# amosroger91/clam-desktop architecture

> Architecture diagram of the GitHub repository amosroger91/clam-desktop, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-30). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/amosroger91/clam-desktop
- Repository: https://github.com/amosroger91/clam-desktop

## Overview

Sentinel AV is a Windows desktop companion for ClamAV. Users configure protection in the desktop app, then run on-demand or scheduled scans, or optionally enable continuous file-change monitoring. Scan results feed the dashboard and durable history; confirmed threats can be quarantined and later reviewed or restored. Optional YARA-X, Radare2, and local behavior snapshots add review evidence. The README documents these capabilities; edges from sampled source or the SOURCE INDEX are cited, while links relying only on broader documented behavior are marked as unverified.

Main entry points: [`src/main.cjs`](https://github.com/amosroger91/clam-desktop/blob/main/src/main.cjs) (App coordinator), [`src/monitor-agent.cjs`](https://github.com/amosroger91/clam-desktop/blob/main/src/monitor-agent.cjs) (Monitor agent), [`ui/app.js`](https://github.com/amosroger91/clam-desktop/blob/main/ui/app.js) (Desktop UI), [`src/scanner.cjs`](https://github.com/amosroger91/clam-desktop/blob/main/src/scanner.cjs) (Scan execution)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_desktop["Desktop experience"]
  node_desktop_ui["Desktop UI<br/>[app.js]"]
  node_app["App coordinator<br/>[main.cjs]"]
end

subgraph group_scanning["Scanning and results"]
  node_scheduler["Scan scheduler<br/>[scheduler.cjs]"]
  node_scanner["Scan execution<br/>[scanner.cjs]"]
  node_engine["ClamAV engine<br/>[clamd.cjs]"]
  node_database["Definition checks<br/>[database.cjs]"]
  node_coverage["Coverage assessment<br/>[coverage.cjs]"]
  node_detections["Detection history<br/>[detections.cjs]"]
  node_journal["Scan journal<br/>[journal.cjs]"]
  node_quarantine["Quarantine and restore<br/>[quarantine.cjs]"]
end

subgraph group_monitoring["Continuous monitoring"]
  node_monitor_client["Monitor client<br/>[monitor-client.cjs]"]
  node_monitor_agent["Monitor agent<br/>[monitor-agent.cjs]"]
  node_monitor_rpc["Monitor RPC<br/>[monitor-rpc.cjs]"]
  node_watcher["Folder watcher<br/>[monitor-watch.cjs]"]
  node_queue["Scan queue<br/>[monitor-queue.cjs]"]
  node_monitor_settings["Monitor policies"]
  node_analysis["Analysis layers<br/>[analysis-tools.cjs]"]
  node_rule_feed["YARA rule feed<br/>[rule-feed.cjs]"]
  node_behavior["Behavior snapshots<br/>[behavior.cjs]"]
  node_clam_service["Windows monitor service<br/>[SentinelMonitor.cs]"]
end

subgraph group_state["Protection state"]
  node_store[("Versioned storage<br/>[store.cjs]")]
  node_state["App state<br/>[state.cjs]"]
  node_health["Health status<br/>[health.cjs]"]
end

node_user(("User"))

node_user -->|"configures and reviews"| node_desktop_ui
node_desktop_ui -.->|"requests actions"| node_app
node_app -->|"runs schedules"| node_scheduler
node_app -->|"starts scans"| node_scanner
node_scanner -.->|"scans files"| node_engine
node_app -->|"checks definitions"| node_database
node_app -->|"assesses scan coverage"| node_coverage
node_app -->|"records findings"| node_detections
node_app -->|"journals scans"| node_journal
node_app -->|"manages threats"| node_quarantine
node_app -->|"controls monitoring"| node_monitor_client
node_monitor_client -->|"sends requests"| node_monitor_rpc
node_monitor_agent -.->|"serves requests"| node_monitor_rpc
node_monitor_agent -->|"watches folders"| node_watcher
node_monitor_agent -->|"dispatches scans"| node_queue
node_queue -.->|"scans queued files"| node_engine
node_monitor_agent -->|"validates policies"| node_monitor_settings
node_monitor_agent -->|"runs analysis layers"| node_analysis
node_analysis -->|"loads active rules"| node_rule_feed
node_monitor_agent -->|"collects snapshots"| node_behavior
node_monitor_agent -->|"quarantines threats"| node_quarantine
node_app -->|"persists records"| node_store
node_app -->|"loads app state"| node_state
node_state -->|"reads and writes"| node_store
node_app -->|"publishes status"| node_health
node_clam_service -.->|"keeps monitoring running"| node_monitor_agent

