Is there a way to detect what program is stealing focus on my Mac?

Question

I've got a problem with some app on my Mac stealing the keyboard focus (the current window's title bar becomes inactive). However, it is not actually putting up any windows or menu bar of its own, and it does not respond identifiably to keyboard shortcuts.

Is there a way to determine what application has the keyboard focus even if it is one of those which has no menu bar or Dock icon? I know of one built-in feature that almost does this; the Force Quit dialog, if invoked from the keyboard, will open with the focused application selected. However, it only lists normal has-a-dock-icon applications, so it doesn't help in this case.

This started occurring around the time when I upgraded from 10.8 to 10.9; I suspect that one of the apps I already had installed, or upgraded along with the OS, is newly misbehaving.

I am open to solutions involving a small amount of programming (or AppleScript, say), use of developer tools, etc.; but not ones like “Uninstall things until it goes away” because that would be excessively disruptive at the moment. I'd like to definitively identify the application and file a bug report or fix its configuration.

My research has only turned up a couple of threads requesting the same on Apple Support Communities which did not contain an answer.

Answer 1

You can find the app that steals focus by saving the following code in a find_focus_stealer.py file and running it via python find_focus_stealer.py in a terminal.

Start running the script – it will print out the name of the active app every 3 seconds. Keep working as usual, wait for the problem to occur, and after a few seconds see the output in the terminal. You’ll have your culprit.

In my case it was a Symantec Antivirus background app (SymUIAgent.app).

#!/usr/bin/python

from AppKit import NSWorkspace
import time
t = range(1,100)
for i in t:
    time.sleep(3)
    activeAppName = NSWorkspace.sharedWorkspace().activeApplication()['NSApplicationName']
    print activeAppName

Credits to iMichael_ in this Apple Discussions thread.

Answer 2

Here’s a slight update to @Ace’s script that runs until you kill it and only prints the app name when it changes. Again, save this code in a file find_focus_stealer.py and then try running it with python find_focus_stealer.py.

#!/usr/bin/python                                                                                                       

try:
    from AppKit import NSWorkspace
except ImportError:
    print "Can't import AppKit -- maybe you're running python from brew?"
    print "Try running with Apple's /usr/bin/python instead."
    exit(1)

from datetime import datetime
from time import sleep

last_active_name = None
while True:
    active_app = NSWorkspace.sharedWorkspace().activeApplication()
    if active_app['NSApplicationName'] != last_active_name:
        last_active_name = active_app['NSApplicationName']
        print '%s: %s [%s]' % (
            datetime.now().strftime('%Y-%m-%d %H:%M:%S'),
            active_app['NSApplicationName'],
            active_app['NSApplicationPath']
        )
    sleep(1)

I was able to use this to track down “Google Drive” as the focus-stealing culprit on my Mac.

Answer 3

Here is improved version of script mentioned in @Ace’s answer:

#!/usr/bin/python
# Prints current window focus.
# See: https://apple.stackexchange.com/q/123730
from AppKit import NSWorkspace
import time
workspace = NSWorkspace.sharedWorkspace()
active_app = workspace.activeApplication()['NSApplicationName']
print('Active focus: ' + active_app)
while True:
    time.sleep(1)
    prev_app = active_app
    active_app = workspace.activeApplication()['NSApplicationName']
    if prev_app != active_app:
        print('Focus changed to: ' + active_app)

It will print the name of the active application that has the focus and will detect if it changed by checking every second.

^{Related script: Identify which app or process is stealing focus on OSX at Gist}

Usage:

1. Save the above script into a file get_active_focus.py.
2. Assign execution attributes with the chmod +x get_active_focus.py command.
3. Run the file with ./get_active_focus.py.

Output:

$ ./get_active_focus.py
Active focus: Terminal
Focus changed to: Google Chrome

Answer 4

While it isn't the primary purpose of this application, Karabiner-Elements (a tool for selectively remapping the keyboard) has a focus-change event log which will tell you which application has been stealing focus. While its intended purpose is to set up per-application keyboard mappings, it also has the nice side effect of telling you when a misbehaving app is making things difficult, and I have used it to track down several problem applications.

The method that Karabiner-Elements uses also works better with applications which steal the focus and immediately give it back (unlike the various Python scripts posted in other answers, which can only reliably log focus steals that last for more than one second).

Answer 5

For those coming here looking for a solution to use with python3:

Based on @medmund's answer, comments under it as well as https://alexn.org/wiki/macos/#find-which-app-is-stealing-focus

Requirements

• Python 3 installed and in $PATH
• Depending on your environment, you may need to substitute python with python3 and pip with pip3.

Usage

Install pyobj

pip install pyobjc

Create python script

With the contents below. Save to new .py file, for this answer I'll use find-focus-stealer.py.

#!/usr/bin/python3

from AppKit import NSWorkspace
from datetime import datetime
from time import sleep

last_active_name = None
while True:
    active_app = NSWorkspace.sharedWorkspace().activeApplication()
    if active_app['NSApplicationName'] != last_active_name:
        last_active_name = active_app['NSApplicationName']
        print('{}: {} [{}]'.format(
            datetime.now().strftime('%Y-%m-%d %H:%M:%S'),
            active_app['NSApplicationName'],
            active_app['NSApplicationPath']
        ))
    sleep(1)

Run script

From command line, run:

python find-focus-stealer.py

Notes

In my case the issue disappeared after restarting the computer. Though it seems likely that it had to do with Logitech's G HUB as was mentioned elsewhere.

Answer 6

Perhaps checking Activity Monitor for active processes? Anything in App Nap state could easily be ruled out, and it might make the hunt a lot shorter.