feat: add label multi-select to Create Issue form

Add dynamic label selection when creating a new issue:
- New GET /issues/new/labels endpoint returns label checkboxes for a repo
- When a repo is selected, labels are fetched via HTMX and displayed as
  checkboxes with colored label badges
- CreateIssue handler now parses label_ids from form and passes them to
  the Gitea API
- Shows "No labels available" message when repo has no labels

Closes leeworks-agents/gitea-mobile#67

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

internal/gitea/client.go

@@ -308,173 +308,243 @@ func (c *Client) ListOrgsAndRepos(ctx context.Context, token string) (map[string
 	return result, nil
 }
 
-// ListAllIssues fetches all open issues across all repos in the given orgs,
+// PageSize is the number of items returned per page for paginated listings.
-// using concurrent requests with a semaphore.
+const PageSize = 20
-func (c *Client) ListAllIssues(ctx context.Context, token string, orgs []string) ([]Issue, error) {
-	cacheKey := fmt.Sprintf("issues-%s", strings.Join(orgs, ","))
-	if cached, ok := c.getFromCache(cacheKey); ok {
-		return cached.([]Issue), nil
-	}
 
-	// First, collect all repos for the given orgs.
+// PaginatedIssues holds a page of issues along with pagination metadata.
-	var allRepos []Repo
+type PaginatedIssues struct {
-	for _, org := range orgs {
+	Issues  []Issue
-		repos, err := c.ListOrgRepos(ctx, token, org)
+	HasMore bool
-		if err != nil {
-			return nil, fmt.Errorf("listing repos for %s: %w", org, err)
-		}
-		allRepos = append(allRepos, repos...)
-	}
-
-	// Fan out issue fetching across repos.
-	var allIssues []Issue
-	var mu sync.Mutex
-	sem := make(chan struct{}, c.maxConcurrent)
-	var wg sync.WaitGroup
-	var firstErr error
-
-	for _, repo := range allRepos {
-		wg.Add(1)
-		go func(r Repo) {
-			defer wg.Done()
-			sem <- struct{}{}
-			defer func() { <-sem }()
-
-			path := fmt.Sprintf("/repos/%s/issues?state=open&type=issues&limit=50", r.FullName)
-			resp, err := c.doRequest(ctx, token, http.MethodGet, path, nil)
-			if err != nil {
-				mu.Lock()
-				if firstErr == nil {
-					firstErr = fmt.Errorf("fetching issues for %s: %w", r.FullName, err)
-				}
-				mu.Unlock()
-				return
-			}
-			defer resp.Body.Close()
-
-			var issues []Issue
-			if err := json.NewDecoder(resp.Body).Decode(&issues); err != nil {
-				mu.Lock()
-				if firstErr == nil {
-					firstErr = fmt.Errorf("decoding issues for %s: %w", r.FullName, err)
-				}
-				mu.Unlock()
-				return
-			}
-
-			// Tag each issue with repo info.
-			for i := range issues {
-				issues[i].RepoOwner = r.Owner.Login
-				issues[i].RepoName = r.Name
-			}
-
-			mu.Lock()
-			allIssues = append(allIssues, issues...)
-			mu.Unlock()
-		}(repo)
-	}
-
-	wg.Wait()
-
-	if firstErr != nil {
-		return nil, firstErr
-	}
-
-	// Sort by updated time, newest first.
-	sort.Slice(allIssues, func(i, j int) bool {
-		return allIssues[i].UpdatedAt.After(allIssues[j].UpdatedAt)
-	})
-
-	c.setCache(cacheKey, allIssues)
-	return allIssues, nil
 }
 
