codex-multi-auth 2.8.0 → 2.8.2

package/scripts/codex-app-router.js

@@ -36,6 +36,7 @@ function parseArgs(argv) {
 		host: "127.0.0.1",
 		port: 0,
 		statusPath: "",
+		identityToken: "",
 		statePath: "",
 		logPath: "",
 		maxLogBytes: DEFAULT_MAX_LOG_BYTES,
@@ -58,6 +59,11 @@ function parseArgs(argv) {
 			index += 1;
 			continue;
 		}
+		if (arg === "--identity-token") {
+			result.identityToken = next;
+			index += 1;
+			continue;
+		}
 		if (arg === "--state") {
 			result.statePath = next;
 			index += 1;
@@ -133,7 +139,16 @@ function writeStatus(statusPath, payload) {
 	}
 }
 
-function createStatusPayload({ state, proxyServer, error, stateRecord }) {
+function createStatusPayload({
+	state,
+	proxyServer,
+	error,
+	stateRecord,
+	startedAt,
+	statusPath,
+	routerScriptPath,
+	identityToken,
+}) {
 	const proxyStatus =
 		typeof proxyServer?.getStatus === "function" ? proxyServer.getStatus() : {};
 	const lastAccountIndex = proxyStatus.lastAccountIndex ?? null;
@@ -149,6 +164,15 @@ function createStatusPayload({ state, proxyServer, error, stateRecord }) {
 		kind: "codex-app-runtime-rotation-router",
 		state,
 		pid: process.pid,
+		startedAt,
+		statusPath: statusPath || readTrimmedString(stateRecord, "statusPath") || null,
+		identityToken:
+			identityToken || readTrimmedString(stateRecord, "identityToken") || null,
+		routerScriptPath:
+			routerScriptPath ||
+			readTrimmedString(stateRecord, "routerScriptPath") ||
+			process.argv[1] ||
+			null,
 		updatedAt: Date.now(),
 		baseUrl: proxyServer?.baseUrl ?? stateRecord?.baseUrl ?? null,
 		totalRequests: proxyStatus.totalRequests ?? 0,
@@ -232,6 +256,7 @@ function installLogBounds(maxBytes, logPath) {
 }
 
 async function main() {
+	const routerStartedAt = Date.now();
 	const args = parseArgs(process.argv.slice(2));
 	installLogBounds(args.maxLogBytes, args.logPath).unref?.();
 	const stateRecord = readState(args.statePath);
@@ -241,7 +266,16 @@ async function main() {
 		);
 		writeStatus(
 			args.statusPath,
-			createStatusPayload({ state: "error", proxyServer: null, error, stateRecord: null }),
+			createStatusPayload({
+				state: "error",
+				proxyServer: null,
+				error,
+				stateRecord: null,
+				startedAt: routerStartedAt,
+				statusPath: args.statusPath,
+				routerScriptPath: process.argv[1],
+				identityToken: args.identityToken,
+			}),
 		);
 		throw error;
 	}
@@ -272,7 +306,17 @@ async function main() {
 	const writeCurrentStatus = (state, error) => {
 		writeStatus(
 			args.statusPath || stateRecord?.statusPath || "",
-			createStatusPayload({ state, proxyServer, error, stateRecord }),
+			createStatusPayload({
+				state,
+				proxyServer,
+				error,
+				stateRecord,
+				startedAt: routerStartedAt,
+				statusPath: args.statusPath || stateRecord?.statusPath || "",
+				routerScriptPath: stateRecord?.routerScriptPath || process.argv[1],
+				identityToken:
+					args.identityToken || stateRecord?.identityToken || "",
+			}),
 		);
 	};
 

