Finder periodically steals focus

I'm still trying to find out what's doing that on my Mac, and have been since High Sierra.

It's not the OS. If I boot into a clean install of the OS (no third party stuff installed yet, especially anything that installs device drivers or kernel extensions), it never does that.

It's also not actually the Finder. Some background process incorrectly jumps to the foreground. Because it's not supposed to do that and isn't a process you should be seeing at all while running, it has no name to place by the Apple logo. For me, it will sometimes stay at the name of the app I was in, and other times it will change to Finder. But regardless, the Finder is not the problem.

So far, I know it's not USB Overdrive, which I use to assign actions to my MS 4000 keyboard, which otherwise would have many non-functioning keys. But I have a lot of other third party items installed that must be there. If I had the time (I normally don't), I'd install one app at a time (in particular, those that install always running processes) and test to see when the problem appears.

I also found a web site where they posted a simple Python script that watches for whatever is the current foreground app and displays it. It's how that person discovered it was a Logitech driver that was causing his drop to the desktop. The problem for me is when I run it, it seems to block the problem app from ever causing the drop to the desktop. As soon as I stop the process, it starts doing it again. I've also tried just leaving Console running on the desktop so I can quick stop it at the point where whatever it is cuts in. But that also seems to prevent the problem from ever occurring when Console is open and running.

If you want to try it, put this into TextEdit and save it as any file name you want, just so it ends with .py as the file extension.

#!/usr/bin/python

from AppKit import NSWorkspace
import time
t = range(1,10000)
for i in t:
    time.sleep(3)
    activeAppName = NSWorkspace.sharedWorkspace().activeApplication()['NSApplicationName']
    print activeAppName

Then open Terminal and type python followed by a space. Don't press Enter yet. Drag and drop the TextEdit file into Terminal and then press Enter. In the script above, it will run for 10,000 entries before terminating. Change the number if you want it to run longer or shorter. The sleep number means 3 seconds before reporting the current foreground app. Change that if you want it to wait for a longer period before showing the next app's name.

The trick then is to work normally with the script running in Terminal off to the side. When whatever app breaks in and steals the foreground focus, don't touch the keyboard or mouse until the script can return the name of the actual foreground process. Whatever is shows, that's the problem child.

Okay, I think I may have an answer. Rather than installing items one at a time on a fresh, OS only install, I worked it backwards on my main drive (after creating a backup).

I knew 1Password and USB Overdrive weren't a problem since I have those installed on other nearly bare partitions, and I never have the foreground app drop while booted to those.

That left all of the other third party software to look at. Particularly, anything with a driver or daemon.

I started by uninstalling the Wacom software. I hardly ever use the tablet, and it wasn't plugged in anyway. It's entirely possible having it disconnected was throwing the drivers off and causing them to misbehave. But removing those kernel extensions helped quite a bit.

However, the drops to the desktop continued. I had no other device driver/kernel extensions installed, so it had to be one or more of a handful of background processes that load at startup. I ran EtreCheck to see what those were, and which were loaded and running.

Turns out, the main culprit are all of these daemons that think they're being helpful by constantly checking their vendor's servers to see if there's an update, for no purpose other than the gleefully state, "There's a update available!", when you launch that app.

This is also why I couldn't catch them with the script above or in Console. They're up and gone before you can register what took over the foreground. The only one that would occasionally give itself away was X-Rite's XRD updater, which would sometimes remain listed in the Command+Tab list of open apps.

Some are no problem as they properly run as a background app, and never intrude on the foreground. Microsoft and Adobe are two that seem to understand how to do this correctly.

I eliminated all of these useless daemons:

/Library/LaunchAgents/

com.corel.CorelUpdateHelperTask.agent.plist

com.xrite.device.softwareupdate.plist

com.xrite.i1Profiler.tray.plist

/Library/LaunchDaemons/

com.xrite.device.xrdd.plist

com.xrite.device.xrdd.restart.plist

~/Library/LaunchAgents/

com.corel.CorelUpdateHelperTask.agent.plist

update.log (a log of updates kept by Corel)

Restarted the Mac and checked each app to see if they would automatically install these daemons or agents when launched. They didn't, and I haven't had any app suddenly drop out of the foreground since.