NW.js Mixed Context Mode Interaction with Chromium's CSP Directives

Goal: Enable NW.js mixed context mode so that UI scripts can directly call Node.js modules such as fs while the application enforces a Content Security Policy that restricts script sources to same‑origin.

Constraint: In mixed context the Node.js globals are exposed on the window object, which may bypass the browser’s CSP script‑src checks; it is unclear whether CSP still governs the loading of Node.js‑provided code or if additional directives are required to prevent remote code execution.

Questions: Does the CSP script‑src directive affect Node.js module loading via require in mixed context? If not, which CSP directives (e.g., worker‑src, sandbox) should be applied to mitigate RCE risk? How can developers verify that CSP enforcement remains effective for both DOM scripts and Node.js APIs in a given NW.js release?