Repository navigation
feat(desktop): reduce EDR/security agent CPU usage from idle terminals and active agent sessions #3235
Description
Background
Users on machines with kernel-level EDR agents (e.g. Elastic Endpoint) experience sustained high CPU usage (>100–200%) from the security agent even when Superset is completely idle. EDR agents intercept and inspect every file open, stat, and process spawn system-wide, so Superset's background activity directly drives the EDR's CPU load.
Root causes identified
Two independent sources were found via fs_usage and sample profiling on macOS:
1. Scrollback file — continuous writes on every PTY event
HistoryWriter.write() calls stream.write() on every PTY data chunk. With active Claude Code agent sessions producing dense terminal output, this causes scrollback.bin to be modified hundreds of times per second per session. Each mtime update causes the EDR to re-stat and re-open the file for inspection.
2. Port scanner — ps + lsof spawned every 2.5s per session
PortManager runs a periodic scan every 2,500ms that calls pidtree (spawning ps) for each registered terminal session, then runs lsof across all discovered PIDs. With 13 open sessions this produces ~14 process spawns every 2.5 seconds. EDR agents intercept every process spawn and monitor the files those processes open — lsof in particular opens thousands of file descriptors per invocation as it enumerates all sockets system-wide.
Proposed fixes
-
Scrollback write debounce (
terminal-history.ts): Buffer PTY output in memory and flush to disk at most once every 250ms. Reduces file modification events by batching many small PTY chunks into a single write. No impact on terminal responsiveness — the in-memory buffer is the source of truth; disk writes are just for cold restore. -
Port scan interval (
port-manager.ts): Increase from 2,500ms → 10,000ms. The hint-based scan (fires within 500ms of seeing "listening on port X" in output) handles prompt detection; the periodic scan is just a safety-net sweep. -
Skip idle sessions in periodic scan (
port-manager.ts): Skip any session that has no currently-detected ports and has not seen port-hint output in the last 60 seconds. A machine with 13 idle terminal sessions running no dev servers produces zerops/lsofspawns per cycle. Hint scans still fire immediately when a dev server starts.
Result
With all three fixes applied, Elastic Endpoint CPU drops from >200% (sustained, with agents running) and ~120% (idle terminals) to under 20% most of the time with 13 open sessions. Occasional spikes to ~60% appear to be within Elastic Endpoint's normal operating range independent of Superset. Baseline CPU without Superset open is <2%, so some overhead remains, but it is well within a tolerable range.
Not addressed
Claude Code agent sessions (each instance continuously stats .claude.json, .git/HEAD, skills, and commands). This is Claude Code's own behavior and outside Superset's control, but it contributes significantly when multiple agents are running.
Activity
perf(desktop): debounce scrollback writes to reduce EDR file-inspecti…
perf(desktop): increase port scan interval and skip scan when no sess…
fix: solve #3235 — reduce EDR/security agent CPU from idle terminals
perf(desktop): skip periodic port scan for idle sessions with no dev …
felixbarny commentedon Apr 7, 2026
Three independent PRs implementing the proposed fixes:
terminal-history.ts)port-manager.ts)port-manager.ts)felixbarny commentedon Apr 7, 2026
PRs #3237, #3238, and #3239 have been closed in favour of #3236, which was opened by the triage agent and covers all three fixes in a single PR. #3236 is a better implementation overall:
flush()hang bug we missed: the original code always registered adrainlistener, but ifstream.write()never returnedfalse,drainnever fires andflush()would hang indefinitelylastHintActivitymap rather than embedding the timestamp in the session interfacesunregisterDaemonSession(we overlooked this)A review comment has been left on #3236 suggesting one additional guard: short-circuiting
scanAllSessions()when no sessions are registered at all.felixbarny commentedon Apr 20, 2026
@saddlepaddle thanks a lot for handling #3372. However, with the latest update, I still get a very high CPU usage for my endpoint agent. Could you have another look at this issue specifically, especially the scrollback file debounce? Thanks!
felixbarny commentedon May 7, 2026
@saddlepaddle @Kitenite this is still an issue even with v2 enabled. The CPU usage of the endpoint agent goes through the roof when opening superset. Due to this, I currently need to run superset form a local build. Could you have a look, please? Any way I could help out here?
nate-credoai commentedon May 11, 2026
I'm having the same issue and it's a blocker for me to continue using this which is a bummer.
mvoehringer commentedon May 21, 2026
I’m seeing this same issue on both v1 and v2, though v2 seems even worse. I use an MDM-managed MacBook Pro M1 with around 20 open workspaces. Whenever Superset is open, my background virus scanner hits 100% CPU usage.
This makes the app completely unusable.
Version 1.10.2
Kitenite commentedon Jul 11, 2026
Closing as a duplicate of #5602, the consolidated tracker for stale
performanceissues from the July 2026 stale-issue sweep (no activity since 2026-06-01). If this still applies on a current build, comment on #5602 and we'll reopen.