-// ListAllPullRequests fetches all open PRs across all repos in the given orgs.
+// PaginatedPulls holds a page of pull requests along with pagination metadata.
-func (c *Client) ListAllPullRequests(ctx context.Context, token string, orgs []string) ([]PullRequest, error) {
+type PaginatedPulls struct {
-	cacheKey := fmt.Sprintf("pulls-%s", strings.Join(orgs, ","))
+	Pulls   []PullRequest
+	HasMore bool
+}
+
+// ListAllIssues fetches issues across all repos in the given orgs,
+// using concurrent requests with a semaphore. Results are paginated.
+func (c *Client) ListAllIssues(ctx context.Context, token string, orgs []string, state string, page int) (PaginatedIssues, error) {
+	if state == "" {
+		state = "open"
+	}
+	if page < 1 {
+		page = 1
+	}
+
+	cacheKey := fmt.Sprintf("issues-%s-%s", state, strings.Join(orgs, ","))
+	var allIssues []Issue
 	if cached, ok := c.getFromCache(cacheKey); ok {
-		return cached.([]PullRequest), nil
+		allIssues = cached.([]Issue)
-	}
+	} else {
-
+		// First, collect all repos for the given orgs.
-	var allRepos []Repo
+		var allRepos []Repo
-	for _, org := range orgs {
+		for _, org := range orgs {
-		repos, err := c.ListOrgRepos(ctx, token, org)
+			repos, err := c.ListOrgRepos(ctx, token, org)
-		if err != nil {
-			return nil, fmt.Errorf("listing repos for %s: %w", org, err)
-		}
-		allRepos = append(allRepos, repos...)
-	}
-
-	var allPRs []PullRequest
-	var mu sync.Mutex
-	sem := make(chan struct{}, c.maxConcurrent)
-	var wg sync.WaitGroup
-	var firstErr error
-
-	for _, repo := range allRepos {
-		wg.Add(1)
-		go func(r Repo) {
-			defer wg.Done()
-			sem <- struct{}{}
-			defer func() { <-sem }()
-
-			path := fmt.Sprintf("/repos/%s/pulls?state=open&limit=50", r.FullName)
-			resp, err := c.doRequest(ctx, token, http.MethodGet, path, nil)
 			if err != nil {
-				mu.Lock()
+				return PaginatedIssues{}, fmt.Errorf("listing repos for %s: %w", org, err)
-				if firstErr == nil {
+			}
-					firstErr = fmt.Errorf("fetching PRs for %s: %w", r.FullName, err)
+			allRepos = append(allRepos, repos...)
+		}
+
+		// Fan out issue fetching across repos.
+		var mu sync.Mutex
+		sem := make(chan struct{}, c.maxConcurrent)
+		var wg sync.WaitGroup
+		var firstErr error
+
+		for _, repo := range allRepos {
+			wg.Add(1)
+			go func(r Repo) {
+				defer wg.Done()
+				sem <- struct{}{}
+				defer func() { <-sem }()
+
+				path := fmt.Sprintf("/repos/%s/issues?state=%s&type=issues&limit=50", r.FullName, state)
+				resp, err := c.doRequest(ctx, token, http.MethodGet, path, nil)
+				if err != nil {
+					mu.Lock()
+					if firstErr == nil {
+						firstErr = fmt.Errorf("fetching issues for %s: %w", r.FullName, err)
+					}
+					mu.Unlock()
+					return
 				}
-				mu.Unlock()
+				defer resp.Body.Close()
-				return
-			}
-			defer resp.Body.Close()
 
-			var prs []PullRequest
+				var issues []Issue
-			if err := json.NewDecoder(resp.Body).Decode(&prs); err != nil {
+				if err := json.NewDecoder(resp.Body).Decode(&issues); err != nil {
-				mu.Lock()
+					mu.Lock()
-				if firstErr == nil {
+					if firstErr == nil {
-					firstErr = fmt.Errorf("decoding PRs for %s: %w", r.FullName, err)
+						firstErr = fmt.Errorf("decoding issues for %s: %w", r.FullName, err)
+					}
+					mu.Unlock()
+					return
 				}
+
+				// Tag each issue with repo info.
+				for i := range issues {
+					issues[i].RepoOwner = r.Owner.Login
+					issues[i].RepoName = r.Name
+				}
+
+				mu.Lock()
+				allIssues = append(allIssues, issues...)
 				mu.Unlock()
-				return
+			}(repo)
-			}
+		}
 
-			for i := range prs {
+		wg.Wait()
-				prs[i].RepoOwner = r.Owner.Login
-				prs[i].RepoName = r.Name
-			}
 
-			mu.Lock()
+		if firstErr != nil {
-			allPRs = append(allPRs, prs...)
+			return PaginatedIssues{}, firstErr
-			mu.Unlock()
+		}
-		}(repo)
+
+		// Sort by updated time, newest first.
+		sort.Slice(allIssues, func(i, j int) bool {
+			return allIssues[i].UpdatedAt.After(allIssues[j].UpdatedAt)
+		})
+
+		c.setCache(cacheKey, allIssues)
 	}
 
-	wg.Wait()
+	// Paginate.
-
+	start := (page - 1) * PageSize
-	if firstErr != nil {
+	if start >= len(allIssues) {
-		return nil, firstErr
+		return PaginatedIssues{}, nil
+	}
+	end := start + PageSize
+	hasMore := end < len(allIssues)
+	if end > len(allIssues) {
+		end = len(allIssues)
 	}
 
-	sort.Slice(allPRs, func(i, j int) bool {
+	return PaginatedIssues{Issues: allIssues[start:end], HasMore: hasMore}, nil
-		return allPRs[i].UpdatedAt.After(allPRs[j].UpdatedAt)
+}
-	})
 