package/scripts/codex.js

@@ -80,6 +80,8 @@ const APP_SERVER_CONFIG_ARGS_ENV =
 	"CODEX_MULTI_AUTH_APP_SERVER_CONFIG_ARGS_JSON";
 const APP_RUNTIME_HELPER_STATUS_FILE =
 	RUNTIME_CONSTANTS.APP_RUNTIME_HELPER_STATUS_FILE;
+const APP_RUNTIME_HELPER_OWNER_FILE =
+	RUNTIME_CONSTANTS.APP_RUNTIME_HELPER_OWNER_FILE;
 const DEFAULT_APP_RUNTIME_HELPER_IDLE_MS = 12 * 60 * 60 * 1000;
 const DEFAULT_APP_RUNTIME_HELPER_DETACH_GRACE_MS = 5_000;
 const APP_RUNTIME_HELPER_LAUNCH_TIMEOUT_MS = 15_000;
@@ -110,6 +112,17 @@ let shadowHomeSyncLockOwnerWriteFailuresRemaining = Number.parseInt(
 	process.env.CODEX_MULTI_AUTH_TEST_SHADOW_LOCK_OWNER_WRITE_FAILURES ?? "0",
 	10,
 );
+let appServerShimFileCleanupBusyFailuresRemaining =
+	Number.parseInt(
+		process.env.CODEX_MULTI_AUTH_TEST_APP_SERVER_SHIM_FILE_CLEANUP_BUSY_FAILURES ??
+			"0",
+		10,
+	) || 0;
+let appServerShimCopyBusyFailuresRemaining =
+	Number.parseInt(
+		process.env.CODEX_MULTI_AUTH_TEST_APP_SERVER_SHIM_COPY_BUSY_FAILURES ?? "0",
+		10,
+	) || 0;
 const shadowHomeCleanupRetryMarkerDir =
 	(process.env.CODEX_MULTI_AUTH_TEST_SHADOW_RETRY_MARKER_DIR ?? "").trim();
 let warnedInvalidRuntimeRotationProxyEnv = false;
@@ -122,6 +135,7 @@ async function loadRuntimeConstants() {
 	const fallback = {
 		RUNTIME_ROTATION_PROXY_PROVIDER_ID: `${APP_SERVER_ACCOUNT_DISPLAY_NAME}-runtime-proxy`,
 		APP_RUNTIME_HELPER_STATUS_FILE: "runtime-rotation-app-helper.json",
+		APP_RUNTIME_HELPER_OWNER_FILE: "runtime-rotation-app-helper-owner.json",
 	};
 	try {
 		const mod = await import("../dist/lib/runtime-constants.js");
@@ -134,6 +148,10 @@ async function loadRuntimeConstants() {
 				typeof mod.APP_RUNTIME_HELPER_STATUS_FILE === "string"
 					? mod.APP_RUNTIME_HELPER_STATUS_FILE
 					: fallback.APP_RUNTIME_HELPER_STATUS_FILE,
+			APP_RUNTIME_HELPER_OWNER_FILE:
+				typeof mod.APP_RUNTIME_HELPER_OWNER_FILE === "string"
+					? mod.APP_RUNTIME_HELPER_OWNER_FILE
+					: fallback.APP_RUNTIME_HELPER_OWNER_FILE,
 		};
 	} catch {
 		// Keep wrapper startup resilient when dist has not been built yet.
@@ -171,6 +189,39 @@ function removeDirectoryWithRetry(targetPath) {
 	}
 }
 
