[dipto0321]

Summary

Snapshot JSON files leaked forever. nodeup upgrade wrote one snapshot per
installed Node version, and nothing in the codebase ever deleted one — the set
only grew, one file per (manager, node version) pair the user had ever had
installed, plus the orphan left behind when an upgrade failed partway.

This PR fixes the leak at the source and gives the user explicit control
over whatever is left on disk.

• Auto-reclaim. The upgrade now records every snapshot path it writes and
  deletes them in a deferred cleanup — but only once they have been
  consumed. A snapshot whose contents were never replayed survives, because on
  the failure path it is the only record of the user's globals and the
  "interrupted upgrade" warning points straight at it.
• nodeup packages cleanup. A new subcommand that lists the snapshot and
  migration-report files on disk and lets the user delete them one by one
  (multi-select) or all at once. --list shows what would go without deleting
  anything, --reports targets the report files instead, --yes skips the
  confirmation.
• --keep-snapshots / packages.keep_snapshots /
  NODEUP_PACKAGES_KEEP_SNAPSHOTS. An opt-out from the automatic deletion,
  for users who want the snapshots kept for their own rollback tooling.

Closes #128
Closes #129

Adjacent bugs found during the audit

Three more leaks/bugs surfaced while tracing the snapshot lifecycle. All are
fixed here:

1. Phantom "interrupted upgrade" sentinel. The sentinel
   (<DataDir>/upgrade-in-progress.json) was armed even when there was
   nothing to install. restoreSucceeded then never became true, so the
   sentinel was never cleared — and every later nodeup invocation warned
   about an interrupted upgrade that never happened. The sentinel is now
   armed only when there is actually something to install. (The live machine
   had a stale sentinel from 2026-10-22 warning on every run.)

2. getCurrentVersion captured the wrong version. It returned
   versions[0] — the lowest installed version, because ListInstalled
   sorts ascending. On a machine with Node 18 and Node 20, nodeup packages snapshot captured the (usually empty) 18 install and filed it under the
   20.x filename, producing a snapshot useless as a restore source. It now
   prefers the manager's active version (Manager.Current) and falls back
   to the highest installed version for managers that can't report one
   (nvm-windows returns "not implemented").

3. Non-atomic snapshot writes. A crash mid-write left a truncated file
   that ListSnapshots silently skipped — an invisible orphan that could
   never be cleaned up. Writes now go through a .tmp file plus a rename.

Design notes

• The cleanup listing is file-based, not snapshot-based. It walks
  <DataDir>/snapshots directly instead of going through ListSnapshots,
  so corrupt files and leftover .json.tmp siblings are visible and
  deletable too — those are exactly the orphans most likely to be missed.
• Deletion is confined to the target directory. DeleteSnapshotFile
  resolves both the directory and the path through filepath.Abs +
  filepath.EvalSymlinks, then uses a filepath.Rel-based containment
  check. A strings.HasPrefix check would wrongly treat /tmp/ab as inside
  /tmp/a; the same guard is used for the tar-extraction path (issue bug(npm-wrapper): no zip-slip guard, Windows/ARM64 passes preinstall but 404s at download, partial state on failure #65).
  Symlinks and non-regular files are refused.
• Multi-select lives in internal/ui. The ui.Prompt interface gained
  MultiSelect, with a plain-mode implementation (comma/space-separated
  numbers or labels, plus an all keyword) and a huh-backed fancy-mode
  one. internal/cli never imports huh directly, and a user abort in fancy
  mode degrades to "nothing selected" rather than an error.

Test plan

• go build ./...
• go vet ./...
• gofmt -l .
• go test ./...
• New unit tests:
  • internal/packages/cleanup_test.go — listing (valid, corrupt, .tmp,
    non-JSON), deletion (removes, missing-is-success, refuses paths
    outside the dir, refuses traversal, refuses symlinks), isInsideDir,
    filename parsing, report-file listing/deletion, atomic write.
  • internal/cli/cleanup_snapshots_test.go — --list deletes nothing,
    --all --yes deletes everything, interactive selection deletes only
    the picked files, blank selection and declined confirmation are
    no-ops, --reports targets the other directory, empty-dir case,
    formatBytes.
  • internal/cli/upgrade_snapshots_test.go — reclaim removes the files it
    is handed, one undeletable file doesn't stop the rest, the
    --keep-snapshots flag exists and defaults to false, packages cleanup is wired into the command tree, a snapshot whose contents
    were not replayed survives, and the snapshots and reports directories
    are genuinely distinct.
  • internal/cli/packages_test.go — getCurrentVersion prefers the active
    version, falls back to the highest installed, errors when there are
    none.
  • internal/ui/prompt_test.go — plain-mode multi-select: by number, by
    label, all, blank, EOF, presentation ordering, no options, rendering.
  • internal/config/*_test.go — packages.keep_snapshots through
    SetByKey, defaults, full-file override, partial-file preservation.
• Manual run against the live data dir: --list showed all three file
  kinds; multi-selecting by number deleted exactly the picked file;
  all deleted the rest.

[cocogitto-bot]

✔️ 75e873c...091fb18 - Conventional commits check succeeded.