-	c.setCache(cacheKey, allPRs)
+// ListAllPullRequests fetches PRs across all repos in the given orgs.
-	return allPRs, nil
+// Results are paginated.
+func (c *Client) ListAllPullRequests(ctx context.Context, token string, orgs []string, state string, page int) (PaginatedPulls, error) {
+	if state == "" {
+		state = "open"
+	}
+	if page < 1 {
+		page = 1
+	}
+
+	cacheKey := fmt.Sprintf("pulls-%s-%s", state, strings.Join(orgs, ","))
+	var allPRs []PullRequest
+	if cached, ok := c.getFromCache(cacheKey); ok {
+		allPRs = cached.([]PullRequest)
+	} else {
+		var allRepos []Repo
+		for _, org := range orgs {
+			repos, err := c.ListOrgRepos(ctx, token, org)
+			if err != nil {
+				return PaginatedPulls{}, fmt.Errorf("listing repos for %s: %w", org, err)
+			}
+			allRepos = append(allRepos, repos...)
+		}
+
+		var mu sync.Mutex
+		sem := make(chan struct{}, c.maxConcurrent)
+		var wg sync.WaitGroup
+		var firstErr error
+
+		for _, repo := range allRepos {
+			wg.Add(1)
+			go func(r Repo) {
+				defer wg.Done()
+				sem <- struct{}{}
+				defer func() { <-sem }()
+
+				path := fmt.Sprintf("/repos/%s/pulls?state=%s&limit=50", r.FullName, state)
+				resp, err := c.doRequest(ctx, token, http.MethodGet, path, nil)
+				if err != nil {
+					mu.Lock()
+					if firstErr == nil {
+						firstErr = fmt.Errorf("fetching PRs for %s: %w", r.FullName, err)
+					}
+					mu.Unlock()
+					return
+				}
+				defer resp.Body.Close()
+
+				var prs []PullRequest
+				if err := json.NewDecoder(resp.Body).Decode(&prs); err != nil {
+					mu.Lock()
+					if firstErr == nil {
+						firstErr = fmt.Errorf("decoding PRs for %s: %w", r.FullName, err)
+					}
+					mu.Unlock()
+					return
+				}
+
+				for i := range prs {
+					prs[i].RepoOwner = r.Owner.Login
+					prs[i].RepoName = r.Name
+				}
+
+				mu.Lock()
+				allPRs = append(allPRs, prs...)
+				mu.Unlock()
+			}(repo)
+		}
+
+		wg.Wait()
+
+		if firstErr != nil {
+			return PaginatedPulls{}, firstErr
+		}
+
+		sort.Slice(allPRs, func(i, j int) bool {
+			return allPRs[i].UpdatedAt.After(allPRs[j].UpdatedAt)
+		})
+
+		c.setCache(cacheKey, allPRs)
+	}
+
+	// Paginate.
+	start := (page - 1) * PageSize
+	if start >= len(allPRs) {
+		return PaginatedPulls{}, nil
+	}
+	end := start + PageSize
+	hasMore := end < len(allPRs)
+	if end > len(allPRs) {
+		end = len(allPRs)
+	}
+
+	return PaginatedPulls{Pulls: allPRs[start:end], HasMore: hasMore}, nil
 }
 
 // GetTriageQueue returns unassigned issues and PRs needing review, sorted by priority.
 func (c *Client) GetTriageQueue(ctx context.Context, token string, orgs []string) ([]TriageItem, error) {
-	issues, err := c.ListAllIssues(ctx, token, orgs)
+	// Collect all open issues across all pages.
-	if err != nil {
+	var issues []Issue
-		return nil, fmt.Errorf("fetching issues for triage: %w", err)
+	for page := 1; ; page++ {
+		result, err := c.ListAllIssues(ctx, token, orgs, "open", page)
+		if err != nil {
+			return nil, fmt.Errorf("fetching issues for triage: %w", err)
+		}
+		issues = append(issues, result.Issues...)
+		if !result.HasMore {
+			break
+		}
 	}
 
-	prs, err := c.ListAllPullRequests(ctx, token, orgs)
+	// Collect all open PRs across all pages.
-	if err != nil {
+	var prs []PullRequest
-		return nil, fmt.Errorf("fetching PRs for triage: %w", err)
+	for page := 1; ; page++ {
+		result, err := c.ListAllPullRequests(ctx, token, orgs, "open", page)
+		if err != nil {
+			return nil, fmt.Errorf("fetching PRs for triage: %w", err)
+		}
+		prs = append(prs, result.Pulls...)
+		if !result.HasMore {
+			break
+		}
 	}
 
 	var queue []TriageItem
@@ -708,15 +778,20 @@ func (c *Client) SubmitReview(ctx context.Context, token, owner, repo string, in
 
 // CloseIssue closes an issue by setting its state to "closed".
 func (c *Client) CloseIssue(ctx context.Context, token, owner, repo string, index int64) error {
-	payload, err := json.Marshal(map[string]string{"state": "closed"})
+	return c.SetIssueState(ctx, token, owner, repo, index, "closed")
+}
+
+// SetIssueState sets an issue's state (e.g. "open" or "closed").
+func (c *Client) SetIssueState(ctx context.Context, token, owner, repo string, index int64, state string) error {
+	payload, err := json.Marshal(map[string]string{"state": state})
 	if err != nil {
-		return fmt.Errorf("marshaling close request: %w", err)
+		return fmt.Errorf("marshaling state change: %w", err)
 	}
 
 	path := fmt.Sprintf("/repos/%s/%s/issues/%d", owner, repo, index)
 	resp, err := c.doRequest(ctx, token, http.MethodPatch, path, strings.NewReader(string(payload)))
 	if err != nil {
-		return fmt.Errorf("closing issue: %w", err)
+		return fmt.Errorf("setting issue state: %w", err)
 	}
 	resp.Body.Close()
 