click node_desktop_ui "https://github.com/amosroger91/clam-desktop/blob/main/ui/app.js"
click node_app "https://github.com/amosroger91/clam-desktop/blob/main/src/main.cjs"
click node_scheduler "https://github.com/amosroger91/clam-desktop/blob/main/src/scheduler.cjs"
click node_scanner "https://github.com/amosroger91/clam-desktop/blob/main/src/scanner.cjs"
click node_engine "https://github.com/amosroger91/clam-desktop/blob/main/src/clamd.cjs"
click node_database "https://github.com/amosroger91/clam-desktop/blob/main/src/database.cjs"
click node_coverage "https://github.com/amosroger91/clam-desktop/blob/main/src/coverage.cjs"
click node_detections "https://github.com/amosroger91/clam-desktop/blob/main/src/detections.cjs"
click node_journal "https://github.com/amosroger91/clam-desktop/blob/main/src/journal.cjs"
click node_quarantine "https://github.com/amosroger91/clam-desktop/blob/main/src/quarantine.cjs"
click node_monitor_client "https://github.com/amosroger91/clam-desktop/blob/main/src/monitor-client.cjs"
click node_monitor_agent "https://github.com/amosroger91/clam-desktop/blob/main/src/monitor-agent.cjs"
click node_monitor_rpc "https://github.com/amosroger91/clam-desktop/blob/main/src/monitor-rpc.cjs"
click node_watcher "https://github.com/amosroger91/clam-desktop/blob/main/src/monitor-watch.cjs"
click node_queue "https://github.com/amosroger91/clam-desktop/blob/main/src/monitor-queue.cjs"
click node_monitor_settings "https://github.com/amosroger91/clam-desktop/blob/main/src/monitor-settings.cjs"
click node_analysis "https://github.com/amosroger91/clam-desktop/blob/main/src/analysis-tools.cjs"
click node_rule_feed "https://github.com/amosroger91/clam-desktop/blob/main/src/rule-feed.cjs"
click node_behavior "https://github.com/amosroger91/clam-desktop/blob/main/src/behavior.cjs"
click node_store "https://github.com/amosroger91/clam-desktop/blob/main/src/store.cjs"
click node_state "https://github.com/amosroger91/clam-desktop/blob/main/src/state.cjs"
click node_health "https://github.com/amosroger91/clam-desktop/blob/main/src/health.cjs"
click node_clam_service "https://github.com/amosroger91/clam-desktop/blob/main/service/SentinelMonitor.cs"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_desktop_ui,node_app,node_user toneBlue
class node_scheduler,node_scanner,node_engine,node_database,node_coverage,node_detections,node_journal,node_quarantine toneAmber
class node_monitor_client,node_monitor_agent,node_monitor_rpc,node_watcher,node_queue,node_monitor_settings,node_analysis,node_rule_feed,node_behavior,node_clam_service toneMint
class node_store,node_state,node_health toneRose
```

## Components

### Desktop experience

- [Desktop UI](https://github.com/amosroger91/clam-desktop/blob/main/ui/app.js): `ui/app.js`
- [App coordinator](https://github.com/amosroger91/clam-desktop/blob/main/src/main.cjs): `src/main.cjs`

### Scanning and results

- [Scan scheduler](https://github.com/amosroger91/clam-desktop/blob/main/src/scheduler.cjs): `src/scheduler.cjs`
- [Scan execution](https://github.com/amosroger91/clam-desktop/blob/main/src/scanner.cjs): `src/scanner.cjs`
- [ClamAV engine](https://github.com/amosroger91/clam-desktop/blob/main/src/clamd.cjs): `src/clamd.cjs`
- [Definition checks](https://github.com/amosroger91/clam-desktop/blob/main/src/database.cjs): `src/database.cjs`
- [Coverage assessment](https://github.com/amosroger91/clam-desktop/blob/main/src/coverage.cjs): `src/coverage.cjs`
- [Detection history](https://github.com/amosroger91/clam-desktop/blob/main/src/detections.cjs): `src/detections.cjs`
- [Scan journal](https://github.com/amosroger91/clam-desktop/blob/main/src/journal.cjs): `src/journal.cjs`
