@theopolis talk about https://github.com/facebook/osquery/issues/1315 came up again... that's not the type of thing I can mock up, although I can get the python-bridge-based way of watching for the NSWorkspace notifications