feat(widgets): bundle mathjs and uPlot for graphing widgets

[posthog]

Problem

• The assistant can author interactive widgets in notes, but the sandbox frame reaches only KaTeX. A function graph therefore means hand-rolling axes, ticks, and an expression parser in raw SVG per widget, so quality is a coin flip.
• The widget-authoring skill told the model KaTeX was the only bundled library and to draw everything else by hand.
• The feature was also invisible: no event recorded a widget render or a sandbox error, so demand for graphs could not be measured.

Changes

• Plot without hand-rolling. Bundle two browser builds the frame can load: math (mathjs) parses and evaluates the expression, uPlot draws the axes, grid, ticks, and lines.
• CSP stays strict. Both builds are eval-free, so script-src keeps 'unsafe-inline' only and never gains 'unsafe-eval'. The bundled URLs join the allow list; the <script>/<link> tags inject only when a widget references the library.
• Same copy path. scripts/copy-widget-libs.mjs now copies KaTeX, mathjs, and uPlot verbatim. The output stays generated and gitignored.
• Skill guidance. A new references/graphing.md shows a theme-aware function plot built from the bundled globals; SKILL.md points the model to it.
• Measurable. Two client events — widget_rendered on first render and widget_render_failed on a sandbox runtime error — each carry uses_katex / uses_mathjs / uses_uplot, so a graph widget is countable apart from an ordinary one.

Library	Global	Role	Uses eval
KaTeX	katex	Math markup	No
mathjs	math	Parse and evaluate expressions	No (v4+)
uPlot	uPlot	Axes, grid, and lines	No

Testing

• vitest widget suites cover the CSP allow list, the conditional tag injection, detectWidgetLibraries, and the first-render / runtime-error callbacks.
• tsc --noEmit, vp lint, and vp fmt are clean.

Not in scope

• The standalone in-workspace graph item (a new WORKSPACE_ITEM_TYPES member plus a database migration) is a deliberate follow-up. This PR delivers graphs inside notes.

Refs #841

Agent context

• Considered function-plot, which draws and parses in one library, but it ships CommonJS only and compiles expressions with new Function, which would force 'unsafe-eval' and a bundler step. mathjs and uPlot both ship eval-free browser builds that copy verbatim, so the sandbox keeps its threat model.

---

Created with PostHog Desktop from this inbox report, addressing #841.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: 9696e0db-3d96-4b6a-a003-4aacb05725ee

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

React Doctor found 1 new issue in 1 file · 1 warning · score 93 / 100 (Great) · 1 fixed · vs main

1 warning

src/features/workspaces/components/widget/WorkspaceWidgetSandbox.tsx

• ⚠️ L47 React function has high control-flow complexity no-high-complexity-react-function

_{Reviewed by React Doctor for commit bcb8fed. See inline comments for fixes.}