# keeper-security/commander architecture

> Architecture diagram of the GitHub repository keeper-security/commander, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-30). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/keeper-security/commander
- Repository: https://github.com/keeper-security/commander

## Overview

Keeper Commander is a CLI and terminal-UI client for Keeper Password Manager and KeeperPAM, with an optional REST service mode. The principal workflow is a user issuing commands or browsing the vault, with Commander handling session state and encrypted API communication to Keeper; command branches also support administration, imports, PAM sessions and security operations. The graph preserves documented capabilities and major runtime layers. Some paths are represented at their existing directory because their specific implementation was not sampled; links based only on broad README descriptions are documented rather than source-verified.

Main entry points: [`keepercommander/api.py`](https://github.com/keeper-security/commander/blob/master/keepercommander/api.py) (Keeper API Client), [`keepercommander/commands/supershell/app.py`](https://github.com/keeper-security/commander/blob/master/keepercommander/commands/supershell/app.py) (Vault TUI), [`keepercommander/service/api/routes.py`](https://github.com/keeper-security/commander/blob/master/keepercommander/service/api/routes.py) (API Routes), [`keepercommander/cli.py`](https://github.com/keeper-security/commander/blob/master/keepercommander/cli.py) (Command Interface)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_cli["CLI and Vault"]
  node_cli["Command Interface<br/>[cli.py]"]
  node_commands["Command Handlers"]
  node_supershell["Vault TUI<br/>[app.py]"]
  node_record["Vault Records<br/>[record.py]"]
end

subgraph group_core["Client Core"]
  node_session["Session State<br/>[params.py]"]
  node_crypto["Encryption<br/>[crypto.py]"]
  node_api["Keeper API Client<br/>[api.py]"]
  node_transport["Encrypted Transport<br/>[rest_api.py]"]
end

subgraph group_admin["Administration and PAM"]
  node_admin["Enterprise Admin<br/>[enterprise.py]"]
  node_pam["PAM Operations"]
  node_pam_router["PAM Gateway Routing<br/>[router_helper.py]"]
  node_pam_launch["Session Launch<br/>[launch.py]"]
end

subgraph group_data["Import and Storage"]
  node_import["Import and Export<br/>[importer.py]"]
  node_json["JSON Exchange<br/>[json.py]"]
  node_local_store[("Local Storage<br/>[sqlite_dao.py]")]
end

subgraph group_service["Service Mode"]
  node_service_manager["Service Lifecycle<br/>[service_manager.py]"]
  node_service_app["REST Application<br/>[app.py]"]
  node_routes["API Routes<br/>[routes.py]"]
  node_service_config["Service Configuration<br/>[service_config.py]"]
  node_request_queue["Request Queue<br/>[request_queue.py]"]
end

node_user(("Commander User"))
node_keeper(("Keeper Cloud"))

node_user -->|"issues commands"| node_cli
node_user -->|"browses vault"| node_supershell
node_cli -.->|"dispatches"| node_commands
node_commands -.->|"uses client"| node_api
node_supershell -->|"browses records"| node_record
node_supershell -->|"reads state"| node_session
node_record -.->|"uses client"| node_api
node_api -->|"uses session"| node_session
node_api -->|"encrypts data"| node_crypto
node_api -.->|"sends requests"| node_transport
node_transport -->|"exchanges API data"| node_keeper
node_user -->|"manages enterprise"| node_admin
node_user -->|"controls privileged access"| node_pam
node_pam -.->|"routes gateway work"| node_pam_router
node_user -->|"launches sessions"| node_pam_launch
node_user -->|"imports or exports"| node_import
node_import -->|"uses JSON format"| node_json
node_user -.->|"starts service"| node_service_manager
node_service_manager -->|"creates app"| node_service_app
node_service_app -->|"initializes routes"| node_routes
node_routes -->|"loads configuration"| node_service_config
node_routes -->|"starts queue"| node_request_queue