@@ -724,6 +799,11 @@ func (c *Client) CloseIssue(ctx context.Context, token, owner, repo string, inde
 	return nil
 }
 
+// AddComment creates a comment on an issue and returns the created Comment.
+func (c *Client) AddComment(ctx context.Context, token, owner, repo string, index int64, body string) (*Comment, error) {
+	return c.PostComment(ctx, token, owner, repo, index, body)
+}
+
 // PostComment creates a comment on an issue and returns the created Comment.
 func (c *Client) PostComment(ctx context.Context, token, owner, repo string, index int64, body string) (*Comment, error) {
 	payload, err := json.Marshal(map[string]string{"body": body})

internal/gitea/client_test.go

@@ -241,6 +241,76 @@ func TestCloseIssue(t *testing.T) {
 	}
 }
 
+func TestSetIssueState(t *testing.T) {
+	tests := []struct {
+		name  string
+		state string
+	}{
+		{"close", "closed"},
+		{"reopen", "open"},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+				if r.Method != http.MethodPatch {
+					t.Errorf("expected PATCH, got %s", r.Method)
+				}
+				if r.URL.Path != "/api/v1/repos/owner1/repo1/issues/42" {
+					t.Errorf("unexpected path: %s", r.URL.Path)
+				}
+
+				var body map[string]string
+				if err := json.NewDecoder(r.Body).Decode(&body); err != nil {
+					t.Fatalf("failed to decode body: %v", err)
+				}
+				if body["state"] != tt.state {
+					t.Errorf("expected state=%q, got %q", tt.state, body["state"])
+				}
+
+				w.WriteHeader(http.StatusOK)
+				json.NewEncoder(w).Encode(map[string]string{"state": tt.state})
+			}))
+			defer server.Close()
+
+			c := NewClient(server.URL)
+			c.setCache("issues-org1", "should-be-invalidated")
+
+			err := c.SetIssueState(context.Background(), "test-token", "owner1", "repo1", 42, tt.state)
+			if err != nil {
+				t.Fatalf("unexpected error: %v", err)
+			}
+
+			_, ok := c.getFromCache("issues-org1")
+			if ok {
+				t.Error("expected cache to be invalidated after SetIssueState")
+			}
+		})
+	}
+}
+
+func TestAddComment(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		comment := map[string]interface{}{
+			"id":         1,
+			"body":       "test",
+			"user":       map[string]string{"login": "testuser"},
+			"created_at": "2026-03-26T12:00:00Z",
+		}
+		json.NewEncoder(w).Encode(comment)
+	}))
+	defer server.Close()
+
+	c := NewClient(server.URL)
+	comment, err := c.AddComment(context.Background(), "test-token", "owner1", "repo1", 42, "test")
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if comment.Body != "test" {
+		t.Errorf("comment.Body = %q, want %q", comment.Body, "test")
+	}
+}
+
 func TestPostComment(t *testing.T) {
 	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		if r.Method != http.MethodPost {

internal/handlers/handlers.go

@@ -39,9 +39,12 @@ func (h *Handler) RegisterRoutes(mux *http.ServeMux) {
 	// Issues.
 	mux.HandleFunc("GET /issues", h.ListIssues)
 	mux.HandleFunc("GET /issues/new", h.NewIssue)
+	mux.HandleFunc("GET /issues/new/labels", h.NewIssueLabels)
 	mux.HandleFunc("POST /issues", h.CreateIssue)
 	mux.HandleFunc("POST /issues/{owner}/{repo}/{index}/labels", h.ApplyLabels)
 	mux.HandleFunc("POST /issues/{owner}/{repo}/{index}/close", h.CloseIssue)
+	mux.HandleFunc("POST /issues/{owner}/{repo}/{index}/state", h.SetIssueState)
+	mux.HandleFunc("POST /issues/{owner}/{repo}/{index}/comments", h.AddComment)
 	mux.HandleFunc("POST /issues/{owner}/{repo}/{index}/comment", h.AddComment)
 
 	// Issue detail.
@@ -243,6 +246,10 @@ func (h *Handler) ListIssues(w http.ResponseWriter, r *http.Request) {
 	if selectedState == "" {
 		selectedState = "open"
 	}
+	page, _ := strconv.Atoi(r.URL.Query().Get("page"))
+	if page < 1 {
+		page = 1
+	}
 
 	data := issuesData{
 		Orgs:          orgNames,
@@ -259,15 +266,38 @@ func (h *Handler) ListIssues(w http.ResponseWriter, r *http.Request) {
 			queryOrgs = []string{selectedOrg}
 		}
 
-		issues, err := h.Client.ListAllIssues(r.Context(), token, queryOrgs)
+		result, err := h.Client.ListAllIssues(r.Context(), token, queryOrgs, selectedState, page)
 		if err != nil {
 			slog.Error("failed to list issues", "error", err)
 			data.Error = "Error loading issues."
 		} else {
-			data.Issues = issues
+			data.Issues = result.Issues
+			data.HasMore = result.HasMore
+			if result.HasMore {
+				data.NextPage = page + 1
+			}
 		}
 	}
 
