Fix update attempt refreshing pill without actually updating

The attemptUpdate() subscriber watched for .updateAvailable state to
auto-confirm, but showUpdateFound used setStateAfterMinimumCheckDelay
which delays the transition by up to 2 seconds. During that window,
dismissUpdateInstallation (from a background probe race) could cancel
the pending transition, reverting state to idle without ever confirming.
The subscriber then tore down on the transient idle, silently abandoning
the update.

Fix: move auto-confirm to the Sparkle driver level via an
autoInstallOnNextUpdate flag. When set, showUpdateFound immediately
calls reply(.install) bypassing the delay entirely. The subscriber
is kept as a fallback but no longer tears down on transient idle
while the flag is active.

Closes #2166

Author: lawrencecchen

Sources/Update/UpdateController.swift

@@ -177,6 +177,7 @@ class UpdateController {
     func attemptUpdate() {
         stopAttemptUpdateMonitoring()
         didObserveAttemptUpdateProgress = false
+        userDriver.autoInstallOnNextUpdate = true
 
         attemptInstallCancellable = viewModel.$state
             .receive(on: DispatchQueue.main)
@@ -187,6 +188,9 @@ class UpdateController {
                     self.didObserveAttemptUpdateProgress = true
                 }
 
+                // Fallback: auto-confirm if we reach .updateAvailable
+                // (e.g. the driver flag was cleared by a dismiss before
+                // showUpdateFound fired).
                 if case .updateAvailable = state {
                     UpdateLogStore.shared.append("attemptUpdate auto-confirming available update")
                     state.confirm()
@@ -196,6 +200,14 @@ class UpdateController {
                 guard self.didObserveAttemptUpdateProgress, !state.isInstallable else {
                     return
                 }
+
+                // While the driver's auto-install flag is set, the Sparkle
+                // check may still be starting up. Don't tear down on a
+                // transient .idle that occurs during retry/probe races.
+                if state.isIdle, self.userDriver.autoInstallOnNextUpdate {
+                    return
+                }
+
                 self.stopAttemptUpdateMonitoring()
             }
 
@@ -279,6 +291,7 @@ class UpdateController {
         attemptInstallCancellable?.cancel()
         attemptInstallCancellable = nil
         didObserveAttemptUpdateProgress = false
+        userDriver.autoInstallOnNextUpdate = false
     }
 
     private func installNoUpdateDismissObserver() {

Sources/Update/UpdateDriver.swift

@@ -10,6 +10,12 @@ class UpdateDriver: NSObject, SPUUserDriver {
     private var checkTimeoutWorkItem: DispatchWorkItem?
     private var lastFeedURLString: String?
 
+    /// When true, the next update found by Sparkle is confirmed immediately
+    /// without waiting for the minimum-check-display delay. This prevents
+    /// the delayed `.updateAvailable` transition from being preempted by
+    /// a `dismissUpdateInstallation` call (e.g. from a background probe race).
+    var autoInstallOnNextUpdate: Bool = false
+
     init(viewModel: UpdateViewModel, hostBundle _: Bundle) {
         self.viewModel = viewModel
         super.init()
@@ -44,6 +50,12 @@ class UpdateDriver: NSObject, SPUUserDriver {
                          state: SPUUserUpdateState,
                          reply: @escaping @Sendable (SPUUserUpdateChoice) -> Void) {
         UpdateLogStore.shared.append("show update found: \(appcastItem.displayVersionString)")
+        if autoInstallOnNextUpdate {
+            autoInstallOnNextUpdate = false
+            UpdateLogStore.shared.append("auto-installing update (attemptUpdate)")
+            reply(.install)
+            return
+        }
         setStateAfterMinimumCheckDelay(.updateAvailable(.init(appcastItem: appcastItem, reply: reply)))
     }
 
@@ -57,12 +69,14 @@ class UpdateDriver: NSObject, SPUUserDriver {
 
     func showUpdateNotFoundWithError(_ error: any Error,
                                      acknowledgement: @escaping () -> Void) {
+        autoInstallOnNextUpdate = false
         UpdateLogStore.shared.append("show update not found: \(formatErrorForLog(error))")
         setStateAfterMinimumCheckDelay(.notFound(.init(acknowledgement: acknowledgement)))
     }
 
     func showUpdaterError(_ error: any Error,
                           acknowledgement: @escaping () -> Void) {
+        autoInstallOnNextUpdate = false
         let details = formatErrorForLog(error)
         UpdateLogStore.shared.append("show updater error: \(details)")
         setState(.error(.init(
@@ -151,6 +165,7 @@ class UpdateDriver: NSObject, SPUUserDriver {
     }
 
     func dismissUpdateInstallation() {
+        autoInstallOnNextUpdate = false
         UpdateLogStore.shared.append("dismiss update installation")
         if case .error = viewModel.state {
             UpdateLogStore.shared.append("dismiss update installation ignored (error visible)")