click node_cli "https://github.com/keeper-security/commander/blob/master/keepercommander/cli.py"
click node_commands "https://github.com/keeper-security/commander/tree/master/keepercommander/commands"
click node_supershell "https://github.com/keeper-security/commander/blob/master/keepercommander/commands/supershell/app.py"
click node_record "https://github.com/keeper-security/commander/blob/master/keepercommander/commands/record.py"
click node_session "https://github.com/keeper-security/commander/blob/master/keepercommander/params.py"
click node_crypto "https://github.com/keeper-security/commander/blob/master/keepercommander/crypto.py"
click node_api "https://github.com/keeper-security/commander/blob/master/keepercommander/api.py"
click node_transport "https://github.com/keeper-security/commander/blob/master/keepercommander/rest_api.py"
click node_admin "https://github.com/keeper-security/commander/blob/master/keepercommander/commands/enterprise.py"
click node_pam "https://github.com/keeper-security/commander/tree/master/keepercommander/commands/pam"
click node_pam_router "https://github.com/keeper-security/commander/blob/master/keepercommander/commands/pam/router_helper.py"
click node_pam_launch "https://github.com/keeper-security/commander/blob/master/keepercommander/commands/pam_launch/launch.py"
click node_import "https://github.com/keeper-security/commander/blob/master/keepercommander/importer/importer.py"
click node_json "https://github.com/keeper-security/commander/blob/master/keepercommander/importer/json/json.py"
click node_local_store "https://github.com/keeper-security/commander/blob/master/keepercommander/storage/sqlite_dao.py"
click node_service_manager "https://github.com/keeper-security/commander/blob/master/keepercommander/service/core/service_manager.py"
click node_service_app "https://github.com/keeper-security/commander/blob/master/keepercommander/service/app.py"
click node_routes "https://github.com/keeper-security/commander/blob/master/keepercommander/service/api/routes.py"
click node_service_config "https://github.com/keeper-security/commander/blob/master/keepercommander/service/config/service_config.py"
click node_request_queue "https://github.com/keeper-security/commander/blob/master/keepercommander/service/core/request_queue.py"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_cli,node_commands,node_supershell,node_record,node_user toneBlue
class node_session,node_crypto,node_api,node_transport toneAmber
class node_admin,node_pam,node_pam_router,node_pam_launch toneMint
class node_import,node_json,node_local_store toneRose
class node_service_manager,node_service_app,node_routes,node_service_config,node_request_queue,node_keeper toneIndigo
```

## Components

### CLI and Vault

- [Command Interface](https://github.com/keeper-security/commander/blob/master/keepercommander/cli.py): `keepercommander/cli.py`
- [Command Handlers](https://github.com/keeper-security/commander/tree/master/keepercommander/commands): `keepercommander/commands`
- [Vault TUI](https://github.com/keeper-security/commander/blob/master/keepercommander/commands/supershell/app.py): `keepercommander/commands/supershell/app.py`
- [Vault Records](https://github.com/keeper-security/commander/blob/master/keepercommander/commands/record.py): `keepercommander/commands/record.py`

### Client Core

- [Session State](https://github.com/keeper-security/commander/blob/master/keepercommander/params.py): `keepercommander/params.py`
- [Encryption](https://github.com/keeper-security/commander/blob/master/keepercommander/crypto.py): `keepercommander/crypto.py`
- [Keeper API Client](https://github.com/keeper-security/commander/blob/master/keepercommander/api.py): `keepercommander/api.py`
- [Encrypted Transport](https://github.com/keeper-security/commander/blob/master/keepercommander/rest_api.py): `keepercommander/rest_api.py`

### Administration and PAM

- [Enterprise Admin](https://github.com/keeper-security/commander/blob/master/keepercommander/commands/enterprise.py): `keepercommander/commands/enterprise.py`
- [PAM Operations](https://github.com/keeper-security/commander/tree/master/keepercommander/commands/pam): `keepercommander/commands/pam`
- [PAM Gateway Routing](https://github.com/keeper-security/commander/blob/master/keepercommander/commands/pam/router_helper.py): `keepercommander/commands/pam/router_helper.py`
- [Session Launch](https://github.com/keeper-security/commander/blob/master/keepercommander/commands/pam_launch/launch.py): `keepercommander/commands/pam_launch/launch.py`

### Import and Storage

- [Import and Export](https://github.com/keeper-security/commander/blob/master/keepercommander/importer/importer.py): `keepercommander/importer/importer.py`
- [JSON Exchange](https://github.com/keeper-security/commander/blob/master/keepercommander/importer/json/json.py): `keepercommander/importer/json/json.py`
- [Local Storage](https://github.com/keeper-security/commander/blob/master/keepercommander/storage/sqlite_dao.py): `keepercommander/storage/sqlite_dao.py`

### Service Mode

- [Service Lifecycle](https://github.com/keeper-security/commander/blob/master/keepercommander/service/core/service_manager.py): `keepercommander/service/core/service_manager.py`
- [REST Application](https://github.com/keeper-security/commander/blob/master/keepercommander/service/app.py): `keepercommander/service/app.py`
- [API Routes](https://github.com/keeper-security/commander/blob/master/keepercommander/service/api/routes.py): `keepercommander/service/api/routes.py`
- [Service Configuration](https://github.com/keeper-security/commander/blob/master/keepercommander/service/config/service_config.py): `keepercommander/service/config/service_config.py`
- [Request Queue](https://github.com/keeper-security/commander/blob/master/keepercommander/service/core/request_queue.py): `keepercommander/service/core/request_queue.py`

### Other components

- **Commander User**
- **Keeper Cloud**

## Connections

- Commander User → Command Interface: issues commands
- Commander User → Vault TUI: browses vault
- Command Interface → Command Handlers: dispatches (evidence: `keepercommander/commands/supershell/app.py`)
- Command Handlers → Keeper API Client: uses client (evidence: `keepercommander/commands/supershell/app.py`)
- Vault TUI → Vault Records: browses records (evidence: `keepercommander/commands/supershell/app.py`)
- Vault TUI → Session State: reads state (evidence: `keepercommander/commands/supershell/app.py`)
- Vault Records → Keeper API Client: uses client
- Keeper API Client → Session State: uses session (evidence: `keepercommander/api.py`)
- Keeper API Client → Encryption: encrypts data (evidence: `keepercommander/api.py`)
- Keeper API Client → Encrypted Transport: sends requests (evidence: `keepercommander/api.py`)
- Encrypted Transport → Keeper Cloud: exchanges API data (evidence: `keepercommander/rest_api.py`)
- Commander User → Enterprise Admin: manages enterprise
- Commander User → PAM Operations: controls privileged access
- PAM Operations → PAM Gateway Routing: routes gateway work (evidence: `keepercommander/commands/pam/router_helper.py`)
- Commander User → Session Launch: launches sessions
- Commander User → Import and Export: imports or exports
- Import and Export → JSON Exchange: uses JSON format (evidence: `keepercommander/importer/json/json.py`)
- Commander User → Service Lifecycle: starts service
- Service Lifecycle → REST Application: creates app (evidence: `keepercommander/service/core/service_manager.py`)
- REST Application → API Routes: initializes routes (evidence: `keepercommander/service/app.py`)
- API Routes → Service Configuration: loads configuration (evidence: `keepercommander/service/api/routes.py`)
- API Routes → Request Queue: starts queue (evidence: `keepercommander/service/api/routes.py`)