[jameskraus]

Why

Saving Goose's default model natively disables the menu trigger, which prevents reliable focus restoration. Reuse the shared button's focusable loading state during the save.

Explainer video

pr1495-explainer-pr.mp4

6:50, narrated. The before and after clips render the real Agent setup section in Chromium, with Goose's save held for about three seconds so the pending state is visible. Chapters: 00:00 Overview · 00:32 The bug · 01:25 The fix · 01:52 What it uses · 02:13 How it works · 04:29 Scope · 04:44 Tests · 05:39 Status · 06:30 Recap.

What changed

• Separate a pending save from model discovery in ModelPicker.
• Retain the selected model's accessible name and block repeated activation while pending.
• Hold saves in the existing focus cases through the real AgentDefaults host, including completion after focus moves elsewhere.

Scope

Covers the Goose default-model control. Shared styles, persistence, and other picker callers keep their existing behavior. Human acceptance remains pending.

Blast radius

The shared picker gains an optional pending state, used by Goose. The shared menu and button own activation blocking and spinner geometry.

Verification

• Both strengthened cases failed with the old native-disabled trigger. The Goose tabs and ModelPicker files then passed all 44 cases.
• Native macOS computer use on October 26 changed the real model, confirmed focus recovery and Enter/Escape/Tab navigation, and verified persistence after restart. The original model was restored and verified after another restart.
• Saves finished before pending could be captured. Controlled tests cover sustained pending; native failure/retry remains unverified. No fresh narrow/dark/enlarged-text matrix or human acceptance is claimed. The final integrated stack (5c043b99d) passed the mandatory TypeScript, full Vitest and design-system gates with one worker.

Human check: Settings → Agent setup → Harness defaults → Goose. Change the model, check focus and keyboard navigation, then restart and confirm persistence. During a slow save, check blocked repeated activation and no focus theft after moving elsewhere.

No browser journeys were added or removed. Uses the documented model-menu exception and shared loading recipe.

Stack, bottom to top: #1491 → #1493 → #1495 → #1496.

[wesbillman]

🤖 Star Lord’s automated source review via Wes’s account, integrating independent systems/lifecycle, correctness/security/concurrency, and product/accessibility reviews.

No actionable findings. The Goose default-model control retains its selected label and reuses the existing focusable loading state and activation guard. The no-provider disabled state and save/error/finally lifecycle remain intact. The public PR description and feature commit metadata were inspected; there are no attached images or identified disclosure issues.

Head: 04fcd77
Base: bea5ee3

Validation limits: source-only; no tests, builds, or application execution performed for this review. Hosted CI run 39663567323 is successful for this head/base; Windows native validation and browser flake checks were skipped. The added deferred-save test covers stable naming/focus, blocked Enter and successful completion. It does not itself cover compact-save rejection/retry or moving focus elsewhere during that save; existing rejection and movement cases exercise the provider dialog and discovery paths respectively. The PR’s reported browser/native checks were not independently reproduced. Sustained pending/failure focus, screen-reader behavior, visual layout and human acceptance remain unverified by this review.

[wesbillman]

🤖 Star Lord’s automated source follow-up via Wes’s account, integrating Rocket, Mantis and Groot. No new actionable findings: the production patch is unchanged, and the revised tests exercise the real AgentDefaults host, blocked activation and focus remaining elsewhere during a pending save.

Head 2a67be7; base dc7bc1e. Source-only: no tests or app execution; native pending/error/retry behavior and the attached video’s contents remain unverified.

[wesbillman]

🤖 Carl, an automated reviewer, commenting via Wes's GitHub account. Mongo did an independent challenge pass.

Verdict: no actionable findings at 2a67be70.

• Only a Goose save sets pending: saving, plus blocking, which GooseSetup.saveDefaults sets. Provider and model reads keep their values while they reload, so disabled={!id} doesn't flip during the save and the trigger stays focusable.
• On the family-menu path, pending goes through the shared focusable loading state in Button (aria-disabled, aria-busy, activation blocked), and the accessible name keeps the selected model. Every other ModelPicker caller defaults to pending=false, so its behavior is unchanged.
• The gated host test holds the save through a deferred promise, checks blocked Enter and focus staying elsewhere, and releases the save in finally.

Remaining gaps (already disclosed): no native evidence of a sustained pending save, and no native check of save failure and retry. Human acceptance is still pending.