macOS: Sentry app-hang false positive while Sparkle shows the authorization prompt during update install

[rachyandco]

Software (please complete the following information):

• Operating system: macOS 26.5.2 (25F84), iMac21,1 (Apple Silicon)
• NymVPN version: 2026.11.0 (808), while updating to 2026.12.1

Describe the bug
Sentry reports App Hanging: App hanging for at least 2000 ms on macOS whenever the user is shown the admin password prompt during a Sparkle update. This is a false positive from Sentry's app-hang tracker, not a bug in app code.

The symbolicated main thread:

AuthorizationCopyRights (Security)
-[SUInstallerLauncher submitInstallerAtPath:withHostBundle:...inSystemDomain:rootUser:] (SUInstallerLauncher.m:246)
-[SUInstallerLauncher launchInstallerWithHostBundlePath:...]_block_invoke (SUInstallerLauncher.m:586)
_dispatch_main_queue_drain
...

Sparkle submits the downloaded .pkg installer in the system domain and calls AuthorizationCopyRights with interaction allowed. That displays the "NymVPN wants to make changes" dialog and blocks the main thread in a synchronous XPC call until the user types their password or cancels. Sparkle does this on the main queue on purpose so the dialog is app-modal. Any user who takes more than 2 s at the prompt produces one of these events.

Breadcrumbs confirm the context: appcast fetched from nymtech.net/.wellknown/macos-vpn/appcast.xml, NymVPN-2026.12.1.pkg downloaded, install started. All other threads are idle (tokio in kevent, one thread in sleep).

Sentry: nym-vpn-ios issue 7175686536.

To Reproduce
Steps to reproduce the behavior:

1. Run an older NymVPN build on macOS with error reporting enabled.
2. Let Sparkle find and download an update (or use "Check for Updates…").
3. When the macOS authorization dialog appears, wait more than 2 seconds before entering the password.
4. An App Hanging event is sent to Sentry.

Expected behavior
Time spent in the system authorization dialog during an update should not be reported as an app hang. Hang tracking should be paused while Sparkle is installing, or these events should be dropped.

Screenshots
N/A. Sentry stack trace above.

Additional context
Our updater is SPUStandardUpdaterController with default settings (ServicesMacOS/Sources/AutoUpdater/AutoUpdater.swift), Sparkle ≥ 2.6.4. Package-based updates always need root, so the prompt is inherent.

Options, in order of preference:

1. Pause app-hang tracking during install: implement updater(_:willInstallUpdate:) in the SPUUpdaterDelegate and call SentrySDK.pauseAppHangTracking(); resume in updater(_:didAbortWithError:) and after relaunch. Removes exactly this false positive, keeps hang tracking elsewhere.
2. Filter in beforeSend: drop app-hang events whose main-thread frames contain SUInstallerLauncher or AuthorizationCopyRights.
3. Leave as is: fires once per update per user, noise only.