Add bucket CRUD and read-only Projects/Labels to Settings page

New "Maintenance Buckets" section: create a bucket, add a pool item by
title (creates the task and assigns it in one step), remove an item,
delete a bucket (unbuckets its tasks rather than deleting them).

New read-only Projects and Labels sections (name + color swatch) --
both are simple enough that read-only is the right call on web, per
user direction, rather than duplicating the Android popup's editing
UX.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EZ7ikw2ukGJFTHE3bJS7zL

3 files changed, 333 insertions, 0 deletions

diff --git a/internal/handlers/buckets_web.go b/internal/handlers/buckets_web.go
new file mode 100644
index 0000000..094e8dd
--- /dev/null
+++ b/internal/handlers/buckets_web.go
@@ -0,0 +1,131 @@
+package handlers
+
+import (
+	"errors"
+	"net/http"
+	"strconv"
+	"strings"
+
+	"github.com/go-chi/chi/v5"
+
+	"task-dashboard/internal/models"
+	"task-dashboard/internal/store"
+)
+
+// BuildBucketSummaries returns every maintenance bucket with its full pool
+// (dormant and active items both). Backs the Settings page's bucket
+// management section.
+func BuildBucketSummaries(s *store.Store) ([]models.BucketSummary, error) {
+	buckets, err := s.GetBuckets()
+	if err != nil {
+		return nil, err
+	}
+	summaries := make([]models.BucketSummary, 0, len(buckets))
+	for _, bucket := range buckets {
+		items, err := s.GetBucketItems(bucket.ID)
+		if err != nil {
+			return nil, err
+		}
+		summaries = append(summaries, models.BucketSummary{Bucket: bucket, Items: items})
+	}
+	return summaries, nil
+}
+
+// HandleBucketsCreate creates a new maintenance bucket from the Settings page's form.
+func (h *Handler) HandleBucketsCreate(w http.ResponseWriter, r *http.Request) {
+	if err := r.ParseForm(); err != nil {
+		JSONError(w, http.StatusBadRequest, "Failed to parse form", err)
+		return
+	}
+	name := strings.TrimSpace(r.FormValue("name"))
+	cycleDays, err1 := strconv.Atoi(r.FormValue("cycle_days"))
+	pickN, err2 := strconv.Atoi(r.FormValue("pick_n"))
+	if name == "" || err1 != nil || err2 != nil || cycleDays <= 0 || pickN <= 0 {
+		JSONError(w, http.StatusBadRequest, "Name, a positive cycle_days, and a positive pick_n are required", nil)
+		return
+	}
+	if _, err := h.store.CreateBucket(name, cycleDays, pickN); err != nil {
+		JSONError(w, http.StatusInternalServerError, "Failed to create bucket", err)
+		return
+	}
+	h.renderBucketsSection(w, r)
+}
+
+// HandleBucketItemAdd creates a new native task from the form's title and
+// assigns it to the bucket's pool in one step -- the Settings page's
+// "type a title to add to the pool" flow. To add a task that already
+// exists elsewhere, use the /api/widget/buckets/{id}/items endpoint with
+// its id directly (unchanged, still task_id-based).
+func (h *Handler) HandleBucketItemAdd(w http.ResponseWriter, r *http.Request) {
+	bucketID := chi.URLParam(r, "id")
+	if err := r.ParseForm(); err != nil {
+		JSONError(w, http.StatusBadRequest, "Failed to parse form", err)
+		return
+	}
+	title := strings.TrimSpace(r.FormValue("title"))
+	if title == "" {
+		JSONError(w, http.StatusBadRequest, "title is required", nil)
+		return
+	}
+	task := models.Task{ID: newID(), Content: title, Priority: 1}
+	if err := h.store.CreateNativeTask(task); err != nil {
+		JSONError(w, http.StatusInternalServerError, "Failed to create task", err)
+		return
+	}
+	if err := h.store.AddBucketItem(bucketID, task.ID); err != nil {
+		JSONError(w, http.StatusInternalServerError, "Failed to add task to bucket", err)
+		return
+	}
+	h.renderBucketsSection(w, r)
+}
+
+// HandleBucketItemRemove clears a task's bucket membership from the
+// Settings page (the task itself is left in place, just unbucketed).
+func (h *Handler) HandleBucketItemRemove(w http.ResponseWriter, r *http.Request) {
+	if err := r.ParseForm(); err != nil {
+		JSONError(w, http.StatusBadRequest, "Failed to parse form", err)
+		return
+	}
+	taskID := r.FormValue("task_id")
+	if err := h.store.RemoveBucketItem(taskID); err != nil {
+		if errors.Is(err, store.ErrNativeTaskNotFound) {
+			JSONError(w, http.StatusNotFound, "task not found", err)
+			return
+		}
+		JSONError(w, http.StatusInternalServerError, "Failed to remove bucket item", err)
+		return
+	}
+	h.renderBucketsSection(w, r)
+}
+
