bug: [P2] trace deduplicates distinct files with the same relative path across working directories

[aoto-tech]

Scope

• Commit: 1a88d503e83ceb6688d41be1e00495abfd17f054
• Package: @cellfence/trace (0.4.0)
• Test environment: Windows, Node.js v24.12.0

Actual and expected behavior

When a process changes its working directory and writes result.json in each directory, distinct files are deduplicated under the same selector. This leaves files out of the recorded access list when processing multiple directories, for example in a batch job.

During validation, two write calls corresponding to work/result.json and outputs/result.json produced only one selector, result.json, in the evidence. The expected result is two observations that distinguish the files.

Reproduction

This reproduction uses the existing packages and packages/trace directories. Writes are mocked, so no files are created.

import fs from "node:fs";
import path from "node:path";

const root = process.cwd();
const writes = [];
fs.mkdirSync = () => undefined;
fs.writeFileSync = (filename, data) => {
  writes.push({ filename: path.resolve(filename), data: String(data) });
};
process.env.CELLFENCE_TRACE_COMMIT_SHA = "0000000000000000000000000000000000000000";
process.env.CELLFENCE_TRACE_OUT = path.join(root, "mock-evidence.json");
const trace = await import("./packages/trace/dist/index.js");
trace.installTrace();
process.chdir(path.join(root, "packages"));
fs.writeFileSync("result.json", "first");
process.chdir(path.join(root, "packages/trace"));
fs.writeFileSync("result.json", "second");
trace.flushEvidence();
const report = JSON.parse(writes.find(w => w.filename === process.env.CELLFENCE_TRACE_OUT).data);
console.log(writes.filter(w => w.filename !== process.env.CELLFENCE_TRACE_OUT).map(w => w.filename));
console.log(report.accesses);

Cause and fix requirements

normalizeSelector preserves relative paths without resolving them against the current working directory, and accessKey and the Map use those strings for deduplication. Paths need to be normalized against a stable reference when each access is observed so that files remain distinguishable after the working directory changes.

Validation scope

Verified using the trace implementation compiled from the specified commit. Because the environment was read-only, file creation and evidence writes were replaced with in-memory mocks. After building the repository, save the reproduction code as repro.mjs in the repository root and run it with node repro.mjs. The full test suite was not run.

If you find this repository useful, please consider giving it a star.