+	// For HTMX infinite-scroll requests (page > 1), return only the card fragment.
+	if isHTMX(r) && page > 1 {
+		tmpl, err := template.ParseFiles("internal/templates/issues.html")
+		if err != nil {
+			slog.Error("failed to parse issues template", "error", err)
+			http.Error(w, "template error", http.StatusInternalServerError)
+			return
+		}
+		var buf strings.Builder
+		if err := tmpl.ExecuteTemplate(&buf, "cards", data); err != nil {
+			slog.Error("failed to execute issues cards template", "error", err)
+			http.Error(w, "template error", http.StatusInternalServerError)
+			return
+		}
+		w.Header().Set("Content-Type", "text/html; charset=utf-8")
+		fmt.Fprint(w, buf.String())
+		return
+	}
+
 	tmpl, err := template.ParseFiles("internal/templates/issues.html")
 	if err != nil {
 		slog.Error("failed to parse issues template", "error", err)
@@ -294,10 +324,16 @@ func (h *Handler) ListPulls(w http.ResponseWriter, r *http.Request) {
 		Pulls       []giteaclient.PullRequest
 		Orgs        []string
 		SelectedOrg string
+		HasMore     bool
+		NextPage    int
 		Error       string
 	}
 
 	selectedOrg := r.URL.Query().Get("org")
+	page, _ := strconv.Atoi(r.URL.Query().Get("page"))
+	if page < 1 {
+		page = 1
+	}
 
 	data := pullsData{
 		Orgs:        orgNames,
@@ -312,15 +348,38 @@ func (h *Handler) ListPulls(w http.ResponseWriter, r *http.Request) {
 			queryOrgs = []string{selectedOrg}
 		}
 
-		prs, err := h.Client.ListAllPullRequests(r.Context(), token, queryOrgs)
+		result, err := h.Client.ListAllPullRequests(r.Context(), token, queryOrgs, "open", page)
 		if err != nil {
 			slog.Error("failed to list pull requests", "error", err)
 			data.Error = "Error loading pull requests."
 		} else {
-			data.Pulls = prs
+			data.Pulls = result.Pulls
+			data.HasMore = result.HasMore
+			if result.HasMore {
+				data.NextPage = page + 1
+			}
 		}
 	}
 
+	// For HTMX infinite-scroll requests (page > 1), return only the card fragment.
+	if isHTMX(r) && page > 1 {
+		tmpl, err := template.ParseFiles("internal/templates/pulls.html")
+		if err != nil {
+			slog.Error("failed to parse pulls template", "error", err)
+			http.Error(w, "template error", http.StatusInternalServerError)
+			return
+		}
+		var buf strings.Builder
+		if err := tmpl.ExecuteTemplate(&buf, "cards", data); err != nil {
+			slog.Error("failed to execute pulls cards template", "error", err)
+			http.Error(w, "template error", http.StatusInternalServerError)
+			return
+		}
+		w.Header().Set("Content-Type", "text/html; charset=utf-8")
+		fmt.Fprint(w, buf.String())
+		return
+	}
+
 	tmpl, err := template.ParseFiles("internal/templates/pulls.html")
 	if err != nil {
 		slog.Error("failed to parse pulls template", "error", err)
@@ -509,6 +568,38 @@ func (h *Handler) NewIssue(w http.ResponseWriter, r *http.Request) {
 	renderPage(w, r, "New Issue", "issues", buf.String())
 }
 
+// NewIssueLabels handles GET /issues/new/labels — returns label checkboxes for a repo.
+func (h *Handler) NewIssueLabels(w http.ResponseWriter, r *http.Request) {
+	token := getToken(r)
+	owner := r.URL.Query().Get("owner")
+	repo := r.URL.Query().Get("repo")
+
+	if owner == "" || repo == "" {
+		w.Header().Set("Content-Type", "text/html; charset=utf-8")
+		fmt.Fprint(w, `<span class="empty">Select a repository first.</span>`)
+		return
+	}
+
+	labels, err := h.Client.GetRepoLabels(r.Context(), token, owner, repo)
+	if err != nil {
+		slog.Error("failed to fetch labels", "error", err, "owner", owner, "repo", repo)
+		w.Header().Set("Content-Type", "text/html; charset=utf-8")
+		fmt.Fprint(w, `<span class="empty">Error loading labels.</span>`)
+		return
+	}
+
+	w.Header().Set("Content-Type", "text/html; charset=utf-8")
+	if len(labels) == 0 {
+		fmt.Fprint(w, `<span class="empty">No labels available for this repository.</span>`)
+		return
+	}
+
+	for _, l := range labels {
+		fmt.Fprintf(w, `<label style="display:inline-block;margin:0.25rem 0.5rem 0.25rem 0;cursor:pointer;"><input type="checkbox" name="label_ids" value="%d" style="margin-right:0.25rem;"> <span class="label" style="color:#%s;border:1px solid #%s">%s</span></label>`,
+			l.ID, template.HTMLEscapeString(l.Color), template.HTMLEscapeString(l.Color), template.HTMLEscapeString(l.Name))
+	}
+}
+
 // CreateIssue handles POST /issues.
 func (h *Handler) CreateIssue(w http.ResponseWriter, r *http.Request) {
 	token := getToken(r)
@@ -522,6 +613,15 @@ func (h *Handler) CreateIssue(w http.ResponseWriter, r *http.Request) {
 	title := r.FormValue("title")
 	body := r.FormValue("body")
 
