@emarcus It sounds like you're encountering a Content Security Policy (CSP) issue where the Chrome extension's CSP is preventing the evaluation of scripts not explicitly allowed. This is a common security feature to prevent potentially malicious code from executing. Here are a few steps you can take to work around this issue: 1. Modify CSP in the Extension's Manifest: You can try to loosen the CSP in your Chrome extension's manifest file by adding the source of the script to the

script-src

directive. However, this might not be the best practice due to security concerns. 2. Use a Nonce or Hash: If you have control over the server that serves the JavaScript file, you can include a nonce or a hash in the CSP header which matches the script you want to allow. 3. Content Security Policy Level 3: If you're using CSP level 3, you can use the

strict-dynamic

keyword, which allows scripts to load additional scripts if they are loaded by a trusted script. 4. Web Workers: Sometimes, loading the script inside a Web Worker can bypass the CSP directive, but this is not a guaranteed solution and may not work for all scripts. 5. Refactor the Code: If possible, refactor the code to avoid using

eval

or similar functions that can execute JavaScript from strings. This is the most secure approach. 6. Contact the Library Authors: Since you're using the

@vapi-ai/web

library, it might be worth reaching out to the library authors to see if they have a version of the library that doesn't use

eval

or if they can provide a workaround. Remember that any modifications to the CSP should be done with caution, as they can potentially open up security vulnerabilities. Always aim to keep your CSP as strict as possible while allowing the functionality you need. If you need further assistance with the integration or have more questions about VAPI, please let me know!

You can continue this conversation by mentioning me in the message.

Got it. Tagging @User for additional help.

I see, okay