+function withSynchronousFileOperationRetry(operation) {
+	for (
+		let attempt = 0;
+		attempt <= SHADOW_HOME_CLEANUP_BACKOFF_MS.length;
+		attempt += 1
+	) {
+		try {
+			return operation();
+		} catch (error) {
+			if (
+				!isRetryableShadowHomeCleanupError(error) ||
+				attempt === SHADOW_HOME_CLEANUP_BACKOFF_MS.length
+			) {
+				throw error;
+			}
+			sleepSync(SHADOW_HOME_CLEANUP_BACKOFF_MS[attempt]);
+		}
+	}
+}
+
+function maybeThrowSimulatedAppServerShimFileError(kind) {
+	const remaining =
+		kind === "copy"
+			? appServerShimCopyBusyFailuresRemaining
+			: appServerShimFileCleanupBusyFailuresRemaining;
+	if (remaining <= 0) return;
+	if (kind === "copy") appServerShimCopyBusyFailuresRemaining -= 1;
+	else appServerShimFileCleanupBusyFailuresRemaining -= 1;
+	const error = new Error(`simulated app-server shim ${kind} EBUSY`);
+	error.code = "EBUSY";
+	throw error;
+}
+
 /**
  * Best-effort async directory removal for hot-path callbacks (e.g. the
  * status-refresh child's close/error handlers, which fire on the PARENT event
@@ -3653,14 +3704,35 @@ function installRuntimeRotationAppServerCliShim(forwardedEnv, configArgs = []) {
 	const preloadPath = join(shimDir, "codex-multi-auth-app-server-preload.mjs");
 	try {
 		try {
-			rmSync(executablePath, { force: true });
+			withSynchronousFileOperationRetry(() => {
+				maybeThrowSimulatedAppServerShimFileError("cleanup");
+				rmSync(executablePath, { force: true });
+			});
 		} catch {
-			// Best-effort stale shim cleanup only.
+			// Best-effort stale shim cleanup only; the copy below will report a
+			// persistent failure without leaving a partially-created helper.
 		}
-		try {
-			linkSync(process.execPath, executablePath);
-		} catch {
-			copyFileSync(process.execPath, executablePath);
+		if (
+			process.platform === "win32" ||
+			(process.env.CODEX_MULTI_AUTH_TEST_FORCE_APP_SERVER_SHIM_COPY ?? "") === "1"
+		) {
+			// A Windows hard link to the running node.exe remains locked by the
+			// helper process itself, which prevents the shim directory from being
+			// removed during graceful helper shutdown. Use an independent image so
+			// the helper can clean up its app-server shim before exiting.
+			withSynchronousFileOperationRetry(() => {
+				maybeThrowSimulatedAppServerShimFileError("copy");
+				copyFileSync(process.execPath, executablePath);
+			});
+		} else {
+			try {
+				linkSync(process.execPath, executablePath);
+			} catch {
+				withSynchronousFileOperationRetry(() => {
+					maybeThrowSimulatedAppServerShimFileError("copy");
+					copyFileSync(process.execPath, executablePath);
+				});
+			}
 		}
 		if (process.platform !== "win32") {
 			chmodSync(executablePath, 0o755);
@@ -3704,6 +3776,19 @@ function resolveRuntimeRotationAppHelperStatusPath(env = process.env) {
 	return join(multiAuthDir, APP_RUNTIME_HELPER_STATUS_FILE);
 }
 
+function resolveRuntimeRotationAppHelperOwnerPath(env = process.env, helperPid) {
+	const multiAuthDir =
+		resolveOriginalMultiAuthDir(env) ?? join(resolveCodexHomeDir(env), "multi-auth");
+	const ownerFileName =
+		typeof helperPid === "number" && Number.isInteger(helperPid) && helperPid > 0
+			? APP_RUNTIME_HELPER_OWNER_FILE.replace(
+					/\.json$/i,
+					`.${helperPid}.json`,
+				)
+			: APP_RUNTIME_HELPER_OWNER_FILE;
+	return join(multiAuthDir, ownerFileName);
+}
+
 function writeOwnerOnlyJsonFileAtomicSync(targetPath, payload) {
 	const targetDir = dirname(targetPath);
 	mkdirSync(targetDir, { recursive: true });
@@ -3816,9 +3901,38 @@ function writeRuntimeRotationAppHelperStatus(payload, env = process.env) {
 	}
 }
 
+function writeRuntimeRotationAppHelperOwner(
+	identityToken,
+	helperPid,
+	env = process.env,
+) {
+	if (
+		typeof helperPid !== "number" ||
+		!Number.isInteger(helperPid) ||
+		helperPid < 1
+	) {
+		return;
+	}
+	try {
+		writeOwnerOnlyJsonFileAtomicSync(
+			resolveRuntimeRotationAppHelperOwnerPath(env, helperPid),
+			{
+				version: 1,
+				kind: "codex-app-runtime-rotation-helper-owner",
+				identityToken,
+				launcherPid: process.pid,
+				createdAt: Date.now(),
+			},
+		);
+	} catch {
+		// Best-effort metadata; an unavailable owner file must never stop the helper.
+	}
+}
+
 function createRuntimeRotationAppHelperStatus({
 	proxyServer,
 	startedAt,
+	identityToken,
 	idleTimeoutMs,
 	lastActivityAt,
 	state,
@@ -3838,6 +3952,8 @@ function createRuntimeRotationAppHelperStatus({
 		kind: "codex-app-runtime-rotation-helper",
 		state,
 		pid: process.pid,
+		scriptPath: process.argv[1] ?? null,
+		identityToken: identityToken || null,
 		startedAt,
 		updatedAt: Date.now(),
 		baseUrl: proxyServer?.baseUrl ?? null,
@@ -3855,7 +3971,7 @@ function createRuntimeRotationAppHelperStatus({
 	};
 }
 
