify high-risk findings one by one, distinguishing confirmed from pending verification. Retain skipped/failed/budget and file counts; empty findings do not mean there is no risk.
Step 4 — Delivery
Output the review scope, engine/model, execution status, coverage statistics, key findings, and unscanned areas. The results do not apply to subsequent modified commits.
For scenario selection and output examples, see Scan decision table。
Not applicable
For PRs, branches, single commits, and ordinary working tree differences, prefer the official open-code-review; for pre-commit user authorization and staged snapshots, use the plugin-specific codereview-harness; executable dependency/credential checks are still performed by CodeGuard.
Gotchas / Common pitfalls
- Full-file scanning of a legacy repository may significantly increase costs; determine the directory and budget first.
scanandreviewresume parameters cannot be mixed.- If generated files and third-party source code are excluded, the report must explicitly state this.
- New commits made after the scan is completed are not covered by the original report.