How amosroger91/clam-desktop works
Sentinel AV is a Windows desktop companion for ClamAV. Users configure protection in the desktop app, then run on-demand or scheduled scans, or optionally enable continuous file-change monitoring. Scan results feed the dashboard and durable history; confirmed threats can be quarantined and later reviewed or restored. Optional YARA-X, Radare2, and local behavior snapshots add review evidence. The README documents these capabilities; edges from sampled source or the SOURCE INDEX are cited, while links relying only on broader documented behavior are marked as unverified.
Main entry points: main.cjs App coordinator · monitor-agent.cjs Monitor agent · app.js Desktop UI · scanner.cjs Scan execution
Components 24
Desktop experience
- Desktop UI
ui/app.js - App coordinator
src/main.cjs
Scanning and results
- Scan scheduler
src/scheduler.cjs - Scan execution
src/scanner.cjs - ClamAV engine
src/clamd.cjs - Definition checks
src/database.cjs - Coverage assessment
src/coverage.cjs - Detection history
src/detections.cjs - Scan journal
src/journal.cjs - Quarantine and restore
src/quarantine.cjs
Continuous monitoring
- Monitor client
src/monitor-client.cjs - Monitor agent
src/monitor-agent.cjs - Monitor RPC
src/monitor-rpc.cjs - Folder watcher
src/monitor-watch.cjs - Scan queue
src/monitor-queue.cjs - Monitor policies
src/monitor-settings.cjs - Analysis layers
src/analysis-tools.cjs - YARA rule feed
src/rule-feed.cjs - Behavior snapshots
src/behavior.cjs - Windows monitor service
service/SentinelMonitor.cs
Protection state
- Versioned storage
src/store.cjs - App state
src/state.cjs - Health status
src/health.cjs
Other components
- User
Connections 26
- User → Desktop UI: configures and reviews
- Desktop UI → App coordinator: requests actions
- App coordinator → Scan scheduler: runs schedules
src/main.cjs - App coordinator → Scan execution: starts scans
src/main.cjs - Scan execution → ClamAV engine: scans files
- App coordinator → Definition checks: checks definitions
src/main.cjs - App coordinator → Coverage assessment: assesses scan coverage
src/main.cjs - App coordinator → Detection history: records findings
src/main.cjs - App coordinator → Scan journal: journals scans
src/main.cjs - App coordinator → Quarantine and restore: manages threats
src/main.cjs - App coordinator → Monitor client: controls monitoring
src/main.cjs - Monitor client → Monitor RPC: sends requests
src/monitor-client.cjs - Monitor agent → Monitor RPC: serves requests
src/monitor-agent.cjs - Monitor agent → Folder watcher: watches folders
src/monitor-agent.cjs - Monitor agent → Scan queue: dispatches scans
src/monitor-agent.cjs - Scan queue → ClamAV engine: scans queued files
- Monitor agent → Monitor policies: validates policies
src/monitor-agent.cjs - Monitor agent → Analysis layers: runs analysis layers
src/monitor-agent.cjs - Analysis layers → YARA rule feed: loads active rules
src/analysis-tools.cjs - Monitor agent → Behavior snapshots: collects snapshots
src/monitor-agent.cjs - Monitor agent → Quarantine and restore: quarantines threats
src/monitor-agent.cjs - App coordinator → Versioned storage: persists records
src/main.cjs - App coordinator → App state: loads app state
src/main.cjs - App state → Versioned storage: reads and writes
src/state.cjs - App coordinator → Health status: publishes status
src/main.cjs - Windows monitor service → Monitor agent: keeps monitoring running