+// HandleBucketDelete removes a bucket, returning its member tasks to being
+// plain unbucketed tasks.
+func (h *Handler) HandleBucketDelete(w http.ResponseWriter, r *http.Request) {
+	id := chi.URLParam(r, "id")
+	if err := h.store.DeleteBucket(id); err != nil {
+		if errors.Is(err, store.ErrNativeTaskNotFound) {
+			JSONError(w, http.StatusNotFound, "bucket not found", err)
+			return
+		}
+		JSONError(w, http.StatusInternalServerError, "Failed to delete bucket", err)
+		return
+	}
+	h.renderBucketsSection(w, r)
+}
+
+// renderBucketsSection re-renders the "buckets-section" partial after any
+// bucket mutation, so the Settings page's htmx targets can swap in the
+// fresh pool contents without a full page reload.
+func (h *Handler) renderBucketsSection(w http.ResponseWriter, r *http.Request) {
+	summaries, err := BuildBucketSummaries(h.store)
+	if err != nil {
+		JSONError(w, http.StatusInternalServerError, "Failed to load buckets", err)
+		return
+	}
+	data := struct {
+		Buckets []models.BucketSummary
+	}{Buckets: summaries}
+	if err := h.renderer.Render(w, "buckets-section", data); err != nil {
+		JSONError(w, http.StatusInternalServerError, "Failed to render buckets", err)
+	}
+}
diff --git a/internal/handlers/buckets_web_test.go b/internal/handlers/buckets_web_test.go
new file mode 100644
index 0000000..9e09ca0
--- /dev/null
+++ b/internal/handlers/buckets_web_test.go
@@ -0,0 +1,193 @@
+package handlers
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+
+	"task-dashboard/internal/models"
+	"task-dashboard/internal/store"
+)
+
+func TestHandleBucketsCreate_Web_CreatesBucket(t *testing.T) {
+	h, cleanup := setupTestHandler(t)
+	defer cleanup()
+
+	req := httptest.NewRequest("POST", "/settings/buckets", strings.NewReader("name=Gutters&cycle_days=30&pick_n=2"))
+	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+	w := httptest.NewRecorder()
+	h.HandleBucketsCreate(w, req)
+
+	if w.Code != http.StatusOK {
+		t.Fatalf("status = %d, want 200, body=%s", w.Code, w.Body.String())
+	}
+	buckets, err := h.store.GetBuckets()
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(buckets) != 1 || buckets[0].Name != "Gutters" {
+		t.Errorf("buckets = %+v", buckets)
+	}
+}
+
+func TestHandleBucketsCreate_Web_InvalidPickN_Returns400(t *testing.T) {
+	h, cleanup := setupTestHandler(t)
+	defer cleanup()
+
+	req := httptest.NewRequest("POST", "/settings/buckets", strings.NewReader("name=Gutters&cycle_days=30&pick_n=0"))
+	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+	w := httptest.NewRecorder()
+	h.HandleBucketsCreate(w, req)
+
+	if w.Code != http.StatusBadRequest {
+		t.Fatalf("status = %d, want 400", w.Code)
+	}
+}
+
+func TestHandleBucketItemAdd_Web_CreatesAndAssignsTask(t *testing.T) {
+	h, cleanup := setupTestHandler(t)
+	defer cleanup()
+	bucket, err := h.store.CreateBucket("Gutters", 30, 2)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	req := withURLParam(httptest.NewRequest("POST", "/settings/buckets/"+bucket.ID+"/items", strings.NewReader("title=Clean+gutters")), "id", bucket.ID)
+	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+	w := httptest.NewRecorder()
+	h.HandleBucketItemAdd(w, req)
+
+	if w.Code != http.StatusOK {
+		t.Fatalf("status = %d, want 200, body=%s", w.Code, w.Body.String())
+	}
+	items, err := h.store.GetBucketItems(bucket.ID)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(items) != 1 || items[0].Content != "Clean gutters" || items[0].BucketState != "dormant" {
+		t.Errorf("items = %+v", items)
+	}
+}
+
+func TestHandleBucketItemAdd_Web_EmptyTitle_Returns400(t *testing.T) {
+	h, cleanup := setupTestHandler(t)
+	defer cleanup()
+	bucket, err := h.store.CreateBucket("Gutters", 30, 2)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	req := withURLParam(httptest.NewRequest("POST", "/settings/buckets/"+bucket.ID+"/items", strings.NewReader("title=")), "id", bucket.ID)
+	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+	w := httptest.NewRecorder()
+	h.HandleBucketItemAdd(w, req)
+
+	if w.Code != http.StatusBadRequest {
+		t.Fatalf("status = %d, want 400", w.Code)
+	}
+}
+
+func TestHandleBucketItemRemove_Web_RemovesMembership(t *testing.T) {
+	h, cleanup := setupTestHandler(t)
+	defer cleanup()