- [Quarantine and restore](https://github.com/amosroger91/clam-desktop/blob/main/src/quarantine.cjs): `src/quarantine.cjs`

### Continuous monitoring

- [Monitor client](https://github.com/amosroger91/clam-desktop/blob/main/src/monitor-client.cjs): `src/monitor-client.cjs`
- [Monitor agent](https://github.com/amosroger91/clam-desktop/blob/main/src/monitor-agent.cjs): `src/monitor-agent.cjs`
- [Monitor RPC](https://github.com/amosroger91/clam-desktop/blob/main/src/monitor-rpc.cjs): `src/monitor-rpc.cjs`
- [Folder watcher](https://github.com/amosroger91/clam-desktop/blob/main/src/monitor-watch.cjs): `src/monitor-watch.cjs`
- [Scan queue](https://github.com/amosroger91/clam-desktop/blob/main/src/monitor-queue.cjs): `src/monitor-queue.cjs`
- [Monitor policies](https://github.com/amosroger91/clam-desktop/blob/main/src/monitor-settings.cjs): `src/monitor-settings.cjs`
- [Analysis layers](https://github.com/amosroger91/clam-desktop/blob/main/src/analysis-tools.cjs): `src/analysis-tools.cjs`
- [YARA rule feed](https://github.com/amosroger91/clam-desktop/blob/main/src/rule-feed.cjs): `src/rule-feed.cjs`
- [Behavior snapshots](https://github.com/amosroger91/clam-desktop/blob/main/src/behavior.cjs): `src/behavior.cjs`
- [Windows monitor service](https://github.com/amosroger91/clam-desktop/blob/main/service/SentinelMonitor.cs): `service/SentinelMonitor.cs`

### Protection state

- [Versioned storage](https://github.com/amosroger91/clam-desktop/blob/main/src/store.cjs): `src/store.cjs`
- [App state](https://github.com/amosroger91/clam-desktop/blob/main/src/state.cjs): `src/state.cjs`
- [Health status](https://github.com/amosroger91/clam-desktop/blob/main/src/health.cjs): `src/health.cjs`

### Other components

- **User**

## Connections

- User → Desktop UI: configures and reviews
- Desktop UI → App coordinator: requests actions
- App coordinator → Scan scheduler: runs schedules (evidence: `src/main.cjs`)
- App coordinator → Scan execution: starts scans (evidence: `src/main.cjs`)
- Scan execution → ClamAV engine: scans files
- App coordinator → Definition checks: checks definitions (evidence: `src/main.cjs`)
- App coordinator → Coverage assessment: assesses scan coverage (evidence: `src/main.cjs`)
- App coordinator → Detection history: records findings (evidence: `src/main.cjs`)
- App coordinator → Scan journal: journals scans (evidence: `src/main.cjs`)
- App coordinator → Quarantine and restore: manages threats (evidence: `src/main.cjs`)
- App coordinator → Monitor client: controls monitoring (evidence: `src/main.cjs`)
- Monitor client → Monitor RPC: sends requests (evidence: `src/monitor-client.cjs`)
- Monitor agent → Monitor RPC: serves requests (evidence: `src/monitor-agent.cjs`)
- Monitor agent → Folder watcher: watches folders (evidence: `src/monitor-agent.cjs`)
- Monitor agent → Scan queue: dispatches scans (evidence: `src/monitor-agent.cjs`)
- Scan queue → ClamAV engine: scans queued files
- Monitor agent → Monitor policies: validates policies (evidence: `src/monitor-agent.cjs`)
- Monitor agent → Analysis layers: runs analysis layers (evidence: `src/monitor-agent.cjs`)
- Analysis layers → YARA rule feed: loads active rules (evidence: `src/analysis-tools.cjs`)
- Monitor agent → Behavior snapshots: collects snapshots (evidence: `src/monitor-agent.cjs`)
- Monitor agent → Quarantine and restore: quarantines threats (evidence: `src/monitor-agent.cjs`)
- App coordinator → Versioned storage: persists records (evidence: `src/main.cjs`)
- App coordinator → App state: loads app state (evidence: `src/main.cjs`)
- App state → Versioned storage: reads and writes (evidence: `src/state.cjs`)
- App coordinator → Health status: publishes status (evidence: `src/main.cjs`)
- Windows monitor service → Monitor agent: keeps monitoring running