New frontend scaffold: Vite + React + TS app at /app/ with auth and shell (Step 1)

.github/workflows/tests.yml

@@ -16,3 +16,21 @@ jobs:
           python-version: "3.12"
       - run: pip install -r requirements-dev.txt
       - run: python -m pytest -v
+  web:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    defaults:
+      run:
+        working-directory: web
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "22"
+          cache: npm
+          cache-dependency-path: web/package-lock.json
+      - run: npm ci
+      - run: npm run lint
+      - run: npm run typecheck
+      - run: npm test
+      - run: npm run build

.gitignore

@@ -14,3 +14,8 @@ __pycache__/
 # OS
 .DS_Store
 Thumbs.db
+
+# New frontend
+web/node_modules/
+web/dist/
+public/

.vercelignore

@@ -5,3 +5,4 @@ __pycache__/
 *.pyo
 .env
 .git
+web/node_modules

CLAUDE.md

@@ -15,6 +15,8 @@ health-dashboard/
 |- parse_health.py         # Local-only Apple Health XML parser
 |- vercel.json             # SPA rewrites for Vercel
 |- .env                    # Local env vars (gitignored)
+|- web/                    # New frontend (Vite + React + TS), served at /app/
+|- scripts/                # build-site.mjs, make_demo_seed.py
 |- supabase/               # migrations/, rollback/, tests/ (rls_check.sql), seed_demo.sql
 `- api/
    |- health.py            # GET /api/health
@@ -107,7 +109,7 @@ The frontend and chat prompt expect this structure:
 }
 ```
 
-`daily` is a dictionary keyed by date string, not an array.
+`daily` is a dictionary keyed by date string, not an array. Metrics and summary stats can be `null` (days or datasets with no data), and daily entries may also include `heart_rate_avg`, `heart_rate_min` and `heart_rate_max`.
 
 ---
 
@@ -168,6 +170,7 @@ Returns `{ url, anonKey }` for frontend initialization.
 ## Frontend Notes
 
 - `index.html` is the whole app.
+- The new app in `web/` fetches its Supabase config at runtime from `/api/supabase_config` and sends the user's JWT as `Authorization: Bearer` on `/api/*` calls. `AuthStatus` is `unconfigured` in local dev (no Supabase env), which skips login. `index.html` (legacy) is still the production app at `/`.
 - `chatConfig` tracks which server-side providers are configured and which models they use.
 - `currentChatMode` is `server`, `claude`, or `byok`.
 - The Insights page has a **Vertex / Claude / BYOK** 3-button model selector. Vertex and Claude are always clickable (server keys, free for users). BYOK is greyed out until the user saves a key.

README.md

@@ -107,6 +107,28 @@ Open `http://localhost:8080`.
 
 ---
 
+## New app (work in progress)
+
+A rebuilt frontend lives in `web/` (Vite + React + TypeScript) and is served at `/app/` next to the classic page, which stays at `/` until the new app reaches parity. Today it has sign-in (email/password and Google), an app shell, and a dashboard placeholder; charts, upload and chat are still in the classic app.
+
+Develop it with two terminals:
+
+```bash
+vercel dev                 # serves the Python API on :3000 (needs SUPABASE_* env vars)
+npm --prefix web install
+npm --prefix web run dev   # http://localhost:5173/app/ (proxies /api to :3000)
+```
+
+Checks: `npm --prefix web run lint`, `typecheck`, `test`, `build`. The Vercel build assembles both apps with `scripts/build-site.mjs`.
+
+For Google sign-in on the new app, add `https://<your-domain>/app/` (and any preview URLs) to the Redirect URLs in Supabase Authentication settings.
+
+Open it with the trailing slash (`/app/`).
+
+If the classic page is missing at `http://localhost:3000/` under `vercel dev`, build it first with `npm --prefix web run build && node scripts/build-site.mjs`.
+
+---
+
 ## Features
 
 - Dashboard views for steps, sleep, resting HR, and HRV