On the content_security_policy property in the manifest file, thanks for pointing that out. The documentation is a bit ambiguous: "In general, CSP works as a black/whitelisting mechanism for resources loaded or executed by your extensions." I'll can revise our post.
I'd rather not eval the script contents since we lose the ability to get stack traces.
Chrome supports a special "//# sourceURL=..." comment that lets you name eval'd code, and allows it to remember breakpoints in the code. (And it plays nicely with source maps still!) However, there is another issue where Chrome doesn't actually activate remembered breakpoints until after the eval() call returns, so the trick is to wrap the code you're going to eval() with "(function(){"..."})" and then call it after it's returned by eval(). (That does require that the script doesn't rely on its top level variables automatically being globals attached to window, since it will now be running inside a function.) Here's an example: https://gist.github.com/AgentME/7369c93de844f8e785b0