Alternative to unsafe-eval

Sure. I am traveling at the moment, though, so I don’t know when I may find time to work on it.

The first thing I would do is use the same API as I currently have, just back it with a WebWorker and give the option to set timeouts (both for asynchronous “tasks” and continuous CPU bursts).

Then, I would like to implement another method on the Evaluator that allows you to expose Objects with methods or functions to the content scope, i.e. evaluator.expose('browser', 'tabs', browser.tabs) should give you a fully functional proxy to that API.