+	// Parse label IDs from form checkboxes.
+	var labelIDs []int64
+	for _, idStr := range r.Form["label_ids"] {
+		id, err := strconv.ParseInt(idStr, 10, 64)
+		if err == nil {
+			labelIDs = append(labelIDs, id)
+		}
+	}
+
 	if owner == "" || repo == "" || title == "" {
 		if isHTMX(r) {
 			w.Header().Set("Content-Type", "text/html; charset=utf-8")
@@ -533,7 +633,7 @@ func (h *Handler) CreateIssue(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	issue, err := h.Client.CreateIssue(r.Context(), token, owner, repo, title, body, nil)
+	issue, err := h.Client.CreateIssue(r.Context(), token, owner, repo, title, body, labelIDs)
 	if err != nil {
 		slog.Error("failed to create issue", "error", err)
 		if isHTMX(r) {
@@ -630,6 +730,53 @@ func (h *Handler) CloseIssue(w http.ResponseWriter, r *http.Request) {
 	http.Redirect(w, r, fmt.Sprintf("/issues/%s/%s/%d", owner, repo, index), http.StatusSeeOther)
 }
 
+// SetIssueState handles POST /issues/{owner}/{repo}/{index}/state.
+func (h *Handler) SetIssueState(w http.ResponseWriter, r *http.Request) {
+	token := getToken(r)
+	owner := r.PathValue("owner")
+	repo := r.PathValue("repo")
+	indexStr := r.PathValue("index")
+
+	index, err := strconv.ParseInt(indexStr, 10, 64)
+	if err != nil {
+		http.Error(w, "invalid issue index", http.StatusBadRequest)
+		return
+	}
+
+	if err := r.ParseForm(); err != nil {
+		http.Error(w, "bad request", http.StatusBadRequest)
+		return
+	}
+
+	state := r.FormValue("state")
+	if state != "open" && state != "closed" {
+		http.Error(w, "state must be 'open' or 'closed'", http.StatusBadRequest)
+		return
+	}
+
+	if err := h.Client.SetIssueState(r.Context(), token, owner, repo, index, state); err != nil {
+		slog.Error("failed to set issue state", "error", err, "owner", owner, "repo", repo, "index", index, "state", state)
+		http.Error(w, "failed to update issue state", http.StatusInternalServerError)
+		return
+	}
+
+	if isHTMX(r) {
+		w.Header().Set("Content-Type", "text/html; charset=utf-8")
+		if state == "closed" {
+			fmt.Fprintf(w, `<span class="state-closed" id="issue-state">closed</span>
+<button class="btn btn-secondary" hx-post="/issues/%s/%s/%d/state" hx-vals='{"state":"open"}' hx-target="#state-section" hx-swap="innerHTML">Reopen Issue</button>`,
+				template.HTMLEscapeString(owner), template.HTMLEscapeString(repo), index)
+		} else {
+			fmt.Fprintf(w, `<span class="state-open" id="issue-state">open</span>
+<button class="btn btn-danger" hx-post="/issues/%s/%s/%d/state" hx-vals='{"state":"closed"}' hx-target="#state-section" hx-swap="innerHTML">Close Issue</button>`,
+				template.HTMLEscapeString(owner), template.HTMLEscapeString(repo), index)
+		}
+		return
+	}
+
+	http.Redirect(w, r, fmt.Sprintf("/issues/%s/%s/%d", owner, repo, index), http.StatusSeeOther)
+}
+
 // AddComment handles POST /issues/{owner}/{repo}/{index}/comment.
 func (h *Handler) AddComment(w http.ResponseWriter, r *http.Request) {
 	token := getToken(r)

internal/handlers/handlers_test.go

@@ -135,6 +135,54 @@ func TestSubmitReview_MissingEventType(t *testing.T) {
 	}
 }
 
+func TestSetIssueState_InvalidState(t *testing.T) {
+	h := newTestHandler()
+	mux := http.NewServeMux()
+	mux.HandleFunc("POST /issues/{owner}/{repo}/{index}/state", h.SetIssueState)
+
+	req := httptest.NewRequest(http.MethodPost, "/issues/org/repo/1/state", nil)
+	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+	w := httptest.NewRecorder()
+
+	mux.ServeHTTP(w, req)
+
+	if w.Code != http.StatusBadRequest {
+		t.Errorf("status = %d, want %d", w.Code, http.StatusBadRequest)
+	}
+}
+
+func TestSetIssueState_InvalidIndex(t *testing.T) {
+	h := newTestHandler()
+	mux := http.NewServeMux()
+	mux.HandleFunc("POST /issues/{owner}/{repo}/{index}/state", h.SetIssueState)
+
+	req := httptest.NewRequest(http.MethodPost, "/issues/org/repo/abc/state", nil)
+	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+	w := httptest.NewRecorder()
+
+	mux.ServeHTTP(w, req)
+
+	if w.Code != http.StatusBadRequest {
+		t.Errorf("status = %d, want %d", w.Code, http.StatusBadRequest)
+	}
+}
+
+func TestAddComment_EmptyBody(t *testing.T) {
+	h := newTestHandler()
+	mux := http.NewServeMux()
+	mux.HandleFunc("POST /issues/{owner}/{repo}/{index}/comments", h.AddComment)
+
+	req := httptest.NewRequest(http.MethodPost, "/issues/org/repo/1/comments", nil)
+	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+	w := httptest.NewRecorder()
+
+	mux.ServeHTTP(w, req)
+
+	if w.Code != http.StatusBadRequest {
+		t.Errorf("status = %d, want %d", w.Code, http.StatusBadRequest)
+	}
+}
+
 func contains(s, substr string) bool {
 	return len(s) >= len(substr) && searchString(s, substr)
 }

