fix: CI builds helpers from source; survive AX cycles; portable ax tests

[woladi]

main is currently red — the Release run after #16 failed — and this is the fix.

CI was testing the previous release, not the branch

postinstall downloads prebuilt helpers for the package's current version. Once that version is published, CI on a branch that changes Swift finds those assets and runs the whole suite against the previous release. Native changes were never tested.

It surfaced when two tests covering behaviour added in #16 failed on CI while passing locally: the runner was executing a binary that predated them. CI now sets MACOS_VISION_SKIP_DOWNLOAD=1 and asserts each helper exists and is newer than its source.

The AX tree is a graph, and the walk assumed it was a tree

Safari lists the application element as its own child, and answers kAXWindows with it:

axApp role: AXApplication
kAXWindows → count 1, same element as axApp? [true]
children   → ["AXApplication", "AXMenuBar"], sameAsApp: [true, false]

Without cycle protection the walk descends into the application repeatedly and returns menu bars at the depth limit instead of the window — the cause of an occasional two-node result seen while wiring this into the MCP server. Visited elements are now tracked by CFHash/CFEqual, and windows are taken from the union of kAXWindows and children, filtered to real windows and never the app element.

The tests asserted a precondition instead of checking it

They targeted Finder. CGWindowList still lists windows on a locked Mac while AX exposes none, and a CI runner has neither — so the fixed target passed locally and failed on CI, where it had only ever passed by exercising the very fallback #16 removed. They now probe until they find an app AX actually answers for, and skip when none does.

Verification, and what is not verified

105/105 with the screen locked, which is the headless case: the axTree tests skip cleanly and everything else passes. CI on this PR exercises that path for real, compiling from source.

Not verified by me: the windowed path with this new union enumeration — the machine locked itself and stays locked behind a password. The union is a superset of the children-only enumeration that was returning 224 nodes correctly before, so the risk is low, but it deserves one run on an unlocked Mac before release.

🤖 Generated with Claude Code