Is there a way to detect what program is stealing focus on my Mac?

I've got a problem with some app on my Mac stealing the keyboard focus (the current window's title bar becomes inactive). However, it is not actually putting up any windows or menu bar of its own, and it does not respond identifiably to keyboard shortcuts.

Is there a way to determine what application has the keyboard focus even if it is one of those which has no menu bar or Dock icon? I know of one built-in feature that almost does this; the Force Quit dialog, if invoked from the keyboard, will open with the focused application selected. However, it only lists normal has-a-dock-icon applications, so it doesn't help in this case.

This started occurring around the time when I upgraded from 10.8 to 10.9; I suspect that one of the apps I already had installed, or upgraded along with the OS, is newly misbehaving.

I am open to solutions involving a small amount of programming (or AppleScript, say), use of developer tools, etc.; but not ones like “Uninstall things until it goes away” because that would be excessively disruptive at the moment. I'd like to definitively identify the application and file a bug report or fix its configuration.

My research has only turned up a couple of threads requesting the same on Apple Support Communities which did not contain an answer.

You can find the app that steals focus by saving the following code in a find_focus_stealer.py file and running it via python find_focus_stealer.py in a terminal.

Start running the script – it will print out the name of the active app every 3 seconds. Keep working as usual, wait for the problem to occur, and after a few seconds see the output in the terminal. You’ll have your culprit.

In my case it was a Symantec Antivirus background app (SymUIAgent.app).

#!/usr/bin/python

from AppKit import NSWorkspace
import time
t = range(1,100)
for i in t:
    time.sleep(3)
    activeAppName = NSWorkspace.sharedWorkspace().activeApplication()['NSApplicationName']
    print activeAppName

Credits to iMichael_ in this Apple Discussions thread.

Here’s a slight update to @Ace’s script that runs until you kill it and only prints the app name when it changes. Again, save this code in a file find_focus_stealer.py and then try running it with python find_focus_stealer.py.

#!/usr/bin/python                                                                                                       

try:
    from AppKit import NSWorkspace
except ImportError:
    print "Can't import AppKit -- maybe you're running python from brew?"
    print "Try running with Apple's /usr/bin/python instead."
    exit(1)

from datetime import datetime
from time import sleep

last_active_name = None
while True:
    active_app = NSWorkspace.sharedWorkspace().activeApplication()
    if active_app['NSApplicationName'] != last_active_name:
        last_active_name = active_app['NSApplicationName']
        print '%s: %s [%s]' % (
            datetime.now().strftime('%Y-%m-%d %H:%M:%S'),
            active_app['NSApplicationName'],
            active_app['NSApplicationPath']
        )
    sleep(1)

I was able to use this to track down “Google Drive” as the focus-stealing culprit on my Mac.

Here is improved version of script mentioned in @Ace’s answer:

#!/usr/bin/python
# Prints current window focus.
# See: https://apple.stackexchange.com/q/123730
from AppKit import NSWorkspace
import time
workspace = NSWorkspace.sharedWorkspace()
active_app = workspace.activeApplication()['NSApplicationName']
print('Active focus: ' + active_app)
while True:
    time.sleep(1)
    prev_app = active_app
    active_app = workspace.activeApplication()['NSApplicationName']
    if prev_app != active_app:
        print('Focus changed to: ' + active_app)

It will print the name of the active application that has the focus and will detect if it changed by checking every second.

^{Related script: Identify which app or process is stealing focus on OSX at Gist}

Usage:

1. Save the above script into a file get_active_focus.py.
2. Assign execution attributes with the chmod +x get_active_focus.py command.
3. Run the file with ./get_active_focus.py.

Output:

$ ./get_active_focus.py
Active focus: Terminal
Focus changed to: Google Chrome