+	bucket, err := h.store.CreateBucket("Gutters", 30, 2)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := h.store.CreateNativeTask(models.Task{ID: "task-1", Content: "Clean gutters", Priority: 1}); err != nil {
+		t.Fatal(err)
+	}
+	if err := h.store.AddBucketItem(bucket.ID, "task-1"); err != nil {
+		t.Fatal(err)
+	}
+
+	req := httptest.NewRequest("POST", "/settings/buckets/items/remove", strings.NewReader("task_id=task-1"))
+	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+	w := httptest.NewRecorder()
+	h.HandleBucketItemRemove(w, req)
+
+	if w.Code != http.StatusOK {
+		t.Fatalf("status = %d, want 200, body=%s", w.Code, w.Body.String())
+	}
+	task, err := h.store.GetNativeTaskByID("task-1")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if task.BucketID != "" {
+		t.Errorf("task.BucketID = %q, want empty", task.BucketID)
+	}
+}
+
+func TestHandleBucketDelete_Web_RemovesBucket(t *testing.T) {
+	h, cleanup := setupTestHandler(t)
+	defer cleanup()
+	bucket, err := h.store.CreateBucket("Gutters", 30, 2)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	req := withURLParam(httptest.NewRequest("DELETE", "/settings/buckets/"+bucket.ID, nil), "id", bucket.ID)
+	w := httptest.NewRecorder()
+	h.HandleBucketDelete(w, req)
+
+	if w.Code != http.StatusOK {
+		t.Fatalf("status = %d, want 200, body=%s", w.Code, w.Body.String())
+	}
+	buckets, err := h.store.GetBuckets()
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(buckets) != 0 {
+		t.Errorf("buckets = %+v, want none", buckets)
+	}
+}
+
+func TestHandleSettingsPage_IncludesBucketsProjectsLabels(t *testing.T) {
+	h, cleanup := setupTestHandler(t)
+	defer cleanup()
+	if _, err := h.store.CreateBucket("Gutters", 30, 1); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := h.store.CreateProject("Home", "#3B82F6"); err != nil {
+		t.Fatal(err)
+	}
+	if err := h.store.SetLabelColor("chore", "#F59E0B"); err != nil {
+		t.Fatal(err)
+	}
+
+	req := httptest.NewRequest("GET", "/settings", nil)
+	w := httptest.NewRecorder()
+	h.HandleSettingsPage(w, req)
+
+	if w.Code != http.StatusOK {
+		t.Fatalf("status = %d, want 200, body=%s", w.Code, w.Body.String())
+	}
+
+	mock := h.renderer.(*MockRenderer)
+	lastCall := mock.Calls[len(mock.Calls)-1]
+	data, ok := lastCall.Data.(struct {
+		Configs         map[string][]models.SourceConfig
+		Sources         []string
+		Toggles         []models.FeatureToggle
+		SyncLog         []store.SyncLogEntry
+		Agents          []models.Agent
+		Buckets         []models.BucketSummary
+		Projects        []models.Project
+		Labels          []models.LabelColor
+		CSRFToken       string
+		WebAuthnEnabled bool
+	})
+	if !ok {
+		t.Fatalf("unexpected data type %T", lastCall.Data)
+	}
+	if len(data.Buckets) != 1 || data.Buckets[0].Bucket.Name != "Gutters" {
+		t.Errorf("Buckets = %+v", data.Buckets)
+	}
+	if len(data.Projects) != 1 || data.Projects[0].Name != "Home" {
+		t.Errorf("Projects = %+v", data.Projects)
+	}
+	if len(data.Labels) != 1 || data.Labels[0].Name != "chore" {
+		t.Errorf("Labels = %+v", data.Labels)
+	}
+}
diff --git a/internal/handlers/settings.go b/internal/handlers/settings.go
index 28988b1..43fce20 100644
--- a/internal/handlers/settings.go
+++ b/internal/handlers/settings.go
@@ -17,6 +17,9 @@ func (h *Handler) HandleSettingsPage(w http.ResponseWriter, r *http.Request) {
 	toggles, _ := h.store.GetFeatureToggles()
 	syncLog, _ := h.store.GetRecentSyncLog(20)
 	agents, _ := h.store.GetAllAgents()
+	buckets, _ := BuildBucketSummaries(h.store)
+	projects, _ := h.store.GetProjects()
+	labels, _ := h.store.GetLabelColors()
 
 	// Group configs by source
 	bySource := make(map[string][]models.SourceConfig)
@@ -30,6 +33,9 @@ func (h *Handler) HandleSettingsPage(w http.ResponseWriter, r *http.Request) {
 		Toggles         []models.FeatureToggle
 		SyncLog         []store.SyncLogEntry
 		Agents          []models.Agent
+		Buckets         []models.BucketSummary
+		Projects        []models.Project
+		Labels          []models.LabelColor
 		CSRFToken       string
 		WebAuthnEnabled bool
 	}{
@@ -38,6 +44,9 @@ func (h *Handler) HandleSettingsPage(w http.ResponseWriter, r *http.Request) {
 		Toggles:         toggles,
 		SyncLog:         syncLog,
 		Agents:          agents,
+		Buckets:         buckets,
+		Projects:        projects,
+		Labels:          labels,
 		CSRFToken:       auth.GetCSRFTokenFromContext(r.Context()),
 		WebAuthnEnabled: h.WebAuthnEnabled,
 	}