list_windows misses system overlay windows (LocalAuthentication / coreautha); get_window_state excludes their buttons

[pavelklymenko]

Problem

list_windows unconditionally filters to CGWindowServer layer 0. System overlay windows — most notably the macOS LocalAuthentication dialog rendered by coreautha (layer 1000) during Touch ID / password challenges — never appear in the output. Without a valid window_id, get_window_state cannot be called, making the entire dialog unreachable from cua-driver tools.

A second, independent issue: even when a window_id is obtained by other means, get_window_state's internal renderTree walk filters AX child windows at depth 0 by requiring their CGWindowID to match the requested window_id. System overlay windows have real CGWindowIDs that are absent from the layer-0 window-server list, so the filter silently drops them and their buttons never appear in the element index.

Steps to reproduce

1. Trigger any LocalAuthentication challenge (e.g. Keychain Access → view a password, or any app calling LAContext.evaluatePolicy).
2. coreautha appears on screen with "Use Password…" and "Cancel" buttons.
3. cua-driver list_windows '{"pid": <coreautha-pid>}' → returns 0 windows.
4. No window_id → get_window_state cannot be called → dialog is unreachable.

Expected behaviour

• list_windows with a pid filter should return all layers for that pid, including overlay windows.
• get_window_state should surface buttons inside those overlay windows so they can be clicked via element_index.

Environment

• macOS 15.x (Sequoia)
• cua-driver built from main
• Reproduced with com.apple.LocalAuthentication.UIAgent (coreautha), but the same gap affects any process whose primary window lives above layer 0.