Hmm - just realised I hadn't merged this, and it turns out the chrome app doesn't work with it at all:

espruino-rollup.browser.js:1 Uncaught EvalError: Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' blob: filesystem: chrome-extension-resource: 'wasm-eval'"

It doesn't like the use of new Function (or eval) in the code inside espruino-rollup.browser.js

Did you have it working somehow, or did you only try out the browser-only version?

Since you obviously know a bunch more about rollup than I do - do you know of a way to stop it using new Function inside the rollup bundle that it produces?

@gfwilliams It is terser code that contains new Function() which cannot be easily replaced.

The issue can be worked around via sandboxing (https://developer.chrome.com/apps/sandboxingEval). It involves an isolated sandbox.html iframe containing the rollup/terser new Function() code and a bidirectional window.postMessage()-based messaging channel to be able to reach the other sides of the frame.

I have modified the code to comply and tested as Chrome App as well as the browser-only version.

Closing based on #242