-async function runRuntimeRotationAppHelper() {
+async function runRuntimeRotationAppHelper(identityToken = "") {
 	let proxyServer = null;
 	let runtimeContext = null;
 	let appServerShimDir = null;
@@ -3872,6 +3988,7 @@ async function runRuntimeRotationAppHelper() {
 			createRuntimeRotationAppHelperStatus({
 				proxyServer,
 				startedAt,
+				identityToken,
 				idleTimeoutMs,
 				lastActivityAt,
 				state,
@@ -4003,6 +4120,9 @@ function waitForRuntimeRotationAppHelperExit(helper, timeoutMs = 2_000) {
 			if (settled) return;
 			settled = true;
 			if (timer) clearTimeout(timer);
+			// Drop the listener when the timeout wins, so a helper that outlives the
+			// graceful window does not keep a live reference back into this process.
+			helper.off?.("close", finish);
 			resolve();
 		};
 		timer = setTimeout(finish, timeoutMs);
@@ -4010,16 +4130,49 @@ function waitForRuntimeRotationAppHelperExit(helper, timeoutMs = 2_000) {
 	});
 }
 
-function stopRuntimeRotationAppHelper(helper) {
-	if (!helper || helper.killed) {
-		return Promise.resolve();
-	}
+function hasRuntimeRotationAppHelperExited(helper) {
+	return helper.exitCode !== null || helper.signalCode !== null;
+}
+
+// Releases every handle the helper still holds in this process. The helper is
+// spawned with piped stdio, so those pipes keep the parent event loop alive on
+// their own — destroying and unref-ing them is what actually lets `mcodex` return
+// to the shell when the child ignores or outlives SIGTERM (#647).
+function releaseRuntimeRotationAppHelperResources(helper) {
+	helper.stdout?.destroy();
+	helper.stderr?.destroy();
 	try {
-		helper.kill("SIGTERM");
+		helper.unref();
 	} catch {
-		return Promise.resolve();
+		// Best-effort only.
+	}
+}
+
+async function stopRuntimeRotationAppHelper(helper) {
+	if (!helper) {
+		return;
+	}
+	if (hasRuntimeRotationAppHelperExited(helper)) {
+		releaseRuntimeRotationAppHelperResources(helper);
+		return;
+	}
+	if (!helper.killed) {
+		try {
+			helper.kill("SIGTERM");
+		} catch {
+			releaseRuntimeRotationAppHelperResources(helper);
+			return;
+		}
+	}
+	await waitForRuntimeRotationAppHelperExit(helper);
+	if (!hasRuntimeRotationAppHelperExited(helper)) {
+		try {
+			helper.kill("SIGKILL");
+		} catch {
+			// Best-effort force-stop once the graceful shutdown window has elapsed.
+		}
 	}
-	return waitForRuntimeRotationAppHelperExit(helper);
+	releaseRuntimeRotationAppHelperResources(helper);
 }
 
