How Mac OS X Timing app can track files

Question

I am curious about how Timing is able to know the amount of time you spend in a particular file. I understand that it needs Accessibility permission, but after that, how is it able to detect what's currently on the screen, plus accessing the path to a given file. I find intriguing, for example, that it knows that I am on Xcode, but how does it know I am working on a specific file, inside Xcode?

Answer 1

I don't work on Timing, so I can only make an educated guess on how their app was implemented.

Timing claims to keep track of three main data points: the apps you use, the websites you visit, and the documents you edit.

For applications, Timing probably listens to the NSWorkspaceDidLaunchApplicationNotification notification, which contains information on the application that was just launched. To check the currently open applications when Timing is launched, it probably checks the non-background processes from System Events, possibly like this:

osascript -e 'tell application "System Events" to get name of (processes where background only is false)'

(Source Get list of running Apps on Mac OS X in Bash?)

For history, Timing might use the HTML5 History API with Safari (I don't know what browsers Timing claims to support with this feature), or take an approach like Charles Proxy and monitor any incoming and outgoing packets and requests. The implementation may vary depending on if Timing requires admin privileges.

For documents, Timing might use the lsof command as Droppy suggested in their comment, or it might use one of the Apple interfaces. Pre-El Capitan, Apple listed recent documents in a plist file at the path ~/Library/Preferences/com.apple.recentitems.plist. In macOS versions newer than El Capitan, you can use the mdfind command and specify the kMDItemContentModificationDate value to find files modified between two dates:

mdfind -onlyin $HOME '((kMDItemContentModificationDate > $time.now(-60m)) && (kMDItemContentModificationDate < $time.now()))' | grep -v /Library/

(Source Alfred)