internal/templates/create_issue.html

@@ -20,6 +20,11 @@
     <input type="hidden" name="repo" id="repo-input">
   </div>
 
+  <div class="form-group" id="label-section" style="display:none;">
+    <label>Labels</label>
+    <div id="label-list"></div>
+  </div>
+
   <div class="form-group">
     <label for="title">Title</label>
     <input type="text" id="title" name="title" placeholder="Issue title" required>
@@ -52,7 +57,19 @@
       }
     }
 
-    repoSelect.addEventListener('change', splitOwnerRepo);
+    repoSelect.addEventListener('change', function() {
+      splitOwnerRepo();
+      var labelSection = document.getElementById('label-section');
+      var labelList = document.getElementById('label-list');
+      if (ownerInput.value && repoInput.value) {
+        labelList.innerHTML = '<span class="empty">Loading labels...</span>';
+        labelSection.style.display = 'block';
+        htmx.ajax('GET', '/issues/new/labels?owner=' + encodeURIComponent(ownerInput.value) + '&repo=' + encodeURIComponent(repoInput.value), {target: '#label-list', swap: 'innerHTML'});
+      } else {
+        labelSection.style.display = 'none';
+        labelList.innerHTML = '';
+      }
+    });
 
     // Validate before HTMX submit.
     document.getElementById('create-issue-form').addEventListener('htmx:configRequest', function(evt) {

internal/templates/issue_detail.html

@@ -3,7 +3,15 @@
 
 <div class="card">
   <div class="card-meta">
-    <span class="state-open">{{.Issue.State}}</span>
+    <span id="state-section">
+      {{if eq .Issue.State "closed"}}
+      <span class="state-closed" id="issue-state">{{.Issue.State}}</span>
+      <button class="btn btn-secondary" hx-post="/issues/{{.Issue.RepoOwner}}/{{.Issue.RepoName}}/{{.Issue.Number}}/state" hx-vals='{"state":"open"}' hx-target="#state-section" hx-swap="innerHTML">Reopen Issue</button>
+      {{else}}
+      <span class="state-open" id="issue-state">{{.Issue.State}}</span>
+      <button class="btn btn-danger" hx-post="/issues/{{.Issue.RepoOwner}}/{{.Issue.RepoName}}/{{.Issue.Number}}/state" hx-vals='{"state":"closed"}' hx-target="#state-section" hx-swap="innerHTML">Close Issue</button>
+      {{end}}
+    </span>
     <span>{{.Issue.RepoOwner}}/{{.Issue.RepoName}} #{{.Issue.Number}}</span>
     {{range .Issue.Labels}}
     <span class="label" style="color:#{{.Color}};border:1px solid #{{.Color}}">{{.Name}}</span>
@@ -18,6 +26,7 @@
 
 {{if .Comments}}
 <h2>Comments</h2>
+<div id="comments-list">
 {{range .Comments}}
 <div class="comment">
   <div class="comment-header">
@@ -27,8 +36,19 @@
   <div class="comment-body">{{.Body}}</div>
 </div>
 {{end}}
+</div>
+{{else}}
+<div id="comments-list"></div>
 {{end}}
 
+<div class="card" style="margin-top:1rem;">
+  <h2>Add Comment</h2>
+  <form hx-post="/issues/{{.Issue.RepoOwner}}/{{.Issue.RepoName}}/{{.Issue.Number}}/comments" hx-target="#comments-list" hx-swap="beforeend" hx-on::after-request="if(event.detail.successful) this.reset()">
+    <textarea name="body" rows="4" placeholder="Write a comment..." required style="width:100%;margin-bottom:0.5rem;"></textarea>
+    <button type="submit" class="btn btn-primary" style="width:auto;padding:0.5rem 1rem;">Comment</button>
+  </form>
+</div>
+
 <div class="card" style="margin-top:1rem;">
   <h2>Actions</h2>
   <form hx-post="/issues/{{.Issue.RepoOwner}}/{{.Issue.RepoName}}/{{.Issue.Number}}/labels" hx-swap="outerHTML" style="margin-bottom:0.5rem;">

