Parent: #52

Design: https://gitcode.com/urandon/gitcode-mcp/wiki/Admin-Web-UI-Design-2026-08-25.md

Goal

Add the optional, secure single-binary runtime foundation for the local admin Web UI.

Scope

• Scaffold web/ with Svelte 5, SvelteKit, TypeScript, Vite, and @sveltejs/adapter-static.
• Build a static SPA bundle and embed it in the Go binary with //go:embed all:assets.
• Serve embedded assets from a dedicated loopback admin listener owned by gitcode-mcp service run.
• Add gitcode-mcp admin open and gitcode-mcp admin status.
• Implement one-time launch-token exchange, bounded SameSite=Strict/HttpOnly session, CSRF protection, Host/Origin checks, CSP, no CORS, and loopback-only defaults.
• Add a minimal version/readiness endpoint and an application shell that reports API/version mismatch.
• Keep generated assets compilable for go install ./...; add deterministic rebuild verification in CI.
• Document the optional listener config and how to disable it.

Acceptance criteria

1. A released or source-installed gitcode-mcp binary opens the embedded UI without Node at runtime.
2. admin open attaches to the existing daemon; it does not start a second control plane or writer owner.
3. The listener defaults to a dynamic loopback port and rejects non-loopback binding unless an explicit unsafe override is supplied.
4. Browser mutations cannot be triggered cross-origin; Host, Origin, session, CSRF, CSP, and security-header behavior have tests.
5. One-time launch material is not retained in logs, API responses, browser history, or persistent config.
6. Hashed assets are immutable-cacheable while index.html revalidates; client routes fall back to embedded index.html.
7. go install ./..., go test ./..., frontend unit checks, an initial Playwright smoke, asset rebuild verification, and git diff --check pass.

Non-goals

• Product data views beyond the version/readiness shell.
• Hosted/remote administration or multi-user auth.
• A separate Node server or separate long-lived UI daemon.