 function startRuntimeRotationAppHelper(baseContext, options = {}) {
@@ -4030,25 +4183,32 @@ function startRuntimeRotationAppHelper(baseContext, options = {}) {
 		let stdoutBuffer = "";
 		let stderrBuffer = "";
 		let settled = false;
+		const identityToken = randomBytes(24).toString("hex");
+		const helperEnv = {
+			...baseContext.env,
+			CODEX_MULTI_AUTH_DIR: resolveRuntimeRotationOriginalMultiAuthDir(
+				realCodexHome,
+				baseContext.env,
+			),
+			[APP_RUNTIME_HELPER_OWNER_PID_ENV]: String(process.pid),
+			[APP_RUNTIME_HELPER_REAL_CODEX_HOME_ENV]: realCodexHome,
+			[APP_RUNTIME_HELPER_USE_CANONICAL_HOME_ENV]:
+				options.useCanonicalHome === true ? "1" : "0",
+		};
 		const helper = spawn(
 			process.execPath,
-			[fileURLToPath(import.meta.url), INTERNAL_RUNTIME_ROTATION_APP_HELPER_ARG],
+			[
+				fileURLToPath(import.meta.url),
+				INTERNAL_RUNTIME_ROTATION_APP_HELPER_ARG,
+				identityToken,
+			],
 			{
-				env: {
-					...baseContext.env,
-					CODEX_MULTI_AUTH_DIR: resolveRuntimeRotationOriginalMultiAuthDir(
-						realCodexHome,
-						baseContext.env,
-					),
-					[APP_RUNTIME_HELPER_OWNER_PID_ENV]: String(process.pid),
-					[APP_RUNTIME_HELPER_REAL_CODEX_HOME_ENV]: realCodexHome,
-					[APP_RUNTIME_HELPER_USE_CANONICAL_HOME_ENV]:
-						options.useCanonicalHome === true ? "1" : "0",
-				},
+				env: helperEnv,
 				stdio: ["ignore", "pipe", "pipe"],
 				detached: true,
 			},
 		);
+		writeRuntimeRotationAppHelperOwner(identityToken, helper.pid, helperEnv);
 		let timeout = null;
 		const finish = (result) => {
 			if (settled) return;
@@ -4114,6 +4274,11 @@ async function createRuntimeRotationAppHelperContext(
 		options,
 	);
 	const helperEnv = message.env ?? {};
+	const helperShimDir =
+		typeof helperEnv.CODEX_CLI_PATH === "string" &&
+		helperEnv.CODEX_CLI_PATH.length > 0
+			? helperEnv.CODEX_CLI_PATH
+			: null;
 	const helperArgs = Array.isArray(message.args)
 		? message.args.filter((arg) => typeof arg === "string")
 		: [];
@@ -4127,7 +4292,22 @@ async function createRuntimeRotationAppHelperContext(
 			helper.unref();
 			return;
 		}
-		await stopRuntimeRotationAppHelper(helper);
+		try {
+			await stopRuntimeRotationAppHelper(helper);
+		} finally {
+			// The helper normally removes its app-server shim before exiting. On
+			// Windows, a descendant may still hold the copied codex.exe briefly
+			// after the helper closes, so retry the parent-owned cleanup once the
+			// helper shutdown path has completed as well.
+			if (helperShimDir) {
+				try {
+					removeDirectoryWithRetry(helperShimDir);
+				} catch {
+					// Best-effort cleanup; stale helper directories are swept on the
+					// next runtime app launch.
+				}
+			}
+		}
 	};
 
 	return {
@@ -4171,7 +4351,10 @@ async function createRuntimeRotationProxyContextIfEnabled(
 	if (isCodexAppCommand(rawArgs)) {
 		return createRuntimeRotationAppHelperContext(baseContext, configTomlModule);
 	}
-	if (isCodexInteractiveTuiCommand(rawArgs)) {
+	if (
+		isCodexInteractiveTuiCommand(rawArgs) ||
+		isCodexInteractiveResumeCommand(rawArgs)
+	) {
 		return createRuntimeRotationAppHelperContext(baseContext, configTomlModule, {
 			detachOnExit: true,
 			useCanonicalHome: true,
@@ -4375,6 +4558,17 @@ function isCodexInteractiveTuiCommand(rawArgs) {
 	return findForwardedCommand(rawArgs) === null;
 }
 
+// `resume` and `fork` are interactive TUI entry points that happen to carry a
+// forwarded subcommand, so the bare-invocation predicate above misses them. They
+// must not take the shadow-home transport: the shadow mirror deliberately omits the
+// runtime SQLite state (`isRuntimeRotationShadowHomeOmittedEntry`), so the requested
+// thread is absent from the shadow session index and the resumed TUI hangs on a
+// blank screen (#647).
+function isCodexInteractiveResumeCommand(rawArgs) {
+	const command = findForwardedCommand(rawArgs)?.command;
+	return command === "resume" || command === "fork";
+}
+
 function shouldUseRuntimeRoutingForForwardedArgs(rawArgs) {
 	if (!Array.isArray(rawArgs) || rawArgs.length === 0) {
 		return true;
@@ -4414,7 +4608,17 @@ function shouldUseRuntimeRoutingForForwardedArgs(rawArgs) {
 		);
 	}
 
-	if (command.command === "app" && hasHelpFlagAfterCommand(rawArgs, command.index)) {
+	// Request commands still print their help without making a single model
+	// request, so the help form skips the transport entirely: no proxy, no shadow
+	// home, no detached helper. This matters most for the interactive commands,
+	// which detach their helper on a clean exit — help always exits clean, so
+	// `resume --help` would otherwise strand a helper until its idle timeout. It is
+	// keyed off the help flag rather than the command, so a real run still routes
+	// through rotation, and it matches how `app-server` help is handled above (#647).
+	if (
+		requestCommands.has(command.command) &&
+		hasHelpFlagAfterCommand(rawArgs, command.index)
+	) {
 		return false;
 	}
 	if (requestCommands.has(command.command)) {
@@ -5106,7 +5310,7 @@ async function main() {
 