internal/templates/issues.html

@@ -1,3 +1,25 @@
+{{define "cards"}}
+  {{range .Issues}}
+  <div class="card" hx-get="/issues/{{.RepoOwner}}/{{.RepoName}}/{{.Number}}" hx-target="#main-content" hx-swap="innerHTML" hx-push-url="true">
+    <div class="card-title">{{.Title}}</div>
+    <div class="card-meta">
+      <span>{{.RepoOwner}}/{{.RepoName}} #{{.Number}}</span>
+      {{range .Labels}}
+      <span class="label" style="color:#{{.Color}};border:1px solid #{{.Color}}">{{.Name}}</span>
+      {{end}}
+      {{if .Assignee}}
+      <span>{{.Assignee.Login}}</span>
+      {{end}}
+    </div>
+  </div>
+  {{end}}
+  {{if .HasMore}}
+  <div class="scroll-sentinel" hx-get="/issues?page={{.NextPage}}&org={{.SelectedOrg}}&state={{.SelectedState}}" hx-trigger="revealed" hx-swap="outerHTML" hx-target="this">
+    <div class="spinner htmx-indicator"></div>
+  </div>
+  {{end}}
+{{end}}
+
 {{define "content"}}
 <h1>Issues</h1>
 
@@ -20,25 +42,7 @@
 <p class="empty">No issues found.</p>
 {{else}}
 <div id="issue-list">
-  {{range .Issues}}
+  {{template "cards" .}}
-  <div class="card" hx-get="/issues/{{.RepoOwner}}/{{.RepoName}}/{{.Number}}" hx-target="#main-content" hx-swap="innerHTML" hx-push-url="true">
-    <div class="card-title">{{.Title}}</div>
-    <div class="card-meta">
-      <span>{{.RepoOwner}}/{{.RepoName}} #{{.Number}}</span>
-      {{range .Labels}}
-      <span class="label" style="color:#{{.Color}};border:1px solid #{{.Color}}">{{.Name}}</span>
-      {{end}}
-      {{if .Assignee}}
-      <span>{{.Assignee.Login}}</span>
-      {{end}}
-    </div>
-  </div>
-  {{end}}
-  {{if .HasMore}}
-  <div class="scroll-sentinel" hx-get="/issues?page={{.NextPage}}&org={{.SelectedOrg}}&state={{.SelectedState}}" hx-trigger="revealed" hx-swap="outerHTML" hx-target="this">
-    <div class="spinner htmx-indicator"></div>
-  </div>
-  {{end}}
 </div>
 {{end}}
 {{end}}

internal/templates/pulls.html

@@ -1,3 +1,28 @@
+{{define "cards"}}
+  {{range .Pulls}}
+  <div class="card" hx-get="/pulls/{{.RepoOwner}}/{{.RepoName}}/{{.Number}}" hx-target="#main-content" hx-swap="innerHTML" hx-push-url="true">
+    <div class="card-title">
+      <span class="type-badge type-pull">PR</span>
+      {{.Title}}
+    </div>
+    <div class="card-meta">
+      <span>{{.RepoOwner}}/{{.RepoName}} #{{.Number}}</span>
+      {{range .Labels}}
+      <span class="label" style="color:#{{.Color}};border:1px solid #{{.Color}}">{{.Name}}</span>
+      {{end}}
+      <span class="diff-add">+{{.Additions}}</span>
+      <span class="diff-del">-{{.Deletions}}</span>
+      {{if .Mergeable}}<span style="color:var(--accent-green);font-size:0.7rem;">mergeable</span>{{end}}
+    </div>
+  </div>
+  {{end}}
+  {{if .HasMore}}
+  <div class="scroll-sentinel" hx-get="/pulls?page={{.NextPage}}&org={{.SelectedOrg}}" hx-trigger="revealed" hx-swap="outerHTML" hx-target="this">
+    <div class="spinner htmx-indicator"></div>
+  </div>
+  {{end}}
+{{end}}
+
 {{define "content"}}
 <h1>Pull Requests</h1>
 
@@ -16,23 +41,7 @@
 <p class="empty">No open pull requests found.</p>
 {{else}}
 <div id="pull-list">
-  {{range .Pulls}}
+  {{template "cards" .}}
-  <div class="card" hx-get="/pulls/{{.RepoOwner}}/{{.RepoName}}/{{.Number}}" hx-target="#main-content" hx-swap="innerHTML" hx-push-url="true">
-    <div class="card-title">
-      <span class="type-badge type-pull">PR</span>
-      {{.Title}}
-    </div>
-    <div class="card-meta">
-      <span>{{.RepoOwner}}/{{.RepoName}} #{{.Number}}</span>
-      {{range .Labels}}
-      <span class="label" style="color:#{{.Color}};border:1px solid #{{.Color}}">{{.Name}}</span>
-      {{end}}
-      <span class="diff-add">+{{.Additions}}</span>
-      <span class="diff-del">-{{.Deletions}}</span>
-      {{if .Mergeable}}<span style="color:var(--accent-green);font-size:0.7rem;">mergeable</span>{{end}}
-    </div>
-  </div>
-  {{end}}
 </div>
 {{end}}
 {{end}}