 	const rawArgs = process.argv.slice(2);
 	if (rawArgs[0] === INTERNAL_RUNTIME_ROTATION_APP_HELPER_ARG) {
-		return runRuntimeRotationAppHelper();
+		return runRuntimeRotationAppHelper(rawArgs[1] ?? "");
 	}
 
 	const normalizedArgs = normalizeAuthAlias(rawArgs);

package/scripts/install-codex-auth-utils.js

@@ -6,6 +6,8 @@ import { join } from "node:path";
 import process from "node:process";
 
 const PLUGIN_NAME = "codex-multi-auth";
+const LEGACY_PLUGIN_NAME = "@ndycode/codex-multi-auth";
+const PLUGIN_NAMES = [PLUGIN_NAME, LEGACY_PLUGIN_NAME];
 
 const TRUE_VALUES = new Set(["1", "true", "yes"]);
 const FALSE_VALUES = new Set(["0", "false", "no"]);
@@ -82,6 +84,7 @@ export function resolveInstallPaths(
 		configPath,
 		cacheDir,
 		cacheNodeModules: join(cacheDir, "node_modules", PLUGIN_NAME),
+		cacheLegacyNodeModules: join(cacheDir, "node_modules", "@ndycode", "codex-multi-auth"),
 		cacheBunLock: join(cacheDir, "bun.lock"),
 		cachePackageJson: join(cacheDir, "package.json"),
 	};
@@ -92,7 +95,9 @@ export function removePluginFromList(list) {
 	const entries = Array.isArray(list) ? list.filter(Boolean) : [];
 	return entries.filter((entry) => {
 		if (typeof entry !== "string") return true;
-		return entry !== PLUGIN_NAME && !entry.startsWith(`${PLUGIN_NAME}@`);
+		return !PLUGIN_NAMES.some(
+			(pluginName) => entry === pluginName || entry.startsWith(`${pluginName}@`),
+		);
 	});
 }
 
@@ -101,7 +106,9 @@ export function normalizePluginList(list) {
 	const entries = Array.isArray(list) ? list.filter(Boolean) : [];
 	const filtered = entries.filter((entry) => {
 		if (typeof entry !== "string") return true;
-		return entry !== PLUGIN_NAME && !entry.startsWith(`${PLUGIN_NAME}@`);
+		return !PLUGIN_NAMES.some(
+			(pluginName) => entry === pluginName || entry.startsWith(`${pluginName}@`),
+		);
 	});
 	const deduped = [];
 	const seen = new Set();

package/scripts/postinstall.js

@@ -33,6 +33,8 @@ const CI_ENV_KEYS = [
 export const INSTALL_NOTICE = [
 	"codex-multi-auth installed. Run `codex-multi-auth --help` to get started.",
 	"App integration (Codex app bind + launcher shortcuts) completes automatically on first run.",
+	"To remove it later, run `codex-multi-auth uninstall`, then `npm uninstall -g codex-multi-auth`.",
+	"`@ndycode/codex-multi-auth` is the legacy scoped package name; it does not remove this package.",
 ].join("\n");
 
 /**

package/scripts/preuninstall.js

@@ -189,6 +189,9 @@ export async function runPreuninstallCleanup(deps = {}) {
 			);
 			if (dryRun) {
 				log(`[dry-run] Would remove ${paths.cacheNodeModules}`);
+				if (paths.cacheLegacyNodeModules) {
+					log(`[dry-run] Would remove ${paths.cacheLegacyNodeModules}`);
+				}
 				if (bunLockSafe) {
 					log(`[dry-run] Would remove ${paths.cacheBunLock}`);
 				} else {
@@ -201,6 +204,14 @@ export async function runPreuninstallCleanup(deps = {}) {
 					await withFileOperationRetry(() =>
 						rm(paths.cacheNodeModules, { recursive: true, force: true }),
 					);
+					if (paths.cacheLegacyNodeModules) {
+						await withFileOperationRetry(() =>
+							rm(paths.cacheLegacyNodeModules, {
+								recursive: true,
+								force: true,
+							}),
+						);
+					}
 					if (bunLockSafe) {
 						await withFileOperationRetry(() =>
 							rm(paths.cacheBunLock, { force: true }),